6.1.75-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainerPATCH 304/417 LoongArch: Fix and simplify fcsr initialization on execve()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xi Ruoyao <[email protected]>
commit c2396651309eba291c15e32db8fbe44c738b5921 upstream.
There has been a lingering bug in LoongArch Linux systems causing some GCC tests to intermittently fail (see Closes link). I've made a minimal reproducer:
zsh% cat measure.s
.align 4
.globl _start
_start:
movfcsr2gr $a0, $fcsr0
bstrpick.w $a0, $a0, 16, 16
beqz $a0, .ok
break 0
.ok:
li.w $a7, 93
syscall 0
zsh% cc mesaure.s -o measure -nostdlib
zsh% echo $((1.0/3))
0.33333333333333331
zsh% while ./measure; do ; doneThis while loop should not stop as POSIX is clear that execve must set fenv to the default, where FCSR should be zero. But in fact it will just stop after running for a while (normally less than 30 seconds). Note that "$((1.0/3))" is needed to reproduce this issue because it raises FE_INVALID and makes fcsr0 non-zero.
The problem is we are currently relying on SET_PERSONALITY2() to reset current->thread.fpu.fcsr. But SET_PERSONALITY2() is executed before start_thread which calls lose_fpu(0). We can see if kernel preempt is enabled, we may switch to another thread after SET_PERSONALITY2() but before lose_fpu(0). Then bad thing happens: during the thread switch the value of the fcsr0 register is stored into current->thread.fpu.fcsr, making it dirty again.
The issue can be fixed by setting current->thread.fpu.fcsr after lose_fpu(0) because lose_fpu() clears TIF_USEDFPU, then the thread switch won't touch current->thread.fpu.fcsr.
The only other architecture setting FCSR in SET_PERSONALITY2() is MIPS. I've ran a similar test on MIPS with mainline kernel and it turns out MIPS is buggy, too. Anyway MIPS do this for supporting different FP flavors (NaN encodings, etc.) which do not exist on LoongArch. So for LoongArch, we can simply remove the current->thread.fpu.fcsr setting from SET_PERSONALITY2() and do it in start_thread(), after lose_fpu(0).
The while loop failing with the mainline kernel has survived one hour after this change on LoongArch.
--- arch/loongarch/include/asm/elf.h | 5 ----- arch/loongarch/kernel/elf.c | 5 ----- arch/loongarch/kernel/process.c | 1 + 3 files changed, 1 insertion(+), 10 deletions(-)
arch/loongarch/include/asm/elf.h +0 -5
@@ -241,8 +241,6 @@ void loongarch_dump_regs64(u64 *uregs, cdo { \ current->thread.vdso = &vdso_info; \ \ -loongarch_set_personality_fcsr (state); \ - \if (personality (current->personality) !=PER_LINUX ) \set_personality (PER_LINUX ); \ }while (0 )
@@ -259,7 +257,6 @@ do { \clear_thread_flag (TIF_32BIT_ADDR ); \ \ current->thread.vdso = &vdso_info; \ -loongarch_set_personality_fcsr (state); \ \ p =personality (current->personality); \if (p !=PER_LINUX32 && p !=PER_LINUX ) \
@@ -340,6 +337,4 @@ extern int arch_elf_pt_proc(void *ehdr,extern int arch_check_elf (void *ehdr,bool has_interpreter,void *interp_ehdr,struct arch_elf_state *state); -extern void loongarch_set_personality_fcsr (struct arch_elf_state *state); -#endif /* _ASM_ELF_H */
arch/loongarch/kernel/elf.c +0 -5
@@ -23,8 +23,3 @@ int arch_check_elf(void *_ehdr, bool has {return 0 ; } - -void loongarch_set_personality_fcsr (struct arch_elf_state *state) -{ - current->thread.fpu.fcsr = boot_cpu_data.fpu_csr0; -}
arch/loongarch/kernel/process.c +1 -0
@@ -82,6 +82,7 @@ void start_thread(struct pt_regs *regs, euen = regs->csr_euen & ~(CSR_EUEN_FPEN ); regs->csr_euen = euen;lose_fpu (0 ); + current->thread.fpu.fcsr = boot_cpu_data.fpu_csr0;clear_thread_flag (TIF_LSX_CTX_LIVE );clear_thread_flag (TIF_LASX_CTX_LIVE );
Greg Kroah-Hartman
maintainerPATCH 305/417 iommu/arm-smmu-qcom: Add missing GMU entry to match table
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
commit afc95681c3068956fed1241a1ff1612c066c75ac upstream.
In some cases the firmware expects cbndx 1 to be assigned to the GMU, so we also want the default domain for the GMU to be an identy domain. This way it does not get a context bank assigned. Without this, both of_dma_configure() and drm/msm's iommu_domain_attach() will trigger allocating and configuring a context bank. So GMU ends up attached to both cbndx 1 and later cbndx 2. This arrangement seemingly confounds and surprises the firmware if the GPU later triggers a translation fault, resulting (on sc8280xp / lenovo x13s, at least) in the SMMU getting wedged and the GPU stuck without memory access.
--- drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 1 + 1 file changed, 1 insertion(+)
drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c +1 -0
@@ -243,6 +243,7 @@ static int qcom_adreno_smmu_init_contextstatic const struct of_device_id qcom_smmu_client_of_match[]__maybe_unused = { { .compatible ="qcom,adreno" }, + { .compatible ="qcom,adreno-gmu" }, { .compatible ="qcom,mdp4" }, { .compatible ="qcom,mdss" }, { .compatible ="qcom,sc7180-mdss" },
Greg Kroah-Hartman
maintainerPATCH 306/417 iommu/dma: Trace bounce buffer usage when mapping buffers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Isaac J. Manjarres <[email protected]>
commit a63c357b9fd56ad5fe64616f5b22835252c6a76a upstream.
When commit 82612d66d51d ("iommu: Allow the dma-iommu api to use bounce buffers") was introduced, it did not add the logic for tracing the bounce buffer usage from iommu_dma_map_page().
All of the users of swiotlb_tbl_map_single() trace their bounce buffer usage, except iommu_dma_map_page(). This makes it difficult to track SWIOTLB usage from that function. Thus, trace bounce buffer usage from iommu_dma_map_page().
--- drivers/iommu/dma-iommu.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/iommu/dma-iommu.c +3 -0
@@ -28,6 +28,7 @@#include <linux/spinlock.h> #include <linux/swiotlb.h> #include <linux/vmalloc.h> +#include <trace/events/swiotlb.h> #include "dma-iommu.h"
@@ -999,6 +1000,8 @@ static dma_addr_t iommu_dma_map_page(strreturn DMA_MAPPING_ERROR ; } +trace_swiotlb_bounced (dev, phys, size); + aligned_size =iova_align (iovad, size); phys =swiotlb_tbl_map_single (dev, phys, size, aligned_size,iova_mask (iovad), dir, attrs);
Greg Kroah-Hartman
maintainerPATCH 307/417 wifi: mt76: fix broken precal loading from MTD for mt7915
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Marangi <[email protected]>
commit e874a79250b39447765ac13272b67ac36ccf2a75 upstream.
Commit 495184ac91bb ("mt76: mt7915: add support for applying pre-calibration data") was fundamentally broken and never worked.
The idea (before NVMEM support) was to expand the MTD function and pass an additional offset. For normal EEPROM load the offset would always be
0. For the purpose of precal loading, an offset was passed that was internally the size of EEPROM, since precal data is right after the EEPROM.
Problem is that the offset value passed is never handled and is actually overwrite by
offset = be32_to_cpup(list); ret = mtd_read(mtd, offset, len, &retlen, eep);
resulting in the passed offset value always ingnored. (and even passing garbage data as precal as the start of the EEPROM is getting read)
Fix this by adding to the current offset value, the offset from DT to correctly read the piece of data at the requested location.
--- drivers/net/wireless/mediatek/mt76/eeprom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/eeprom.c +1 -1
@@ -62,7 +62,7 @@ int mt76_get_of_eeprom(struct mt76_dev * goto out_put_node; } - offset =be32_to_cpup (list); + offset +=be32_to_cpup (list); ret =mtd_read (mtd, offset, len, &retlen, eep);put_mtd_device (mtd);if (mtd_is_bitflip (ret))
Greg Kroah-Hartman
maintainerPATCH 308/417 wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
commit b3943b3c2971444364e03224cfc828c5789deada upstream.
Ever since introduction in the commit 0c8173385e54 ("rtl8192ce: Add new driver") the rtlwifi code has, according to comments, attempted to disable/enable ASPM of the upstream bridge by writing into its LNKCTL register. However, the code has never been correct because it performs the writes to the device instead of the upstream bridge.
Worse yet, the offset where the PCIe capabilities reside is derived from the offset of the upstream bridge. As a result, the write will use an offset on the device that does not relate to the LNKCTL register making the ASPM disable/enable code outright dangerous.
Because of those problems, there is no indication that the driver needs disable/enable ASPM on the upstream bridge. As the Capabilities offset is not correctly calculated for the write to target device's LNKCTL register, the code is not disabling/enabling device's ASPM either. Therefore, just remove the upstream bridge related ASPM disable/enable code entirely.
The upstream bridge related ASPM code was the only user of the struct mp_adapter members num4bytes, pcibridge_pciehdr_offset, and pcibridge_linkctrlreg so those are removed as well.
Note: This change does not remove the code related to changing the device's ASPM on purpose (which is independent of this flawed code related to upstream bridge's ASPM).
--- drivers/net/wireless/realtek/rtlwifi/pci.c | 58 ----------------------------- drivers/net/wireless/realtek/rtlwifi/pci.h | 5 -- 2 files changed, 1 insertion(+), 62 deletions(-)
drivers/net/wireless/realtek/rtlwifi/pci.c +1 -57
@@ -192,11 +192,8 @@ static void rtl_pci_disable_aspm(structstruct rtl_ps_ctl *ppsc =rtl_psc (rtl_priv (hw));struct rtl_pci *rtlpci =rtl_pcidev (rtl_pcipriv (hw));u8 pcibridge_vendor = pcipriv->ndis_adapter.pcibridge_vendor; -u8 num4bytes = pcipriv->ndis_adapter.num4bytes;/*Retrieve original configuration settings. */ u8 linkctrl_reg = pcipriv->ndis_adapter.linkctrl_reg; -u16 pcibridge_linkctrlreg = pcipriv->ndis_adapter. - pcibridge_linkctrlreg;u16 aspmlevel =0 ;u8 tmp_u1b =0 ;
@@ -221,16 +218,8 @@ static void rtl_pci_disable_aspm(struct/*Set corresponding value. */ aspmlevel |=BIT (0 ) |BIT (1 ); linkctrl_reg &= ~aspmlevel; - pcibridge_linkctrlreg &= ~(BIT (0 ) |BIT (1 ));_rtl_pci_platform_switch_device_pci_aspm (hw, linkctrl_reg); -udelay (50 ); - -/*4 Disable Pci Bridge ASPM */ -pci_write_config_byte (rtlpci->pdev, (num4bytes <<2 ), - pcibridge_linkctrlreg); - -udelay (50 ); }/*Enable RTL8192SE ASPM & Enable Pci Bridge ASPM for
@@ -245,9 +234,7 @@ static void rtl_pci_enable_aspm(struct istruct rtl_ps_ctl *ppsc =rtl_psc (rtl_priv (hw));struct rtl_pci *rtlpci =rtl_pcidev (rtl_pcipriv (hw));u8 pcibridge_vendor = pcipriv->ndis_adapter.pcibridge_vendor; -u8 num4bytes = pcipriv->ndis_adapter.num4bytes;u16 aspmlevel; -u8 u_pcibridge_aspmsetting;u8 u_device_aspmsetting;if (!ppsc->support_aspm)
@@ -259,25 +246,6 @@ static void rtl_pci_enable_aspm(struct ireturn ; } -/*4 Enable Pci Bridge ASPM */ - - u_pcibridge_aspmsetting = - pcipriv->ndis_adapter.pcibridge_linkctrlreg | - rtlpci->const_hostpci_aspm_setting; - -if (pcibridge_vendor ==PCI_BRIDGE_VENDOR_INTEL ) - u_pcibridge_aspmsetting &= ~BIT (0 ); - -pci_write_config_byte (rtlpci->pdev, (num4bytes <<2 ), - u_pcibridge_aspmsetting); - -rtl_dbg (rtlpriv,COMP_INIT ,DBG_LOUD , -"PlatformEnableASPM(): Write reg[%x] = %x\n" , - (pcipriv->ndis_adapter.pcibridge_pciehdr_offset +0x10 ), - u_pcibridge_aspmsetting); - -udelay (50 ); -/*Get ASPM level (with/without Clock Req) */ aspmlevel = rtlpci->const_devicepci_aspm_setting; u_device_aspmsetting = pcipriv->ndis_adapter.linkctrl_reg;
@@ -358,22 +326,6 @@ static bool rtl_pci_check_buddy_priv(strreturn tpriv !=NULL ; } -static void rtl_pci_get_linkcontrol_field (struct ieee80211_hw *hw) -{ -struct rtl_pci_priv *pcipriv =rtl_pcipriv (hw); -struct rtl_pci *rtlpci =rtl_pcidev (pcipriv); -u8 capabilityoffset = pcipriv->ndis_adapter.pcibridge_pciehdr_offset; -u8 linkctrl_reg; -u8 num4bbytes; - - num4bbytes = (capabilityoffset +0x10 ) /4 ; - -/*Read Link Control Register */ -pci_read_config_byte (rtlpci->pdev, (num4bbytes <<2 ), &linkctrl_reg); - - pcipriv->ndis_adapter.pcibridge_linkctrlreg = linkctrl_reg; -} -static void rtl_pci_parse_configuration (struct pci_dev *pdev,struct ieee80211_hw *hw) {
@@ -2033,12 +1985,6 @@ static bool _rtl_pci_find_adapter(structPCI_SLOT (bridge_pdev->devfn); pcipriv->ndis_adapter.pcibridge_funcnum =PCI_FUNC (bridge_pdev->devfn); - pcipriv->ndis_adapter.pcibridge_pciehdr_offset = -pci_pcie_cap (bridge_pdev); - pcipriv->ndis_adapter.num4bytes = - (pcipriv->ndis_adapter.pcibridge_pciehdr_offset +0x10 ) /4 ; - -rtl_pci_get_linkcontrol_field (hw);if (pcipriv->ndis_adapter.pcibridge_vendor ==PCI_BRIDGE_VENDOR_AMD ) {
@@ -2055,13 +2001,11 @@ static bool _rtl_pci_find_adapter(struct pdev->vendor, pcipriv->ndis_adapter.linkctrl_reg);rtl_dbg (rtlpriv,COMP_INIT ,DBG_DMESG , -"pci_bridge busnumber:devnumber:funcnumber:vendor:pcie_cap:link_ctl_reg:amd %d:%d:%d:%x:%x:%x:%x\n" , +"pci_bridge busnumber:devnumber:funcnumber:vendor:amd %d:%d:%d:%x:%x\n" , pcipriv->ndis_adapter.pcibridge_busnum, pcipriv->ndis_adapter.pcibridge_devnum, pcipriv->ndis_adapter.pcibridge_funcnum, pcibridge_vendors[pcipriv->ndis_adapter.pcibridge_vendor], - pcipriv->ndis_adapter.pcibridge_pciehdr_offset, - pcipriv->ndis_adapter.pcibridge_linkctrlreg, pcipriv->ndis_adapter.amd_l1_patch);rtl_pci_parse_configuration (pdev, hw);
drivers/net/wireless/realtek/rtlwifi/pci.h +0 -5
@@ -236,11 +236,6 @@ struct mp_adapter {u16 pcibridge_vendorid;u16 pcibridge_deviceid; -u8 num4bytes; - -u8 pcibridge_pciehdr_offset; -u8 pcibridge_linkctrlreg; -bool amd_l1_patch; };
Greg Kroah-Hartman
maintainerPATCH 309/417 wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
commit 5894d0089cbc146063dcc0239a78ede0a8142efb upstream.
The rtlwifi driver comes with custom code to write into PCIe Link Control register. RMW access for the Link Control register requires locking that is already provided by the standard PCIe capability accessors.
Convert the custom RMW code writing into LNKCTL register to standard RMW capability accessors. The accesses are changed to cover the full LNKCTL register instead of touching just a single byte of the register.
--- drivers/net/wireless/realtek/rtlwifi/pci.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-)
drivers/net/wireless/realtek/rtlwifi/pci.c +15 -6
@@ -164,21 +164,29 @@ static bool _rtl_pci_platform_switch_devstruct rtl_pci *rtlpci =rtl_pcidev (rtl_pcipriv (hw));struct rtl_hal *rtlhal =rtl_hal (rtl_priv (hw)); + value &=PCI_EXP_LNKCTL_ASPMC ; +if (rtlhal->hw_type !=HARDWARE_TYPE_RTL8192SE ) - value |=0x40 ; + value |=PCI_EXP_LNKCTL_CCC ; -pci_write_config_byte (rtlpci->pdev,0x80 , value); +pcie_capability_clear_and_set_word (rtlpci->pdev,PCI_EXP_LNKCTL , +PCI_EXP_LNKCTL_ASPMC | value, + value);return false; } -/*When we set 0x01 to enable clk request. Set 0x0 to disable clk req.*/ -static void _rtl_pci_switch_clk_req (struct ieee80211_hw *hw,u8 value) +/* @value is PCI_EXP_LNKCTL_CLKREQ_EN or 0 to enable/disable clk request. */ +static void _rtl_pci_switch_clk_req (struct ieee80211_hw *hw,u16 value) {struct rtl_pci *rtlpci =rtl_pcidev (rtl_pcipriv (hw));struct rtl_hal *rtlhal =rtl_hal (rtl_priv (hw)); -pci_write_config_byte (rtlpci->pdev,0x81 , value); + value &=PCI_EXP_LNKCTL_CLKREQ_EN ; + +pcie_capability_clear_and_set_word (rtlpci->pdev,PCI_EXP_LNKCTL , +PCI_EXP_LNKCTL_CLKREQ_EN , + value);if (rtlhal->hw_type ==HARDWARE_TYPE_RTL8192SE )udelay (100 );
@@ -259,7 +267,8 @@ static void rtl_pci_enable_aspm(struct iif (ppsc->reg_rfps_level &RT_RF_OFF_LEVL_CLK_REQ ) {_rtl_pci_switch_clk_req (hw, (ppsc->reg_rfps_level & -RT_RF_OFF_LEVL_CLK_REQ ) ?1 :0 ); +RT_RF_OFF_LEVL_CLK_REQ ) ? +PCI_EXP_LNKCTL_CLKREQ_EN :0 );RT_SET_PS_LEVEL (ppsc,RT_RF_OFF_LEVL_CLK_REQ ); }udelay (100 );
Greg Kroah-Hartman
maintainerPATCH 310/417 wifi: mwifiex: configure BSSID consistently when starting AP
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lin <[email protected]>
commit f0dd488e11e71ac095df7638d892209c629d9af2 upstream.
AP BSSID configuration is missing at AP start. Without this fix, FW returns STA interface MAC address after first init. When hostapd restarts, it gets MAC address from netdev before driver sets STA MAC to netdev again. Now MAC address between hostapd and net interface are different causes STA cannot connect to AP. After that MAC address of uap0 mlan0 become the same. And issue disappears after following hostapd restart (another issue is AP/STA MAC address become the same).
This patch fixes the issue cleanly.
--- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 2 ++ drivers/net/wireless/marvell/mwifiex/fw.h | 1 + drivers/net/wireless/marvell/mwifiex/ioctl.h | 1 + drivers/net/wireless/marvell/mwifiex/uap_cmd.c | 8 ++++++++ 4 files changed, 12 insertions(+)
drivers/net/wireless/marvell/mwifiex/cfg80211.c +2 -0
@@ -2046,6 +2046,8 @@ static int mwifiex_cfg80211_start_ap(strmwifiex_set_sys_config_invalid_data (bss_cfg); +memcpy (bss_cfg->mac_addr, priv->curr_addr,ETH_ALEN ); +if (params->beacon_interval) bss_cfg->beacon_period = params->beacon_interval;if (params->dtim_period)
drivers/net/wireless/marvell/mwifiex/fw.h +1 -0
@@ -165,6 +165,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {#define TLV_TYPE_STA_MAC_ADDR (PROPRIETARY_TLV_BASE_ID + 32)#define TLV_TYPE_BSSID (PROPRIETARY_TLV_BASE_ID + 35)#define TLV_TYPE_CHANNELBANDLIST (PROPRIETARY_TLV_BASE_ID + 42) +#define TLV_TYPE_UAP_MAC_ADDRESS (PROPRIETARY_TLV_BASE_ID + 43)#define TLV_TYPE_UAP_BEACON_PERIOD (PROPRIETARY_TLV_BASE_ID + 44)#define TLV_TYPE_UAP_DTIM_PERIOD (PROPRIETARY_TLV_BASE_ID + 45)#define TLV_TYPE_UAP_BCAST_SSID (PROPRIETARY_TLV_BASE_ID + 48)
drivers/net/wireless/marvell/mwifiex/ioctl.h +1 -0
@@ -107,6 +107,7 @@ struct mwifiex_uap_bss_param {u8 qos_info;u8 power_constraint;struct mwifiex_types_wmm_info wmm_info; +u8 mac_addr[ETH_ALEN ]; };enum {
drivers/net/wireless/marvell/mwifiex/uap_cmd.c +8 -0
@@ -468,6 +468,7 @@ void mwifiex_config_uap_11d(struct mwifistatic int mwifiex_uap_bss_param_prepare (u8 *tlv,void *cmd_buf,u16 *param_size) { +struct host_cmd_tlv_mac_addr *mac_tlv;struct host_cmd_tlv_dtim_period *dtim_period;struct host_cmd_tlv_beacon_period *beacon_period;struct host_cmd_tlv_ssid *ssid;
@@ -487,6 +488,13 @@ mwifiex_uap_bss_param_prepare(u8 *tlv, vint i;u16 cmd_size = *param_size; + mac_tlv = (struct host_cmd_tlv_mac_addr *)tlv; + mac_tlv->header.type =cpu_to_le16 (TLV_TYPE_UAP_MAC_ADDRESS ); + mac_tlv->header.len =cpu_to_le16 (ETH_ALEN ); +memcpy (mac_tlv->mac_addr, bss_cfg->mac_addr,ETH_ALEN ); + cmd_size +=sizeof (struct host_cmd_tlv_mac_addr ); + tlv +=sizeof (struct host_cmd_tlv_mac_addr ); +if (bss_cfg->ssid.ssid_len) { ssid = (struct host_cmd_tlv_ssid *)tlv; ssid->header.type =cpu_to_le16 (TLV_TYPE_UAP_SSID );
Greg Kroah-Hartman
maintainerPATCH 311/417 Revert "net: rtnetlink: Enslave device before bringing it up"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Dichtel <[email protected]>
commit ec4ffd100ffb396eca13ebe7d18938ea80f399c3 upstream.
This reverts commit a4abfa627c3865c37e036bccb681619a50d3d93c.
The patch broke:
Quoted 2 lines
ip link set dummy0 up
ip link set dummy0 master bond0 down
This last command is useful to be able to enslave an interface with only one netlink message.
After discussion, there is no good reason to support:
Quoted 2 lines
ip link set dummy0 down
ip link set dummy0 master bond0 up
because the bond interface already set the slave up when it is up.
--- net/core/rtnetlink.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
net/core/rtnetlink.c +7 -7
@@ -2797,13 +2797,6 @@ static int do_setlink(const struct sk_bucall_netdevice_notifiers (NETDEV_CHANGEADDR , dev); } -if (tb[IFLA_MASTER ]) { - err =do_set_master (dev,nla_get_u32 (tb[IFLA_MASTER ]), extack); -if (err) - goto errout; - status |=DO_SETLINK_MODIFIED ; - } -if (ifm->ifi_flags || ifm->ifi_change) { err =dev_change_flags (dev,rtnl_dev_combine_flags (dev, ifm), extack);
@@ -2811,6 +2804,13 @@ static int do_setlink(const struct sk_bu goto errout; } +if (tb[IFLA_MASTER ]) { + err =do_set_master (dev,nla_get_u32 (tb[IFLA_MASTER ]), extack); +if (err) + goto errout; + status |=DO_SETLINK_MODIFIED ; + } +if (tb[IFLA_CARRIER ]) { err =dev_change_carrier (dev,nla_get_u8 (tb[IFLA_CARRIER ]));if (err)
Greg Kroah-Hartman
maintainerPATCH 312/417 cxl/port: Fix decoder initialization when nr_targets > interleave_ways
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huang Ying <[email protected]>
commit d6488fee66472b468ed88d265b14aa3f04dc3bdf upstream.
The decoder_populate_targets() helper walks all of the targets in a port and makes sure they can be looked up in @target_map. Where @target_map is a lookup table from target position to target id (corresponding to a cxl_dport instance). However @target_map is only responsible for conveying the active dport instances as indicated by interleave_ways.
When nr_targets > interleave_ways it results in decoder_populate_targets() walking off the end of the valid entries in @target_map. Given target_map is initialized to 0 it results in the dport lookup failing if position 0 is not mapped to a dport with an id of 0:
cxl_port port3: Failed to populate active decoder targets cxl_port port3: Failed to add decoder
cxl_port port3: Failed to add decoder3.0
cxl_bus_probe: cxl_port port3: probe: -6
This bug also highlights that when the decoder's ->targets[] array is written in cxl_port_setup_targets() it is missing a hold of the targets_lock to synchronize against sysfs readers of the target list. A fix for that is saved for a later patch.
--- drivers/cxl/core/port.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cxl/core/port.c +1 -1
@@ -1403,7 +1403,7 @@ static int decoder_populate_targets(strureturn -EINVAL ;write_seqlock (&cxlsd->target_lock); -for (i =0 ; i < cxlsd->nr_targets; i++) { +for (i =0 ; i < cxlsd->cxld.interleave_ways; i++) {struct cxl_dport *dport =find_dport (port, target_map[i]);if (!dport) {
Greg Kroah-Hartman
maintainerPATCH 313/417 PCI/P2PDMA: Remove reference to pci_p2pdma_map_sg()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tadeusz Struk <[email protected]>
commit 9a000a72af75886e5de13f4edef7f0d788622e7d upstream.
Update Documentation/driver-api/pci/p2pdma.rst doc and remove references to obsolete p2pdma mapping functions.
--- Documentation/driver-api/pci/p2pdma.rst | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-)
Documentation/driver-api/pci/p2pdma.rst +3 -13
@@ -83,19 +83,9 @@ this to include other types of resources like doorbells. Client Drivers -------------- -A client driver typically only has to conditionally change its DMA map -routine to use the mapping function :c:func:`pci_p2pdma_map_sg()` instead -of the usual :c:func:`dma_map_sg()` function. Memory mapped in this -way does not need to be unmapped. - -The client may also, optionally, make use of -:c:func:`is_pci_p2pdma_page()` to determine when to use the P2P mapping -functions and when to use the regular mapping functions. In some -situations, it may be more appropriate to use a flag to indicate a -given request is P2P memory and map appropriately. It is important to -ensure that struct pages that back P2P memory stay out of code that -does not have support for them as other code may treat the pages as -regular memory which may not be appropriate. +A client driver only has to use the mapping API :c:func:`dma_map_sg()` +and :c:func:`dma_unmap_sg()` functions as usual, and the implementation +will do the right thing for the P2P capable memory. Orchestrator Drivers
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 314/417 PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
commit 2217fffcd63f86776c985d42e76daa43a56abdf1 upstream.
Commit 6f5e193bfb55 ("PCI: dwc: Fix dw_pcie_ep_raise_msix_irq() to get correct MSI-X table address") modified dw_pcie_ep_raise_msix_irq() to support iATUs which require a specific alignment.
However, this support cannot have been properly tested.
The whole point is for the iATU to map an address that is aligned, using dw_pcie_ep_map_addr(), and then let the writel() write to ep->msi_mem + aligned_offset.
Thus, modify the address that is mapped such that it is aligned. With this change, dw_pcie_ep_raise_msix_irq() matches the logic in dw_pcie_ep_raise_msi_irq().
--- drivers/pci/controller/dwc/pcie-designware-ep.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/controller/dwc/pcie-designware-ep.c +1 -0
@@ -600,6 +600,7 @@ int dw_pcie_ep_raise_msix_irq(struct dw_ } aligned_offset = msg_addr & (epc->mem->window.page_size -1 ); + msg_addr &= ~aligned_offset; ret =dw_pcie_ep_map_addr (epc, func_no,0 , ep->msi_mem_phys, msg_addr, epc->mem->window.page_size);if (ret)
Greg Kroah-Hartman
maintainerPATCH 315/417 PCI: mediatek: Clear interrupt status before dispatching handler
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: qizhong cheng <[email protected]>
commit 4e11c29873a8a296a20f99b3e03095e65ebf897d upstream.
We found a failure when using the iperf tool during WiFi performance testing, where some MSIs were received while clearing the interrupt status, and these MSIs cannot be serviced.
The interrupt status can be cleared even if the MSI status remains pending. As such, given the edge-triggered interrupt type, its status should be cleared before being dispatched to the handler of the underling device.
--- drivers/pci/controller/pcie-mediatek.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/pci/controller/pcie-mediatek.c +8 -2
@@ -617,12 +617,18 @@ static void mtk_pcie_intr_handler(structif (status &MSI_STATUS ){unsigned long imsi_status; +/* +* The interrupt status can be cleared even if the +* MSI status remains pending. As such, given the +* edge-triggered interrupt type, its status should +* be cleared before being dispatched to the +* handler of the underlying device. +*/ +writel (MSI_STATUS , port->base +PCIE_INT_STATUS );while ((imsi_status =readl (port->base +PCIE_IMSI_STATUS ))) {for_each_set_bit (bit, &imsi_status,MTK_MSI_IRQS_NUM )generic_handle_domain_irq (port->inner_domain, bit); } -/* Clear MSI interrupt status */ -writel (MSI_STATUS , port->base +PCIE_INT_STATUS ); } }
Greg Kroah-Hartman
maintainerPATCH 316/417 x86/kvm: Do not try to disable kvmclock if it was not enabled
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill A. Shutemov <[email protected]>
commit 1c6d984f523f67ecfad1083bb04c55d91977bb15 upstream.
kvm_guest_cpu_offline() tries to disable kvmclock regardless if it is present in the VM. It leads to write to a MSR that doesn't exist on some configurations, namely in TDX guest:
unchecked MSR access error: WRMSR to 0x12 (tried to write 0x0000000000000000) at rIP: 0xffffffff8110687c (kvmclock_disable+0x1c/0x30)
kvmclock enabling is gated by CLOCKSOURCE and CLOCKSOURCE2 KVM paravirt features.
Do not disable kvmclock if it was not enabled.
Message-Id: <[email protected]>
--- arch/x86/kernel/kvmclock.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
arch/x86/kernel/kvmclock.c +8 -4
@@ -24,8 +24,8 @@static int kvmclock__initdata =1 ;static int kvmclock_vsyscall__initdata =1 ; -static int msr_kvm_system_time__ro_after_init =MSR_KVM_SYSTEM_TIME ; -static int msr_kvm_wall_clock__ro_after_init =MSR_KVM_WALL_CLOCK ; +static int msr_kvm_system_time__ro_after_init ; +static int msr_kvm_wall_clock__ro_after_init ;static u64 kvm_sched_clock_offset__ro_after_init ;static int __init parse_no_kvmclock (char *arg)
@@ -195,7 +195,8 @@ static void kvm_setup_secondary_clock(vovoid kvmclock_disable (void ) { -native_write_msr (msr_kvm_system_time,0 ,0 ); +if (msr_kvm_system_time) +native_write_msr (msr_kvm_system_time,0 ,0 ); }static void __init kvmclock_init_mem (void )
@@ -294,7 +295,10 @@ void __init kvmclock_init(void)if (kvm_para_has_feature (KVM_FEATURE_CLOCKSOURCE2 )) { msr_kvm_system_time =MSR_KVM_SYSTEM_TIME_NEW ; msr_kvm_wall_clock =MSR_KVM_WALL_CLOCK_NEW ; - }else if (!kvm_para_has_feature (KVM_FEATURE_CLOCKSOURCE )) { + }else if (kvm_para_has_feature (KVM_FEATURE_CLOCKSOURCE )) { + msr_kvm_system_time =MSR_KVM_SYSTEM_TIME ; + msr_kvm_wall_clock =MSR_KVM_WALL_CLOCK ; + }else {return ; }
Greg Kroah-Hartman
maintainerPATCH 317/417 KVM: arm64: vgic-v4: Restore pending state on host userspace write
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit 7b95382f965133ef61ce44aaabc518c16eb46909 upstream.
