6.1.77-rc1 review
Subsystems (6)
Greg Kroah-Hartman
maintainercover 6.1.77-rc1 review
This is the start of the stable review cycle for the 6.1.77 release. There are 219 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Mon, 05 Feb 2024 03:51:47 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.77-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.77-rc1
Zhengchao Shao <[email protected]>
bonding: remove print in bond_verify_device_path
Praveen Kaligineedi <[email protected]>
gve: Fix use-after-free vulnerability
Huacai Chen <[email protected]>
LoongArch/smp: Call rcutree_report_cpu_starting() at tlb_init()
Konrad Dybcio <[email protected]>
drm/msm/dsi: Enable runtime PM
Jonathan Gray <[email protected]>
Revert "drm/amd/display: Disable PSR-SU on Parade 0803 TCON again"
Marco Elver <[email protected]>
mm, kmsan: fix infinite recursion due to RCU critical section
Huang Shijie <[email protected]>
arm64: irq: set the correct node for shadow call stack
Benjamin Poirier <[email protected]>
selftests: bonding: Check initial state
Benjamin Poirier <[email protected]>
selftests: team: Add missing config options
Breno Leitao <[email protected]>
net: sysfs: Fix /sys/class/net/<iface> path
Paolo Abeni <[email protected]>
selftests: net: fix available tunnels detection
Eric Dumazet <[email protected]>
af_unix: fix lockdep positive in sk_diag_dump_icons()
Zhipeng Lu <[email protected]>
net: ipv4: fix a memleak in ip_setup_cork
Pablo Neira Ayuso <[email protected]>
netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
Pablo Neira Ayuso <[email protected]>
netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV
Ryan Schaefer <[email protected]>
netfilter: conntrack: correct window scaling with retransmitted SYN
Matthias May <[email protected]>
selftests: net: add missing config for GENEVE
Linus Lüssing <[email protected]>
bridge: mcast: fix disabled snooping after long uptime
Eric Dumazet <[email protected]>
llc: call sock_orphan() at release time
Helge Deller <[email protected]>
ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
Michal Vokáč <[email protected]>
net: dsa: qca8k: fix illegal usage of GPIO
Christophe JAILLET <[email protected]>
ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
Jedrzej Jagielski <[email protected]>
ixgbe: Refactor overtemp event handling
Jedrzej Jagielski <[email protected]>
ixgbe: Refactor returning internal error codes
Eric Dumazet <[email protected]>
tcp: add sanity checks to rx zerocopy
Horatiu Vultur <[email protected]>
net: lan966x: Fix port configuration when using SGMII interface
Nicolas Dichtel <[email protected]>
ipmr: fix kernel panic when forwarding mcast packets
Eric Dumazet <[email protected]>
ipv4: raw: add drop reasons
Eric Dumazet <[email protected]>
ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
Paolo Abeni <[email protected]>
selftests: net: give more time for GRO aggregation
Su Hui <[email protected]>
HID: hidraw: fix a problem of memory leak in hidraw_release()
Ming Lei <[email protected]>
scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
Romain Naour <[email protected]>
regulator: ti-abb: don't use devm_platform_ioremap_resource_byname for shared interrupt register
Su Hui <[email protected]>
scsi: isci: Fix an error code problem in isci_io_request_build()
Stephen Rothwell <[email protected]>
drm: using mul_u32_u32() requires linux/math64.h
Edward Adam Davis <[email protected]>
wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
Peter Zijlstra <[email protected]>
perf: Fix the nr_addr_filters fix
Srinivasan Shanmugam <[email protected]>
drm/amdkfd: Fix 'node' NULL check in 'svm_range_get_range_boundaries()'
Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()'
Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Fix with right return code '-EIO' in 'amdgpu_gmc_vram_checking()'
Srinivasan Shanmugam <[email protected]>
drm/amd/powerplay: Fix kzalloc parameter 'ATOM_Tonga_PPM_Table' in 'get_platform_power_management_table()'
Wenchao Hao <[email protected]>
ceph: fix invalid pointer access if get_quota_realm return ERR_PTR
Xiubo Li <[email protected]>
ceph: fix deadlock or deadcode of misusing dget()
Venky Shankar <[email protected]>
ceph: reinitialize mds feature bit even when session in open
Ming Lei <[email protected]>
blk-mq: fix IO hang from sbitmap wakeup race
Zhu Yanjun <[email protected]>
virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings
Philip Yang <[email protected]>
drm/amdkfd: Fix lock dependency warning with srcu
Felix Kuehling <[email protected]>
drm/amdkfd: Fix lock dependency warning
Ian Rogers <[email protected]>
libsubcmd: Fix memory leak in uniq()
Hans de Goede <[email protected]>
misc: lis3lv02d_i2c: Add missing setting of the reg_ctrl callback
David Howells <[email protected]>
9p: Fix initialisation of netfs_inode for 9p
Bjorn Helgaas <[email protected]>
PCI/AER: Decode Requester ID when no error info found
Ilpo Järvinen <[email protected]>
PCI: Fix 64GT/s effective data rate calculation
Yu-Che Cheng <[email protected]>
spmi: mediatek: Fix UAF on device remove
Max Kellermann <[email protected]>
fs/kernfs/dir: obey S_ISGID
Adrian Reber <[email protected]>
tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE
Jo Van Bulck <[email protected]>
selftests/sgx: Fix linker script asserts
Hardik Gajjar <[email protected]>
usb: hub: Add quirk to decrease IN-ep poll interval for Microchip USB491x hub
Hardik Gajjar <[email protected]>
usb: hub: Replace hardcoded quirk value with BIT() macro
Mathias Nyman <[email protected]>
xhci: fix possible null pointer deref during xhci urb enqueue
James Clark <[email protected]>
perf cs-etm: Bump minimum OpenCSD version to ensure a bugfix is present
Daniel Stodden <[email protected]>
PCI: switchtec: Fix stdev_release() crash after surprise hot remove
Guilherme G. Piccoli <[email protected]>
PCI: Only override AMD USB controller if required
Xiaowu.ding <[email protected]>
mailbox: arm_mhuv2: Fix a bug for mhuv2_sender_interrupt
Peter Robinson <[email protected]>
mfd: ti_am335x_tscadc: Fix TI SoC dependencies
Oleksandr Tyshchenko <[email protected]>
xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import
Harshit Shah <[email protected]>
i3c: master: cdns: Update maximum prescaler value for i2c clock
Johannes Berg <[email protected]>
um: time-travel: fix time corruption
Nathan Chancellor <[email protected]>
um: net: Fix return type of uml_net_start_xmit()
Benjamin Berg <[email protected]>
um: Don't use vfprintf() for os_info()
Anton Ivanov <[email protected]>
um: Fix naming clash between UML and scheduler
Heiner Kallweit <[email protected]>
leds: trigger: panic: Don't register panic notifier if creating the trigger failed
bo liu <[email protected]>
ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140
Srinivasan Shanmugam <[email protected]>
drm/amdkfd: Fix iterator used outside loop in 'kfd_add_peer_prop()'
Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Fix '*fw' from request_firmware() not released in 'amdgpu_ucode_request()'
Felix Kuehling <[email protected]>
drm/amdgpu: Let KFD sync with VM fences
Stanley.Yang <[email protected]>
drm/amdgpu: Fix ecc irq enable/disable unpaired
Alexander Stein <[email protected]>
clk: imx: clk-imx8qxp: fix LVDS bypass, pixel and phy clocks
Josip Pavic <[email protected]>
drm/amd/display: make flip_timestamp_in_us a 64-bit variable
Werner Fischer <[email protected]>
watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786
Kuan-Wei Chiu <[email protected]>
clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
Kuan-Wei Chiu <[email protected]>
clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
Wang, Beyond <[email protected]>
drm/amdgpu: fix ftrace event amdgpu_bo_move always move on same heap
Abhinav Kumar <[email protected]>
drm/msm/dpu: fix writeback programming for YUV cases
Rob Clark <[email protected]>
drm/msm/dpu: Ratelimit framedone timeout msgs
Alvin Lee <[email protected]>
drm/amd/display: For prefetch mode > 0, extend prefetch if possible
Kieran Bingham <[email protected]>
media: i2c: imx335: Fix hblank min/max values
Su Hui <[email protected]>
media: ddbridge: fix an error code problem in ddb_probe
Ming Qian <[email protected]>
media: amphion: remove mutext lock in condition of wait_event
Daniel Vacek <[email protected]>
IB/ipoib: Fix mcast list locking
Douglas Anderson <[email protected]>
drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
Chao Yu <[email protected]>
f2fs: fix to tag gcing flag on page during block migration
Xing Tong Wu <[email protected]>
hwmon: (nct6775) Fix fan speed set failure in automatic mode
Tomi Valkeinen <[email protected]>
media: rkisp1: Fix IRQ disable race issue
Tomi Valkeinen <[email protected]>
media: rkisp1: Store IRQ lines
Tomi Valkeinen <[email protected]>
media: rkisp1: Fix IRQ handler return values
Tomi Valkeinen <[email protected]>
media: rkisp1: Drop IRQF_SHARED
Pierre-Louis Bossart <[email protected]>
ALSA: hda: Intel: add HDA_ARL PCI ID support
Pierre-Louis Bossart <[email protected]>
PCI: add INTEL_HDA_ARL to pci_ids.h
Michael Tretter <[email protected]>
media: rockchip: rga: fix swizzling for RGB formats
Ghanshyam Agrawal <[email protected]>
media: stk1160: Fixed high volume of stk1160_dbg messages
Tomi Valkeinen <[email protected]>
drm/mipi-dsi: Fix detach call without attach
Tomi Valkeinen <[email protected]>
drm/framebuffer: Fix use of uninitialized variable
Tomi Valkeinen <[email protected]>
drm/drm_file: fix use of uninitialized variable
Venkata Prasad Potturu <[email protected]>
ASoC: amd: Add new dmi entries for acp5x platform
Jaegeuk Kim <[email protected]>
f2fs: fix write pointers on zoned device after roll forward
Meenakshikumar Somasundaram <[email protected]>
drm/amd/display: Fix tiled display misalignment
Xin Ji <[email protected]>
drm/bridge: anx7625: Fix Set HPD irq detect window to 2ms
Hsin-Yi Wang <[email protected]>
drm/panel-edp: Add override_edid_mode quirk for generic edp
Jack Wang <[email protected]>
RDMA/IPoIB: Fix error code return in ipoib_mcast_join
Al Viro <[email protected]>
fast_dput(): handle underflows gracefully
Cristian Ciocaltea <[email protected]>
ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
Takashi Iwai <[email protected]>
ALSA: hda: Refer to correct stream index at loops
Chao Yu <[email protected]>
f2fs: fix to check return value of f2fs_reserve_new_block()
Vladimir Oltean <[email protected]>
net: dsa: qca8k: put MDIO bus OF node on qca8k_mdio_register() failure
Suman Ghosh <[email protected]>
octeontx2-af: Fix max NPC MCAM entry check while validating ref_entry
Andrii Staikov <[email protected]>
i40e: Fix VF disable behavior to block all traffic
Lin Ma <[email protected]>
bridge: cfm: fix enum typo in br_cc_ccm_tx_parse
Wen Gu <[email protected]>
net/smc: disable SEID on non-s390 archs where virtual ISM may be used
Frédéric Danis <[email protected]>
Bluetooth: L2CAP: Fix possible multiple reject send
clancy shang <[email protected]>
Bluetooth: hci_sync: fix BR/EDR wakeup bug
Zijun Hu <[email protected]>
Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for QCA2066
Benjamin Berg <[email protected]>
wifi: cfg80211: free beacon_ies when overridden from hidden BSS
Su Hui <[email protected]>
wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
Mingyi Zhang <[email protected]>
libbpf: Fix NULL pointer dereference in bpf_object__collect_prog_relos
Zenm Chen <[email protected]>
wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
Xianwei Zhao <[email protected]>
arm64: dts: amlogic: fix format for s4 uart node
Jesse Brandeburg <[email protected]>
ice: fix pre-shifted bit usage
Mao Jinlong <[email protected]>
arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property
Mao Jinlong <[email protected]>
arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property
Alex Lyakas <[email protected]>
md: Whenassemble the array, consult the superblock of the freshest device
Christoph Hellwig <[email protected]>
block: prevent an integer overflow in bvec_try_merge_hw_page
Tobias Waldekranz <[email protected]>
net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error path
Igor Russkikh <[email protected]>
net: atlantic: eliminate double free in error handling logic
Ahmed Zaki <[email protected]>
ice: fix ICE_AQ_VSI_Q_OPT_RSS_* register values
Yihang Li <[email protected]>
scsi: hisi_sas: Set .phy_attached before notifing phyup event HISI_PHYE_PHY_UP_PM
Fabio Estevam <[email protected]>
ARM: dts: imx23/28: Fix the DMA controller node name
Fabio Estevam <[email protected]>
ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
Fabio Estevam <[email protected]>
ARM: dts: imx27-apf27dev: Fix LED name
Fabio Estevam <[email protected]>
ARM: dts: imx25/27: Pass timing0
Fabio Estevam <[email protected]>
ARM: dts: imx25: Fix the iim compatible string
Kees Cook <[email protected]>
block/rnbd-srv: Check for unlikely string overflow
Shannon Nelson <[email protected]>
ionic: bypass firmware cmds when stuck in reset
Shannon Nelson <[email protected]>
ionic: pass opcode to devcmd_wait
Christian Marangi <[email protected]>
net: phy: at803x: fix passing the wrong reference for config_intr
Fabio Estevam <[email protected]>
ARM: dts: imx1: Fix sram node
Fabio Estevam <[email protected]>
ARM: dts: imx27: Fix sram node
Fabio Estevam <[email protected]>
ARM: dts: imx: Use flash@0,0 pattern
Fabio Estevam <[email protected]>
ARM: dts: imx25/27-eukrea: Fix RTC node name
Johan Jonker <[email protected]>
ARM: dts: rockchip: fix rk3036 hdmi ports node
Dmitry Antipov <[email protected]>
wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap()
Hou Tao <[email protected]>
bpf: Set uattr->batch.count as zero before batched update or deletion
Hannes Reinecke <[email protected]>
scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
Hannes Reinecke <[email protected]>
scsi: libfc: Don't schedule abort twice
Hou Tao <[email protected]>
bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
Baochen Qiang <[email protected]>
wifi: ath11k: fix race due to setting ATH11K_FLAG_EXT_IRQ_ENABLED too early
Minsuk Kang <[email protected]>
wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
Alexander Stein <[email protected]>
ARM: dts: imx7s: Fix nand-controller #size-cells
Alexander Stein <[email protected]>
ARM: dts: imx7s: Fix lcdif compatible
Alexander Stein <[email protected]>
ARM: dts: imx7d: Fix coresight funnel ports
ching Huang <[email protected]>
scsi: arcmsr: Support new PCI device IDs 1883 and 1886
Sumit Saxena <[email protected]>
scsi: mpi3mr: Add PCI checks where SAS5116 diverges from SAS4116
Jose Ignacio Tornos Martinez <[email protected]>
net: usb: ax88179_178a: avoid two consecutive device resets
Zhengchao Shao <[email protected]>
bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
Ido Schimmel <[email protected]>
PCI: Add no PM reset quirk for NVIDIA Spectrum devices
Justin Tee <[email protected]>
scsi: lpfc: Fix possible file string name overflow when updating firmware
Tanmay Shah <[email protected]>
soc: xilinx: fix unhandled SGI warning message
HariBabu Gattem <[email protected]>
soc: xilinx: Fix for call trace due to the usage of smp_processor_id()
Yafang Shao <[email protected]>
selftests/bpf: Fix issues in setup_classid_environment()
Shiji Yang <[email protected]>
wifi: rt2x00: correct wrong BBP register in RxDCOC calibration
Yonghong Song <[email protected]>
selftests/bpf: Fix pyperf180 compilation failure with clang18
Andrii Nakryiko <[email protected]>
selftests/bpf: satisfy compiler by having explicit return in btf test
Shiji Yang <[email protected]>
wifi: rt2x00: restart beacon queue when hardware reset
Baokun Li <[email protected]>
ext4: avoid online resizing failures due to oversized flex bg
Baokun Li <[email protected]>
ext4: remove unnecessary check from alloc_flex_gd()
Baokun Li <[email protected]>
ext4: unify the type of flexbg_size to unsigned int
Ye Bin <[email protected]>
ext4: fix inconsistent between segment fstrim and full fstrim
Gabriel Krisman Bertazi <[email protected]>
ecryptfs: Reject casefold directory inodes
Anna Schumaker <[email protected]>
SUNRPC: Fix a suspicious RCU usage warning
Heiko Carstens <[email protected]>
KVM: s390: fix setting of fpc register
Heiko Carstens <[email protected]>
s390/ptrace: handle setting of fpc register correctly
Tony Krowiak <[email protected]>
s390/vfio-ap: fix sysfs status attribute for AP queue devices
Arnd Bergmann <[email protected]>
arch: consolidate arch_irq_work_raise prototypes
Edward Adam Davis <[email protected]>
jfs: fix array-index-out-of-bounds in diNewExt
Oleg Nesterov <[email protected]>
rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
Oleg Nesterov <[email protected]>
afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
Oleg Nesterov <[email protected]>
afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu()
Thomas Bourgoin <[email protected]>
crypto: stm32/crc32 - fix parsing list of devices
Gao Xiang <[email protected]>
erofs: fix ztailpacking for subpage compressed blocks
Bharat Bhushan <[email protected]>
crypto: octeontx2 - Fix cptvf driver cleanup
Weichen Chen <[email protected]>
pstore/ram: Fix crash when setting number of cpus to an odd number
Edward Adam Davis <[email protected]>
jfs: fix uaf in jfs_evict_inode
Manas Ghandat <[email protected]>
jfs: fix array-index-out-of-bounds in dbAdjTree
Manas Ghandat <[email protected]>
jfs: fix slab-out-of-bounds Read in dtSearch
Osama Muhammad <[email protected]>
UBSAN: array-index-out-of-bounds in dtSplitRoot
Osama Muhammad <[email protected]>
FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
Shuai Xue <[email protected]>
ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous events
Mukesh Ojha <[email protected]>
PM / devfreq: Synchronize devfreq_monitor_[start/stop]
Yuntao Wang <[email protected]>
ACPI: NUMA: Fix the logic of getting the fake_pxm value
Prarit Bhargava <[email protected]>
ACPI: extlog: fix NULL pointer dereference check
Dmitry Antipov <[email protected]>
PNP: ACPI: fix fortify warning
Yuluo Qiu <[email protected]>
ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
Chris Riches <[email protected]>
audit: Send netlink ACK before setting connection in auditd_set
Rui Zhang <[email protected]>
regulator: core: Only increment use_count when enable_count changes
Andrzej Hajda <[email protected]>
debugobjects: Stop accessing objects after releasing hash bucket lock
Greg KH <[email protected]>
perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file
Zhiquan Li <[email protected]>
x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel
Naveen N Rao <[email protected]>
powerpc/lib: Validate size for vector operations
Stephen Rothwell <[email protected]>
powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE
Jun'ichi Nomura <[email protected]>
x86/boot: Ignore NMIs during very early boot
Michael Ellerman <[email protected]>
powerpc/64s: Fix CONFIG_NUMA=n build due to create_section_mapping()
Michael Ellerman <[email protected]>
powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
Michael Ellerman <[email protected]>
powerpc: Fix build error due to is_valid_bugaddr()
Mark Rutland <[email protected]>
drivers/perf: pmuv3: don't expose SW_INCR event in sysfs
Huang Shijie <[email protected]>
arm64: irq: set the correct node for VMAP stack
Kunwu Chan <[email protected]>
powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
Dmitry Torokhov <[email protected]>
asm-generic: make sparse happy with odd-sized put_unaligned_*()
-------------
Diffstat:
Documentation/ABI/testing/sysfs-class-net-queues | 22 +-- Documentation/sound/soc/dapm.rst | 2 +- Makefile | 4 +- arch/arm/boot/dts/imx1-ads.dts | 2 +- arch/arm/boot/dts/imx1-apf9328.dts | 2 +- arch/arm/boot/dts/imx1.dtsi | 5 +- arch/arm/boot/dts/imx23-sansa.dts | 12 +- arch/arm/boot/dts/imx23.dtsi | 2 +- arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi | 2 +- .../imx25-eukrea-mbimxsd25-baseboard-cmo-qvga.dts | 2 +- .../imx25-eukrea-mbimxsd25-baseboard-dvi-svga.dts | 2 +- .../imx25-eukrea-mbimxsd25-baseboard-dvi-vga.dts | 2 +- arch/arm/boot/dts/imx25-pdk.dts | 2 +- arch/arm/boot/dts/imx25.dtsi | 2 +- arch/arm/boot/dts/imx27-apf27dev.dts | 4 +- arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi | 4 +- .../boot/dts/imx27-eukrea-mbimxsd27-baseboard.dts | 2 +- arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts | 2 +- arch/arm/boot/dts/imx27-phytec-phycore-rdk.dts | 2 +- arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi | 2 +- arch/arm/boot/dts/imx27.dtsi | 3 + arch/arm/boot/dts/imx28.dtsi | 2 +- arch/arm/boot/dts/imx7d.dtsi | 3 - arch/arm/boot/dts/imx7s.dtsi | 10 +- arch/arm/boot/dts/rk3036.dtsi | 14 +- arch/arm/include/asm/irq_work.h | 2 - .../boot/dts/amlogic/meson-s4-s805x2-aq222.dts | 4 +- arch/arm64/boot/dts/amlogic/meson-s4.dtsi | 4 +- arch/arm64/boot/dts/qcom/msm8996.dtsi | 21 +++ arch/arm64/boot/dts/qcom/msm8998.dtsi | 32 ++-- arch/arm64/include/asm/irq_work.h | 2 - arch/arm64/kernel/irq.c | 7 +- arch/arm64/kernel/perf_event.c | 6 +- arch/csky/include/asm/irq_work.h | 2 +- arch/loongarch/kernel/smp.c | 1 - arch/loongarch/mm/tlb.c | 16 +- arch/powerpc/include/asm/irq_work.h | 1 - arch/powerpc/include/asm/mmu.h | 4 + arch/powerpc/include/asm/mmzone.h | 8 - arch/powerpc/kernel/traps.c | 2 + arch/powerpc/lib/sstep.c | 10 ++ arch/powerpc/mm/book3s64/pgtable.c | 2 + arch/powerpc/mm/init-common.c | 5 +- arch/powerpc/mm/mmu_decl.h | 5 + arch/riscv/include/asm/irq_work.h | 2 +- arch/s390/include/asm/irq_work.h | 2 - arch/s390/kernel/ptrace.c | 6 +- arch/s390/kvm/kvm-s390.c | 5 - arch/um/drivers/net_kern.c | 2 +- arch/um/include/shared/kern_util.h | 2 +- arch/um/kernel/process.c | 2 +- arch/um/kernel/time.c | 32 +++- arch/um/os-Linux/helper.c | 6 +- arch/um/os-Linux/util.c | 19 +- arch/x86/boot/compressed/ident_map_64.c | 5 + arch/x86/boot/compressed/idt_64.c | 1 + arch/x86/boot/compressed/idt_handlers_64.S | 1 + arch/x86/boot/compressed/misc.h | 1 + arch/x86/include/asm/irq_work.h | 1 - arch/x86/include/asm/kmsan.h | 17 +- arch/x86/kernel/cpu/mce/core.c | 16 ++ block/bio.c | 2 +- block/blk-mq.c | 16 ++ drivers/acpi/acpi_extlog.c | 5 +- drivers/acpi/acpi_video.c | 9 + drivers/acpi/apei/ghes.c | 29 ++- drivers/acpi/numa/srat.c | 4 +- drivers/base/arch_numa.c | 2 +- drivers/block/rnbd/rnbd-srv.c | 19 +- drivers/bluetooth/hci_qca.c | 1 + drivers/clk/hisilicon/clk-hi3620.c | 4 +- drivers/clk/imx/clk-imx8qxp.c | 24 ++- drivers/clk/mmp/clk-of-pxa168.c | 3 + drivers/crypto/marvell/octeontx2/otx2_cptlf.c | 6 +- drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c | 3 + drivers/crypto/stm32/stm32-crc32.c | 2 +- drivers/devfreq/devfreq.c | 24 ++- drivers/gpu/drm/amd/amdgpu/aldebaran.c | 26 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 21 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.h | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 6 +- drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c | 4 + drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c | 5 + drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 4 + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 42 ++--- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 24 +-- drivers/gpu/drm/amd/display/dc/core/dc.c | 4 + drivers/gpu/drm/amd/display/dc/dc_hw_types.h | 2 +- .../amd/display/dc/dml/dcn32/display_mode_vba_32.c | 3 + .../dc/dml/dcn32/display_mode_vba_util_32.c | 33 +++- .../dc/dml/dcn32/display_mode_vba_util_32.h | 1 + .../drm/amd/display/modules/power/power_helpers.c | 2 - .../amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | 2 +- drivers/gpu/drm/bridge/analogix/anx7625.c | 51 ++++-- drivers/gpu/drm/bridge/analogix/anx7625.h | 4 + drivers/gpu/drm/drm_file.c | 2 +- drivers/gpu/drm/drm_framebuffer.c | 2 +- drivers/gpu/drm/drm_mipi_dsi.c | 17 +- drivers/gpu/drm/exynos/exynos_drm_drv.c | 11 ++ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 5 +- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c | 3 + drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h | 1 + drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 4 + drivers/gpu/drm/panel/panel-edp.c | 48 ++++- drivers/hid/hidraw.c | 7 +- drivers/hwmon/nct6775-core.c | 7 + drivers/i3c/master/i3c-master-cdns.c | 7 +- drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 7 +- drivers/leds/trigger/ledtrig-panic.c | 5 +- drivers/mailbox/arm_mhuv2.c | 3 +- drivers/md/md.c | 54 ++++-- drivers/media/i2c/imx335.c | 4 +- drivers/media/pci/ddbridge/ddbridge-main.c | 2 +- drivers/media/platform/amphion/vpu.h | 3 +- drivers/media/platform/amphion/vpu_cmds.c | 28 +-- drivers/media/platform/amphion/vpu_v4l2.c | 1 + drivers/media/platform/rockchip/rga/rga.c | 15 +- .../media/platform/rockchip/rkisp1/rkisp1-common.h | 11 +- .../media/platform/rockchip/rkisp1/rkisp1-csi.c | 14 +- .../media/platform/rockchip/rkisp1/rkisp1-dev.c | 35 +++- .../media/platform/rockchip/rkisp1/rkisp1-isp.c | 20 ++- drivers/media/usb/stk1160/stk1160-video.c | 5 +- drivers/mfd/Kconfig | 1 + drivers/misc/lis3lv02d/lis3lv02d_i2c.c | 1 + drivers/net/bonding/bond_alb.c | 3 +- drivers/net/dsa/mv88e6xxx/chip.h | 4 +- drivers/net/dsa/mv88e6xxx/serdes.c | 10 +- drivers/net/dsa/mv88e6xxx/serdes.h | 8 +- drivers/net/dsa/qca/qca8k-8xxx.c | 24 ++- drivers/net/ethernet/aquantia/atlantic/aq_ptp.c | 28 ++- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 61 ++----- drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 22 +-- drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 23 ++- drivers/net/ethernet/google/gve/gve_tx_dqo.c | 5 +- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 32 ++++ drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 1 + drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 18 +- drivers/net/ethernet/intel/ice/ice_lib.c | 7 +- drivers/net/ethernet/intel/ice/ice_virtchnl.c | 12 +- drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.c | 16 +- drivers/net/ethernet/intel/ixgbe/ixgbe_82598.c | 36 ++-- drivers/net/ethernet/intel/ixgbe/ixgbe_82599.c | 61 ++++--- drivers/net/ethernet/intel/ixgbe/ixgbe_common.c | 145 +++++++-------- drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 42 ++--- drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.c | 34 ++-- drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h | 1 - drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c | 105 +++++------ drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_type.h | 43 +---- drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c | 44 ++--- drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 149 +++++++-------- .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 13 +- .../net/ethernet/microchip/lan966x/lan966x_port.c | 5 +- .../net/ethernet/pensando/ionic/ionic_bus_pci.c | 4 + drivers/net/ethernet/pensando/ionic/ionic_dev.c | 1 + drivers/net/ethernet/pensando/ionic/ionic_dev.h | 1 + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 3 + drivers/net/ethernet/pensando/ionic/ionic_main.c | 22 ++- drivers/net/phy/at803x.c | 6 +- drivers/net/usb/ax88179_178a.c | 2 - drivers/net/virtio_net.c | 9 +- drivers/net/wireless/ath/ath11k/pcic.c | 4 +- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 5 +- drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 3 + drivers/net/wireless/ralink/rt2x00/rt2x00mac.c | 11 ++ .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 12 ++ .../net/wireless/realtek/rtlwifi/rtl8723ae/phy.c | 6 +- .../net/wireless/realtek/rtlwifi/rtl8723be/phy.c | 4 +- drivers/net/wireless/silabs/wfx/sta.c | 42 +++-- drivers/pci/pci.h | 2 +- drivers/pci/pcie/aer.c | 9 +- drivers/pci/quirks.c | 24 ++- drivers/pci/switch/switchtec.c | 25 ++- drivers/pnp/pnpacpi/rsparser.c | 12 +- drivers/regulator/core.c | 56 +++--- drivers/regulator/ti-abb-regulator.c | 22 ++- drivers/s390/crypto/vfio_ap_ops.c | 16 +- drivers/scsi/arcmsr/arcmsr.h | 4 + drivers/scsi/arcmsr/arcmsr_hba.c | 6 + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +- drivers/scsi/isci/request.c | 2 +- drivers/scsi/libfc/fc_fcp.c | 18 +- drivers/scsi/lpfc/lpfc.h | 1 + drivers/scsi/lpfc/lpfc_init.c | 4 +- drivers/scsi/mpi3mr/mpi3mr_fw.c | 3 +- drivers/scsi/mpi3mr/mpi3mr_os.c | 5 +- drivers/scsi/scsi_error.c | 8 +- drivers/scsi/scsi_lib.c | 2 +- drivers/scsi/scsi_priv.h | 2 +- drivers/soc/xilinx/xlnx_event_manager.c | 7 +- drivers/spmi/spmi-mtk-pmif.c | 7 +- drivers/tty/tty_ioctl.c | 4 +- drivers/usb/core/hub.c | 33 +++- drivers/usb/host/xhci.c | 40 +++-- drivers/watchdog/it87_wdt.c | 14 +- drivers/xen/gntdev-dmabuf.c | 50 +++--- fs/9p/v9fs_vfs.h | 1 + fs/9p/vfs_inode.c | 6 +- fs/9p/vfs_inode_dotl.c | 1 + fs/afs/callback.c | 3 +- fs/afs/server.c | 7 +- fs/ceph/caps.c | 9 +- fs/ceph/mds_client.c | 2 +- fs/ceph/quota.c | 39 ++-- fs/dcache.c | 7 +- fs/ecryptfs/inode.c | 8 + fs/erofs/zdata.c | 2 +- fs/ext4/mballoc.c | 11 +- fs/ext4/resize.c | 37 ++-- fs/f2fs/compress.c | 4 +- fs/f2fs/file.c | 2 + fs/f2fs/recovery.c | 25 ++- fs/jfs/jfs_dmap.c | 57 +++--- fs/jfs/jfs_dtree.c | 7 +- fs/jfs/jfs_imap.c | 3 + fs/jfs/jfs_mount.c | 6 +- fs/kernfs/dir.c | 12 ++ fs/pstore/ram.c | 1 + include/asm-generic/numa.h | 2 + include/asm-generic/unaligned.h | 24 +-- include/drm/drm_color_mgmt.h | 1 + include/drm/drm_mipi_dsi.h | 2 + include/linux/irq_work.h | 3 + include/linux/mmzone.h | 6 +- include/linux/pci_ids.h | 1 + include/net/af_unix.h | 20 ++- include/net/ip.h | 2 +- include/net/netfilter/nf_tables.h | 2 + kernel/audit.c | 31 +++- kernel/bpf/helpers.c | 13 +- kernel/bpf/syscall.c | 6 + kernel/events/core.c | 38 ++-- lib/debugobjects.c | 200 ++++++++------------- net/bluetooth/hci_sync.c | 10 +- net/bluetooth/l2cap_core.c | 3 +- net/bridge/br_cfm_netlink.c | 2 +- net/bridge/br_multicast.c | 20 ++- net/bridge/br_private.h | 4 +- net/ipv4/ip_output.c | 12 +- net/ipv4/ip_sockglue.c | 6 +- net/ipv4/ipmr.c | 2 +- net/ipv4/raw.c | 10 +- net/ipv4/tcp.c | 12 +- net/ipv4/udp.c | 2 +- net/ipv6/addrconf_core.c | 21 ++- net/ipv6/ip6_tunnel.c | 21 ++- net/llc/af_llc.c | 2 + net/netfilter/nf_conntrack_proto_tcp.c | 10 +- net/netfilter/nf_log.c | 7 +- net/netfilter/nf_tables_api.c | 14 +- net/netfilter/nft_ct.c | 24 +++ net/netfilter/nft_tunnel.c | 1 + net/rxrpc/conn_service.c | 3 +- net/smc/smc_clc.c | 14 ++ net/sunrpc/xprtmultipath.c | 17 +- net/unix/af_unix.c | 14 +- net/unix/diag.c | 2 +- net/wireless/scan.c | 4 + sound/hda/hdac_stream.c | 9 +- sound/pci/hda/hda_intel.c | 2 + sound/pci/hda/patch_conexant.c | 115 +++++++++++- sound/soc/amd/acp-config.c | 15 +- tools/build/feature/test-libopencsd.c | 4 +- tools/lib/bpf/libbpf.c | 2 + tools/lib/subcmd/help.c | 18 +- tools/testing/selftests/bpf/cgroup_helpers.c | 18 +- tools/testing/selftests/bpf/prog_tests/btf.c | 1 + tools/testing/selftests/bpf/progs/pyperf180.c | 22 +++ .../selftests/drivers/net/bonding/lag_lib.sh | 11 ++ tools/testing/selftests/drivers/net/team/config | 4 +- tools/testing/selftests/net/config | 1 + tools/testing/selftests/net/pmtu.sh | 16 +- tools/testing/selftests/net/setup_veth.sh | 2 +- tools/testing/selftests/sgx/test_encl.lds | 6 +- 282 files changed, 2329 insertions(+), 1339 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/219 asm-generic: make sparse happy with odd-sized put_unaligned_*()
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit 1ab33c03145d0f6c345823fc2da935d9a1a9e9fc ]
__put_unaligned_be24() and friends use implicit casts to convert larger-sized data to bytes, which trips sparse truncation warnings when the argument is a constant:
CC [M] drivers/input/touchscreen/hynitron_cstxxx.o
CHECK drivers/input/touchscreen/hynitron_cstxxx.c
drivers/input/touchscreen/hynitron_cstxxx.c: note: in included file (through arch/x86/include/generated/asm/unaligned.h):
include/asm-generic/unaligned.h:119:16: warning: cast truncates bits from constant value (aa01a0 becomes a0) include/asm-generic/unaligned.h:120:20: warning: cast truncates bits from constant value (aa01 becomes 1) include/asm-generic/unaligned.h:119:16: warning: cast truncates bits from constant value (ab00d0 becomes d0) include/asm-generic/unaligned.h:120:20: warning: cast truncates bits from constant value (ab00 becomes 0)
To avoid this let's mask off upper bits explicitly, the resulting code should be exactly the same, but it will keep sparse happy.
--- include/asm-generic/unaligned.h | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
include/asm-generic/unaligned.h +12 -12
@@ -104,9 +104,9 @@ static inline u32 get_unaligned_le24(const void *p)static inline void __put_unaligned_be24 (const u32 val,u8 *p) { - *p++ = val >>16 ; - *p++ = val >>8 ; - *p++ = val; + *p++ = (val >>16 ) &0xff ; + *p++ = (val >>8 ) &0xff ; + *p++ = val &0xff ; }static inline void put_unaligned_be24 (const u32 val,void *p)
@@ -116,9 +116,9 @@ static inline void put_unaligned_be24(const u32 val, void *p)static inline void __put_unaligned_le24 (const u32 val,u8 *p) { - *p++ = val; - *p++ = val >>8 ; - *p++ = val >>16 ; + *p++ = val &0xff ; + *p++ = (val >>8 ) &0xff ; + *p++ = (val >>16 ) &0xff ; }static inline void put_unaligned_le24 (const u32 val,void *p)
@@ -128,12 +128,12 @@ static inline void put_unaligned_le24(const u32 val, void *p)static inline void __put_unaligned_be48 (const u64 val,u8 *p) { - *p++ = val >>40 ; - *p++ = val >>32 ; - *p++ = val >>24 ; - *p++ = val >>16 ; - *p++ = val >>8 ; - *p++ = val; + *p++ = (val >>40 ) &0xff ; + *p++ = (val >>32 ) &0xff ; + *p++ = (val >>24 ) &0xff ; + *p++ = (val >>16 ) &0xff ; + *p++ = (val >>8 ) &0xff ; + *p++ = val &0xff ; }static inline void put_unaligned_be48 (const u64 val,void *p)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/219 powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit f46c8a75263f97bda13c739ba1c90aced0d3b071 ]
kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity.
--- arch/powerpc/mm/init-common.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/powerpc/mm/init-common.c +3 -2
@@ -126,7 +126,7 @@ void pgtable_cache_add(unsigned int shift)* as to leave enough 0 bits in the address to contain it. */ unsigned long minalign =max (MAX_PGTABLE_INDEX_SIZE +1 ,HUGEPD_SHIFT_MASK +1 ); -struct kmem_cache *new; +struct kmem_cache *new =NULL ;/* It would be nice if this was a BUILD_BUG_ON(), but at the * moment, gcc doesn't seem to recognize is_power_of_2 as a
@@ -139,7 +139,8 @@ void pgtable_cache_add(unsigned int shift) align = max_t(unsigned long, align, minalign); name =kasprintf (GFP_KERNEL ,"pgtable-2^%d" , shift); - new =kmem_cache_create (name, table_size, align,0 ,ctor (shift)); +if (name) + new =kmem_cache_create (name, table_size, align,0 ,ctor (shift));if (!new)panic ("Could not allocate pgtable cache for order %d" , shift);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/219 arm64: irq: set the correct node for VMAP stack
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huang Shijie <[email protected]>
[ Upstream commit 75b5e0bf90bffaca4b1f19114065dc59f5cc161f ]
In current code, init_irq_stacks() will call cpu_to_node(). The cpu_to_node() depends on percpu "numa_node" which is initialized in:
arch_call_rest_init() --> rest_init() -- kernel_init() --> kernel_init_freeable() --> smp_prepare_cpus()
But init_irq_stacks() is called in init_IRQ() which is before arch_call_rest_init().
So in init_irq_stacks(), the cpu_to_node() does not work, it always return 0. In NUMA, it makes the node 1 cpu accesses the IRQ stack which is in the node 0.
This patch fixes it by:
1.) export the early_cpu_to_node(), and use it in the init_irq_stacks(). 2.) change init_irq_stacks() to __init function.
--- arch/arm64/kernel/irq.c | 5 +++-- drivers/base/arch_numa.c | 2 +- include/asm-generic/numa.h | 2 ++ 3 files changed, 6 insertions(+), 3 deletions(-)
arch/arm64/kernel/irq.c +3 -2
@@ -22,6 +22,7 @@#include <linux/vmalloc.h> #include <asm/daifflags.h> #include <asm/exception.h> +#include <asm/numa.h> #include <asm/vmap_stack.h> #include <asm/softirq_stack.h>
@@ -50,13 +51,13 @@ static void init_irq_scs(void) }#ifdef CONFIG_VMAP_STACK -static void init_irq_stacks (void ) +static void __init init_irq_stacks (void ) {int cpu;unsigned long *p;for_each_possible_cpu (cpu) { - p =arch_alloc_vmap_stack (IRQ_STACK_SIZE ,cpu_to_node (cpu)); + p =arch_alloc_vmap_stack (IRQ_STACK_SIZE ,early_cpu_to_node (cpu));per_cpu (irq_stack_ptr, cpu) = p; } }
drivers/base/arch_numa.c +1 -1
@@ -144,7 +144,7 @@ void __init early_map_cpu_to_node(unsigned int cpu, int nid)unsigned long __per_cpu_offset[NR_CPUS ]__read_mostly ;EXPORT_SYMBOL (__per_cpu_offset); -static int __init early_cpu_to_node (int cpu) +int __init early_cpu_to_node (int cpu) {return cpu_to_node_map[cpu]; }
include/asm-generic/numa.h +2 -0
@@ -35,6 +35,7 @@ int __init numa_add_memblk(int nodeid, u64 start, u64 end);void __init numa_set_distance (int from,int to,int distance);void __init numa_free_distance (void );void __init early_map_cpu_to_node (unsigned int cpu,int nid); +int __init early_cpu_to_node (int cpu);void numa_store_cpu_info (unsigned int cpu);void numa_add_cpu (unsigned int cpu);void numa_remove_cpu (unsigned int cpu);
@@ -46,6 +47,7 @@ static inline void numa_add_cpu(unsigned int cpu) { }static inline void numa_remove_cpu (unsigned int cpu) { }static inline void arch_numa_init (void ) { }static inline void early_map_cpu_to_node (unsigned int cpu,int nid) { } +static inline int early_cpu_to_node (int cpu) {return 0 ; }#endif /* CONFIG_NUMA */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/219 drivers/perf: pmuv3: dont expose SW_INCR event in sysfs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
[ Upstream commit ca6f537e459e2da4b331fe8928d1a0b0f9301f42 ]
The SW_INCR event is somewhat unusual, and depends on the specific HW counter that it is programmed into. When programmed into PMEVCNTR<n>, SW_INCR will count any writes to PMSWINC_EL0 with bit n set, ignoring writes to SW_INCR with bit n clear.