When the VMM writes to ISPENDR0 to set the state pending state of an SGI, we fail to convey this to the HW if this SGI is already backed by a GICv4.1 vSGI.
This is a bit of a corner case, as this would only occur if the vgic state is changed on an already running VM, but this can apparently happen across a guest reset driven by the VMM.
Fix this by always writing out the pending_latch value to the HW, and reseting it to false.
--- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-)
arch/arm64/kvm/vgic/vgic-mmio-v3.c +17 -10
@@ -365,19 +365,26 @@ static int vgic_v3_uaccess_write_pendingstruct vgic_irq *irq =vgic_get_irq (vcpu->kvm, vcpu, intid + i);raw_spin_lock_irqsave (&irq->irq_lock, flags); -if (test_bit (i, &val)) { -/* -* pending_latch is set irrespective of irq type -* (level or edge) to avoid dependency that VM should -* restore irq config before pending info. -*/ - irq->pending_latch = true; -vgic_queue_irq_unlock (vcpu->kvm, irq, flags); - }else { + +/* +* pending_latch is set irrespective of irq type +* (level or edge) to avoid dependency that VM should +* restore irq config before pending info. +*/ + irq->pending_latch =test_bit (i, &val); + +if (irq->hw &&vgic_irq_is_sgi (irq->intid)) { +irq_set_irqchip_state (irq->host_irq, +IRQCHIP_STATE_PENDING , + irq->pending_latch); irq->pending_latch = false; -raw_spin_unlock_irqrestore (&irq->irq_lock, flags); } +if (irq->pending_latch) +vgic_queue_irq_unlock (vcpu->kvm, irq, flags); +else +raw_spin_unlock_irqrestore (&irq->irq_lock, flags); +vgic_put_irq (vcpu->kvm, irq); }
Greg Kroah-Hartman
maintainerPATCH 318/417 KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Upton <[email protected]>
commit ad362fe07fecf0aba839ff2cc59a3617bd42c33f upstream.
There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgic_its_check_cache() does not elevate the refcount on the vgic_irq before dropping the lock that serializes refcount changes.
Have vgic_its_check_cache() raise the refcount on the returned vgic_irq and add the corresponding decrement after queueing the interrupt.
--- arch/arm64/kvm/vgic/vgic-its.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/arm64/kvm/vgic/vgic-its.c +5 -0
@@ -584,7 +584,11 @@ static struct vgic_irq *vgic_its_check_cunsigned long flags;raw_spin_lock_irqsave (&dist->lpi_list_lock, flags); + irq =__vgic_its_check_cache (dist, db, devid, eventid); +if (irq) +vgic_get_irq_kref (irq); +raw_spin_unlock_irqrestore (&dist->lpi_list_lock, flags);return irq;
@@ -763,6 +767,7 @@ int vgic_its_inject_cached_translation(sraw_spin_lock_irqsave (&irq->irq_lock, flags); irq->pending_latch = true;vgic_queue_irq_unlock (kvm, irq, flags); +vgic_put_irq (kvm, irq);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 319/417 iio: adc: ad7091r: Pass iio_dev to event handler
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcelo Schmitt <[email protected]>
commit a25a7df518fc71b1ba981d691e9322e645d2689c upstream.
Previous version of ad7091r event handler received the ADC state pointer and retrieved the iio device from driver data field with dev_get_drvdata(). However, no driver data have ever been set, which led to null pointer dereference when running the event handler.
Pass the iio device to the event handler and retrieve the ADC state struct from it so we avoid the null pointer dereference and save the driver from filling the driver data field.
--- drivers/iio/adc/ad7091r-base.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/iio/adc/ad7091r-base.c +3 -3
@@ -174,8 +174,8 @@ static const struct iio_info ad7091r_infstatic irqreturn_t ad7091r_event_handler (int irq,void *private) { -struct ad7091r_state *st = (struct ad7091r_state *) private; -struct iio_dev *iio_dev =dev_get_drvdata (st->dev); +struct iio_dev *iio_dev = private; +struct ad7091r_state *st =iio_priv (iio_dev);unsigned int i, read_val;int ret;s64 timestamp =iio_get_time_ns (iio_dev);
@@ -234,7 +234,7 @@ int ad7091r_probe(struct device *dev, coif (irq) { ret =devm_request_threaded_irq (dev, irq,NULL , ad7091r_event_handler, -IRQF_TRIGGER_FALLING |IRQF_ONESHOT , name, st); +IRQF_TRIGGER_FALLING |IRQF_ONESHOT , name, iio_dev);if (ret)return ret; }
Greg Kroah-Hartman
maintainerPATCH 320/417 HID: wacom: Correct behavior when processing some confidence == false touches
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gerecke <[email protected]>
commit 502296030ec6b0329e00f9fb15018e170cc63037 upstream.
There appear to be a few different ways that Wacom devices can deal with confidence:
1. If the device looses confidence in a touch, it will first clear the tipswitch flag in one report, and then clear the confidence flag in a second report. This behavior is used by e.g. DTH-2452.
2. If the device looses confidence in a touch, it will clear both the tipswitch and confidence flags within the same report. This behavior is used by some AES devices.
3. If the device looses confidence in a touch, it will clear *only* the confidence bit. The tipswitch bit will remain set so long as the touch is tracked. This behavior may be used in future devices.
The driver does not currently handle situation 3 properly. Touches that loose confidence will remain "in prox" and essentially frozen in place until the tipswitch bit is finally cleared. Not only does this result in userspace seeing a stuck touch, but it also prevents pen arbitration from working properly (the pen won't send events until all touches are up, but we don't currently process events from non-confident touches).
This commit centralizes the checking of the confidence bit in the wacom_wac_finger_slot() function and has 'prox' depend on it. In the case where situation 3 is encountered, the treat the touch as though it was removed, allowing both userspace and the pen arbitration to act normally.
--- drivers/hid/wacom_wac.c | 32 ++++---------------------------- 1 file changed, 4 insertions(+), 28 deletions(-)
drivers/hid/wacom_wac.c +4 -28
@@ -2646,8 +2646,8 @@ static void wacom_wac_finger_slot(struct {struct hid_data *hid_data = &wacom_wac->hid_data;bool mt = wacom_wac->features.touch_max >1 ; -bool prox = hid_data->tipswitch && -report_touch_events (wacom_wac); +bool touch_down = hid_data->tipswitch && hid_data->confidence; +bool prox = touch_down &&report_touch_events (wacom_wac);if (touch_is_muted (wacom_wac)) {if (!wacom_wac->shared->touch_down)
@@ -2697,24 +2697,6 @@ static void wacom_wac_finger_slot(struct } } -static bool wacom_wac_slot_is_active (struct input_dev *dev,int key) -{ -struct input_mt *mt = dev->mt; -struct input_mt_slot *s; - -if (!mt) -return false; - -for (s = mt->slots; s != mt->slots + mt->num_slots; s++) { -if (s->key == key && -input_mt_get_value (s,ABS_MT_TRACKING_ID ) >=0 ) { -return true; - } - } - -return false; -} -static void wacom_wac_finger_event (struct hid_device *hdev,struct hid_field *field,struct hid_usage *usage,__s32 value) {
@@ -2765,14 +2747,8 @@ static void wacom_wac_finger_event(struc }if (usage->usage_index +1 == field->report_count) { -if (equivalent_usage == wacom_wac->hid_data.last_slot_field) { -bool touch_removed =wacom_wac_slot_is_active (wacom_wac->touch_input, - wacom_wac->hid_data.id) && !wacom_wac->hid_data.tipswitch; - -if (wacom_wac->hid_data.confidence || touch_removed) { -wacom_wac_finger_slot (wacom_wac, wacom_wac->touch_input); - } - } +if (equivalent_usage == wacom_wac->hid_data.last_slot_field) +wacom_wac_finger_slot (wacom_wac, wacom_wac->touch_input); } }
Greg Kroah-Hartman
maintainerPATCH 321/417 serial: sc16is7xx: add check for unsupported SPI modes during probe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <[email protected]>
commit 6d710b769c1f5f0d55c9ad9bb49b7dce009ec103 upstream.
The original comment is confusing because it implies that variants other than the SC16IS762 supports other SPI modes beside SPI_MODE_0.
Extract from datasheet:
The SC16IS762 differs from the SC16IS752 in that it supports SPI clock speeds up to 15 Mbit/s instead of the 4 Mbit/s supported by the SC16IS752... In all other aspects, the SC16IS762 is functionally and electrically the same as the SC16IS752.
The same is also true of the SC16IS760 variant versus the SC16IS740 and SC16IS750 variants.
For all variants, only SPI mode 0 is supported.
Change comment and abort probing if the specified SPI mode is not SPI_MODE_0.
--- drivers/tty/serial/sc16is7xx.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/tty/serial/sc16is7xx.c +4 -1
@@ -1716,7 +1716,10 @@ static int sc16is7xx_spi_probe(struct sp/* Setup SPI bus */ spi->bits_per_word =8 ; -/* only supports mode 0 on SC16IS762 */ +/* For all variants, only mode 0 is supported */ +if ((spi->mode &SPI_MODE_X_MASK ) !=SPI_MODE_0 ) +return dev_err_probe (&spi->dev, -EINVAL ,"Unsupported SPI mode\n" ); + spi->mode = spi->mode ? :SPI_MODE_0 ; spi->max_speed_hz = spi->max_speed_hz ? :15000000 ; ret =spi_setup (spi);
Greg Kroah-Hartman
maintainerPATCH 322/417 serial: sc16is7xx: set safe default SPI clock frequency
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <[email protected]>
commit 3ef79cd1412236d884ab0c46b4d1921380807b48 upstream.
15 MHz is supported only by 76x variants.
If the SPI clock frequency is not specified, use a safe default clock value of 4 MHz that is supported by all variants.
Also use HZ_PER_MHZ macro to improve readability.
--- drivers/tty/serial/sc16is7xx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/tty/serial/sc16is7xx.c +2 -1
@@ -24,6 +24,7 @@#include <linux/tty_flip.h> #include <linux/spi/spi.h> #include <linux/uaccess.h> +#include <linux/units.h> #include <uapi/linux/sched/types.h> #define SC16IS7XX_NAME "sc16is7xx"
@@ -1721,7 +1722,7 @@ static int sc16is7xx_spi_probe(struct spreturn dev_err_probe (&spi->dev, -EINVAL ,"Unsupported SPI mode\n" ); spi->mode = spi->mode ? :SPI_MODE_0 ; - spi->max_speed_hz = spi->max_speed_hz ? :15000000 ; + spi->max_speed_hz = spi->max_speed_hz ? :4 *HZ_PER_MHZ ; ret =spi_setup (spi);if (ret)return ret;
Greg Kroah-Hartman
maintainerPATCH 323/417 ARM: 9330/1: davinci: also select PINCTRL
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit f54e8634d1366926c807e2af6125b33cff555fa7 ]
kconfig warns when PINCTRL_SINGLE is selected but PINCTRL is not set, so also set PINCTRL for ARCH_DAVINCI. This prevents a kconfig/build warning:
WARNING: unmet direct dependencies detected for PINCTRL_SINGLE
Depends on [n]: PINCTRL [=n] && OF [=y] && HAS_IOMEM [=y] Selected by [y]:
- ARCH_DAVINCI [=y] && ARCH_MULTI_V5 [=y]
--- arch/arm/mach-davinci/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-davinci/Kconfig +1 -0
@@ -11,6 +11,7 @@ menuconfig ARCH_DAVINCI select PM_GENERIC_DOMAINS_OF if PM && OF select REGMAP_MMIO select RESET_CONTROLLER + select PINCTRL select PINCTRL_SINGLE if ARCH_DAVINCI
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 324/417 mfd: syscon: Fix null pointer dereference in of_syscon_register()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit 41673c66b3d0c09915698fec5c13b24336f18dd1 ]
kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.
--- drivers/mfd/syscon.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/mfd/syscon.c +4 -0
@@ -102,6 +102,10 @@ static struct syscon *of_syscon_register(struct device_node *np, bool check_clk) } syscon_config.name =kasprintf (GFP_KERNEL ,"%pOFn@%pa" , np, &res.start); +if (!syscon_config.name) { + ret = -ENOMEM ; + goto err_regmap; + } syscon_config.reg_stride = reg_io_width; syscon_config.val_bits = reg_io_width *8 ; syscon_config.max_register =resource_size (&res) - reg_io_width;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 325/417 leds: aw2013: Select missing dependency REGMAP_I2C
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dang Huynh <[email protected]>
[ Upstream commit 75469bb0537ad2ab0fc1fb6e534a79cfc03f3b3f ]
The AW2013 driver uses devm_regmap_init_i2c, so REGMAP_I2C needs to be selected.
Otherwise build process may fail with:
ld: drivers/leds/leds-aw2013.o: in function `aw2013_probe':
leds-aw2013.c:345: undefined reference to `__devm_regmap_init_i2c'
--- drivers/leds/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/leds/Kconfig +1 -0
@@ -97,6 +97,7 @@ config LEDS_ARIEL config LEDS_AW2013 tristate "LED support for Awinic AW2013" depends on LEDS_CLASS && I2C && OF + select REGMAP_I2C help This option enables support for the AW2013 3-channel LED driver.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 326/417 mfd: intel-lpss: Fix the fractional clock divider flags
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 03d790f04fb2507173913cad9c213272ac983a60 ]
The conversion to CLK_FRAC_DIVIDER_POWER_OF_TWO_PS uses wrong flags in the parameters and hence miscalculates the values in the clock divider. Fix this by applying the flag to the proper parameter.
--- drivers/mfd/intel-lpss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mfd/intel-lpss.c +1 -1
@@ -301,8 +301,8 @@ static int intel_lpss_register_clock_divider(struct intel_lpss *lpss,snprintf (name,sizeof (name),"%s-div" , devname); tmp =clk_register_fractional_divider (NULL , name,__clk_get_name (tmp), +0 , lpss->priv,1 ,15 ,16 ,15 ,CLK_FRAC_DIVIDER_POWER_OF_TWO_PS , - lpss->priv,1 ,15 ,16 ,15 ,0 ,NULL );if (IS_ERR (tmp))return PTR_ERR (tmp);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 327/417 mips: dmi: Fix early remap on MIPS32
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serge Semin <[email protected]>
[ Upstream commit 0d0a3748a2cb38f9da1f08d357688ebd982eb788 ]
dmi_early_remap() has been defined as ioremap_cache() which on MIPS32 gets to be converted to the VM-based mapping. DMI early remapping is performed at the setup_arch() stage with no VM available. So calling the dmi_early_remap() for MIPS32 causes the system to crash at the early boot time. Fix that by converting dmi_early_remap() to the uncached remapping which is always available on both 32 and 64-bits MIPS systems.
Note this change shall not cause any regressions on the current DMI support implementation because on the early boot-up stage neither MIPS32 nor MIPS64 has the cacheable ioremapping support anyway.
--- arch/mips/include/asm/dmi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/include/asm/dmi.h +1 -1
@@ -5,7 +5,7 @@#include <linux/io.h> #include <linux/memblock.h> -#define dmi_early_remap (x, l) ioremap_cache(x, l) +#define dmi_early_remap (x, l) ioremap(x, l)#define dmi_early_unmap (x, l) iounmap(x)#define dmi_remap (x, l) ioremap_cache(x, l)#define dmi_unmap (x) iounmap(x)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 328/417 mips: Fix incorrect max_low_pfn adjustment
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serge Semin <[email protected]>
[ Upstream commit 0f5cc249ff73552d3bd864e62f85841dafaa107d ]
max_low_pfn variable is incorrectly adjusted if the kernel is built with high memory support and the later is detected in a running system, so the memory which actually can be directly mapped is getting into the highmem zone. See the ZONE_NORMAL range on my MIPS32r5 system:
Quoted 4 lines
Zone ranges:
DMA [mem 0x0000000000000000-0x0000000000ffffff] Normal [mem 0x0000000001000000-0x0000000007ffffff] HighMem [mem 0x0000000008000000-0x000000020fffffff]
while the zones are supposed to look as follows:
Quoted 4 lines
Zone ranges:
DMA [mem 0x0000000000000000-0x0000000000ffffff] Normal [mem 0x0000000001000000-0x000000001fffffff] HighMem [mem 0x0000000020000000-0x000000020fffffff]
Even though the physical memory within the range [0x08000000;0x20000000] belongs to MMIO on our system, we don't really want it to be considered as high memory since on MIPS32 that range still can be directly mapped.
Note there might be other problems caused by the max_low_pfn variable misconfiguration. For instance high_memory variable is initialize with virtual address corresponding to the max_low_pfn PFN, and by design it must define the upper bound on direct map memory, then end of the normal zone. That in its turn potentially may cause problems in accessing the memory by means of the /dev/mem and /dev/kmem devices.
Let's fix the discovered misconfiguration then. It turns out the commit a94e4f24ec83 ("MIPS: init: Drop boot_mem_map") didn't introduce the max_low_pfn adjustment quite correct. If the kernel is built with high memory support and the system is equipped with high memory, the max_low_pfn variable will need to be initialized with PFN of the most upper directly reachable memory address so the zone normal would be correctly setup. On MIPS that PFN corresponds to PFN_DOWN(HIGHMEM_START). If the system is built with no high memory support and one is detected in the running system, we'll just need to adjust the max_pfn variable to discard the found high memory from the system and leave the max_low_pfn as is, since the later will be less than PFN_DOWN(HIGHMEM_START) anyway by design of the for_each_memblock() loop performed a bit early in the bootmem_init() method.
--- arch/mips/kernel/setup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/mips/kernel/setup.c +2 -2
@@ -326,11 +326,11 @@ static void __init bootmem_init(void)panic ("Incorrect memory mapping !!!" );if (max_pfn >PFN_DOWN (HIGHMEM_START )) { + max_low_pfn =PFN_DOWN (HIGHMEM_START );#ifdef CONFIG_HIGHMEM - highstart_pfn =PFN_DOWN (HIGHMEM_START ); + highstart_pfn = max_low_pfn; highend_pfn = max_pfn;#else - max_low_pfn =PFN_DOWN (HIGHMEM_START ); max_pfn = max_low_pfn;#endif }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 329/417 riscv: Check if the code to patch lies in the exit section
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Ghiti <[email protected]>
[ Upstream commit 420370f3ae3d3b883813fd3051a38805160b2b9f ]
Otherwise we fall through to vmalloc_to_page() which panics since the address does not lie in the vmalloc region.
--- arch/riscv/include/asm/sections.h | 1 + arch/riscv/kernel/patch.c | 11 ++++++++++- arch/riscv/kernel/vmlinux-xip.lds.S | 2 ++ arch/riscv/kernel/vmlinux.lds.S | 2 ++ 4 files changed, 15 insertions(+), 1 deletion(-)
arch/riscv/include/asm/sections.h +1 -0
@@ -13,6 +13,7 @@ extern char _start_kernel[];extern char __init_data_begin[], __init_data_end[];extern char __init_text_begin[], __init_text_end[];extern char __alt_start[], __alt_end[]; +extern char __exittext_begin[], __exittext_end[];static inline bool is_va_kernel_text (uintptr_t va) {
arch/riscv/kernel/patch.c +10 -1
@@ -13,6 +13,7 @@#include <asm/fixmap.h> #include <asm/ftrace.h> #include <asm/patch.h> +#include <asm/sections.h> struct patch_insn {void *addr;
@@ -23,6 +24,14 @@ struct patch_insn {int riscv_patch_in_stop_machine = false;#ifdef CONFIG_MMU + +static inline bool is_kernel_exittext (uintptr_t addr) +{ +return system_state <SYSTEM_RUNNING && + addr >= (uintptr_t )__exittext_begin && + addr < (uintptr_t )__exittext_end; +} +/* * The fix_to_virt(, idx) needs a const value (not a dynamic variable of * reg-a0) or BUILD_BUG_ON failed with "idx >= __end_of_fixed_addresses".
@@ -33,7 +42,7 @@ static __always_inline void *patch_map(void *addr, const unsigned int fixmap)uintptr_t uintaddr = (uintptr_t ) addr;struct page *page; -if (core_kernel_text (uintaddr)) +if (core_kernel_text (uintaddr) ||is_kernel_exittext (uintaddr)) page =phys_to_page (__pa_symbol (addr));else if (IS_ENABLED (CONFIG_STRICT_MODULE_RWX )) page =vmalloc_to_page (addr);
arch/riscv/kernel/vmlinux-xip.lds.S +2 -0
@@ -29,10 +29,12 @@ SECTIONS HEAD_TEXT_SECTION INIT_TEXT_SECTION(PAGE_SIZE) /* we have to discard exit text and such at runtime, not link time */ + __exittext_begin = .; .exit.text : { EXIT_TEXT } + __exittext_end = .; .text : { _text = .;
arch/riscv/kernel/vmlinux.lds.S +2 -0
@@ -72,10 +72,12 @@ SECTIONS __soc_builtin_dtb_table_end = .; } /* we have to discard exit text and such at runtime, not link time */ + __exittext_begin = .; .exit.text : { EXIT_TEXT } + __exittext_end = .; __init_text_end = .; . = ALIGN(SECTION_ALIGN);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 330/417 riscv: Fix module_alloc() that did not reset the linear mapping permissions
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Ghiti <[email protected]>
[ Upstream commit 749b94b08005929bbc636df21a23322733166e35 ]
After unloading a module, we must reset the linear mapping permissions, see the example below:
Before unloading a module:
0xffffaf809d65d000-0xffffaf809d6dc000 0x000000011d65d000 508K PTE . .. .. D A G . . W R V 0xffffaf809d6dc000-0xffffaf809d6dd000 0x000000011d6dc000 4K PTE . .. .. D A G . . . R V 0xffffaf809d6dd000-0xffffaf809d6e1000 0x000000011d6dd000 16K PTE . .. .. D A G . . W R V 0xffffaf809d6e1000-0xffffaf809d6e7000 0x000000011d6e1000 24K PTE . .. .. D A G . X . R V
After unloading a module:
0xffffaf809d65d000-0xffffaf809d6e1000 0x000000011d65d000 528K PTE . .. .. D A G . . W R V 0xffffaf809d6e1000-0xffffaf809d6e7000 0x000000011d6e1000 24K PTE . .. .. D A G . X W R V
The last mapping is not reset and we end up with WX mappings in the linear mapping.
So add VM_FLUSH_RESET_PERMS to our module_alloc() definition.
--- arch/riscv/kernel/module.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/riscv/kernel/module.c +2 -1
@@ -424,7 +424,8 @@ void *module_alloc(unsigned long size) {return __vmalloc_node_range (size,1 ,MODULES_VADDR ,MODULES_END ,GFP_KERNEL , -PAGE_KERNEL ,0 ,NUMA_NO_NODE , +PAGE_KERNEL ,VM_FLUSH_RESET_PERMS , +NUMA_NO_NODE ,__builtin_return_address (0 )); }#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 331/417 riscv: Fix set_memory_XX() and set_direct_map_XX() by splitting huge linear mappings
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Ghiti <[email protected]>
[ Upstream commit 311cd2f6e25380cff0abc2884dc6a3d33bc9b5c3 ]
When STRICT_KERNEL_RWX is set, any change of permissions on any kernel mapping (vmalloc/modules/kernel text...etc) should be applied on its linear mapping alias. The problem is that the riscv kernel uses huge mappings for the linear mapping and walk_page_range_novma() does not split those huge mappings.
So this patchset implements such split in order to apply fine-grained permissions on the linear mapping.
Below is the difference before and after (the first PUD mapping is split into PTE/PMD mappings):
Before:
---[ Linear mapping ]---
0xffffaf8000080000-0xffffaf8000200000 0x0000000080080000 1536K PTE D A G . . W R V 0xffffaf8000200000-0xffffaf8077c00000 0x0000000080200000 1914M PMD D A G . . W R V 0xffffaf8077c00000-0xffffaf8078800000 0x00000000f7c00000 12M PMD D A G . . . R V 0xffffaf8078800000-0xffffaf8078c00000 0x00000000f8800000 4M PMD D A G . . W R V 0xffffaf8078c00000-0xffffaf8079200000 0x00000000f8c00000 6M PMD D A G . . . R V 0xffffaf8079200000-0xffffaf807e600000 0x00000000f9200000 84M PMD D A G . . W R V 0xffffaf807e600000-0xffffaf807e716000 0x00000000fe600000 1112K PTE D A G . . W R V 0xffffaf807e717000-0xffffaf807e71a000 0x00000000fe717000 12K PTE D A G . . W R V 0xffffaf807e71d000-0xffffaf807e71e000 0x00000000fe71d000 4K PTE D A G . . W R V 0xffffaf807e722000-0xffffaf807e800000 0x00000000fe722000 888K PTE D A G . . W R V 0xffffaf807e800000-0xffffaf807fe00000 0x00000000fe800000 22M PMD D A G . . W R V 0xffffaf807fe00000-0xffffaf807ff54000 0x00000000ffe00000 1360K PTE D A G . . W R V 0xffffaf807ff55000-0xffffaf8080000000 0x00000000fff55000 684K PTE D A G . . W R V 0xffffaf8080000000-0xffffaf8400000000 0x0000000100000000 14G PUD D A G . . W R V
After:
---[ Linear mapping ]---
0xffffaf8000080000-0xffffaf8000200000 0x0000000080080000 1536K PTE D A G . . W R V 0xffffaf8000200000-0xffffaf8077c00000 0x0000000080200000 1914M PMD D A G . . W R V 0xffffaf8077c00000-0xffffaf8078800000 0x00000000f7c00000 12M PMD D A G . . . R V 0xffffaf8078800000-0xffffaf8078a00000 0x00000000f8800000 2M PMD D A G . . W R V 0xffffaf8078a00000-0xffffaf8078c00000 0x00000000f8a00000 2M PTE D A G . . W R V 0xffffaf8078c00000-0xffffaf8079200000 0x00000000f8c00000 6M PMD D A G . . . R V 0xffffaf8079200000-0xffffaf807e600000 0x00000000f9200000 84M PMD D A G . . W R V 0xffffaf807e600000-0xffffaf807e716000 0x00000000fe600000 1112K PTE D A G . . W R V 0xffffaf807e717000-0xffffaf807e71a000 0x00000000fe717000 12K PTE D A G . . W R V 0xffffaf807e71d000-0xffffaf807e71e000 0x00000000fe71d000 4K PTE D A G . . W R V 0xffffaf807e722000-0xffffaf807e800000 0x00000000fe722000 888K PTE D A G . . W R V 0xffffaf807e800000-0xffffaf807fe00000 0x00000000fe800000 22M PMD D A G . . W R V 0xffffaf807fe00000-0xffffaf807ff54000 0x00000000ffe00000 1360K PTE D A G . . W R V 0xffffaf807ff55000-0xffffaf8080000000 0x00000000fff55000 684K PTE D A G . . W R V 0xffffaf8080000000-0xffffaf8080800000 0x0000000100000000 8M PMD D A G . . W R V 0xffffaf8080800000-0xffffaf8080af6000 0x0000000100800000 3032K PTE D A G . . W R V 0xffffaf8080af6000-0xffffaf8080af8000 0x0000000100af6000 8K PTE D A G . X . R V 0xffffaf8080af8000-0xffffaf8080c00000 0x0000000100af8000 1056K PTE D A G . . W R V 0xffffaf8080c00000-0xffffaf8081a00000 0x0000000100c00000 14M PMD D A G . . W R V 0xffffaf8081a00000-0xffffaf8081a40000 0x0000000101a00000 256K PTE D A G . . W R V 0xffffaf8081a40000-0xffffaf8081a44000 0x0000000101a40000 16K PTE D A G . X . R V 0xffffaf8081a44000-0xffffaf8081a52000 0x0000000101a44000 56K PTE D A G . . W R V 0xffffaf8081a52000-0xffffaf8081a54000 0x0000000101a52000 8K PTE D A G . X . R V ... 0xffffaf809e800000-0xffffaf80c0000000 0x000000011e800000 536M PMD D A G . . W R V 0xffffaf80c0000000-0xffffaf8400000000 0x0000000140000000 13G PUD D A G . . W R V
Note that this also fixes memfd_secret() syscall which uses set_direct_map_invalid_noflush() and set_direct_map_default_noflush() to remove the pages from the linear mapping. Below is the kernel page table while a memfd_secret() syscall is running, you can see all the !valid page table entries in the linear mapping:
...
0xffffaf8082240000-0xffffaf8082241000 0x0000000102240000 4K PTE D A G . . W R . 0xffffaf8082241000-0xffffaf8082250000 0x0000000102241000 60K PTE D A G . . W R V 0xffffaf8082250000-0xffffaf8082252000 0x0000000102250000 8K PTE D A G . . W R . 0xffffaf8082252000-0xffffaf8082256000 0x0000000102252000 16K PTE D A G . . W R V 0xffffaf8082256000-0xffffaf8082257000 0x0000000102256000 4K PTE D A G . . W R . 0xffffaf8082257000-0xffffaf8082258000 0x0000000102257000 4K PTE D A G . . W R V 0xffffaf8082258000-0xffffaf8082259000 0x0000000102258000 4K PTE D A G . . W R . 0xffffaf8082259000-0xffffaf808225a000 0x0000000102259000 4K PTE D A G . . W R V 0xffffaf808225a000-0xffffaf808225c000 0x000000010225a000 8K PTE D A G . . W R . 0xffffaf808225c000-0xffffaf8082266000 0x000000010225c000 40K PTE D A G . . W R V 0xffffaf8082266000-0xffffaf8082268000 0x0000000102266000 8K PTE D A G . . W R . 0xffffaf8082268000-0xffffaf8082284000 0x0000000102268000 112K PTE D A G . . W R V 0xffffaf8082284000-0xffffaf8082288000 0x0000000102284000 16K PTE D A G . . W R . 0xffffaf8082288000-0xffffaf808229c000 0x0000000102288000 80K PTE D A G . . W R V 0xffffaf808229c000-0xffffaf80822a0000 0x000000010229c000 16K PTE D A G . . W R . 0xffffaf80822a0000-0xffffaf80822a5000 0x00000001022a0000 20K PTE D A G . . W R V 0xffffaf80822a5000-0xffffaf80822a6000 0x00000001022a5000 4K PTE D A G . . . R V 0xffffaf80822a6000-0xffffaf80822ab000 0x00000001022a6000 20K PTE D A G . . W R V
...
And when the memfd_secret() fd is released, the linear mapping is correctly reset:
...
0xffffaf8082240000-0xffffaf80822a5000 0x0000000102240000 404K PTE D A G . . W R V 0xffffaf80822a5000-0xffffaf80822a6000 0x00000001022a5000 4K PTE D A G . . . R V 0xffffaf80822a6000-0xffffaf80822af000 0x00000001022a6000 36K PTE D A G . . W R V
...