Event rotation means that there's no fixed relationship between perf_events and HW counters, so this isn't all that useful.
Further, we program PMUSERENR.{SW,EN}=={0,0}, which causes EL0 writes to PMSWINC_EL0 to be trapped and handled as UNDEFINED, resulting in a SIGILL to userspace.
Given that, it's not a good idea to expose SW_INCR in sysfs. Hide it as we did for CHAIN back in commit:
4ba2578fa7b55701 ("arm64: perf: don't expose CHAIN event in sysfs")
--- arch/arm64/kernel/perf_event.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/arm64/kernel/perf_event.c +5 -1
@@ -168,7 +168,11 @@ armv8pmu_events_sysfs_show(struct device *dev, PMU_EVENT_ATTR_ID(name, armv8pmu_events_sysfs_show, config)static struct attribute *armv8_pmuv3_event_attrs[] = { -ARMV8_EVENT_ATTR (sw_incr,ARMV8_PMUV3_PERFCTR_SW_INCR ), +/* +* Don't expose the sw_incr event in /sys. It's not usable as writes to +* PMSWINC_EL0 will trap as PMUSERENR.{SW,EN}=={0,0} and event rotation +* means we don't have a fixed event<->counter relationship regardless. +*/ ARMV8_EVENT_ATTR (l1i_cache_refill,ARMV8_PMUV3_PERFCTR_L1I_CACHE_REFILL ),ARMV8_EVENT_ATTR (l1i_tlb_refill,ARMV8_PMUV3_PERFCTR_L1I_TLB_REFILL ),ARMV8_EVENT_ATTR (l1d_cache_refill,ARMV8_PMUV3_PERFCTR_L1D_CACHE_REFILL ),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/219 powerpc: Fix build error due to is_valid_bugaddr()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit f8d3555355653848082c351fa90775214fb8a4fa ]
With CONFIG_GENERIC_BUG=n the build fails with:
arch/powerpc/kernel/traps.c:1442:5: error: no previous prototype for ‘is_valid_bugaddr’ [-Werror=missing-prototypes] 1442 | int is_valid_bugaddr(unsigned long addr)
| ^~~~~~~~~~~~~~~~
The prototype is only defined, and the function is only needed, when CONFIG_GENERIC_BUG=y, so move the implementation under that.
--- arch/powerpc/kernel/traps.c | 2 ++ 1 file changed, 2 insertions(+)
arch/powerpc/kernel/traps.c +2 -0
@@ -1439,10 +1439,12 @@ static int emulate_instruction(struct pt_regs *regs)return -EINVAL ; } +#ifdef CONFIG_GENERIC_BUG int is_valid_bugaddr (unsigned long addr) {return is_kernel_addr (addr); } +#endif #ifdef CONFIG_MATH_EMULATION static int emulate_math (struct pt_regs *regs)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/219 powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit d8c3f243d4db24675b653f0568bb65dae34e6455 ]
With NUMA=n and FA_DUMP=y or PRESERVE_FA_DUMP=y the build fails with:
arch/powerpc/kernel/fadump.c:1739:22: error: no previous prototype for ‘arch_reserved_kernel_pages’ [-Werror=missing-prototypes] 1739 | unsigned long __init arch_reserved_kernel_pages(void)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
The prototype for arch_reserved_kernel_pages() is in include/linux/mm.h, but it's guarded by __HAVE_ARCH_RESERVED_KERNEL_PAGES. The powerpc headers define __HAVE_ARCH_RESERVED_KERNEL_PAGES in asm/mmzone.h, which is not included into the generic headers when NUMA=n.
Move the definition of __HAVE_ARCH_RESERVED_KERNEL_PAGES into asm/mmu.h which is included regardless of NUMA=n.
Additionally the ifdef around __HAVE_ARCH_RESERVED_KERNEL_PAGES needs to also check for CONFIG_PRESERVE_FA_DUMP.
--- arch/powerpc/include/asm/mmu.h | 4 ++++ arch/powerpc/include/asm/mmzone.h | 3 --- 2 files changed, 4 insertions(+), 3 deletions(-)
arch/powerpc/include/asm/mmu.h +4 -0
@@ -417,5 +417,9 @@ extern void *abatron_pteptrs[2];#include <asm/nohash/mmu.h> #endif +#if defined(CONFIG_FA_DUMP ) || defined(CONFIG_PRESERVE_FA_DUMP ) +#define __HAVE_ARCH_RESERVED_KERNEL_PAGES +#endif +#endif /* __KERNEL__ */ #endif /* _ASM_POWERPC_MMU_H_ */
arch/powerpc/include/asm/mmzone.h +0 -3
@@ -42,9 +42,6 @@ u64 memory_hotplug_max(void);#else #define memory_hotplug_max () memblock_end_of_DRAM()#endif /* CONFIG_NUMA */ -#ifdef CONFIG_FA_DUMP -#define __HAVE_ARCH_RESERVED_KERNEL_PAGES -#endif #ifdef CONFIG_MEMORY_HOTPLUG extern int create_section_mapping(unsigned long start, unsigned long end,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/219 powerpc/64s: Fix CONFIG_NUMA=n build due to create_section_mapping()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit ede66cd22441820cbd399936bf84fdc4294bc7fa ]
With CONFIG_NUMA=n the build fails with:
arch/powerpc/mm/book3s64/pgtable.c:275:15: error: no previous prototype for ‘create_section_mapping’ [-Werror=missing-prototypes] 275 | int __meminit create_section_mapping(unsigned long start, unsigned long end,
| ^~~~~~~~~~~~~~~~~~~~~~
That happens because the prototype for create_section_mapping() is in asm/mmzone.h, but asm/mmzone.h is only included by linux/mmzone.h when CONFIG_NUMA=y.
In fact the prototype is only needed by arch/powerpc/mm code, so move the prototype into arch/powerpc/mm/mmu_decl.h, which also fixes the build error.
--- arch/powerpc/include/asm/mmzone.h | 5 ----- arch/powerpc/mm/mmu_decl.h | 5 +++++ 2 files changed, 5 insertions(+), 5 deletions(-)
arch/powerpc/include/asm/mmzone.h +0 -5
@@ -43,10 +43,5 @@ u64 memory_hotplug_max(void);#define memory_hotplug_max () memblock_end_of_DRAM()#endif /* CONFIG_NUMA */ -#ifdef CONFIG_MEMORY_HOTPLUG -extern int create_section_mapping (unsigned long start,unsigned long end, -int nid,pgprot_t prot); -#endif -#endif /* __KERNEL__ */ #endif /* _ASM_MMZONE_H_ */
arch/powerpc/mm/mmu_decl.h +5 -0
@@ -179,3 +179,8 @@ static inline bool debug_pagealloc_enabled_or_kfence(void) {return IS_ENABLED (CONFIG_KFENCE ) ||debug_pagealloc_enabled (); } + +#ifdef CONFIG_MEMORY_HOTPLUG +int create_section_mapping (unsigned long start,unsigned long end, +int nid,pgprot_t prot); +#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/219 x86/boot: Ignore NMIs during very early boot
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jun'ichi Nomura <[email protected]>
[ Upstream commit 78a509fba9c9b1fcb77f95b7c6be30da3d24823a ]
When there are two racing NMIs on x86, the first NMI invokes NMI handler and the 2nd NMI is latched until IRET is executed.
If panic on NMI and panic kexec are enabled, the first NMI triggers panic and starts booting the next kernel via kexec. Note that the 2nd NMI is still latched. During the early boot of the next kernel, once an IRET is executed as a result of a page fault, then the 2nd NMI is unlatched and invokes the NMI handler.
However, NMI handler is not set up at the early stage of boot, which results in a boot failure.
Avoid such problems by setting up a NOP handler for early NMIs.
[ mingo: Refined the changelog. ]
--- arch/x86/boot/compressed/ident_map_64.c | 5 +++++ arch/x86/boot/compressed/idt_64.c | 1 + arch/x86/boot/compressed/idt_handlers_64.S | 1 + arch/x86/boot/compressed/misc.h | 1 + 4 files changed, 8 insertions(+)
arch/x86/boot/compressed/ident_map_64.c +5 -0
@@ -393,3 +393,8 @@ void do_boot_page_fault(struct pt_regs *regs, unsigned long error_code)*/ kernel_add_identity_map (address, end); } + +void do_boot_nmi_trap (struct pt_regs *regs,unsigned long error_code) +{ +/* Empty handler to ignore NMI during early boot */ +}
arch/x86/boot/compressed/idt_64.c +1 -0
@@ -61,6 +61,7 @@ void load_stage2_idt(void) boot_idt_desc.address = (unsigned long )boot_idt;set_idt_entry (X86_TRAP_PF , boot_page_fault); +set_idt_entry (X86_TRAP_NMI , boot_nmi_trap);#ifdef CONFIG_AMD_MEM_ENCRYPT /*
arch/x86/boot/compressed/idt_handlers_64.S +1 -0
@@ -70,6 +70,7 @@ SYM_FUNC_END(\name) .code64 EXCEPTION_HANDLER boot_page_fault do_boot_page_fault error_code=1 +EXCEPTION_HANDLER boot_nmi_trap do_boot_nmi_trap error_code=0 #ifdef CONFIG_AMD_MEM_ENCRYPT EXCEPTION_HANDLER boot_stage1_vc do_vc_no_ghcb error_code=1
arch/x86/boot/compressed/misc.h +1 -0
@@ -190,6 +190,7 @@ static inline void cleanup_exception_handling(void) { }/* IDT Entry Points */ void boot_page_fault (void ); +void boot_nmi_trap (void );void boot_stage1_vc (void );void boot_stage2_vc (void );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/219 powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Rothwell <[email protected]>
[ Upstream commit 0d555b57ee660d8a871781c0eebf006e855e918d ]
The linux-next build of powerpc64 allnoconfig fails with:
arch/powerpc/mm/book3s64/pgtable.c:557:5: error: no previous prototype for 'pmd_move_must_withdraw'
557 | int pmd_move_must_withdraw(struct spinlock *new_pmd_ptl,
| ^~~~~~~~~~~~~~~~~~~~~~
Caused by commit:
c6345dfa6e3e ("Makefile.extrawarn: turn on missing-prototypes globally")
Fix it by moving the function definition under CONFIG_TRANSPARENT_HUGEPAGE like the prototype. The function is only called when CONFIG_TRANSPARENT_HUGEPAGE=y.
--- arch/powerpc/mm/book3s64/pgtable.c | 2 ++ 1 file changed, 2 insertions(+)
arch/powerpc/mm/book3s64/pgtable.c +2 -0
@@ -463,6 +463,7 @@ void ptep_modify_prot_commit(struct vm_area_struct *vma, unsigned long addr,set_pte_at (vma->vm_mm, addr, ptep, pte); } +#ifdef CONFIG_TRANSPARENT_HUGEPAGE /* * For hash translation mode, we use the deposited table to store hash slot * information and they are stored at PTRS_PER_PMD offset from related pmd
@@ -484,6 +485,7 @@ int pmd_move_must_withdraw(struct spinlock *new_pmd_ptl, return true; } +#endif /* * Does the CPU support tlbie?
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/219 powerpc/lib: Validate size for vector operations
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naveen N Rao <[email protected]>
[ Upstream commit 8f9abaa6d7de0a70fc68acaedce290c1f96e2e59 ]
Some of the fp/vmx code in sstep.c assume a certain maximum size for the instructions being emulated. The size of those operations however is determined separately in analyse_instr().
Add a check to validate the assumption on the maximum size of the operations, so as to prevent any unintended kernel stack corruption.
--- arch/powerpc/lib/sstep.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
arch/powerpc/lib/sstep.c +10 -0
@@ -586,6 +586,8 @@ static int do_fp_load(struct instruction_op *op, unsigned long ea, } u; nb =GETSIZE (op->type); +if (nb >sizeof (u)) +return -EINVAL ;if (!address_ok (regs, ea, nb))return -EFAULT ; rn = op->reg;
@@ -636,6 +638,8 @@ static int do_fp_store(struct instruction_op *op, unsigned long ea, } u; nb =GETSIZE (op->type); +if (nb >sizeof (u)) +return -EINVAL ;if (!address_ok (regs, ea, nb))return -EFAULT ; rn = op->reg;
@@ -680,6 +684,9 @@ static nokprobe_inline int do_vec_load(int rn, unsigned long ea,u8 b[sizeof (__vector128)]; } u = {}; +if (size >sizeof (u)) +return -EINVAL ; +if (!address_ok (regs, ea & ~0xfUL ,16 ))return -EFAULT ;/* align to multiple of size */
@@ -707,6 +714,9 @@ static nokprobe_inline int do_vec_store(int rn, unsigned long ea,u8 b[sizeof (__vector128)]; } u; +if (size >sizeof (u)) +return -EINVAL ; +if (!address_ok (regs, ea & ~0xfUL ,16 ))return -EFAULT ;/* align to multiple of size */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/219 x86/mce: Mark fatal MCEs page as poison to avoid panic in the kdump kernel
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiquan Li <[email protected]>
[ Upstream commit 9f3b130048bfa2e44a8cfb1b616f826d9d5d8188 ]
Memory errors don't happen very often, especially fatal ones. However, in large-scale scenarios such as data centers, that probability increases with the amount of machines present.
When a fatal machine check happens, mce_panic() is called based on the severity grading of that error. The page containing the error is not marked as poison.
However, when kexec is enabled, tools like makedumpfile understand when pages are marked as poison and do not touch them so as not to cause a fatal machine check exception again while dumping the previous kernel's memory.
Therefore, mark the page containing the error as poisoned so that the kexec'ed kernel can avoid accessing the page.
[ bp: Rewrite commit message and comment. ]
--- arch/x86/kernel/cpu/mce/core.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
arch/x86/kernel/cpu/mce/core.c +16 -0
@@ -44,6 +44,7 @@#include <linux/sync_core.h> #include <linux/task_work.h> #include <linux/hardirq.h> +#include <linux/kexec.h> #include <asm/intel-family.h> #include <asm/processor.h>
@@ -239,6 +240,7 @@ static noinstr void mce_panic(const char *msg, struct mce *final, char *exp)struct llist_node *pending;struct mce_evt_llist *l;int apei_err =0 ; +struct page *p;/* * Allow instrumentation around external facilities usage. Not that it
@@ -292,6 +294,20 @@ static noinstr void mce_panic(const char *msg, struct mce *final, char *exp)if (!fake_panic) {if (panic_timeout ==0 ) panic_timeout = mca_cfg.panic_timeout; + +/* +* Kdump skips the poisoned page in order to avoid +* touching the error bits again. Poison the page even +* if the error is fatal and the machine is about to +* panic. +*/ +if (kexec_crash_loaded ()) { +if (final && (final->status &MCI_STATUS_ADDRV )) { + p =pfn_to_online_page (final->addr >>PAGE_SHIFT ); +if (p) +SetPageHWPoison (p); + } + }panic (msg); }else pr_emerg (HW_ERR "Fake kernel panic: %s\n" , msg);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/219 perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg KH <[email protected]>
[ Upstream commit 652ffc2104ec1f69dd4a46313888c33527145ccf ]
--- kernel/events/core.c | 40 ++++++++++++++++++++++++++++------------ 1 file changed, 28 insertions(+), 12 deletions(-)
kernel/events/core.c +28 -12
@@ -11223,9 +11223,32 @@ static DEVICE_ATTR_RW(perf_event_mux_interval_ms);static struct attribute *pmu_dev_attrs[] = { &dev_attr_type.attr, &dev_attr_perf_event_mux_interval_ms.attr, + &dev_attr_nr_addr_filters.attr, +NULL , +}; + +static umode_t pmu_dev_is_visible (struct kobject *kobj,struct attribute *a,int n) +{ +struct device *dev =kobj_to_dev (kobj); +struct pmu *pmu =dev_get_drvdata (dev); + +if (!pmu->nr_addr_filters) +return 0 ; + +return a->mode; + +return 0 ; +} + +static struct attribute_group pmu_dev_attr_group = { + .is_visible = pmu_dev_is_visible, + .attrs = pmu_dev_attrs, +}; + +static const struct attribute_group *pmu_dev_groups[] = { + &pmu_dev_attr_group,NULL , }; -ATTRIBUTE_GROUPS (pmu_dev);static int pmu_bus_running;static struct bus_type pmu_bus = {
@@ -11261,18 +11284,11 @@ static int pmu_dev_alloc(struct pmu *pmu)if (ret) goto free_dev; -/* For PMUs with address filters, throw in an extra attribute: */ -if (pmu->nr_addr_filters) - ret =device_create_file (pmu->dev, &dev_attr_nr_addr_filters); - -if (ret) - goto del_dev; - -if (pmu->attr_update) +if (pmu->attr_update) { ret =sysfs_update_groups (&pmu->dev->kobj, pmu->attr_update); - -if (ret) - goto del_dev; +if (ret) + goto del_dev; + } out:return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/219 debugobjects: Stop accessing objects after releasing hash bucket lock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrzej Hajda <[email protected]>
[ Upstream commit 9bb6362652f3f4d74a87d572a91ee1b38e673ef6 ]
After release of the hashbucket lock the tracking object can be modified or freed by a concurrent thread. Using it in such a case is error prone, even for printing the object state:
1. T1 tries to deactivate destroyed object, debugobjects detects it, hash bucket lock is released.
2. T2 preempts T1 and frees the tracking object.
3. The freed tracking object is allocated and initialized for a different to be tracked kernel object.
4. T1 resumes and reports error for wrong kernel object.
Create a local copy of the tracking object before releasing the hash bucket lock and use the local copy for reporting and fixups to prevent this.
--- lib/debugobjects.c | 200 ++++++++++++++++++--------------------------- 1 file changed, 78 insertions(+), 122 deletions(-)
lib/debugobjects.c +78 -122
@@ -609,9 +609,8 @@ static void debug_objects_fill_pool(void)static void __debug_object_init (void *addr,const struct debug_obj_descr *descr,int onstack) { -enum debug_obj_state state; +struct debug_obj *obj, o;struct debug_bucket *db; -struct debug_obj *obj;unsigned long flags;debug_objects_fill_pool ();
@@ -632,24 +631,18 @@ __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstackcase ODEBUG_STATE_INIT :case ODEBUG_STATE_INACTIVE : obj->state =ODEBUG_STATE_INIT ; -break ; - -case ODEBUG_STATE_ACTIVE : - state = obj->state; -raw_spin_unlock_irqrestore (&db->lock, flags); -debug_print_object (obj,"init" ); -debug_object_fixup (descr->fixup_init, addr, state); -return ; - -case ODEBUG_STATE_DESTROYED :raw_spin_unlock_irqrestore (&db->lock, flags); -debug_print_object (obj,"init" );return ;default :break ; } + o = *obj;raw_spin_unlock_irqrestore (&db->lock, flags); +debug_print_object (&o,"init" ); + +if (o.state ==ODEBUG_STATE_ACTIVE ) +debug_object_fixup (descr->fixup_init, addr, o.state); }/**
@@ -690,11 +683,9 @@ EXPORT_SYMBOL_GPL(debug_object_init_on_stack);int debug_object_activate (void *addr,const struct debug_obj_descr *descr) {struct debug_obj o = { .object = addr, .state =ODEBUG_STATE_NOTAVAILABLE , .descr = descr }; -enum debug_obj_state state;struct debug_bucket *db;struct debug_obj *obj;unsigned long flags; -int ret;if (!debug_objects_enabled)return 0 ;
@@ -706,49 +697,38 @@ int debug_object_activate(void *addr, const struct debug_obj_descr *descr)raw_spin_lock_irqsave (&db->lock, flags); obj =lookup_object_or_alloc (addr, db, descr, false, true); -if (likely (!IS_ERR_OR_NULL (obj))) { -bool print_object = false; - +if (unlikely (!obj)) { +raw_spin_unlock_irqrestore (&db->lock, flags); +debug_objects_oom (); +return 0 ; + }else if (likely (!IS_ERR (obj))) {switch (obj->state) { -case ODEBUG_STATE_INIT : -case ODEBUG_STATE_INACTIVE : - obj->state =ODEBUG_STATE_ACTIVE ; - ret =0 ; -break ; -case ODEBUG_STATE_ACTIVE : - state = obj->state; -raw_spin_unlock_irqrestore (&db->lock, flags); -debug_print_object (obj,"activate" ); - ret =debug_object_fixup (descr->fixup_activate, addr, state); -return ret ?0 : -EINVAL ; -case ODEBUG_STATE_DESTROYED : - print_object = true; - ret = -EINVAL ; + o = *obj;break ; +case ODEBUG_STATE_INIT : +case ODEBUG_STATE_INACTIVE : + obj->state =ODEBUG_STATE_ACTIVE ; + fallthrough;default : - ret =0 ; -break ; +raw_spin_unlock_irqrestore (&db->lock, flags); +return 0 ; } -raw_spin_unlock_irqrestore (&db->lock, flags); -if (print_object) -debug_print_object (obj,"activate" ); -return ret; }raw_spin_unlock_irqrestore (&db->lock, flags); +debug_print_object (&o,"activate" ); -/* If NULL the allocation has hit OOM */ -if (!obj) { -debug_objects_oom (); -return 0 ; +switch (o.state) { +case ODEBUG_STATE_ACTIVE : +case ODEBUG_STATE_NOTAVAILABLE : +if (debug_object_fixup (descr->fixup_activate, addr, o.state)) +return 0 ; + fallthrough; +default : +return -EINVAL ; } - -/* Object is neither static nor tracked. It's not initialized */ -debug_print_object (&o,"activate" ); - ret =debug_object_fixup (descr->fixup_activate, addr,ODEBUG_STATE_NOTAVAILABLE ); -return ret ?0 : -EINVAL ; }EXPORT_SYMBOL_GPL (debug_object_activate);
@@ -759,10 +739,10 @@ EXPORT_SYMBOL_GPL(debug_object_activate);*/ void debug_object_deactivate (void *addr,const struct debug_obj_descr *descr) { +struct debug_obj o = { .object = addr, .state =ODEBUG_STATE_NOTAVAILABLE , .descr = descr };struct debug_bucket *db;struct debug_obj *obj;unsigned long flags; -bool print_object = false;if (!debug_objects_enabled)return ;
@@ -774,33 +754,24 @@ void debug_object_deactivate(void *addr, const struct debug_obj_descr *descr) obj =lookup_object (addr, db);if (obj) {switch (obj->state) { +case ODEBUG_STATE_DESTROYED : +break ;case ODEBUG_STATE_INIT :case ODEBUG_STATE_INACTIVE :case ODEBUG_STATE_ACTIVE : -if (!obj->astate) - obj->state =ODEBUG_STATE_INACTIVE ; -else - print_object = true; -break ; - -case ODEBUG_STATE_DESTROYED : - print_object = true; -break ; +if (obj->astate) +break ; + obj->state =ODEBUG_STATE_INACTIVE ; + fallthrough;default : -break ; +raw_spin_unlock_irqrestore (&db->lock, flags); +return ; } + o = *obj; }raw_spin_unlock_irqrestore (&db->lock, flags); -if (!obj) { -struct debug_obj o = { .object = addr, - .state =ODEBUG_STATE_NOTAVAILABLE , - .descr = descr }; - -debug_print_object (&o,"deactivate" ); - }else if (print_object) { -debug_print_object (obj,"deactivate" ); - } +debug_print_object (&o,"deactivate" ); }EXPORT_SYMBOL_GPL (debug_object_deactivate);
@@ -811,11 +782,9 @@ EXPORT_SYMBOL_GPL(debug_object_deactivate);*/ void debug_object_destroy (void *addr,const struct debug_obj_descr *descr) { -enum debug_obj_state state; +struct debug_obj *obj, o;struct debug_bucket *db; -struct debug_obj *obj;unsigned long flags; -bool print_object = false;if (!debug_objects_enabled)return ;
@@ -825,32 +794,31 @@ void debug_object_destroy(void *addr, const struct debug_obj_descr *descr)raw_spin_lock_irqsave (&db->lock, flags); obj =lookup_object (addr, db); -if (!obj) - goto out_unlock; +if (!obj) { +raw_spin_unlock_irqrestore (&db->lock, flags); +return ; + }switch (obj->state) { +case ODEBUG_STATE_ACTIVE : +case ODEBUG_STATE_DESTROYED : +break ;case ODEBUG_STATE_NONE :case ODEBUG_STATE_INIT :case ODEBUG_STATE_INACTIVE : obj->state =ODEBUG_STATE_DESTROYED ; -break ; -case ODEBUG_STATE_ACTIVE : - state = obj->state; + fallthrough; +default :raw_spin_unlock_irqrestore (&db->lock, flags); -debug_print_object (obj,"destroy" ); -debug_object_fixup (descr->fixup_destroy, addr, state);return ; - -case ODEBUG_STATE_DESTROYED : - print_object = true; -break ; -default : -break ; } -out_unlock: + + o = *obj;raw_spin_unlock_irqrestore (&db->lock, flags); -if (print_object) -debug_print_object (obj,"destroy" ); +debug_print_object (&o,"destroy" ); + +if (o.state ==ODEBUG_STATE_ACTIVE ) +debug_object_fixup (descr->fixup_destroy, addr, o.state); }EXPORT_SYMBOL_GPL (debug_object_destroy);
@@ -861,9 +829,8 @@ EXPORT_SYMBOL_GPL(debug_object_destroy);*/ void debug_object_free (void *addr,const struct debug_obj_descr *descr) { -enum debug_obj_state state; +struct debug_obj *obj, o;struct debug_bucket *db; -struct debug_obj *obj;unsigned long flags;if (!debug_objects_enabled)
@@ -874,24 +841,26 @@ void debug_object_free(void *addr, const struct debug_obj_descr *descr)raw_spin_lock_irqsave (&db->lock, flags); obj =lookup_object (addr, db); -if (!obj) - goto out_unlock; +if (!obj) { +raw_spin_unlock_irqrestore (&db->lock, flags); +return ; + }switch (obj->state) {case ODEBUG_STATE_ACTIVE : - state = obj->state; -raw_spin_unlock_irqrestore (&db->lock, flags); -debug_print_object (obj,"free" ); -debug_object_fixup (descr->fixup_free, addr, state); -return ; +break ;default :hlist_del (&obj->node);raw_spin_unlock_irqrestore (&db->lock, flags);free_object (obj);return ; } -out_unlock: + + o = *obj;raw_spin_unlock_irqrestore (&db->lock, flags); +debug_print_object (&o,"free" ); + +debug_object_fixup (descr->fixup_free, addr, o.state); }EXPORT_SYMBOL_GPL (debug_object_free);
@@ -943,10 +912,10 @@ void debug_object_active_state(void *addr, const struct debug_obj_descr *descr, unsigned int expect, unsigned int next) { +struct debug_obj o = { .object = addr, .state =ODEBUG_STATE_NOTAVAILABLE , .descr = descr };struct debug_bucket *db;struct debug_obj *obj;unsigned long flags; -bool print_object = false;if (!debug_objects_enabled)return ;
@@ -959,28 +928,19 @@ debug_object_active_state(void *addr, const struct debug_obj_descr *descr,if (obj) {switch (obj->state) {case ODEBUG_STATE_ACTIVE : -if (obj->astate == expect) - obj->astate = next; -else - print_object = true; -break ; - +if (obj->astate != expect) +break ; + obj->astate = next; +raw_spin_unlock_irqrestore (&db->lock, flags); +return ;default : - print_object = true;break ; } + o = *obj; }raw_spin_unlock_irqrestore (&db->lock, flags); -if (!obj) { -struct debug_obj o = { .object = addr, - .state =ODEBUG_STATE_NOTAVAILABLE , - .descr = descr }; - -debug_print_object (&o,"active_state" ); - }else if (print_object) { -debug_print_object (obj,"active_state" ); - } +debug_print_object (&o,"active_state" ); }EXPORT_SYMBOL_GPL (debug_object_active_state);
@@ -988,12 +948,10 @@ EXPORT_SYMBOL_GPL(debug_object_active_state);static void __debug_check_no_obj_freed (const void *address,unsigned long size) {unsigned long flags, oaddr, saddr, eaddr, paddr, chunks; -const struct debug_obj_descr *descr; -enum debug_obj_state state; +int cnt, objs_checked =0 ; +struct debug_obj *obj, o;struct debug_bucket *db;struct hlist_node *tmp; -struct debug_obj *obj; -int cnt, objs_checked =0 ; saddr = (unsigned long ) address; eaddr = saddr + size;
@@ -1015,12 +973,10 @@ static void __debug_check_no_obj_freed(const void *address, unsigned long size)switch (obj->state) {case ODEBUG_STATE_ACTIVE : - descr = obj->descr; - state = obj->state; + o = *obj;raw_spin_unlock_irqrestore (&db->lock, flags); -debug_print_object (obj,"free" ); -debug_object_fixup (descr->fixup_free, - (void *) oaddr, state); +debug_print_object (&o,"free" ); +debug_object_fixup (o.descr->fixup_free, (void *)oaddr, o.state); goto repeat;default :hlist_del (&obj->node);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/219 regulator: core: Only increment use_count when enable_count changes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rui Zhang <[email protected]>
[ Upstream commit 7993d3a9c34f609c02171e115fd12c10e2105ff4 ]
The use_count of a regulator should only be incremented when the enable_count changes from 0 to 1. Similarly, the use_count should only be decremented when the enable_count changes from 1 to 0.
In the previous implementation, use_count was sometimes decremented to 0 when some consumer called unbalanced disable, leading to unexpected disable even the regulator is enabled by other consumers. With this change, the use_count accurately reflects the number of users which the regulator is enabled.
This should make things more robust in the case where a consumer does leak references.
--- drivers/regulator/core.c | 56 +++++++++++++++++++++------------------- 1 file changed, 30 insertions(+), 26 deletions(-)
drivers/regulator/core.c +30 -26
@@ -2925,7 +2925,8 @@ static int _regulator_enable(struct regulator *regulator)/* Fallthrough on positive return values - already enabled */ } - rdev->use_count++; +if (regulator->enable_count ==1 ) + rdev->use_count++;return 0 ;
@@ -3000,37 +3001,40 @@ static int _regulator_disable(struct regulator *regulator)lockdep_assert_held_once (&rdev->mutex.base); -if (WARN (rdev->use_count <=0 , +if (WARN (regulator->enable_count ==0 ,"unbalanced disables for %s\n" ,rdev_get_name (rdev)))return -EIO ; -/* are we the last user and permitted to disable ? */ -if (rdev->use_count ==1 && - (rdev->constraints && !rdev->constraints->always_on)) { - -/* we are last user */ -if (regulator_ops_is_valid (rdev,REGULATOR_CHANGE_STATUS )) { - ret =_notifier_call_chain (rdev, -REGULATOR_EVENT_PRE_DISABLE , -NULL ); -if (ret &NOTIFY_STOP_MASK ) -return -EINVAL ; - - ret =_regulator_do_disable (rdev); -if (ret <0 ) { -rdev_err (rdev,"failed to disable: %pe\n" ,ERR_PTR (ret)); -_notifier_call_chain (rdev, -REGULATOR_EVENT_ABORT_DISABLE , +if (regulator->enable_count ==1 ) { +/* disabling last enable_count from this regulator */ +/* are we the last user and permitted to disable ? */ +if (rdev->use_count ==1 && + (rdev->constraints && !rdev->constraints->always_on)) { + +/* we are last user */ +if (regulator_ops_is_valid (rdev,REGULATOR_CHANGE_STATUS )) { + ret =_notifier_call_chain (rdev, +REGULATOR_EVENT_PRE_DISABLE , +NULL ); +if (ret &NOTIFY_STOP_MASK ) +return -EINVAL ; + + ret =_regulator_do_disable (rdev); +if (ret <0 ) { +rdev_err (rdev,"failed to disable: %pe\n" ,ERR_PTR (ret)); +_notifier_call_chain (rdev, +REGULATOR_EVENT_ABORT_DISABLE , +NULL ); +return ret; + } +_notifier_call_chain (rdev,REGULATOR_EVENT_DISABLE ,NULL ); -return ret; } -_notifier_call_chain (rdev,REGULATOR_EVENT_DISABLE , -NULL ); - } - rdev->use_count =0 ; - }else if (rdev->use_count >1 ) { - rdev->use_count--; + rdev->use_count =0 ; + }else if (rdev->use_count >1 ) { + rdev->use_count--; + } }if (ret ==0 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/219 audit: Send netlink ACK before setting connection in auditd_set
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Riches <[email protected]>
[ Upstream commit 022732e3d846e197539712e51ecada90ded0572a ]
When auditd_set sets the auditd_conn pointer, audit messages can immediately be put on the socket by other kernel threads. If the backlog is large or the rate is high, this can immediately fill the socket buffer. If the audit daemon requested an ACK for this operation, a full socket buffer causes the ACK to get dropped, also setting ENOBUFS on the socket.
To avoid this race and ensure ACKs get through, fast-track the ACK in this specific case to ensure it is sent before auditd_conn is set.
--- kernel/audit.c | 31 ++++++++++++++++++++++++------- 1 file changed, 24 insertions(+), 7 deletions(-)
kernel/audit.c +24 -7
@@ -488,15 +488,19 @@ static void auditd_conn_free(struct rcu_head *rcu)* @pid: auditd PID * @portid: auditd netlink portid * @net: auditd network namespace pointer +* @skb: the netlink command from the audit daemon +* @ack: netlink ack flag, cleared if ack'd here * * Description: * This function will obtain and drop network namespace references as * necessary. Returns zero on success, negative values on failure. */ -static int auditd_set (struct pid *pid,u32 portid,struct net *net) +static int auditd_set (struct pid *pid,u32 portid,struct net *net, +struct sk_buff *skb,bool *ack) {unsigned long flags;struct auditd_connection *ac_old, *ac_new; +struct nlmsghdr *nlh;if (!pid || !net)return -EINVAL ;
@@ -508,6 +512,13 @@ static int auditd_set(struct pid *pid, u32 portid, struct net *net) ac_new->portid = portid; ac_new->net =get_net (net); +/* send the ack now to avoid a race with the queue backlog */ +if (*ack) { + nlh =nlmsg_hdr (skb); +netlink_ack (skb, nlh,0 ,NULL ); + *ack = false; + } +spin_lock_irqsave (&auditd_conn_lock, flags); ac_old =rcu_dereference_protected (auditd_conn,lockdep_is_held (&auditd_conn_lock));
@@ -1201,7 +1212,8 @@ static int audit_replace(struct pid *pid)return auditd_send_unicast_skb (skb); } -static int audit_receive_msg (struct sk_buff *skb,struct nlmsghdr *nlh) +static int audit_receive_msg (struct sk_buff *skb,struct nlmsghdr *nlh, +bool *ack) {u32 seq;void *data;
@@ -1294,7 +1306,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)/* register a new auditd connection */ err =auditd_set (req_pid,NETLINK_CB (skb).portid, -sock_net (NETLINK_CB (skb).sk)); +sock_net (NETLINK_CB (skb).sk), + skb, ack);if (audit_enabled !=AUDIT_OFF ) audit_log_config_change("audit_pid", new_pid,
@@ -1539,9 +1552,10 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)* Parse the provided skb and deal with any messages that may be present, * malformed skbs are discarded. */ -static void audit_receive (struct sk_buff *skb) +static void audit_receive (struct sk_buff *skb) {struct nlmsghdr *nlh; +bool ack;/* * len MUST be signed for nlmsg_next to be able to dec it below 0 * if the nlmsg_len was not aligned
@@ -1554,9 +1568,12 @@ static void audit_receive(struct sk_buff *skb)audit_ctl_lock ();while (nlmsg_ok (nlh, len)) { - err =audit_receive_msg (skb, nlh); -/* if err or if this message says it wants a response */ -if (err || (nlh->nlmsg_flags &NLM_F_ACK )) + ack = nlh->nlmsg_flags &NLM_F_ACK ; + err =audit_receive_msg (skb, nlh, &ack); + +/* send an ack if the user asked for one and audit_receive_msg +* didn't already do it, or if there was an error. */ +if (ack || err)netlink_ack (skb, nlh, err,NULL ); nlh =nlmsg_next (nlh, &len);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/219 ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuluo Qiu <[email protected]>
[ Upstream commit 143176a46bdd3bfbe9ba2462bf94458e80d65ebf ]
The Colorful X15 AT 23 ACPI video-bus device report spurious ACPI_VIDEO_NOTIFY_CYCLE events resulting in spurious KEY_SWITCHVIDEOMODE events being reported to userspace (and causing trouble there) when an external screen plugged in.
Add a quirk setting the report_key_events mask to REPORT_BRIGHTNESS_KEY_EVENTS so that the ACPI_VIDEO_NOTIFY_CYCLE events will be ignored, while still reporting brightness up/down hotkey-presses to userspace normally.
--- drivers/acpi/acpi_video.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/acpi/acpi_video.c +9 -0
@@ -513,6 +513,15 @@ static const struct dmi_system_id video_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 3350"), }, }, + { + .callback = video_set_report_key_events, + .driver_data = (void *)((uintptr_t)REPORT_BRIGHTNESS_KEY_EVENTS), + .ident = "COLORFUL X15 AT 23", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "COLORFUL"), + DMI_MATCH(DMI_PRODUCT_NAME, "X15 AT 23"), + }, + },/* * Some machines change the brightness themselves when a brightness * hotkey gets pressed, despite us telling them not to. In this case
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/219 PNP: ACPI: fix fortify warning
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit ba3f5058db437d919f8468db50483dd9028ff688 ]
When compiling with gcc version 14.0.0 20231126 (experimental) and CONFIG_FORTIFY_SOURCE=y, I've noticed the following:
In file included from ./include/linux/string.h:295,
from ./include/linux/bitmap.h:12,
from ./include/linux/cpumask.h:12,
from ./arch/x86/include/asm/paravirt.h:17,
from ./arch/x86/include/asm/cpuid.h:62,
from ./arch/x86/include/asm/processor.h:19,
from ./arch/x86/include/asm/cpufeature.h:5,
from ./arch/x86/include/asm/thread_info.h:53,
from ./include/linux/thread_info.h:60,
from ./arch/x86/include/asm/preempt.h:9,
from ./include/linux/preempt.h:79,
from ./include/linux/spinlock.h:56,
from ./include/linux/mmzone.h:8,
from ./include/linux/gfp.h:7,
from ./include/linux/slab.h:16,
from ./include/linux/resource_ext.h:11,
from ./include/linux/acpi.h:13,
from drivers/pnp/pnpacpi/rsparser.c:11:In function 'fortify_memcpy_chk',
inlined from 'pnpacpi_parse_allocated_vendor' at drivers/pnp/pnpacpi/rsparser.c:158:3, inlined from 'pnpacpi_allocated_resource' at drivers/pnp/pnpacpi/rsparser.c:249:3:./include/linux/fortify-string.h:588:25: warning: call to '__read_overflow2_field' declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning]
588 | __read_overflow2_field(q_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~According to the comments in include/linux/fortify-string.h, 'memcpy()', 'memmove()' and 'memset()' must not be used beyond individual struct members to ensure that the compiler can enforce protection against buffer overflows, and, IIUC, this also applies to partial copies from the particular member ('vendor->byte_data' in this case). So it should be better (and safer) to do both copies at once (and 'byte_data' of 'struct acpi_resource_vendor_typed' seems to be a good candidate for '__counted_by(byte_length)' as well).
--- drivers/pnp/pnpacpi/rsparser.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/pnp/pnpacpi/rsparser.c +6 -6
@@ -151,13 +151,13 @@ static int vendor_resource_matches(struct pnp_dev *dev,static void pnpacpi_parse_allocated_vendor (struct pnp_dev *dev,struct acpi_resource_vendor_typed *vendor) { -if (vendor_resource_matches (dev, vendor, &hp_ccsr_uuid,16 )) { -u64 start, length; +struct {u64 start, length; } range; -memcpy (&start, vendor->byte_data,sizeof (start)); -memcpy (&length, vendor->byte_data +8 ,sizeof (length)); - -pnp_add_mem_resource (dev, start, start + length -1 ,0 ); +if (vendor_resource_matches (dev, vendor, &hp_ccsr_uuid, +sizeof (range))) { +memcpy (&range, vendor->byte_data,sizeof (range)); +pnp_add_mem_resource (dev, range.start, range.start + + range.length -1 ,0 ); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/219 ACPI: extlog: fix NULL pointer dereference check
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prarit Bhargava <[email protected]>
[ Upstream commit 72d9b9747e78979510e9aafdd32eb99c7aa30dd1 ]
The gcc plugin -fanalyzer [1] tries to detect various patterns of incorrect behaviour. The tool reports:
drivers/acpi/acpi_extlog.c: In function ‘extlog_exit’:drivers/acpi/acpi_extlog.c:307:12: warning: check of ‘extlog_l1_addr’ for NULL after already dereferencing it [-Wanalyzer-deref-before-check]
|
| 306 | ((struct extlog_l1_head *)extlog_l1_addr)->flags &= ~FLAG_OS_OPTIN;
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~
| | |
| | (1) pointer ‘extlog_l1_addr’ is dereferenced here
| 307 | if (extlog_l1_addr)
| | ~
| | |
| | (2) pointer ‘extlog_l1_addr’ is checked for NULL here but it was already dereferenced at (1)
|Fix the NULL pointer dereference check in extlog_exit().
--- drivers/acpi/acpi_extlog.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/acpi/acpi_extlog.c +3 -2
@@ -308,9 +308,10 @@ static int __init extlog_init(void) static void __exit extlog_exit(void) {mce_unregister_decode_chain (&extlog_mce_dec); - ((struct extlog_l1_head *)extlog_l1_addr)->flags &= ~FLAG_OS_OPTIN ; -if (extlog_l1_addr) +if (extlog_l1_addr) { + ((struct extlog_l1_head *)extlog_l1_addr)->flags &= ~FLAG_OS_OPTIN ;acpi_os_unmap_iomem (extlog_l1_addr, l1_size); + }if (elog_addr)acpi_os_unmap_iomem (elog_addr, elog_size);release_mem_region (elog_base, elog_size);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/219 ACPI: NUMA: Fix the logic of getting the fake_pxm value
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Wang <[email protected]>
[ Upstream commit e3f577830ce216b0ca21d4750cbbd64cfc21efff ]
The for loop does not iterate over the last element of the node_to_pxm_map array. This could lead to a conflict between the final fake_pxm value and the existing pxm values. That is, the final fake_pxm value can not be guaranteed to be an unused pxm value.
While at it, fix up white space in slit_valid().
--- drivers/acpi/numa/srat.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/acpi/numa/srat.c +2 -2
@@ -183,7 +183,7 @@ static int __init slit_valid(struct acpi_table_slit *slit)int i, j;int d = slit->locality_count;for (i =0 ; i < d; i++) { -for (j =0 ; j < d; j++) { +for (j =0 ; j < d; j++) {u8 val = slit->entry[d*i + j];if (i == j) {if (val !=LOCAL_DISTANCE )
@@ -532,7 +532,7 @@ int __init acpi_numa_init(void)*/ /* fake_pxm is the next unused PXM value after SRAT parsing */ -for (i =0 , fake_pxm =-1 ; i <MAX_NUMNODES -1 ; i++) { +for (i =0 , fake_pxm =-1 ; i <MAX_NUMNODES ; i++) {if (node_to_pxm_map[i] > fake_pxm) fake_pxm = node_to_pxm_map[i]; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/219 PM / devfreq: Synchronize devfreq_monitor_[start/stop]
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukesh Ojha <[email protected]>
[ Upstream commit aed5ed595960c6d301dcd4ed31aeaa7a8054c0c6 ]
There is a chance if a frequent switch of the governor done in a loop result in timer list corruption where timer cancel being done from two place one from cancel_delayed_work_sync() and followed by expire_timers() can be seen from the traces[1].
while true
do
echo "simple_ondemand" > /sys/class/devfreq/1d84000.ufshc/governor echo "performance" > /sys/class/devfreq/1d84000.ufshc/governor
done
It looks to be issue with devfreq driver where device_monitor_[start/stop] need to synchronized so that delayed work should get corrupted while it is either being queued or running or being cancelled.
Let's use polling flag and devfreq lock to synchronize the queueing the timer instance twice and work data being corrupted.
[1]
...
..
<idle>-0 [003] 9436.209662: timer_cancel timer=0xffffff80444f0428 <idle>-0 [003] 9436.209664: timer_expire_entry timer=0xffffff80444f0428 now=0x10022da1c function=__typeid__ZTSFvP10timer_listE_global_addr baseclk=0x10022da1c <idle>-0 [003] 9436.209718: timer_expire_exit timer=0xffffff80444f0428 kworker/u16:6-14217 [003] 9436.209863: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2b now=0x10022da1c flags=182452227 vendor.xxxyyy.ha-1593 [004] 9436.209888: timer_cancel timer=0xffffff80444f0428 vendor.xxxyyy.ha-1593 [004] 9436.216390: timer_init timer=0xffffff80444f0428 vendor.xxxyyy.ha-1593 [004] 9436.216392: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2c now=0x10022da1d flags=186646532 vendor.xxxyyy.ha-1593 [005] 9436.220992: timer_cancel timer=0xffffff80444f0428 xxxyyyTraceManag-7795 [004] 9436.261641: timer_cancel timer=0xffffff80444f0428
[2]
9436.261653][ C4] Unable to handle kernel paging request at virtual address dead00000000012a
[ 9436.261664][ C4] Mem abort info: [ 9436.261666][ C4] ESR = 0x96000044 [ 9436.261669][ C4] EC = 0x25: DABT (current EL), IL = 32 bits [ 9436.261671][ C4] SET = 0, FnV = 0 [ 9436.261673][ C4] EA = 0, S1PTW = 0 [ 9436.261675][ C4] Data abort info: [ 9436.261677][ C4] ISV = 0, ISS = 0x00000044 [ 9436.261680][ C4] CM = 0, WnR = 1 [ 9436.261682][ C4] [dead00000000012a] address between user and kernel address ranges [ 9436.261685][ C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP [ 9436.261701][ C4] Skip md ftrace buffer dump for: 0x3a982d0
...
[ 9436.262138][ C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S W O 5.10.149-android12-9-o-g17f915d29d0c #1 [ 9436.262141][ C4] Hardware name: Qualcomm Technologies, Inc. (DT) [ 9436.262144][ C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--) [ 9436.262161][ C4] pc : expire_timers+0x9c/0x438 [ 9436.262164][ C4] lr : expire_timers+0x2a4/0x438 [ 9436.262168][ C4] sp : ffffffc010023dd0 [ 9436.262171][ C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18 [ 9436.262178][ C4] x27: ffffffd063569dd0 x26: ffffffd063536008 [ 9436.262182][ C4] x25: 0000000000000001 x24: ffffff88f7c69280 [ 9436.262185][ C4] x23: 00000000000000e0 x22: dead000000000122 [ 9436.262188][ C4] x21: 000000010022da29 x20: ffffff8af72b4e80 [ 9436.262191][ C4] x19: ffffffc010023e50 x18: ffffffc010025038 [ 9436.262195][ C4] x17: 0000000000000240 x16: 0000000000000201 [ 9436.262199][ C4] x15: ffffffffffffffff x14: ffffff889f3c3100 [ 9436.262203][ C4] x13: ffffff889f3c3100 x12: 00000000049f56b8 [ 9436.262207][ C4] x11: 00000000049f56b8 x10: 00000000ffffffff [ 9436.262212][ C4] x9 : ffffffc010023e50 x8 : dead000000000122 [ 9436.262216][ C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8 [ 9436.262220][ C4] x5 : 0000000000000000 x4 : 0000000000000101 [ 9436.262223][ C4] x3 : 0000000000000080 x2 : ffffff889edc155c [ 9436.262227][ C4] x1 : ffffff8001005200 x0 : ffffff80444f0428 [ 9436.262232][ C4] Call trace: [ 9436.262236][ C4] expire_timers+0x9c/0x438 [ 9436.262240][ C4] __run_timers+0x1f0/0x330 [ 9436.262245][ C4] run_timer_softirq+0x28/0x58 [ 9436.262255][ C4] efi_header_end+0x168/0x5ec [ 9436.262265][ C4] __irq_exit_rcu+0x108/0x124 [ 9436.262274][ C4] __handle_domain_irq+0x118/0x1e4 [ 9436.262282][ C4] gic_handle_irq.30369+0x6c/0x2bc [ 9436.262286][ C4] el0_irq_naked+0x60/0x6c
--- drivers/devfreq/devfreq.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-)
drivers/devfreq/devfreq.c +22 -2
@@ -461,10 +461,14 @@ static void devfreq_monitor(struct work_struct *work)if (err)dev_err (&devfreq->dev,"dvfs failed with (%d) error\n" , err); +if (devfreq->stop_polling) + goto out; +queue_delayed_work (devfreq_wq, &devfreq->work,msecs_to_jiffies (devfreq->profile->polling_ms)); -mutex_unlock (&devfreq->lock); +out: +mutex_unlock (&devfreq->lock);trace_devfreq_monitor (devfreq); }
@@ -482,6 +486,10 @@ void devfreq_monitor_start(struct devfreq *devfreq)if (IS_SUPPORTED_FLAG (devfreq->governor->flags,IRQ_DRIVEN ))return ; +mutex_lock (&devfreq->lock); +if (delayed_work_pending (&devfreq->work)) + goto out; +switch (devfreq->profile->timer) {case DEVFREQ_TIMER_DEFERRABLE :INIT_DEFERRABLE_WORK (&devfreq->work, devfreq_monitor);
@@ -490,12 +498,16 @@ void devfreq_monitor_start(struct devfreq *devfreq)INIT_DELAYED_WORK (&devfreq->work, devfreq_monitor);break ;default : -return ; + goto out; }if (devfreq->profile->polling_ms)queue_delayed_work (devfreq_wq, &devfreq->work,msecs_to_jiffies (devfreq->profile->polling_ms)); + +out: + devfreq->stop_polling = false; +mutex_unlock (&devfreq->lock); }EXPORT_SYMBOL (devfreq_monitor_start);
@@ -512,6 +524,14 @@ void devfreq_monitor_stop(struct devfreq *devfreq)if (IS_SUPPORTED_FLAG (devfreq->governor->flags,IRQ_DRIVEN ))return ; +mutex_lock (&devfreq->lock); +if (devfreq->stop_polling) { +mutex_unlock (&devfreq->lock); +return ; + } + + devfreq->stop_polling = true; +mutex_unlock (&devfreq->lock);cancel_delayed_work_sync (&devfreq->work); }EXPORT_SYMBOL (devfreq_monitor_stop);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/219 ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous events
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <[email protected]>
[ Upstream commit a70297d2213253853e95f5b49651f924990c6d3b ]
There are two major types of uncorrected recoverable (UCR) errors :
- Synchronous error: The error is detected and raised at the point of the consumption in the execution flow, e.g. when a CPU tries to access a poisoned cache line. The CPU will take a synchronous error exception such as Synchronous External Abort (SEA) on Arm64 and Machine Check Exception (MCE) on X86. OS requires to take action (for example, offline failure page/kill failure thread) to recover this uncorrectable error.
- Asynchronous error: The error is detected out of processor execution context, e.g. when an error is detected by a background scrubber. Some data in the memory are corrupted. But the data have not been consumed. OS is optional to take action to recover this uncorrectable error.
When APEI firmware first is enabled, a platform may describe one error source for the handling of synchronous errors (e.g. MCE or SEA notification ), or for handling asynchronous errors (e.g. SCI or External Interrupt notification). In other words, we can distinguish synchronous errors by APEI notification. For synchronous errors, kernel will kill the current process which accessing the poisoned page by sending SIGBUS with BUS_MCEERR_AR. In addition, for asynchronous errors, kernel will notify the process who owns the poisoned page by sending SIGBUS with BUS_MCEERR_AO in early kill mode. However, the GHES driver always sets mf_flags to 0 so that all synchronous errors are handled as asynchronous errors in memory failure.
To this end, set memory failure flags as MF_ACTION_REQUIRED on synchronous events.
--- drivers/acpi/apei/ghes.c | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-)
drivers/acpi/apei/ghes.c +23 -6
@@ -99,6 +99,20 @@ static inline bool is_hest_type_generic_v2(struct ghes *ghes)return ghes->generic->header.type ==ACPI_HEST_TYPE_GENERIC_ERROR_V2 ; } +/* +* A platform may describe one error source for the handling of synchronous +* errors (e.g. MCE or SEA), or for handling asynchronous errors (e.g. SCI +* or External Interrupt). On x86, the HEST notifications are always +* asynchronous, so only SEA on ARM is delivered as a synchronous +* notification. +*/ +static inline bool is_hest_sync_notify (struct ghes *ghes) +{ +u8 notify_type = ghes->generic->notify.type; + +return notify_type ==ACPI_HEST_NOTIFY_SEA ; +} +/* * This driver isn't really modular, however for the time being, * continuing to use module_param is the easiest way to remain
@@ -461,7 +475,7 @@ static bool ghes_do_memory_failure(u64 physical_addr, int flags) }static bool ghes_handle_memory_failure (struct acpi_hest_generic_data *gdata, -int sev) +int sev,bool sync) {int flags =-1 ;int sec_sev =ghes_severity (gdata->error_severity);
@@ -475,7 +489,7 @@ static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata, (gdata->flags & CPER_SEC_ERROR_THRESHOLD_EXCEEDED)) flags =MF_SOFT_OFFLINE ;if (sev ==GHES_SEV_RECOVERABLE && sec_sev ==GHES_SEV_RECOVERABLE ) - flags =0 ; + flags = sync ?MF_ACTION_REQUIRED :0 ;if (flags !=-1 )return ghes_do_memory_failure (mem_err->physical_addr, flags);
@@ -483,9 +497,11 @@ static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata,return false; } -static bool ghes_handle_arm_hw_error (struct acpi_hest_generic_data *gdata,int sev) +static bool ghes_handle_arm_hw_error (struct acpi_hest_generic_data *gdata, +int sev,bool sync) {struct cper_sec_proc_arm *err =acpi_hest_get_payload (gdata); +int flags = sync ?MF_ACTION_REQUIRED :0 ;bool queued = false;int sec_sev, i;char *p;
@@ -510,7 +526,7 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, int s* and don't filter out 'corrected' error here. */ if (is_cache && has_pa) { - queued =ghes_do_memory_failure (err_info->physical_fault_addr,0 ); + queued =ghes_do_memory_failure (err_info->physical_fault_addr, flags); p += err_info->length;continue ; }
@@ -631,6 +647,7 @@ static bool ghes_do_proc(struct ghes *ghes,const guid_t *fru_id = &guid_null;char *fru_text ="" ;bool queued = false; +bool sync =is_hest_sync_notify (ghes); sev =ghes_severity (estatus->error_severity);apei_estatus_for_each_section (estatus, gdata) {
@@ -648,13 +665,13 @@ static bool ghes_do_proc(struct ghes *ghes,ghes_edac_report_mem_error (sev, mem_err);arch_apei_report_mem_error (sev, mem_err); - queued =ghes_handle_memory_failure (gdata, sev); + queued =ghes_handle_memory_failure (gdata, sev, sync); }else if (guid_equal (sec_type, &CPER_SEC_PCIE )) {ghes_handle_aer (gdata); }else if (guid_equal (sec_type, &CPER_SEC_PROC_ARM )) { - queued =ghes_handle_arm_hw_error (gdata, sev); + queued =ghes_handle_arm_hw_error (gdata, sev, sync); }else {void *err =acpi_hest_get_payload (gdata);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/219 FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Osama Muhammad <[email protected]>
[ Upstream commit 9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68 ]
Syzkaller reported the following issue:
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6 index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]') CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> ================================================================================ Kernel panic - not syncing: UBSAN: panic_on_warn set ... CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 panic+0x30f/0x770 kernel/panic.c:340 check_panic_on_warn+0x82/0xa0 kernel/panic.c:236 ubsan_epilogue lib/ubsan.c:223 [inline] __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..
The issue is caused when the value of lp becomes greater than CTLTREESIZE which is the max size of stree. Adding a simple check solves this issue.
Dave:
As the function returns a void, good error handling would require a more intrusive code reorganization, so I modified Osama's patch at use WARN_ON_ONCE for lack of a cleaner option.
The patch is tested via syzbot.
--- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+)
fs/jfs/jfs_dmap.c +3 -0
@@ -2871,6 +2871,9 @@ static void dbAdjTree(dmtree_t * tp, int leafno, int newval)/* is the current value the same as the old value ? if so, * there is nothing to do. */ +if (WARN_ON_ONCE (lp >=CTLTREESIZE )) +return ; +if (tp->dmt_stree[lp] == newval)return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/219 UBSAN: array-index-out-of-bounds in dtSplitRoot
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Osama Muhammad <[email protected]>
[ Upstream commit 27e56f59bab5ddafbcfe69ad7a4a6ea1279c1b16 ]
Syzkaller reported the following issue:
oop0: detected capacity change from 0 to 32768
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1971:9 index -2 is out of range for type 'struct dtslot [128]' CPU: 0 PID: 3613 Comm: syz-executor270 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_out_of_bounds+0xdb/0x130 lib/ubsan.c:283 dtSplitRoot+0x8d8/0x1900 fs/jfs/jfs_dtree.c:1971 dtSplitUp fs/jfs/jfs_dtree.c:985 [inline] dtInsert+0x1189/0x6b80 fs/jfs/jfs_dtree.c:863 jfs_mkdir+0x757/0xb00 fs/jfs/namei.c:270 vfs_mkdir+0x3b3/0x590 fs/namei.c:4013 do_mkdirat+0x279/0x550 fs/namei.c:4038 __do_sys_mkdirat fs/namei.c:4053 [inline] __se_sys_mkdirat fs/namei.c:4051 [inline] __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4051 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fcdc0113fd9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffeb8bc67d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcdc0113fd9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003 RBP: 00007fcdc00d37a0 R08: 0000000000000000 R09: 00007fcdc00d37a0 R10: 00005555559a72c0 R11: 0000000000000246 R12: 00000000f8008000 R13: 0000000000000000 R14: 00083878000000f8 R15: 0000000000000000 </TASK>
The issue is caused when the value of fsi becomes less than -1. The check to break the loop when fsi value becomes -1 is present but syzbot was able to produce value less than -1 which cause the error. This patch simply add the change for the values less than 0.
The patch is tested via syzbot.
--- fs/jfs/jfs_dtree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/jfs/jfs_dtree.c +1 -1
@@ -1970,7 +1970,7 @@ static int dtSplitRoot(tid_t tid,do { f = &rp->slot[fsi]; fsi = f->next; - }while (fsi !=-1 ); + }while (fsi >=0 ); f->next = n; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/219 jfs: fix slab-out-of-bounds Read in dtSearch
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manas Ghandat <[email protected]>
[ Upstream commit fa5492ee89463a7590a1449358002ff7ef63529f ]
Currently while searching for current page in the sorted entry table of the page there is a out of bound access. Added a bound check to fix the error.
Dave:
Set return code to -EIO
--- fs/jfs/jfs_dtree.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/jfs/jfs_dtree.c +5 -0
@@ -633,6 +633,11 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data,for (base =0 , lim = p->header.nextindex; lim; lim >>=1 ) { index = base + (lim >>1 ); +if (stbl[index] <0 ) { + rc = -EIO ; + goto out; + } +if (p->header.flag &BT_LEAF ) {/* uppercase leaf name to compare */ cmp =
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/219 jfs: fix array-index-out-of-bounds in dbAdjTree
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manas Ghandat <[email protected]>
[ Upstream commit 74ecdda68242b174920fe7c6133a856fb7d8559b ]
Currently there is a bound check missing in the dbAdjTree while accessing the dmt_stree. To add the required check added the bool is_ctl which is required to determine the size as suggest in the following commit.
https://lore.kernel.org/linux-kernel-mentees/[email protected]/
--- fs/jfs/jfs_dmap.c | 60 ++++++++++++++++++++++++----------------------- 1 file changed, 31 insertions(+), 29 deletions(-)
fs/jfs/jfs_dmap.c +31 -29
@@ -63,10 +63,10 @@*/ static void dbAllocBits (struct bmap * bmp,struct dmap * dp,s64 blkno,int nblocks); -static void dbSplit (dmtree_t * tp,int leafno,int splitsz,int newval); -static int dbBackSplit (dmtree_t * tp,int leafno); -static int dbJoin (dmtree_t * tp,int leafno,int newval); -static void dbAdjTree (dmtree_t * tp,int leafno,int newval); +static void dbSplit (dmtree_t *tp,int leafno,int splitsz,int newval,bool is_ctl); +static int dbBackSplit (dmtree_t *tp,int leafno,bool is_ctl); +static int dbJoin (dmtree_t *tp,int leafno,int newval,bool is_ctl); +static void dbAdjTree (dmtree_t *tp,int leafno,int newval,bool is_ctl);static int dbAdjCtl (struct bmap * bmp,s64 blkno,int newval,int alloc,int level);static int dbAllocAny (struct bmap * bmp,s64 nblocks,int l2nb,s64 * results);
@@ -2103,7 +2103,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno,* system. */ if (dp->tree.stree[word] ==NOFREE ) -dbBackSplit ((dmtree_t *) & dp->tree, word); +dbBackSplit ((dmtree_t *)&dp->tree, word, false);dbAllocBits (bmp, dp, blkno, nblocks); }
@@ -2189,7 +2189,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno,* the binary system of the leaves if need be. */ dbSplit (tp, word,BUDMIN , -dbMaxBud ((u8 *) & dp->wmap[word])); +dbMaxBud ((u8 *)&dp->wmap[word]), false); word +=1 ; }else {
@@ -2229,7 +2229,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno,* system of the leaves to reflect the current * allocation (size). */ -dbSplit (tp, word, size,NOFREE ); +dbSplit (tp, word, size,NOFREE , false);/* get the number of dmap words handled */ nw =BUDSIZE (size,BUDMIN );
@@ -2336,7 +2336,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno,/* update the leaf for this dmap word. */ rc =dbJoin (tp, word, -dbMaxBud ((u8 *) & dp->wmap[word])); +dbMaxBud ((u8 *)&dp->wmap[word]), false);if (rc)return rc;
@@ -2369,7 +2369,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno,/* update the leaf. */ - rc =dbJoin (tp, word, size); + rc =dbJoin (tp, word, size, false);if (rc)return rc;
@@ -2521,16 +2521,16 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)* that it is at the front of a binary buddy system. */ if (oldval ==NOFREE ) { - rc =dbBackSplit ((dmtree_t *) dcp, leafno); + rc =dbBackSplit ((dmtree_t *)dcp, leafno, true);if (rc) {release_metapage (mp);return rc; } oldval = dcp->stree[ti]; } -dbSplit ((dmtree_t *) dcp, leafno, dcp->budmin, newval); +dbSplit ((dmtree_t *) dcp, leafno, dcp->budmin, newval, true); }else { - rc =dbJoin ((dmtree_t *) dcp, leafno, newval); + rc =dbJoin ((dmtree_t *) dcp, leafno, newval, true);if (rc) {release_metapage (mp);return rc;
@@ -2561,7 +2561,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)*/ if (alloc) {dbJoin ((dmtree_t *) dcp, leafno, - oldval); + oldval, true); }else {/* the dbJoin() above might have * caused a larger binary buddy system
@@ -2571,9 +2571,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)*/ if (dcp->stree[ti] ==NOFREE )dbBackSplit ((dmtree_t *) - dcp, leafno); + dcp, leafno, true);dbSplit ((dmtree_t *) dcp, leafno, - dcp->budmin, oldval); + dcp->budmin, oldval, true); }/* release the buffer and return the error.
@@ -2621,7 +2621,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)* * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static void dbSplit (dmtree_t * tp,int leafno,int splitsz,int newval) +static void dbSplit (dmtree_t *tp,int leafno,int splitsz,int newval,bool is_ctl) {int budsz;int cursz;
@@ -2643,7 +2643,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval)while (cursz >= splitsz) {/* update the buddy's leaf with its new value. */ -dbAdjTree (tp, leafno ^ budsz, cursz); +dbAdjTree (tp, leafno ^ budsz, cursz, is_ctl);/* on to the next size and buddy. */
@@ -2655,7 +2655,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval)/* adjust the dmap tree to reflect the specified leaf's new * value. */ -dbAdjTree (tp, leafno, newval); +dbAdjTree (tp, leafno, newval, is_ctl); }
@@ -2686,7 +2686,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval)* * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static int dbBackSplit (dmtree_t * tp,int leafno) +static int dbBackSplit (dmtree_t *tp,int leafno,bool is_ctl) {int budsz, bud, w, bsz, size;int cursz;
@@ -2737,7 +2737,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno)* system in two. */ cursz = leaf[bud] -1 ; -dbSplit (tp, bud, cursz, cursz); +dbSplit (tp, bud, cursz, cursz, is_ctl);break ; } }
@@ -2765,7 +2765,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno)* * RETURN VALUES: none */ -static int dbJoin (dmtree_t * tp,int leafno,int newval) +static int dbJoin (dmtree_t *tp,int leafno,int newval,bool is_ctl) {int budsz, buddy;s8 *leaf;
@@ -2820,12 +2820,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval)if (leafno < buddy) {/* leafno is the left buddy. */ -dbAdjTree (tp, buddy,NOFREE ); +dbAdjTree (tp, buddy,NOFREE , is_ctl); }else {/* buddy is the left buddy and becomes * leafno. */ -dbAdjTree (tp, leafno,NOFREE ); +dbAdjTree (tp, leafno,NOFREE , is_ctl); leafno = buddy; }
@@ -2838,7 +2838,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval)/* update the leaf value. */ -dbAdjTree (tp, leafno, newval); +dbAdjTree (tp, leafno, newval, is_ctl);return 0 ; }
@@ -2859,21 +2859,23 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval)* * RETURN VALUES: none */ -static void dbAdjTree (dmtree_t * tp,int leafno,int newval) +static void dbAdjTree (dmtree_t *tp,int leafno,int newval,bool is_ctl) {int lp, pp, k; -int max; +int max, size; + + size = is_ctl ?CTLTREESIZE :TREESIZE ;/* pick up the index of the leaf for this leafno. */ lp = leafno +le32_to_cpu (tp->dmt_leafidx); +if (WARN_ON_ONCE (lp >= size || lp <0 )) +return ; +/* is the current value the same as the old value ? if so, * there is nothing to do. */ -if (WARN_ON_ONCE (lp >=CTLTREESIZE )) -return ; -if (tp->dmt_stree[lp] == newval)return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/219 jfs: fix uaf in jfs_evict_inode
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit e0e1958f4c365e380b17ccb35617345b31ef7bf3 ]
When the execution of diMount(ipimap) fails, the object ipimap that has been released may be accessed in diFreeSpecial(). Asynchronous ipimap release occurs when rcu_core() calls jfs_free_node().
Therefore, when diMount(ipimap) fails, sbi->ipimap should not be initialized as ipimap.
--- fs/jfs/jfs_mount.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/jfs/jfs_mount.c +3 -3
@@ -172,15 +172,15 @@ int jfs_mount(struct super_block *sb) }jfs_info ("jfs_mount: ipimap:0x%p" , ipimap); -/* map further access of per fileset inodes by the fileset inode */ - sbi->ipimap = ipimap; -/* initialize fileset inode allocation map */ if ((rc =diMount (ipimap))) {jfs_err ("jfs_mount: diMount failed w/rc = %d" , rc); goto err_ipimap; } +/* map further access of per fileset inodes by the fileset inode */ + sbi->ipimap = ipimap; +return rc;/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/219 pstore/ram: Fix crash when setting number of cpus to an odd number
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weichen Chen <[email protected]>
[ Upstream commit d49270a04623ce3c0afddbf3e984cb245aa48e9c ]
When the number of cpu cores is adjusted to 7 or other odd numbers, the zone size will become an odd number.
The address of the zone will become:
addr of zone0 = BASE
addr of zone1 = BASE + zone_size
addr of zone2 = BASE + zone_size*2
...
The address of zone1/3/5/7 will be mapped to non-alignment va. Eventually crashes will occur when accessing these va.
So, use ALIGN_DOWN() to make sure the zone size is even to avoid this bug.
--- fs/pstore/ram.c | 1 + 1 file changed, 1 insertion(+)
fs/pstore/ram.c +1 -0
@@ -519,6 +519,7 @@ static int ramoops_init_przs(const char *name, } zone_sz = mem_sz / *cnt; + zone_sz =ALIGN_DOWN (zone_sz,2 );if (!zone_sz) {dev_err (dev,"%s zone size == 0\n" , name); goto fail;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/219 crypto: octeontx2 - Fix cptvf driver cleanup
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bharat Bhushan <[email protected]>
[ Upstream commit c480a421a4faf693c38e60b0fe6e554c9a3fee02 ]
This patch fixes following cleanup issues:
- Missing instruction queue free on cleanup. This will lead to memory leak.
- lfs->lfs_num is set to zero before cleanup, which will lead to improper cleanup.
--- drivers/crypto/marvell/octeontx2/otx2_cptlf.c | 6 ++++-- drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c | 3 +++ 2 files changed, 7 insertions(+), 2 deletions(-)
drivers/crypto/marvell/octeontx2/otx2_cptlf.c +4 -2
@@ -419,8 +419,8 @@ int otx2_cptlf_init(struct otx2_cptlfs_info *lfs, u8 eng_grp_mask, int pri,return 0 ; free_iq: -otx2_cpt_free_instruction_queues (lfs);cptlf_hw_cleanup (lfs); +otx2_cpt_free_instruction_queues (lfs); detach_rsrcs:otx2_cpt_detach_rsrcs_msg (lfs); clear_lfs_num:
@@ -431,11 +431,13 @@ EXPORT_SYMBOL_NS_GPL(otx2_cptlf_init, CRYPTO_DEV_OCTEONTX2_CPT);void otx2_cptlf_shutdown (struct otx2_cptlfs_info *lfs) { - lfs->lfs_num =0 ;/* Cleanup LFs hardware side */ cptlf_hw_cleanup (lfs); +/* Free instruction queues */ +otx2_cpt_free_instruction_queues (lfs);/* Send request to detach LFs */ otx2_cpt_detach_rsrcs_msg (lfs); + lfs->lfs_num =0 ; }EXPORT_SYMBOL_NS_GPL (otx2_cptlf_shutdown,CRYPTO_DEV_OCTEONTX2_CPT );
drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c +3 -0
@@ -249,8 +249,11 @@ static void cptvf_lf_shutdown(struct otx2_cptlfs_info *lfs)otx2_cptlf_unregister_interrupts (lfs);/* Cleanup LFs software side */ lf_sw_cleanup (lfs); +/* Free instruction queues */ +otx2_cpt_free_instruction_queues (lfs);/* Send request to detach LFs */ otx2_cpt_detach_rsrcs_msg (lfs); + lfs->lfs_num =0 ; }static int cptvf_lf_init (struct otx2_cptvf_dev *cptvf)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/219 erofs: fix ztailpacking for subpage compressed blocks
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
[ Upstream commit e5aba911dee5e20fa82efbe13e0af8f38ea459e7 ]
pageofs_in should be the compressed data offset of the page rather than of the block.
--- fs/erofs/zdata.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/erofs/zdata.c +1 -1
@@ -652,7 +652,6 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe)if (ztailpacking) { pcl->obj.index =0 ;/* which indicates ztailpacking */ - pcl->pageofs_in =erofs_blkoff (map->m_pa); pcl->tailpacking_size = map->m_plen; }else { pcl->obj.index = map->m_pa >>PAGE_SHIFT ;
@@ -852,6 +851,7 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe,get_page (fe->map.buf.page);WRITE_ONCE (fe->pcl->compressed_bvecs[0 ].page, fe->map.buf.page); + fe->pcl->pageofs_in = map->m_pa & ~PAGE_MASK ; fe->mode =Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE ; }else {/* bind cache first when cached decompression is preferred */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/219 crypto: stm32/crc32 - fix parsing list of devices
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Bourgoin <[email protected]>
[ Upstream commit 0eaef675b94c746900dcea7f6c41b9a103ed5d53 ]
smatch warnings:drivers/crypto/stm32/stm32-crc32.c:108 stm32_crc_get_next_crc() warn:
can 'crc' even be NULL?
Use list_first_entry_or_null instead of list_first_entry to retrieve the first device registered.
The function list_first_entry always return a non NULL pointer even if the list is empty. Hence checking if the pointer returned is NULL does not tell if the list is empty or not.
--- drivers/crypto/stm32/stm32-crc32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/stm32/stm32-crc32.c +1 -1
@@ -104,7 +104,7 @@ static struct stm32_crc *stm32_crc_get_next_crc(void)struct stm32_crc *crc;spin_lock_bh (&crc_list.lock); - crc = list_first_entry(&crc_list.dev_list, struct stm32_crc, list); + crc = list_first_entry_or_null(&crc_list.dev_list, struct stm32_crc, list);if (crc)list_move_tail (&crc->list, &crc_list.dev_list);spin_unlock_bh (&crc_list.lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/219 afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
[ Upstream commit 4121b4337146b64560d1e46ebec77196d9287802 ]
David Howells says:
(2) afs_lookup_volume_rcu().
There can be a lot of volumes known by a system. A thousand would require a 10-step walk and this is drivable by remote operation, so I think this should probably take a lock on the second pass too.
Make the "seq" counter odd on the 2nd pass, otherwise read_seqbegin_or_lock() never takes the lock.
--- fs/afs/callback.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/afs/callback.c +2 -1
@@ -110,13 +110,14 @@ static struct afs_volume *afs_lookup_volume_rcu(struct afs_cell *cell, {struct afs_volume *volume =NULL ;struct rb_node *p; -int seq =0 ; +int seq =1 ; do { /* Unfortunately, rbtree walking doesn't give reliable results * under just the RCU read lock, so we have to check for * changes. */ + seq++; /* 2 on the 1st/lockless path, otherwise odd */ read_seqbegin_or_lock(&cell->volume_lock, &seq); p = rcu_dereference_raw(cell->volumes.rb_node);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/219 afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
[ Upstream commit 1702e0654ca9a7bcd7c7619c8a5004db58945b71 ]
David Howells says:
(5) afs_find_server().
There could be a lot of servers in the list and each server can have multiple addresses, so I think this would be better with an exclusive second pass.
The server list isn't likely to change all that often, but when it does change, there's a good chance several servers are going to be added/removed one after the other. Further, this is only going to be used for incoming cache management/callback requests from the server, which hopefully aren't going to happen too often - but it is remotely drivable.
(6) afs_find_server_by_uuid().
Similarly to (5), there could be a lot of servers to search through, but they are in a tree not a flat list, so it should be faster to process. Again, it's not likely to change that often and, again, when it does change it's likely to involve multiple changes. This can be driven remotely by an incoming cache management request but is mostly going to be driven by setting up or reconfiguring a volume's server list - something that also isn't likely to happen often.
Make the "seq" counter odd on the 2nd pass, otherwise read_seqbegin_or_lock() never takes the lock.
--- fs/afs/server.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/afs/server.c +4 -3
@@ -27,7 +27,7 @@ struct afs_server *afs_find_server(struct afs_net *net,const struct afs_addr_list *alist;struct afs_server *server =NULL ;unsigned int i; -int seq =0 , diff; +int seq =1 , diff;rcu_read_lock ();
@@ -35,6 +35,7 @@ struct afs_server *afs_find_server(struct afs_net *net,if (server)afs_unuse_server_notime (net, server, afs_server_trace_put_find_rsq); server =NULL ; + seq++;/* 2 on the 1st/lockless path, otherwise odd */ read_seqbegin_or_lock (&net->fs_addr_lock, &seq);if (srx->transport.family ==AF_INET6 ) {
@@ -90,7 +91,7 @@ struct afs_server *afs_find_server_by_uuid(struct afs_net *net, const uuid_t *uu {struct afs_server *server =NULL ;struct rb_node *p; -int diff, seq =0 ; +int diff, seq =1 ;_enter ("%pU" , uuid);
@@ -102,7 +103,7 @@ struct afs_server *afs_find_server_by_uuid(struct afs_net *net, const uuid_t *uuif (server)afs_unuse_server (net, server, afs_server_trace_put_uuid_rsq); server =NULL ; - + seq++;/* 2 on the 1st/lockless path, otherwise odd */ read_seqbegin_or_lock (&net->fs_lock, &seq); p = net->fs_servers.rb_node;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/219 rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
[ Upstream commit bad1a11c0f061aa073bab785389fe04f19ba02e1 ]
rxrpc_find_service_conn_rcu() should make the "seq" counter odd on the second pass, otherwise read_seqbegin_or_lock() never takes the lock.
--- net/rxrpc/conn_service.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/rxrpc/conn_service.c +2 -1
@@ -31,7 +31,7 @@ struct rxrpc_connection *rxrpc_find_service_conn_rcu(struct rxrpc_peer *peer,struct rxrpc_conn_proto k;struct rxrpc_skb_priv *sp =rxrpc_skb (skb);struct rb_node *p; -unsigned int seq =0 ; +unsigned int seq =1 ; k.epoch = sp->hdr.epoch; k.cid = sp->hdr.cid &RXRPC_CIDMASK ;
@@ -41,6 +41,7 @@ struct rxrpc_connection *rxrpc_find_service_conn_rcu(struct rxrpc_peer *peer,* under just the RCU read lock, so we have to check for * changes. */ + seq++;/* 2 on the 1st/lockless path, otherwise odd */ read_seqbegin_or_lock (&peer->service_conn_lock, &seq); p =rcu_dereference_raw (peer->service_conns.rb_node);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/219 jfs: fix array-index-out-of-bounds in diNewExt
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit 49f9637aafa6e63ba686c13cb8549bf5e6920402 ]
[Syz report]
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:2360:2 index -878706688 is out of range for type 'struct iagctl[128]' CPU: 1 PID: 5065 Comm: syz-executor282 Not tainted 6.7.0-rc4-syzkaller-00009-gbee0e7762ad2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 diNewExt+0x3cf3/0x4000 fs/jfs/jfs_imap.c:2360 diAllocExt fs/jfs/jfs_imap.c:1949 [inline] diAllocAG+0xbe8/0x1e50 fs/jfs/jfs_imap.c:1666 diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587 ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56 jfs_mkdir+0x1c5/0xb90 fs/jfs/namei.c:225 vfs_mkdir+0x2f1/0x4b0 fs/namei.c:4106 do_mkdirat+0x264/0x3a0 fs/namei.c:4129 __do_sys_mkdir fs/namei.c:4149 [inline] __se_sys_mkdir fs/namei.c:4147 [inline] __x64_sys_mkdir+0x6e/0x80 fs/namei.c:4147 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7fcb7e6a0b57 Code: ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd83023038 EFLAGS: 00000286 ORIG_RAX: 0000000000000053 RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007fcb7e6a0b57 RDX: 00000000000a1020 RSI: 00000000000001ff RDI: 0000000020000140 RBP: 0000000020000140 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000286 R12: 00007ffd830230d0 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[Analysis]
When the agstart is too large, it can cause agno overflow.
[Fix]
After obtaining agno, if the value is invalid, exit the subsequent process.
Modified the test from agno > MAXAG to agno >= MAXAG based on linux-next report by kernel test robot (Dan Carpenter).
--- fs/jfs/jfs_imap.c | 3 +++ 1 file changed, 3 insertions(+)
fs/jfs/jfs_imap.c +3 -0
@@ -2179,6 +2179,9 @@ static int diNewExt(struct inomap * imap, struct iag * iagp, int extno)/* get the ag and iag numbers for this iag. */ agno =BLKTOAG (le64_to_cpu (iagp->agstart), sbi); +if (agno >=MAXAG || agno <0 ) +return -EIO ; + iagno =le32_to_cpu (iagp->iagnum);/* check if this is the last free extent within the
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/219 arch: consolidate arch_irq_work_raise prototypes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 64bac5ea17d527872121adddfee869c7a0618f8f ]
The prototype was hidden in an #ifdef on x86, which causes a warning:
kernel/irq_work.c:72:13: error: no previous prototype for 'arch_irq_work_raise' [-Werror=missing-prototypes]
Some architectures have a working prototype, while others don't. Fix this by providing it in only one place that is always visible.