Stable-dep-of: b8b2711336f0 ("riscv: Fix set_direct_map_default_noflush() to reset _PAGE_EXEC")
--- arch/riscv/mm/pageattr.c | 270 +++++++++++++++++++++++++++++++++------ 1 file changed, 230 insertions(+), 40 deletions(-)
arch/riscv/mm/pageattr.c +230 -40
@@ -5,6 +5,7 @@#include <linux/pagewalk.h> #include <linux/pgtable.h> +#include <linux/vmalloc.h> #include <asm/tlbflush.h> #include <asm/bitops.h> #include <asm/set_memory.h>
@@ -25,19 +26,6 @@ static unsigned long set_pageattr_masks(unsigned long val, struct mm_walk *walk)return new_val; } -static int pageattr_pgd_entry (pgd_t *pgd,unsigned long addr, -unsigned long next,struct mm_walk *walk) -{ -pgd_t val =READ_ONCE (*pgd); - -if (pgd_leaf (val)) { - val =__pgd (set_pageattr_masks (pgd_val (val), walk)); -set_pgd (pgd, val); - } - -return 0 ; -} -static int pageattr_p4d_entry (p4d_t *p4d,unsigned long addr,unsigned long next,struct mm_walk *walk) {
@@ -96,7 +84,6 @@ static int pageattr_pte_hole(unsigned long addr, unsigned long next, }static const struct mm_walk_ops pageattr_ops = { - .pgd_entry = pageattr_pgd_entry, .p4d_entry = pageattr_p4d_entry, .pud_entry = pageattr_pud_entry, .pmd_entry = pageattr_pmd_entry,
@@ -104,12 +91,181 @@ static const struct mm_walk_ops pageattr_ops = { .pte_hole = pageattr_pte_hole, }; +#ifdef CONFIG_64BIT +static int __split_linear_mapping_pmd (pud_t *pudp, +unsigned long vaddr,unsigned long end) +{ +pmd_t *pmdp; +unsigned long next; + + pmdp =pmd_offset (pudp, vaddr); + +do { + next =pmd_addr_end (vaddr, end); + +if (next - vaddr >=PMD_SIZE && + vaddr <= (vaddr &PMD_MASK ) && end >= next) +continue ; + +if (pmd_leaf (*pmdp)) { +struct page *pte_page; +unsigned long pfn =_pmd_pfn (*pmdp); +pgprot_t prot =__pgprot (pmd_val (*pmdp) & ~_PAGE_PFN_MASK); +pte_t *ptep_new; +int i; + + pte_page =alloc_page (GFP_KERNEL ); +if (!pte_page) +return -ENOMEM ; + + ptep_new = (pte_t *)page_address (pte_page); +for (i =0 ; i <PTRS_PER_PTE ; ++i, ++ptep_new) +set_pte (ptep_new,pfn_pte (pfn + i, prot)); + +smp_wmb (); + +set_pmd (pmdp,pfn_pmd (page_to_pfn (pte_page),PAGE_TABLE )); + } + }while (pmdp++, vaddr = next, vaddr != end); + +return 0 ; +} + +static int __split_linear_mapping_pud (p4d_t *p4dp, +unsigned long vaddr,unsigned long end) +{ +pud_t *pudp; +unsigned long next; +int ret; + + pudp =pud_offset (p4dp, vaddr); + +do { + next =pud_addr_end (vaddr, end); + +if (next - vaddr >=PUD_SIZE && + vaddr <= (vaddr &PUD_MASK ) && end >= next) +continue ; + +if (pud_leaf (*pudp)) { +struct page *pmd_page; +unsigned long pfn =_pud_pfn (*pudp); +pgprot_t prot =__pgprot (pud_val (*pudp) & ~_PAGE_PFN_MASK); +pmd_t *pmdp_new; +int i; + + pmd_page =alloc_page (GFP_KERNEL ); +if (!pmd_page) +return -ENOMEM ; + + pmdp_new = (pmd_t *)page_address (pmd_page); +for (i =0 ; i <PTRS_PER_PMD ; ++i, ++pmdp_new) +set_pmd (pmdp_new, +pfn_pmd (pfn + ((i *PMD_SIZE ) >>PAGE_SHIFT ), prot)); + +smp_wmb (); + +set_pud (pudp,pfn_pud (page_to_pfn (pmd_page),PAGE_TABLE )); + } + + ret =__split_linear_mapping_pmd (pudp, vaddr, next); +if (ret) +return ret; + }while (pudp++, vaddr = next, vaddr != end); + +return 0 ; +} + +static int __split_linear_mapping_p4d (pgd_t *pgdp, +unsigned long vaddr,unsigned long end) +{ +p4d_t *p4dp; +unsigned long next; +int ret; + + p4dp =p4d_offset (pgdp, vaddr); + +do { + next =p4d_addr_end (vaddr, end); + +/* +* If [vaddr; end] contains [vaddr & P4D_MASK; next], we don't +* need to split, we'll change the protections on the whole P4D. +*/ +if (next - vaddr >=P4D_SIZE && + vaddr <= (vaddr &P4D_MASK ) && end >= next) +continue ; + +if (p4d_leaf (*p4dp)) { +struct page *pud_page; +unsigned long pfn =_p4d_pfn (*p4dp); +pgprot_t prot =__pgprot (p4d_val (*p4dp) & ~_PAGE_PFN_MASK); +pud_t *pudp_new; +int i; + + pud_page =alloc_page (GFP_KERNEL ); +if (!pud_page) +return -ENOMEM ; + +/* +* Fill the pud level with leaf puds that have the same +* protections as the leaf p4d. +*/ + pudp_new = (pud_t *)page_address (pud_page); +for (i =0 ; i <PTRS_PER_PUD ; ++i, ++pudp_new) +set_pud (pudp_new, +pfn_pud (pfn + ((i *PUD_SIZE ) >>PAGE_SHIFT ), prot)); + +/* +* Make sure the pud filling is not reordered with the +* p4d store which could result in seeing a partially +* filled pud level. +*/ +smp_wmb (); + +set_p4d (p4dp,pfn_p4d (page_to_pfn (pud_page),PAGE_TABLE )); + } + + ret =__split_linear_mapping_pud (p4dp, vaddr, next); +if (ret) +return ret; + }while (p4dp++, vaddr = next, vaddr != end); + +return 0 ; +} + +static int __split_linear_mapping_pgd (pgd_t *pgdp, +unsigned long vaddr, +unsigned long end) +{ +unsigned long next; +int ret; + +do { + next =pgd_addr_end (vaddr, end); +/* We never use PGD mappings for the linear mapping */ + ret =__split_linear_mapping_p4d (pgdp, vaddr, next); +if (ret) +return ret; + }while (pgdp++, vaddr = next, vaddr != end); + +return 0 ; +} + +static int split_linear_mapping (unsigned long start,unsigned long end) +{ +return __split_linear_mapping_pgd (pgd_offset_k (start), start, end); +} +#endif /* CONFIG_64BIT */ +static int __set_memory (unsigned long addr,int numpages,pgprot_t set_mask,pgprot_t clear_mask) {int ret;unsigned long start = addr;unsigned long end = start +PAGE_SIZE * numpages; +unsigned long __maybe_unused lm_start; +unsigned long __maybe_unused lm_end;struct pageattr_masks masks = { .set_mask = set_mask, .clear_mask = clear_mask
@@ -119,11 +275,67 @@ static int __set_memory(unsigned long addr, int numpages, pgprot_t set_mask,return 0 ;mmap_write_lock (&init_mm); + +#ifdef CONFIG_64BIT +/* +* We are about to change the permissions of a kernel mapping, we must +* apply the same changes to its linear mapping alias, which may imply +* splitting a huge mapping. +*/ + +if (is_vmalloc_or_module_addr ((void *)start)) { +struct vm_struct *area =NULL ; +int i, page_start; + + area =find_vm_area ((void *)start); + page_start = (start - (unsigned long )area->addr) >>PAGE_SHIFT ; + +for (i = page_start; i < page_start + numpages; ++i) { + lm_start = (unsigned long )page_address (area->pages[i]); + lm_end = lm_start +PAGE_SIZE ; + + ret =split_linear_mapping (lm_start, lm_end); +if (ret) + goto unlock; + + ret =walk_page_range_novma (&init_mm, lm_start, lm_end, + &pageattr_ops,NULL , &masks); +if (ret) + goto unlock; + } + }else if (is_kernel_mapping (start) ||is_linear_mapping (start)) { + lm_start = (unsigned long )lm_alias (start); + lm_end = (unsigned long )lm_alias (end); + + ret =split_linear_mapping (lm_start, lm_end); +if (ret) + goto unlock; + + ret =walk_page_range_novma (&init_mm, lm_start, lm_end, + &pageattr_ops,NULL , &masks); +if (ret) + goto unlock; + } + ret =walk_page_range_novma (&init_mm, start, end, &pageattr_ops,NULL , &masks); + +unlock: +mmap_write_unlock (&init_mm); + +/* +* We can't use flush_tlb_kernel_range() here as we may have split a +* hugepage that is larger than that, so let's flush everything. +*/ +flush_tlb_all (); +#else + ret =walk_page_range_novma (&init_mm, start, end, &pageattr_ops,NULL , + &masks); +mmap_write_unlock (&init_mm);flush_tlb_kernel_range (start, end); +#endif return ret; }
@@ -158,36 +370,14 @@ int set_memory_nx(unsigned long addr, int numpages)int set_direct_map_invalid_noflush (struct page *page) { -int ret; -unsigned long start = (unsigned long )page_address (page); -unsigned long end = start +PAGE_SIZE ; -struct pageattr_masks masks = { - .set_mask =__pgprot (0 ), - .clear_mask =__pgprot (_PAGE_PRESENT) - }; - -mmap_read_lock (&init_mm); - ret =walk_page_range (&init_mm, start, end, &pageattr_ops, &masks); -mmap_read_unlock (&init_mm); - -return ret; +return __set_memory ((unsigned long )page_address (page),1 , +__pgprot (0 ),__pgprot (_PAGE_PRESENT)); }int set_direct_map_default_noflush (struct page *page) { -int ret; -unsigned long start = (unsigned long )page_address (page); -unsigned long end = start +PAGE_SIZE ; -struct pageattr_masks masks = { - .set_mask =PAGE_KERNEL , - .clear_mask =__pgprot (0 ) - }; - -mmap_read_lock (&init_mm); - ret =walk_page_range (&init_mm, start, end, &pageattr_ops, &masks); -mmap_read_unlock (&init_mm); - -return ret; +return __set_memory ((unsigned long )page_address (page),1 , +PAGE_KERNEL ,__pgprot (0 )); }#ifdef CONFIG_DEBUG_PAGEALLOC
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 332/417 riscv: Fix set_direct_map_default_noflush() to reset _PAGE_EXEC
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Ghiti <[email protected]>
[ Upstream commit b8b2711336f03ece539de61479d6ffc44fb603d3 ]
When resetting the linear mapping permissions, we must make sure that we clear the X bit so that do not end up with WX mappings (since we set PAGE_KERNEL).
--- arch/riscv/mm/pageattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/mm/pageattr.c +1 -1
@@ -377,7 +377,7 @@ int set_direct_map_invalid_noflush(struct page *page)int set_direct_map_default_noflush (struct page *page) {return __set_memory ((unsigned long )page_address (page),1 , -PAGE_KERNEL ,__pgprot (0 )); +PAGE_KERNEL ,__pgprot (_PAGE_EXEC)); }#ifdef CONFIG_DEBUG_PAGEALLOC
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 333/417 riscv: Fixed wrong register in XIP_FIXUP_FLASH_OFFSET macro
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederik Haxel <[email protected]>
[ Upstream commit 5daa3726410288075ba73c336bb2e80d6b06aa4d ]
During the refactoring, a bug was introduced in the rarly used XIP_FIXUP_FLASH_OFFSET macro.
--- arch/riscv/include/asm/xip_fixup.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/include/asm/xip_fixup.h +1 -1
@@ -13,7 +13,7 @@ add \reg, \reg, t0 .endm .macro XIP_FIXUP_FLASH_OFFSET reg - la t1, __data_loc + la t0, __data_loc REG_L t1, _xip_phys_offset sub \reg, \reg, t1 add \reg, \reg, t0
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 334/417 MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 89c4b588d11e9acf01d604de4b0c715884f59213 ]
When calling spi_register_board_info(), we should pass the number of elements in 'db1200_spi_devs', not 'db1200_i2c_devs'.
--- arch/mips/alchemy/devboards/db1200.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/alchemy/devboards/db1200.c +1 -1
@@ -847,7 +847,7 @@ int __init db1200_dev_setup(void)i2c_register_board_info (0 , db1200_i2c_devs,ARRAY_SIZE (db1200_i2c_devs));spi_register_board_info (db1200_spi_devs, -ARRAY_SIZE (db1200_i2c_devs)); +ARRAY_SIZE (db1200_spi_devs));/* SWITCHES: S6.8 I2C/SPI selector (OFF=I2C ON=SPI) * S6.7 AC97/I2S selector (OFF=AC97 ON=I2S)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 335/417 MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 3c1e5abcda64bed0c7bffa65af2316995f269a61 ]
When calling spi_register_board_info(),
--- arch/mips/alchemy/devboards/db1550.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/alchemy/devboards/db1550.c +1 -1
@@ -589,7 +589,7 @@ int __init db1550_dev_setup(void)i2c_register_board_info (0 , db1550_i2c_devs,ARRAY_SIZE (db1550_i2c_devs));spi_register_board_info (db1550_spi_devs, -ARRAY_SIZE (db1550_i2c_devs)); +ARRAY_SIZE (db1550_spi_devs)); c =clk_get (NULL ,"psc0_intclk" );if (!IS_ERR (c)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 336/417 power: supply: cw2015: correct time_to_empty units in sysfs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Palus <[email protected]>
[ Upstream commit f37669119423ca852ca855b24732f25c0737aa57 ]
RRT_ALRT register holds remaining battery time in minutes therefore it needs to be scaled accordingly when exposing TIME_TO_EMPTY via sysfs expressed in seconds
--- drivers/power/supply/cw2015_battery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/supply/cw2015_battery.c +1 -1
@@ -491,7 +491,7 @@ static int cw_battery_get_property(struct power_supply *psy,case POWER_SUPPLY_PROP_TIME_TO_EMPTY_NOW :if (cw_battery_valid_time_to_empty (cw_bat)) - val->intval = cw_bat->time_to_empty; + val->intval = cw_bat->time_to_empty *60 ;else val->intval =0 ;break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 337/417 power: supply: bq256xx: fix some problem in bq256xx_hw_init
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit b55d073e6501dc6077edaa945a6dad8ac5c8bbab ]
smatch complains that there is a buffer overflow and clang complains 'ret' is never read.
Smatch error:drivers/power/supply/bq256xx_charger.c:1578 bq256xx_hw_init() error:
buffer overflow 'bq256xx_watchdog_time' 4 <= 4
Clang static checker:
Value stored to 'ret' is never read.
Add check for buffer overflow and error code from regmap_update_bits().
--- drivers/power/supply/bq256xx_charger.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/power/supply/bq256xx_charger.c +4 -1
@@ -1514,13 +1514,16 @@ static int bq256xx_hw_init(struct bq256xx_device *bq) wd_reg_val = i;break ; } -if (bq->watchdog_timer > bq256xx_watchdog_time[i] && +if (i +1 <BQ256XX_NUM_WD_VAL && + bq->watchdog_timer > bq256xx_watchdog_time[i] && bq->watchdog_timer < bq256xx_watchdog_time[i +1 ]) wd_reg_val = i; } ret =regmap_update_bits (bq->regmap,BQ256XX_CHARGER_CONTROL_1 ,BQ256XX_WATCHDOG_MASK , wd_reg_val <<BQ256XX_WDT_BIT_SHIFT ); +if (ret) +return ret; ret =power_supply_get_battery_info (bq->charger, &bat_info);if (ret == -ENOMEM )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 338/417 serial: 8250: omap: Dont skip resource freeing if pm_runtime_resume_and_get() failed
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit ad90d0358bd3b4554f243a425168fc7cebe7d04e ]
Returning an error code from .remove() makes the driver core emit the little helpful error message:
remove callback returned a non-zero value. This will be ignored.
and then remove the device anyhow. So all resources that were not freed are leaked in this case. Skipping serial8250_unregister_port() has the potential to keep enough of the UART around to trigger a use-after-free.
So replace the error return (and with it the little helpful error message) by a more useful error message and continue to cleanup.
--- drivers/tty/serial/8250/8250_omap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/8250/8250_omap.c +1 -1
@@ -1476,7 +1476,7 @@ static int omap8250_remove(struct platform_device *pdev) err =pm_runtime_resume_and_get (&pdev->dev);if (err) -return err; +dev_err (&pdev->dev,"Failed to resume hardware\n" );serial8250_unregister_port (priv->line); priv->line = -ENODEV ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 339/417 libapi: Add missing linux/types.h header to get the __u64 type on io.h
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit af76b2dec0984a079d8497bfa37d29a9b55932e1 ]
There are functions using __u64, so we need to have the linux/types.h header otherwise we'll break when its not included before api/io.h.
--- tools/lib/api/io.h | 1 + 1 file changed, 1 insertion(+)
tools/lib/api/io.h +1 -0
@@ -9,6 +9,7 @@#include <stdlib.h> #include <unistd.h> +#include <linux/types.h> struct io {/* File descriptor being read/ */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 340/417 usb: core: Allow subclassed USB drivers to override usb_choose_configuration()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit a87b8e3be926af0fc3b9b1af42b1127bd1ff077c ]
For some USB devices we might want to do something different for usb_choose_configuration(). One example here is the r8152 driver where we want to end up using the vendor driver with the preferred interface.
The r8152 driver tried to make things work by implementing a USB generic_subclass driver and then overriding the normal config selection after it happened. This is less than ideal and also caused breakage if someone deauthorized and re-authorized the USB device because the USB core ended up going back to it's default logic for choosing the best config. I made an attempt to fix this [1] but it was a bit ugly.
Let's do this better and allow USB generic_subclass drivers to override usb_choose_configuration().
[1] https://lore.kernel.org/r/20231130154337.1.Ie00e07f07f87149c9ce0b27ae4e26991d307e14b@changeid
Stable-dep-of: aa4f2b3e418e ("r8152: Choose our USB config with choose_configuration() rather than probe()")
--- drivers/usb/core/generic.c | 7 +++++++ include/linux/usb.h | 6 ++++++ 2 files changed, 13 insertions(+)
drivers/usb/core/generic.c +7 -0
@@ -59,10 +59,17 @@ int usb_choose_configuration(struct usb_device *udev)int num_configs;int insufficient_power =0 ;struct usb_host_config *c, *best; +struct usb_device_driver *udriver =to_usb_device_driver (udev->dev.driver);if (usb_device_is_owned (udev))return 0 ; +if (udriver->choose_configuration) { + i = udriver->choose_configuration (udev); +if (i >=0 ) +return i; + } + best =NULL ; c = udev->config; num_configs = udev->descriptor.bNumConfigurations;
include/linux/usb.h +6 -0
@@ -1234,6 +1234,9 @@ struct usb_driver {* module is being unloaded. * @suspend: Called when the device is going to be suspended by the system. * @resume: Called when the device is being resumed by the system. +* @choose_configuration: If non-NULL, called instead of the default +* usb_choose_configuration(). If this returns an error then we'll go +* on to call the normal usb_choose_configuration(). * @dev_groups: Attributes attached to the device that will be created once it * is bound to the driver. * @drvwrap: Driver-model core structure wrapper.
@@ -1257,6 +1260,9 @@ struct usb_device_driver {int (*suspend) (struct usb_device *udev,pm_message_t message);int (*resume) (struct usb_device *udev,pm_message_t message); + +int (*choose_configuration) (struct usb_device *udev); +const struct attribute_group **dev_groups;struct usbdrv_wrap drvwrap;const struct usb_device_id *id_table;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 341/417 r8152: Choose our USB config with choose_configuration() rather than probe()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit aa4f2b3e418e8673e55145de8b8016a7a9920306 ]
If you deauthorize the r8152 device (by writing 0 to the "authorized" field in sysfs) and then reauthorize it (by writing a 1) then it no longer works. This is because when you do the above we lose the special configuration that we set in rtl8152_cfgselector_probe(). Deauthorizing causes the config to be set to -1 and then reauthorizing runs the default logic for choosing the best config.
I made an attempt to fix it so that the config is kept across deauthorizing / reauthorizing [1] but it was a bit ugly.
Let's instead use the new USB core feature to override choose_configuration().
This patch relies upon the patches ("usb: core: Don't force USB generic_subclass drivers to define probe()") and ("usb: core: Allow subclassed USB drivers to override usb_choose_configuration()")
[1] https://lore.kernel.org/r/20231130154337.1.Ie00e07f07f87149c9ce0b27ae4e26991d307e14b@changeid
--- drivers/net/usb/r8152.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-)
drivers/net/usb/r8152.c +5 -11
@@ -9899,7 +9899,7 @@ static struct usb_driver rtl8152_driver = { .disable_hub_initiated_lpm = 1, }; -static int rtl8152_cfgselector_probe (struct usb_device *udev) +static int rtl8152_cfgselector_choose_configuration (struct usb_device *udev) {struct usb_host_config *c;int i, num_configs;
@@ -9926,19 +9926,13 @@ static int rtl8152_cfgselector_probe(struct usb_device *udev)if (i == num_configs)return -ENODEV ; -if (usb_set_configuration (udev, c->desc.bConfigurationValue)) { -dev_err (&udev->dev,"Failed to set configuration %d\n" , - c->desc.bConfigurationValue); -return -ENODEV ; - } - -return 0 ; +return c->desc.bConfigurationValue; }static struct usb_device_driver rtl8152_cfgselector_driver = { - .name =MODULENAME "-cfgselector" , - .probe = rtl8152_cfgselector_probe, - .id_table = rtl8152_table, + .name =MODULENAME "-cfgselector" , + .choose_configuration = rtl8152_cfgselector_choose_configuration, + .id_table = rtl8152_table, .generic_subclass =1 , .supports_autosuspend =1 , };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 342/417 base/node.c: initialize the accessor list before registering
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <[email protected]>
[ Upstream commit 48b5928e18dc27e05cab3dc4c78cd8a15baaf1e5 ]
The current code registers the node as available in the node array before initializing the accessor list. This makes it so that anything which might access the accessor list as a result of allocations will cause an undefined memory access.
In one example, an extension to access hmat data during interleave caused this undefined access as a result of a bulk allocation that occurs during node initialization but before the accessor list is initialized.
Initialize the accessor list before making the node generally available to the global system.
--- drivers/base/node.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/base/node.c +6 -3
@@ -859,11 +859,15 @@ int __register_one_node(int nid) {int error;int cpu; +struct node *node; - node_devices[nid] =kzalloc (sizeof (struct node ),GFP_KERNEL ); -if (!node_devices[nid]) + node =kzalloc (sizeof (struct node ),GFP_KERNEL ); +if (!node)return -ENOMEM ; +INIT_LIST_HEAD (&node->access_list); + node_devices[nid] = node; + error =register_node (node_devices[nid], nid);/* link cpu under this node */
@@ -872,7 +876,6 @@ int __register_one_node(int nid)register_cpu_under_node (cpu, nid); } -INIT_LIST_HEAD (&node_devices[nid]->access_list);node_init_caches (nid);return error;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 343/417 acpi: property: Let args be NULL in __acpi_node_get_property_reference
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
[ Upstream commit bef52aa0f3de1b7d8c258c13b16e577361dabf3a ]
fwnode_get_property_reference_args() may not be called with args argument NULL on ACPI, OF already supports this. Add the missing NULL checks and document this.
The purpose is to be able to count the references.
--- drivers/acpi/property.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/acpi/property.c +4 -0
@@ -851,6 +851,7 @@ static int acpi_get_ref_args(struct fwnode_reference_args *args,* @index: Index of the reference to return * @num_args: Maximum number of arguments after each reference * @args: Location to store the returned reference with optional arguments +* (may be NULL) * * Find property with @name, verifify that it is a package containing at least * one object reference and if so, store the ACPI device object pointer to the
@@ -907,6 +908,9 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,if (!device)return -EINVAL ; +if (!args) +return 0 ; + args->fwnode =acpi_fwnode_handle (device); args->nargs =0 ;return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 344/417 software node: Let args be NULL in software_node_get_reference_args
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
[ Upstream commit 1eaea4b3604eb9ca7d9a1e73d88fc121bb4061f5 ]
fwnode_get_property_reference_args() may not be called with args argument NULL and while OF already supports this. Add the missing NULL check.
The purpose is to be able to count the references.
--- drivers/base/swnode.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/base/swnode.c +3 -0
@@ -541,6 +541,9 @@ software_node_get_reference_args(const struct fwnode_handle *fwnode,if (nargs >NR_FWNODE_REFERENCE_ARGS )return -EINVAL ; +if (!args) +return 0 ; + args->fwnode =software_node_get (refnode); args->nargs = nargs;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 345/417 serial: imx: fix tx statemachine deadlock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Geurts <[email protected]>
[ Upstream commit 78d60dae9a0c9f09aa3d6477c94047df2fe6f7b0 ]
When using the serial port as RS485 port, the tx statemachine is used to control the RTS pin to drive the RS485 transceiver TX_EN pin. When the TTY port is closed in the middle of a transmission (for instance during userland application crash), imx_uart_shutdown disables the interface and disables the Transmission Complete interrupt. afer that, imx_uart_stop_tx bails on an incomplete transmission, to be retriggered by the TC interrupt. This interrupt is disabled and therefore the tx statemachine never transitions out of SEND. The statemachine is in deadlock now, and the TX_EN remains low, making the interface useless.
imx_uart_stop_tx now checks for incomplete transmission AND whether TC interrupts are enabled before bailing to be retriggered. This makes sure the state machine handling is reached, and is properly set to WAIT_AFTER_SEND.
--- drivers/tty/serial/imx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/tty/serial/imx.c +2 -2
@@ -450,13 +450,13 @@ static void imx_uart_stop_tx(struct uart_port *port) ucr1 =imx_uart_readl (sport,UCR1 );imx_uart_writel (sport, ucr1 & ~UCR1_TRDYEN ,UCR1 ); + ucr4 =imx_uart_readl (sport,UCR4 ); usr2 =imx_uart_readl (sport,USR2 ); -if (!(usr2 &USR2_TXDC )) { +if ((!(usr2 &USR2_TXDC )) && (ucr4 &UCR4_TCEN )) {/* The shifter is still busy, so retry once TC triggers */ return ; } - ucr4 =imx_uart_readl (sport,UCR4 ); ucr4 &= ~UCR4_TCEN ;imx_uart_writel (sport, ucr4,UCR4 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 346/417 selftests/sgx: Fix uninitialized pointer dereference in error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jo Van Bulck <[email protected]>
[ Upstream commit 79eba8c924f7decfa71ddf187d38cb9f5f2cd7b3 ]
Ensure ctx is zero-initialized, such that the encl_measure function will not call EVP_MD_CTX_destroy with an uninitialized ctx pointer in case of an early error during key generation.
--- tools/testing/selftests/sgx/sigstruct.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
tools/testing/selftests/sgx/sigstruct.c +3 -2
@@ -318,9 +318,9 @@ bool encl_measure(struct encl *encl)struct sgx_sigstruct *sigstruct = &encl->sigstruct;struct sgx_sigstruct_payload payload;uint8_t digest[SHA256_DIGEST_LENGTH ]; +EVP_MD_CTX *ctx =NULL ;unsigned int siglen;RSA *key =NULL ; -EVP_MD_CTX *ctx;int i;memset (sigstruct,0 ,sizeof (*sigstruct));
@@ -384,7 +384,8 @@ bool encl_measure(struct encl *encl)return true; err: -EVP_MD_CTX_destroy (ctx); +if (ctx) +EVP_MD_CTX_destroy (ctx);RSA_free (key);return false; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 347/417 selftests/sgx: Fix uninitialized pointer dereferences in encl_get_entry
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jo Van Bulck <[email protected]>
[ Upstream commit b84fc2e0139ba4b23b8039bd7cfd242894fe8f8b ]
Ensure sym_tab and sym_names are zero-initialized and add an early-out condition in the unlikely (erroneous) case that the enclave ELF file would not contain a symbol table.
This addresses -Werror=maybe-uninitialized compiler warnings for gcc -O2.
--- tools/testing/selftests/sgx/load.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
tools/testing/selftests/sgx/load.c +6 -3
@@ -136,11 +136,11 @@ static bool encl_ioc_add_pages(struct encl *encl, struct encl_segment *seg)*/ uint64_t encl_get_entry (struct encl *encl,const char *symbol) { +Elf64_Sym *symtab =NULL ; +char *sym_names =NULL ;Elf64_Shdr *sections; -Elf64_Sym *symtab;Elf64_Ehdr *ehdr; -char *sym_names; -int num_sym; +int num_sym =0 ;int i; ehdr = encl->bin;
@@ -161,6 +161,9 @@ uint64_t encl_get_entry(struct encl *encl, const char *symbol) } } +if (!symtab || !sym_names) +return 0 ; +for (i =0 ; i < num_sym; i++) {Elf64_Sym *sym = &symtab[i];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 348/417 selftests/sgx: Include memory clobber for inline asm in test enclave
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jo Van Bulck <[email protected]>
[ Upstream commit 853a57a43ebdb8c024160c1a0990bae85f4bcc2f ]
Add the "memory" clobber to the EMODPE and EACCEPT asm blocks to tell the compiler the assembly code accesses to the secinfo struct. This ensures the compiler treats the asm block as a memory barrier and the write to secinfo will be visible to ENCLU.
--- tools/testing/selftests/sgx/test_encl.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
tools/testing/selftests/sgx/test_encl.c +5 -3
@@ -24,10 +24,11 @@ static void do_encl_emodpe(void *_op) secinfo.flags = op->flags; asmvolatile (".byte 0x0f, 0x01, 0xd7" - : + :/* no outputs */ :"a" (EMODPE ),"b" (&secinfo), -"c" (op->epc_addr)); +"c" (op->epc_addr) + :"memory" /* read from secinfo pointer */ ); }static void do_encl_eaccept (void *_op)
@@ -42,7 +43,8 @@ static void do_encl_eaccept(void *_op) : "=a" (rax) : "a" (EACCEPT), "b" (&secinfo), - "c" (op->epc_addr)); + "c" (op->epc_addr) + : "memory" /* read from secinfo pointer */); op->ret = rax; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 349/417 selftests/sgx: Skip non X86_64 platform
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Mengmeng <[email protected]>
[ Upstream commit 981cf568a8644161c2f15c02278ebc2834b51ba6 ]
When building whole selftests on arm64, rsync gives an erorr about sgx:
rsync: [sender] link_stat "/root/linux-next/tools/testing/selftests/sgx/test_encl.elf" failed: No such file or directory (2) rsync error: some files/attrs were not transferred (see previous errors) (code 23) at main.c(1327) [sender=3.2.5]
The root casue is sgx only used on X86_64, and shall be skipped on other platforms.
Fix this by moving TEST_CUSTOM_PROGS and TEST_FILES inside the if check, then the build result will be "Skipping non-existent dir: sgx".
--- tools/testing/selftests/sgx/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/sgx/Makefile +1 -1
@@ -16,9 +16,9 @@ HOST_CFLAGS := -Wall -Werror -g $(INCLUDES) -fPIC -z noexecstack ENCL_CFLAGS := -Wall -Werror -static -nostdlib -nostartfiles -fPIC \ -fno-stack-protector -mrdrnd $(INCLUDES) +ifeq ($(CAN_BUILD_X86_64), 1) TEST_CUSTOM_PROGS := $(OUTPUT)/test_sgx -ifeq ($(CAN_BUILD_X86_64), 1) all: $(TEST_CUSTOM_PROGS) $(OUTPUT)/test_encl.elf endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 350/417 iio: adc: ad9467: fix reset gpio handling
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Sa <[email protected]>
[ Upstream commit 76f028539cf360f750efd8cde560edda298e4c6b ]
The reset gpio was being handled with inverted polarity. This means that as far as gpiolib is concerned we were actually leaving the pin asserted (in theory, this would mean reset). However, inverting the polarity in devicetree made things work. Fix it by doing it the proper way and how gpiolib expects it to be done.
While at it, moved the handling to it's own function and dropped 'reset_gpio' from the 'struct ad9467_state' as we only need it during probe. On top of that, refactored things so that we now request the gpio asserted (i.e in reset) and then de-assert it. Also note that we now use gpiod_set_value_cansleep() instead of gpiod_direction_output() as we already request the pin as output.
--- drivers/iio/adc/ad9467.c | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-)
drivers/iio/adc/ad9467.c +18 -13
@@ -121,7 +121,6 @@ struct ad9467_state {unsigned int output_mode;struct gpio_desc *pwrdown_gpio; -struct gpio_desc *reset_gpio; };static int ad9467_spi_read (struct spi_device *spi,unsigned int reg)
@@ -378,6 +377,21 @@ static int ad9467_preenable_setup(struct adi_axi_adc_conv *conv)return ad9467_outputmode_set (st->spi, st->output_mode); } +static int ad9467_reset (struct device *dev) +{ +struct gpio_desc *gpio; + + gpio =devm_gpiod_get_optional (dev,"reset" ,GPIOD_OUT_HIGH ); +if (IS_ERR_OR_NULL (gpio)) +return PTR_ERR_OR_ZERO (gpio); + +fsleep (1 ); +gpiod_set_value_cansleep (gpio,0 ); +fsleep (10 *USEC_PER_MSEC ); + +return 0 ; +} +static int ad9467_probe (struct spi_device *spi) {const struct ad9467_chip_info *info;
@@ -406,18 +420,9 @@ static int ad9467_probe(struct spi_device *spi)if (IS_ERR (st->pwrdown_gpio))return PTR_ERR (st->pwrdown_gpio); - st->reset_gpio =devm_gpiod_get_optional (&spi->dev,"reset" , -GPIOD_OUT_LOW ); -if (IS_ERR (st->reset_gpio)) -return PTR_ERR (st->reset_gpio); - -if (st->reset_gpio) { -udelay (1 ); - ret =gpiod_direction_output (st->reset_gpio,1 ); -if (ret) -return ret; -mdelay (10 ); - } + ret =ad9467_reset (&spi->dev); +if (ret) +return ret; conv->chip_info = &info->axi_adc_info;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 351/417 iio: adc: ad9467: dont ignore error codes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Sa <[email protected]>
[ Upstream commit e072e149cfb827e0ab4cafb0547e9658e35393cd ]
Make sure functions that return errors are not ignored.
--- drivers/iio/adc/ad9467.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-)
drivers/iio/adc/ad9467.c +17 -10
@@ -162,9 +162,10 @@ static int ad9467_reg_access(struct adi_axi_adc_conv *conv, unsigned int reg,if (readval ==NULL ) { ret =ad9467_spi_write (spi, reg, writeval); -ad9467_spi_write (spi,AN877_ADC_REG_TRANSFER , -AN877_ADC_TRANSFER_SYNC ); -return ret; +if (ret) +return ret; +return ad9467_spi_write (spi,AN877_ADC_REG_TRANSFER , +AN877_ADC_TRANSFER_SYNC ); } ret =ad9467_spi_read (spi, reg);
@@ -272,10 +273,13 @@ static int ad9467_get_scale(struct adi_axi_adc_conv *conv, int *val, int *val2)const struct ad9467_chip_info *info1 =to_ad9467_chip_info (info);struct ad9467_state *st =adi_axi_adc_conv_priv (conv);unsigned int i, vref_val; +int ret; - vref_val =ad9467_spi_read (st->spi,AN877_ADC_REG_VREF ); + ret =ad9467_spi_read (st->spi,AN877_ADC_REG_VREF ); +if (ret <0 ) +return ret; - vref_val &= info1->vref_mask; + vref_val = ret & info1->vref_mask;for (i =0 ; i < info->num_scales; i++) {if (vref_val == info->scale_table[i][1 ])
@@ -296,6 +300,7 @@ static int ad9467_set_scale(struct adi_axi_adc_conv *conv, int val, int val2)struct ad9467_state *st =adi_axi_adc_conv_priv (conv);unsigned int scale_val[2 ];unsigned int i; +int ret;if (val !=0 )return -EINVAL ;
@@ -305,11 +310,13 @@ static int ad9467_set_scale(struct adi_axi_adc_conv *conv, int val, int val2)if (scale_val[0 ] != val || scale_val[1 ] != val2)continue ; -ad9467_spi_write (st->spi,AN877_ADC_REG_VREF , - info->scale_table[i][1 ]); -ad9467_spi_write (st->spi,AN877_ADC_REG_TRANSFER , -AN877_ADC_TRANSFER_SYNC ); -return 0 ; + ret =ad9467_spi_write (st->spi,AN877_ADC_REG_VREF , + info->scale_table[i][1 ]); +if (ret <0 ) +return ret; + +return ad9467_spi_write (st->spi,AN877_ADC_REG_TRANSFER , +AN877_ADC_TRANSFER_SYNC ); }return -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 352/417 iio: adc: ad9467: fix scale setting
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Sa <[email protected]>
[ Upstream commit b73f08bb7fe5a0901646ca5ceaa1e7a2d5ee6293 ]
When reading in_voltage_scale we can get something like:
root@analog:/sys/bus/iio/devices/iio:device2# cat in_voltage_scale 0.038146
However, when reading the available options:
root@analog:/sys/bus/iio/devices/iio:device2# cat in_voltage_scale_available 2000.000000 2100.000006 2200.000007 2300.000008 2400.000009 2500.000010
which does not make sense. Moreover, when trying to set a new scale we get an error because there's no call to __ad9467_get_scale() to give us values as given when reading in_voltage_scale. Fix it by computing the available scales during probe and properly pass the list when .read_available() is called.
While at it, change to use .read_available() from iio_info. Also note that to properly fix this, adi-axi-adc.c has to be changed accordingly.
--- drivers/iio/adc/ad9467.c | 47 ++++++++++++++++++ drivers/iio/adc/adi-axi-adc.c | 74 ++++++----------------------- include/linux/iio/adc/adi-axi-adc.h | 4 ++ 3 files changed, 66 insertions(+), 59 deletions(-)
drivers/iio/adc/ad9467.c +47 -0
@@ -119,6 +119,7 @@ struct ad9467_state {struct spi_device *spi;struct clk *clk;unsigned int output_mode; +unsigned int (*scales)[2 ];struct gpio_desc *pwrdown_gpio; };
@@ -212,6 +213,7 @@ static void __ad9467_get_scale(struct adi_axi_adc_conv *conv, int index, .channel = _chan, \ .info_mask_shared_by_type =BIT (IIO_CHAN_INFO_SCALE ) | \ BIT(IIO_CHAN_INFO_SAMP_FREQ), \ + .info_mask_shared_by_type_available = BIT(IIO_CHAN_INFO_SCALE), \ .scan_index = _si, \ .scan_type = { \ .sign = _sign, \
@@ -365,6 +367,26 @@ static int ad9467_write_raw(struct adi_axi_adc_conv *conv, } } +static int ad9467_read_avail (struct adi_axi_adc_conv *conv, +struct iio_chan_spec const *chan, +const int **vals,int *type,int *length, +long mask) +{ +const struct adi_axi_adc_chip_info *info = conv->chip_info; +struct ad9467_state *st =adi_axi_adc_conv_priv (conv); + +switch (mask) { +case IIO_CHAN_INFO_SCALE : + *vals = (const int *)st->scales; + *type =IIO_VAL_INT_PLUS_MICRO ; +/* Values are stored in a 2D matrix */ + *length = info->num_scales *2 ; +return IIO_AVAIL_LIST ; +default : +return -EINVAL ; + } +} +static int ad9467_outputmode_set (struct spi_device *spi,unsigned int mode) {int ret;
@@ -377,6 +399,26 @@ static int ad9467_outputmode_set(struct spi_device *spi, unsigned int mode) AN877_ADC_TRANSFER_SYNC); } +static int ad9467_scale_fill (struct adi_axi_adc_conv *conv) +{ +const struct adi_axi_adc_chip_info *info = conv->chip_info; +struct ad9467_state *st =adi_axi_adc_conv_priv (conv); +unsigned int i, val1, val2; + + st->scales =devm_kmalloc_array (&st->spi->dev, info->num_scales, +sizeof (*st->scales),GFP_KERNEL ); +if (!st->scales) +return -ENOMEM ; + +for (i =0 ; i < info->num_scales; i++) { +__ad9467_get_scale (conv, i, &val1, &val2); + st->scales[i][0 ] = val1; + st->scales[i][1 ] = val2; + } + +return 0 ; +} +static int ad9467_preenable_setup (struct adi_axi_adc_conv *conv) {struct ad9467_state *st =adi_axi_adc_conv_priv (conv);
@@ -433,6 +475,10 @@ static int ad9467_probe(struct spi_device *spi) conv->chip_info = &info->axi_adc_info; + ret =ad9467_scale_fill (conv); +if (ret) +return ret; + id =ad9467_spi_read (spi,AN877_ADC_REG_CHIP_ID );if (id != conv->chip_info->id) { dev_err(&spi->dev, "Mismatch CHIP_ID, got 0x%X, expected 0x%X\n",
@@ -443,6 +489,7 @@ static int ad9467_probe(struct spi_device *spi) conv->reg_access = ad9467_reg_access; conv->write_raw = ad9467_write_raw; conv->read_raw = ad9467_read_raw; + conv->read_avail = ad9467_read_avail; conv->preenable_setup = ad9467_preenable_setup; st->output_mode = info->default_output_mode |
drivers/iio/adc/adi-axi-adc.c +15 -59
90 lines not on this page · raw message
include/linux/iio/adc/adi-axi-adc.h +4 -0
@@ -41,6 +41,7 @@ struct adi_axi_adc_chip_info {* @reg_access IIO debugfs_reg_access hook for the client ADC * @read_raw IIO read_raw hook for the client ADC * @write_raw IIO write_raw hook for the client ADC +* @read_avail IIO read_avail hook for the client ADC */ struct adi_axi_adc_conv {const struct adi_axi_adc_chip_info *chip_info;
@@ -54,6 +55,9 @@ struct adi_axi_adc_conv {int (*write_raw)(struct adi_axi_adc_conv *conv,struct iio_chan_spec const *chan,int val,int val2,long mask); +int (*read_avail)(struct adi_axi_adc_conv *conv, +struct iio_chan_spec const *chan, +const int **val,int *type,int *length,long mask); }; struct adi_axi_adc_conv *devm_adi_axi_adc_conv_register(struct device *dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 353/417 perf header: Fix one memory leakage in perf_event__fprintf_event_update()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yicong Yang <[email protected]>
[ Upstream commit 813900d19b923fc1b241c1ce292472f68066092b ]
When dump the raw trace by perf report -D ASan reports a memory leakage in perf_event__fprintf_event_update().
It shows that we allocated a temporary cpumap for dumping the CPUs but doesn't release it and it's not used elsewhere. Fix this by free the cpumap after the dumping.
--- tools/perf/util/header.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
tools/perf/util/header.c +3 -2
@@ -4314,9 +4314,10 @@ size_t perf_event__fprintf_event_update(union perf_event *event, FILE *fp) ret +=fprintf (fp,"... " ); map =cpu_map__new_data (&ev->cpus.cpus); -if (map) +if (map) { ret +=cpu_map__fprintf (map, fp); -else +perf_cpu_map__put (map); + }else ret +=fprintf (fp,"failed to get cpus\n" );break ;default :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 354/417 perf hisi-ptt: Fix one memory leakage in hisi_ptt_process_auxtrace_event()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yicong Yang <[email protected]>
[ Upstream commit 1bc479d665bc25a9a4e8168d5b400a47491511f9 ]
ASan complains a memory leakage in hisi_ptt_process_auxtrace_event() that the data buffer is not freed. Since currently we only support the raw dump trace mode, the data buffer is used only within this function. So fix this by freeing the data buffer before going out.
--- tools/perf/util/hisi-ptt.c | 1 + 1 file changed, 1 insertion(+)
tools/perf/util/hisi-ptt.c +1 -0
@@ -121,6 +121,7 @@ static int hisi_ptt_process_auxtrace_event(struct perf_session *session,if (dump_trace)hisi_ptt_dump_event (ptt, data, size); +free (data);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 355/417 perf genelf: Set ELF program header addresses properly
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit 1af478903fc48c1409a8dd6b698383b62387adf1 ]
The text section starts after the ELF headers so PHDR.p_vaddr and others should have the correct addresses.
--- tools/perf/util/genelf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
tools/perf/util/genelf.c +3 -3
@@ -293,9 +293,9 @@ jit_write_elf(int fd, uint64_t load_addr, const char *sym,*/ phdr =elf_newphdr (e,1 ); phdr[0 ].p_type =PT_LOAD ; - phdr[0 ].p_offset =0 ; - phdr[0 ].p_vaddr =0 ; - phdr[0 ].p_paddr =0 ; + phdr[0 ].p_offset =GEN_ELF_TEXT_OFFSET ; + phdr[0 ].p_vaddr =GEN_ELF_TEXT_OFFSET ; + phdr[0 ].p_paddr =GEN_ELF_TEXT_OFFSET ; phdr[0 ].p_filesz = csize; phdr[0 ].p_memsz = csize; phdr[0 ].p_flags =PF_X |PF_R ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 356/417 tty: change tty_write_lock()s ndelay parameter to bool
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <[email protected]>
[ Upstream commit af815336556df28f800669c58ab3bdad7d786b98 ]
It's a yes-no parameter, so convert it to bool to be obvious.
Stable-dep-of: 66aad7d8d3ec ("usb: cdc-acm: return correct error code on unsupported break")
--- drivers/tty/tty.h | 2 +- drivers/tty/tty_io.c | 6 +++--- drivers/tty/tty_ioctl.c | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-)
drivers/tty/tty.h +1 -1
@@ -63,7 +63,7 @@ int tty_check_change(struct tty_struct *tty);void __stop_tty (struct tty_struct *tty);void __start_tty (struct tty_struct *tty);void tty_write_unlock (struct tty_struct *tty); -int tty_write_lock (struct tty_struct *tty,int ndelay); +int tty_write_lock (struct tty_struct *tty,bool ndelay);void tty_vhangup_session (struct tty_struct *tty);void tty_open_proc_set_tty (struct file *filp,struct tty_struct *tty);int tty_signal_session_leader (struct tty_struct *tty,int exit_session);
drivers/tty/tty_io.c +3 -3
@@ -939,7 +939,7 @@ void tty_write_unlock(struct tty_struct *tty)wake_up_interruptible_poll (&tty->write_wait,EPOLLOUT ); } -int tty_write_lock (struct tty_struct *tty,int ndelay) +int tty_write_lock (struct tty_struct *tty,bool ndelay) {if (!mutex_trylock (&tty->atomic_write_lock)) {if (ndelay)
@@ -1153,7 +1153,7 @@ int tty_send_xchar(struct tty_struct *tty, char ch)return 0 ; } -if (tty_write_lock (tty,0 ) <0 ) +if (tty_write_lock (tty, false) <0 )return -ERESTARTSYS ;down_read (&tty->termios_rwsem);
@@ -2475,7 +2475,7 @@ static int send_break(struct tty_struct *tty, unsigned int duration) retval = tty->ops->break_ctl (tty, duration); else {/* Do the work ourselves */ -if (tty_write_lock (tty,0 ) <0 ) +if (tty_write_lock (tty, false) <0 )return -EINTR ; retval = tty->ops->break_ctl (tty,-1 );if (retval)
drivers/tty/tty_ioctl.c +1 -1
@@ -506,7 +506,7 @@ static int set_termios(struct tty_struct *tty, void __user *arg, int opt)if (retval <0 )return retval; -if (tty_write_lock (tty,0 ) <0 ) +if (tty_write_lock (tty, false) <0 ) goto retry_write_wait;/* Racing writer? */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 357/417 tty: early return from send_break() on TTY_DRIVER_HARDWARE_BREAK
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <[email protected]>
[ Upstream commit 66619686d187b4a6395316b7f39881e945dce4bc ]
If the driver sets TTY_DRIVER_HARDWARE_BREAK, we leave ops->break_ctl() to the driver and return from send_break(). But we do it using a local variable and keep the code flowing through the end of the function. Instead, do 'return' immediately with the ops->break_ctl()'s return value.
This way, we don't have to stuff the 'else' branch of the 'if' with the software break handling. And we can re-indent the function too.
Stable-dep-of: 66aad7d8d3ec ("usb: cdc-acm: return correct error code on unsupported break")
--- drivers/tty/tty_io.c | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-)
drivers/tty/tty_io.c +17 -15
@@ -2472,22 +2472,24 @@ static int send_break(struct tty_struct *tty, unsigned int duration)return 0 ;if (tty->driver->flags &TTY_DRIVER_HARDWARE_BREAK ) - retval = tty->ops->break_ctl (tty, duration); -else { -/* Do the work ourselves */ -if (tty_write_lock (tty, false) <0 ) -return -EINTR ; - retval = tty->ops->break_ctl (tty,-1 ); -if (retval) - goto out; -if (!signal_pending (current)) -msleep_interruptible (duration); - retval = tty->ops->break_ctl (tty,0 ); +return tty->ops->break_ctl (tty, duration); + +/* Do the work ourselves */ +if (tty_write_lock (tty, false) <0 ) +return -EINTR ; + + retval = tty->ops->break_ctl (tty,-1 ); +if (retval) + goto out; +if (!signal_pending (current)) +msleep_interruptible (duration); + retval = tty->ops->break_ctl (tty,0 ); out: -tty_write_unlock (tty); -if (signal_pending (current)) - retval = -EINTR ; - } +tty_write_unlock (tty); + +if (signal_pending (current)) + retval = -EINTR ; +return retval; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 358/417 tty: dont check for signal_pending() in send_break()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <[email protected]>
[ Upstream commit fd99392b643b824813df2edbaebe26a2136d31e6 ]
msleep_interruptible() will check on its own. So no need to do the check in send_break() before calling the above.
Stable-dep-of: 66aad7d8d3ec ("usb: cdc-acm: return correct error code on unsupported break")
--- drivers/tty/tty_io.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/tty/tty_io.c +1 -2
@@ -2481,8 +2481,7 @@ static int send_break(struct tty_struct *tty, unsigned int duration) retval = tty->ops->break_ctl (tty,-1 );if (retval) goto out; -if (!signal_pending (current)) -msleep_interruptible (duration); +msleep_interruptible (duration); retval = tty->ops->break_ctl (tty,0 ); out:tty_write_unlock (tty);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 359/417 tty: use if in send_break() instead of goto
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <[email protected]>
[ Upstream commit 24f2cd019946fc2e88e632d2e24a34c2cc3f2be4 ]
Now, the "jumped-over" code is simple enough to be put inside an 'if'. Do so to make it 'goto'-less.
Stable-dep-of: 66aad7d8d3ec ("usb: cdc-acm: return correct error code on unsupported break")
--- drivers/tty/tty_io.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/tty/tty_io.c +4 -5
@@ -2479,11 +2479,10 @@ static int send_break(struct tty_struct *tty, unsigned int duration)return -EINTR ; retval = tty->ops->break_ctl (tty,-1 ); -if (retval) - goto out; -msleep_interruptible (duration); - retval = tty->ops->break_ctl (tty,0 ); -out: +if (!retval) { +msleep_interruptible (duration); + retval = tty->ops->break_ctl (tty,0 ); + }tty_write_unlock (tty);if (signal_pending (current))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 360/417 usb: cdc-acm: return correct error code on unsupported break
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
[ Upstream commit 66aad7d8d3ec5a3a8ec2023841bcec2ded5f65c9 ]
In ACM support for sending breaks to devices is optional. If a device says that it doenot support sending breaks, the host must respect that.
Given the number of optional features providing tty operations for each combination is not practical and errors need to be returned dynamically if unsupported features are requested.
In case a device does not support break, we want the tty layer to treat that like it treats drivers that statically cannot support sending a break. It ignores the inability and does nothing. This patch uses EOPNOTSUPP to indicate that.
--- drivers/tty/tty_io.c | 3 +++ drivers/usb/class/cdc-acm.c | 3 +++ 2 files changed, 6 insertions(+)
drivers/tty/tty_io.c +3 -0
@@ -2482,6 +2482,9 @@ static int send_break(struct tty_struct *tty, unsigned int duration)if (!retval) {msleep_interruptible (duration); retval = tty->ops->break_ctl (tty,0 ); + }else if (retval == -EOPNOTSUPP ) { +/* some drivers can tell only dynamically */ + retval =0 ; }tty_write_unlock (tty);
drivers/usb/class/cdc-acm.c +3 -0
@@ -892,6 +892,9 @@ static int acm_tty_break_ctl(struct tty_struct *tty, int state)struct acm *acm = tty->driver_data;int retval; +if (!(acm->ctrl_caps &USB_CDC_CAP_BRK )) +return -EOPNOTSUPP ; + retval =acm_send_break (acm, state ?0xffff :0 );if (retval <0 ) dev_dbg(&acm->control->dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 361/417 usb: core: Fix crash w/ usb_choose_configuration() if no driver
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 44995e6f07028f798efd0c3c11a1efc78330f600 ]
It's possible that usb_choose_configuration() can get called when a USB device has no driver. In this case the recent commit a87b8e3be926 ("usb: core: Allow subclassed USB drivers to override usb_choose_configuration()") can cause a crash since it dereferenced the driver structure without checking for NULL. Let's add a check.
A USB device with no driver is an anomaly, so make usb_choose_configuration() return immediately if there is no driver.
This was seen in the real world when usbguard got ahold of a r8152 device at the wrong time. It can also be simulated via this on a computer with one r8152-based USB Ethernet adapter:
cd /sys/bus/usb/drivers/r8152-cfgselector to_unbind="$(ls -d *-*)"
real_dir="$(readlink -f "${to_unbind}")"
echo "${to_unbind}" > unbind
cd "${real_dir}"
echo 0 > authorized
echo 1 > authorized
--- drivers/usb/core/generic.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/usb/core/generic.c +10 -1
@@ -59,7 +59,16 @@ int usb_choose_configuration(struct usb_device *udev)int num_configs;int insufficient_power =0 ;struct usb_host_config *c, *best; -struct usb_device_driver *udriver =to_usb_device_driver (udev->dev.driver); +struct usb_device_driver *udriver; + +/* +* If a USB device (not an interface) doesn't have a driver then the +* kernel has no business trying to select or install a configuration +* for it. +*/ +if (!udev->dev.driver) +return -1 ; + udriver =to_usb_device_driver (udev->dev.driver);if (usb_device_is_owned (udev))return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 362/417 spmi: mtk-pmif: Serialize PMIF status check and command submission
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nícolas F. R. A. Prado <[email protected]>
[ Upstream commit f200fff8d019f2754f91f5d715652e3e3fdf3604 ]
Before writing the read or write command to the SPMI arbiter through the PMIF interface, the current status of the channel is checked to ensure it is idle. However, since the status only changes from idle when the command is written, it is possible for two concurrent calls to determine that the channel is idle and simultaneously send their commands. At this point the PMIF interface hangs, with the status register no longer being updated, and thus causing all subsequent operations to time out.
This was observed on the mt8195-cherry-tomato-r2 machine, particularly after commit 46600ab142f8 ("regulator: Set PROBE_PREFER_ASYNCHRONOUS for drivers between 5.10 and 5.15") was applied, since then the two MT6315 devices present on the SPMI bus would probe assynchronously and sometimes (during probe or at a later point) read the bus simultaneously, breaking the PMIF interface and consequently slowing down the whole system.
To fix the issue at its root cause, introduce locking around the channel status check and the command write, so that both become an atomic operation, preventing race conditions between two (or more) SPMI bus read/write operations. A spinlock is used since this is a fast bus, as indicated by the usage of the atomic variant of readl_poll, and '.fast_io = true' being used in the mt6315 driver, so spinlocks are already used for the regmap access.
--- drivers/spmi/spmi-mtk-pmif.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
drivers/spmi/spmi-mtk-pmif.c +16 -4
@@ -50,6 +50,7 @@ struct pmif {struct clk_bulk_data clks[PMIF_MAX_CLKS ];size_t nclks;const struct pmif_data *data; +raw_spinlock_t lock; };static const char *const pmif_clock_names[] = {
@@ -314,6 +315,7 @@ static int pmif_spmi_read_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid,struct ch_reg *inf_reg;int ret;u32 data, cmd; +unsigned long flags;/* Check for argument validation. */ if (sid & ~0xf ) {
@@ -334,6 +336,7 @@ static int pmif_spmi_read_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid,else return -EINVAL ; +raw_spin_lock_irqsave (&arb->lock, flags);/* Wait for Software Interface FSM state to be IDLE. */ inf_reg = &arb->chan; ret = readl_poll_timeout_atomic(arb->base + arb->data->regs[inf_reg->ch_sta],
@@ -343,6 +346,7 @@ static int pmif_spmi_read_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid,/* set channel ready if the data has transferred */ if (pmif_is_fsm_vldclr (arb))pmif_writel (arb,1 , inf_reg->ch_rdy); +raw_spin_unlock_irqrestore (&arb->lock, flags);dev_err (&ctrl->dev,"failed to wait for SWINF_IDLE\n" );return ret; }
@@ -350,6 +354,7 @@ static int pmif_spmi_read_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid,/* Send the command. */ cmd = (opc <<30 ) | (sid <<24 ) | ((len -1 ) <<16 ) | addr;pmif_writel (arb, cmd, inf_reg->ch_send); +raw_spin_unlock_irqrestore (&arb->lock, flags);/* * Wait for Software Interface FSM state to be WFVLDCLR,
@@ -376,7 +381,8 @@ static int pmif_spmi_write_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid,struct pmif *arb =spmi_controller_get_drvdata (ctrl);struct ch_reg *inf_reg;int ret; -u32 data, cmd; +u32 data, wdata, cmd; +unsigned long flags;if (len >4 ) {dev_err (&ctrl->dev,"pmif supports 1..4 bytes per trans, but:%zu requested" , len);
@@ -394,6 +400,10 @@ static int pmif_spmi_write_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid,else return -EINVAL ; +/* Set the write data. */ +memcpy (&wdata, buf, len); + +raw_spin_lock_irqsave (&arb->lock, flags);/* Wait for Software Interface FSM state to be IDLE. */ inf_reg = &arb->chan; ret = readl_poll_timeout_atomic(arb->base + arb->data->regs[inf_reg->ch_sta],
@@ -403,17 +413,17 @@ static int pmif_spmi_write_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid,/* set channel ready if the data has transferred */ if (pmif_is_fsm_vldclr (arb))pmif_writel (arb,1 , inf_reg->ch_rdy); +raw_spin_unlock_irqrestore (&arb->lock, flags);dev_err (&ctrl->dev,"failed to wait for SWINF_IDLE\n" );return ret; } -/* Set the write data. */ -memcpy (&data, buf, len); -pmif_writel (arb, data, inf_reg->wdata); +pmif_writel (arb, wdata, inf_reg->wdata);/* Send the command. */ cmd = (opc <<30 ) |BIT (29 ) | (sid <<24 ) | ((len -1 ) <<16 ) | addr;pmif_writel (arb, cmd, inf_reg->ch_send); +raw_spin_unlock_irqrestore (&arb->lock, flags);return 0 ; }
@@ -488,6 +498,8 @@ static int mtk_spmi_probe(struct platform_device *pdev) arb->chan.ch_send =PMIF_SWINF_0_ACC + chan_offset; arb->chan.ch_rdy =PMIF_SWINF_0_VLD_CLR + chan_offset; +raw_spin_lock_init (&arb->lock); +platform_set_drvdata (pdev, ctrl); err =spmi_controller_add (ctrl);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 363/417 vdpa: Fix an error handling path in eni_vdpa_probe()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit c1b9f2c66eed3261db76cccd8a22a9affae8dcbf ]
After a successful vp_legacy_probe() call, vp_legacy_remove() should be called in the error handling path, as already done in the remove function.
Add the missing call.
Message-Id: <a7b0ef1eabd081f1c7c894e9b11de01678e85dee.1666293559.git.christophe.jaillet@wanadoo.fr>
--- drivers/vdpa/alibaba/eni_vdpa.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/vdpa/alibaba/eni_vdpa.c +4 -2
@@ -497,7 +497,7 @@ static int eni_vdpa_probe(struct pci_dev *pdev, const struct pci_device_id *id)if (!eni_vdpa->vring) { ret = -ENOMEM ;ENI_ERR (pdev,"failed to allocate virtqueues\n" ); - goto err; + goto err_remove_vp_legacy; }for (i =0 ; i < eni_vdpa->queues; i++) {
@@ -509,11 +509,13 @@ static int eni_vdpa_probe(struct pci_dev *pdev, const struct pci_device_id *id) ret =vdpa_register_device (&eni_vdpa->vdpa, eni_vdpa->queues);if (ret) {ENI_ERR (pdev,"failed to register to vdpa bus\n" ); - goto err; + goto err_remove_vp_legacy; }return 0 ; +err_remove_vp_legacy: +vp_legacy_remove (&eni_vdpa->ldev); err:put_device (&eni_vdpa->vdpa.dev);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 364/417 nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <[email protected]>
[ Upstream commit efa56305908ba20de2104f1b8508c6a7401833be ]
If the host sends an H2CData command with an invalid DATAL, the kernel may crash in nvmet_tcp_build_pdu_iovec().
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 lr : nvmet_tcp_io_work+0x6ac/0x718 [nvmet_tcp] Call trace: process_one_work+0x174/0x3c8 worker_thread+0x2d0/0x3e8 kthread+0x104/0x110
Fix the bug by raising a fatal error if DATAL isn't coherent with the packet size.
Also, the PDU length should never exceed the MAXH2CDATA parameter which has been communicated to the host in nvmet_tcp_handle_icreq().
--- drivers/nvme/target/tcp.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/nvme/target/tcp.c +12 -1
@@ -18,6 +18,7 @@#include "nvmet.h" #define NVMET_TCP_DEF_INLINE_DATA_SIZE (4 * PAGE_SIZE) +#define NVMET_TCP_MAXH2CDATA 0x400000/* 16M arbitrary limit */ /* Define the socket priority to use for connections were it is desirable * that the NIC consider performing optimized packet processing or filtering.
@@ -861,7 +862,7 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue) icresp->hdr.pdo =0 ; icresp->hdr.plen =cpu_to_le32 (icresp->hdr.hlen); icresp->pfv =cpu_to_le16 (NVME_TCP_PFV_1_0 ); - icresp->maxdata =cpu_to_le32 (0x400000 );/* 16M arbitrary limit */ + icresp->maxdata =cpu_to_le32 (NVMET_TCP_MAXH2CDATA ); icresp->cpda =0 ;if (queue->hdr_digest) icresp->digest |=NVME_TCP_HDR_DIGEST_ENABLE ;
@@ -914,6 +915,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) {struct nvme_tcp_data_pdu *data = &queue->pdu.data;struct nvmet_tcp_cmd *cmd; +unsigned int plen;if (likely (queue->nr_cmds)) {if (unlikely (data->ttag >= queue->nr_cmds)) {
@@ -937,7 +939,16 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)return -EPROTO ; } + plen =le32_to_cpu (data->hdr.plen); cmd->pdu_len =le32_to_cpu (data->data_length); +if (unlikely (cmd->pdu_len != (plen -sizeof (*data)) || + cmd->pdu_len ==0 || + cmd->pdu_len >NVMET_TCP_MAXH2CDATA )) { +pr_err ("H2CData PDU len %u is invalid\n" , cmd->pdu_len); +/* FIXME: use proper transport errors */ +nvmet_tcp_fatal_error (queue); +return -EPROTO ; + } cmd->pdu_recv =0 ;nvmet_tcp_build_pdu_iovec (cmd); queue->cmd = cmd;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 365/417 nvmet-tcp: fix a crash in nvmet_req_complete()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <[email protected]>
[ Upstream commit 0849a5441358cef02586fb2d60f707c0db195628 ]
in nvmet_tcp_handle_h2c_data_pdu(), if the host sends a data_offset different from rbytes_done, the driver ends up calling nvmet_req_complete() passing a status error.
The problem is that at this point cmd->req is not yet initialized, the kernel will crash after dereferencing a NULL pointer.
Fix the bug by replacing the call to nvmet_req_complete() with nvmet_tcp_fatal_error().
--- drivers/nvme/target/tcp.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/nvme/target/tcp.c +1 -2
@@ -934,8 +934,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) data->ttag,le32_to_cpu (data->data_offset), cmd->rbytes_done);/* FIXME: use path and transport errors */ -nvmet_req_complete (&cmd->req, -NVME_SC_INVALID_FIELD |NVME_SC_DNR ); +nvmet_tcp_fatal_error (queue);return -EPROTO ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 366/417 perf env: Avoid recursively taking env->bpf_progs.lock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 9c51f8788b5d4e9f46afbcf563255cfd355690b3 ]
Add variants of perf_env__insert_bpf_prog_info(), perf_env__insert_btf() and perf_env__find_btf prefixed with __ to indicate the env->bpf_progs.lock is assumed held.