--- arch/arm/include/asm/irq_work.h | 2 -- arch/arm64/include/asm/irq_work.h | 2 -- arch/csky/include/asm/irq_work.h | 2 +- arch/powerpc/include/asm/irq_work.h | 1 - arch/riscv/include/asm/irq_work.h | 2 +- arch/s390/include/asm/irq_work.h | 2 -- arch/x86/include/asm/irq_work.h | 1 - include/linux/irq_work.h | 3 +++ 8 files changed, 5 insertions(+), 10 deletions(-)
arch/arm/include/asm/irq_work.h +0 -2
@@ -9,6 +9,4 @@ static inline bool arch_irq_work_has_interrupt(void) return is_smp(); } -extern void arch_irq_work_raise (void ); -#endif /* _ASM_ARM_IRQ_WORK_H */
arch/arm64/include/asm/irq_work.h +0 -2
@@ -2,8 +2,6 @@#ifndef __ASM_IRQ_WORK_H#define __ASM_IRQ_WORK_H -extern void arch_irq_work_raise (void ); -static inline bool arch_irq_work_has_interrupt (void ) {return true;
arch/csky/include/asm/irq_work.h +1 -1
@@ -7,5 +7,5 @@ static inline bool arch_irq_work_has_interrupt(void) {return true; } -extern void arch_irq_work_raise (void ); +#endif /* __ASM_CSKY_IRQ_WORK_H */
arch/powerpc/include/asm/irq_work.h +0 -1
@@ -6,6 +6,5 @@ static inline bool arch_irq_work_has_interrupt(void) {return true; } -extern void arch_irq_work_raise (void );#endif /* _ASM_POWERPC_IRQ_WORK_H */
arch/riscv/include/asm/irq_work.h +1 -1
@@ -6,5 +6,5 @@ static inline bool arch_irq_work_has_interrupt(void) {return IS_ENABLED (CONFIG_SMP ); } -extern void arch_irq_work_raise (void ); +#endif /* _ASM_RISCV_IRQ_WORK_H */
arch/s390/include/asm/irq_work.h +0 -2
@@ -7,6 +7,4 @@ static inline bool arch_irq_work_has_interrupt(void) return true; } -void arch_irq_work_raise (void ); -#endif /* _ASM_S390_IRQ_WORK_H */
arch/x86/include/asm/irq_work.h +0 -1
@@ -9,7 +9,6 @@ static inline bool arch_irq_work_has_interrupt(void) {return boot_cpu_has (X86_FEATURE_APIC ); } -extern void arch_irq_work_raise (void );#else static inline bool arch_irq_work_has_interrupt (void ) {
include/linux/irq_work.h +3 -0
@@ -66,6 +66,9 @@ void irq_work_sync(struct irq_work *work);void irq_work_run (void );bool irq_work_needs_cpu (void );void irq_work_single (void *arg); + +void arch_irq_work_raise (void ); +#else static inline bool irq_work_needs_cpu (void ) {return false; }static inline void irq_work_run (void ) { }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/219 s390/vfio-ap: fix sysfs status attribute for AP queue devices
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Krowiak <[email protected]>
[ Upstream commit a0d8f4eeb7c4ffaee21702bcc91a09b3988c5b7a ]
The 'status' attribute for AP queue devices bound to the vfio_ap device driver displays incorrect status when the mediated device is attached to a guest, but the queue device is not passed through. In the current implementation, the status displayed is 'in_use' which is not correct; it should be 'assigned'. This can happen if one of the queue devices associated with a given adapter is not bound to the vfio_ap device driver. For example:
Queues listed in /sys/bus/ap/drivers/vfio_ap:
14.0005
14.0006
14.000d
16.0006
16.000d
Queues listed in /sys/devices/vfio_ap/matrix/$UUID/matrix 14.0005
14.0006
14.000d
16.0005
16.0006
16.000d
Queues listed in /sys/devices/vfio_ap/matrix/$UUID/guest_matrix 14.0005
14.0006
14.000d
The reason no queues for adapter 0x16 are listed in the guest_matrix is because queue 16.0005 is not bound to the vfio_ap device driver, so no queue associated with the adapter is passed through to the guest; therefore, each queue device for adapter 0x16 should display 'assigned' instead of 'in_use', because those queues are not in use by a guest, but only assigned to the mediated device.
Let's check the AP configuration for the guest to determine whether a queue device is passed through before displaying a status of 'in_use'.
--- drivers/s390/crypto/vfio_ap_ops.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
drivers/s390/crypto/vfio_ap_ops.c +15 -1
@@ -1742,6 +1742,7 @@ static ssize_t status_show(struct device *dev, {ssize_t nchars =0 ;struct vfio_ap_queue *q; +unsigned long apid, apqi;struct ap_matrix_mdev *matrix_mdev;struct ap_device *apdev =to_ap_dev (dev);
@@ -1749,8 +1750,21 @@ static ssize_t status_show(struct device *dev, q =dev_get_drvdata (&apdev->device); matrix_mdev =vfio_ap_mdev_for_queue (q); +/* If the queue is assigned to the matrix mediated device, then +* determine whether it is passed through to a guest; otherwise, +* indicate that it is unassigned. +*/ if (matrix_mdev) { -if (matrix_mdev->kvm) + apid =AP_QID_CARD (q->apqn); + apqi =AP_QID_QUEUE (q->apqn); +/* +* If the queue is passed through to the guest, then indicate +* that it is in use; otherwise, indicate that it is +* merely assigned to a matrix mediated device. +*/ +if (matrix_mdev->kvm && +test_bit_inv (apid, matrix_mdev->shadow_apcb.apm) && +test_bit_inv (apqi, matrix_mdev->shadow_apcb.aqm)) nchars =scnprintf (buf,PAGE_SIZE ,"%s\n" ,AP_QUEUE_IN_USE );else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/219 s390/ptrace: handle setting of fpc register correctly
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit 8b13601d19c541158a6e18b278c00ba69ae37829 ]
If the content of the floating point control (fpc) register of a traced process is modified with the ptrace interface the new value is tested for validity by temporarily loading it into the fpc register.
This may lead to corruption of the fpc register of the tracing process:
if an interrupt happens while the value is temporarily loaded into the fpc register, and within interrupt context floating point or vector registers are used, the current fp/vx registers are saved with save_fpu_regs() assuming they belong to user space and will be loaded into fp/vx registers when returning to user space.
test_fp_ctl() restores the original user space fpc register value, however it will be discarded, when returning to user space.
In result the tracer will incorrectly continue to run with the value that was supposed to be used for the traced process.
Fix this by saving fpu register contents with save_fpu_regs() before using test_fp_ctl().
--- arch/s390/kernel/ptrace.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/s390/kernel/ptrace.c +3 -3
@@ -385,6 +385,7 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data)/* * floating point control reg. is in the thread structure */ +save_fpu_regs ();if ((unsigned int ) data !=0 ||test_fp_ctl (data >> (BITS_PER_LONG -32 )))return -EINVAL ;
@@ -741,6 +742,7 @@ static int __poke_user_compat(struct task_struct *child,/* * floating point control reg. is in the thread structure */ +save_fpu_regs ();if (test_fp_ctl (tmp))return -EINVAL ; child->thread.fpu.fpc = data;
@@ -904,9 +906,7 @@ static int s390_fpregs_set(struct task_struct *target,int rc =0 ;freg_t fprs[__NUM_FPRS]; -if (target == current) -save_fpu_regs (); - +save_fpu_regs ();if (MACHINE_HAS_VX )convert_vx_to_fp (fprs, target->thread.fpu.vxrs);else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/219 KVM: s390: fix setting of fpc register
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit b988b1bb0053c0dcd26187d29ef07566a565cf55 ]
kvm_arch_vcpu_ioctl_set_fpu() allows to set the floating point control (fpc) register of a guest cpu. The new value is tested for validity by temporarily loading it into the fpc register.
This may lead to corruption of the fpc register of the host process:
if an interrupt happens while the value is temporarily loaded into the fpc register, and within interrupt context floating point or vector registers are used, the current fp/vx registers are saved with save_fpu_regs() assuming they belong to user space and will be loaded into fp/vx registers when returning to user space.
test_fp_ctl() restores the original user space / host process fpc register value, however it will be discarded, when returning to user space.
In result the host process will incorrectly continue to run with the value that was supposed to be used for a guest cpu.
Fix this by simply removing the test. There is another test right before the SIE context is entered which will handles invalid values.
This results in a change of behaviour: invalid values will now be accepted instead of that the ioctl fails with -EINVAL. This seems to be acceptable, given that this interface is most likely not used anymore, and this is in addition the same behaviour implemented with the memory mapped interface (replace invalid values with zero) - see sync_regs() in kvm-s390.c.
--- arch/s390/kvm/kvm-s390.c | 5 ----- 1 file changed, 5 deletions(-)
arch/s390/kvm/kvm-s390.c +0 -5
@@ -4138,10 +4138,6 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)vcpu_load (vcpu); -if (test_fp_ctl (fpu->fpc)) { - ret = -EINVAL ; - goto out; - } vcpu->run->s.regs.fpc = fpu->fpc;if (MACHINE_HAS_VX ) convert_fp_to_vx((__vector128 *) vcpu->run->s.regs.vrs,
@@ -4149,7 +4145,6 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)else memcpy (vcpu->run->s.regs.fprs, &fpu->fprs,sizeof (fpu->fprs)); -out:vcpu_put (vcpu);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/219 SUNRPC: Fix a suspicious RCU usage warning
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anna Schumaker <[email protected]>
[ Upstream commit 31b62908693c90d4d07db597e685d9f25a120073 ]
I received the following warning while running cthon against an ontap server running pNFS:
[ 57.202521] =============================
[ 57.202522] WARNING: suspicious RCU usage
[ 57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted
[ 57.202525] -----------------------------
[ 57.202525] net/sunrpc/xprtmultipath.c:349 RCU-list traversed in non-reader section!!
[ 57.202527]
other info that might help us debug this:[ 57.202528]
rcu_scheduler_active = 2, debug_locks = 1
[ 57.202529] no locks held by test5/3567.
[ 57.202530]
stack backtrace:
[ 57.202532] CPU: 0 PID: 3567 Comm: test5 Not tainted 6.7.0-rc3-g2cc14f52aeb7 #41492 5b09971b4965c0aceba19f3eea324a4a806e227e
[ 57.202534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 2/2/2022
[ 57.202536] Call Trace:
[ 57.202537] <TASK>
[ 57.202540] dump_stack_lvl+0x77/0xb0
[ 57.202551] lockdep_rcu_suspicious+0x154/0x1a0
[ 57.202556] rpc_xprt_switch_has_addr+0x17c/0x190 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]
[ 57.202596] rpc_clnt_setup_test_and_add_xprt+0x50/0x180 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]
[ 57.202621] ? rpc_clnt_add_xprt+0x254/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]
[ 57.202646] rpc_clnt_add_xprt+0x27a/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]
[ 57.202671] ? __pfx_rpc_clnt_setup_test_and_add_xprt+0x10/0x10 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]
[ 57.202696] nfs4_pnfs_ds_connect+0x345/0x760 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]
[ 57.202728] ? __pfx_nfs4_test_session_trunk+0x10/0x10 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]
[ 57.202754] nfs4_fl_prepare_ds+0x75/0xc0 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a]
[ 57.202760] filelayout_write_pagelist+0x4a/0x200 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a]
[ 57.202765] pnfs_generic_pg_writepages+0xbe/0x230 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]
[ 57.202788] __nfs_pageio_add_request+0x3fd/0x520 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]
[ 57.202813] nfs_pageio_add_request+0x18b/0x390 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]
[ 57.202831] nfs_do_writepage+0x116/0x1e0 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]
[ 57.202849] nfs_writepages_callback+0x13/0x30 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]
[ 57.202866] write_cache_pages+0x265/0x450
[ 57.202870] ? __pfx_nfs_writepages_callback+0x10/0x10 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]
[ 57.202891] nfs_writepages+0x141/0x230 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]
[ 57.202913] do_writepages+0xd2/0x230
[ 57.202917] ? filemap_fdatawrite_wbc+0x5c/0x80
[ 57.202921] filemap_fdatawrite_wbc+0x67/0x80
[ 57.202924] filemap_write_and_wait_range+0xd9/0x170
[ 57.202930] nfs_wb_all+0x49/0x180 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]
[ 57.202947] nfs4_file_flush+0x72/0xb0 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]
[ 57.202969] __se_sys_close+0x46/0xd0
[ 57.202972] do_syscall_64+0x68/0x100
[ 57.202975] ? do_syscall_64+0x77/0x100
[ 57.202976] ? do_syscall_64+0x77/0x100
[ 57.202979] entry_SYSCALL_64_after_hwframe+0x6e/0x76
[ 57.202982] RIP: 0033:0x7fe2b12e4a94
[ 57.202985] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d d5 18 0e 00 00 74 13 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 44 c3 0f 1f 00 48 83 ec 18 89 7c 24 0c e8 c3
[ 57.202987] RSP: 002b:00007ffe857ddb38 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
[ 57.202989] RAX: ffffffffffffffda RBX: 00007ffe857dfd68 RCX: 00007fe2b12e4a94
[ 57.202991] RDX: 0000000000002000 RSI: 00007ffe857ddc40 RDI: 0000000000000003
[ 57.202992] RBP: 00007ffe857dfc50 R08: 7fffffffffffffff R09: 0000000065650f49
[ 57.202993] R10: 00007fe2b11f8300 R11: 0000000000000202 R12: 0000000000000000
[ 57.202994] R13: 00007ffe857dfd80 R14: 00007fe2b1445000 R15: 0000000000000000
[ 57.202999] </TASK>The problem seems to be that two out of three callers aren't taking the rcu_read_lock() before calling the list_for_each_entry_rcu() function in rpc_xprt_switch_has_addr(). I fix this by having rpc_xprt_switch_has_addr() unconditionaly take the rcu_read_lock(), which is okay to do recursively in the case that the lock has already been taken by a caller.
--- net/sunrpc/xprtmultipath.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
net/sunrpc/xprtmultipath.c +15 -2
@@ -336,8 +336,9 @@ struct rpc_xprt *xprt_iter_current_entry_offline(struct rpc_xprt_iter *xpi) xprt_switch_find_current_entry_offline); } -bool rpc_xprt_switch_has_addr (struct rpc_xprt_switch *xps, -const struct sockaddr *sap) +static +bool __rpc_xprt_switch_has_addr (struct rpc_xprt_switch *xps, +const struct sockaddr *sap) {struct list_head *head;struct rpc_xprt *pos;
@@ -356,6 +357,18 @@ bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps,return false; } +bool rpc_xprt_switch_has_addr (struct rpc_xprt_switch *xps, +const struct sockaddr *sap) +{ +bool res; + +rcu_read_lock (); + res =__rpc_xprt_switch_has_addr (xps, sap); +rcu_read_unlock (); + +return res; +} +static struct rpc_xprt *xprt_switch_find_next_entry (struct list_head *head,const struct rpc_xprt *cur,bool check_active)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/219 ecryptfs: Reject casefold directory inodes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriel Krisman Bertazi <[email protected]>
[ Upstream commit cd72c7ef5fed44272272a105b1da22810c91be69 ]
Even though it seems to be able to resolve some names of case-insensitive directories, the lack of d_hash and d_compare means we end up with a broken state in the d_cache. Considering it was never a goal to support these two together, and we are preparing to use d_revalidate in case-insensitive filesystems, which would make the combination even more broken, reject any attempt to get a casefolded inode from ecryptfs.
--- fs/ecryptfs/inode.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/ecryptfs/inode.c +8 -0
@@ -76,6 +76,14 @@ static struct inode *__ecryptfs_get_inode(struct inode *lower_inode,if (lower_inode->i_sb !=ecryptfs_superblock_to_lower (sb))return ERR_PTR (-EXDEV ); + +/* Reject dealing with casefold directories. */ +if (IS_CASEFOLDED (lower_inode)) { +pr_err_ratelimited ("%s: Can't handle casefolded directory.\n" , + __func__); +return ERR_PTR (-EREMOTE ); + } +if (!igrab (lower_inode))return ERR_PTR (-ESTALE ); inode = iget5_locked(sb, (unsigned long)lower_inode,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/219 ext4: fix inconsistent between segment fstrim and full fstrim
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
[ Upstream commit 68da4c44b994aea797eb9821acb3a4a36015293e ]
Suppose we issue two FITRIM ioctls for ranges [0,15] and [16,31] with mininum length of trimmed range set to 8 blocks. If we have say a range of blocks 10-22 free, this range will not be trimmed because it straddles the boundary of the two FITRIM ranges and neither part is big enough. This is a bit surprising to some users that call FITRIM on smaller ranges of blocks to limit impact on the system. Also XFS trims all free space extents that overlap with the specified range so we are inconsistent among filesystems. Let's change ext4_try_to_trim_range() to consider for trimming the whole free space extent that straddles the end of specified range, not just the part of it within the range.
--- fs/ext4/mballoc.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
fs/ext4/mballoc.c +8 -3
@@ -6444,13 +6444,15 @@ static int ext4_try_to_trim_range(struct super_block *sb, __acquires(ext4_group_lock_ptr(sb, e4b->bd_group)) __releases(ext4_group_lock_ptr(sb, e4b->bd_group)) { -ext4_grpblk_t next, count, free_count; +ext4_grpblk_t next, count, free_count, last, origin_start;bool set_trimmed = false;void *bitmap; + last =ext4_last_grp_cluster (sb, e4b->bd_group); bitmap = e4b->bd_bitmap; -if (start ==0 && max >=ext4_last_grp_cluster (sb, e4b->bd_group)) +if (start ==0 && max >= last) set_trimmed = true; + origin_start = start; start =max (e4b->bd_info->bb_first_free, start); count =0 ; free_count =0 ;
@@ -6459,7 +6461,10 @@ __releases(ext4_group_lock_ptr(sb, e4b->bd_group)) start =mb_find_next_zero_bit (bitmap, max +1 , start);if (start > max)break ; - next =mb_find_next_bit (bitmap, max +1 , start); + + next =mb_find_next_bit (bitmap, last +1 , start); +if (origin_start ==0 && next >= last) + set_trimmed = true;if ((next - start) >= minblocks) {int ret =ext4_trim_extent (sb, start, next - start, e4b);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/219 ext4: unify the type of flexbg_size to unsigned int
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit 658a52344fb139f9531e7543a6e0015b630feb38 ]
The maximum value of flexbg_size is 2^31, but the maximum value of int is (2^31 - 1), so overflow may occur when the type of flexbg_size is declared as int.
For example, when uninit_mask is initialized in ext4_alloc_group_tables(), if flexbg_size == 2^31, the initialized uninit_mask is incorrect, and this may causes set_flexbg_block_bitmap() to trigger a BUG_ON().
Therefore, the flexbg_size type is declared as unsigned int to avoid overflow and memory waste.
--- fs/ext4/resize.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
fs/ext4/resize.c +7 -6
@@ -241,7 +241,7 @@ struct ext4_new_flex_group_data {* * Returns NULL on failure otherwise address of the allocated structure. */ -static struct ext4_new_flex_group_data *alloc_flex_gd (unsigned long flexbg_size) +static struct ext4_new_flex_group_data *alloc_flex_gd (unsigned int flexbg_size) {struct ext4_new_flex_group_data *flex_gd;
@@ -296,7 +296,7 @@ static void free_flex_gd(struct ext4_new_flex_group_data *flex_gd)*/ static int ext4_alloc_group_tables (struct super_block *sb,struct ext4_new_flex_group_data *flex_gd, -int flexbg_size) +unsigned int flexbg_size) {struct ext4_new_group_data *group_data = flex_gd->groups;ext4_fsblk_t start_blk;
@@ -397,12 +397,12 @@ static int ext4_alloc_group_tables(struct super_block *sb, group = group_data[0 ].group;printk (KERN_DEBUG "EXT4-fs: adding a flex group with " -"%d groups, flexbg size is %d:\n" , flex_gd->count, +"%u groups, flexbg size is %u:\n" , flex_gd->count, flexbg_size);for (i =0 ; i < flex_gd->count; i++) { ext4_debug( - "adding %s group %u: %u blocks (%d free, %d mdata blocks)\n", + "adding %s group %u: %u blocks (%u free, %u mdata blocks)\n", ext4_bg_has_super(sb, group + i) ? "normal" : "no-super", group + i, group_data[i].blocks_count,
@@ -1624,7 +1624,7 @@ static int ext4_flex_group_add(struct super_block *sb,static int ext4_setup_next_flex_gd (struct super_block *sb,struct ext4_new_flex_group_data *flex_gd,ext4_fsblk_t n_blocks_count, -unsigned long flexbg_size) +unsigned int flexbg_size) {struct ext4_sb_info *sbi =EXT4_SB (sb);struct ext4_super_block *es = sbi->s_es;
@@ -2010,8 +2010,9 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count)ext4_fsblk_t o_blocks_count;ext4_fsblk_t n_blocks_count_retry =0 ;unsigned long last_update_time =0 ; -int err =0 , flexbg_size =1 << sbi->s_log_groups_per_flex; +int err =0 ;int meta_bg; +unsigned int flexbg_size =ext4_flex_bg_size (sbi);/* See if the device is actually as big as what was requested */ bh =ext4_sb_bread (sb, n_blocks_count -1 ,0 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/219 ext4: remove unnecessary check from alloc_flex_gd()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit b099eb87de105cf07cad731ded6fb40b2675108b ]
In commit 967ac8af4475 ("ext4: fix potential integer overflow in alloc_flex_gd()"), an overflow check is added to alloc_flex_gd() to prevent the allocated memory from being smaller than expected due to the overflow. However, after kmalloc() is replaced with kmalloc_array() in commit 6da2ec56059c ("treewide: kmalloc() -> kmalloc_array()"), the kmalloc_array() function has an overflow check, so the above problem will not occur. Therefore, the extra check is removed.
--- fs/ext4/resize.c | 3 --- 1 file changed, 3 deletions(-)
fs/ext4/resize.c +0 -3
@@ -249,10 +249,7 @@ static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned int flexbg_size)if (flex_gd ==NULL ) goto out3; -if (flexbg_size >=UINT_MAX /sizeof (struct ext4_new_group_data )) - goto out2; flex_gd->count = flexbg_size; - flex_gd->groups =kmalloc_array (flexbg_size,sizeof (struct ext4_new_group_data ),GFP_NOFS );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/219 ext4: avoid online resizing failures due to oversized flex bg
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit 5d1935ac02ca5aee364a449a35e2977ea84509b0 ]
When we online resize an ext4 filesystem with a oversized flexbg_size,
mkfs.ext4 -F -G 67108864 $dev -b 4096 100M
mount $dev $dir
resize2fs $dev 16G
the following WARN_ON is triggered:
==================================================================
WARNING: CPU: 0 PID: 427 at mm/page_alloc.c:4402 __alloc_pages+0x411/0x550 Modules linked in: sg(E) CPU: 0 PID: 427 Comm: resize2fs Tainted: G E 6.6.0-rc5+ #314 RIP: 0010:__alloc_pages+0x411/0x550 Call Trace: <TASK> __kmalloc_large_node+0xa2/0x200 __kmalloc+0x16e/0x290 ext4_resize_fs+0x481/0xd80 __ext4_ioctl+0x1616/0x1d90 ext4_ioctl+0x12/0x20 __x64_sys_ioctl+0xf0/0x150 do_syscall_64+0x3b/0x90 ==================================================================
This is because flexbg_size is too large and the size of the new_group_data array to be allocated exceeds MAX_ORDER. Currently, the minimum value of MAX_ORDER is 8, the minimum value of PAGE_SIZE is 4096, the corresponding maximum number of groups that can be allocated is:
(PAGE_SIZE << MAX_ORDER) / sizeof(struct ext4_new_group_data) ≈ 21845
And the value that is down-aligned to the power of 2 is 16384. Therefore, this value is defined as MAX_RESIZE_BG, and the number of groups added each time does not exceed this value during resizing, and is added multiple times to complete the online resizing. The difference is that the metadata in a flex_bg may be more dispersed.
--- fs/ext4/resize.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-)
fs/ext4/resize.c +17 -8
@@ -231,10 +231,17 @@ struct ext4_new_flex_group_data {in the flex group */ __u16 *bg_flags;/* block group flags of groups in @groups */ +ext4_group_t resize_bg;/* number of allocated +new_group_data */ ext4_group_t count;/* number of groups in @groups */ }; +/* +* Avoiding memory allocation failures due to too many groups added each time. +*/ +#define MAX_RESIZE_BG 16384 +/* * alloc_flex_gd() allocates a ext4_new_flex_group_data with size of * @flexbg_size.
@@ -249,14 +256,18 @@ static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned int flexbg_size)if (flex_gd ==NULL ) goto out3; - flex_gd->count = flexbg_size; - flex_gd->groups =kmalloc_array (flexbg_size, +if (unlikely (flexbg_size >MAX_RESIZE_BG )) + flex_gd->resize_bg =MAX_RESIZE_BG ; +else + flex_gd->resize_bg = flexbg_size; + + flex_gd->groups =kmalloc_array (flex_gd->resize_bg,sizeof (struct ext4_new_group_data ),GFP_NOFS );if (flex_gd->groups ==NULL ) goto out2; - flex_gd->bg_flags =kmalloc_array (flexbg_size,sizeof (__u16), + flex_gd->bg_flags =kmalloc_array (flex_gd->resize_bg,sizeof (__u16),GFP_NOFS );if (flex_gd->bg_flags ==NULL ) goto out1;
@@ -1620,8 +1631,7 @@ static int ext4_flex_group_add(struct super_block *sb,static int ext4_setup_next_flex_gd (struct super_block *sb,struct ext4_new_flex_group_data *flex_gd, -ext4_fsblk_t n_blocks_count, -unsigned int flexbg_size) +ext4_fsblk_t n_blocks_count) {struct ext4_sb_info *sbi =EXT4_SB (sb);struct ext4_super_block *es = sbi->s_es;
@@ -1645,7 +1655,7 @@ static int ext4_setup_next_flex_gd(struct super_block *sb,BUG_ON (last);ext4_get_group_no_and_offset (sb, n_blocks_count -1 , &n_group, &last); - last_group = group | (flexbg_size -1 ); + last_group = group | (flex_gd->resize_bg -1 );if (last_group > n_group) last_group = n_group;
@@ -2150,8 +2160,7 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count)/* Add flex groups. Note that a regular group is a * flex group with 1 group. */ -while (ext4_setup_next_flex_gd (sb, flex_gd, n_blocks_count, - flexbg_size)) { +while (ext4_setup_next_flex_gd (sb, flex_gd, n_blocks_count)) {if (time_is_before_jiffies (last_update_time +HZ *10 )) {if (last_update_time) ext4_msg(sb, KERN_INFO,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/219 wifi: rt2x00: restart beacon queue when hardware reset
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shiji Yang <[email protected]>
[ Upstream commit a11d965a218f0cd95b13fe44d0bcd8a20ce134a8 ]
When a hardware reset is triggered, all registers are reset, so all queues are forced to stop in hardware interface. However, mac80211 will not automatically stop the queue. If we don't manually stop the beacon queue, the queue will be deadlocked and unable to start again. This patch fixes the issue where Apple devices cannot connect to the AP after calling ieee80211_restart_hw().
--- drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 3 +++ drivers/net/wireless/ralink/rt2x00/rt2x00mac.c | 11 +++++++++++ 2 files changed, 14 insertions(+)
drivers/net/wireless/ralink/rt2x00/rt2x00dev.c +3 -0
@@ -101,6 +101,7 @@ void rt2x00lib_disable_radio(struct rt2x00_dev *rt2x00dev)rt2x00link_stop_tuner (rt2x00dev);rt2x00queue_stop_queues (rt2x00dev);rt2x00queue_flush_queues (rt2x00dev, true); +rt2x00queue_stop_queue (rt2x00dev->bcn);/* * Disable radio.
@@ -1286,6 +1287,7 @@ int rt2x00lib_start(struct rt2x00_dev *rt2x00dev) rt2x00dev->intf_ap_count =0 ; rt2x00dev->intf_sta_count =0 ; rt2x00dev->intf_associated =0 ; + rt2x00dev->intf_beaconing =0 ;/* Enable the radio */ retval =rt2x00lib_enable_radio (rt2x00dev);
@@ -1312,6 +1314,7 @@ void rt2x00lib_stop(struct rt2x00_dev *rt2x00dev) rt2x00dev->intf_ap_count =0 ; rt2x00dev->intf_sta_count =0 ; rt2x00dev->intf_associated =0 ; + rt2x00dev->intf_beaconing =0 ; }static inline void rt2x00lib_set_if_combinations (struct rt2x00_dev *rt2x00dev)
drivers/net/wireless/ralink/rt2x00/rt2x00mac.c +11 -0
@@ -598,6 +598,17 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,*/ if (changes &BSS_CHANGED_BEACON_ENABLED ) {mutex_lock (&intf->beacon_skb_mutex); + +/* +* Clear the 'enable_beacon' flag and clear beacon because +* the beacon queue has been stopped after hardware reset. +*/ +if (test_bit (DEVICE_STATE_RESET , &rt2x00dev->flags) && + intf->enable_beacon) { + intf->enable_beacon = false; +rt2x00queue_clear_beacon (rt2x00dev, vif); + } +if (!bss_conf->enable_beacon && intf->enable_beacon) { rt2x00dev->intf_beaconing--; intf->enable_beacon = false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/219 selftests/bpf: satisfy compiler by having explicit return in btf test
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit f4c7e887324f5776eef6e6e47a90e0ac8058a7a8 ]
Some compilers complain about get_pprint_mapv_size() not returning value in some code paths. Fix with explicit return.
--- tools/testing/selftests/bpf/prog_tests/btf.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/bpf/prog_tests/btf.c +1 -0
@@ -5211,6 +5211,7 @@ static size_t get_pprint_mapv_size(enum pprint_mapv_kind_t mapv_kind)#endif assert (0 ); +return 0 ; } static void set_pprint_mapv(enum pprint_mapv_kind_t mapv_kind,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/219 selftests/bpf: Fix pyperf180 compilation failure with clang18
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <[email protected]>
[ Upstream commit 100888fb6d8a185866b1520031ee7e3182b173de ]
With latest clang18 (main branch of llvm-project repo), when building bpf selftests,
[~/work/bpf-next (master)]$ make -C tools/testing/selftests/bpf LLVM=1 -j
The following compilation error happens:
fatal error: error in backend: Branch target out of insn range
...
Stack dump:
0. Program arguments: clang -g -Wall -Werror -D__TARGET_ARCH_x86 -mlittle-endian
-I/home/yhs/work/bpf-next/tools/testing/selftests/bpf/tools/include -I/home/yhs/work/bpf-next/tools/testing/selftests/bpf -I/home/yhs/work/bpf-next/tools/include/uapi -I/home/yhs/work/bpf-next/tools/testing/selftests/usr/include -idirafter /home/yhs/work/llvm-project/llvm/build.18/install/lib/clang/18/include -idirafter /usr/local/include -idirafter /usr/include -Wno-compare-distinct-pointer-types -DENABLE_ATOMICS_TESTS -O2 --target=bpf -c progs/pyperf180.c -mcpu=v3 -o /home/yhs/work/bpf-next/tools/testing/selftests/bpf/pyperf180.bpf.o
1. <eof> parser at end of file
2. Code generation
...
The compilation failure only happens to cpu=v2 and cpu=v3. cpu=v4 is okay since cpu=v4 supports 32-bit branch target offset.
The above failure is due to upstream llvm patch [1] where some inlining behavior are changed in clang18.
To workaround the issue, previously all 180 loop iterations are fully unrolled. The bpf macro __BPF_CPU_VERSION__ (implemented in clang18 recently) is used to avoid unrolling changes if cpu=v4. If __BPF_CPU_VERSION__ is not available and the compiler is clang18, the unrollng amount is unconditionally reduced.
[1] https://github.com/llvm/llvm-project/commit/1a2e77cf9e11dbf56b5720c607313a566eebb16e
--- tools/testing/selftests/bpf/progs/pyperf180.c | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+)
tools/testing/selftests/bpf/progs/pyperf180.c +22 -0
@@ -1,4 +1,26 @@// SPDX-License-Identifier: GPL-2.0 // Copyright (c) 2019 Facebook #define STACK_MAX_LEN 180 + +/* llvm upstream commit at clang18 +* https://github.com/llvm/llvm-project/commit/1a2e77cf9e11dbf56b5720c607313a566eebb16e +* changed inlining behavior and caused compilation failure as some branch +* target distance exceeded 16bit representation which is the maximum for +* cpu v1/v2/v3. Macro __BPF_CPU_VERSION__ is later implemented in clang18 +* to specify which cpu version is used for compilation. So a smaller +* unroll_count can be set if __BPF_CPU_VERSION__ is less than 4, which +* reduced some branch target distances and resolved the compilation failure. +* +* To capture the case where a developer/ci uses clang18 but the corresponding +* repo checkpoint does not have __BPF_CPU_VERSION__, a smaller unroll_count +* will be set as well to prevent potential compilation failures. +*/ +#ifdef __BPF_CPU_VERSION__ +#if __BPF_CPU_VERSION__ <4 +#define UNROLL_COUNT 90 +#endif +#elif __clang_major__ ==18 +#define UNROLL_COUNT 90 +#endif +#include "pyperf.h"
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/219 wifi: rt2x00: correct wrong BBP register in RxDCOC calibration
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shiji Yang <[email protected]>
[ Upstream commit 50da74e1e8b682853d1e07fc8bbe3a0774ae5e09 ]
Refer to Mediatek vendor driver RxDCOC_Calibration() function, when performing gainfreeze calibration, we should write register 140 instead of 141. This fix can reduce the total calibration time from 6 seconds to 1 second.
--- drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ralink/rt2x00/rt2800lib.c +1 -1
@@ -8672,7 +8672,7 @@ static void rt2800_rxdcoc_calibration(struct rt2x00_dev *rt2x00dev)rt2800_rfcsr_write_bank (rt2x00dev,5 ,4 , saverfb5r4);rt2800_rfcsr_write_bank (rt2x00dev,7 ,4 , saverfb7r4); -rt2800_bbp_write (rt2x00dev,158 ,141 ); +rt2800_bbp_write (rt2x00dev,158 ,140 ); bbpreg =rt2800_bbp_read (rt2x00dev,159 ); bbpreg = bbpreg & (~0x40 );rt2800_bbp_write (rt2x00dev,159 , bbpreg);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/219 selftests/bpf: Fix issues in setup_classid_environment()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yafang Shao <[email protected]>
[ Upstream commit 4849775587844e44d215289c425bcd70f315efe7 ]
If the net_cls subsystem is already mounted, attempting to mount it again in setup_classid_environment() will result in a failure with the error code EBUSY. Despite this, tmpfs will have been successfully mounted at /sys/fs/cgroup/net_cls. Consequently, the /sys/fs/cgroup/net_cls directory will be empty, causing subsequent setup operations to fail.
Here's an error log excerpt illustrating the issue when net_cls has already been mounted at /sys/fs/cgroup/net_cls prior to running setup_classid_environment():
- Before that change
$ tools/testing/selftests/bpf/test_progs --name=cgroup_v1v2 test_cgroup_v1v2:PASS:server_fd 0 nsec test_cgroup_v1v2:PASS:client_fd 0 nsec test_cgroup_v1v2:PASS:cgroup_fd 0 nsec test_cgroup_v1v2:PASS:server_fd 0 nsec run_test:PASS:skel_open 0 nsec run_test:PASS:prog_attach 0 nsec test_cgroup_v1v2:PASS:cgroup-v2-only 0 nsec (cgroup_helpers.c:248: errno: No such file or directory) Opening Cgroup Procs: /sys/fs/cgroup/net_cls/cgroup.procs (cgroup_helpers.c:540: errno: No such file or directory) Opening cgroup classid: /sys/fs/cgroup/net_cls/cgroup-test-work-dir/net_cls.classid run_test:PASS:skel_open 0 nsec run_test:PASS:prog_attach 0 nsec (cgroup_helpers.c:248: errno: No such file or directory) Opening Cgroup Procs: /sys/fs/cgroup/net_cls/cgroup-test-work-dir/cgroup.procs run_test:FAIL:join_classid unexpected error: 1 (errno 2) test_cgroup_v1v2:FAIL:cgroup-v1v2 unexpected error: -1 (errno 2) (cgroup_helpers.c:248: errno: No such file or directory) Opening Cgroup Procs: /sys/fs/cgroup/net_cls/cgroup.procs #44 cgroup_v1v2:FAIL Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED
- After that change
$ tools/testing/selftests/bpf/test_progs --name=cgroup_v1v2 #44 cgroup_v1v2:OK Summary: 1/0 PASSED, 0 SKIPPED, 0 FAILED
--- tools/testing/selftests/bpf/cgroup_helpers.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
tools/testing/selftests/bpf/cgroup_helpers.c +14 -4
@@ -467,10 +467,20 @@ int setup_classid_environment(void)return 1 ; } -if (mount ("net_cls" ,NETCLS_MOUNT_PATH ,"cgroup" ,0 ,"net_cls" ) && - errno !=EBUSY ) { -log_err ("mount cgroup net_cls" ); -return 1 ; +if (mount ("net_cls" ,NETCLS_MOUNT_PATH ,"cgroup" ,0 ,"net_cls" )) { +if (errno !=EBUSY ) { +log_err ("mount cgroup net_cls" ); +return 1 ; + } + +if (rmdir (NETCLS_MOUNT_PATH )) { +log_err ("rmdir cgroup net_cls" ); +return 1 ; + } +if (umount (CGROUP_MOUNT_DFLT )) { +log_err ("umount cgroup base" ); +return 1 ; + } }cleanup_classid_environment ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/219 soc: xilinx: Fix for call trace due to the usage of smp_processor_id()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: HariBabu Gattem <[email protected]>
[ Upstream commit daed80ed07580e5adc0e6d8bc79933a35154135a ]
When preemption is enabled in kernel and if any task which can be preempted should not use smp_processor_id() directly, since CPU switch can happen at any time, the previous value of cpu_id differs with current cpu_id. As a result we see the below call trace during xlnx_event_manager_probe.
[ 6.140197] dump_backtrace+0x0/0x190 [ 6.143884] show_stack+0x18/0x40 [ 6.147220] dump_stack_lvl+0x7c/0xa0 [ 6.150907] dump_stack+0x18/0x34 [ 6.154241] check_preemption_disabled+0x124/0x134 [ 6.159068] debug_smp_processor_id+0x20/0x2c [ 6.163453] xlnx_event_manager_probe+0x48/0x250
To protect cpu_id, It is recommended to use get_cpu()/put_cpu() to disable preemption, get the cpu_id and enable preemption respectively. (For Reference, Documentation/locking/preempt-locking.rst and Documentation/kernel-hacking/hacking.rst)
Use preempt_disable()/smp_processor_id()/preempt_enable() API's to achieve the same.
--- drivers/soc/xilinx/xlnx_event_manager.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/soc/xilinx/xlnx_event_manager.c +4 -1
@@ -555,7 +555,7 @@ static void xlnx_disable_percpu_irq(void *data)static int xlnx_event_init_sgi (struct platform_device *pdev) {int ret =0 ; -int cpu =smp_processor_id (); +int cpu;/* * IRQ related structures are used for the following: * for each SGI interrupt ensure its mapped by GIC IRQ domain
@@ -592,9 +592,12 @@ static int xlnx_event_init_sgi(struct platform_device *pdev) sgi_fwspec.param[0 ] = sgi_num; virq_sgi =irq_create_fwspec_mapping (&sgi_fwspec); + cpu =get_cpu ();per_cpu (cpu_number1, cpu) = cpu; ret =request_percpu_irq (virq_sgi, xlnx_event_handler,"xlnx_event_mgmt" , &cpu_number1); +put_cpu (); +WARN_ON (ret);if (ret) {irq_dispose_mapping (virq_sgi);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/219 soc: xilinx: fix unhandled SGI warning message
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tanmay Shah <[email protected]>
[ Upstream commit 9c6724abf969251af53cdae525ad8100ec78d3c2 ]
Xen broadcasts SGI to each VM when multiple VMs run on Xen hypervisor. In such case spurious SGI is expected if one event is registered by one VM and not registered by another VM. We let users know that Unhandled SGI is not error and expected if kernel is running on Xen hypervisor.
--- drivers/soc/xilinx/xlnx_event_manager.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/xilinx/xlnx_event_manager.c +1 -1
@@ -477,7 +477,7 @@ static void xlnx_call_notify_cb_handler(const u32 *payload) } }if (!is_callback_found) -pr_warn ("Didn't find any registered callback for 0x%x 0x%x\n" , +pr_warn ("Unhandled SGI node 0x%x event 0x%x. Expected with Xen hypervisor\n" , payload[1 ], payload[2 ]); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/219 scsi: lpfc: Fix possible file string name overflow when updating firmware
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit f5779b529240b715f0e358489ad0ed933bf77c97 ]
Because file_name and phba->ModelName are both declared a size 80 bytes, the extra ".grp" file extension could cause an overflow into file_name.
Define a ELX_FW_NAME_SIZE macro with value 84. 84 incorporates the 4 extra characters from ".grp". file_name is changed to be declared as a char and initialized to zeros i.e. null chars.
--- drivers/scsi/lpfc/lpfc.h | 1 + drivers/scsi/lpfc/lpfc_init.c | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-)
drivers/scsi/lpfc/lpfc.h +1 -0
@@ -33,6 +33,7 @@struct lpfc_sli2_slim ;#define ELX_MODEL_NAME_SIZE 80 +#define ELX_FW_NAME_SIZE 84#define LPFC_PCI_DEV_LP 0x1#define LPFC_PCI_DEV_OC 0x2
drivers/scsi/lpfc/lpfc_init.c +2 -2
@@ -14778,7 +14778,7 @@ lpfc_write_firmware(const struct firmware *fw, void *context)int lpfc_sli4_request_firmware_update (struct lpfc_hba *phba,uint8_t fw_upgrade) { -uint8_t file_name[ELX_MODEL_NAME_SIZE ]; +char file_name[ELX_FW_NAME_SIZE ] = {0 };int ret;const struct firmware *fw;
@@ -14787,7 +14787,7 @@ lpfc_sli4_request_firmware_update(struct lpfc_hba *phba, uint8_t fw_upgrade) LPFC_SLI_INTF_IF_TYPE_2)return -EPERM ; -snprintf (file_name,ELX_MODEL_NAME_SIZE ,"%s.grp" , phba->ModelName); +scnprintf (file_name,sizeof (file_name),"%s.grp" , phba->ModelName);if (fw_upgrade ==INT_FW_UPGRADE ) { ret = request_firmware_nowait(THIS_MODULE, FW_ACTION_UEVENT,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/219 PCI: Add no PM reset quirk for NVIDIA Spectrum devices
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 3ed48c80b28d8dcd584d6ddaf00c75b7673e1a05 ]
Spectrum-{1,2,3,4} devices report that a D3hot->D0 transition causes a reset (i.e., they advertise NoSoftRst-). However, this transition does not have any effect on the device: It continues to be operational and network ports remain up. Advertising this support makes it seem as if a PM reset is viable for these devices. Mark it as unavailable to skip it when testing reset methods.