Call these variants when the lock is held to avoid recursively taking it and potentially having a thread deadlock with itself.
--- tools/perf/util/bpf-event.c | 8 +++--- tools/perf/util/bpf-event.h | 12 ++++----- tools/perf/util/env.c | 50 ++++++++++++++++++++++++------------- tools/perf/util/env.h | 4 +++ tools/perf/util/header.c | 8 +++--- 5 files changed, 50 insertions(+), 32 deletions(-)
tools/perf/util/bpf-event.c +4 -4
@@ -606,9 +606,9 @@ int evlist__add_bpf_sb_event(struct evlist *evlist, struct perf_env *env)return evlist__add_sb_event (evlist, &attr, bpf_event__sb_cb, env); } -void bpf_event__print_bpf_prog_info (struct bpf_prog_info *info, -struct perf_env *env, -FILE *fp) +void __bpf_event__print_bpf_prog_info (struct bpf_prog_info *info, +struct perf_env *env, +FILE *fp) {__u32 *prog_lens = (__u32 *)(uintptr_t )(info->jited_func_lens);__u64 *prog_addrs = (__u64 *)(uintptr_t )(info->jited_ksyms);
@@ -624,7 +624,7 @@ void bpf_event__print_bpf_prog_info(struct bpf_prog_info *info,if (info->btf_id) {struct btf_node *node; - node =perf_env__find_btf (env, info->btf_id); + node =__perf_env__find_btf (env, info->btf_id);if (node) btf =btf__new ((__u8 *)(node->data), node->data_size);
tools/perf/util/bpf-event.h +6 -6
@@ -33,9 +33,9 @@ struct btf_node {int machine__process_bpf (struct machine *machine,union perf_event *event,struct perf_sample *sample);int evlist__add_bpf_sb_event (struct evlist *evlist,struct perf_env *env); -void bpf_event__print_bpf_prog_info (struct bpf_prog_info *info, -struct perf_env *env, -FILE *fp); +void __bpf_event__print_bpf_prog_info (struct bpf_prog_info *info, +struct perf_env *env, +FILE *fp);#else static inline int machine__process_bpf(struct machine *machine __maybe_unused, union perf_event *event __maybe_unused,
@@ -50,9 +50,9 @@ static inline int evlist__add_bpf_sb_event(struct evlist *evlist __maybe_unused,return 0 ; } -static inline void bpf_event__print_bpf_prog_info (struct bpf_prog_info *info__maybe_unused , -struct perf_env *env__maybe_unused , -FILE *fp__maybe_unused ) +static inline void __bpf_event__print_bpf_prog_info (struct bpf_prog_info *info__maybe_unused , +struct perf_env *env__maybe_unused , +FILE *fp__maybe_unused ) { }
tools/perf/util/env.c +32 -18
112 lines not on this page · raw message
tools/perf/util/env.h +4 -0
@@ -164,12 +164,16 @@ const char *perf_env__raw_arch(struct perf_env *env);int perf_env__nr_cpus_avail (struct perf_env *env);void perf_env__init (struct perf_env *env); +void __perf_env__insert_bpf_prog_info (struct perf_env *env, +struct bpf_prog_info_node *info_node);void perf_env__insert_bpf_prog_info (struct perf_env *env,struct bpf_prog_info_node *info_node);struct bpf_prog_info_node *perf_env__find_bpf_prog_info (struct perf_env *env,__u32 prog_id);bool perf_env__insert_btf (struct perf_env *env,struct btf_node *btf_node); +bool __perf_env__insert_btf (struct perf_env *env,struct btf_node *btf_node);struct btf_node *perf_env__find_btf (struct perf_env *env,__u32 btf_id); +struct btf_node *__perf_env__find_btf (struct perf_env *env,__u32 btf_id);int perf_env__numa_node (struct perf_env *env,struct perf_cpu cpu); char *perf_env__find_pmu_cap(struct perf_env *env, const char *pmu_name,
tools/perf/util/header.c +4 -4
@@ -1809,8 +1809,8 @@ static void print_bpf_prog_info(struct feat_fd *ff, FILE *fp) node = rb_entry(next, struct bpf_prog_info_node, rb_node); next =rb_next (&node->rb_node); -bpf_event__print_bpf_prog_info (&node->info_linear->info, - env, fp); +__bpf_event__print_bpf_prog_info (&node->info_linear->info, + env, fp); }up_read (&env->bpf_progs.lock);
@@ -3136,7 +3136,7 @@ static int process_bpf_prog_info(struct feat_fd *ff, void *data __maybe_unused)/* after reading from file, translate offset to address */ bpil_offs_to_addr (info_linear); info_node->info_linear = info_linear; -perf_env__insert_bpf_prog_info (env, info_node); +__perf_env__insert_bpf_prog_info (env, info_node); }up_write (&env->bpf_progs.lock);
@@ -3183,7 +3183,7 @@ static int process_bpf_btf(struct feat_fd *ff, void *data __maybe_unused)if (__do_read (ff, node->data, data_size)) goto out; -perf_env__insert_btf (env, node); +__perf_env__insert_btf (env, node); node =NULL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 367/417 cxl/region: fix x9 interleave typo
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Harris <[email protected]>
[ Upstream commit c7ad3dc3649730af483ee1e78be5d0362da25bfe ]
CXL supports x3, x6 and x12 - not x9.
--- drivers/cxl/core/region.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cxl/core/region.c +1 -1
@@ -331,7 +331,7 @@ static ssize_t interleave_ways_store(struct device *dev,return rc;/* -* Even for x3, x9, and x12 interleaves the region interleave must be a +* Even for x3, x6, and x12 interleaves the region interleave must be a * power of 2 multiple of the host bridge interleave. */ if (!is_power_of_2(val / cxld->interleave_ways) ||
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 368/417 apparmor: avoid crash when parsed profile name is empty
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
[ Upstream commit 55a8210c9e7d21ff2644809699765796d4bfb200 ]
When processing a packed profile in unpack_profile() described like
"profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}"
a string ":samba-dcerpcd" is unpacked as a fully-qualified name and then passed to aa_splitn_fqname().
aa_splitn_fqname() treats ":samba-dcerpcd" as only containing a namespace. Thus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Later aa_alloc_profile() crashes as the new profile name is NULL now.
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 6 PID: 1657 Comm: apparmor_parser Not tainted 6.7.0-rc2-dirty #16 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:strlen+0x1e/0xa0 Call Trace: <TASK> ? strlen+0x1e/0xa0 aa_policy_init+0x1bb/0x230 aa_alloc_profile+0xb1/0x480 unpack_profile+0x3bc/0x4960 aa_unpack+0x309/0x15e0 aa_replace_profiles+0x213/0x33c0 policy_update+0x261/0x370 profile_replace+0x20e/0x2a0 vfs_write+0x2af/0xe00 ksys_write+0x126/0x250 do_syscall_64+0x46/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK> ---[ end trace 0000000000000000 ]--- RIP: 0010:strlen+0x1e/0xa0
It seems such behaviour of aa_splitn_fqname() is expected and checked in other places where it is called (e.g. aa_remove_profiles). Well, there is an explicit comment "a ns name without a following profile is allowed" inside.
AFAICS, nothing can prevent unpacked "name" to be in form like ":samba-dcerpcd" - it is passed from userspace.
Deny the whole profile set replacement in such case and inform user with EPROTO and an explaining message.
Found by Linux Verification Center (linuxtesting.org).
--- security/apparmor/policy_unpack.c | 4 ++++ 1 file changed, 4 insertions(+)
security/apparmor/policy_unpack.c +4 -0
@@ -674,6 +674,10 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name) tmpname =aa_splitn_fqname (name,strlen (name), &tmpns, &ns_len);if (tmpns) { +if (!tmpname) { + info ="empty profile name" ; + goto fail; + } *ns_name =kstrndup (tmpns, ns_len,GFP_KERNEL );if (!*ns_name) { info ="out of memory" ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 369/417 usb: xhci-mtk: fix a short packet issue of gen1 isoc-in transfer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chunfeng Yun <[email protected]>
[ Upstream commit 017dbfc05c31284150819890b4cc86a699cbdb71 ]
For Gen1 isoc-in transfer, host still send out unexpected ACK after device finish the burst with a short packet, this will cause an exception on the connected device, such as, a usb 4k camera.
It can be fixed by setting rxfifo depth less than 4k bytes, prefer to use 3k here, the side-effect is that may cause performance drop about 10%, including bulk transfer.
--- drivers/usb/host/xhci-mtk.c | 40 +++++++++++++++++++++++++++++++++++-- drivers/usb/host/xhci-mtk.h | 2 ++ 2 files changed, 40 insertions(+), 2 deletions(-)
drivers/usb/host/xhci-mtk.c +38 -2
@@ -7,6 +7,7 @@* Chunfeng Yun <[email protected]> */ +#include <linux/bitfield.h> #include <linux/dma-mapping.h> #include <linux/iopoll.h> #include <linux/kernel.h>
@@ -73,6 +74,9 @@#define FRMCNT_LEV1_RANG (0x12b << 8)#define FRMCNT_LEV1_RANG_MASK GENMASK(19, 8) +#define HSCH_CFG1 0x960 +#define SCH3_RXFIFO_DEPTH_MASK GENMASK(21, 20) +#define SS_GEN2_EOF_CFG 0x990#define SSG2EOF_OFFSET 0x3c
@@ -114,6 +118,8 @@#define SSC_IP_SLEEP_EN BIT(4)#define SSC_SPM_INT_EN BIT(1) +#define SCH_FIFO_TO_KB (x) ((x) >> 10) +enum ssusb_uwk_vers {SSUSB_UWK_V1 =1 ,SSUSB_UWK_V2 ,
@@ -165,6 +171,35 @@ static void xhci_mtk_set_frame_interval(struct xhci_hcd_mtk *mtk)writel (value, hcd->regs +SS_GEN2_EOF_CFG ); } +/* +* workaround: usb3.2 gen1 isoc rx hw issue +* host send out unexpected ACK afer device fininsh a burst transfer with +* a short packet. +*/ +static void xhci_mtk_rxfifo_depth_set (struct xhci_hcd_mtk *mtk) +{ +struct usb_hcd *hcd = mtk->hcd; +u32 value; + +if (!mtk->rxfifo_depth) +return ; + + value =readl (hcd->regs +HSCH_CFG1 ); + value &= ~SCH3_RXFIFO_DEPTH_MASK ; + value |=FIELD_PREP (SCH3_RXFIFO_DEPTH_MASK , +SCH_FIFO_TO_KB (mtk->rxfifo_depth) -1 ); +writel (value, hcd->regs +HSCH_CFG1 ); +} + +static void xhci_mtk_init_quirk (struct xhci_hcd_mtk *mtk) +{ +/* workaround only for mt8195 */ +xhci_mtk_set_frame_interval (mtk); + +/* workaround for SoCs using SSUSB about before IPM v1.6.0 */ +xhci_mtk_rxfifo_depth_set (mtk); +} +static int xhci_mtk_host_enable (struct xhci_hcd_mtk *mtk) {struct mu3c_ippc_regs __iomem *ippc = mtk->ippc_regs;
@@ -453,8 +488,7 @@ static int xhci_mtk_setup(struct usb_hcd *hcd)if (ret)return ret; -/* workaround only for mt8195 */ -xhci_mtk_set_frame_interval (mtk); +xhci_mtk_init_quirk (mtk); } ret =xhci_gen_setup (hcd, xhci_mtk_quirks);
@@ -531,6 +565,8 @@ static int xhci_mtk_probe(struct platform_device *pdev)of_property_read_u32 (node,"mediatek,u2p-dis-msk" , &mtk->u2p_dis_msk); +of_property_read_u32 (node,"rx-fifo-depth" , &mtk->rxfifo_depth); + ret =usb_wakeup_of_property_parse (mtk, node);if (ret) {dev_err (dev,"failed to parse uwk property\n" );
drivers/usb/host/xhci-mtk.h +2 -0
@@ -160,6 +160,8 @@ struct xhci_hcd_mtk {struct regmap *uwk;u32 uwk_reg_base;u32 uwk_vers; +/* quirk */ +u32 rxfifo_depth; };static inline struct xhci_hcd_mtk *hcd_to_mtk (struct usb_hcd *hcd)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 370/417 serial: imx: Correct clock error message in function probe()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Niedermaier <[email protected]>
[ Upstream commit 3e189470cad27d41a3a9dc02649f965b7ed1c90f ]
Correct the clock error message by changing the clock name.
--- drivers/tty/serial/imx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/imx.c +1 -1
@@ -2344,7 +2344,7 @@ static int imx_uart_probe(struct platform_device *pdev)/* For register access, we only need to enable the ipg clock. */ ret =clk_prepare_enable (sport->clk_ipg);if (ret) { -dev_err (&pdev->dev,"failed to enable per clk: %d\n" , ret); +dev_err (&pdev->dev,"failed to enable ipg clk: %d\n" , ret);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 371/417 nvmet: re-fix tracing strncpy() warning
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 4ee7ffeb4ce50c80bc4504db6f39b25a2df6bcf4 ]
An earlier patch had tried to address a warning about a string copy with missing zero termination:
drivers/nvme/target/trace.h:52:3: warning: ‘strncpy’ specified bound 32 equals destination size [-Wstringop-truncation]
The new version causes a different warning with some compiler versions, notably gcc-9 and gcc-10, and also misses the zero padding that was apparently done intentionally in the original code:
drivers/nvme/target/trace.h:56:2: error: 'strncpy' specified bound depends on the length of the source argument [-Werror=stringop-overflow=]
Change it to use strscpy_pad() with the original length, which will give a properly padded and zero-terminated string as well as avoiding the warning.
--- drivers/nvme/target/trace.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/nvme/target/trace.h +1 -2
@@ -53,8 +53,7 @@ static inline void __assign_req_name(char *name, struct nvmet_req *req) return; } -strncpy (name, req->ns->device_path, -min_t (size_t,DISK_NAME_LEN ,strlen (req->ns->device_path))); +strscpy_pad (name, req->ns->device_path,DISK_NAME_LEN ); }#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 372/417 nvme: trace: avoid memcpy overflow warning
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit a7de1dea76cd6a3707707af4ea2f8bc3cdeaeb11 ]
A previous patch introduced a struct_group() in nvme_common_command to help stringop fortification figure out the length of the fields, but one function is not currently using them:
In file included from drivers/nvme/target/core.c:7:
In file included from include/linux/string.h:254:include/linux/fortify-string.h:592:4: error: call to '__read_overflow2_field' declared with 'warning' attribute: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror,-Wattribute-warning]
__read_overflow2_field(q_size_field, size);
^Change this one to use the correct field name to avoid the warning.
--- drivers/nvme/target/trace.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/target/trace.h +1 -1
@@ -84,7 +84,7 @@ TRACE_EVENT(nvmet_req_init, __entry->flags = cmd->common.flags; __entry->nsid =le32_to_cpu (cmd->common.nsid); __entry->metadata =le64_to_cpu (cmd->common.metadata); -memcpy (__entry->cdw10, &cmd->common.cdw10, +memcpy (__entry->cdw10, &cmd->common.cdws,sizeof (__entry->cdw10)); ), TP_printk("nvmet%s: %sqid=%d, cmdid=%u, nsid=%u, flags=%#x, "
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 373/417 nvmet-tcp: Fix the H2C expected PDU len calculation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <[email protected]>
[ Upstream commit 9a1abc24850eb759e36a2f8869161c3b7254c904 ]
The nvmet_tcp_handle_h2c_data_pdu() function should take into consideration the possibility that the header digest and/or the data digests are enabled when calculating the expected PDU length, before comparing it to the value stored in cmd->pdu_len.
--- drivers/nvme/target/tcp.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/nvme/target/tcp.c +7 -3
@@ -915,7 +915,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) {struct nvme_tcp_data_pdu *data = &queue->pdu.data;struct nvmet_tcp_cmd *cmd; -unsigned int plen; +unsigned int exp_data_len;if (likely (queue->nr_cmds)) {if (unlikely (data->ttag >= queue->nr_cmds)) {
@@ -938,9 +938,13 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)return -EPROTO ; } - plen =le32_to_cpu (data->hdr.plen); + exp_data_len =le32_to_cpu (data->hdr.plen) - +nvmet_tcp_hdgst_len (queue) - +nvmet_tcp_ddgst_len (queue) - +sizeof (*data); + cmd->pdu_len =le32_to_cpu (data->data_length); -if (unlikely (cmd->pdu_len != (plen -sizeof (*data)) || +if (unlikely (cmd->pdu_len != exp_data_len || cmd->pdu_len ==0 || cmd->pdu_len >NVMET_TCP_MAXH2CDATA )) {pr_err ("H2CData PDU len %u is invalid\n" , cmd->pdu_len);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 374/417 PCI: keystone: Fix race condition when initializing PHYs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <[email protected]>
[ Upstream commit c12ca110c613a81cb0f0099019c839d078cd0f38 ]
The PCI driver invokes the PHY APIs using the ks_pcie_enable_phy() function. The PHY in this case is the Serdes. It is possible that the PCI instance is configured for two lane operation across two different Serdes instances, using one lane of each Serdes.
In such a configuration, if the reference clock for one Serdes is provided by the other Serdes, it results in a race condition. After the Serdes providing the reference clock is initialized by the PCI driver by invoking its PHY APIs, it is not guaranteed that this Serdes remains powered on long enough for the PHY APIs based initialization of the dependent Serdes. In such cases, the PLL of the dependent Serdes fails to lock due to the absence of the reference clock from the former Serdes which has been powered off by the PM Core.
Fix this by obtaining reference to the PHYs before invoking the PHY initialization APIs and releasing reference after the initialization is complete.
--- drivers/pci/controller/dwc/pci-keystone.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/pci/controller/dwc/pci-keystone.c +9 -0
@@ -1219,7 +1219,16 @@ static int ks_pcie_probe(struct platform_device *pdev) goto err_link; } +/* Obtain references to the PHYs */ +for (i =0 ; i < num_lanes; i++) +phy_pm_runtime_get_sync (ks_pcie->phy[i]); + ret =ks_pcie_enable_phy (ks_pcie); + +/* Release references to the PHYs */ +for (i =0 ; i < num_lanes; i++) +phy_pm_runtime_put_sync (ks_pcie->phy[i]); +if (ret) {dev_err (dev,"failed to enable phy\n" ); goto err_link;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 375/417 PCI: mediatek-gen3: Fix translation window size calculation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianjun Wang <[email protected]>
[ Upstream commit 9ccc1318cf4bd90601f221268e42c3374703d681 ]
When using the fls() helper, the translation table should be a power of two; otherwise, the resulting value will not be correct.
For example, given fls(0x3e00000) - 1 = 25, the PCIe translation window size will be set to 0x2000000 instead of the expected size 0x3e00000.
Fix the translation window by splitting the MMIO space into multiple tables if its size is not a power of two.
--- drivers/pci/controller/pcie-mediatek-gen3.c | 85 ++++++++++++--------- 1 file changed, 50 insertions(+), 35 deletions(-)
drivers/pci/controller/pcie-mediatek-gen3.c +50 -35
@@ -245,35 +245,60 @@ static int mtk_pcie_set_trans_table(struct mtk_gen3_pcie *pcie,resource_size_t cpu_addr, resource_size_t pci_addr, resource_size_t size, - unsigned long type, int num) + unsigned long type, int *num) { + resource_size_t remaining = size; +resource_size_t table_size; +resource_size_t addr_align; +const char *range_type;void __iomem *table;u32 val; -if (num >=PCIE_MAX_TRANS_TABLES ) { -dev_err (pcie->dev,"not enough translate table for addr: %#llx, limited to [%d]\n" , - (unsigned long long )cpu_addr,PCIE_MAX_TRANS_TABLES ); -return -ENODEV ; - } +while (remaining && (*num <PCIE_MAX_TRANS_TABLES )) { +/* Table size needs to be a power of 2 */ + table_size =BIT (fls (remaining) -1 ); + +if (cpu_addr >0 ) { + addr_align =BIT (ffs (cpu_addr) -1 ); + table_size =min (table_size, addr_align); + } + +/* Minimum size of translate table is 4KiB */ +if (table_size <0x1000 ) { +dev_err (pcie->dev,"illegal table size %#llx\n" , + (unsigned long long )table_size); +return -EINVAL ; + } - table = pcie->base +PCIE_TRANS_TABLE_BASE_REG + - num *PCIE_ATR_TLB_SET_OFFSET ; + table = pcie->base +PCIE_TRANS_TABLE_BASE_REG + *num *PCIE_ATR_TLB_SET_OFFSET ; +writel_relaxed (lower_32_bits (cpu_addr) |PCIE_ATR_SIZE (fls (table_size) -1 ), table); +writel_relaxed (upper_32_bits (cpu_addr), table +PCIE_ATR_SRC_ADDR_MSB_OFFSET ); +writel_relaxed (lower_32_bits (pci_addr), table +PCIE_ATR_TRSL_ADDR_LSB_OFFSET ); +writel_relaxed (upper_32_bits (pci_addr), table +PCIE_ATR_TRSL_ADDR_MSB_OFFSET ); -writel_relaxed (lower_32_bits (cpu_addr) |PCIE_ATR_SIZE (fls (size) -1 ), - table); -writel_relaxed (upper_32_bits (cpu_addr), - table +PCIE_ATR_SRC_ADDR_MSB_OFFSET ); -writel_relaxed (lower_32_bits (pci_addr), - table +PCIE_ATR_TRSL_ADDR_LSB_OFFSET ); -writel_relaxed (upper_32_bits (pci_addr), - table +PCIE_ATR_TRSL_ADDR_MSB_OFFSET ); +if (type ==IORESOURCE_IO ) { + val =PCIE_ATR_TYPE_IO |PCIE_ATR_TLP_TYPE_IO ; + range_type ="IO" ; + }else { + val =PCIE_ATR_TYPE_MEM |PCIE_ATR_TLP_TYPE_MEM ; + range_type ="MEM" ; + } -if (type ==IORESOURCE_IO ) - val =PCIE_ATR_TYPE_IO |PCIE_ATR_TLP_TYPE_IO ; -else - val =PCIE_ATR_TYPE_MEM |PCIE_ATR_TLP_TYPE_MEM ; +writel_relaxed (val, table +PCIE_ATR_TRSL_PARAM_OFFSET ); -writel_relaxed (val, table +PCIE_ATR_TRSL_PARAM_OFFSET ); +dev_dbg (pcie->dev,"set %s trans window[%d]: cpu_addr = %#llx, pci_addr = %#llx, size = %#llx\n" , + range_type, *num, (unsigned long long )cpu_addr, + (unsigned long long )pci_addr, (unsigned long long )table_size); + + cpu_addr += table_size; + pci_addr += table_size; + remaining -= table_size; + (*num)++; + } + +if (remaining) +dev_warn (pcie->dev,"not enough translate table for addr: %#llx, limited to [%d]\n" , + (unsigned long long )cpu_addr,PCIE_MAX_TRANS_TABLES );return 0 ; }
@@ -380,30 +405,20 @@ static int mtk_pcie_startup_port(struct mtk_gen3_pcie *pcie)resource_size_t cpu_addr;resource_size_t pci_addr;resource_size_t size; -const char *range_type; -if (type ==IORESOURCE_IO ) { +if (type ==IORESOURCE_IO ) cpu_addr =pci_pio_to_address (res->start); - range_type ="IO" ; - }else if (type ==IORESOURCE_MEM ) { +else if (type ==IORESOURCE_MEM ) cpu_addr = res->start; - range_type ="MEM" ; - }else { +else continue ; - } pci_addr = res->start - entry->offset; size =resource_size (res); err =mtk_pcie_set_trans_table (pcie, cpu_addr, pci_addr, size, - type, table_index); + type, &table_index);if (err)return err; - -dev_dbg (pcie->dev,"set %s trans window[%d]: cpu_addr = %#llx, pci_addr = %#llx, size = %#llx\n" , - range_type, table_index, (unsigned long long )cpu_addr, - (unsigned long long )pci_addr, (unsigned long long )size); - - table_index++; }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 376/417 ASoC: mediatek: sof-common: Add NULL check for normal_link string
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit e3b3ec967a7d93b9010a5af9a2394c8b5c8f31ed ]
It's not granted that all entries of struct sof_conn_stream declare a normal_link (a non-SOF, direct link) string, and this is the case for SoCs that support only SOF paths (hence do not support both direct and SOF usecases).
For example, in the case of MT8188 there is no normal_link string in any of the sof_conn_stream entries and there will be more drivers doing that in the future.
To avoid possible NULL pointer KPs, add a NULL check for normal_link.
--- sound/soc/mediatek/common/mtk-dsp-sof-common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/mediatek/common/mtk-dsp-sof-common.c +1 -1
@@ -24,7 +24,7 @@ int mtk_sof_dai_link_fixup(struct snd_soc_pcm_runtime *rtd,struct snd_soc_dai_link *sof_dai_link =NULL ;const struct sof_conn_stream *conn = &sof_priv->conn_streams[i]; -if (strcmp (rtd->dai_link->name, conn->normal_link)) +if (conn->normal_link &&strcmp (rtd->dai_link->name, conn->normal_link))continue ;for_each_card_rtds (card, runtime) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 377/417 s390/pci: fix max size calculation in zpci_memcpy_toio()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <[email protected]>
[ Upstream commit 80df7d6af7f6d229b34cf237b2cc9024c07111cd ]
The zpci_get_max_write_size() helper is used to determine the maximum size a PCI store or load can use at a given __iomem address.
For the PCI block store the following restrictions apply:
1. The dst + len must not cross a 4K boundary in the (pseudo-)MMIO space
2. len must not exceed ZPCI_MAX_WRITE_SIZE
3. len must be a multiple of 8 bytes
4. The src address must be double word (8 byte) aligned
5. The dst address must be double word (8 byte) aligned
Otherwise only a normal PCI store which takes its src value from a register can be used. For these PCI store restriction 1 still applies. Similarly 1 also applies to PCI loads.
It turns out zpci_max_write_size() instead implements stricter conditions which prevents PCI block stores from being used where they can and should be used. In particular instead of conditions 4 and 5 it wrongly enforces both dst and src to be size aligned. This indirectly covers condition 1 but also prevents many legal PCI block stores.
On top of the functional shortcomings the zpci_get_max_write_size() is misnamed as it is used for both read and write size calculations. Rename it to zpci_get_max_io_size() and implement the listed conditions explicitly.
--- arch/s390/include/asm/pci_io.h | 32 ++++++++++++++++++-------------- arch/s390/pci/pci_mmio.c | 12 ++++++------ 2 files changed, 24 insertions(+), 20 deletions(-)
arch/s390/include/asm/pci_io.h +18 -14
@@ -11,6 +11,8 @@/* I/O size constraints */ #define ZPCI_MAX_READ_SIZE 8#define ZPCI_MAX_WRITE_SIZE 128 +#define ZPCI_BOUNDARY_SIZE (1 << 12) +#define ZPCI_BOUNDARY_MASK (ZPCI_BOUNDARY_SIZE - 1)/* I/O Map */ #define ZPCI_IOMAP_SHIFT 48
@@ -125,16 +127,18 @@ static inline int zpci_read_single(void *dst, const volatile void __iomem *src,int zpci_write_block (volatile void __iomem *dst,const void *src,unsigned long len); -static inline u8 zpci_get_max_write_size (u64 src,u64 dst,int len,int max) +static inline int zpci_get_max_io_size (u64 src,u64 dst,int len,int max) { -int count = len > max ? max : len, size =1 ; +int offset = dst &ZPCI_BOUNDARY_MASK ; +int size; -while (!(src &0x1 ) && !(dst &0x1 ) && ((size <<1 ) <= count)) { - dst = dst >>1 ; - src = src >>1 ; - size = size <<1 ; - } -return size; + size =min3 (len,ZPCI_BOUNDARY_SIZE - offset, max); +if (IS_ALIGNED (src,8 ) &&IS_ALIGNED (dst,8 ) &&IS_ALIGNED (size,8 )) +return size; + +if (size >=8 ) +return 8 ; +return rounddown_pow_of_two (size); } static inline int zpci_memcpy_fromio(void *dst,
@@ -144,9 +148,9 @@ static inline int zpci_memcpy_fromio(void *dst,int size, rc =0 ;while (n >0 ) { - size =zpci_get_max_write_size ((u64 __force ) src, - (u64 ) dst, n, -ZPCI_MAX_READ_SIZE ); + size =zpci_get_max_io_size ((u64 __force ) src, + (u64 ) dst, n, +ZPCI_MAX_READ_SIZE ); rc =zpci_read_single (dst, src, size);if (rc)break ;
@@ -166,9 +170,9 @@ static inline int zpci_memcpy_toio(volatile void __iomem *dst,return -EINVAL ;while (n >0 ) { - size =zpci_get_max_write_size ((u64 __force ) dst, - (u64 ) src, n, -ZPCI_MAX_WRITE_SIZE ); + size =zpci_get_max_io_size ((u64 __force ) dst, + (u64 ) src, n, +ZPCI_MAX_WRITE_SIZE );if (size >8 )/* main path */ rc =zpci_write_block (dst, src, size);else
arch/s390/pci/pci_mmio.c +6 -6
@@ -97,9 +97,9 @@ static inline int __memcpy_toio_inuser(void __iomem *dst,return -EINVAL ;while (n >0 ) { - size =zpci_get_max_write_size ((u64 __force ) dst, - (u64 __force ) src, n, -ZPCI_MAX_WRITE_SIZE ); + size =zpci_get_max_io_size ((u64 __force ) dst, + (u64 __force ) src, n, +ZPCI_MAX_WRITE_SIZE );if (size >8 )/* main path */ rc =__pcistb_mio_inuser (dst, src, size, &status);else
@@ -242,9 +242,9 @@ static inline int __memcpy_fromio_inuser(void __user *dst,u8 status;while (n >0 ) { - size =zpci_get_max_write_size ((u64 __force ) src, - (u64 __force ) dst, n, -ZPCI_MAX_READ_SIZE ); + size =zpci_get_max_io_size ((u64 __force ) src, + (u64 __force ) dst, n, +ZPCI_MAX_READ_SIZE ); rc =__pcilg_mio_inuser (dst, src, size, &status);if (rc)break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 378/417 net: qualcomm: rmnet: fix global oob in rmnet_policy
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <[email protected]>
[ Upstream commit b33fb5b801c6db408b774a68e7c8722796b59ecc ]
The variable rmnet_link_ops assign a *bigger* maxtype which leads to a global out-of-bounds read when parsing the netlink attributes. See bug trace below:
==================================================================
BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline]
BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600
Read of size 1 at addr ffffffff92c438d0 by task syz-executor.6/84207
CPU: 0 PID: 84207 Comm: syz-executor.6 Tainted: G N 6.1.0 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:284 [inline]
print_report+0x172/0x475 mm/kasan/report.c:395
kasan_report+0xbb/0x1c0 mm/kasan/report.c:495
validate_nla lib/nlattr.c:386 [inline]
__nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600
__nla_parse+0x3e/0x50 lib/nlattr.c:697
nla_parse_nested_deprecated include/net/netlink.h:1248 [inline]
__rtnl_newlink+0x50a/0x1880 net/core/rtnetlink.c:3485
rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3594
rtnetlink_rcv_msg+0x43c/0xd70 net/core/rtnetlink.c:6091
netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0x154/0x190 net/socket.c:734
____sys_sendmsg+0x6df/0x840 net/socket.c:2482
___sys_sendmsg+0x110/0x1b0 net/socket.c:2536
__sys_sendmsg+0xf3/0x1c0 net/socket.c:2565
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fdcf2072359
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fdcf13e3168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fdcf219ff80 RCX: 00007fdcf2072359
RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003
RBP: 00007fdcf20bd493 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffbb8d7bdf R14: 00007fdcf13e3300 R15: 0000000000022000
</TASK>
The buggy address belongs to the variable:
rmnet_policy+0x30/0xe0
The buggy address belongs to the physical page:
page:0000000065bdeb3c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x155243
flags: 0x200000000001000(reserved|node=0|zone=2)
raw: 0200000000001000 ffffea00055490c8 ffffea00055490c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffffffff92c43780: f9 f9 f9 f9 00 00 00 02 f9 f9 f9 f9 00 00 00 07
ffffffff92c43800: f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 06 f9 f9 f9
>ffffffff92c43880: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9
^
ffffffff92c43900: 00 00 00 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9 f9
ffffffff92c43980: 00 00 00 07 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9According to the comment of nla_parse_nested_deprecated, the maxtype should be len(destination array) - 1. Hence use IFLA_RMNET_MAX here.
--- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c +1 -1
@@ -391,7 +391,7 @@ static int rmnet_fill_info(struct sk_buff *skb, const struct net_device *dev)struct rtnl_link_ops rmnet_link_ops__read_mostly = { .kind ="rmnet" , - .maxtype = __IFLA_RMNET_MAX, + .maxtype =IFLA_RMNET_MAX , .priv_size =sizeof (struct rmnet_priv ), .setup = rmnet_vnd_setup, .validate = rmnet_rtnl_validate,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 379/417 net: ethernet: ti: am65-cpsw: Fix max mtu to fit ethernet frames
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanjuán García, Jorge <[email protected]>
[ Upstream commit 64e47d8afb5ca533b27efc006405e5bcae2c4a7b ]
The value of AM65_CPSW_MAX_PACKET_SIZE represents the maximum length of a received frame. This value is written to the register AM65_CPSW_PORT_REG_RX_MAXLEN.
The maximum MTU configured on the network device should then leave some room for the ethernet headers and frame check. Otherwise, if the network interface is configured to its maximum mtu possible, the frames will be larger than AM65_CPSW_MAX_PACKET_SIZE and will get dropped as oversized.
The switch supports ethernet frame sizes between 64 and 2024 bytes (including VLAN) as stated in the technical reference manual, so define AM65_CPSW_MAX_PACKET_SIZE with that maximum size.
--- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ethernet/ti/am65-cpsw-nuss.c +3 -2
@@ -54,7 +54,7 @@#define AM65_CPSW_MAX_PORTS 8#define AM65_CPSW_MIN_PACKET_SIZE VLAN_ETH_ZLEN -#define AM65_CPSW_MAX_PACKET_SIZE (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN) +#define AM65_CPSW_MAX_PACKET_SIZE 2024#define AM65_CPSW_REG_CTL 0x004#define AM65_CPSW_REG_STAT_PORT_EN 0x014
@@ -1990,7 +1990,8 @@ am65_cpsw_nuss_init_port_ndev(struct am65_cpsw_common *common, u32 port_idx)eth_hw_addr_set (port->ndev, port->slave.mac_addr); port->ndev->min_mtu =AM65_CPSW_MIN_PACKET_SIZE ; - port->ndev->max_mtu =AM65_CPSW_MAX_PACKET_SIZE ; + port->ndev->max_mtu =AM65_CPSW_MAX_PACKET_SIZE - + (VLAN_ETH_HLEN +ETH_FCS_LEN ); port->ndev->hw_features =NETIF_F_SG |NETIF_F_RXCSUM | NETIF_F_HW_CSUM |
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 380/417 amt: do not use overwrapped cb area
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <[email protected]>
[ Upstream commit bec161add35b478a7746bf58bcdea6faa19129ef ]
amt driver uses skb->cb for storing tunnel information.
This job is worked before TC layer and then amt driver load tunnel info from skb->cb after TC layer.
So, its cb area should not be overwrapped with CB area used by TC. In order to not use cb area used by TC, it skips the biggest cb structure used by TC, which was qdisc_skb_cb.
But it's not anymore.
Currently, biggest structure of TC's CB is tc_skb_cb.
So, it should skip size of tc_skb_cb instead of qdisc_skb_cb.
--- drivers/net/amt.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/amt.c +3 -3
@@ -11,7 +11,7 @@#include <linux/net.h> #include <linux/igmp.h> #include <linux/workqueue.h> -#include <net/sch_generic.h> +#include <net/pkt_sched.h> #include <net/net_namespace.h> #include <net/ip.h> #include <net/udp.h>
@@ -80,11 +80,11 @@ static struct mld2_grec mldv2_zero_grec;static struct amt_skb_cb *amt_skb_cb (struct sk_buff *skb) { -BUILD_BUG_ON (sizeof (struct amt_skb_cb ) +sizeof (struct qdisc_skb_cb ) > +BUILD_BUG_ON (sizeof (struct amt_skb_cb ) +sizeof (struct tc_skb_cb ) > sizeof_field(struct sk_buff, cb));return (struct amt_skb_cb *)((void *)skb->cb + -sizeof (struct qdisc_skb_cb )); +sizeof (struct tc_skb_cb )); }static void __amt_source_gc_work (void )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 381/417 net: phy: micrel: populate .soft_reset for KSZ9131
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
[ Upstream commit e398822c4751017fe401f57409488f5948d12fb5 ]
The RZ/G3S SMARC Module has 2 KSZ9131 PHYs. In this setup, the KSZ9131 PHY is used with the ravb Ethernet driver. It has been discovered that when bringing the Ethernet interface down/up continuously, e.g., with the following sh script:
$ while :; do ifconfig eth0 down; ifconfig eth0 up; done
the link speed and duplex are wrong after interrupting the bring down/up operation even though the Ethernet interface is up. To recover from this state the following configuration sequence is necessary (executed manually):
$ ifconfig eth0 down $ ifconfig eth0 up
The behavior has been identified also on the Microchip SAMA7G5-EK board which runs the macb driver and uses the same PHY.
The order of PHY-related operations in ravb_open() is as follows:ravb_open() ->
ravb_phy_start() ->
ravb_phy_init() ->
of_phy_connect() ->
phy_connect_direct() ->
phy_attach_direct() ->
phy_init_hw() ->
phydev->drv->soft_reset()
phydev->drv->config_init()
phydev->drv->config_intr()
phy_resume()
kszphy_resume()The order of PHY-related operations in ravb_close is as follows:ravb_close() ->
phy_stop() ->
phy_suspend() ->
kszphy_suspend() ->
genphy_suspend()
// set BMCR_PDOWN bit in MII_BMCRIn genphy_suspend() setting the BMCR_PDWN bit in MII_BMCR switches the PHY to Software Power-Down (SPD) mode (according to the KSZ9131 datasheet). Thus, when opening the interface after it has been previously closed (via ravb_close()), the phydev->drv->config_init() and phydev->drv->config_intr() reach the KSZ9131 PHY driver via the ksz9131_config_init() and kszphy_config_intr() functions.
KSZ9131 specifies that the MII management interface remains operational during SPD (Software Power-Down), but (according to manual):
- Only access to the standard registers (0 through 31) is supported.
- Access to MMD address spaces other than MMD address space 1 is possible if the spd_clock_gate_override bit is set.
- Access to MMD address space 1 is not possible.
The spd_clock_gate_override bit is not used in the KSZ9131 driver.
ksz9131_config_init() configures RGMII delay, pad skews and LEDs by accessesing MMD registers other than those in address space 1.
The datasheet for the KSZ9131 does not specify what happens if registers from an unsupported address space are accessed while the PHY is in SPD.
To fix the issue the .soft_reset method has been instantiated for KSZ9131, too. This resets the PHY to the default state before doing any configurations to it, thus switching it out of SPD.
--- drivers/net/phy/micrel.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/phy/micrel.c +1 -0
@@ -3302,6 +3302,7 @@ static struct phy_driver ksphy_driver[] = { .flags = PHY_POLL_CABLE_TEST, .driver_data = &ksz9021_type, .probe = kszphy_probe, + .soft_reset = genphy_soft_reset, .config_init = ksz9131_config_init, .config_intr = kszphy_config_intr, .handle_interrupt = kszphy_handle_interrupt,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 382/417 mptcp: mptcp_parse_option() fix for MPTCPOPT_MP_JOIN
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 89e23277f9c16df6f9f9c1a1a07f8f132339c15c ]
mptcp_parse_option() currently sets OPTIONS_MPTCP_MPJ, for the three possible cases handled for MPTCPOPT_MP_JOIN option.
OPTIONS_MPTCP_MPJ is the combination of three flags:
- OPTION_MPTCP_MPJ_SYN
- OPTION_MPTCP_MPJ_SYNACK
- OPTION_MPTCP_MPJ_ACK
This is a problem, because backup, join_id, token, nonce and/or hmac fields could be left uninitialized in some cases.
Distinguish the three cases, as following patches will need this step.
--- net/mptcp/options.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/mptcp/options.c +3 -3
@@ -118,8 +118,8 @@ static void mptcp_parse_option(const struct sk_buff *skb,break ;case MPTCPOPT_MP_JOIN : - mp_opt->suboptions |=OPTIONS_MPTCP_MPJ ;if (opsize ==TCPOLEN_MPTCP_MPJ_SYN ) { + mp_opt->suboptions |=OPTION_MPTCP_MPJ_SYN ; mp_opt->backup = *ptr++ &MPTCPOPT_BACKUP ; mp_opt->join_id = *ptr++; mp_opt->token =get_unaligned_be32 (ptr);
@@ -130,6 +130,7 @@ static void mptcp_parse_option(const struct sk_buff *skb, mp_opt->backup, mp_opt->join_id, mp_opt->token, mp_opt->nonce); }else if (opsize ==TCPOLEN_MPTCP_MPJ_SYNACK ) { + mp_opt->suboptions |=OPTION_MPTCP_MPJ_SYNACK ; mp_opt->backup = *ptr++ &MPTCPOPT_BACKUP ; mp_opt->join_id = *ptr++; mp_opt->thmac =get_unaligned_be64 (ptr);
@@ -140,11 +141,10 @@ static void mptcp_parse_option(const struct sk_buff *skb, mp_opt->backup, mp_opt->join_id, mp_opt->thmac, mp_opt->nonce); }else if (opsize ==TCPOLEN_MPTCP_MPJ_ACK ) { + mp_opt->suboptions |=OPTION_MPTCP_MPJ_ACK ; ptr +=2 ;memcpy (mp_opt->hmac, ptr,MPTCPOPT_HMAC_LEN );pr_debug ("MP_JOIN hmac" ); - }else { - mp_opt->suboptions &= ~OPTIONS_MPTCP_MPJ ; }break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 383/417 mptcp: strict validation before using mp_opt->hmac
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit c1665273bdc7c201766c65e561c06711f2e050dc ]
mp_opt->hmac contains uninitialized data unless OPTION_MPTCP_MPJ_ACK was set in mptcp_parse_option().
We must refine the condition before we call subflow_hmac_valid().
--- net/mptcp/subflow.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mptcp/subflow.c +1 -1
@@ -718,7 +718,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, }else if (subflow_req->mp_join) {mptcp_get_options (skb, &mp_opt); -if (!(mp_opt.suboptions &OPTIONS_MPTCP_MPJ ) || +if (!(mp_opt.suboptions &OPTION_MPTCP_MPJ_ACK ) || !subflow_hmac_valid (req, &mp_opt) || !mptcp_can_accept_new_subflow (subflow_req->msk)) {SUBFLOW_REQ_INC_STATS (req,MPTCP_MIB_JOINACKMAC );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 384/417 mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit be1d9d9d38da922bd4beeec5b6dd821ff5a1dfeb ]
subflow_finish_connect() uses four fields (backup, join_id, thmac, none) that may contain garbage unless OPTION_MPTCP_MPJ_SYNACK has been set in mptcp_parse_option()
--- net/mptcp/subflow.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mptcp/subflow.c +1 -1
@@ -438,7 +438,7 @@ static void subflow_finish_connect(struct sock *sk, const struct sk_buff *skb) }else if (subflow->request_join) {u8 hmac[SHA256_DIGEST_SIZE ]; -if (!(mp_opt.suboptions &OPTIONS_MPTCP_MPJ )) { +if (!(mp_opt.suboptions &OPTION_MPTCP_MPJ_SYNACK )) { subflow->reset_reason =MPTCP_RST_EMPTCP ; goto do_reset; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 385/417 mptcp: use OPTION_MPTCP_MPJ_SYN in subflow_check_req()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 66ff70df1a919a066942844bb095d6fcb748d78d ]
syzbot reported that subflow_check_req() was using uninitialized data in subflow_check_req() [1]
This is because mp_opt.token is only set when OPTION_MPTCP_MPJ_SYN is also set.
While we are are it, fix mptcp_subflow_init_cookie_req() to test for OPTION_MPTCP_MPJ_ACK.
[1]
BUG: KMSAN: uninit-value in subflow_token_join_request net/mptcp/subflow.c:91 [inline] BUG: KMSAN: uninit-value in subflow_check_req+0x1028/0x15d0 net/mptcp/subflow.c:209 subflow_token_join_request net/mptcp/subflow.c:91 [inline] subflow_check_req+0x1028/0x15d0 net/mptcp/subflow.c:209 subflow_v6_route_req+0x269/0x410 net/mptcp/subflow.c:367 tcp_conn_request+0x153a/0x4240 net/ipv4/tcp_input.c:7164 subflow_v6_conn_request+0x3ee/0x510 tcp_rcv_state_process+0x2e1/0x4ac0 net/ipv4/tcp_input.c:6659 tcp_v6_do_rcv+0x11bf/0x1fe0 net/ipv6/tcp_ipv6.c:1669 tcp_v6_rcv+0x480b/0x4fb0 net/ipv6/tcp_ipv6.c:1900 ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438 ip6_input_finish net/ipv6/ip6_input.c:483 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492 dst_input include/net/dst.h:461 [inline] ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:314 [inline] ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5532 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5646 netif_receive_skb_internal net/core/dev.c:5732 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5791 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2020 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x1490 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Local variable mp_opt created at:
subflow_check_req+0x6d/0x15d0 net/mptcp/subflow.c:145 subflow_v6_route_req+0x269/0x410 net/mptcp/subflow.c:367 CPU: 1 PID: 5924 Comm: syz-executor.3 Not tainted 6.7.0-rc8-syzkaller-00055-g5eff55d725a4 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
--- net/mptcp/subflow.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/mptcp/subflow.c +2 -2
@@ -157,7 +157,7 @@ static int subflow_check_req(struct request_sock *req,mptcp_get_options (skb, &mp_opt); opt_mp_capable = !!(mp_opt.suboptions &OPTIONS_MPTCP_MPC ); - opt_mp_join = !!(mp_opt.suboptions &OPTIONS_MPTCP_MPJ ); + opt_mp_join = !!(mp_opt.suboptions &OPTION_MPTCP_MPJ_SYN );if (opt_mp_capable) {SUBFLOW_REQ_INC_STATS (req,MPTCP_MIB_MPCAPABLEPASSIVE );
@@ -254,7 +254,7 @@ int mptcp_subflow_init_cookie_req(struct request_sock *req,mptcp_get_options (skb, &mp_opt); opt_mp_capable = !!(mp_opt.suboptions &OPTIONS_MPTCP_MPC ); - opt_mp_join = !!(mp_opt.suboptions &OPTIONS_MPTCP_MPJ ); + opt_mp_join = !!(mp_opt.suboptions &OPTION_MPTCP_MPJ_ACK );if (opt_mp_capable && opt_mp_join)return -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 386/417 mptcp: refine opt_mp_capable determination
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 724b00c12957973656d312dce2a110c75ae2c680 ]
OPTIONS_MPTCP_MPC is a combination of three flags.
It would be better to be strict about testing what flag is expected, at least for code readability.
mptcp_parse_option() already makes the distinction.
- subflow_check_req() should use OPTION_MPTCP_MPC_SYN.
- mptcp_subflow_init_cookie_req() should use OPTION_MPTCP_MPC_ACK.
- subflow_finish_connect() should use OPTION_MPTCP_MPC_SYNACK
- subflow_syn_recv_sock should use OPTION_MPTCP_MPC_ACK
--- net/mptcp/subflow.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/mptcp/subflow.c +4 -4
@@ -156,7 +156,7 @@ static int subflow_check_req(struct request_sock *req,mptcp_get_options (skb, &mp_opt); - opt_mp_capable = !!(mp_opt.suboptions &OPTIONS_MPTCP_MPC ); + opt_mp_capable = !!(mp_opt.suboptions &OPTION_MPTCP_MPC_SYN ); opt_mp_join = !!(mp_opt.suboptions &OPTION_MPTCP_MPJ_SYN );if (opt_mp_capable) {SUBFLOW_REQ_INC_STATS (req,MPTCP_MIB_MPCAPABLEPASSIVE );
@@ -253,7 +253,7 @@ int mptcp_subflow_init_cookie_req(struct request_sock *req,subflow_init_req (req, sk_listener);mptcp_get_options (skb, &mp_opt); - opt_mp_capable = !!(mp_opt.suboptions &OPTIONS_MPTCP_MPC ); + opt_mp_capable = !!(mp_opt.suboptions &OPTION_MPTCP_MPC_ACK ); opt_mp_join = !!(mp_opt.suboptions &OPTION_MPTCP_MPJ_ACK );if (opt_mp_capable && opt_mp_join)return -EINVAL ;
@@ -415,7 +415,7 @@ static void subflow_finish_connect(struct sock *sk, const struct sk_buff *skb)mptcp_get_options (skb, &mp_opt);if (subflow->request_mptcp) { -if (!(mp_opt.suboptions &OPTIONS_MPTCP_MPC )) { +if (!(mp_opt.suboptions &OPTION_MPTCP_MPC_SYNACK )) {MPTCP_INC_STATS (sock_net (sk),MPTCP_MIB_MPCAPABLEACTIVEFALLBACK );mptcp_do_fallback (sk);
@@ -713,7 +713,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,* options. */ mptcp_get_options (skb, &mp_opt); -if (!(mp_opt.suboptions &OPTIONS_MPTCP_MPC )) +if (!(mp_opt.suboptions &OPTION_MPTCP_MPC_ACK )) fallback = true; }else if (subflow_req->mp_join) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 387/417 block: ensure we hold a queue reference when using queue limits
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
[ Upstream commit 7b4f36cd22a65b750b4cb6ac14804fb7d6e6c67d ]
q_usage_counter is the only thing preventing us from the limits changing under us in __bio_split_to_limits, but blk_mq_submit_bio doesn't hold it while calling into it.
Move the splitting inside the region where we know we've got a queue reference. Ideally this could still remain a shared section of code, but let's keep the fix simple and defer any refactoring here to later.
--- block/blk-mq.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
block/blk-mq.c +10 -6
@@ -2946,12 +2946,6 @@ void blk_mq_submit_bio(struct bio *bio)blk_status_t ret; bio =blk_queue_bounce (bio, q); -if (bio_may_exceed_limits (bio, &q->limits)) { - bio =__bio_split_to_limits (bio, &q->limits, &nr_segs); -if (!bio) -return ; - } -bio_set_ioprio (bio);if (plug) {
@@ -2960,6 +2954,11 @@ void blk_mq_submit_bio(struct bio *bio) rq =NULL ; }if (rq) { +if (unlikely (bio_may_exceed_limits (bio, &q->limits))) { + bio =__bio_split_to_limits (bio, &q->limits, &nr_segs); +if (!bio) +return ; + }if (!bio_integrity_prep (bio))return ;if (blk_mq_attempt_bio_merge (q, bio, nr_segs))
@@ -2970,6 +2969,11 @@ void blk_mq_submit_bio(struct bio *bio) }else {if (unlikely (bio_queue_enter (bio)))return ; +if (unlikely (bio_may_exceed_limits (bio, &q->limits))) { + bio =__bio_split_to_limits (bio, &q->limits, &nr_segs); +if (!bio) + goto fail; + }if (!bio_integrity_prep (bio)) goto fail; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 388/417 udp: annotate data-races around up->pending
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 482521d8e0c6520429478aa6866cd44128b33d5d ]
up->pending can be read without holding the socket lock, as pointed out by syzbot [1]
Add READ_ONCE() in lockless contexts, and WRITE_ONCE() on write side.
[1]
BUG: KCSAN: data-race in udpv6_sendmsg / udpv6_sendmsg
write to 0xffff88814e5eadf0 of 4 bytes by task 15547 on cpu 1:
udpv6_sendmsg+0x1405/0x1530 net/ipv6/udp.c:1596 inet6_sendmsg+0x63/0x80 net/ipv6/af_inet6.c:657 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x257/0x310 net/socket.c:2192 __do_sys_sendto net/socket.c:2204 [inline] __se_sys_sendto net/socket.c:2200 [inline] __x64_sys_sendto+0x78/0x90 net/socket.c:2200 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
read to 0xffff88814e5eadf0 of 4 bytes by task 15551 on cpu 0:
udpv6_sendmsg+0x22c/0x1530 net/ipv6/udp.c:1373 inet6_sendmsg+0x63/0x80 net/ipv6/af_inet6.c:657 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x37c/0x4d0 net/socket.c:2586 ___sys_sendmsg net/socket.c:2640 [inline] __sys_sendmmsg+0x269/0x500 net/socket.c:2726 __do_sys_sendmmsg net/socket.c:2755 [inline] __se_sys_sendmmsg net/socket.c:2752 [inline] __x64_sys_sendmmsg+0x57/0x60 net/socket.c:2752 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
value changed: 0x00000000 -> 0x0000000a
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 15551 Comm: syz-executor.1 Tainted: G W 6.7.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
--- net/ipv4/udp.c | 12 ++++++------ net/ipv6/udp.c | 16 ++++++++-------- 2 files changed, 14 insertions(+), 14 deletions(-)
net/ipv4/udp.c +6 -6
@@ -823,7 +823,7 @@ void udp_flush_pending_frames(struct sock *sk)if (up->pending) { up->len =0 ; - up->pending =0 ; +WRITE_ONCE (up->pending,0 );ip_flush_pending_frames (sk); } }
@@ -1010,7 +1010,7 @@ int udp_push_pending_frames(struct sock *sk) out: up->len =0 ; - up->pending =0 ; +WRITE_ONCE (up->pending,0 );return err; }EXPORT_SYMBOL (udp_push_pending_frames);
@@ -1086,7 +1086,7 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) getfrag = is_udplite ? udplite_getfrag : ip_generic_getfrag; fl4 = &inet->cork.fl.u.ip4; -if (up->pending) { +if (READ_ONCE (up->pending)) {/* * There are pending frames. * The socket lock must be held while it's corked.
@@ -1287,7 +1287,7 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) fl4->saddr = saddr; fl4->fl4_dport = dport; fl4->fl4_sport = inet->inet_sport; - up->pending =AF_INET ; +WRITE_ONCE (up->pending,AF_INET ); do_append_data: up->len += ulen;
@@ -1299,7 +1299,7 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)else if (!corkreq) err =udp_push_pending_frames (sk);else if (unlikely (skb_queue_empty (&sk->sk_write_queue))) - up->pending =0 ; +WRITE_ONCE (up->pending,0 );release_sock (sk); out:
@@ -1337,7 +1337,7 @@ void udp_splice_eof(struct socket *sock)struct sock *sk = sock->sk;struct udp_sock *up =udp_sk (sk); -if (!up->pending ||udp_test_bit (CORK , sk)) +if (!READ_ONCE (up->pending) ||udp_test_bit (CORK , sk))return ;lock_sock (sk);
net/ipv6/udp.c +8 -8
@@ -1152,7 +1152,7 @@ static void udp_v6_flush_pending_frames(struct sock *sk)udp_flush_pending_frames (sk); else if (up->pending) { up->len =0 ; - up->pending =0 ; +WRITE_ONCE (up->pending,0 );ip6_flush_pending_frames (sk); } }
@@ -1330,7 +1330,7 @@ static int udp_v6_push_pending_frames(struct sock *sk) &inet_sk(sk)->cork.base); out: up->len =0 ; - up->pending =0 ; +WRITE_ONCE (up->pending,0 );return err; }
@@ -1387,7 +1387,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)default :return -EINVAL ; } - }else if (!up->pending) { + }else if (!READ_ONCE (up->pending)) {if (sk->sk_state !=TCP_ESTABLISHED )return -EDESTADDRREQ ; daddr = &sk->sk_v6_daddr;
@@ -1418,8 +1418,8 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)return -EMSGSIZE ; getfrag = is_udplite ? udplite_getfrag : ip_generic_getfrag; -if (up->pending) { -if (up->pending ==AF_INET ) +if (READ_ONCE (up->pending)) { +if (READ_ONCE (up->pending) ==AF_INET )return udp_sendmsg (sk, msg, len);/* * There are pending frames.
@@ -1609,7 +1609,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) goto out; } - up->pending =AF_INET6 ; +WRITE_ONCE (up->pending,AF_INET6 ); do_append_data:if (ipc6.dontfrag <0 )
@@ -1623,7 +1623,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)else if (!corkreq) err =udp_v6_push_pending_frames (sk);else if (unlikely (skb_queue_empty (&sk->sk_write_queue))) - up->pending =0 ; +WRITE_ONCE (up->pending,0 );if (err >0 ) err = np->recverr ?net_xmit_errno (err) :0 ;
@@ -1663,7 +1663,7 @@ static void udpv6_splice_eof(struct socket *sock)struct sock *sk = sock->sk;struct udp_sock *up =udp_sk (sk); -if (!up->pending ||udp_test_bit (CORK , sk)) +if (!READ_ONCE (up->pending) ||udp_test_bit (CORK , sk))return ;lock_sock (sk);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 389/417 net: ravb: Fix dma_addr_t truncation in error case
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Yushchenko <[email protected]>
[ Upstream commit e327b2372bc0f18c30433ac40be07741b59231c5 ]
In ravb_start_xmit(), ravb driver uses u32 variable to store result of dma_map_single() call. Since ravb hardware has 32-bit address fields in descriptors, this works properly when mapping is successful - it is platform's job to provide mapping addresses that fit into hardware limitations.
However, in failure case dma_map_single() returns DMA_MAPPING_ERROR constant that is 64-bit when dma_addr_t is 64-bit. Storing this constant in u32 leads to truncation, and further call to dma_mapping_error() fails to notice the error.
Fix that by storing result of dma_map_single() in a dma_addr_t variable.
--- drivers/net/ethernet/renesas/ravb_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/renesas/ravb_main.c +1 -1
@@ -1965,7 +1965,7 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev)struct ravb_tstamp_skb *ts_skb;struct ravb_tx_desc *desc;unsigned long flags; -u32 dma_addr; +dma_addr_t dma_addr;void *buffer;u32 entry;u32 len;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 390/417 dt-bindings: gpio: xilinx: Fix node address in gpio
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Simek <[email protected]>
[ Upstream commit 314c020c4ed3de72b15603eb6892250bc4b51702 ]
Node address doesn't match reg property which is not correct.
--- Documentation/devicetree/bindings/gpio/xlnx,gpio-xilinx.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/gpio/xlnx,gpio-xilinx.yaml +1 -1
@@ -126,7 +126,7 @@ examples: - | #include <dt-bindings/interrupt-controller/arm-gic.h> - gpio@e000a000 { + gpio@a0020000 { compatible = "xlnx,xps-gpio-1.00.a"; reg = <0xa0020000 0x10000>; #gpio-cells = <2>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 391/417 drm/amdkfd: Use resource_size() helper function
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepak R Varma <[email protected]>
[ Upstream commit 9d086e0ddaeb08876f4df3a1485166bfd7483252 ]
Use the resource_size() function instead of a open coded computation resource size. It makes the code more readable.
Issue identified using resource_size.cocci coccinelle semantic patch.
Stable-dep-of: 02eed83abc13 ("drm/amdkfd: fixes for HMM mem allocation")
--- drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +1 -2
@@ -1038,8 +1038,7 @@ int svm_migrate_init(struct amdgpu_device *adev)/* Disable SVM support capability */ pgmap->type =0 ;if (pgmap->type ==MEMORY_DEVICE_PRIVATE ) -devm_release_mem_region (adev->dev, res->start, - res->end - res->start +1 ); +devm_release_mem_region (adev->dev, res->start,resource_size (res));return PTR_ERR (r); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 392/417 drm/amdkfd: fixes for HMM mem allocation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dafna Hirschfeld <[email protected]>
[ Upstream commit 02eed83abc1395a1207591aafad9bcfc5cb1abcb ]
Fix err return value and reset pgmap->type after checking it.
--- drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +3 -3
@@ -1019,7 +1019,7 @@ int svm_migrate_init(struct amdgpu_device *adev) }else { res =devm_request_free_mem_region (adev->dev, &iomem_resource, size);if (IS_ERR (res)) -return -ENOMEM ; +return PTR_ERR (res); pgmap->range.start = res->start; pgmap->range.end = res->end; pgmap->type =MEMORY_DEVICE_PRIVATE ;
@@ -1035,10 +1035,10 @@ int svm_migrate_init(struct amdgpu_device *adev) r =devm_memremap_pages (adev->dev, pgmap);if (IS_ERR (r)) {pr_err ("failed to register HMM device memory\n" ); -/* Disable SVM support capability */ - pgmap->type =0 ;if (pgmap->type ==MEMORY_DEVICE_PRIVATE )devm_release_mem_region (adev->dev, res->start,resource_size (res)); +/* Disable SVM support capability */ + pgmap->type =0 ;return PTR_ERR (r); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 393/417 net: stmmac: ethtool: Fixed calltrace caused by unbalanced disable_irq_wake calls
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiang Ma <[email protected]>
[ Upstream commit a23aa04042187cbde16f470b49d4ad60d32e9206 ]
We found the following dmesg calltrace when testing the GMAC NIC notebook:
[9.448656] ------------[ cut here ]------------ [9.448658] Unbalanced IRQ 43 wake disable [9.448673] WARNING: CPU: 3 PID: 1083 at kernel/irq/manage.c:688 irq_set_irq_wake+0xe0/0x128 [9.448717] CPU: 3 PID: 1083 Comm: ethtool Tainted: G O 4.19 #1 [9.448773] ... [9.448774] Call Trace: [9.448781] [<9000000000209b5c>] show_stack+0x34/0x140 [9.448788] [<9000000000d52700>] dump_stack+0x98/0xd0 [9.448794] [<9000000000228610>] __warn+0xa8/0x120 [9.448797] [<9000000000d2fb60>] report_bug+0x98/0x130 [9.448800] [<900000000020a418>] do_bp+0x248/0x2f0 [9.448805] [<90000000002035f4>] handle_bp_int+0x4c/0x78 [9.448808] [<900000000029ea40>] irq_set_irq_wake+0xe0/0x128 [9.448813] [<9000000000a96a7c>] stmmac_set_wol+0x134/0x150 [9.448819] [<9000000000be6ed0>] dev_ethtool+0x1368/0x2440 [9.448824] [<9000000000c08350>] dev_ioctl+0x1f8/0x3e0 [9.448827] [<9000000000bb2a34>] sock_ioctl+0x2a4/0x450 [9.448832] [<900000000046f044>] do_vfs_ioctl+0xa4/0x738 [9.448834] [<900000000046f778>] ksys_ioctl+0xa0/0xe8 [9.448837] [<900000000046f7d8>] sys_ioctl+0x18/0x28 [9.448840] [<9000000000211ab4>] syscall_common+0x20/0x34 [9.448842] ---[ end trace 40c18d9aec863c3e ]---
Multiple disable_irq_wake() calls will keep decreasing the IRQ wake_depth, When wake_depth is 0, calling disable_irq_wake() again, will report the above calltrace.
Due to the need to appear in pairs, we cannot call disable_irq_wake() without calling enable_irq_wake(). Fix this by making sure there are no unbalanced disable_irq_wake() calls.