Before:
# cat /sys/bus/pci/devices/0000\:03\:00.0/reset_method pm bus
After:
# cat /sys/bus/pci/devices/0000\:03\:00.0/reset_method bus
--- drivers/pci/quirks.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/pci/quirks.c +13 -0
@@ -3691,6 +3691,19 @@ static void quirk_no_pm_reset(struct pci_dev *dev)DECLARE_PCI_FIXUP_CLASS_HEADER (PCI_VENDOR_ID_ATI ,PCI_ANY_ID ,PCI_CLASS_DISPLAY_VGA ,8 , quirk_no_pm_reset); +/* +* Spectrum-{1,2,3,4} devices report that a D3hot->D0 transition causes a reset +* (i.e., they advertise NoSoftRst-). However, this transition does not have +* any effect on the device: It continues to be operational and network ports +* remain up. Advertising this support makes it seem as if a PM reset is viable +* for these devices. Mark it as unavailable to skip it when testing reset +* methods. +*/ +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_MELLANOX ,0xcb84 , quirk_no_pm_reset); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_MELLANOX ,0xcf6c , quirk_no_pm_reset); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_MELLANOX ,0xcf70 , quirk_no_pm_reset); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_MELLANOX ,0xcf80 , quirk_no_pm_reset); +/* * Thunderbolt controllers with broken MSI hotplug signaling: * Entire 1st generation (Light Ridge, Eagle Ridge, Light Peak) and part
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/219 bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhengchao Shao <[email protected]>
[ Upstream commit d6b83f1e3707c4d60acfa58afd3515e17e5d5384 ]
If failed to allocate "tags" or could not find the final upper device from start_dev's upper list in bond_verify_device_path(), only the loopback detection of the current upper device should be affected, and the system is no need to be panic.
So return -ENOMEM in alb_upper_dev_walk to stop walking, print some warn information when failed to allocate memory for vlan tags in bond_verify_device_path.
I also think that the following function callsnetdev_walk_all_upper_dev_rcu
---->>>alb_upper_dev_walk
---------->>>bond_verify_device_path
Quoted 1 line
From this way, "end device" can eventually be obtained from "start device"
in bond_verify_device_path, IS_ERR(tags) could be instead of IS_ERR_OR_NULL(tags) in alb_upper_dev_walk.
--- drivers/net/bonding/bond_alb.c | 3 ++- drivers/net/bonding/bond_main.c | 5 ++++- 2 files changed, 6 insertions(+), 2 deletions(-)
drivers/net/bonding/bond_alb.c +2 -1
@@ -985,7 +985,8 @@ static int alb_upper_dev_walk(struct net_device *upper,if (netif_is_macvlan (upper) && !strict_match) { tags =bond_verify_device_path (bond->dev, upper,0 );if (IS_ERR_OR_NULL (tags)) -BUG (); +return -ENOMEM ; +alb_send_lp_vid (slave, upper->dev_addr, tags[0 ].vlan_proto, tags[0 ].vlan_id);kfree (tags);
drivers/net/bonding/bond_main.c +4 -1
@@ -2943,8 +2943,11 @@ struct bond_vlan_tag *bond_verify_device_path(struct net_device *start_dev,if (start_dev == end_dev) { tags =kcalloc (level +1 ,sizeof (*tags),GFP_ATOMIC ); -if (!tags) +if (!tags) { +net_err_ratelimited ("%s: %s: Failed to allocate tags\n" , + __func__, start_dev->name);return ERR_PTR (-ENOMEM ); + } tags[level].vlan_proto =VLAN_N_VID ;return tags; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/219 net: usb: ax88179_178a: avoid two consecutive device resets
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jose Ignacio Tornos Martinez <[email protected]>
[ Upstream commit d2689b6a86b9d23574bd4b654bf770b6034e2c7e ]
The device is always reset two consecutive times (ax88179_reset is called twice), one from usbnet_probe during the device binding and the other from usbnet_open.
Remove the non-necessary reset during the device binding and let the reset operation from open to keep the normal behavior (tested with generic ASIX Electronics Corp. AX88179 Gigabit Ethernet device).
--- drivers/net/usb/ax88179_178a.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/usb/ax88179_178a.c +0 -2
@@ -1315,8 +1315,6 @@ static int ax88179_bind(struct usbnet *dev, struct usb_interface *intf)netif_set_tso_max_size (dev->net,16384 ); -ax88179_reset (dev); -return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/219 scsi: mpi3mr: Add PCI checks where SAS5116 diverges from SAS4116
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumit Saxena <[email protected]>
[ Upstream commit c9260ff28ee561fca5f96425c9328a9698e8427b ]
Add PCI IDs checks for the cases where SAS5116 diverges from SAS4116 in behavior.
--- drivers/scsi/mpi3mr/mpi3mr_fw.c | 3 ++- drivers/scsi/mpi3mr/mpi3mr_os.c | 5 ++++- 2 files changed, 6 insertions(+), 2 deletions(-)
drivers/scsi/mpi3mr/mpi3mr_fw.c +2 -1
@@ -1886,7 +1886,8 @@ static int mpi3mr_create_op_reply_q(struct mpi3mr_ioc *mrioc, u16 qidx) reply_qid = qidx +1 ; op_reply_q->num_replies =MPI3MR_OP_REP_Q_QD ; -if (!mrioc->pdev->revision) +if ((mrioc->pdev->device ==MPI3_MFGPAGE_DEVID_SAS4116 ) && + !mrioc->pdev->revision) op_reply_q->num_replies =MPI3MR_OP_REP_Q_QD4K ; op_reply_q->ci =0 ; op_reply_q->ephase =1 ;
drivers/scsi/mpi3mr/mpi3mr_os.c +4 -1
@@ -4963,7 +4963,10 @@ mpi3mr_probe(struct pci_dev *pdev, const struct pci_device_id *id)mpi3mr_init_drv_cmd (&mrioc->evtack_cmds[i],MPI3MR_HOSTTAG_EVTACKCMD_MIN + i); -if (pdev->revision) +if ((pdev->device ==MPI3_MFGPAGE_DEVID_SAS4116 ) && + !pdev->revision) + mrioc->enable_segqueue = false; +else mrioc->enable_segqueue = true;init_waitqueue_head (&mrioc->reset_waitq);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/219 scsi: arcmsr: Support new PCI device IDs 1883 and 1886
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ching Huang <[email protected]>
[ Upstream commit 41c8a1a1e90fa4721f856bf3cf71211fd16d6434 ]
Add support for Areca RAID controllers with PCI device IDs 1883 and 1886.
--- drivers/scsi/arcmsr/arcmsr.h | 4 ++++ drivers/scsi/arcmsr/arcmsr_hba.c | 6 ++++++ 2 files changed, 10 insertions(+)
drivers/scsi/arcmsr/arcmsr.h +4 -0
@@ -77,9 +77,13 @@ struct device_attribute;#ifndef PCI_DEVICE_ID_ARECA_1203 #define PCI_DEVICE_ID_ARECA_1203 0x1203#endif +#ifndef PCI_DEVICE_ID_ARECA_1883 +#define PCI_DEVICE_ID_ARECA_1883 0x1883 +#endif #ifndef PCI_DEVICE_ID_ARECA_1884 #define PCI_DEVICE_ID_ARECA_1884 0x1884#endif +#define PCI_DEVICE_ID_ARECA_1886_0 0x1886#define PCI_DEVICE_ID_ARECA_1886 0x188A#define ARCMSR_HOURS (1000 * 60 * 60 * 4)#define ARCMSR_MINUTES (1000 * 60 * 60)
drivers/scsi/arcmsr/arcmsr_hba.c +6 -0
@@ -214,8 +214,12 @@ static struct pci_device_id arcmsr_device_id_table[] = { .driver_data = ACB_ADAPTER_TYPE_A}, {PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1880), .driver_data = ACB_ADAPTER_TYPE_C}, + {PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1883), + .driver_data = ACB_ADAPTER_TYPE_C}, {PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1884), .driver_data = ACB_ADAPTER_TYPE_E}, + {PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1886_0), + .driver_data = ACB_ADAPTER_TYPE_F}, {PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1886), .driver_data = ACB_ADAPTER_TYPE_F}, {0, 0}, /* Terminating entry */
@@ -4708,9 +4712,11 @@ static const char *arcmsr_info(struct Scsi_Host *host)case PCI_DEVICE_ID_ARECA_1680 :case PCI_DEVICE_ID_ARECA_1681 :case PCI_DEVICE_ID_ARECA_1880 : +case PCI_DEVICE_ID_ARECA_1883 :case PCI_DEVICE_ID_ARECA_1884 : type ="SAS/SATA" ;break ; +case PCI_DEVICE_ID_ARECA_1886_0 :case PCI_DEVICE_ID_ARECA_1886 : type ="NVMe/SAS/SATA" ;break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/219 ARM: dts: imx7d: Fix coresight funnel ports
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 0d4ac04fa7c3f6dc263dba6f575a2ec7a2d4eca8 ]
imx7d uses two ports for 'in-ports', so the syntax port@<num> has to be used. imx7d has both port and port@1 nodes present, raising these error:
funnel@30041000: in-ports: More than one condition true in oneOf schema funnel@30041000: Unevaluated properties are not allowed ('in-ports' was unexpected)
Fix this by also using port@0 for imx7s as well.
--- arch/arm/boot/dts/imx7d.dtsi | 3 --- arch/arm/boot/dts/imx7s.dtsi | 6 +++++- 2 files changed, 5 insertions(+), 4 deletions(-)
arch/arm/boot/dts/imx7d.dtsi +0 -3
@@ -208,9 +208,6 @@ }; &ca_funnel_in_ports { - #address-cells = <1>; - #size-cells = <0>; - port@1 { reg = <1>; ca_funnel_in_port1: endpoint {
arch/arm/boot/dts/imx7s.dtsi +5 -1
@@ -190,7 +190,11 @@ clock-names = "apb_pclk"; ca_funnel_in_ports: in-ports { - port { + #address-cells = <1>; + #size-cells = <0>; + + port@0 { + reg = <0>; ca_funnel_in_port0: endpoint { remote-endpoint = <&etm0_out_port>; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/219 ARM: dts: imx7s: Fix lcdif compatible
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 5f55da4cc37051cda600ea870ce8cf29f1297715 ]
imx7d-lcdif is compatible to imx6sx-lcdif. MXSFB_V6 supports overlay by using LCDC_AS_CTRL register. This registers used by overlay plane:
* LCDC_AS_CTRL
* LCDC_AS_BUF
* LCDC_AS_NEXT_BUF
are listed in i.MX7D RM as well.
--- arch/arm/boot/dts/imx7s.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/imx7s.dtsi +1 -1
@@ -818,7 +818,7 @@ }; lcdif: lcdif@30730000 { - compatible = "fsl,imx7d-lcdif", "fsl,imx28-lcdif"; + compatible = "fsl,imx7d-lcdif", "fsl,imx6sx-lcdif"; reg = <0x30730000 0x10000>; interrupts = <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clks IMX7D_LCDIF_PIXEL_ROOT_CLK>,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/219 ARM: dts: imx7s: Fix nand-controller #size-cells
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 4aadb841ed49bada1415c48c44d21f5b69e01299 ]
nand-controller.yaml bindings says #size-cells shall be set to 0. Fixes the dtbs_check warning:arch/arm/boot/dts/nxp/imx/imx7s-mba7.dtb: nand-controller@33002000:
#size-cells:0:0: 0 was expected
from schema $id: http://devicetree.org/schemas/mtd/gpmi-nand.yaml#
--- arch/arm/boot/dts/imx7s.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/imx7s.dtsi +1 -1
@@ -1283,7 +1283,7 @@ gpmi: nand-controller@33002000{ compatible = "fsl,imx7d-gpmi-nand"; #address-cells = <1>; - #size-cells = <1>; + #size-cells = <0>; reg = <0x33002000 0x2000>, <0x33004000 0x4000>; reg-names = "gpmi-nand", "bch"; interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/219 wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minsuk Kang <[email protected]>
[ Upstream commit 2adc886244dff60f948497b59affb6c6ebb3c348 ]
Fix an array-index-out-of-bounds read in ath9k_htc_txstatus(). The bug occurs when txs->cnt, data from a URB provided by a USB device, is bigger than the size of the array txs->txstatus, which is HTC_MAX_TX_STATUS. WARN_ON() already checks it, but there is no bug handling code after the check. Make the function return if that is the case.
Found by a modified version of syzkaller.
UBSAN: array-index-out-of-bounds in htc_drv_txrx.c index 13 is out of range for type '__wmi_event_txstatus [12]' Call Trace: ath9k_htc_txstatus ath9k_wmi_event_tasklet tasklet_action_common __do_softirq irq_exit_rxu sysvec_apic_timer_interrupt
--- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +3 -2
@@ -652,9 +652,10 @@ void ath9k_htc_txstatus(struct ath9k_htc_priv *priv, void *wmi_event)struct ath9k_htc_tx_event *tx_pend;int i; -for (i =0 ; i < txs->cnt; i++) { -WARN_ON (txs->cnt >HTC_MAX_TX_STATUS ); +if (WARN_ON_ONCE (txs->cnt >HTC_MAX_TX_STATUS )) +return ; +for (i =0 ; i < txs->cnt; i++) { __txs = &txs->txstatus[i]; skb =ath9k_htc_tx_get_packet (priv, __txs);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/219 wifi: ath11k: fix race due to setting ATH11K_FLAG_EXT_IRQ_ENABLED too early
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit 5082b3e3027eae393a4e86874bffb4ce3f83c26e ]
We are seeing below error randomly in the case where only one MSI vector is configured:
kernel: ath11k_pci 0000:03:00.0: wmi command 16387 timeout
The reason is, currently, in ath11k_pcic_ext_irq_enable(), ATH11K_FLAG_EXT_IRQ_ENABLED is set before NAPI is enabled. This results in a race condition: after ATH11K_FLAG_EXT_IRQ_ENABLED is set but before NAPI enabled, CE interrupt breaks in. Since IRQ is shared by CE and data path, ath11k_pcic_ext_interrupt_handler() is also called where we call disable_irq_nosync() to disable IRQ. Then napi_schedule() is called but it does nothing because NAPI is not enabled at that time, meaning ath11k_pcic_ext_grp_napi_poll() will never run, so we have no chance to call enable_irq() to enable IRQ back. Finally we get above error.
Fix it by setting ATH11K_FLAG_EXT_IRQ_ENABLED after all NAPI and IRQ work are done. With the fix, we are sure that by the time ATH11K_FLAG_EXT_IRQ_ENABLED is set, NAPI is enabled.
Note that the fix above also introduce some side effects:
if ath11k_pcic_ext_interrupt_handler() breaks in after NAPI enabled but before ATH11K_FLAG_EXT_IRQ_ENABLED set, nothing will be done by the handler this time, the work will be postponed till the next time the IRQ fires.
Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23
--- drivers/net/wireless/ath/ath11k/pcic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath11k/pcic.c +2 -2
@@ -453,8 +453,6 @@ void ath11k_pcic_ext_irq_enable(struct ath11k_base *ab) {int i; -set_bit (ATH11K_FLAG_EXT_IRQ_ENABLED , &ab->dev_flags); -for (i =0 ; i <ATH11K_EXT_IRQ_GRP_NUM_MAX ; i++) {struct ath11k_ext_irq_grp *irq_grp = &ab->ext_irq_grp[i];
@@ -465,6 +463,8 @@ void ath11k_pcic_ext_irq_enable(struct ath11k_base *ab) }ath11k_pcic_ext_grp_enable (irq_grp); } + +set_bit (ATH11K_FLAG_EXT_IRQ_ENABLED , &ab->dev_flags); }EXPORT_SYMBOL (ath11k_pcic_ext_irq_enable);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/219 bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Tao <[email protected]>
[ Upstream commit 169410eba271afc9f0fb476d996795aa26770c6d ]
These three bpf_map_{lookup,update,delete}_elem() helpers are also available for sleepable bpf program, so add the corresponding lock assertion for sleepable bpf program, otherwise the following warning will be reported when a sleepable bpf program manipulates bpf map under interpreter mode (aka bpf_jit_enable=0):
WARNING: CPU: 3 PID: 4985 at kernel/bpf/helpers.c:40 ...... CPU: 3 PID: 4985 Comm: test_progs Not tainted 6.6.0+ #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:bpf_map_lookup_elem+0x54/0x60 ...... Call Trace: <TASK> ? __warn+0xa5/0x240 ? bpf_map_lookup_elem+0x54/0x60 ? report_bug+0x1ba/0x1f0 ? handle_bug+0x40/0x80 ? exc_invalid_op+0x18/0x50 ? asm_exc_invalid_op+0x1b/0x20 ? __pfx_bpf_map_lookup_elem+0x10/0x10 ? rcu_lockdep_current_cpu_online+0x65/0xb0 ? rcu_is_watching+0x23/0x50 ? bpf_map_lookup_elem+0x54/0x60 ? __pfx_bpf_map_lookup_elem+0x10/0x10 ___bpf_prog_run+0x513/0x3b70 __bpf_prog_run32+0x9d/0xd0 ? __bpf_prog_enter_sleepable_recur+0xad/0x120 ? __bpf_prog_enter_sleepable_recur+0x3e/0x120 bpf_trampoline_6442580665+0x4d/0x1000 __x64_sys_getpgid+0x5/0x30 ? do_syscall_64+0x36/0xb0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK>
--- kernel/bpf/helpers.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
kernel/bpf/helpers.c +8 -5
@@ -28,12 +28,13 @@* * Different map implementations will rely on rcu in map methods * lookup/update/delete, therefore eBPF programs must run under rcu lock -* if program is allowed to access maps, so check rcu_read_lock_held in -* all three functions. +* if program is allowed to access maps, so check rcu_read_lock_held() or +* rcu_read_lock_trace_held() in all three functions. */ BPF_CALL_2(bpf_map_lookup_elem, struct bpf_map *, map, void *, key) { -WARN_ON_ONCE (!rcu_read_lock_held () && !rcu_read_lock_bh_held ()); +WARN_ON_ONCE (!rcu_read_lock_held () && !rcu_read_lock_trace_held () && + !rcu_read_lock_bh_held ());return (unsigned long ) map->ops->map_lookup_elem (map, key); }
@@ -49,7 +50,8 @@ const struct bpf_func_proto bpf_map_lookup_elem_proto = { BPF_CALL_4(bpf_map_update_elem, struct bpf_map *, map, void *, key, void *, value, u64, flags) { -WARN_ON_ONCE (!rcu_read_lock_held () && !rcu_read_lock_bh_held ()); +WARN_ON_ONCE (!rcu_read_lock_held () && !rcu_read_lock_trace_held () && + !rcu_read_lock_bh_held ());return map->ops->map_update_elem (map, key, value, flags); }
@@ -66,7 +68,8 @@ const struct bpf_func_proto bpf_map_update_elem_proto = { BPF_CALL_2(bpf_map_delete_elem, struct bpf_map *, map, void *, key) { -WARN_ON_ONCE (!rcu_read_lock_held () && !rcu_read_lock_bh_held ()); +WARN_ON_ONCE (!rcu_read_lock_held () && !rcu_read_lock_trace_held () && + !rcu_read_lock_bh_held ());return map->ops->map_delete_elem (map, key); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/219 scsi: libfc: Dont schedule abort twice
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Reinecke <[email protected]>
[ Upstream commit b57c4db5d23b9df0118a25e2441c9288edd73710 ]
The current FC error recovery is sending up to three REC (recovery) frames in 10 second intervals, and as a final step sending an ABTS after 30 seconds for the command itself. Unfortunately sending an ABTS is also the action for the SCSI abort handler, and the default timeout for SCSI commands is also 30 seconds. This causes two ABTS to be scheduled, with the libfc one slightly earlier. The ABTS scheduled by SCSI EH then sees the command to be already aborted, and will always return with a 'GOOD' status irrespective on the actual result from the first ABTS. This causes the SCSI EH abort handler to always succeed, and SCSI EH never to be engaged. Fix this by not issuing an ABTS when a SCSI command is present for the exchange, but rather wait for the abort scheduled from SCSI EH. And warn if an abort is already scheduled to avoid similar errors in the future.
--- drivers/scsi/libfc/fc_fcp.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
drivers/scsi/libfc/fc_fcp.c +11 -5
@@ -265,6 +265,11 @@ static int fc_fcp_send_abort(struct fc_fcp_pkt *fsp)if (!fsp->seq_ptr)return -EINVAL ; +if (fsp->state &FC_SRB_ABORT_PENDING ) { +FC_FCP_DBG (fsp,"abort already pending\n" ); +return -EBUSY ; + } +this_cpu_inc (fsp->lp->stats->FcpPktAborts); fsp->state |=FC_SRB_ABORT_PENDING ;
@@ -1690,11 +1695,12 @@ static void fc_fcp_recovery(struct fc_fcp_pkt *fsp, u8 code) fsp->status_code = code; fsp->cdb_status =0 ; fsp->io_status =0 ; -/* -* if this fails then we let the scsi command timer fire and -* scsi-ml escalate. -*/ -fc_fcp_send_abort (fsp); +if (!fsp->cmd) +/* +* Only abort non-scsi commands; otherwise let the +* scsi command timer fire and scsi-ml escalate. +*/ +fc_fcp_send_abort (fsp); }/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/219 scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Reinecke <[email protected]>
[ Upstream commit 53122a49f49796beb2c4a1bb702303b66347e29f ]
We should set the status to FC_TIMED_OUT when a timeout error is passed to fc_fcp_rec_error().
--- drivers/scsi/libfc/fc_fcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/libfc/fc_fcp.c +1 -1
@@ -1676,7 +1676,7 @@ static void fc_fcp_rec_error(struct fc_fcp_pkt *fsp, struct fc_frame *fp)if (fsp->recov_retry++ <FC_MAX_RECOV_RETRY )fc_fcp_rec (fsp);else -fc_fcp_recovery (fsp,FC_ERROR ); +fc_fcp_recovery (fsp,FC_TIMED_OUT );break ; }fc_fcp_unlock_pkt (fsp);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/219 bpf: Set uattr->batch.count as zero before batched update or deletion
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Tao <[email protected]>
[ Upstream commit 06e5c999f10269a532304e89a6adb2fbfeb0593c ]
generic_map_{delete,update}_batch() doesn't set uattr->batch.count as zero before it tries to allocate memory for key. If the memory allocation fails, the value of uattr->batch.count will be incorrect.
Fix it by setting uattr->batch.count as zero beore batched update or deletion.
--- kernel/bpf/syscall.c | 6 ++++++ 1 file changed, 6 insertions(+)
kernel/bpf/syscall.c +6 -0
@@ -1598,6 +1598,9 @@ int generic_map_delete_batch(struct bpf_map *map,if (!max_count)return 0 ; +if (put_user (0 , &uattr->batch.count)) +return -EFAULT ; + key =kvmalloc (map->key_size,GFP_USER | __GFP_NOWARN);if (!key)return -ENOMEM ;
@@ -1657,6 +1660,9 @@ int generic_map_update_batch(struct bpf_map *map,if (!max_count)return 0 ; +if (put_user (0 , &uattr->batch.count)) +return -EFAULT ; + key =kvmalloc (map->key_size,GFP_USER | __GFP_NOWARN);if (!key)return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/219 wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit fe0a7776d4d19e613bb8dd80fe2d78ae49e8b49d ]
Since 'ieee80211_beacon_get()' can return NULL, 'wfx_set_mfp_ap()' should check the return value before examining skb data. So convert the latter to return an appropriate error code and propagate it to return from 'wfx_start_ap()' as well. Compile tested only.
--- drivers/net/wireless/silabs/wfx/sta.c | 42 ++++++++++++++++----------- 1 file changed, 25 insertions(+), 17 deletions(-)
drivers/net/wireless/silabs/wfx/sta.c +25 -17
@@ -354,29 +354,38 @@ static int wfx_upload_ap_templates(struct wfx_vif *wvif)return 0 ; } -static void wfx_set_mfp_ap (struct wfx_vif *wvif) +static int wfx_set_mfp_ap (struct wfx_vif *wvif) {struct ieee80211_vif *vif =wvif_to_vif (wvif);struct sk_buff *skb =ieee80211_beacon_get (wvif->wdev->hw, vif,0 ); const int ieoffset = offsetof(struct ieee80211_mgmt, u.beacon.variable); -const u16 *ptr = (u16 *)cfg80211_find_ie (WLAN_EID_RSN , skb->data + ieoffset, - skb->len - ieoffset);const int pairwise_cipher_suite_count_offset =8 /sizeof (u16);const int pairwise_cipher_suite_size =4 /sizeof (u16);const int akm_suite_size =4 /sizeof (u16); +const u16 *ptr; -if (ptr) { - ptr += pairwise_cipher_suite_count_offset; -if (WARN_ON (ptr > (u16 *)skb_tail_pointer (skb))) -return ; - ptr +=1 + pairwise_cipher_suite_size * *ptr; -if (WARN_ON (ptr > (u16 *)skb_tail_pointer (skb))) -return ; - ptr +=1 + akm_suite_size * *ptr; -if (WARN_ON (ptr > (u16 *)skb_tail_pointer (skb))) -return ; -wfx_hif_set_mfp (wvif, *ptr &BIT (7 ), *ptr &BIT (6 )); - } +if (unlikely (!skb)) +return -ENOMEM ; + + ptr = (u16 *)cfg80211_find_ie (WLAN_EID_RSN , skb->data + ieoffset, + skb->len - ieoffset); +if (unlikely (!ptr)) +return -EINVAL ; + + ptr += pairwise_cipher_suite_count_offset; +if (WARN_ON (ptr > (u16 *)skb_tail_pointer (skb))) +return -EINVAL ; + + ptr +=1 + pairwise_cipher_suite_size * *ptr; +if (WARN_ON (ptr > (u16 *)skb_tail_pointer (skb))) +return -EINVAL ; + + ptr +=1 + akm_suite_size * *ptr; +if (WARN_ON (ptr > (u16 *)skb_tail_pointer (skb))) +return -EINVAL ; + +wfx_hif_set_mfp (wvif, *ptr &BIT (7 ), *ptr &BIT (6 )); +return 0 ; } int wfx_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -394,8 +403,7 @@ int wfx_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif, ret =wfx_hif_start (wvif, &vif->bss_conf, wvif->channel);if (ret >0 )return -EIO ; -wfx_set_mfp_ap (wvif); -return ret; +return wfx_set_mfp_ap (wvif); } void wfx_stop_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/219 ARM: dts: rockchip: fix rk3036 hdmi ports node
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Jonker <[email protected]>
[ Upstream commit 27ded76ef0fcfcf939914532aae575cf23c221b4 ]
Fix hdmi ports node so that it matches the
rockchip,inno-hdmi.yaml binding.
--- arch/arm/boot/dts/rk3036.dtsi | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
arch/arm/boot/dts/rk3036.dtsi +11 -3
@@ -402,12 +402,20 @@ pinctrl-0 = <&hdmi_ctl>; status = "disabled"; - hdmi_in: port { + ports { #address-cells = <1>; #size-cells = <0>; - hdmi_in_vop: endpoint@0 { + + hdmi_in: port@0 { reg = <0>; - remote-endpoint = <&vop_out_hdmi>; + + hdmi_in_vop: endpoint { + remote-endpoint = <&vop_out_hdmi>; + }; + }; + + hdmi_out: port@1 { + reg = <1>; }; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/219 ARM: dts: imx25/27-eukrea: Fix RTC node name
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit 68c711b882c262e36895547cddea2c2d56ce611d ]
Node names should be generic. Use 'rtc' as node name to fix the following dt-schema warning:
imx25-eukrea-mbimxsd25-baseboard.dtb: pcf8563@51: $nodename:0: 'pcf8563@51' does not match '^rtc(@.*|-([0-9]|[1-9][0-9]+))?$'
from schema $id: http://devicetree.org/schemas/rtc/nxp,pcf8563.yaml#
--- arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi | 2 +- arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi +1 -1
@@ -27,7 +27,7 @@ pinctrl-0 = <&pinctrl_i2c1>; status = "okay"; - pcf8563@51 { + rtc@51 { compatible = "nxp,pcf8563"; reg = <0x51>; };
arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi +1 -1
@@ -33,7 +33,7 @@ pinctrl-0 = <&pinctrl_i2c1>; status = "okay"; - pcf8563@51 { + rtc@51 { compatible = "nxp,pcf8563"; reg = <0x51>; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/219 ARM: dts: imx: Use flash@0,0 pattern
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit 1e1d7cc478fb16816de09740e3c323c0c188d58f ]
Per mtd-physmap.yaml, 'nor@0,0' is not a valid node pattern.
Change it to 'flash@0,0' to fix the following dt-schema warning:
imx1-ads.dtb: nor@0,0: $nodename:0: 'nor@0,0' does not match '^(flash|.*sram|nand)(@.*)?$'
from schema $id: http://devicetree.org/schemas/mtd/mtd-physmap.yaml#
--- arch/arm/boot/dts/imx1-ads.dts | 2 +- arch/arm/boot/dts/imx1-apf9328.dts | 2 +- arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi | 2 +- arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-)
arch/arm/boot/dts/imx1-ads.dts +1 -1
@@ -65,7 +65,7 @@ pinctrl-0 = <&pinctrl_weim>; status = "okay"; - nor: nor@0,0 { + nor: flash@0,0 { compatible = "cfi-flash"; reg = <0 0x00000000 0x02000000>; bank-width = <4>;
arch/arm/boot/dts/imx1-apf9328.dts +1 -1
@@ -45,7 +45,7 @@ pinctrl-0 = <&pinctrl_weim>; status = "okay"; - nor: nor@0,0 { + nor: flash@0,0 { compatible = "cfi-flash"; reg = <0 0x00000000 0x02000000>; bank-width = <2>;
arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi +1 -1
@@ -90,7 +90,7 @@ &weim { status = "okay"; - nor: nor@0,0 { + nor: flash@0,0 { #address-cells = <1>; #size-cells = <1>; compatible = "cfi-flash";
arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi +1 -1
@@ -322,7 +322,7 @@ &weim { status = "okay"; - nor: nor@0,0 { + nor: flash@0,0 { compatible = "cfi-flash"; reg = <0 0x00000000 0x02000000>; bank-width = <2>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/219 ARM: dts: imx27: Fix sram node
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit 2fb7b2a2f06bb3f8321cf26c33e4e820c5b238b6 ]
Per sram.yaml, address-cells, size-cells and ranges are mandatory.
Pass them to fix the following dt-schema warnings:
--- arch/arm/boot/dts/imx27.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm/boot/dts/imx27.dtsi +3 -0
@@ -588,6 +588,9 @@ iram: sram@ffff4c00 { compatible = "mmio-sram"; reg = <0xffff4c00 0xb400>; + ranges = <0 0xffff4c00 0xb400>; + #address-cells = <1>; + #size-cells = <1>; }; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/219 ARM: dts: imx1: Fix sram node
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit c248e535973088ba7071ff6f26ab7951143450af ]
Per sram.yaml, address-cells, size-cells and ranges are mandatory.
The node name should be sram.
Change the node name and pass the required properties to fix the following dt-schema warnings:
imx1-apf9328.dtb: esram@300000: $nodename:0: 'esram@300000' does not match '^sram(@.*)?'
from schema $id: http://devicetree.org/schemas/sram/sram.yaml#
imx1-apf9328.dtb: esram@300000: '#address-cells' is a required property
from schema $id: http://devicetree.org/schemas/sram/sram.yaml#
imx1-apf9328.dtb: esram@300000: '#size-cells' is a required property
from schema $id: http://devicetree.org/schemas/sram/sram.yaml#
imx1-apf9328.dtb: esram@300000: 'ranges' is a required property
from schema $id: http://devicetree.org/schemas/sram/sram.yaml#
--- arch/arm/boot/dts/imx1.dtsi | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/arm/boot/dts/imx1.dtsi +4 -1
@@ -268,9 +268,12 @@ status = "disabled"; }; - esram: esram@300000 { + esram: sram@300000 { compatible = "mmio-sram"; reg = <0x00300000 0x20000>; + ranges = <0 0x00300000 0x20000>; + #address-cells = <1>; + #size-cells = <1>; }; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/219 net: phy: at803x: fix passing the wrong reference for config_intr
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Marangi <[email protected]>
[ Upstream commit f8fdbf3389f44c7026f16e36cb1f2ff017f7f5b2 ]
Fix passing the wrong reference for config_initr on passing the function pointer, drop the wrong & from at803x_config_intr in the PHY struct.
--- drivers/net/phy/at803x.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/phy/at803x.c +3 -3
@@ -2051,7 +2051,7 @@ static struct phy_driver at803x_driver[] = { .write_page = at803x_write_page, .get_features = at803x_get_features, .read_status = at803x_read_status, - .config_intr = &at803x_config_intr, + .config_intr = at803x_config_intr, .handle_interrupt = at803x_handle_interrupt, .get_tunable = at803x_get_tunable, .set_tunable = at803x_set_tunable,
@@ -2081,7 +2081,7 @@ static struct phy_driver at803x_driver[] = { .resume = at803x_resume, .flags = PHY_POLL_CABLE_TEST,/* PHY_BASIC_FEATURES */ - .config_intr = &at803x_config_intr, + .config_intr = at803x_config_intr, .handle_interrupt = at803x_handle_interrupt, .cable_test_start = at803x_cable_test_start, .cable_test_get_status = at803x_cable_test_get_status,
@@ -2097,7 +2097,7 @@ static struct phy_driver at803x_driver[] = { .resume = at803x_resume, .flags = PHY_POLL_CABLE_TEST,/* PHY_BASIC_FEATURES */ - .config_intr = &at803x_config_intr, + .config_intr = at803x_config_intr, .handle_interrupt = at803x_handle_interrupt, .cable_test_start = at803x_cable_test_start, .cable_test_get_status = at803x_cable_test_get_status,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/219 ionic: pass opcode to devcmd_wait
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shannon Nelson <[email protected]>
[ Upstream commit 24f110240c03c6b5368f1203bac72883d511e606 ]
Don't rely on the PCI memory for the devcmd opcode because we read a 0xff value if the PCI bus is broken, which can cause us to report a bogus dev_cmd opcode later.
--- drivers/net/ethernet/pensando/ionic/ionic_dev.c | 1 + drivers/net/ethernet/pensando/ionic/ionic_dev.h | 1 + drivers/net/ethernet/pensando/ionic/ionic_main.c | 2 +- 3 files changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/pensando/ionic/ionic_dev.c +1 -0
@@ -293,6 +293,7 @@ void ionic_dev_cmd_comp(struct ionic_dev *idev, union ionic_dev_cmd_comp *comp)void ionic_dev_cmd_go (struct ionic_dev *idev,union ionic_dev_cmd *cmd) { + idev->opcode = cmd->cmd.opcode;memcpy_toio (&idev->dev_cmd_regs->cmd, cmd,sizeof (*cmd));iowrite32 (0 , &idev->dev_cmd_regs->done);iowrite32 (1 , &idev->dev_cmd_regs->doorbell);
drivers/net/ethernet/pensando/ionic/ionic_dev.h +1 -0
@@ -150,6 +150,7 @@ struct ionic_dev {bool fw_hb_ready;bool fw_status_ready;u8 fw_generation; +u8 opcode;u64 __iomem *db_pages;dma_addr_t phy_db_pages;
drivers/net/ethernet/pensando/ionic/ionic_main.c +1 -1
@@ -465,7 +465,7 @@ static int __ionic_dev_cmd_wait(struct ionic *ionic, unsigned long max_seconds,*/ max_wait = jiffies + (max_seconds *HZ ); try_again: - opcode =readb (&idev->dev_cmd_regs->cmd.cmd.opcode); + opcode = idev->opcode; start_time = jiffies; for (fw_up = ionic_is_fw_running(idev); !done && fw_up && time_before(jiffies, max_wait);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/219 ionic: bypass firmware cmds when stuck in reset
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shannon Nelson <[email protected]>
[ Upstream commit ca5fdf9a7c5b65968c718f2be159cda4c13556a1 ]
If the driver or firmware is stuck in reset state, don't bother trying to use adminq commands. This speeds up shutdown and prevents unnecessary timeouts and error messages.
This includes a bit of rework on ionic_adminq_post_wait() and ionic_adminq_post_wait_nomsg() to both use __ionic_adminq_post_wait() which can do the checks needed in both cases.
--- .../ethernet/pensando/ionic/ionic_bus_pci.c | 4 ++++ .../net/ethernet/pensando/ionic/ionic_lif.c | 3 +++ .../net/ethernet/pensando/ionic/ionic_main.c | 20 ++++++++++++------- 3 files changed, 20 insertions(+), 7 deletions(-)
drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c +4 -0
@@ -380,6 +380,10 @@ static void ionic_remove(struct pci_dev *pdev)del_timer_sync (&ionic->watchdog_timer);if (ionic->lif) { +/* prevent adminq cmds if already known as down */ +if (test_and_clear_bit (IONIC_LIF_F_FW_RESET , ionic->lif->state)) +set_bit (IONIC_LIF_F_FW_STOPPING , ionic->lif->state); +ionic_lif_unregister (ionic->lif);ionic_devlink_unregister (ionic);ionic_lif_deinit (ionic->lif);
drivers/net/ethernet/pensando/ionic/ionic_lif.c +3 -0
@@ -3008,6 +3008,9 @@ static void ionic_lif_reset(struct ionic_lif *lif) {struct ionic_dev *idev = &lif->ionic->idev; +if (!ionic_is_fw_running (idev)) +return ; +mutex_lock (&lif->ionic->dev_cmd_lock);ionic_dev_cmd_lif_reset (idev, lif->index);ionic_dev_cmd_wait (lif->ionic,DEVCMD_TIMEOUT );
drivers/net/ethernet/pensando/ionic/ionic_main.c +13 -7
@@ -410,22 +410,28 @@ int ionic_adminq_wait(struct ionic_lif *lif, struct ionic_admin_ctx *ctx, do_msg); } -int ionic_adminq_post_wait (struct ionic_lif *lif,struct ionic_admin_ctx *ctx) +static int __ionic_adminq_post_wait (struct ionic_lif *lif, +struct ionic_admin_ctx *ctx, +const bool do_msg) {int err; +if (!ionic_is_fw_running (&lif->ionic->idev)) +return 0 ; + err =ionic_adminq_post (lif, ctx); -return ionic_adminq_wait (lif, ctx, err, true); +return ionic_adminq_wait (lif, ctx, err, do_msg); } -int ionic_adminq_post_wait_nomsg (struct ionic_lif *lif,struct ionic_admin_ctx *ctx) +int ionic_adminq_post_wait (struct ionic_lif *lif,struct ionic_admin_ctx *ctx) { -int err; - - err =ionic_adminq_post (lif, ctx); +return __ionic_adminq_post_wait (lif, ctx, true); +} -return ionic_adminq_wait (lif, ctx, err, false); +int ionic_adminq_post_wait_nomsg (struct ionic_lif *lif,struct ionic_admin_ctx *ctx) +{ +return __ionic_adminq_post_wait (lif, ctx, false); }static void ionic_dev_cmd_clean (struct ionic *ionic)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/219 block/rnbd-srv: Check for unlikely string overflow
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 9e4bf6a08d1e127bcc4bd72557f2dfafc6bc7f41 ]
Since "dev_search_path" can technically be as large as PATH_MAX, there was a risk of truncation when copying it and a second string into "full_path" since it was also PATH_MAX sized. The W=1 builds were reporting this warning:
drivers/block/rnbd/rnbd-srv.c: In function 'process_msg_open.isra':drivers/block/rnbd/rnbd-srv.c:616:51: warning: '%s' directive output may be truncated writing up to 254 bytes into a region of size between 0 and 4095 [-Wformat-truncation=]
616 | snprintf(full_path, PATH_MAX, "%s/%s",
| ^~
In function 'rnbd_srv_get_full_path',
inlined from 'process_msg_open.isra' at drivers/block/rnbd/rnbd-srv.c:721:14: drivers/block/rnbd/rnbd-srv.c:616:17: note: 'snprintf' output between 2 and 4351 bytes into a destination of size 4096
616 | snprintf(full_path, PATH_MAX, "%s/%s",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
617 | dev_search_path, dev_name);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~To fix this, unconditionally check for truncation (as was already done for the case where "%SESSNAME%" was present).
--- drivers/block/rnbd/rnbd-srv.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
drivers/block/rnbd/rnbd-srv.c +10 -9
@@ -587,6 +587,7 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess, {char *full_path;char *a, *b; +int len; full_path =kmalloc (PATH_MAX ,GFP_KERNEL );if (!full_path)
@@ -598,19 +599,19 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess,*/ a =strnstr (dev_search_path,"%SESSNAME%" ,sizeof (dev_search_path));if (a) { -int len = a - dev_search_path; + len = a - dev_search_path; len =snprintf (full_path,PATH_MAX ,"%.*s/%s/%s" , len, dev_search_path, srv_sess->sessname, dev_name); -if (len >=PATH_MAX ) { -pr_err ("Too long path: %s, %s, %s\n" , - dev_search_path, srv_sess->sessname, dev_name); -kfree (full_path); -return ERR_PTR (-EINVAL ); - } }else { -snprintf (full_path,PATH_MAX ,"%s/%s" , - dev_search_path, dev_name); + len =snprintf (full_path,PATH_MAX ,"%s/%s" , + dev_search_path, dev_name); + } +if (len >=PATH_MAX ) { +pr_err ("Too long path: %s, %s, %s\n" , + dev_search_path, srv_sess->sessname, dev_name); +kfree (full_path); +return ERR_PTR (-EINVAL ); }/* eliminitate duplicated slashes */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/219 ARM: dts: imx25: Fix the iim compatible string
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit f0b929f58719fc57a4926ab4fc972f185453d6a5 ]
Per imx-iim.yaml, the compatible string should only contain a single entry.
Use it as "fsl,imx25-iim" to fix the following dt-schema warning:
imx25-karo-tx25.dtb: efuse@53ff0000: compatible: ['fsl,imx25-iim', 'fsl,imx27-iim'] is too long
from schema $id: http://devicetree.org/schemas/nvmem/imx-iim.yaml#
--- arch/arm/boot/dts/imx25.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/imx25.dtsi +1 -1
@@ -543,7 +543,7 @@ }; iim: efuse@53ff0000 { - compatible = "fsl,imx25-iim", "fsl,imx27-iim"; + compatible = "fsl,imx25-iim"; reg = <0x53ff0000 0x4000>; interrupts = <19>; clocks = <&clks 99>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/219 ARM: dts: imx25/27: Pass timing0
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit 11ab7ad6f795ae23c398a4a5c56505d3dab27c4c ]
Per display-timings.yaml, the 'timing' pattern should be used to describe the display timings.
Change it accordingly to fix the following dt-schema warning:
imx27-apf27dev.dtb: display-timings: '800x480' does not match any of the regexes: '^timing', 'pinctrl-[0-9]+'
from schema $id: http://devicetree.org/schemas/display/panel/display-timings.yaml#
--- arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-cmo-qvga.dts | 2 +- arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-dvi-svga.dts | 2 +- arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-dvi-vga.dts | 2 +- arch/arm/boot/dts/imx25-pdk.dts | 2 +- arch/arm/boot/dts/imx27-apf27dev.dts | 2 +- arch/arm/boot/dts/imx27-eukrea-mbimxsd27-baseboard.dts | 2 +- arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts | 2 +- arch/arm/boot/dts/imx27-phytec-phycore-rdk.dts | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-)
arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-cmo-qvga.dts +1 -1
@@ -16,7 +16,7 @@ bus-width = <18>; display-timings { native-mode = <&qvga_timings>; - qvga_timings: 320x240 { + qvga_timings: timing0 { clock-frequency = <6500000>; hactive = <320>; vactive = <240>;
arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-dvi-svga.dts +1 -1
@@ -16,7 +16,7 @@ bus-width = <18>; display-timings { native-mode = <&dvi_svga_timings>; - dvi_svga_timings: 800x600 { + dvi_svga_timings: timing0 { clock-frequency = <40000000>; hactive = <800>; vactive = <600>;
arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-dvi-vga.dts +1 -1
@@ -16,7 +16,7 @@ bus-width = <18>; display-timings { native-mode = <&dvi_vga_timings>; - dvi_vga_timings: 640x480 { + dvi_vga_timings: timing0 { clock-frequency = <31250000>; hactive = <640>; vactive = <480>;
arch/arm/boot/dts/imx25-pdk.dts +1 -1
@@ -78,7 +78,7 @@ bus-width = <18>; display-timings { native-mode = <&wvga_timings>; - wvga_timings: 640x480 { + wvga_timings: timing0 { hactive = <640>; vactive = <480>; hback-porch = <45>;
arch/arm/boot/dts/imx27-apf27dev.dts +1 -1
@@ -16,7 +16,7 @@ fsl,pcr = <0xfae80083>; /* non-standard but required */ display-timings { native-mode = <&timing0>; - timing0: 800x480 { + timing0: timing0 { clock-frequency = <33000033>; hactive = <800>; vactive = <480>;
arch/arm/boot/dts/imx27-eukrea-mbimxsd27-baseboard.dts +1 -1
@@ -16,7 +16,7 @@ display-timings { native-mode = <&timing0>; - timing0: 320x240 { + timing0: timing0 { clock-frequency = <6500000>; hactive = <320>; vactive = <240>;
arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts +1 -1
@@ -19,7 +19,7 @@ fsl,pcr = <0xf0c88080>; /* non-standard but required */ display-timings { native-mode = <&timing0>; - timing0: 640x480 { + timing0: timing0 { hactive = <640>; vactive = <480>; hback-porch = <112>;
arch/arm/boot/dts/imx27-phytec-phycore-rdk.dts +1 -1
@@ -19,7 +19,7 @@ display-timings { native-mode = <&timing0>; - timing0: 240x320 { + timing0: timing0 { clock-frequency = <5500000>; hactive = <240>; vactive = <320>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/219 ARM: dts: imx27-apf27dev: Fix LED name
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit dc35e253d032b959d92e12f081db5b00db26ae64 ]
Per leds-gpio.yaml, the led names should start with 'led'.
Change it to fix the following dt-schema warning:
imx27-apf27dev.dtb: leds: 'user' does not match any of the regexes: '(^led-[0-9a-f]$|led)', 'pinctrl-[0-9]+'
from schema $id: http://devicetree.org/schemas/leds/leds-gpio.yaml#
--- arch/arm/boot/dts/imx27-apf27dev.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/imx27-apf27dev.dts +1 -1
@@ -47,7 +47,7 @@ pinctrl-names = "default"; pinctrl-0 = <&pinctrl_gpio_leds>; - user { + led-user { label = "Heartbeat"; gpios = <&gpio6 14 GPIO_ACTIVE_HIGH>; linux,default-trigger = "heartbeat";
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/219 ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit e3aa1a82fb20ee97597022f6528823a8ab82bde6 ]
The 'gpios' property to describe the SDA and SCL GPIOs is considered deprecated according to i2c-gpio.yaml.
Switch to the preferred 'sda-gpios' and 'scl-gpios' properties.
This fixes the following schema warnings:
imx23-sansa.dtb: i2c-0: 'sda-gpios' is a required property
from schema $id: http://devicetree.org/schemas/i2c/i2c-gpio.yaml#
imx23-sansa.dtb: i2c-0: 'scl-gpios' is a required property
from schema $id: http://devicetree.org/schemas/i2c/i2c-gpio.yaml#
--- arch/arm/boot/dts/imx23-sansa.dts | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
arch/arm/boot/dts/imx23-sansa.dts +4 -8
@@ -175,10 +175,8 @@ #address-cells = <1>; #size-cells = <0>; compatible = "i2c-gpio"; - gpios = < - &gpio1 24 0 /* SDA */ - &gpio1 22 0 /* SCL */ - >; + sda-gpios = <&gpio1 24 0>; + scl-gpios = <&gpio1 22 0>; i2c-gpio,delay-us = <2>; /* ~100 kHz */ };
@@ -186,10 +184,8 @@ #address-cells = <1>; #size-cells = <0>; compatible = "i2c-gpio"; - gpios = < - &gpio0 31 0 /* SDA */ - &gpio0 30 0 /* SCL */ - >; + sda-gpios = <&gpio0 31 0>; + scl-gpios = <&gpio0 30 0>; i2c-gpio,delay-us = <2>; /* ~100 kHz */ touch: touch@20 {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/219 ARM: dts: imx23/28: Fix the DMA controller node name
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit 858d83ca4b50bbc8693d95cc94310e6d791fb2e6 ]
Per fsl,mxs-dma.yaml, the node name should be 'dma-controller'.
Change it to fix the following dt-schema warning.
imx28-apf28.dtb: dma-apbx@80024000: $nodename:0: 'dma-apbx@80024000' does not match '^dma-controller(@.*)?$'
from schema $id: http://devicetree.org/schemas/dma/fsl,mxs-dma.yaml#
--- arch/arm/boot/dts/imx23.dtsi | 2 +- arch/arm/boot/dts/imx28.dtsi | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/imx23.dtsi +1 -1
@@ -414,7 +414,7 @@ status = "disabled"; }; - dma_apbx: dma-apbx@80024000 { + dma_apbx: dma-controller@80024000 { compatible = "fsl,imx23-dma-apbx"; reg = <0x80024000 0x2000>; interrupts = <7 5 9 26
arch/arm/boot/dts/imx28.dtsi +1 -1
@@ -994,7 +994,7 @@ status = "disabled"; }; - dma_apbx: dma-apbx@80024000 { + dma_apbx: dma-controller@80024000 { compatible = "fsl,imx28-dma-apbx"; reg = <0x80024000 0x2000>; interrupts = <78 79 66 0
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/219 scsi: hisi_sas: Set .phy_attached before notifing phyup event HISI_PHYE_PHY_UP_PM
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihang Li <[email protected]>
[ Upstream commit ce26497c745d0541aec930d5211b431a1c26af97 ]
Currently in directly attached scenario, the phyup event HISI_PHYE_PHY_UP_PM is notified before .phy_attached is set - this may cause the phyup work hisi_sas_bytes_dmaed() execution failed and the attached device will not be found.
To fix it, set .phy_attached before notifing phyup event.
--- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +5 -5
@@ -1565,6 +1565,11 @@ static irqreturn_t phy_up_v3_hw(int phy_no, struct hisi_hba *hisi_hba) } phy->port_id = port_id; +spin_lock (&phy->lock); +/* Delete timer and set phy_attached atomically */ +del_timer (&phy->timer); + phy->phy_attached =1 ; +spin_unlock (&phy->lock);/* * Call pm_runtime_get_noresume() which pairs with
@@ -1578,11 +1583,6 @@ static irqreturn_t phy_up_v3_hw(int phy_no, struct hisi_hba *hisi_hba) res =IRQ_HANDLED ; -spin_lock (&phy->lock); -/* Delete timer and set phy_attached atomically */ -del_timer (&phy->timer); - phy->phy_attached =1 ; -spin_unlock (&phy->lock); end:if (phy->reset_completion)complete (phy->reset_completion);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/219 ice: fix ICE_AQ_VSI_Q_OPT_RSS_* register values
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmed Zaki <[email protected]>
[ Upstream commit 20f73b60bb5c276cee9b1a530f100c677bc74af8 ]
Fix the values of the ICE_AQ_VSI_Q_OPT_RSS_* registers. Shifting is already done when the values are used, no need to double shift. Bug was not discovered earlier since only ICE_AQ_VSI_Q_OPT_RSS_TPLZ (Zero) is currently used.
Also, rename ICE_AQ_VSI_Q_OPT_RSS_XXX to ICE_AQ_VSI_Q_OPT_RSS_HASH_XXX for consistency.
--- drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 8 ++++---- drivers/net/ethernet/intel/ice/ice_lib.c | 4 ++-- drivers/net/ethernet/intel/ice/ice_virtchnl.c | 12 +++++------- 3 files changed, 11 insertions(+), 13 deletions(-)
drivers/net/ethernet/intel/ice/ice_adminq_cmd.h +4 -4
@@ -483,10 +483,10 @@ struct ice_aqc_vsi_props {#define ICE_AQ_VSI_Q_OPT_RSS_GBL_LUT_M (0xF << ICE_AQ_VSI_Q_OPT_RSS_GBL_LUT_S)#define ICE_AQ_VSI_Q_OPT_RSS_HASH_S 6#define ICE_AQ_VSI_Q_OPT_RSS_HASH_M (0x3 << ICE_AQ_VSI_Q_OPT_RSS_HASH_S) -#define ICE_AQ_VSI_Q_OPT_RSS_TPLZ (0x0 << ICE_AQ_VSI_Q_OPT_RSS_HASH_S) -#define ICE_AQ_VSI_Q_OPT_RSS_SYM_TPLZ (0x1 << ICE_AQ_VSI_Q_OPT_RSS_HASH_S) -#define ICE_AQ_VSI_Q_OPT_RSS_XOR (0x2 << ICE_AQ_VSI_Q_OPT_RSS_HASH_S) -#define ICE_AQ_VSI_Q_OPT_RSS_JHASH (0x3 << ICE_AQ_VSI_Q_OPT_RSS_HASH_S) +#define ICE_AQ_VSI_Q_OPT_RSS_HASH_TPLZ 0x0U +#define ICE_AQ_VSI_Q_OPT_RSS_HASH_SYM_TPLZ 0x1U +#define ICE_AQ_VSI_Q_OPT_RSS_HASH_XOR 0x2U +#define ICE_AQ_VSI_Q_OPT_RSS_HASH_JHASH 0x3Uu8 q_opt_tc;#define ICE_AQ_VSI_Q_OPT_TC_OVR_S 0#define ICE_AQ_VSI_Q_OPT_TC_OVR_M (0x1F << ICE_AQ_VSI_Q_OPT_TC_OVR_S)
drivers/net/ethernet/intel/ice/ice_lib.c +2 -2
@@ -1085,12 +1085,12 @@ static void ice_set_rss_vsi_ctx(struct ice_vsi_ctx *ctxt, struct ice_vsi *vsi)case ICE_VSI_PF :/* PF VSI will inherit RSS instance of PF */ lut_type =ICE_AQ_VSI_Q_OPT_RSS_LUT_PF ; - hash_type =ICE_AQ_VSI_Q_OPT_RSS_TPLZ ; + hash_type =ICE_AQ_VSI_Q_OPT_RSS_HASH_TPLZ ;break ;case ICE_VSI_VF :/* VF VSI will gets a small RSS table which is a VSI LUT type */ lut_type =ICE_AQ_VSI_Q_OPT_RSS_LUT_VSI ; - hash_type =ICE_AQ_VSI_Q_OPT_RSS_TPLZ ; + hash_type =ICE_AQ_VSI_Q_OPT_RSS_HASH_TPLZ ;break ;default : dev_dbg(dev, "Unsupported VSI type %s\n",
drivers/net/ethernet/intel/ice/ice_virtchnl.c +5 -7
@@ -817,8 +817,8 @@ static int ice_vc_handle_rss_cfg(struct ice_vf *vf, u8 *msg, bool add)int status; lut_type =ICE_AQ_VSI_Q_OPT_RSS_LUT_VSI ; - hash_type = add ?ICE_AQ_VSI_Q_OPT_RSS_XOR : -ICE_AQ_VSI_Q_OPT_RSS_TPLZ ; + hash_type = add ?ICE_AQ_VSI_Q_OPT_RSS_HASH_XOR : +ICE_AQ_VSI_Q_OPT_RSS_HASH_TPLZ ; ctx =kzalloc (sizeof (*ctx),GFP_KERNEL );if (!ctx) {
@@ -826,11 +826,9 @@ static int ice_vc_handle_rss_cfg(struct ice_vf *vf, u8 *msg, bool add) goto error_param; } - ctx->info.q_opt_rss = ((lut_type << -ICE_AQ_VSI_Q_OPT_RSS_LUT_S ) & -ICE_AQ_VSI_Q_OPT_RSS_LUT_M ) | - (hash_type & -ICE_AQ_VSI_Q_OPT_RSS_HASH_M ); + ctx->info.q_opt_rss = +FIELD_PREP (ICE_AQ_VSI_Q_OPT_RSS_LUT_M , lut_type) | +FIELD_PREP (ICE_AQ_VSI_Q_OPT_RSS_HASH_M , hash_type);/* Preserve existing queueing option setting */ ctx->info.q_opt_rss |= (vsi->info.q_opt_rss &
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/219 net: atlantic: eliminate double free in error handling logic
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Russkikh <[email protected]>
[ Upstream commit b3cb7a830a24527877b0bc900b9bd74a96aea928 ]
Driver has a logic leak in ring data allocation/free, where aq_ring_free could be called multiple times on same ring, if system is under stress and got memory allocation error.
Ring pointer was used as an indicator of failure, but this is not correct since only ring data is allocated/deallocated. Ring itself is an array member.
Changing ring allocation functions to return error code directly. This simplifies error handling and eliminates aq_ring_free on higher layer.
--- .../net/ethernet/aquantia/atlantic/aq_ptp.c | 28 +++------ .../net/ethernet/aquantia/atlantic/aq_ring.c | 61 +++++-------------- .../net/ethernet/aquantia/atlantic/aq_ring.h | 22 +++---- .../net/ethernet/aquantia/atlantic/aq_vec.c | 23 +++---- 4 files changed, 47 insertions(+), 87 deletions(-)
drivers/net/ethernet/aquantia/atlantic/aq_ptp.c +10 -18
@@ -953,8 +953,6 @@ int aq_ptp_ring_alloc(struct aq_nic_s *aq_nic) {struct aq_ptp_s *aq_ptp = aq_nic->aq_ptp;unsigned int tx_ring_idx, rx_ring_idx; -struct aq_ring_s *hwts; -struct aq_ring_s *ring;int err;if (!aq_ptp)
@@ -962,29 +960,23 @@ int aq_ptp_ring_alloc(struct aq_nic_s *aq_nic) tx_ring_idx =aq_ptp_ring_idx (aq_nic->aq_nic_cfg.tc_mode); - ring =aq_ring_tx_alloc (&aq_ptp->ptp_tx, aq_nic, - tx_ring_idx, &aq_nic->aq_nic_cfg); -if (!ring) { - err = -ENOMEM ; + err =aq_ring_tx_alloc (&aq_ptp->ptp_tx, aq_nic, + tx_ring_idx, &aq_nic->aq_nic_cfg); +if (err) goto err_exit; - } rx_ring_idx =aq_ptp_ring_idx (aq_nic->aq_nic_cfg.tc_mode); - ring =aq_ring_rx_alloc (&aq_ptp->ptp_rx, aq_nic, - rx_ring_idx, &aq_nic->aq_nic_cfg); -if (!ring) { - err = -ENOMEM ; + err =aq_ring_rx_alloc (&aq_ptp->ptp_rx, aq_nic, + rx_ring_idx, &aq_nic->aq_nic_cfg); +if (err) goto err_exit_ptp_tx; - } - hwts =aq_ring_hwts_rx_alloc (&aq_ptp->hwts_rx, aq_nic,PTP_HWST_RING_IDX , - aq_nic->aq_nic_cfg.rxds, - aq_nic->aq_nic_cfg.aq_hw_caps->rxd_size); -if (!hwts) { - err = -ENOMEM ; + err =aq_ring_hwts_rx_alloc (&aq_ptp->hwts_rx, aq_nic,PTP_HWST_RING_IDX , + aq_nic->aq_nic_cfg.rxds, + aq_nic->aq_nic_cfg.aq_hw_caps->rxd_size); +if (err) goto err_exit_ptp_rx; - } err =aq_ptp_skb_ring_init (&aq_ptp->skb_ring, aq_nic->aq_nic_cfg.rxds);if (err !=0 ) {
drivers/net/ethernet/aquantia/atlantic/aq_ring.c +16 -45
102 lines not on this page · raw message
drivers/net/ethernet/aquantia/atlantic/aq_ring.h +11 -11
@@ -183,14 +183,14 @@ static inline unsigned int aq_ring_avail_dx(struct aq_ring_s *self) self->sw_head - self->sw_tail - 1); } -struct aq_ring_s *aq_ring_tx_alloc (struct aq_ring_s *self, -struct aq_nic_s *aq_nic, -unsigned int idx, -struct aq_nic_cfg_s *aq_nic_cfg); -struct aq_ring_s *aq_ring_rx_alloc (struct aq_ring_s *self, -struct aq_nic_s *aq_nic, -unsigned int idx, -struct aq_nic_cfg_s *aq_nic_cfg); +int aq_ring_tx_alloc (struct aq_ring_s *self, +struct aq_nic_s *aq_nic, +unsigned int idx, +struct aq_nic_cfg_s *aq_nic_cfg); +int aq_ring_rx_alloc (struct aq_ring_s *self, +struct aq_nic_s *aq_nic, +unsigned int idx, +struct aq_nic_cfg_s *aq_nic_cfg);int aq_ring_init (struct aq_ring_s *self,const enum atl_ring_type ring_type);void aq_ring_rx_deinit (struct aq_ring_s *self);
@@ -207,9 +207,9 @@ int aq_ring_rx_clean(struct aq_ring_s *self, int budget);int aq_ring_rx_fill (struct aq_ring_s *self); -struct aq_ring_s *aq_ring_hwts_rx_alloc (struct aq_ring_s *self, -struct aq_nic_s *aq_nic,unsigned int idx, -unsigned int size,unsigned int dx_size); +int aq_ring_hwts_rx_alloc (struct aq_ring_s *self, +struct aq_nic_s *aq_nic,unsigned int idx, +unsigned int size,unsigned int dx_size);void aq_ring_hwts_rx_clean (struct aq_ring_s *self,struct aq_nic_s *aq_nic);unsigned int aq_ring_fill_stats_data (struct aq_ring_s *self,u64 *data);
drivers/net/ethernet/aquantia/atlantic/aq_vec.c +10 -13
@@ -136,35 +136,32 @@ int aq_vec_ring_alloc(struct aq_vec_s *self, struct aq_nic_s *aq_nic,const unsigned int idx_ring =AQ_NIC_CFG_TCVEC2RING (aq_nic_cfg, i, idx); - ring =aq_ring_tx_alloc (&self->ring[i][AQ_VEC_TX_ID ], aq_nic, - idx_ring, aq_nic_cfg); -if (!ring) { - err = -ENOMEM ; + ring = &self->ring[i][AQ_VEC_TX_ID ]; + err =aq_ring_tx_alloc (ring, aq_nic, idx_ring, aq_nic_cfg); +if (err) goto err_exit; - } ++self->tx_rings;aq_nic_set_tx_ring (aq_nic, idx_ring, ring); -if (xdp_rxq_info_reg (&self->ring[i][AQ_VEC_RX_ID ].xdp_rxq, + ring = &self->ring[i][AQ_VEC_RX_ID ]; +if (xdp_rxq_info_reg (&ring->xdp_rxq, aq_nic->ndev, idx, self->napi.napi_id) <0 ) { err = -ENOMEM ; goto err_exit; } -if (xdp_rxq_info_reg_mem_model (&self->ring[i][AQ_VEC_RX_ID ].xdp_rxq, +if (xdp_rxq_info_reg_mem_model (&ring->xdp_rxq,MEM_TYPE_PAGE_SHARED ,NULL ) <0 ) { -xdp_rxq_info_unreg (&self->ring[i][AQ_VEC_RX_ID ].xdp_rxq); +xdp_rxq_info_unreg (&ring->xdp_rxq); err = -ENOMEM ; goto err_exit; } - ring =aq_ring_rx_alloc (&self->ring[i][AQ_VEC_RX_ID ], aq_nic, - idx_ring, aq_nic_cfg); -if (!ring) { -xdp_rxq_info_unreg (&self->ring[i][AQ_VEC_RX_ID ].xdp_rxq); - err = -ENOMEM ; + err =aq_ring_rx_alloc (ring, aq_nic, idx_ring, aq_nic_cfg); +if (err) { +xdp_rxq_info_unreg (&ring->xdp_rxq); goto err_exit; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/219 net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Waldekranz <[email protected]>
[ Upstream commit fc82a08ae795ee6b73fb6b50785f7be248bec7b5 ]
mv88e6xxx_get_stats, which collects stats from various sources, expects all callees to return the number of stats read. If an error occurs, 0 should be returned.
Prevent future mishaps of this kind by updating the return type to reflect this contract.
--- drivers/net/dsa/mv88e6xxx/chip.h | 4 ++-- drivers/net/dsa/mv88e6xxx/serdes.c | 10 +++++----- drivers/net/dsa/mv88e6xxx/serdes.h | 8 ++++---- 3 files changed, 11 insertions(+), 11 deletions(-)
drivers/net/dsa/mv88e6xxx/chip.h +2 -2
@@ -601,8 +601,8 @@ struct mv88e6xxx_ops {int (*serdes_get_sset_count)(struct mv88e6xxx_chip *chip,int port);int (*serdes_get_strings)(struct mv88e6xxx_chip *chip,int port,uint8_t *data); -int (*serdes_get_stats)(struct mv88e6xxx_chip *chip,int port, -uint64_t *data); +size_t (*serdes_get_stats)(struct mv88e6xxx_chip *chip,int port, +uint64_t *data);/* SERDES registers for ethtool */ int (*serdes_get_regs_len)(struct mv88e6xxx_chip *chip,int port);
drivers/net/dsa/mv88e6xxx/serdes.c +5 -5
@@ -342,8 +342,8 @@ static uint64_t mv88e6352_serdes_get_stat(struct mv88e6xxx_chip *chip,return val; } -int mv88e6352_serdes_get_stats (struct mv88e6xxx_chip *chip,int port, -uint64_t *data) +size_t mv88e6352_serdes_get_stats (struct mv88e6xxx_chip *chip,int port, +uint64_t *data) {struct mv88e6xxx_port *mv88e6xxx_port = &chip->ports[port];struct mv88e6352_serdes_hw_stat *stat;
@@ -352,7 +352,7 @@ int mv88e6352_serdes_get_stats(struct mv88e6xxx_chip *chip, int port, err =mv88e6352_g2_scratch_port_has_serdes (chip, port);if (err <=0 ) -return err; +return 0 ;BUILD_BUG_ON (ARRAY_SIZE (mv88e6352_serdes_hw_stats) >ARRAY_SIZE (mv88e6xxx_port->serdes_stats));
@@ -798,8 +798,8 @@ static uint64_t mv88e6390_serdes_get_stat(struct mv88e6xxx_chip *chip, int lane,return reg[0 ] | ((u64 )reg[1 ] <<16 ) | ((u64 )reg[2 ] <<32 ); } -int mv88e6390_serdes_get_stats (struct mv88e6xxx_chip *chip,int port, -uint64_t *data) +size_t mv88e6390_serdes_get_stats (struct mv88e6xxx_chip *chip,int port, +uint64_t *data) {struct mv88e6390_serdes_hw_stat *stat;int lane;
drivers/net/dsa/mv88e6xxx/serdes.h +4 -4
@@ -165,13 +165,13 @@ irqreturn_t mv88e6393x_serdes_irq_status(struct mv88e6xxx_chip *chip, int port,int mv88e6352_serdes_get_sset_count (struct mv88e6xxx_chip *chip,int port);int mv88e6352_serdes_get_strings (struct mv88e6xxx_chip *chip,int port,uint8_t *data); -int mv88e6352_serdes_get_stats (struct mv88e6xxx_chip *chip,int port, -uint64_t *data); +size_t mv88e6352_serdes_get_stats (struct mv88e6xxx_chip *chip,int port, +uint64_t *data);int mv88e6390_serdes_get_sset_count (struct mv88e6xxx_chip *chip,int port);int mv88e6390_serdes_get_strings (struct mv88e6xxx_chip *chip,int port,uint8_t *data); -int mv88e6390_serdes_get_stats (struct mv88e6xxx_chip *chip,int port, -uint64_t *data); +size_t mv88e6390_serdes_get_stats (struct mv88e6xxx_chip *chip,int port, +uint64_t *data);int mv88e6352_serdes_get_regs_len (struct mv88e6xxx_chip *chip,int port);void mv88e6352_serdes_get_regs (struct mv88e6xxx_chip *chip,int port,void *_p);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/219 block: prevent an integer overflow in bvec_try_merge_hw_page
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 3f034c374ad55773c12dd8f3c1607328e17c0072 ]
Reordered a check to avoid a possible overflow when adding len to bv_len.
--- block/bio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/bio.c +1 -1
@@ -927,7 +927,7 @@ static bool bio_try_merge_hw_seg(struct request_queue *q, struct bio *bio,if ((addr1 | mask) != (addr2 | mask))return false; -if (bv->bv_len + len >queue_max_segment_size (q)) +if (len >queue_max_segment_size (q) - bv->bv_len)return false;return __bio_try_merge_page (bio, page, len, offset, same_page); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/219 md: Whenassemble the array, consult the superblock of the freshest device
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Lyakas <[email protected]>
[ Upstream commit dc1cc22ed58f11d58d8553c5ec5f11cbfc3e3039 ]
Upon assembling the array, both kernel and mdadm allow the devices to have event counter difference of 1, and still consider them as up-to-date. However, a device whose event count is behind by 1, may in fact not be up-to-date, and array resync with such a device may cause data corruption.
To avoid this, consult the superblock of the freshest device about the status of a device, whose event counter is behind by 1.
--- drivers/md/md.c | 54 ++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 44 insertions(+), 10 deletions(-)
drivers/md/md.c +44 -10
@@ -1145,6 +1145,7 @@ struct super_type {struct md_rdev *refdev, int minor_version);int (*validate_super)(struct mddev *mddev, +struct md_rdev *freshest,struct md_rdev *rdev);void (*sync_super)(struct mddev *mddev,struct md_rdev *rdev);
@@ -1282,8 +1283,9 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor/* * validate_super for 0.90.0 +* note: we are not using "freshest" for 0.9 superblock */ -static int super_90_validate (struct mddev *mddev,struct md_rdev *rdev) +static int super_90_validate (struct mddev *mddev,struct md_rdev *freshest,struct md_rdev *rdev) {mdp_disk_t *desc;mdp_super_t *sb =page_address (rdev->sb_page);
@@ -1795,7 +1797,7 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_return ret; } -static int super_1_validate (struct mddev *mddev,struct md_rdev *rdev) +static int super_1_validate (struct mddev *mddev,struct md_rdev *freshest,struct md_rdev *rdev) {struct mdp_superblock_1 *sb =page_address (rdev->sb_page);__u64 ev1 =le64_to_cpu (sb->events);
@@ -1891,13 +1893,15 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev) } }else if (mddev->pers ==NULL ) {/* Insist of good event counter while assembling, except for -* spares (which don't need an event count) */ - ++ev1; +* spares (which don't need an event count). +* Similar to mdadm, we allow event counter difference of 1 +* from the freshest device. +*/ if (rdev->desc_nr >=0 && rdev->desc_nr <le32_to_cpu (sb->max_dev) && (le16_to_cpu (sb->dev_roles[rdev->desc_nr]) <MD_DISK_ROLE_MAX ||le16_to_cpu (sb->dev_roles[rdev->desc_nr]) ==MD_DISK_ROLE_JOURNAL )) -if (ev1 < mddev->events) +if (ev1 +1 < mddev->events)return -EINVAL ; }else if (mddev->bitmap) {/* If adding to array with a bitmap, then we can accept an
@@ -1918,8 +1922,38 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev) rdev->desc_nr >= le32_to_cpu(sb->max_dev)) { role =MD_DISK_ROLE_SPARE ; rdev->desc_nr =-1 ; - } else + } else if (mddev->pers == NULL && freshest && ev1 < mddev->events) { +/* +* If we are assembling, and our event counter is smaller than the +* highest event counter, we cannot trust our superblock about the role. +* It could happen that our rdev was marked as Faulty, and all other +* superblocks were updated with +1 event counter. +* Then, before the next superblock update, which typically happens when +* remove_and_add_spares() removes the device from the array, there was +* a crash or reboot. +* If we allow current rdev without consulting the freshest superblock, +* we could cause data corruption. +* Note that in this case our event counter is smaller by 1 than the +* highest, otherwise, this rdev would not be allowed into array; +* both kernel and mdadm allow event counter difference of 1. +*/ +struct mdp_superblock_1 *freshest_sb =page_address (freshest->sb_page); +u32 freshest_max_dev =le32_to_cpu (freshest_sb->max_dev); + +if (rdev->desc_nr >= freshest_max_dev) { +/* this is unexpected, better not proceed */ +pr_warn ("md: %s: rdev[%pg]: desc_nr(%d) >= freshest(%pg)->sb->max_dev(%u)\n" , +mdname (mddev), rdev->bdev, rdev->desc_nr, + freshest->bdev, freshest_max_dev); +return -EUCLEAN ; + } + + role =le16_to_cpu (freshest_sb->dev_roles[rdev->desc_nr]); +pr_debug ("md: %s: rdev[%pg]: role=%d(0x%x) according to freshest %pg\n" , +mdname (mddev), rdev->bdev, role, role, freshest->bdev); + } else { role =le16_to_cpu (sb->dev_roles[rdev->desc_nr]); + }switch (role) {case MD_DISK_ROLE_SPARE :/* spare */ break ;
@@ -2861,7 +2895,7 @@ static int add_bound_rdev(struct md_rdev *rdev)* and should be added immediately. */ super_types[mddev->major_version]. -validate_super (mddev, rdev); +validate_super (mddev,NULL /*freshest*/ , rdev);if (add_journal)mddev_suspend (mddev); err = mddev->pers->hot_add_disk (mddev, rdev);
@@ -3775,7 +3809,7 @@ static int analyze_sbs(struct mddev *mddev) } super_types[mddev->major_version]. -validate_super (mddev, freshest); +validate_super (mddev,NULL /*freshest*/ , freshest); i =0 ;rdev_for_each_safe (rdev, tmp, mddev) {
@@ -3790,7 +3824,7 @@ static int analyze_sbs(struct mddev *mddev) }if (rdev != freshest) {if (super_types[mddev->major_version]. -validate_super (mddev, rdev)) { +validate_super (mddev, freshest, rdev)) {pr_warn ("md: kicking non-fresh %pg from array!\n" , rdev->bdev);md_kick_rdev_from_array (rdev);
@@ -6804,7 +6838,7 @@ int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info) rdev->saved_raid_disk = rdev->raid_disk; }else super_types[mddev->major_version]. -validate_super (mddev, rdev); +validate_super (mddev,NULL /*freshest*/ , rdev);if ((info->state & (1 <<MD_DISK_SYNC )) && rdev->raid_disk != info->raid_disk) {/* This was a hot-add request, but events doesn't
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/219 arm64: dts: qcom: msm8996: Fix in-ports is a required property
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mao Jinlong <[email protected]>
[ Upstream commit 9a6fc510a6a3ec150cb7450aec1e5f257e6fc77b ]
Add the inport of funnel@3023000 to fix 'in-ports' is a required property warning.
--- arch/arm64/boot/dts/qcom/msm8996.dtsi | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
arch/arm64/boot/dts/qcom/msm8996.dtsi +21 -0
@@ -390,6 +390,19 @@ reg = <0x0 0x80000000 0x0 0x0>; }; + etm { + compatible = "qcom,coresight-remote-etm"; + + out-ports { + port { + modem_etm_out_funnel_in2: endpoint { + remote-endpoint = + <&funnel_in2_in_modem_etm>; + }; + }; + }; + }; + psci { compatible = "arm,psci-1.0"; method = "smc";
@@ -2565,6 +2578,14 @@ clocks = <&rpmcc RPM_QDSS_CLK>, <&rpmcc RPM_QDSS_A_CLK>; clock-names = "apb_pclk", "atclk"; + in-ports { + port { + funnel_in2_in_modem_etm: endpoint { + remote-endpoint = + <&modem_etm_out_funnel_in2>; + }; + }; + }; out-ports { port {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/219 arm64: dts: qcom: msm8998: Fix out-ports is a required property
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mao Jinlong <[email protected]>
[ Upstream commit ae5ee3562a2519214b12228545e88a203dd68bbd ]
out-ports is a required property for coresight ETM. Add out-ports for ETM nodes to fix the warning.
--- arch/arm64/boot/dts/qcom/msm8998.dtsi | 32 +++++++++++++++++---------- 1 file changed, 20 insertions(+), 12 deletions(-)
arch/arm64/boot/dts/qcom/msm8998.dtsi +20 -12
@@ -1903,9 +1903,11 @@ cpu = <&CPU4>; - port{ - etm4_out: endpoint { - remote-endpoint = <&apss_funnel_in4>; + out-ports { + port{ + etm4_out: endpoint { + remote-endpoint = <&apss_funnel_in4>; + }; }; }; };
@@ -1920,9 +1922,11 @@ cpu = <&CPU5>; - port{ - etm5_out: endpoint { - remote-endpoint = <&apss_funnel_in5>; + out-ports { + port{ + etm5_out: endpoint { + remote-endpoint = <&apss_funnel_in5>; + }; }; }; };
@@ -1937,9 +1941,11 @@ cpu = <&CPU6>; - port{ - etm6_out: endpoint { - remote-endpoint = <&apss_funnel_in6>; + out-ports { + port{ + etm6_out: endpoint { + remote-endpoint = <&apss_funnel_in6>; + }; }; }; };
@@ -1954,9 +1960,11 @@ cpu = <&CPU7>; - port{ - etm7_out: endpoint { - remote-endpoint = <&apss_funnel_in7>; + out-ports { + port{ + etm7_out: endpoint { + remote-endpoint = <&apss_funnel_in7>; + }; }; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/219 ice: fix pre-shifted bit usage
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Brandeburg <[email protected]>
[ Upstream commit 7173be21ae29ef50ada42fd4464056a9d3f55bb3 ]
While converting to FIELD_PREP() and FIELD_GET(), it was noticed that some of the RSS defines had *included* the shift in their definitions. This is completely outside of normal, such that a developer could easily make a mistake and shift at the usage site (like when using FIELD_PREP()).
Rename the defines and set them to the "pre-shifted values" so they match the template the driver normally uses for masks and the member bits of the mask, which also allows the driver to use FIELD_PREP correctly with these values. Use GENMASK() for this changed MASK value.
Do the same for the VLAN EMODE defines as well.
--- drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 10 +++++----- drivers/net/ethernet/intel/ice/ice_lib.c | 3 ++- .../net/ethernet/intel/ice/ice_vsi_vlan_lib.c | 16 +++++++++++----- 3 files changed, 18 insertions(+), 11 deletions(-)
drivers/net/ethernet/intel/ice/ice_adminq_cmd.h +5 -5
@@ -413,10 +413,10 @@ struct ice_aqc_vsi_props {#define ICE_AQ_VSI_INNER_VLAN_INSERT_PVID BIT(2)#define ICE_AQ_VSI_INNER_VLAN_EMODE_S 3#define ICE_AQ_VSI_INNER_VLAN_EMODE_M (0x3 << ICE_AQ_VSI_INNER_VLAN_EMODE_S) -#define ICE_AQ_VSI_INNER_VLAN_EMODE_STR_BOTH (0x0 << ICE_AQ_VSI_INNER_VLAN_EMODE_S) -#define ICE_AQ_VSI_INNER_VLAN_EMODE_STR_UP (0x1 << ICE_AQ_VSI_INNER_VLAN_EMODE_S) -#define ICE_AQ_VSI_INNER_VLAN_EMODE_STR (0x2 << ICE_AQ_VSI_INNER_VLAN_EMODE_S) -#define ICE_AQ_VSI_INNER_VLAN_EMODE_NOTHING (0x3 << ICE_AQ_VSI_INNER_VLAN_EMODE_S) +#define ICE_AQ_VSI_INNER_VLAN_EMODE_STR_BOTH 0x0U +#define ICE_AQ_VSI_INNER_VLAN_EMODE_STR_UP 0x1U +#define ICE_AQ_VSI_INNER_VLAN_EMODE_STR 0x2U +#define ICE_AQ_VSI_INNER_VLAN_EMODE_NOTHING 0x3Uu8 inner_vlan_reserved2[3 ];/* ingress egress up sections */ __le32 ingress_table;/* bitmap, 3 bits per up */
@@ -482,7 +482,7 @@ struct ice_aqc_vsi_props {#define ICE_AQ_VSI_Q_OPT_RSS_GBL_LUT_S 2#define ICE_AQ_VSI_Q_OPT_RSS_GBL_LUT_M (0xF << ICE_AQ_VSI_Q_OPT_RSS_GBL_LUT_S)#define ICE_AQ_VSI_Q_OPT_RSS_HASH_S 6 -#define ICE_AQ_VSI_Q_OPT_RSS_HASH_M (0x3 << ICE_AQ_VSI_Q_OPT_RSS_HASH_S) +#define ICE_AQ_VSI_Q_OPT_RSS_HASH_M GENMASK(7, 6)#define ICE_AQ_VSI_Q_OPT_RSS_HASH_TPLZ 0x0U#define ICE_AQ_VSI_Q_OPT_RSS_HASH_SYM_TPLZ 0x1U#define ICE_AQ_VSI_Q_OPT_RSS_HASH_XOR 0x2U
drivers/net/ethernet/intel/ice/ice_lib.c +2 -1
@@ -878,7 +878,8 @@ static void ice_set_dflt_vsi_ctx(struct ice_hw *hw, struct ice_vsi_ctx *ctxt)*/ if (ice_is_dvm_ena (hw)) { ctxt->info.inner_vlan_flags |= -ICE_AQ_VSI_INNER_VLAN_EMODE_NOTHING ; +FIELD_PREP (ICE_AQ_VSI_INNER_VLAN_EMODE_M , +ICE_AQ_VSI_INNER_VLAN_EMODE_NOTHING ); ctxt->info.outer_vlan_flags = (ICE_AQ_VSI_OUTER_VLAN_TX_MODE_ALL << ICE_AQ_VSI_OUTER_VLAN_TX_MODE_S) &
drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.c +11 -5
@@ -131,6 +131,7 @@ static int ice_vsi_manage_vlan_stripping(struct ice_vsi *vsi, bool ena) {struct ice_hw *hw = &vsi->back->hw;struct ice_vsi_ctx *ctxt; +u8 *ivf;int err;/* do not allow modifying VLAN stripping when a port VLAN is configured
@@ -143,19 +144,24 @@ static int ice_vsi_manage_vlan_stripping(struct ice_vsi *vsi, bool ena)if (!ctxt)return -ENOMEM ; + ivf = &ctxt->info.inner_vlan_flags; +/* Here we are configuring what the VSI should do with the VLAN tag in * the Rx packet. We can either leave the tag in the packet or put it in * the Rx descriptor. */ -if (ena) +if (ena) {/* Strip VLAN tag from Rx packet and put it in the desc */ - ctxt->info.inner_vlan_flags =ICE_AQ_VSI_INNER_VLAN_EMODE_STR_BOTH ; -else + *ivf =FIELD_PREP (ICE_AQ_VSI_INNER_VLAN_EMODE_M , +ICE_AQ_VSI_INNER_VLAN_EMODE_STR_BOTH ); + }else {/* Disable stripping. Leave tag in packet */ - ctxt->info.inner_vlan_flags =ICE_AQ_VSI_INNER_VLAN_EMODE_NOTHING ; + *ivf =FIELD_PREP (ICE_AQ_VSI_INNER_VLAN_EMODE_M , +ICE_AQ_VSI_INNER_VLAN_EMODE_NOTHING ); + }/* Allow all packets untagged/tagged */ - ctxt->info.inner_vlan_flags |=ICE_AQ_VSI_INNER_VLAN_TX_MODE_ALL ; + *ivf |=ICE_AQ_VSI_INNER_VLAN_TX_MODE_ALL ; ctxt->info.valid_sections =cpu_to_le16 (ICE_AQ_VSI_PROP_VLAN_VALID );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/219 arm64: dts: amlogic: fix format for s4 uart node
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xianwei Zhao <[email protected]>
[ Upstream commit eb54ef36282f670c704ed5af8593da62bebba80d ]
Aliases use lowercase letters and place status in end.