--- drivers/net/ethernet/stmicro/stmmac/stmmac.h | 1 + drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 10 ++++++++-- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 + 3 files changed, 10 insertions(+), 2 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac.h +1 -0
@@ -247,6 +247,7 @@ struct stmmac_priv {u32 msg_enable;int wolopts;int wol_irq; +bool wol_irq_disabled;int clk_csr;struct timer_list eee_ctrl_timer;int lpi_irq;
drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +8 -2
@@ -761,10 +761,16 @@ static int stmmac_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)if (wol->wolopts) {pr_info ("stmmac: wakeup enable\n" );device_set_wakeup_enable (priv->device,1 ); -enable_irq_wake (priv->wol_irq); +/* Avoid unbalanced enable_irq_wake calls */ +if (priv->wol_irq_disabled) +enable_irq_wake (priv->wol_irq); + priv->wol_irq_disabled = false; }else {device_set_wakeup_enable (priv->device,0 ); -disable_irq_wake (priv->wol_irq); +/* Avoid unbalanced disable_irq_wake calls */ +if (!priv->wol_irq_disabled) +disable_irq_wake (priv->wol_irq); + priv->wol_irq_disabled = true; }mutex_lock (&priv->lock);
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +1 -0
@@ -3519,6 +3519,7 @@ static int stmmac_request_irq_multi_msi(struct net_device *dev)/* Request the Wake IRQ in case of another line * is used for WoL */ + priv->wol_irq_disabled = true;if (priv->wol_irq >0 && priv->wol_irq != dev->irq) { int_name = priv->int_name_wol;sprintf (int_name,"%s:%s" , dev->name,"wol" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 394/417 bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Sun <[email protected]>
[ Upstream commit 22c7fa171a02d310e3a3f6ed46a698ca8a0060ed ]
For PTR_TO_FLOW_KEYS, check_flow_keys_access() only uses fixed off for validation. However, variable offset ptr alu is not prohibited for this ptr kind. So the variable offset is not checked.
The following prog is accepted:
func#0 @0
0: R1=ctx() R10=fp0
0: (bf) r6 = r1 ; R1=ctx() R6_w=ctx() 1: (79) r7 = *(u64 *)(r6 +144) ; R6_w=ctx() R7_w=flow_keys() 2: (b7) r8 = 1024 ; R8_w=1024 3: (37) r8 /= 1 ; R8_w=scalar() 4: (57) r8 &= 1024 ; R8_w=scalar(smin=smin32=0,
smax=umax=smax32=umax32=1024,var_off=(0x0; 0x400))
5: (0f) r7 += r8
mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1
mark_precise: frame0: regs=r8 stack= before 4: (57) r8 &= 1024
mark_precise: frame0: regs=r8 stack= before 3: (37) r8 /= 1
mark_precise: frame0: regs=r8 stack= before 2: (b7) r8 = 1024 6: R7_w=flow_keys(smin=smin32=0,smax=umax=smax32=umax32=1024,var_off =(0x0; 0x400)) R8_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=1024, var_off=(0x0; 0x400))
6: (79) r0 = *(u64 *)(r7 +0) ; R0_w=scalar()
7: (95) exit
This prog loads flow_keys to r7, and adds the variable offset r8 to r7, and finally causes out-of-bounds access:
BUG: unable to handle page fault for address: ffffc90014c80038 [...] Call Trace: <TASK> bpf_dispatcher_nop_func include/linux/bpf.h:1231 [inline] __bpf_prog_run include/linux/filter.h:651 [inline] bpf_prog_run include/linux/filter.h:658 [inline] bpf_prog_run_pin_on_cpu include/linux/filter.h:675 [inline] bpf_flow_dissect+0x15f/0x350 net/core/flow_dissector.c:991 bpf_prog_test_run_flow_dissector+0x39d/0x620 net/bpf/test_run.c:1359 bpf_prog_test_run kernel/bpf/syscall.c:4107 [inline] __sys_bpf+0xf8f/0x4560 kernel/bpf/syscall.c:5475 __do_sys_bpf kernel/bpf/syscall.c:5561 [inline] __se_sys_bpf kernel/bpf/syscall.c:5559 [inline] __x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:5559 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Fix this by rejecting ptr alu with variable offset on flow_keys. Applying the patch rejects the program with "R7 pointer arithmetic on flow_keys prohibited".
--- kernel/bpf/verifier.c | 4 ++++ 1 file changed, 4 insertions(+)
kernel/bpf/verifier.c +4 -0
@@ -8541,6 +8541,10 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, }switch (base_type (ptr_reg->type)) { +case PTR_TO_FLOW_KEYS : +if (known) +break ; + fallthrough;case CONST_PTR_TO_MAP :/* smin_val represents the known value */ if (known && smin_val ==0 && opcode ==BPF_ADD )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 395/417 net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit 776dac5a662774f07a876b650ba578d0a62d20db ]
devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.
--- drivers/net/dsa/vitesse-vsc73xx-core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/dsa/vitesse-vsc73xx-core.c +2 -0
@@ -1119,6 +1119,8 @@ static int vsc73xx_gpio_probe(struct vsc73xx *vsc) vsc->gc.label =devm_kasprintf (vsc->dev,GFP_KERNEL ,"VSC%04x" , vsc->chipid); +if (!vsc->gc.label) +return -ENOMEM ; vsc->gc.ngpio =4 ; vsc->gc.owner =THIS_MODULE ; vsc->gc.parent = vsc->dev;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 396/417 LoongArch: BPF: Prevent out-of-bounds memory access
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hengqi Chen <[email protected]>
[ Upstream commit 36a87385e31c9343af9a4756598e704741250a67 ]
The test_tag test triggers an unhandled page fault:
# ./test_tag [ 130.640218] CPU 0 Unable to handle kernel paging request at virtual address ffff80001b898004, era == 9000000003137f7c, ra == 9000000003139e70 [ 130.640501] Oops[#3]: [ 130.640553] CPU: 0 PID: 1326 Comm: test_tag Tainted: G D O 6.7.0-rc4-loong-devel-gb62ab1a397cf #47 61985c1d94084daa2432f771daa45b56b10d8d2a [ 130.640764] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022 [ 130.640874] pc 9000000003137f7c ra 9000000003139e70 tp 9000000104cb4000 sp 9000000104cb7a40 [ 130.641001] a0 ffff80001b894000 a1 ffff80001b897ff8 a2 000000006ba210be a3 0000000000000000 [ 130.641128] a4 000000006ba210be a5 00000000000000f1 a6 00000000000000b3 a7 0000000000000000 [ 130.641256] t0 0000000000000000 t1 00000000000007f6 t2 0000000000000000 t3 9000000004091b70 [ 130.641387] t4 000000006ba210be t5 0000000000000004 t6 fffffffffffffff0 t7 90000000040913e0 [ 130.641512] t8 0000000000000005 u0 0000000000000dc0 s9 0000000000000009 s0 9000000104cb7ae0 [ 130.641641] s1 00000000000007f6 s2 0000000000000009 s3 0000000000000095 s4 0000000000000000 [ 130.641771] s5 ffff80001b894000 s6 ffff80001b897fb0 s7 9000000004090c50 s8 0000000000000000 [ 130.641900] ra: 9000000003139e70 build_body+0x1fcc/0x4988 [ 130.642007] ERA: 9000000003137f7c build_body+0xd8/0x4988 [ 130.642112] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) [ 130.642261] PRMD: 00000004 (PPLV0 +PIE -PWE) [ 130.642353] EUEN: 00000003 (+FPE +SXE -ASXE -BTE) [ 130.642458] ECFG: 00071c1c (LIE=2-4,10-12 VS=7) [ 130.642554] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0) [ 130.642658] BADV: ffff80001b898004 [ 130.642719] PRID: 0014c010 (Loongson-64bit, Loongson-3A5000) [ 130.642815] Modules linked in: [last unloaded: bpf_testmod(O)] [ 130.642924] Process test_tag (pid: 1326, threadinfo=00000000f7f4015f, task=000000006499f9fd) [ 130.643062] Stack : 0000000000000000 9000000003380724 0000000000000000 0000000104cb7be8 [ 130.643213] 0000000000000000 25af8d9b6e600558 9000000106250ea0 9000000104cb7ae0 [ 130.643378] 0000000000000000 0000000000000000 9000000104cb7be8 90000000049f6000 [ 130.643538] 0000000000000090 9000000106250ea0 ffff80001b894000 ffff80001b894000 [ 130.643685] 00007ffffb917790 900000000313ca94 0000000000000000 0000000000000000 [ 130.643831] ffff80001b894000 0000000000000ff7 0000000000000000 9000000100468000 [ 130.643983] 0000000000000000 0000000000000000 0000000000000040 25af8d9b6e600558 [ 130.644131] 0000000000000bb7 ffff80001b894048 0000000000000000 0000000000000000 [ 130.644276] 9000000104cb7be8 90000000049f6000 0000000000000090 9000000104cb7bdc [ 130.644423] ffff80001b894000 0000000000000000 00007ffffb917790 90000000032acfb0 [ 130.644572] ... [ 130.644629] Call Trace: [ 130.644641] [<9000000003137f7c>] build_body+0xd8/0x4988 [ 130.644785] [<900000000313ca94>] bpf_int_jit_compile+0x228/0x4ec [ 130.644891] [<90000000032acfb0>] bpf_prog_select_runtime+0x158/0x1b0 [ 130.645003] [<90000000032b3504>] bpf_prog_load+0x760/0xb44 [ 130.645089] [<90000000032b6744>] __sys_bpf+0xbb8/0x2588 [ 130.645175] [<90000000032b8388>] sys_bpf+0x20/0x2c [ 130.645259] [<9000000003f6ab38>] do_syscall+0x7c/0x94 [ 130.645369] [<9000000003121c5c>] handle_syscall+0xbc/0x158 [ 130.645507] [ 130.645539] Code: 380839f6 380831f9 28412bae <24000ca6> 004081ad 0014cb50 004083e8 02bff34c 58008e91 [ 130.645729] [ 130.646418] ---[ end trace 0000000000000000 ]---
On my machine, which has CONFIG_PAGE_SIZE_16KB=y, the test failed at loading a BPF prog with 2039 instructions:
prog = (struct bpf_prog *)ffff80001b894000
insn = (struct bpf_insn *)(prog->insnsi)ffff80001b894048 insn + 2039 = (struct bpf_insn *)ffff80001b898000 <- end of the page
In the build_insn() function, we are trying to access next instruction unconditionally, i.e. (insn + 1)->imm. The address lies in the next page and can be not owned by the current process, thus an page fault is inevitable and then segfault.
So, let's access next instruction only under dst = imm64 context.
With this fix, we have:
# ./test_tag test_tag: OK (40945 tests)
--- arch/loongarch/net/bpf_jit.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/loongarch/net/bpf_jit.c +4 -1
@@ -402,7 +402,6 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool extconst u8 dst = regmap[insn->dst_reg];const s16 off = insn->off;const s32 imm = insn->imm; -const u64 imm64 = (u64)(insn +1 )->imm <<32 | (u32 )insn->imm;const bool is32 =BPF_CLASS (insn->code) ==BPF_ALU ||BPF_CLASS (insn->code) ==BPF_JMP32 ;switch (code) {
@@ -806,8 +805,12 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext/* dst = imm64 */ case BPF_LD |BPF_IMM |BPF_DW : + { +const u64 imm64 = (u64)(insn +1 )->imm <<32 | (u32 )insn->imm; +move_imm (ctx, dst, imm64, is32);return 1 ; + }/* dst = *(size *)(src + off) */ case BPF_LDX |BPF_MEM |BPF_B :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 397/417 mptcp: relax check on MPC passive fallback
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
[ Upstream commit c0f5aec28edf98906d28f08daace6522adf9ee7a ]
While testing the blamed commit below, I was able to miss (!) packetdrill failures in the fastopen test-cases.
On passive fastopen the child socket is created by incoming TCP MPC syn, allow for both MPC_SYN and MPC_ACK header.
--- net/mptcp/subflow.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/mptcp/subflow.c +2 -1
@@ -713,7 +713,8 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,* options. */ mptcp_get_options (skb, &mp_opt); -if (!(mp_opt.suboptions &OPTION_MPTCP_MPC_ACK )) +if (!(mp_opt.suboptions & + (OPTION_MPTCP_MPC_SYN |OPTION_MPTCP_MPC_ACK ))) fallback = true; }else if (subflow_req->mp_join) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 398/417 netfilter: nf_tables: reject invalid set policy
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 0617c3de9b4026b87be12b0cb5c35f42c7c66fcb ]
Report -EINVAL in case userspace provides a unsupported set backend policy.
--- net/netfilter/nf_tables_api.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +9 -1
@@ -4753,8 +4753,16 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, } desc.policy =NFT_SET_POL_PERFORMANCE ; -if (nla[NFTA_SET_POLICY ] !=NULL ) +if (nla[NFTA_SET_POLICY ] !=NULL ) { desc.policy =ntohl (nla_get_be32 (nla[NFTA_SET_POLICY ])); +switch (desc.policy) { +case NFT_SET_POL_PERFORMANCE : +case NFT_SET_POL_MEMORY : +break ; +default : +return -EOPNOTSUPP ; + } + }if (nla[NFTA_SET_DESC ] !=NULL ) { err =nf_tables_set_desc_parse (&desc, nla[NFTA_SET_DESC ]);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 399/417 netfilter: nft_limit: do not ignore unsupported flags
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 91a139cee1202a4599a380810d93c69b5bac6197 ]
Bail out if userspace provides unsupported flags, otherwise future extensions to the limit expression will be silently ignored by the kernel.
--- net/netfilter/nft_limit.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
net/netfilter/nft_limit.c +12 -7
@@ -58,6 +58,7 @@ static inline bool nft_limit_eval(struct nft_limit_priv *priv, u64 cost)static int nft_limit_init (struct nft_limit_priv *priv,const struct nlattr *const tb[],bool pkts) { +bool invert = false;u64 unit, tokens; if (tb[NFTA_LIMIT_RATE] == NULL ||
@@ -90,19 +91,23 @@ static int nft_limit_init(struct nft_limit_priv *priv, priv->rate); } +if (tb[NFTA_LIMIT_FLAGS ]) { +u32 flags =ntohl (nla_get_be32 (tb[NFTA_LIMIT_FLAGS ])); + +if (flags & ~NFT_LIMIT_F_INV ) +return -EOPNOTSUPP ; + +if (flags &NFT_LIMIT_F_INV ) + invert = true; + } + priv->limit =kmalloc (sizeof (*priv->limit),GFP_KERNEL_ACCOUNT );if (!priv->limit)return -ENOMEM ; priv->limit->tokens = tokens; priv->tokens_max = priv->limit->tokens; - -if (tb[NFTA_LIMIT_FLAGS ]) { -u32 flags =ntohl (nla_get_be32 (tb[NFTA_LIMIT_FLAGS ])); - -if (flags &NFT_LIMIT_F_INV ) - priv->invert = true; - } + priv->invert = invert; priv->limit->last =ktime_get_ns ();spin_lock_init (&priv->limit->lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 400/417 netfilter: nfnetlink_log: use proper helper for fetching physinif
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Tikhomirov <[email protected]>
[ Upstream commit c3f9fd54cd87233f53bdf0e191a86b3a5e960e02 ]
We don't use physindev in __build_packet_message except for getting physinif from it. So let's switch to nf_bridge_get_physinif to get what we want directly.
Stable-dep-of: 9874808878d9 ("netfilter: bridge: replace physindev with physinif in nf_bridge_info")
--- net/netfilter/nfnetlink_log.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/netfilter/nfnetlink_log.c +4 -4
@@ -499,7 +499,7 @@ __build_packet_message(struct nfnl_log_net *log, htonl(br_port_get_rcu(indev)->br->dev->ifindex))) goto nla_put_failure; }else { -struct net_device *physindev; +int physinif;/* Case 2: indev is bridge group, we need to look for * physical device (when called from ipv4) */
@@ -507,10 +507,10 @@ __build_packet_message(struct nfnl_log_net *log, htonl(indev->ifindex))) goto nla_put_failure; - physindev =nf_bridge_get_physindev (skb); -if (physindev && + physinif =nf_bridge_get_physinif (skb); +if (physinif &&nla_put_be32 (inst->skb,NFULA_IFINDEX_PHYSINDEV , -htonl (physindev->ifindex))) +htonl (physinif))) goto nla_put_failure; }#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 401/417 netfilter: nf_queue: remove excess nf_bridge variable
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Tikhomirov <[email protected]>
[ Upstream commit aeaa44075f8e49e2e0ad4507d925e690b7950145 ]
We don't really need nf_bridge variable here. And nf_bridge_info_exists is better replacement for nf_bridge_info_get in case we are only checking for existence.
Stable-dep-of: 9874808878d9 ("netfilter: bridge: replace physindev with physinif in nf_bridge_info")
--- net/netfilter/nf_queue.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
net/netfilter/nf_queue.c +1 -3
@@ -82,10 +82,8 @@ static void __nf_queue_entry_init_physdevs(struct nf_queue_entry *entry) {#if IS_ENABLED (CONFIG_BRIDGE_NETFILTER )const struct sk_buff *skb = entry->skb; -struct nf_bridge_info *nf_bridge; - nf_bridge =nf_bridge_info_get (skb); -if (nf_bridge) { +if (nf_bridge_info_exists (skb)) { entry->physin =nf_bridge_get_physindev (skb); entry->physout =nf_bridge_get_physoutdev (skb); }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 402/417 netfilter: propagate net to nf_bridge_get_physindev
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Tikhomirov <[email protected]>
[ Upstream commit a54e72197037d2c9bfcd70dddaac8c8ccb5b41ba ]
This is a preparation patch for replacing physindev with physinif on nf_bridge_info structure. We will use dev_get_by_index_rcu to resolve device, when needed, and it requires net to be available.
Stable-dep-of: 9874808878d9 ("netfilter: bridge: replace physindev with physinif in nf_bridge_info")
--- include/linux/netfilter_bridge.h | 2 +- net/ipv4/netfilter/nf_reject_ipv4.c | 2 +- net/ipv6/netfilter/nf_reject_ipv6.c | 2 +- net/netfilter/ipset/ip_set_hash_netiface.c | 8 ++++---- net/netfilter/nf_log_syslog.c | 13 +++++++------ net/netfilter/nf_queue.c | 2 +- net/netfilter/xt_physdev.c | 2 +- 7 files changed, 16 insertions(+), 15 deletions(-)
include/linux/netfilter_bridge.h +1 -1
@@ -56,7 +56,7 @@ static inline int nf_bridge_get_physoutif(const struct sk_buff *skb) }static inline struct net_device * -nf_bridge_get_physindev (const struct sk_buff *skb) +nf_bridge_get_physindev (const struct sk_buff *skb,struct net *net) {const struct nf_bridge_info *nf_bridge =nf_bridge_info_get (skb);
net/ipv4/netfilter/nf_reject_ipv4.c +1 -1
@@ -288,7 +288,7 @@ void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb,* build the eth header using the original destination's MAC as the * source, and send the RST packet directly. */ - br_indev =nf_bridge_get_physindev (oldskb); + br_indev =nf_bridge_get_physindev (oldskb, net);if (br_indev) {struct ethhdr *oeth =eth_hdr (oldskb);
net/ipv6/netfilter/nf_reject_ipv6.c +1 -1
@@ -353,7 +353,7 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb,* build the eth header using the original destination's MAC as the * source, and send the RST packet directly. */ - br_indev =nf_bridge_get_physindev (oldskb); + br_indev =nf_bridge_get_physindev (oldskb, net);if (br_indev) {struct ethhdr *oeth =eth_hdr (oldskb);
net/netfilter/ipset/ip_set_hash_netiface.c +4 -4
@@ -138,9 +138,9 @@ hash_netiface4_data_next(struct hash_netiface4_elem *next,#include "ip_set_hash_gen.h" #if IS_ENABLED (CONFIG_BRIDGE_NETFILTER ) -static const char *get_physindev_name (const struct sk_buff *skb) +static const char *get_physindev_name (const struct sk_buff *skb,struct net *net) { -struct net_device *dev =nf_bridge_get_physindev (skb); +struct net_device *dev =nf_bridge_get_physindev (skb, net);return dev ? dev->name :NULL ; }
@@ -177,7 +177,7 @@ hash_netiface4_kadt(struct ip_set *set, const struct sk_buff *skb,if (opt->cmdflags &IPSET_FLAG_PHYSDEV ) {#if IS_ENABLED (CONFIG_BRIDGE_NETFILTER ) -const char *eiface =SRCDIR ?get_physindev_name (skb) : +const char *eiface =SRCDIR ?get_physindev_name (skb,xt_net (par)) :get_physoutdev_name (skb);if (!eiface)
@@ -395,7 +395,7 @@ hash_netiface6_kadt(struct ip_set *set, const struct sk_buff *skb,if (opt->cmdflags &IPSET_FLAG_PHYSDEV ) {#if IS_ENABLED (CONFIG_BRIDGE_NETFILTER ) -const char *eiface =SRCDIR ?get_physindev_name (skb) : +const char *eiface =SRCDIR ?get_physindev_name (skb,xt_net (par)) :get_physoutdev_name (skb);if (!eiface)
net/netfilter/nf_log_syslog.c +7 -6
@@ -111,7 +111,8 @@ nf_log_dump_packet_common(struct nf_log_buf *m, u8 pf, unsigned int hooknum, const struct sk_buff *skb, const struct net_device *in, const struct net_device *out, - const struct nf_loginfo *loginfo, const char *prefix) + const struct nf_loginfo *loginfo, const char *prefix, + struct net *net) { const struct net_device *physoutdev __maybe_unused;const struct net_device *physindev__maybe_unused ;
@@ -121,7 +122,7 @@ nf_log_dump_packet_common(struct nf_log_buf *m, u8 pf, in ? in->name :"" , out ? out->name : "");#if IS_ENABLED (CONFIG_BRIDGE_NETFILTER ) - physindev =nf_bridge_get_physindev (skb); + physindev =nf_bridge_get_physindev (skb, net);if (physindev && in != physindev)nf_log_buf_add (m,"PHYSIN=%s " , physindev->name); physoutdev =nf_bridge_get_physoutdev (skb);
@@ -148,7 +149,7 @@ static void nf_log_arp_packet(struct net *net, u_int8_t pf, loginfo = &default_loginfo;nf_log_dump_packet_common (m, pf, hooknum, skb, in, out, loginfo, - prefix); + prefix, net);dump_arp_packet (m, loginfo, skb,skb_network_offset (skb));nf_log_buf_close (m);
@@ -845,7 +846,7 @@ static void nf_log_ip_packet(struct net *net, u_int8_t pf, loginfo = &default_loginfo;nf_log_dump_packet_common (m, pf, hooknum, skb, in, - out, loginfo, prefix); + out, loginfo, prefix, net);if (in)dump_mac_header (m, loginfo, skb);
@@ -880,7 +881,7 @@ static void nf_log_ip6_packet(struct net *net, u_int8_t pf, loginfo = &default_loginfo;nf_log_dump_packet_common (m, pf, hooknum, skb, in, out, - loginfo, prefix); + loginfo, prefix, net);if (in)dump_mac_header (m, loginfo, skb);
@@ -916,7 +917,7 @@ static void nf_log_unknown_packet(struct net *net, u_int8_t pf, loginfo = &default_loginfo;nf_log_dump_packet_common (m, pf, hooknum, skb, in, out, loginfo, - prefix); + prefix, net);dump_mac_header (m, loginfo, skb);
net/netfilter/nf_queue.c +1 -1
@@ -84,7 +84,7 @@ static void __nf_queue_entry_init_physdevs(struct nf_queue_entry *entry)const struct sk_buff *skb = entry->skb;if (nf_bridge_info_exists (skb)) { - entry->physin =nf_bridge_get_physindev (skb); + entry->physin =nf_bridge_get_physindev (skb, entry->state.net); entry->physout =nf_bridge_get_physoutdev (skb); }else { entry->physin =NULL ;
net/netfilter/xt_physdev.c +1 -1
@@ -59,7 +59,7 @@ physdev_mt(const struct sk_buff *skb, struct xt_action_param *par) (!!outdev ^ !(info->invert & XT_PHYSDEV_OP_BRIDGED)))return false; - physdev =nf_bridge_get_physindev (skb); + physdev =nf_bridge_get_physindev (skb,xt_net (par)); indev = physdev ? physdev->name :NULL ; if ((info->bitmask & XT_PHYSDEV_OP_ISIN &&
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 403/417 netfilter: bridge: replace physindev with physinif in nf_bridge_info
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Tikhomirov <[email protected]>
[ Upstream commit 9874808878d9eed407e3977fd11fee49de1e1d86 ]
An skb can be added to a neigh->arp_queue while waiting for an arp reply. Where original skb's skb->dev can be different to neigh's neigh->dev. For instance in case of bridging dnated skb from one veth to another, the skb would be added to a neigh->arp_queue of the bridge.
As skb->dev can be reset back to nf_bridge->physindev and used, and as there is no explicit mechanism that prevents this physindev from been freed under us (for instance neigh_flush_dev doesn't cleanup skbs from different device's neigh queue) we can crash on e.g. this stack:
arp_process
neigh_update
skb = __skb_dequeue(&neigh->arp_queue)
neigh_resolve_output(..., skb)
...
br_nf_dev_xmit
br_nf_pre_routing_finish_bridge_slow
skb->dev = nf_bridge->physindev
br_handle_frame_finishLet's use plain ifindex instead of net_device link. To peek into the original net_device we will use dev_get_by_index_rcu(). Thus either we get device and are safe to use it or we don't get it and drop skb.
--- include/linux/netfilter_bridge.h | 4 +-- include/linux/skbuff.h | 2 +- net/bridge/br_netfilter_hooks.c | 42 +++++++++++++++++++++++------ net/bridge/br_netfilter_ipv6.c | 14 +++++++--- net/ipv4/netfilter/nf_reject_ipv4.c | 9 ++++--- net/ipv6/netfilter/nf_reject_ipv6.c | 11 +++++--- 6 files changed, 61 insertions(+), 21 deletions(-)
include/linux/netfilter_bridge.h +2 -2
@@ -42,7 +42,7 @@ static inline int nf_bridge_get_physinif(const struct sk_buff *skb)if (!nf_bridge)return 0 ; -return nf_bridge->physindev ? nf_bridge->physindev->ifindex :0 ; +return nf_bridge->physinif; }static inline int nf_bridge_get_physoutif (const struct sk_buff *skb)
@@ -60,7 +60,7 @@ nf_bridge_get_physindev(const struct sk_buff *skb, struct net *net) {const struct nf_bridge_info *nf_bridge =nf_bridge_info_get (skb); -return nf_bridge ? nf_bridge->physindev :NULL ; +return nf_bridge ?dev_get_by_index_rcu (net, nf_bridge->physinif) :NULL ; } static inline struct net_device *
include/linux/skbuff.h +1 -1
@@ -301,7 +301,7 @@ struct nf_bridge_info { u8 bridged_dnat:1; u8 sabotage_in_done:1;__u16 frag_max_size; -struct net_device *physindev; +int physinif;/* always valid & non-NULL from FORWARD on, for physdev match */ struct net_device *physoutdev;
net/bridge/br_netfilter_hooks.c +34 -8
102 lines not on this page · raw message
net/bridge/br_netfilter_ipv6.c +10 -4
@@ -161,9 +161,15 @@ static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struc {struct nf_bridge_info *nf_bridge =nf_bridge_info_get (skb);struct rtable *rt; -struct net_device *dev = skb->dev; +struct net_device *dev = skb->dev, *br_indev;const struct nf_ipv6_ops *v6ops =nf_get_ipv6_ops (); + br_indev =nf_bridge_get_physindev (skb, net); +if (!br_indev) { +kfree_skb (skb); +return 0 ; + } + nf_bridge->frag_max_size =IP6CB (skb)->frag_max_size;if (nf_bridge->pkt_otherhost) {
@@ -181,7 +187,7 @@ static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struc }if (skb_dst (skb)->dev == dev) { - skb->dev = nf_bridge->physindev; + skb->dev = br_indev;nf_bridge_update_protocol (skb);nf_bridge_push_encap_header (skb); br_nf_hook_thresh(NF_BR_PRE_ROUTING,
@@ -192,7 +198,7 @@ static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, strucether_addr_copy (eth_hdr (skb)->h_dest, dev->dev_addr); skb->pkt_type =PACKET_HOST ; }else { - rt =bridge_parent_rtable (nf_bridge->physindev); + rt =bridge_parent_rtable (br_indev);if (!rt) {kfree_skb (skb);return 0 ;
@@ -201,7 +207,7 @@ static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, strucskb_dst_set_noref (skb, &rt->dst); } - skb->dev = nf_bridge->physindev; + skb->dev = br_indev;nf_bridge_update_protocol (skb);nf_bridge_push_encap_header (skb); br_nf_hook_thresh(NF_BR_PRE_ROUTING, net, sk, skb,
net/ipv4/netfilter/nf_reject_ipv4.c +6 -3
@@ -239,7 +239,6 @@ static int nf_reject_fill_skb_dst(struct sk_buff *skb_in)void nf_send_reset (struct net *net,struct sock *sk,struct sk_buff *oldskb,int hook) { -struct net_device *br_indev__maybe_unused ;struct sk_buff *nskb;struct iphdr *niph;const struct tcphdr *oth;
@@ -288,9 +287,13 @@ void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb,* build the eth header using the original destination's MAC as the * source, and send the RST packet directly. */ - br_indev =nf_bridge_get_physindev (oldskb, net); -if (br_indev) { +if (nf_bridge_info_exists (oldskb)) {struct ethhdr *oeth =eth_hdr (oldskb); +struct net_device *br_indev; + + br_indev =nf_bridge_get_physindev (oldskb, net); +if (!br_indev) + goto free_nskb; nskb->dev = br_indev; niph->tot_len =htons (nskb->len);
net/ipv6/netfilter/nf_reject_ipv6.c +8 -3
@@ -278,7 +278,6 @@ static int nf_reject6_fill_skb_dst(struct sk_buff *skb_in)void nf_send_reset6 (struct net *net,struct sock *sk,struct sk_buff *oldskb,int hook) { -struct net_device *br_indev__maybe_unused ;struct sk_buff *nskb;struct tcphdr _otcph;const struct tcphdr *otcph;
@@ -353,9 +352,15 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb,* build the eth header using the original destination's MAC as the * source, and send the RST packet directly. */ - br_indev =nf_bridge_get_physindev (oldskb, net); -if (br_indev) { +if (nf_bridge_info_exists (oldskb)) {struct ethhdr *oeth =eth_hdr (oldskb); +struct net_device *br_indev; + + br_indev =nf_bridge_get_physindev (oldskb, net); +if (!br_indev) { +kfree_skb (nskb); +return ; + } nskb->dev = br_indev; nskb->protocol =htons (ETH_P_IPV6 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 404/417 netfilter: nf_tables: do not allow mismatch field size and set key length
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 3ce67e3793f48c1b9635beb9bb71116ca1e51b58 ]
The set description provides the size of each field in the set whose sum should not mismatch the set key length, bail out otherwise.
I did not manage to crash nft_set_pipapo with mismatch fields and set key length so far, but this is UB which must be disallowed.
--- net/netfilter/nf_tables_api.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +5 -1
@@ -4523,8 +4523,8 @@ static int nft_set_desc_concat_parse(const struct nlattr *attr,static int nft_set_desc_concat (struct nft_set_desc *desc,const struct nlattr *nla) { +u32 num_regs =0 , key_num_regs =0 ;struct nlattr *attr; -u32 num_regs =0 ;int rem, err, i;nla_for_each_nested (attr, nla, rem) {
@@ -4539,6 +4539,10 @@ static int nft_set_desc_concat(struct nft_set_desc *desc,for (i =0 ; i < desc->field_count; i++) num_regs +=DIV_ROUND_UP (desc->field_len[i],sizeof (u32)); + key_num_regs =DIV_ROUND_UP (desc->klen,sizeof (u32)); +if (key_num_regs != num_regs) +return -EINVAL ; +if (num_regs >NFT_REG32_COUNT )return -E2BIG ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 405/417 netfilter: nf_tables: skip dead set elements in netlink dump
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 6b1ca88e4bb63673dc9f9c7f23c899f22c3cb17a ]
Delete from packet path relies on the garbage collector to purge elements with NFT_SET_ELEM_DEAD_BIT on.
Skip these dead elements from nf_tables_dump_setelem() path, I very rarely see tests/shell/testcases/maps/typeof_maps_add_delete reports [DUMP FAILED] showing a mismatch in the expected output with an element that should not be there.
If the netlink dump happens before GC worker run, it might show dead elements in the ruleset listing.
nft_rhash_get() already skips dead elements in nft_rhash_cmp(), therefore, it already does not show the element when getting a single element via netlink control plane.
--- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +1 -1
@@ -5418,7 +5418,7 @@ static int nf_tables_dump_setelem(const struct nft_ctx *ctx,const struct nft_set_ext *ext =nft_set_elem_ext (set, elem->priv);struct nft_set_dump_args *args; -if (nft_set_elem_expired (ext)) +if (nft_set_elem_expired (ext) ||nft_set_elem_is_dead (ext))return 0 ; args = container_of(iter, struct nft_set_dump_args, iter);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 406/417 netfilter: nf_tables: reject NFT_SET_CONCAT with not field length description
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 113661e07460a6604aacc8ae1b23695a89e7d4b3 ]
It is still possible to set on the NFT_SET_CONCAT flag by specifying a set size and no field description, report EINVAL in such case.
--- net/netfilter/nf_tables_api.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +5 -1
@@ -4773,8 +4773,12 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info,if (err <0 )return err; -if (desc.field_count >1 && !(flags &NFT_SET_CONCAT )) +if (desc.field_count >1 ) { +if (!(flags &NFT_SET_CONCAT )) +return -EINVAL ; + }else if (flags &NFT_SET_CONCAT ) {return -EINVAL ; + } }else if (flags &NFT_SET_CONCAT ) {return -EINVAL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 407/417 ipvs: avoid stat macros calls from preemptible context
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
[ Upstream commit d6938c1c76c64f42363d0d1f051e1b4641c2ad40 ]
Inside decrement_ttl() upon discovering that the packet ttl has exceeded, __IP_INC_STATS and __IP6_INC_STATS macros can be called from preemptible context having the following backtrace:
check_preemption_disabled: 48 callbacks suppressed
BUG: using __this_cpu_add() in preemptible [00000000] code: curl/1177 caller is decrement_ttl+0x217/0x830 CPU: 5 PID: 1177 Comm: curl Not tainted 6.7.0+ #34 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0xbd/0xe0 check_preemption_disabled+0xd1/0xe0 decrement_ttl+0x217/0x830 __ip_vs_get_out_rt+0x4e0/0x1ef0 ip_vs_nat_xmit+0x205/0xcd0 ip_vs_in_hook+0x9b1/0x26a0 nf_hook_slow+0xc2/0x210 nf_hook+0x1fb/0x770 __ip_local_out+0x33b/0x640 ip_local_out+0x2a/0x490 __ip_queue_xmit+0x990/0x1d10 __tcp_transmit_skb+0x288b/0x3d10 tcp_connect+0x3466/0x5180 tcp_v4_connect+0x1535/0x1bb0 __inet_stream_connect+0x40d/0x1040 inet_stream_connect+0x57/0xa0 __sys_connect_file+0x162/0x1a0 __sys_connect+0x137/0x160 __x64_sys_connect+0x72/0xb0 do_syscall_64+0x6f/0x140 entry_SYSCALL_64_after_hwframe+0x6e/0x76 RIP: 0033:0x7fe6dbbc34e0
Use the corresponding preemption-aware variants: IP_INC_STATS and IP6_INC_STATS.
Found by Linux Verification Center (linuxtesting.org).
--- net/netfilter/ipvs/ip_vs_xmit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/netfilter/ipvs/ip_vs_xmit.c +2 -2
@@ -271,7 +271,7 @@ static inline bool decrement_ttl(struct netns_ipvs *ipvs, skb->dev = dst->dev;icmpv6_send (skb,ICMPV6_TIME_EXCEED ,ICMPV6_EXC_HOPLIMIT ,0 ); -__IP6_INC_STATS (net, idev,IPSTATS_MIB_INHDRERRORS ); +IP6_INC_STATS (net, idev,IPSTATS_MIB_INHDRERRORS );return false; }
@@ -286,7 +286,7 @@ static inline bool decrement_ttl(struct netns_ipvs *ipvs, {if (ip_hdr (skb)->ttl <=1 ) {/* Tell the sender its packet died... */ -__IP_INC_STATS (net,IPSTATS_MIB_INHDRERRORS ); +IP_INC_STATS (net,IPSTATS_MIB_INHDRERRORS );icmp_send (skb,ICMP_TIME_EXCEEDED ,ICMP_EXC_TTL ,0 );return false; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 408/417 kdb: Fix a potential buffer overflow in kdb_local()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 4f41d30cd6dc865c3cbc1a852372321eba6d4e4c ]
When appending "[defcmd]" to 'kdb_prompt_str', the size of the string already in the buffer should be taken into account.
An option could be to switch from strncat() to strlcat() which does the correct test to avoid such an overflow.
However, this actually looks as dead code, because 'defcmd_in_progress' can't be true here.
See a more detailed explanation at [1].
[1]: https://lore.kernel.org/all/CAD=FV=WSh7wKN7Yp-3wWiDgX4E3isQ8uh0LCzTmd1v9Cg9j+nQ@mail.gmail.com/
--- kernel/debug/kdb/kdb_main.c | 2 -- 1 file changed, 2 deletions(-)
kernel/debug/kdb/kdb_main.c +0 -2
@@ -1349,8 +1349,6 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs,/* PROMPT can only be set if we have MEM_READ permission. */ snprintf (kdb_prompt_str,CMD_BUFLEN ,kdbgetenv ("PROMPT" ),raw_smp_processor_id ()); -if (defcmd_in_progress) -strncat (kdb_prompt_str,"[defcmd]" ,CMD_BUFLEN );/* * Fetch command from keyboard
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 409/417 ethtool: netlink: Add missing ethnl_ops_begin/complete
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ludvig Pärsson <[email protected]>
[ Upstream commit f1172f3ee3a98754d95b968968920a7d03fdebcc ]
Accessing an ethernet device that is powered off or clock gated might cause the CPU to hang. Add ethnl_ops_begin/complete in ethnl_set_features() to protect against this.
--- net/ethtool/features.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
net/ethtool/features.c +7 -2
@@ -234,17 +234,20 @@ int ethnl_set_features(struct sk_buff *skb, struct genl_info *info) dev = req_info.dev;rtnl_lock (); + ret =ethnl_ops_begin (dev); +if (ret <0 ) + goto out_rtnl;ethnl_features_to_bitmap (old_active, dev->features);ethnl_features_to_bitmap (old_wanted, dev->wanted_features); ret =ethnl_parse_bitset (req_wanted, req_mask,NETDEV_FEATURE_COUNT , tb[ETHTOOL_A_FEATURES_WANTED ], netdev_features_strings, info->extack);if (ret <0 ) - goto out_rtnl; + goto out_ops;if (ethnl_bitmap_to_features (req_mask) & ~NETIF_F_ETHTOOL_BITS ) {GENL_SET_ERR_MSG (info,"attempt to change non-ethtool features" ); ret = -EINVAL ; - goto out_rtnl; + goto out_ops; }/* set req_wanted bits not in req_mask from old_wanted */
@@ -281,6 +284,8 @@ int ethnl_set_features(struct sk_buff *skb, struct genl_info *info)if (mod)netdev_features_change (dev); +out_ops: +ethnl_ops_complete (dev); out_rtnl:rtnl_unlock ();ethnl_parse_header_dev_put (&req_info);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 410/417 loop: fix the the direct I/O support check when used on top of block devices
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit baa7d536077dcdfe2b70c476a8873d1745d3de0f ]
__loop_update_dio only checks the alignment requirement for block backed file systems, but misses them for the case where the loop device is created directly on top of another block device. Due to this creating a loop device with default option plus the direct I/O flag on a > 512 byte sector size file system will lead to incorrect I/O being submitted to the lower block device and a lot of error from the lock layer. This can be seen with xfstests generic/563.
Fix the code in __loop_update_dio by factoring the alignment check into a helper, and calling that also for the struct block_device of a block device inode.
Also remove the TODO comment talking about dynamically switching between buffered and direct I/O, which is a would be a recipe for horrible performance and occasional data loss.
--- drivers/block/loop.c | 52 +++++++++++++++++++++----------------------- 1 file changed, 25 insertions(+), 27 deletions(-)
drivers/block/loop.c +25 -27
@@ -165,39 +165,37 @@ static loff_t get_loop_size(struct loop_device *lo, struct file *file)return get_size (lo->lo_offset, lo->lo_sizelimit, file); } +/* +* We support direct I/O only if lo_offset is aligned with the logical I/O size +* of backing device, and the logical block size of loop is bigger than that of +* the backing device. +*/ +static bool lo_bdev_can_use_dio (struct loop_device *lo, +struct block_device *backing_bdev) +{ +unsigned short sb_bsize =bdev_logical_block_size (backing_bdev); + +if (queue_logical_block_size (lo->lo_queue) < sb_bsize) +return false; +if (lo->lo_offset & (sb_bsize -1 )) +return false; +return true; +} +static void __loop_update_dio (struct loop_device *lo,bool dio) {struct file *file = lo->lo_backing_file; -struct address_space *mapping = file->f_mapping; -struct inode *inode = mapping->host; -unsigned short sb_bsize =0 ; -unsigned dio_align =0 ; +struct inode *inode = file->f_mapping->host; +struct block_device *backing_bdev =NULL ;bool use_dio; -if (inode->i_sb->s_bdev) { - sb_bsize =bdev_logical_block_size (inode->i_sb->s_bdev); - dio_align = sb_bsize -1 ; - } +if (S_ISBLK (inode->i_mode)) + backing_bdev =I_BDEV (inode); +else if (inode->i_sb->s_bdev) + backing_bdev = inode->i_sb->s_bdev; -/* -* We support direct I/O only if lo_offset is aligned with the -* logical I/O size of backing device, and the logical block -* size of loop is bigger than the backing device's. -* -* TODO: the above condition may be loosed in the future, and -* direct I/O may be switched runtime at that time because most -* of requests in sane applications should be PAGE_SIZE aligned -*/ -if (dio) { -if (queue_logical_block_size (lo->lo_queue) >= sb_bsize && - !(lo->lo_offset & dio_align) && - (file->f_mode &FMODE_CAN_ODIRECT )) - use_dio = true; -else - use_dio = false; - }else { - use_dio = false; - } + use_dio = dio && (file->f_mode &FMODE_CAN_ODIRECT ) && + (!backing_bdev ||lo_bdev_can_use_dio (lo, backing_bdev));if (lo->use_dio == use_dio)return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 411/417 mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Cohen <[email protected]>
[ Upstream commit 6d6eeabcfaba2fcadf5443b575789ea606f9de83 ]
Lately, a bug was found when many TC filters are added - at some point, several bugs are printed to dmesg [1] and the switch is crashed with segmentation fault.
The issue starts when gen_pool_free() fails because of unexpected behavior - a try to free memory which is already freed, this leads to BUG() call which crashes the switch and makes many other bugs.
Trying to track down the unexpected behavior led to a bug in eRP code. The function mlxsw_sp_acl_erp_table_alloc() gets a pointer to the allocated index, sets the value and returns an error code. When gen_pool_alloc() fails it returns address 0, we track it and return -ENOBUFS outside, BUT the call for gen_pool_alloc() already override the index in erp_table structure. This is a problem when such allocation is done as part of table expansion. This is not a new table, which will not be used in case of allocation failure. We try to expand eRP table and override the current index (non-zero) with zero. Then, it leads to an unexpected behavior when address 0 is freed twice. Note that address 0 is valid in erp_table->base_index and indeed other tables use it.
gen_pool_alloc() fails in case that there is no space left in the pre-allocated pool, in our case, the pool is limited to ACL_MAX_ERPT_BANK_SIZE, which is read from hardware. When more than max erp entries are required, we exceed the limit and return an error, this error leads to "Failed to migrate vregion" print.
Fix this by changing erp_table->base_index only in case of a successful allocation.
Add a test case for such a scenario. Without this fix it causes segmentation fault:
$ TESTS="max_erp_entries_test" ./tc_flower.sh ./tc_flower.sh: line 988: 1560 Segmentation fault tc filter del dev $h2 ingress chain $i protocol ip pref $i handle $j flower &>/dev/null
[1]:
kernel BUG at lib/genalloc.c:508!
invalid opcode: 0000 [#1] PREEMPT SMP
CPU: 6 PID: 3531 Comm: tc Not tainted 6.7.0-rc5-custom-ga6893f479f5e #1 Hardware name: Mellanox Technologies Ltd. MSN4700/VMOD0010, BIOS 5.11 07/12/2021 RIP: 0010:gen_pool_free_owner+0xc9/0xe0 ... Call Trace: <TASK> __mlxsw_sp_acl_erp_table_other_dec+0x70/0xa0 [mlxsw_spectrum] mlxsw_sp_acl_erp_mask_destroy+0xf5/0x110 [mlxsw_spectrum] objagg_obj_root_destroy+0x18/0x80 [objagg] objagg_obj_destroy+0x12c/0x130 [objagg] mlxsw_sp_acl_erp_mask_put+0x37/0x50 [mlxsw_spectrum] mlxsw_sp_acl_ctcam_region_entry_remove+0x74/0xa0 [mlxsw_spectrum] mlxsw_sp_acl_ctcam_entry_del+0x1e/0x40 [mlxsw_spectrum] mlxsw_sp_acl_tcam_ventry_del+0x78/0xd0 [mlxsw_spectrum] mlxsw_sp_flower_destroy+0x4d/0x70 [mlxsw_spectrum] mlxsw_sp_flow_block_cb+0x73/0xb0 [mlxsw_spectrum] tc_setup_cb_destroy+0xc1/0x180 fl_hw_destroy_filter+0x94/0xc0 [cls_flower] __fl_delete+0x1ac/0x1c0 [cls_flower] fl_destroy+0xc2/0x150 [cls_flower] tcf_proto_destroy+0x1a/0xa0
...mlxsw_spectrum3 0000:07:00.0: Failed to migrate vregion mlxsw_spectrum3 0000:07:00.0: Failed to migrate vregion
--- .../mellanox/mlxsw/spectrum_acl_erp.c | 8 +-- .../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 52 ++++++++++++++++++- 2 files changed, 56 insertions(+), 4 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c +5 -3
@@ -301,6 +301,7 @@ mlxsw_sp_acl_erp_table_alloc(struct mlxsw_sp_acl_erp_core *erp_core, unsigned long *p_index) {unsigned int num_rows, entry_size; +unsigned long index;/* We only allow allocations of entire rows */ if (num_erps % erp_core->num_erp_banks !=0 )
@@ -309,10 +310,11 @@ mlxsw_sp_acl_erp_table_alloc(struct mlxsw_sp_acl_erp_core *erp_core, entry_size = erp_core->erpt_entries_size[region_type]; num_rows = num_erps / erp_core->num_erp_banks; - *p_index =gen_pool_alloc (erp_core->erp_tables, num_rows * entry_size); -if (*p_index ==0 ) + index =gen_pool_alloc (erp_core->erp_tables, num_rows * entry_size); +if (!index)return -ENOBUFS ; - *p_index -=MLXSW_SP_ACL_ERP_GENALLOC_OFFSET ; + + *p_index = index -MLXSW_SP_ACL_ERP_GENALLOC_OFFSET ;return 0 ; }
tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh +51 -1
64 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 412/417 selftests: mlxsw: qos_pfc: Adjust the test to support 8 lanes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Cohen <[email protected]>
[ Upstream commit b34f4de6d30cbaa8fed905a5080b6eace8c84dc7 ]
'qos_pfc' test checks PFC behavior. The idea is to limit the traffic using a shaper somewhere in the flow of the packets. In this area, the buffer is smaller than the buffer at the beginning of the flow, so it fills up until there is no more space left. The test configures there PFC which is supposed to notice that the headroom is filling up and send PFC Xoff to indicate the transmitter to stop sending traffic for the priorities sharing this PG.
The Xon/Xoff threshold is auto-configured and always equal to 2*(MTU rounded up to cell size). Even after sending the PFC Xoff packet, traffic will keep arriving until the transmitter receives and processes the PFC packet. This amount of traffic is known as the PFC delay allowance.
Currently the buffer for the delay traffic is configured as 100KB. The MTU in the test is 10KB, therefore the threshold for Xoff is about 20KB. This allows 80KB extra to be stored in this buffer.
8-lane ports use two buffers among which the configured buffer is split, the Xoff threshold then applies to each buffer in parallel.
The test does not take into account the behavior of 8-lane ports, when the ports are configured to 400Gbps with 8 lanes or 800Gbps with 8 lanes, packets are dropped and the test fails.
Check if the relevant ports use 8 lanes, in such case double the size of the buffer, as the headroom is split half-half.
--- .../selftests/drivers/net/mlxsw/qos_pfc.sh | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
tools/testing/selftests/drivers/net/mlxsw/qos_pfc.sh +17 -1
@@ -121,6 +121,9 @@ h2_destroy() switch_create() { + local lanes_swp4 + local pg1_size + # pools # -----
@@ -230,7 +233,20 @@ switch_create() dcb pfc set dev $swp4 prio-pfc all:off 1:on # PG0 will get autoconfigured to Xoff, give PG1 arbitrarily 100K, which # is (-2*MTU) about 80K of delay provision. - dcb buffer set dev $swp4 buffer-size all:0 1:$_100KB + pg1_size=$_100KB + + setup_wait_dev_with_timeout $swp4 + + lanes_swp4=$(ethtool $swp4 | grep 'Lanes:') + lanes_swp4=${lanes_swp4#*"Lanes: "} + + # 8-lane ports use two buffers among which the configured buffer + # is split, so double the size to get twice (20K + 80K). + if [[ $lanes_swp4 -eq 8 ]]; then + pg1_size=$((pg1_size * 2)) + fi + + dcb buffer set dev $swp4 buffer-size all:0 1:$pg1_size # bridges # -------
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 413/417 ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
[ Upstream commit 2e7ef287f07c74985f1bf2858bedc62bd9ebf155 ]
idev->mc_ifc_count can be written over without proper locking.
Originally found by syzbot [1], fix this issue by encapsulating calls to mld_ifc_stop_work() (and mld_gq_stop_work() for good measure) with mutex_lock() and mutex_unlock() accordingly as these functions should only be called with mc_lock per their declarations.
[1]
BUG: KCSAN: data-race in ipv6_mc_down / mld_ifc_work
write to 0xffff88813a80c832 of 1 bytes by task 3771 on cpu 0:
mld_ifc_stop_work net/ipv6/mcast.c:1080 [inline] ipv6_mc_down+0x10a/0x280 net/ipv6/mcast.c:2725 addrconf_ifdown+0xe32/0xf10 net/ipv6/addrconf.c:3949 addrconf_notify+0x310/0x980 notifier_call_chain kernel/notifier.c:93 [inline] raw_notifier_call_chain+0x6b/0x1c0 kernel/notifier.c:461 __dev_notify_flags+0x205/0x3d0 dev_change_flags+0xab/0xd0 net/core/dev.c:8685 do_setlink+0x9f6/0x2430 net/core/rtnetlink.c:2916 rtnl_group_changelink net/core/rtnetlink.c:3458 [inline] __rtnl_newlink net/core/rtnetlink.c:3717 [inline] rtnl_newlink+0xbb3/0x1670 net/core/rtnetlink.c:3754 rtnetlink_rcv_msg+0x807/0x8c0 net/core/rtnetlink.c:6558 netlink_rcv_skb+0x126/0x220 net/netlink/af_netlink.c:2545 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6576 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] netlink_unicast+0x589/0x650 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x66e/0x770 net/netlink/af_netlink.c:1910 ...
write to 0xffff88813a80c832 of 1 bytes by task 22 on cpu 1:
mld_ifc_work+0x54c/0x7b0 net/ipv6/mcast.c:2653 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2700 worker_thread+0x525/0x730 kernel/workqueue.c:2781 ...
--- net/ipv6/mcast.c | 4 ++++ 1 file changed, 4 insertions(+)
net/ipv6/mcast.c +4 -0
@@ -2725,8 +2725,12 @@ void ipv6_mc_down(struct inet6_dev *idev)synchronize_net ();mld_query_stop_work (idev);mld_report_stop_work (idev); + +mutex_lock (&idev->mc_lock);mld_ifc_stop_work (idev);mld_gq_stop_work (idev); +mutex_unlock (&idev->mc_lock); +mld_dad_stop_work (idev); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 414/417 i2c: s3c24xx: fix read transfers in polling mode
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
[ Upstream commit 0d9cf23ed55d7ba3ab26d617a3ae507863674c8f ]
To properly handle read transfers in polling mode, no waiting for the ACK state is needed as it will never come. Just wait a bit to ensure start state is on the bus and continue processing next bytes.
--- drivers/i2c/busses/i2c-s3c2410.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-s3c2410.c +11 -2
@@ -220,8 +220,17 @@ static bool is_ack(struct s3c24xx_i2c *i2c)int tries;for (tries =50 ; tries; --tries) { -if (readl (i2c->regs +S3C2410_IICCON ) - &S3C2410_IICCON_IRQPEND ) { +unsigned long tmp =readl (i2c->regs +S3C2410_IICCON ); + +if (!(tmp &S3C2410_IICCON_ACKEN )) { +/* +* Wait a bit for the bus to stabilize, +* delay estimated experimentally. +*/ +usleep_range (100 ,200 ); +return true; + } +if (tmp &S3C2410_IICCON_IRQPEND ) {if (!(readl (i2c->regs +S3C2410_IICSTAT ) &S3C2410_IICSTAT_LASTBIT ))return true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 415/417 i2c: s3c24xx: fix transferring more than one message in polling mode
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
[ Upstream commit 990489e1042c6c5d6bccf56deca68f8dbeed8180 ]
To properly handle ACK on the bus when transferring more than one message in polling mode, move the polling handling loop from s3c24xx_i2c_message_start() to s3c24xx_i2c_doxfer(). This way i2c_s3c_irq_nextbyte() is always executed till the end, properly acknowledging the IRQ bits and no recursive calls to i2c_s3c_irq_nextbyte() are made.
While touching this, also fix finishing transfers in polling mode by using common code path and always waiting for the bus to become idle and disabled.
--- drivers/i2c/busses/i2c-s3c2410.c | 27 ++++++++++----------------- 1 file changed, 10 insertions(+), 17 deletions(-)
drivers/i2c/busses/i2c-s3c2410.c +10 -17
@@ -283,16 +283,6 @@ static void s3c24xx_i2c_message_start(struct s3c24xx_i2c *i2c, stat |=S3C2410_IICSTAT_START ;writel (stat, i2c->regs +S3C2410_IICSTAT ); - -if (i2c->quirks &QUIRK_POLL ) { -while ((i2c->msg_num !=0 ) &&is_ack (i2c)) { -i2c_s3c_irq_nextbyte (i2c, stat); - stat =readl (i2c->regs +S3C2410_IICSTAT ); - -if (stat &S3C2410_IICSTAT_ARBITR ) -dev_err (i2c->dev,"deal with arbitration loss\n" ); - } - } }static inline void s3c24xx_i2c_stop (struct s3c24xx_i2c *i2c,int ret)
@@ -699,7 +689,7 @@ static void s3c24xx_i2c_wait_idle(struct s3c24xx_i2c *i2c)static int s3c24xx_i2c_doxfer (struct s3c24xx_i2c *i2c,struct i2c_msg *msgs,int num) { -unsigned long timeout; +unsigned long timeout =0 ;int ret; ret =s3c24xx_i2c_set_master (i2c);
@@ -719,16 +709,19 @@ static int s3c24xx_i2c_doxfer(struct s3c24xx_i2c *i2c,s3c24xx_i2c_message_start (i2c, msgs);if (i2c->quirks &QUIRK_POLL ) { - ret = i2c->msg_idx; +while ((i2c->msg_num !=0 ) &&is_ack (i2c)) { +unsigned long stat =readl (i2c->regs +S3C2410_IICSTAT ); -if (ret != num) -dev_dbg (i2c->dev,"incomplete xfer (%d)\n" , ret); +i2c_s3c_irq_nextbyte (i2c, stat); - goto out; + stat =readl (i2c->regs +S3C2410_IICSTAT ); +if (stat &S3C2410_IICSTAT_ARBITR ) +dev_err (i2c->dev,"deal with arbitration loss\n" ); + } + }else { + timeout =wait_event_timeout (i2c->wait, i2c->msg_num ==0 ,HZ *5 ); } - timeout =wait_event_timeout (i2c->wait, i2c->msg_num ==0 ,HZ *5 ); - ret = i2c->msg_idx;/*
Signature · 1 line
2.43.0
Hello,
Quoted 5 lines · On Mon, 22 Jan 2024 15:52:48 -0800 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.1.75 release. There are 417 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Responses should be made by Wed, 24 Jan 2024 23:56:49 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.75-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.
This rc kernel passes DAMON functionality test[1] on my test machine. Attaching the test results summary below. Please note that I retrieved the kernel from linux-stable-rc tree[2].
[1] https://github.com/awslabs/damon-tests/tree/next/corr
[2] b74a57f4a549 ("Linux 6.1.75-rc1")
Thanks,
SJ
[...]
---
ok 1 selftests: damon: debugfs_attrs.sh
ok 2 selftests: damon: debugfs_schemes.sh
ok 3 selftests: damon: debugfs_target_ids.sh
ok 4 selftests: damon: debugfs_empty_targets.sh
ok 5 selftests: damon: debugfs_huge_count_read_write.sh
ok 6 selftests: damon: debugfs_duplicate_context_creation.sh
ok 7 selftests: damon: sysfs.sh
ok 1 selftests: damon-tests: kunit.sh
ok 2 selftests: damon-tests: huge_count_read_write.sh
ok 3 selftests: damon-tests: buffer_overflow.sh
ok 4 selftests: damon-tests: rm_contexts.sh
ok 5 selftests: damon-tests: record_null_deref.sh
ok 6 selftests: damon-tests: dbgfs_target_ids_read_before_terminate_race.sh ok 7 selftests: damon-tests: dbgfs_target_ids_pid_leak.sh
ok 8 selftests: damon-tests: damo_tests.sh
ok 9 selftests: damon-tests: masim-record.sh
ok 10 selftests: damon-tests: build_i386.sh
ok 11 selftests: damon-tests: build_arm64.sh
ok 12 selftests: damon-tests: build_m68k.sh
ok 13 selftests: damon-tests: build_i386_idle_flag.sh
ok 14 selftests: damon-tests: build_i386_highpte.sh
ok 15 selftests: damon-tests: build_nomemcg.sh
[33m
[92mPASS [39m
Greg Kroah-Hartman
maintainerPATCH 416/417 block: Remove special-casing of compound pages
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
commit 1b151e2435fc3a9b10c8946c6aebe9f3e1938c55 upstream.
The special casing was originally added in pre-git history; reproducing the commit log here:
Quoted 9 lines
commit
a318a92567d77Author: Andrew Morton <[email protected]> Date: Sun Sep 21 01:42:22 2003 -0700[PATCH] Speed up direct-io hugetlbpage handling
This patch short-circuits all the direct-io page dirtying logic for higher-order pages. Without this, we pointlessly bounce BIOs up to keventd all the time.
In the last twenty years, compound pages have become used for more than just hugetlb. Rewrite these functions to operate on folios instead of pages and remove the special case for hugetlbfs; I don't think it's needed any more (and if it is, we can put it back in as a call to folio_test_hugetlb()).
This was found by inspection; as far as I can tell, this bug can lead to pages used as the destination of a direct I/O read not being marked as dirty. If those pages are then reclaimed by the MM without being dirtied for some other reason, they won't be written out. Then when they're faulted back in, they will not contain the data they should. It'll take a pretty unusual setup to produce this problem with several races all going the wrong way.
This problem predates the folio work; it could for example have been triggered by mmaping a THP in tmpfs and using that as the target of an O_DIRECT read.
--- block/bio.c | 38 +++++++++++++++++++++++--------------- 1 file changed, 23 insertions(+), 15 deletions(-)
block/bio.c +23 -15
@@ -1109,13 +1109,22 @@ bool bio_add_folio(struct bio *bio, struvoid __bio_release_pages (struct bio *bio,bool mark_dirty) { -struct bvec_iter_all iter_all; -struct bio_vec *bvec; +struct folio_iter fi; -bio_for_each_segment_all (bvec, bio, iter_all) { -if (mark_dirty && !PageCompound (bvec->bv_page)) -set_page_dirty_lock (bvec->bv_page); -put_page (bvec->bv_page); +bio_for_each_folio_all (fi, bio) { +struct page *page; +size_t done =0 ; + +if (mark_dirty) { +folio_lock (fi.folio); +folio_mark_dirty (fi.folio); +folio_unlock (fi.folio); + } + page =folio_page (fi.folio, fi.offset /PAGE_SIZE ); +do { +folio_put (fi.folio); + done +=PAGE_SIZE ; + }while (done < fi.length); } }EXPORT_SYMBOL_GPL (__bio_release_pages);
@@ -1414,12 +1423,12 @@ EXPORT_SYMBOL(bio_free_pages);*/ void bio_set_pages_dirty (struct bio *bio) { -struct bio_vec *bvec; -struct bvec_iter_all iter_all; +struct folio_iter fi; -bio_for_each_segment_all (bvec, bio, iter_all) { -if (!PageCompound (bvec->bv_page)) -set_page_dirty_lock (bvec->bv_page); +bio_for_each_folio_all (fi, bio) { +folio_lock (fi.folio); +folio_mark_dirty (fi.folio); +folio_unlock (fi.folio); } }
@@ -1462,12 +1471,11 @@ static void bio_dirty_fn(struct work_strvoid bio_check_pages_dirty (struct bio *bio) { -struct bio_vec *bvec; +struct folio_iter fi;unsigned long flags; -struct bvec_iter_all iter_all; -bio_for_each_segment_all (bvec, bio, iter_all) { -if (!PageDirty (bvec->bv_page) && !PageCompound (bvec->bv_page)) +bio_for_each_folio_all (fi, bio) { +if (!folio_test_dirty (fi.folio)) goto defer; }
Greg Kroah-Hartman
maintainerPATCH 417/417 riscv: Fix wrong usage of lm_alias() when splitting a huge linear mapping
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Ghiti <[email protected]>
commit c29fc621e1a49949a14c7fa031dd4760087bfb29 upstream.
lm_alias() can only be used on kernel mappings since it explicitly uses __pa_symbol(), so simply fix this by checking where the address belongs to before.
--- arch/riscv/mm/pageattr.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/riscv/mm/pageattr.c +7 -2
@@ -304,8 +304,13 @@ static int __set_memory(unsigned long ad goto unlock; } }else if (is_kernel_mapping (start) ||is_linear_mapping (start)) { - lm_start = (unsigned long )lm_alias (start); - lm_end = (unsigned long )lm_alias (end); +if (is_kernel_mapping (start)) { + lm_start = (unsigned long )lm_alias (start); + lm_end = (unsigned long )lm_alias (end); + }else { + lm_start = start; + lm_end = end; + } ret =split_linear_mapping (lm_start, lm_end);if (ret)
Jon Hunter
maintainerQuoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.75 release. There are 417 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 24 Jan 2024 23:56:49 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.75-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
Failures detected for Tegra ...
Test results for stable-v6.1:
10 builds: 10 pass, 0 fail
28 boots: 26 pass, 2 fail
96 tests: 96 pass, 0 failLinux version: 6.1.75-rc1-gb74a57f4a549
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Boot failures: tegra210-p2371-2180
Jon
Quoted 9 lines
This is the start of the stable review cycle for the 6.1.75 release. There are 417 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 24 Jan 2024 23:56:49 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.75-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my x86_64 and ARM64 test systems. No errors or regressions.
Thanks.
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.75 release. There are 417 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Works fine for me on x86_64.
Cheers,
Sven
Hi Greg,
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.75 release. There are 417 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 24 Jan 2024 23:56:49 +0000. Anything received after that time might be too late.
Quoted 7 lines
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.75-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
I tested 6.1.75-rc1 (b62718874a32) on Kalray kvx arch (not upstream yet), just to let you know everything works in our CI.
It ran on real hw (k200 and k200lp boards), on qemu as well as on our internal instruction set simulator (ISS).
Tests were run on several interfaces/drivers (usb, qsfp ethernet, eMMC, PCIe endpoint+RC, SPI, remoteproc, uart, iommu). LTP and uClibc-ng testsuites are also run without any regression.
Everything looks fine to us.
Thanks a lot!
PS: I'll push a job for -rc2 today and will get the results tomorrow
--
Yann