--- arch/arm64/boot/dts/amlogic/meson-s4-s805x2-aq222.dts | 4 ++-- arch/arm64/boot/dts/amlogic/meson-s4.dtsi | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/amlogic/meson-s4-s805x2-aq222.dts +2 -2
@@ -15,7 +15,7 @@ #size-cells = <2>; aliases { - serial0 = &uart_B; + serial0 = &uart_b; }; memory@0 {
@@ -25,6 +25,6 @@ }; -&uart_B { +&uart_b { status = "okay"; };
arch/arm64/boot/dts/amlogic/meson-s4.dtsi +2 -2
@@ -118,14 +118,14 @@ <10 11 12 13 14 15 16 17 18 19 20 21>; }; - uart_B: serial@7a000 { + uart_b: serial@7a000 { compatible = "amlogic,meson-s4-uart", "amlogic,meson-ao-uart"; reg = <0x0 0x7a000 0x0 0x18>; interrupts = <GIC_SPI 169 IRQ_TYPE_EDGE_RISING>; - status = "disabled"; clocks = <&xtal>, <&xtal>, <&xtal>; clock-names = "xtal", "pclk", "baud"; + status = "disabled"; }; reset: reset-controller@2000 {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/219 wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zenm Chen <[email protected]>
[ Upstream commit 4e87ca403e2008b9e182239e1abbf6876a55eb33 ]
Add additional USB IDs found in the vendor driver from
https://github.com/Mange/rtl8192eu-linux-driver to support more RTL8192EU devices.
--- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +12 -0
@@ -7030,6 +7030,18 @@ static const struct usb_device_id dev_table[] = { .driver_info = (unsigned long)&rtl8192eu_fops}, {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_REALTEK, 0x818c, 0xff, 0xff, 0xff), .driver_info = (unsigned long)&rtl8192eu_fops}, +/* D-Link DWA-131 rev C1 */ +{USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3312, 0xff, 0xff, 0xff), + .driver_info = (unsigned long)&rtl8192eu_fops}, +/* TP-Link TL-WN8200ND V2 */ +{USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x0126, 0xff, 0xff, 0xff), + .driver_info = (unsigned long)&rtl8192eu_fops}, +/* Mercusys MW300UM */ +{USB_DEVICE_AND_INTERFACE_INFO(0x2c4e, 0x0100, 0xff, 0xff, 0xff), + .driver_info = (unsigned long)&rtl8192eu_fops}, +/* Mercusys MW300UH */ +{USB_DEVICE_AND_INTERFACE_INFO(0x2c4e, 0x0104, 0xff, 0xff, 0xff), + .driver_info = (unsigned long)&rtl8192eu_fops}, #endif { } };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/219 libbpf: Fix NULL pointer dereference in bpf_object__collect_prog_relos
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mingyi Zhang <[email protected]>
[ Upstream commit fc3a5534e2a8855427403113cbeb54af5837bbe0 ]
An issue occurred while reading an ELF file in libbpf.c during fuzzing:
Program received signal SIGSEGV, Segmentation fault.
0x0000000000958e97 in bpf_object.collect_prog_relos () at libbpf.c:4206
4206 in libbpf.c
(gdb) bt
#0 0x0000000000958e97 in bpf_object.collect_prog_relos () at libbpf.c:4206
#1 0x000000000094f9d6 in bpf_object.collect_relos () at libbpf.c:6706
#2 0x000000000092bef3 in bpf_object_open () at libbpf.c:7437
#3 0x000000000092c046 in bpf_object.open_mem () at libbpf.c:7497
#4 0x0000000000924afa in LLVMFuzzerTestOneInput () at fuzz/bpf-object-fuzzer.c:16
#5 0x000000000060be11 in testblitz_engine::fuzzer::Fuzzer::run_one ()
#6 0x000000000087ad92 in tracing::span::Span::in_scope ()
#7 0x00000000006078aa in testblitz_engine::fuzzer::util::walkdir ()
#8 0x00000000005f3217 in testblitz_engine::entrypoint::main::{{closure}} ()
#9 0x00000000005f2601 in main ()
(gdb)scn_data was null at this code(tools/lib/bpf/src/libbpf.c):
if (rel->r_offset % BPF_INSN_SZ || rel->r_offset >= scn_data->d_size) {The scn_data is derived from the code above:
scn = elf_sec_by_idx(obj, sec_idx); scn_data = elf_sec_data(obj, scn); relo_sec_name = elf_sec_str(obj, shdr->sh_name); sec_name = elf_sec_name(obj, scn); if (!relo_sec_name || !sec_name)// don't check whether scn_data is NULL return -EINVAL;
In certain special scenarios, such as reading a malformed ELF file, it is possible that scn_data may be a null pointer
--- tools/lib/bpf/libbpf.c | 2 ++ 1 file changed, 2 insertions(+)
tools/lib/bpf/libbpf.c +2 -0
@@ -4157,6 +4157,8 @@ bpf_object__collect_prog_relos(struct bpf_object *obj, Elf64_Shdr *shdr, Elf_Dat scn =elf_sec_by_idx (obj, sec_idx); scn_data =elf_sec_data (obj, scn); +if (!scn_data) +return -LIBBPF_ERRNO__FORMAT ; relo_sec_name =elf_sec_str (obj, shdr->sh_name); sec_name =elf_sec_name (obj, scn);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/219 wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit 5c16618bc06a41ad68fd8499a21d35ef57ca06c2 ]
Using calculate_bit_shift() to replace rtl8723_phy_calculate_bit_shift(). And fix an undefined bitwise shift behavior problem.
--- drivers/net/wireless/realtek/rtlwifi/rtl8723ae/phy.c | 6 +++--- drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8723ae/phy.c +3 -3
@@ -49,7 +49,7 @@ u32 rtl8723e_phy_query_rf_reg(struct ieee80211_hw *hw, rfpath, regaddr); } - bitshift =rtl8723_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); readback_value = (original_value & bitmask) >> bitshift;spin_unlock (&rtlpriv->locks.rf_lock);
@@ -80,7 +80,7 @@ void rtl8723e_phy_set_rf_reg(struct ieee80211_hw *hw, original_value =rtl8723_phy_rf_serial_read (hw, rfpath, regaddr); - bitshift =rtl8723_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((original_value & (~bitmask)) | (data << bitshift));
@@ -89,7 +89,7 @@ void rtl8723e_phy_set_rf_reg(struct ieee80211_hw *hw,rtl8723_phy_rf_serial_write (hw, rfpath, regaddr, data); }else {if (bitmask !=RFREG_OFFSET_MASK ) { - bitshift =rtl8723_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((original_value & (~bitmask)) | (data << bitshift));
drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c +2 -2
@@ -41,7 +41,7 @@ u32 rtl8723be_phy_query_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,spin_lock (&rtlpriv->locks.rf_lock); original_value =rtl8723_phy_rf_serial_read (hw, rfpath, regaddr); - bitshift =rtl8723_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); readback_value = (original_value & bitmask) >> bitshift;spin_unlock (&rtlpriv->locks.rf_lock);
@@ -68,7 +68,7 @@ void rtl8723be_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path path,if (bitmask !=RFREG_OFFSET_MASK ) { original_value =rtl8723_phy_rf_serial_read (hw, path, regaddr); - bitshift =rtl8723_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((original_value & (~bitmask)) | (data << bitshift)); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/219 wifi: cfg80211: free beacon_ies when overridden from hidden BSS
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit 32af9a9e1069e55bc02741fb00ac9d0ca1a2eaef ]
This is a more of a cosmetic fix. The branch will only be taken if proberesp_ies is set, which implies that beacon_ies is not set unless we are connected to an AP that just did a channel switch. And, in that case we should have found the BSS in the internal storage to begin with.
--- net/wireless/scan.c | 4 ++++ 1 file changed, 4 insertions(+)
net/wireless/scan.c +4 -0
@@ -1810,8 +1810,12 @@ cfg80211_bss_update(struct cfg80211_registered_device *rdev,list_add (&new->hidden_list, &hidden->hidden_list); hidden->refcount++; + + ies = (void *)rcu_dereference (new->pub.beacon_ies);rcu_assign_pointer (new->pub.beacon_ies, hidden->pub.beacon_ies); +if (ies) +kfree_rcu (ies, rcu_head); } }else {/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/219 Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for QCA2066
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
[ Upstream commit 5d192b697c7417254cdd9edc3d5e9e0364eb9045 ]
Set both WIDEBAND_SPEECH_SUPPORTED and VALID_LE_STATES quirks for QCA2066.
--- drivers/bluetooth/hci_qca.c | 1 + 1 file changed, 1 insertion(+)
drivers/bluetooth/hci_qca.c +1 -0
@@ -1861,6 +1861,7 @@ static const struct qca_device_data qca_soc_data_wcn3998 = {static const struct qca_device_data qca_soc_data_qca6390 = { .soc_type =QCA_QCA6390 , .num_vregs =0 , + .capabilities =QCA_CAP_WIDEBAND_SPEECH |QCA_CAP_VALID_LE_STATES , };static const struct qca_device_data qca_soc_data_wcn6750 = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/219 Bluetooth: hci_sync: fix BR/EDR wakeup bug
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: clancy shang <[email protected]>
[ Upstream commit d4b70ba1eab450eff9c5ef536f07c01d424b7eda ]
when Bluetooth set the event mask and enter suspend, the controller has hci mode change event coming, it cause controller can not enter sleep mode. so it should to set the hci mode change event mask before enter suspend.
--- net/bluetooth/hci_sync.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
net/bluetooth/hci_sync.c +6 -4
@@ -3780,12 +3780,14 @@ static int hci_set_event_mask_sync(struct hci_dev *hdev)if (lmp_bredr_capable (hdev)) { events[4 ] |=0x01 ;/* Flow Specification Complete */ -/* Don't set Disconnect Complete when suspended as that -* would wakeup the host when disconnecting due to -* suspend. +/* Don't set Disconnect Complete and mode change when +* suspended as that would wakeup the host when disconnecting +* due to suspend. */ -if (hdev->suspended) +if (hdev->suspended) { events[0 ] &=0xef ; + events[2 ] &=0xf7 ; + } }else {/* Use a different default for LE-only devices */ memset (events,0 ,sizeof (events));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/219 Bluetooth: L2CAP: Fix possible multiple reject send
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frédéric Danis <[email protected]>
[ Upstream commit 96a3398b467ab8aada3df2f3a79f4b7835d068b8 ]
In case of an incomplete command or a command with a null identifier 2 reject packets will be sent, one with the identifier and one with 0. Consuming the data of the command will prevent it.
This allows to send a reject packet for each corrupted command in a multi-command packet.
--- net/bluetooth/l2cap_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/bluetooth/l2cap_core.c +2 -1
@@ -6527,7 +6527,8 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn,if (len > skb->len || !cmd->ident) {BT_DBG ("corrupted command" );l2cap_sig_send_rej (conn, cmd->ident); -break ; +skb_pull (skb, len > skb->len ? skb->len : len); +continue ; } err =l2cap_bredr_sig_cmd (conn, cmd, len, skb->data);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/219 net/smc: disable SEID on non-s390 archs where virtual ISM may be used
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wen Gu <[email protected]>
[ Upstream commit c6b8b8eb49904018e22e4e4b1fa502e57dc747d9 ]
The system EID (SEID) is an internal EID used by SMC-D to represent the s390 physical machine that OS is executing on. On s390 architecture, it predefined by fixed string and part of cpuid and is enabled regardless of whether underlay device is virtual ISM or platform firmware ISM.
However on non-s390 architectures where SMC-D can be used with virtual ISM devices, there is no similar information to identify physical machines, especially in virtualization scenarios. So in such cases, SEID is forcibly disabled and the user-defined UEID will be used to represent the communicable space.
--- net/smc/smc_clc.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
net/smc/smc_clc.c +14 -0
@@ -155,10 +155,12 @@ static int smc_clc_ueid_remove(char *ueid) rc =0 ; } } +#if IS_ENABLED (CONFIG_S390 )if (!rc && !smc_clc_eid_table.ueid_cnt) { smc_clc_eid_table.seid_enabled =1 ; rc = -EAGAIN ;/* indicate success and enabling of seid */ } +#endif write_unlock (&smc_clc_eid_table.lock);return rc; }
@@ -273,22 +275,30 @@ int smc_nl_dump_seid(struct sk_buff *skb, struct netlink_callback *cb)int smc_nl_enable_seid (struct sk_buff *skb,struct genl_info *info) { +#if IS_ENABLED (CONFIG_S390 )write_lock (&smc_clc_eid_table.lock); smc_clc_eid_table.seid_enabled =1 ;write_unlock (&smc_clc_eid_table.lock);return 0 ; +#else +return -EOPNOTSUPP ; +#endif }int smc_nl_disable_seid (struct sk_buff *skb,struct genl_info *info) {int rc =0 ; +#if IS_ENABLED (CONFIG_S390 )write_lock (&smc_clc_eid_table.lock);if (!smc_clc_eid_table.ueid_cnt) rc = -ENOENT ;else smc_clc_eid_table.seid_enabled =0 ;write_unlock (&smc_clc_eid_table.lock); +#else + rc = -EOPNOTSUPP ; +#endif return rc; }
@@ -1168,7 +1178,11 @@ void __init smc_clc_init(void)INIT_LIST_HEAD (&smc_clc_eid_table.list);rwlock_init (&smc_clc_eid_table.lock); smc_clc_eid_table.ueid_cnt =0 ; +#if IS_ENABLED (CONFIG_S390 ) smc_clc_eid_table.seid_enabled =1 ; +#else + smc_clc_eid_table.seid_enabled =0 ; +#endif }void smc_clc_exit (void )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/219 bridge: cfm: fix enum typo in br_cc_ccm_tx_parse
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <[email protected]>
[ Upstream commit c2b2ee36250d967c21890cb801e24af4b6a9eaa5 ]
It appears that there is a typo in the code where the nlattr array is being parsed with policy br_cfm_cc_ccm_tx_policy, but the instance is being accessed via IFLA_BRIDGE_CFM_CC_RDI_INSTANCE, which is associated with the policy br_cfm_cc_rdi_policy.
This problem was introduced by commit 2be665c3940d ("bridge: cfm: Netlink SET configuration Interface.").
Though it seems like a harmless typo since these two enum owns the exact same value (1 here), it is quite misleading hence fix it by using the correct enum IFLA_BRIDGE_CFM_CC_CCM_TX_INSTANCE here.
--- net/bridge/br_cfm_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bridge/br_cfm_netlink.c +1 -1
@@ -362,7 +362,7 @@ static int br_cc_ccm_tx_parse(struct net_bridge *br, struct nlattr *attr,memset (&tx_info,0 ,sizeof (tx_info)); - instance =nla_get_u32 (tb[IFLA_BRIDGE_CFM_CC_RDI_INSTANCE ]); + instance =nla_get_u32 (tb[IFLA_BRIDGE_CFM_CC_CCM_TX_INSTANCE ]);nla_memcpy (&tx_info.dmac.addr, tb[IFLA_BRIDGE_CFM_CC_CCM_TX_DMAC ],sizeof (tx_info.dmac.addr));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/219 i40e: Fix VF disable behavior to block all traffic
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Staikov <[email protected]>
[ Upstream commit 31deb12e85c35ddd2c037f0107d05d8674cab2c0 ]
Currently, if a VF is disabled using the
'ip link set dev $ETHX vf $VF_NUM state disable' command, the VF is still able to receive traffic.
Fix the behavior of the 'ip link set dev $ETHX vf $VF_NUM state disable' to completely shutdown the VF's queues making it entirely disabled and not able to receive or send any traffic.
Modify the behavior of the 'ip link set $ETHX vf $VF_NUM state enable' command to make a VF do reinitialization bringing the queues back up.
--- .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 32 +++++++++++++++++++ .../ethernet/intel/i40e/i40e_virtchnl_pf.h | 1 + 2 files changed, 33 insertions(+)
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +32 -0
@@ -2603,6 +2603,14 @@ static int i40e_vc_enable_queues_msg(struct i40e_vf *vf, u8 *msg)int aq_ret =0 ;int i; +if (vf->is_disabled_from_host) { + aq_ret = -EPERM ; +dev_info (&pf->pdev->dev, +"Admin has disabled VF %d, will not enable queues\n" , + vf->vf_id); + goto error_param; + } +if (!test_bit (I40E_VF_STATE_ACTIVE , &vf->vf_states)) { aq_ret =I40E_ERR_PARAM ; goto error_param;
@@ -4656,9 +4664,12 @@ int i40e_ndo_set_vf_link_state(struct net_device *netdev, int vf_id, int link)struct i40e_link_status *ls = &pf->hw.phy.link_info;struct virtchnl_pf_event pfe;struct i40e_hw *hw = &pf->hw; +struct i40e_vsi *vsi; +unsigned long q_map;struct i40e_vf *vf;int abs_vf_id;int ret =0 ; +int tmp;if (test_and_set_bit (__I40E_VIRTCHNL_OP_PENDING, pf->state)) {dev_warn (&pf->pdev->dev,"Unable to configure VFs, other operation is pending.\n" );
@@ -4681,17 +4692,38 @@ int i40e_ndo_set_vf_link_state(struct net_device *netdev, int vf_id, int link)switch (link) {case IFLA_VF_LINK_STATE_AUTO : vf->link_forced = false; + vf->is_disabled_from_host = false; +/* reset needed to reinit VF resources */ +i40e_vc_reset_vf (vf, true);i40e_set_vf_link_state (vf, &pfe, ls);break ;case IFLA_VF_LINK_STATE_ENABLE : vf->link_forced = true; vf->link_up = true; + vf->is_disabled_from_host = false; +/* reset needed to reinit VF resources */ +i40e_vc_reset_vf (vf, true);i40e_set_vf_link_state (vf, &pfe, ls);break ;case IFLA_VF_LINK_STATE_DISABLE : vf->link_forced = true; vf->link_up = false;i40e_set_vf_link_state (vf, &pfe, ls); + + vsi = pf->vsi[vf->lan_vsi_idx]; + q_map =BIT (vsi->num_queue_pairs) -1 ; + + vf->is_disabled_from_host = true; + +/* Try to stop both Tx&Rx rings even if one of the calls fails +* to ensure we stop the rings even in case of errors. +* If any of them returns with an error then the first +* error that occurred will be returned. +*/ + tmp =i40e_ctrl_vf_tx_rings (vsi, q_map, false); + ret =i40e_ctrl_vf_rx_rings (vsi, q_map, false); + + ret = tmp ? tmp : ret;break ;default : ret = -EINVAL ;
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h +1 -0
@@ -98,6 +98,7 @@ struct i40e_vf {bool link_forced;bool link_up;/* only valid if VF link is forced */ bool spoofchk; +bool is_disabled_from_host;/* PF ctrl of VF enable/disable */ u16 num_vlan;/* ADq related variables */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/219 octeontx2-af: Fix max NPC MCAM entry check while validating ref_entry
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suman Ghosh <[email protected]>
[ Upstream commit 4ebb1f95e0c3c3e0eec5bb21aa43097580c4b6e4 ]
As of today, the last MCAM entry was not getting allocated because of a <= check with the max_bmap count. This patch modifies that and if the requested entry is greater than the available entries then set it to the max value.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +6 -7
@@ -2678,18 +2678,17 @@ int rvu_mbox_handler_npc_mcam_alloc_entry(struct rvu *rvu, rsp->entry =NPC_MCAM_ENTRY_INVALID ; rsp->free_count =0 ; -/* Check if ref_entry is within range */ -if (req->priority && req->ref_entry >= mcam->bmap_entries) { -dev_err (rvu->dev,"%s: reference entry %d is out of range\n" , - __func__, req->ref_entry); -return NPC_MCAM_INVALID_REQ ; - } +/* Check if ref_entry is greater that the range +* then set it to max value. +*/ +if (req->ref_entry > mcam->bmap_entries) + req->ref_entry = mcam->bmap_entries;/* ref_entry can't be '0' if requested priority is high. * Can't be last entry if requested priority is low. */ if ((!req->ref_entry && req->priority ==NPC_MCAM_HIGHER_PRIO ) || - ((req->ref_entry == (mcam->bmap_entries -1 )) && + ((req->ref_entry == mcam->bmap_entries) && req->priority ==NPC_MCAM_LOWER_PRIO ))return NPC_MCAM_INVALID_REQ ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/219 net: dsa: qca8k: put MDIO bus OF node on qca8k_mdio_register() failure
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit 68e1010cda7967cfca9c8650ee1f4efcae54ab90 ]
of_get_child_by_name() gives us an OF node with an elevated refcount, which should be dropped when we're done with it. This is so that, if (of_node_check_flag(node, OF_DYNAMIC)) is true, the node's memory can eventually be freed.
There are 2 distinct paths to be considered in qca8k_mdio_register():
- devm_of_mdiobus_register() succeeds: since commit 3b73a7b8ec38 ("net:
mdio_bus: add refcounting for fwnodes to mdiobus"), the MDIO core treats this well.
- devm_of_mdiobus_register() or anything up to that point fails: it is the duty of the qca8k driver to release the OF node.
This change addresses the second case by making sure that the OF node reference is not leaked.
The "mdio" node may be NULL, but of_node_put(NULL) is safe.
--- drivers/net/dsa/qca/qca8k-8xxx.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
drivers/net/dsa/qca/qca8k-8xxx.c +16 -5
@@ -842,10 +842,15 @@ qca8k_mdio_register(struct qca8k_priv *priv)struct dsa_switch *ds = priv->ds;struct device_node *mdio;struct mii_bus *bus; +int err; + + mdio =of_get_child_by_name (priv->dev->of_node,"mdio" ); bus =devm_mdiobus_alloc (ds->dev); -if (!bus) -return -ENOMEM ; +if (!bus) { + err = -ENOMEM ; + goto out_put_node; + } bus->priv = (void *)priv; snprintf(bus->id, MII_BUS_ID_SIZE, "qca8k-%d.%d",
@@ -855,12 +860,12 @@ qca8k_mdio_register(struct qca8k_priv *priv) ds->slave_mii_bus = bus;/* Check if the devicetree declare the port:phy mapping */ - mdio =of_get_child_by_name (priv->dev->of_node,"mdio" );if (of_device_is_available (mdio)) { bus->name ="qca8k slave mii" ; bus->read = qca8k_internal_mdio_read; bus->write = qca8k_internal_mdio_write; -return devm_of_mdiobus_register (priv->dev, bus, mdio); + err =devm_of_mdiobus_register (priv->dev, bus, mdio); + goto out_put_node; }/* If a mapping can't be found the legacy mapping is used,
@@ -869,7 +874,13 @@ qca8k_mdio_register(struct qca8k_priv *priv) bus->name ="qca8k-legacy slave mii" ; bus->read = qca8k_legacy_mdio_read; bus->write = qca8k_legacy_mdio_write; -return devm_mdiobus_register (priv->dev, bus); + + err =devm_mdiobus_register (priv->dev, bus); + +out_put_node: +of_node_put (mdio); + +return err; } static int
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/219 f2fs: fix to check return value of f2fs_reserve_new_block()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 956fa1ddc132e028f3b7d4cf17e6bfc8cb36c7fd ]
Let's check return value of f2fs_reserve_new_block() in do_recover_data() rather than letting it fails silently.
Also refactoring check condition on return value of f2fs_reserve_new_block() as below:
- trigger f2fs_bug_on() only for ENOSPC case;
- use do-while statement to avoid redundant codes;
--- fs/f2fs/recovery.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-)
fs/f2fs/recovery.c +17 -6
@@ -683,7 +683,16 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode,*/ if (dest ==NEW_ADDR ) {f2fs_truncate_data_blocks_range (&dn,1 ); -f2fs_reserve_new_block (&dn); +do { + err =f2fs_reserve_new_block (&dn); +if (err == -ENOSPC ) { +f2fs_bug_on (sbi,1 ); +break ; + } + }while (err && +IS_ENABLED (CONFIG_F2FS_FAULT_INJECTION )); +if (err) + goto err;continue ; }
@@ -691,12 +700,14 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode,if (f2fs_is_valid_blkaddr (sbi, dest,META_POR )) {if (src ==NULL_ADDR ) { - err =f2fs_reserve_new_block (&dn); -while (err && -IS_ENABLED (CONFIG_F2FS_FAULT_INJECTION )) +do { err =f2fs_reserve_new_block (&dn); -/* We should not get -ENOSPC */ -f2fs_bug_on (sbi, err); +if (err == -ENOSPC ) { +f2fs_bug_on (sbi,1 ); +break ; + } + }while (err && +IS_ENABLED (CONFIG_F2FS_FAULT_INJECTION ));if (err) goto err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/219 ALSA: hda: Refer to correct stream index at loops
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 26257869672fd4a06a60c2da841e15fb2cb47bbe ]
In a couple of loops over the all streams, we check the bitmap against the loop counter. A more correct reference would be, however, the index of each stream, instead.
This patch corrects the check of bitmaps to the stream index.
Note that this change doesn't fix anything for now; all existing drivers set up the stream indices properly, hence the loop count is always equal with the stream index. That said, this change is only for consistency.
--- sound/hda/hdac_stream.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
sound/hda/hdac_stream.c +3 -6
@@ -629,17 +629,15 @@ void snd_hdac_stream_timecounter_init(struct hdac_stream *azx_dev,struct hdac_stream *s;bool inited = false;u64 cycle_last =0 ; -int i =0 ;list_for_each_entry (s, &bus->stream_list, list) { -if (streams & (1 << i)) { +if ((streams & (1 << s->index))) {azx_timecounter_init (s, inited, cycle_last);if (!inited) { inited = true; cycle_last = s->tc.cycle_last; } } - i++; }snd_pcm_gettime (runtime, &runtime->trigger_tstamp);
@@ -684,14 +682,13 @@ void snd_hdac_stream_sync(struct hdac_stream *azx_dev, bool start, unsigned int streams) {struct hdac_bus *bus = azx_dev->bus; -int i, nwait, timeout; +int nwait, timeout;struct hdac_stream *s;for (timeout =5000 ; timeout; timeout--) { nwait =0 ; - i =0 ;list_for_each_entry (s, &bus->stream_list, list) { -if (!(streams & (1 << i++))) +if (!(streams & (1 << s->index)))continue ;if (start) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/219 ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit 67c7666fe808c3a7af3cc6f9d0a3dd3acfd26115 ]
The virtual widget example makes use of an undefined SND_SOC_DAPM_NOPM argument passed to SND_SOC_DAPM_MIXER(). Replace with the correct SND_SOC_NOPM definition.
--- Documentation/sound/soc/dapm.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/sound/soc/dapm.rst +1 -1
@@ -234,7 +234,7 @@ corresponding soft power control. In this case it is necessary to create a virtual widget - a widget with no control bits e.g. :: - SND_SOC_DAPM_MIXER("AC97 Mixer", SND_SOC_DAPM_NOPM, 0, 0, NULL, 0), + SND_SOC_DAPM_MIXER("AC97 Mixer", SND_SOC_NOPM, 0, 0, NULL, 0), This can be used to merge to signal paths together in software.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/219 fast_dput(): handle underflows gracefully
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 504e08cebe1d4e1efe25f915234f646e74a364a8 ]
If refcount is less than 1, we should just warn, unlock dentry and return true, so that the caller doesn't try to do anything else.
Taking care of that leaves the rest of "lockref_put_return() has failed" case equivalent to "decrement refcount and rejoin the normal slow path after the point where we grab ->d_lock".
NOTE: lockref_put_return() is strictly a fastpath thing - unlike the rest of lockref primitives, it does not contain a fallback. Caller (and it looks like fast_dput() is the only legitimate one in the entire kernel) has to do that itself. Reasons for lockref_put_return() failures:
* ->d_lock held by somebody
* refcount <= 0
* ... or an architecture not supporting lockref use of
cmpxchg - sparc, anything non-SMP, config with spinlock debugging...
We could add a fallback, but it would be a clumsy API - we'd have to distinguish between:
(1) refcount > 1 - decremented, lock not held on return
(2) refcount < 1 - left alone, probably no sense to hold the lock
(3) refcount is 1, no cmphxcg - decremented, lock held on return
(4) refcount is 1, cmphxcg supported - decremented, lock *NOT* held on return.
We want to return with no lock held in case (4); that's the whole point of that thing. We very much do not want to have the fallback in case (3) return without a lock, since the caller might have to retake it in that case.
So it wouldn't be more convenient than doing the fallback in the caller and it would be very easy to screw up, especially since the test coverage would suck - no way to test (3) and (4) on the same kernel build.
--- fs/dcache.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/dcache.c +4 -3
@@ -787,12 +787,12 @@ static inline bool fast_dput(struct dentry *dentry)*/ if (unlikely (ret <0 )) {spin_lock (&dentry->d_lock); -if (dentry->d_lockref.count >1 ) { - dentry->d_lockref.count--; +if (WARN_ON_ONCE (dentry->d_lockref.count <=0 )) {spin_unlock (&dentry->d_lock);return true; } -return false; + dentry->d_lockref.count--; + goto locked; }/*
@@ -850,6 +850,7 @@ static inline bool fast_dput(struct dentry *dentry)* else could have killed it and marked it dead. Either way, we * don't need to do anything else. */ +locked:if (dentry->d_lockref.count) {spin_unlock (&dentry->d_lock);return true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/219 RDMA/IPoIB: Fix error code return in ipoib_mcast_join
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Wang <[email protected]>
[ Upstream commit 753fff78f430704548f45eda52d6d55371a52c0f ]
Return the error code in case of ib_sa_join_multicast fail.
--- drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/ulp/ipoib/ipoib_multicast.c +1 -0
@@ -546,6 +546,7 @@ static int ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)spin_unlock_irq (&priv->lock);complete (&mcast->done);spin_lock_irq (&priv->lock); +return ret; }return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/219 drm/panel-edp: Add override_edid_mode quirk for generic edp
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hsin-Yi Wang <[email protected]>
[ Upstream commit 9f7843b515811aea6c56527eb195b622e9c01f12 ]
Generic edp gets mode from edid. However, some panels report incorrect mode in this way, resulting in glitches on panel. Introduce a new quirk additional_mode to the generic edid to pick a correct hardcoded mode.
--- drivers/gpu/drm/panel/panel-edp.c | 48 +++++++++++++++++++++++++++++-- 1 file changed, 45 insertions(+), 3 deletions(-)
drivers/gpu/drm/panel/panel-edp.c +45 -3
@@ -203,6 +203,9 @@ struct edp_panel_entry {/** @name: Name of this panel (for printing to logs). */ const char *name; + +/** @override_edid_mode: Override the mode obtained by edid. */ +const struct drm_display_mode *override_edid_mode; };struct panel_edp {
@@ -301,6 +304,24 @@ static unsigned int panel_edp_get_display_modes(struct panel_edp *panel,return num; } +static int panel_edp_override_edid_mode (struct panel_edp *panel, +struct drm_connector *connector, +const struct drm_display_mode *override_mode) +{ +struct drm_display_mode *mode; + + mode =drm_mode_duplicate (connector->dev, override_mode); +if (!mode) { +dev_err (panel->base.dev,"failed to add additional mode\n" ); +return 0 ; + } + + mode->type |=DRM_MODE_TYPE_DRIVER |DRM_MODE_TYPE_PREFERRED ; +drm_mode_set_name (mode); +drm_mode_probed_add (connector, mode); +return 1 ; +} +static int panel_edp_get_non_edid_modes (struct panel_edp *panel,struct drm_connector *connector) {
@@ -568,6 +589,9 @@ static int panel_edp_get_modes(struct drm_panel *panel, {struct panel_edp *p =to_panel_edp (panel);int num =0 ; +bool has_override_edid_mode = p->detected_panel && + p->detected_panel !=ERR_PTR (-EINVAL ) && + p->detected_panel->override_edid_mode;/* probe EDID if a DDC bus is available */ if (p->ddc) {
@@ -575,9 +599,18 @@ static int panel_edp_get_modes(struct drm_panel *panel,if (!p->edid) p->edid =drm_get_edid (connector, p->ddc); - -if (p->edid) - num +=drm_add_edid_modes (connector, p->edid); +if (p->edid) { +if (has_override_edid_mode) { +/* +* override_edid_mode is specified. Use +* override_edid_mode instead of from edid. +*/ + num +=panel_edp_override_edid_mode (p, connector, + p->detected_panel->override_edid_mode); + }else { + num +=drm_add_edid_modes (connector, p->edid); + } + }pm_runtime_mark_last_busy (panel->dev);pm_runtime_put_autosuspend (panel->dev);
@@ -1861,6 +1894,15 @@ static const struct panel_delay delay_200_500_e200 = { .delay = _delay \ } +#define EDP_PANEL_ENTRY2 (vend_chr_0, vend_chr_1, vend_chr_2, product_id, _delay, _name, _mode) \ +{ \ + .name = _name, \ + .panel_id = drm_edid_encode_panel_id(vend_chr_0, vend_chr_1, vend_chr_2, \ + product_id), \ + .delay = _delay, \ + .override_edid_mode = _mode \ +} +/* * This table is used to figure out power sequencing delays for panels that * are detected by EDID. Entries here may point to entries in the
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/219 drm/bridge: anx7625: Fix Set HPD irq detect window to 2ms
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Ji <[email protected]>
[ Upstream commit e3af7053de3f685c96158373bc234b2feca1f160 ]
Polling firmware HPD GPIO status, set HPD irq detect window to 2ms after firmware HPD GPIO initial done
--- drivers/gpu/drm/bridge/analogix/anx7625.c | 51 ++++++++++++++++------- drivers/gpu/drm/bridge/analogix/anx7625.h | 4 ++ 2 files changed, 40 insertions(+), 15 deletions(-)
drivers/gpu/drm/bridge/analogix/anx7625.c +36 -15
@@ -1300,10 +1300,32 @@ static void anx7625_config(struct anx7625_data *ctx) XTAL_FRQ_SEL, XTAL_FRQ_27M); } +static int anx7625_hpd_timer_config (struct anx7625_data *ctx) +{ +int ret; + +/* Set irq detect window to 2ms */ + ret =anx7625_reg_write (ctx, ctx->i2c.tx_p2_client, +HPD_DET_TIMER_BIT0_7 ,HPD_TIME &0xFF ); + ret |=anx7625_reg_write (ctx, ctx->i2c.tx_p2_client, +HPD_DET_TIMER_BIT8_15 , + (HPD_TIME >>8 ) &0xFF ); + ret |=anx7625_reg_write (ctx, ctx->i2c.tx_p2_client, +HPD_DET_TIMER_BIT16_23 , + (HPD_TIME >>16 ) &0xFF ); + +return ret; +} + +static int anx7625_read_hpd_gpio_config_status (struct anx7625_data *ctx) +{ +return anx7625_reg_read (ctx, ctx->i2c.rx_p0_client,GPIO_CTRL_2 ); +} +static void anx7625_disable_pd_protocol (struct anx7625_data *ctx) {struct device *dev = &ctx->client->dev; -int ret; +int ret, val;/* Reset main ocm */ ret =anx7625_reg_write (ctx, ctx->i2c.rx_p0_client,0x88 ,0x40 );
@@ -1317,6 +1339,19 @@ static void anx7625_disable_pd_protocol(struct anx7625_data *ctx)DRM_DEV_DEBUG_DRIVER (dev,"disable PD feature fail.\n" ); else DRM_DEV_DEBUG_DRIVER(dev, "disable PD feature succeeded.\n"); + +/* +* Make sure the HPD GPIO already be configured after OCM release before +* setting HPD detect window register. Here we poll the status register +* at maximum 40ms, then config HPD irq detect window register +*/ +readx_poll_timeout (anx7625_read_hpd_gpio_config_status, + ctx, val, + ((val &HPD_SOURCE ) || (val <0 )), +2000 ,2000 *20 ); + +/* Set HPD irq detect window to 2ms */ +anx7625_hpd_timer_config (ctx); }static int anx7625_ocm_loading_check (struct anx7625_data *ctx)
@@ -1440,20 +1475,6 @@ static void anx7625_start_dp_work(struct anx7625_data *ctx)static int anx7625_read_hpd_status_p0 (struct anx7625_data *ctx) { -int ret; - -/* Set irq detect window to 2ms */ - ret =anx7625_reg_write (ctx, ctx->i2c.tx_p2_client, -HPD_DET_TIMER_BIT0_7 ,HPD_TIME &0xFF ); - ret |=anx7625_reg_write (ctx, ctx->i2c.tx_p2_client, -HPD_DET_TIMER_BIT8_15 , - (HPD_TIME >>8 ) &0xFF ); - ret |=anx7625_reg_write (ctx, ctx->i2c.tx_p2_client, -HPD_DET_TIMER_BIT16_23 , - (HPD_TIME >>16 ) &0xFF ); -if (ret <0 ) -return ret; -return anx7625_reg_read (ctx, ctx->i2c.rx_p0_client,SYSTEM_STSTUS ); }
drivers/gpu/drm/bridge/analogix/anx7625.h +4 -0
@@ -259,6 +259,10 @@#define AP_MIPI_RX_EN BIT(5)/* 1: MIPI RX input in 0: no RX in */ #define AP_DISABLE_PD BIT(6)#define AP_DISABLE_DISPLAY BIT(7) + +#define GPIO_CTRL_2 0x49 +#define HPD_SOURCE BIT(6) +/***************************************************************/ /* Register definition of device address 0x84 */ #define MIPI_PHY_CONTROL_3 0x03
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/219 drm/amd/display: Fix tiled display misalignment
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Meenakshikumar Somasundaram <[email protected]>
[ Upstream commit c4b8394e76adba4f50a3c2696c75b214a291e24a ]
[Why]
When otg workaround is applied during clock update, otgs of tiled display went out of sync.
[How]
To call dc_trigger_sync() after clock update to sync otgs again.
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/display/dc/core/dc.c +4 -0
@@ -1903,6 +1903,10 @@ static enum dc_status dc_commit_state_no_check(struct dc *dc, struct dc_state *cwait_for_no_pipes_pending (dc, context);/* pplib is notified if disp_num changed */ dc->hwss.optimize_bandwidth (dc, context); +/* Need to do otg sync again as otg could be out of sync due to otg +* workaround applied during clock update +*/ +dc_trigger_sync (dc, context); }if (dc->hwss.update_dsc_pg)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/219 f2fs: fix write pointers on zoned device after roll forward
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
[ Upstream commit 9dad4d964291295ef48243d4e03972b85138bc9f ]
1. do roll forward recovery
2. update current segments pointers
3. fix the entire zones' write pointers
4. do checkpoint
--- fs/f2fs/recovery.c | 2 ++ 1 file changed, 2 insertions(+)
fs/f2fs/recovery.c +2 -0
@@ -898,6 +898,8 @@ int f2fs_recover_fsync_data(struct f2fs_sb_info *sbi, bool check_only)if (!err && fix_curseg_write_pointer && !f2fs_readonly (sbi->sb) &&f2fs_sb_has_blkzoned (sbi)) { err =f2fs_fix_curseg_write_pointer (sbi); +if (!err) + err =f2fs_check_write_pointer (sbi); ret = err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/219 ASoC: amd: Add new dmi entries for acp5x platform
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Venkata Prasad Potturu <[email protected]>
[ Upstream commit c3ab23a10771bbe06300e5374efa809789c65455 ]
Add sys_vendor and product_name dmi entries for acp5x platform.
--- sound/soc/amd/acp-config.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
sound/soc/amd/acp-config.c +14 -1
@@ -3,7 +3,7 @@// This file is provided under a dual BSD/GPLv2 license. When using or // redistributing this file, you may do so under either license. // -// Copyright(c) 2021 Advanced Micro Devices, Inc. +// Copyright(c) 2021, 2023 Advanced Micro Devices, Inc. // // Authors: Ajit Kumar Pandey <[email protected]> //
@@ -35,6 +35,19 @@ static const struct config_entry config_table[] = { {} }, }, + { + .flags = FLAG_AMD_LEGACY, + .device = ACP_PCI_DEV_ID, + .dmi_table = (const struct dmi_system_id []) { + { + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Valve" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Jupiter" ), + }, + }, + {} + }, + }, { .flags = FLAG_AMD_SOF, .device = ACP_PCI_DEV_ID,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/219 drm/drm_file: fix use of uninitialized variable
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 1d3062fad9c7313fff9970a88e0538a24480ffb8 ]
smatch reports:
drivers/gpu/drm/drm_file.c:967 drm_show_memory_stats() error: uninitialized symbol 'supported_status'.
'supported_status' is only set in one code path. I'm not familiar with the code to say if that path will always be ran in real life, but whether that is the case or not, I think it is good to initialize 'supported_status' to 0 to silence the warning (and possibly fix a bug).
--- drivers/gpu/drm/drm_file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/drm_file.c +1 -1
@@ -406,7 +406,7 @@ int drm_open(struct inode *inode, struct file *filp) {struct drm_device *dev;struct drm_minor *minor; -int retcode; +int retcode =0 ;int need_setup =0 ; minor =drm_minor_acquire (iminor (inode));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/219 drm/framebuffer: Fix use of uninitialized variable
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit f9af8f0c1dc567a5a6a6318ff324c45d80d4a60f ]
smatch reports:
drivers/gpu/drm/drm_framebuffer.c:654 drm_mode_getfb2_ioctl() error: uninitialized symbol 'ret'.
'ret' is possibly not set when there are no errors, causing the error above. I can't say if that ever happens in real-life, but in any case I think it is good to initialize 'ret' to 0.
--- drivers/gpu/drm/drm_framebuffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/drm_framebuffer.c +1 -1
@@ -570,7 +570,7 @@ int drm_mode_getfb2_ioctl(struct drm_device *dev,struct drm_mode_fb_cmd2 *r = data;struct drm_framebuffer *fb;unsigned int i; -int ret; +int ret =0 ;if (!drm_core_check_feature (dev,DRIVER_MODESET ))return -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/219 drm/mipi-dsi: Fix detach call without attach
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 90d50b8d85834e73536fdccd5aa913b30494fef0 ]
It's been reported that DSI host driver's detach can be called without the attach ever happening:
https://lore.kernel.org/all/[email protected]/
After reading the code, I think this is what happens:
We have a DSI host defined in the device tree and a DSI peripheral under that host (i.e. an i2c device using the DSI as data bus doesn't exhibit this behavior).
The host driver calls mipi_dsi_host_register(), which causes (via a few functions) mipi_dsi_device_add() to be called for the DSI peripheral. So now we have a DSI device under the host, but attach hasn't been called.
Normally the probing of the devices continues, and eventually the DSI peripheral's driver will call mipi_dsi_attach(), attaching the peripheral.
However, if the host driver's probe encounters an error after calling mipi_dsi_host_register(), and before the peripheral has called mipi_dsi_attach(), the host driver will do cleanups and return an error from its probe function. The cleanups include calling mipi_dsi_host_unregister().
mipi_dsi_host_unregister() will call two functions for all its DSI peripheral devices: mipi_dsi_detach() and mipi_dsi_device_unregister(). The latter makes sense, as the device exists, but the former may be wrong as attach has not necessarily been done.
To fix this, track the attached state of the peripheral, and only detach from mipi_dsi_host_unregister() if the peripheral was attached.
Note that I have only tested this with a board with an i2c DSI peripheral, not with a "pure" DSI peripheral.
However, slightly related, the unregister machinery still seems broken. E.g. if the DSI host driver is unbound, it'll detach and unregister the DSI peripherals. After that, when the DSI peripheral driver unbound it'll call detach either directly or using the devm variant, leading to a crash. And probably the driver will crash if it happens, for some reason, to try to send a message via the DSI bus.
But that's another topic.
--- drivers/gpu/drm/drm_mipi_dsi.c | 17 +++++++++++++++-- include/drm/drm_mipi_dsi.h | 2 ++ 2 files changed, 17 insertions(+), 2 deletions(-)
drivers/gpu/drm/drm_mipi_dsi.c +15 -2
@@ -346,7 +346,8 @@ static int mipi_dsi_remove_device_fn(struct device *dev, void *priv) {struct mipi_dsi_device *dsi =to_mipi_dsi_device (dev); -mipi_dsi_detach (dsi); +if (dsi->attached) +mipi_dsi_detach (dsi);mipi_dsi_device_unregister (dsi);return 0 ;
@@ -369,11 +370,18 @@ EXPORT_SYMBOL(mipi_dsi_host_unregister);int mipi_dsi_attach (struct mipi_dsi_device *dsi) {const struct mipi_dsi_host_ops *ops = dsi->host->ops; +int ret;if (!ops || !ops->attach)return -ENOSYS ; -return ops->attach (dsi->host, dsi); + ret = ops->attach (dsi->host, dsi); +if (ret) +return ret; + + dsi->attached = true; + +return 0 ; }EXPORT_SYMBOL (mipi_dsi_attach);
@@ -385,9 +393,14 @@ int mipi_dsi_detach(struct mipi_dsi_device *dsi) {const struct mipi_dsi_host_ops *ops = dsi->host->ops; +if (WARN_ON (!dsi->attached)) +return -EINVAL ; +if (!ops || !ops->detach)return -ENOSYS ; + dsi->attached = false; +return ops->detach (dsi->host, dsi); }EXPORT_SYMBOL (mipi_dsi_detach);
include/drm/drm_mipi_dsi.h +2 -0
@@ -168,6 +168,7 @@ struct mipi_dsi_device_info {* struct mipi_dsi_device - DSI peripheral device * @host: DSI host for this peripheral * @dev: driver model device node for this peripheral +* @attached: the DSI device has been successfully attached * @name: DSI peripheral chip type * @channel: virtual channel assigned to the peripheral * @format: pixel format for video mode
@@ -184,6 +185,7 @@ struct mipi_dsi_device_info {struct mipi_dsi_device {struct mipi_dsi_host *host;struct device dev; +bool attached;char name[DSI_DEV_NAME_SIZE ];unsigned int channel;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/219 media: stk1160: Fixed high volume of stk1160_dbg messages
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ghanshyam Agrawal <[email protected]>
[ Upstream commit b3695e86d25aafbe175dd51f6aaf6f68d341d590 ]
The function stk1160_dbg gets called too many times, which causes the output to get flooded with messages. Since stk1160_dbg uses printk, it is now replaced with printk_ratelimited.
--- drivers/media/usb/stk1160/stk1160-video.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/media/usb/stk1160/stk1160-video.c +2 -3
@@ -107,8 +107,7 @@ void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len)/* * TODO: These stk1160_dbg are very spammy! -* We should 1) check why we are getting them -* and 2) add ratelimit. +* We should check why we are getting them. * * UPDATE: One of the reasons (the only one?) for getting these * is incorrect standard (mismatch between expected and configured).
@@ -151,7 +150,7 @@ void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len)/* Let the bug hunt begin! sanity checks! */ if (lencopy <0 ) { -stk1160_dbg ("copy skipped: negative lencopy\n" ); +printk_ratelimited (KERN_DEBUG "copy skipped: negative lencopy\n" );return ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/219 media: rockchip: rga: fix swizzling for RGB formats
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Tretter <[email protected]>
[ Upstream commit 9e7dc39260edac180c206bb6149595a40eabae3e ]
When using 32 bit RGB formats, the RGA on the rk3568 produces wrong colors as the wrong color channels are read or written. The reason is that the format description for the channel swizzeling is wrong and the wrong bits are configured. For example, when converting ARGB32 to NV12, the alpha channel is used as blue channel.. This doesn't happen if the color format is the same on both sides.
Fix the color_swap settings of the formats to correctly handle 32 bit RGB formats.
For RGA_COLOR_FMT_XBGR8888, the RGA_COLOR_ALPHA_SWAP bit doesn't have an effect. Thus, it isn't possible to handle the V4L2_PIX_FMT_XRGB32. Thus, it is removed from the list of supported formats.
--- drivers/media/platform/rockchip/rga/rga.c | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-)
drivers/media/platform/rockchip/rga/rga.c +3 -12
@@ -187,25 +187,16 @@ static int rga_setup_ctrls(struct rga_ctx *ctx)static struct rga_fmt formats[] = { { .fourcc =V4L2_PIX_FMT_ARGB32 , - .color_swap =RGA_COLOR_RB_SWAP , + .color_swap =RGA_COLOR_ALPHA_SWAP , .hw_format =RGA_COLOR_FMT_ABGR8888 , .depth =32 , .uv_factor =1 , .y_div =1 , .x_div =1 , }, - { - .fourcc =V4L2_PIX_FMT_XRGB32 , - .color_swap =RGA_COLOR_RB_SWAP , - .hw_format =RGA_COLOR_FMT_XBGR8888 , - .depth =32 , - .uv_factor =1 , - .y_div =1 , - .x_div =1 , - }, { .fourcc =V4L2_PIX_FMT_ABGR32 , - .color_swap =RGA_COLOR_ALPHA_SWAP , + .color_swap =RGA_COLOR_RB_SWAP , .hw_format =RGA_COLOR_FMT_ABGR8888 , .depth =32 , .uv_factor =1 ,
@@ -214,7 +205,7 @@ static struct rga_fmt formats[] = { }, { .fourcc = V4L2_PIX_FMT_XBGR32, - .color_swap = RGA_COLOR_ALPHA_SWAP, + .color_swap = RGA_COLOR_RB_SWAP, .hw_format = RGA_COLOR_FMT_XBGR8888, .depth = 32, .uv_factor = 1,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/219 PCI: add INTEL_HDA_ARL to pci_ids.h
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 5ec42bf04d72fd6d0a6855810cc779e0ee31dfd7 ]
The PCI ID insertion follows the increasing order in the table, but this hardware follows MTL (MeteorLake).
--- include/linux/pci_ids.h | 1 + 1 file changed, 1 insertion(+)
include/linux/pci_ids.h +1 -0
@@ -3000,6 +3000,7 @@#define PCI_DEVICE_ID_INTEL_82443GX_0 0x71a0#define PCI_DEVICE_ID_INTEL_82443GX_2 0x71a2#define PCI_DEVICE_ID_INTEL_82372FB_1 0x7601 +#define PCI_DEVICE_ID_INTEL_HDA_ARL 0x7728#define PCI_DEVICE_ID_INTEL_SCH_LPC 0x8119#define PCI_DEVICE_ID_INTEL_SCH_IDE 0x811a#define PCI_DEVICE_ID_INTEL_E6XX_CU 0x8183
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/219 ALSA: hda: Intel: add HDA_ARL PCI ID support
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit a31014ebad617868c246d3985ff80d891f03711e ]
Yet another PCI ID.
--- sound/pci/hda/hda_intel.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/hda_intel.c +2 -0
@@ -2549,6 +2549,8 @@ static const struct pci_device_id azx_ids[] = {/* Lunarlake-P */ { PCI_DEVICE(0x8086, 0xa828), .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, +/* Arrow Lake */ + { PCI_DEVICE_DATA(INTEL, HDA_ARL, AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE) },/* Broxton-P(Apollolake) */ { PCI_DEVICE(0x8086, 0x5a98), .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_BROXTON },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/219 media: rkisp1: Drop IRQF_SHARED
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 85d2a31fe4d9be1555f621ead7a520d8791e0f74 ]
In all known platforms the ISP has dedicated IRQ lines, but for some reason the driver uses IRQF_SHARED.
Supporting IRQF_SHARED properly requires handling interrupts even when our device is disabled, and the driver does not handle this. To avoid adding such code, and to be sure the driver won't accidentally be used in a platform with shared interrupts, let's drop the IRQF_SHARED flag.
--- drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c +1 -1
@@ -542,7 +542,7 @@ static int rkisp1_probe(struct platform_device *pdev)if (irq <0 )return irq; - ret =devm_request_irq (dev, irq, info->isrs[i].isr,IRQF_SHARED , + ret =devm_request_irq (dev, irq, info->isrs[i].isr,0 ,dev_driver_string (dev), dev);if (ret) {dev_err (dev,"request irq failed: %d\n" , ret);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/219 media: rkisp1: Fix IRQ handler return values
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 3eb7910e1b16a2c136be26a8380f21469225b2f6 ]
The IRQ handler rkisp1_isr() calls sub-handlers, all of which returns an irqreturn_t value, but rkisp1_isr() ignores those values and always returns IRQ_HANDLED.
Fix this by collecting the return values, and returning IRQ_HANDLED or IRQ_NONE as appropriate.
--- .../media/platform/rockchip/rkisp1/rkisp1-dev.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c +12 -4
@@ -442,17 +442,25 @@ static int rkisp1_entities_register(struct rkisp1_device *rkisp1)static irqreturn_t rkisp1_isr (int irq,void *ctx) { +irqreturn_t ret =IRQ_NONE ; +/* * Call rkisp1_capture_isr() first to handle the frame that * potentially completed using the current frame_sequence number before * it is potentially incremented by rkisp1_isp_isr() in the vertical * sync. */ -rkisp1_capture_isr (irq, ctx); -rkisp1_isp_isr (irq, ctx); -rkisp1_csi_isr (irq, ctx); -return IRQ_HANDLED ; +if (rkisp1_capture_isr (irq, ctx) ==IRQ_HANDLED ) + ret =IRQ_HANDLED ; + +if (rkisp1_isp_isr (irq, ctx) ==IRQ_HANDLED ) + ret =IRQ_HANDLED ; + +if (rkisp1_csi_isr (irq, ctx) ==IRQ_HANDLED ) + ret =IRQ_HANDLED ; + +return ret; }static const char *const px30_isp_clks[] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/219 media: rkisp1: Store IRQ lines
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 0753874617de883c6d4da903142f334f76a75d70 ]
Store the IRQ lines used by the driver for easy access. These are needed in future patches which fix IRQ race issues.
--- .../platform/rockchip/rkisp1/rkisp1-common.h | 11 ++++++++++- .../media/platform/rockchip/rkisp1/rkisp1-dev.c | 17 +++++++++++++---- 2 files changed, 23 insertions(+), 5 deletions(-)
drivers/media/platform/rockchip/rkisp1/rkisp1-common.h +10 -1
@@ -61,6 +61,14 @@ struct dentry; RKISP1_CIF_ISP_EXP_END | \ RKISP1_CIF_ISP_HIST_MEASURE_RDY) +/* IRQ lines */ +enum rkisp1_irq_line { +RKISP1_IRQ_ISP =0 , +RKISP1_IRQ_MI , +RKISP1_IRQ_MIPI , +RKISP1_NUM_IRQS , +}; +/* enum for the resizer pads */ enum rkisp1_rsz_pad {RKISP1_RSZ_PAD_SINK ,
@@ -441,7 +449,6 @@ struct rkisp1_debug {* struct rkisp1_device - ISP platform device * * @base_addr: base register address -* @irq: the irq number * @dev: a pointer to the struct device * @clk_size: number of clocks * @clks: array of clocks
@@ -459,6 +466,7 @@ struct rkisp1_debug {* @stream_lock: serializes {start/stop}_streaming callbacks between the capture devices. * @debug: debug params to be exposed on debugfs * @info: version-specific ISP information +* @irqs: IRQ line numbers */ struct rkisp1_device {void __iomem *base_addr;
@@ -479,6 +487,7 @@ struct rkisp1_device {struct mutex stream_lock;/* serialize {start/stop}_streaming cb between capture devices */ struct rkisp1_debug debug;const struct rkisp1_info *info; +int irqs[RKISP1_NUM_IRQS ]; };/*
drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c +13 -4
@@ -114,6 +114,7 @@struct rkisp1_isr_data {const char *name;irqreturn_t (*isr)(int irq,void *ctx); +u32 line_mask; };/* ----------------------------------------------------------------------------
@@ -471,9 +472,9 @@ static const char * const px30_isp_clks[] = { };static const struct rkisp1_isr_data px30_isp_isrs[] = { - {"isp" , rkisp1_isp_isr }, - {"mi" , rkisp1_capture_isr }, - {"mipi" , rkisp1_csi_isr }, + {"isp" , rkisp1_isp_isr,BIT (RKISP1_IRQ_ISP ) }, + {"mi" , rkisp1_capture_isr,BIT (RKISP1_IRQ_MI ) }, + {"mipi" , rkisp1_csi_isr,BIT (RKISP1_IRQ_MIPI ) }, };static const struct rkisp1_info px30_isp_info = {
@@ -492,7 +493,7 @@ static const char * const rk3399_isp_clks[] = { };static const struct rkisp1_isr_data rk3399_isp_isrs[] = { - {NULL , rkisp1_isr }, + {NULL , rkisp1_isr,BIT (RKISP1_IRQ_ISP ) |BIT (RKISP1_IRQ_MI ) |BIT (RKISP1_IRQ_MIPI ) }, };static const struct rkisp1_info rk3399_isp_info = {
@@ -543,6 +544,9 @@ static int rkisp1_probe(struct platform_device *pdev)if (IS_ERR (rkisp1->base_addr))return PTR_ERR (rkisp1->base_addr); +for (unsigned int il =0 ; il <ARRAY_SIZE (rkisp1->irqs); ++il) + rkisp1->irqs[il] =-1 ; +for (i =0 ; i < info->isr_size; i++) { irq = info->isrs[i].name ? platform_get_irq_byname(pdev, info->isrs[i].name)
@@ -550,6 +554,11 @@ static int rkisp1_probe(struct platform_device *pdev)if (irq <0 )return irq; +for (unsigned int il =0 ; il <ARRAY_SIZE (rkisp1->irqs); ++il) { +if (info->isrs[i].line_mask &BIT (il)) + rkisp1->irqs[il] = irq; + } + ret =devm_request_irq (dev, irq, info->isrs[i].isr,0 ,dev_driver_string (dev), dev);if (ret) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/219 media: rkisp1: Fix IRQ disable race issue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 870565f063a58576e8a4529f122cac4325c6b395 ]
In rkisp1_isp_stop() and rkisp1_csi_disable() the driver masks the interrupts and then apparently assumes that the interrupt handler won't be running, and proceeds in the stop procedure. This is not the case, as the interrupt handler can already be running, which would lead to the ISP being disabled while the interrupt handler handling a captured frame.
This brings up two issues: 1) the ISP could be powered off while the interrupt handler is still running and accessing registers, leading to board lockup, and 2) the interrupt handler code and the code that disables the streaming might do things that conflict.
It is not clear to me if 2) causes a real issue, but 1) can be seen with a suitable delay (or printk in my case) in the interrupt handler, leading to board lockup.
--- .../platform/rockchip/rkisp1/rkisp1-csi.c | 14 ++++++++++++- .../platform/rockchip/rkisp1/rkisp1-isp.c | 20 ++++++++++++++++--- 2 files changed, 30 insertions(+), 4 deletions(-)
drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c +13 -1
@@ -141,8 +141,20 @@ static void rkisp1_csi_disable(struct rkisp1_csi *csi)struct rkisp1_device *rkisp1 = csi->rkisp1;u32 val; -/* Mask and clear interrupts. */ +/* Mask MIPI interrupts. */ rkisp1_write (rkisp1,RKISP1_CIF_MIPI_IMSC ,0 ); + +/* Flush posted writes */ +rkisp1_read (rkisp1,RKISP1_CIF_MIPI_IMSC ); + +/* +* Wait until the IRQ handler has ended. The IRQ handler may get called +* even after this, but it will return immediately as the MIPI +* interrupts have been masked. +*/ +synchronize_irq (rkisp1->irqs[RKISP1_IRQ_MIPI ]); + +/* Clear MIPI interrupt status */ rkisp1_write (rkisp1,RKISP1_CIF_MIPI_ICR , ~0 ); val =rkisp1_read (rkisp1,RKISP1_CIF_MIPI_CTRL );
drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c +17 -3
@@ -281,11 +281,25 @@ static void rkisp1_isp_stop(struct rkisp1_isp *isp)* ISP(mi) stop in mi frame end -> Stop ISP(mipi) -> * Stop ISP(isp) ->wait for ISP isp off */ -/* stop and clear MI and ISP interrupts */ -rkisp1_write (rkisp1,RKISP1_CIF_ISP_IMSC ,0 ); -rkisp1_write (rkisp1,RKISP1_CIF_ISP_ICR , ~0 ); +/* Mask MI and ISP interrupts */ +rkisp1_write (rkisp1,RKISP1_CIF_ISP_IMSC ,0 );rkisp1_write (rkisp1,RKISP1_CIF_MI_IMSC ,0 ); + +/* Flush posted writes */ +rkisp1_read (rkisp1,RKISP1_CIF_MI_IMSC ); + +/* +* Wait until the IRQ handler has ended. The IRQ handler may get called +* even after this, but it will return immediately as the MI and ISP +* interrupts have been masked. +*/ +synchronize_irq (rkisp1->irqs[RKISP1_IRQ_ISP ]); +if (rkisp1->irqs[RKISP1_IRQ_ISP ] != rkisp1->irqs[RKISP1_IRQ_MI ]) +synchronize_irq (rkisp1->irqs[RKISP1_IRQ_MI ]); + +/* Clear MI and ISP interrupt status */ +rkisp1_write (rkisp1,RKISP1_CIF_ISP_ICR , ~0 );rkisp1_write (rkisp1,RKISP1_CIF_MI_ICR , ~0 );/* stop ISP */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/219 hwmon: (nct6775) Fix fan speed set failure in automatic mode
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xing Tong Wu <[email protected]>
[ Upstream commit 8b3800256abad20e91c2698607f9b28591407b19 ]
Setting the fan speed is only valid in manual mode; it is not possible to set the fan's speed in automatic mode.
Return error when attempting to set the fan speed in automatic mode.
--- drivers/hwmon/nct6775-core.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/hwmon/nct6775-core.c +7 -0
@@ -2462,6 +2462,13 @@ store_pwm(struct device *dev, struct device_attribute *attr, const char *buf,int err;u16 reg; +/* +* The fan control mode should be set to manual if the user wants to adjust +* the fan speed. Otherwise, it will fail to set. +*/ +if (index ==0 && data->pwm_enable[nr] > manual) +return -EBUSY ; + err =kstrtoul (buf,10 , &val);if (err <0 )return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/219 f2fs: fix to tag gcing flag on page during block migration
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 4961acdd65c956e97c1a000c82d91a8c1cdbe44b ]
It needs to add missing gcing flag on page during block migration, in order to garantee migrated data be persisted during checkpoint, otherwise out-of-order persistency between data and node may cause data corruption after SPOR.
Similar issue was fixed by commit 2d1fe8a86bf5 ("f2fs: fix to tag gcing flag on page during file defragment").
--- fs/f2fs/compress.c | 4 +++- fs/f2fs/file.c | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-)
fs/f2fs/compress.c +3 -1
@@ -1026,8 +1026,10 @@ static void set_cluster_dirty(struct compress_ctx *cc)int i;for (i =0 ; i < cc->cluster_size; i++) -if (cc->rpages[i]) +if (cc->rpages[i]) {set_page_dirty (cc->rpages[i]); +set_page_private_gcing (cc->rpages[i]); + } } static int prepare_compress_overwrite(struct compress_ctx *cc,
fs/f2fs/file.c +2 -0
@@ -1326,6 +1326,7 @@ static int __clone_blkaddrs(struct inode *src_inode, struct inode *dst_inode, }memcpy_page (pdst,0 , psrc,0 ,PAGE_SIZE );set_page_dirty (pdst); +set_page_private_gcing (pdst);f2fs_put_page (pdst,1 );f2fs_put_page (psrc,1 );
@@ -4037,6 +4038,7 @@ static int redirty_blocks(struct inode *inode, pgoff_t page_idx, int len)f2fs_bug_on (F2FS_I_SB (inode), !page);set_page_dirty (page); +set_page_private_gcing (page);f2fs_put_page (page,1 );f2fs_put_page (page,0 ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/219 drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 16ac5b21b31b439f03cdf44c153c5f5af94fb3eb ]
Based on grepping through the source code this driver appears to be missing a call to drm_atomic_helper_shutdown() at system shutdown time and at driver unbind time. Among other things, this means that if a panel is in use that it won't be cleanly powered off at system shutdown time.
The fact that we should call drm_atomic_helper_shutdown() in the case of OS shutdown/restart and at driver remove (or unbind) time comes straight out of the kernel doc "driver instance overview" in drm_drv.c.
A few notes about this fix:
- When adding drm_atomic_helper_shutdown() to the unbind path, I added it after drm_kms_helper_poll_fini() since that's when other drivers seemed to have it.
- Technically with a previous patch, ("drm/atomic-helper:
drm_atomic_helper_shutdown(NULL) should be a noop"), we don't actually need to check to see if our "drm" pointer is NULL before calling drm_atomic_helper_shutdown(). We'll leave the "if" test in, though, so that this patch can land without any dependencies. It could potentially be removed later.
- This patch also makes sure to set the drvdata to NULL in the case of bind errors to make sure that shutdown can't access freed data.
--- drivers/gpu/drm/exynos/exynos_drm_drv.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/gpu/drm/exynos/exynos_drm_drv.c +11 -0
@@ -309,6 +309,7 @@ static int exynos_drm_bind(struct device *dev)drm_mode_config_cleanup (drm);exynos_drm_cleanup_dma (drm);kfree (private); +dev_set_drvdata (dev,NULL ); err_free_drm:drm_dev_put (drm);
@@ -323,6 +324,7 @@ static void exynos_drm_unbind(struct device *dev)exynos_drm_fbdev_fini (drm);drm_kms_helper_poll_fini (drm); +drm_atomic_helper_shutdown (drm);component_unbind_all (drm->dev, drm);drm_mode_config_cleanup (drm);
@@ -360,9 +362,18 @@ static int exynos_drm_platform_remove(struct platform_device *pdev)return 0 ; } +static void exynos_drm_platform_shutdown (struct platform_device *pdev) +{ +struct drm_device *drm =platform_get_drvdata (pdev); + +if (drm) +drm_atomic_helper_shutdown (drm); +} +static struct platform_driver exynos_drm_platform_driver = { .probe = exynos_drm_platform_probe, .remove = exynos_drm_platform_remove, + .shutdown = exynos_drm_platform_shutdown, .driver = { .name ="exynos-drm" , .pm = &exynos_drm_pm_ops,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/219 IB/ipoib: Fix mcast list locking
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vacek <[email protected]>
[ Upstream commit 4f973e211b3b1c6d36f7c6a19239d258856749f9 ]
Releasing the priv->lock while iterating the priv->multicast_list in ipoib_mcast_join_task() opens a window for ipoib_mcast_dev_flush() to remove the items while in the middle of iteration. If the mcast is removed while the lock was dropped, the for loop spins forever resulting in a hard lockup (as was reported on RHEL 4.18.0-372.75.1.el8_6 kernel):
Task A (kworker/u72:2 below) | Task B (kworker/u72:0 below)
-----------------------------------+-----------------------------------
ipoib_mcast_join_task(work) | ipoib_ib_dev_flush_light(work)
spin_lock_irq(&priv->lock) | __ipoib_ib_dev_flush(priv, ...)
list_for_each_entry(mcast, | ipoib_mcast_dev_flush(dev = priv->dev)
&priv->multicast_list, list) |
ipoib_mcast_join(dev, mcast) |
spin_unlock_irq(&priv->lock) |
| spin_lock_irqsave(&priv->lock, flags)
| list_for_each_entry_safe(mcast, tmcast,
| &priv->multicast_list, list)
| list_del(&mcast->list);
| list_add_tail(&mcast->list, &remove_list)
| spin_unlock_irqrestore(&priv->lock, flags)
spin_lock_irq(&priv->lock) |
| ipoib_mcast_remove_list(&remove_list)
(Here, `mcast` is no longer on the | list_for_each_entry_safe(mcast, tmcast,
`priv->multicast_list` and we keep | remove_list, list)
spinning on the `remove_list` of | >>> wait_for_completion(&mcast->done)
the other thread which is blocked |
and the list is still valid on |it's stack.)
Fix this by keeping the lock held and changing to GFP_ATOMIC to prevent eventual sleeps.
Unfortunately we could not reproduce the lockup and confirm this fix but based on the code review I think this fix should address such lockups.
crash> bc 31
PID: 747 TASK: ff1c6a1a007e8000 CPU: 31 COMMAND: "kworker/u72:2"
--
[exception RIP: ipoib_mcast_join_task+0x1b1]
RIP: ffffffffc0944ac1 RSP: ff646f199a8c7e00 RFLAGS: 00000002
RAX: 0000000000000000 RBX: ff1c6a1a04dc82f8 RCX: 0000000000000000
work (&priv->mcast_task{,.work})
RDX: ff1c6a192d60ac68 RSI: 0000000000000286 RDI: ff1c6a1a04dc8000
&mcast->list
RBP: ff646f199a8c7e90 R8: ff1c699980019420 R9: ff1c6a1920c9a000
R10: ff646f199a8c7e00 R11: ff1c6a191a7d9800 R12: ff1c6a192d60ac00
mcast
R13: ff1c6a1d82200000 R14: ff1c6a1a04dc8000 R15: ff1c6a1a04dc82d8
dev priv (&priv->lock) &priv->multicast_list (aka head)
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018--- drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/infiniband/ulp/ipoib/ipoib_multicast.c +1 -5
@@ -531,21 +531,17 @@ static int ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)if (test_bit (IPOIB_MCAST_FLAG_SENDONLY , &mcast->flags)) rec.join_state =SENDONLY_FULLMEMBER_JOIN ; } -spin_unlock_irq (&priv->lock); multicast =ib_sa_join_multicast (&ipoib_sa_client, priv->ca, priv->port, - &rec, comp_mask,GFP_KERNEL , + &rec, comp_mask,GFP_ATOMIC , ipoib_mcast_join_complete, mcast); -spin_lock_irq (&priv->lock);if (IS_ERR (multicast)) { ret =PTR_ERR (multicast);ipoib_warn (priv,"ib_sa_join_multicast failed, status %d\n" , ret);/* Requeue this join task with a backoff delay */ __ipoib_mcast_schedule_join_thread (priv, mcast,1 );clear_bit (IPOIB_MCAST_FLAG_BUSY , &mcast->flags); -spin_unlock_irq (&priv->lock);complete (&mcast->done); -spin_lock_irq (&priv->lock);return ret; }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/219 media: amphion: remove mutext lock in condition of wait_event
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Qian <[email protected]>
[ Upstream commit f9c8ddce2fe3b767582f299d03fc8fb85943568c ]
mutext_lock should not be called in condition of wait_event, otherwise, when CONFIG_DEBUG_ATOMIC_SLEEP is enabled, we may meet the following warning:
do not call blocking ops when !TASK_RUNNING; state=2
WARNING: CPU: 5 PID: 741 at kernel/sched/core.c:9859 __might_sleep+0x80/0xa4 Hardware name: Freescale i.MX8QM MEK (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __might_sleep+0x80/0xa4 lr : __might_sleep+0x80/0xa4 sp : ffffffc0123738a0 x29: ffffffc0123738a0 x28: ffffffc009194c48 x27: ffffffc00bbc1050 x26: ffffff8814b282f0 x25: ffffff8814b280d0 x24: ffffff8814b28080 x23: 0000000000000001 x22: 0000000000000032 x21: ffffffc00bbc1000 x20: 000000000000011b x19: ffffffc009324670 x18: 00000000fffffffd x17: 30303c5b20746120 x16: 74657320323d6574 x15: 617473203b474e49 x14: 00058b5b8b9aa1f1 x13: ffffffc00903cda0 x12: 00000000d744fcc9 x11: 000000000000001c x10: 00000000000009a0 x9 : ffffffc0090201f4 x8 : ffffff8828245000 x7 : 0000000000000001 x6 : 0000000000000001 x5 : 00000000410fd080 x4 : 0000000000000002 x3 : ffffff8815aab4c8 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffff8828244600 Call trace: __might_sleep+0x80/0xa4 mutex_lock+0x2c/0x80 sync_session_response+0x110/0x310 vpu_session_send_cmd+0x18c/0x244 vpu_session_start+0x38/0x70 vdec_start_session+0x1b4/0x3e0 vpu_vb2_start_streaming+0xa0/0x1c4 vb2_start_streaming+0x74/0x160 vb2_core_qbuf+0x488/0x650 vb2_qbuf+0x9c/0x100 v4l2_m2m_qbuf+0x7c/0x224 v4l2_m2m_ioctl_qbuf+0x20/0x2c v4l_qbuf+0x50/0x6c __video_do_ioctl+0x174/0x3f0 video_usercopy+0x210/0x7cc video_ioctl2+0x20/0x30 v4l2_ioctl+0x48/0x6c
we need to refine check_is_responsed() to remove the mutext_lock, each cmd has a monotonically increasing id, and cmds are executed sequentially, so we can check the id of the last reponsed cmd, then determine whether a command has been responded or not.
--- drivers/media/platform/amphion/vpu.h | 3 ++- drivers/media/platform/amphion/vpu_cmds.c | 28 ++++++++--------------- drivers/media/platform/amphion/vpu_v4l2.c | 1 + 3 files changed, 12 insertions(+), 20 deletions(-)
drivers/media/platform/amphion/vpu.h +2 -1
@@ -152,7 +152,6 @@ struct vpu_core {struct vpu_mbox tx_type;struct vpu_mbox tx_data;struct vpu_mbox rx; -unsigned long cmd_seq;wait_queue_head_t ack_wq;struct completion cmp;
@@ -251,6 +250,8 @@ struct vpu_inst {struct list_head cmd_q;void *pending; +unsigned long cmd_seq; +atomic_long_t last_response_cmd;struct vpu_inst_ops *ops;const struct vpu_format *formats;
drivers/media/platform/amphion/vpu_cmds.c +9 -19
@@ -34,6 +34,7 @@ struct vpu_cmd_t {struct vpu_cmd_request *request;struct vpu_rpc_event *pkt;unsigned long key; +atomic_long_t *last_response_cmd; };static struct vpu_cmd_request vpu_cmd_requests[] = {
@@ -117,6 +118,8 @@ static void vpu_free_cmd(struct vpu_cmd_t *cmd) {if (!cmd)return ; +if (cmd->last_response_cmd) +atomic_long_set (cmd->last_response_cmd, cmd->key);vfree (cmd->pkt);vfree (cmd); }
@@ -174,7 +177,8 @@ static int vpu_request_cmd(struct vpu_inst *inst, u32 id, void *data,return -ENOMEM ;mutex_lock (&core->cmd_lock); - cmd->key = core->cmd_seq++; + cmd->key = ++inst->cmd_seq; + cmd->last_response_cmd = &inst->last_response_cmd;if (key) *key = cmd->key;if (sync)
@@ -248,26 +252,12 @@ void vpu_clear_request(struct vpu_inst *inst)static bool check_is_responsed (struct vpu_inst *inst,unsigned long key) { -struct vpu_core *core = inst->core; -struct vpu_cmd_t *cmd; -bool flag = true; +unsigned long last_response =atomic_long_read (&inst->last_response_cmd); -mutex_lock (&core->cmd_lock); - cmd = inst->pending; -if (cmd && key == cmd->key) { - flag = false; - goto exit; - } -list_for_each_entry (cmd, &inst->cmd_q, list) { -if (key == cmd->key) { - flag = false; -break ; - } - } -exit: -mutex_unlock (&core->cmd_lock); +if (key <= last_response && (last_response - key) < (ULONG_MAX >>1 )) +return true; -return flag; +return false; }static int sync_session_response (struct vpu_inst *inst,unsigned long key,long timeout,int try)
drivers/media/platform/amphion/vpu_v4l2.c +1 -0
@@ -631,6 +631,7 @@ int vpu_v4l2_open(struct file *file, struct vpu_inst *inst) func = &vpu->decoder;atomic_set (&inst->ref_count,0 ); +atomic_long_set (&inst->last_response_cmd,0 );vpu_inst_get (inst); inst->vpu = vpu; inst->core =vpu_request_core (vpu, inst->type);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/219 media: ddbridge: fix an error code problem in ddb_probe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit 09b4195021be69af1e1936cca995712a6d0f2562 ]
Error code is assigned to 'stat', return 'stat' rather than '-1'.
--- drivers/media/pci/ddbridge/ddbridge-main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/pci/ddbridge/ddbridge-main.c +1 -1
@@ -238,7 +238,7 @@ static int ddb_probe(struct pci_dev *pdev,ddb_unmap (dev);pci_set_drvdata (pdev,NULL );pci_disable_device (pdev); -return -1 ; +return stat; }/****************************************************************************/
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/219 media: i2c: imx335: Fix hblank min/max values
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kieran Bingham <[email protected]>
[ Upstream commit d7b95ad7a8d56248dfc34f861e445fad7a4004f4 ]
The V4L2_CID_HBLANK control is marked as readonly and can only be a single value.
Set the minimum and maximum value to match the mode value.
--- drivers/media/i2c/imx335.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/i2c/imx335.c +2 -2
@@ -971,8 +971,8 @@ static int imx335_init_controls(struct imx335 *imx335) imx335->hblank_ctrl =v4l2_ctrl_new_std (ctrl_hdlr, &imx335_ctrl_ops,V4L2_CID_HBLANK , -IMX335_REG_MIN , -IMX335_REG_MAX , + mode->hblank, + mode->hblank,1 , mode->hblank);if (imx335->hblank_ctrl) imx335->hblank_ctrl->flags |=V4L2_CTRL_FLAG_READ_ONLY ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/219 drm/amd/display: For prefetch mode > 0, extend prefetch if possible
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alvin Lee <[email protected]>
[ Upstream commit dd4e4bb28843393065eed279e869fac248d03f0f ]
[Description]
For mode programming we want to extend the prefetch as much as possible (up to oto, or as long as we can for equ) if we're not already applying the 60us prefetch requirement. This is to avoid intermittent underflow issues during prefetch.
The prefetch extension is applied under the following scenarios:
1. We're in prefetch mode 1 (i.e. we don't support MCLK switch in blank)
2. We're using subvp or drr methods of p-state switch, in which case we we don't care if prefetch takes up more of the blanking time
Mode programming typically chooses the smallest prefetch time possible (i.e. highest bandwidth during prefetch) presumably to create margin between p-states / c-states that happen in vblank and prefetch. Therefore we only apply this prefetch extension when p-state in vblank is not required (UCLK p-states take up the most vblank time).
--- .../dc/dml/dcn32/display_mode_vba_32.c | 3 ++ .../dc/dml/dcn32/display_mode_vba_util_32.c | 33 +++++++++++++++---- .../dc/dml/dcn32/display_mode_vba_util_32.h | 1 + 3 files changed, 31 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c +3 -0
@@ -810,6 +810,8 @@ static void DISPCLKDPPCLKDCFCLKDeepSleepPrefetchParametersWatermarksAndPerforman (v->DRAMSpeedPerState[mode_lib->vba.VoltageLevel] <=MEM_STROBE_FREQ_MHZ || v->DCFCLKPerState[mode_lib->vba.VoltageLevel] <=DCFCLK_FREQ_EXTRA_PREFETCH_REQ_MHZ ) ? mode_lib->vba.ip.min_prefetch_in_strobe_us :0 , + mode_lib->vba.PrefetchModePerState[mode_lib->vba.VoltageLevel][mode_lib->vba.maxMpcComb] >0 || mode_lib->vba.DRAMClockChangeRequirementFinal == false, +/* Output */ &v->DSTXAfterScaler[k], &v->DSTYAfterScaler[k],
@@ -3291,6 +3293,7 @@ void dml32_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l v->SwathHeightCThisState[k], v->TWait, (v->DRAMSpeedPerState[i] <=MEM_STROBE_FREQ_MHZ || v->DCFCLKState[i][j] <=DCFCLK_FREQ_EXTRA_PREFETCH_REQ_MHZ ) ? mode_lib->vba.ip.min_prefetch_in_strobe_us :0 , + mode_lib->vba.PrefetchModePerState[i][j] >0 || mode_lib->vba.DRAMClockChangeRequirementFinal == false,/* Output */ &v->dummy_vars.dml32_ModeSupportAndSystemConfigurationFull.DSTXAfterScaler[k],
drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c +27 -6
@@ -3418,6 +3418,7 @@ bool dml32_CalculatePrefetchSchedule(unsigned int SwathHeightC, double TWait, double TPreReq, + bool ExtendPrefetchIfPossible,/* Output */ double *DSTXAfterScaler, double *DSTYAfterScaler,
@@ -3887,12 +3888,32 @@ bool dml32_CalculatePrefetchSchedule(/* Clamp to oto for bandwidth calculation */ LinesForPrefetchBandwidth = dst_y_prefetch_oto; }else { - *DestinationLinesForPrefetch = dst_y_prefetch_equ; - TimeForFetchingMetaPTE = Tvm_equ; - TimeForFetchingRowInVBlank = Tr0_equ; - *PrefetchBandwidth = prefetch_bw_equ; -/* Clamp to equ for bandwidth calculation */ - LinesForPrefetchBandwidth = dst_y_prefetch_equ; +/* For mode programming we want to extend the prefetch as much as possible +* (up to oto, or as long as we can for equ) if we're not already applying +* the 60us prefetch requirement. This is to avoid intermittent underflow +* issues during prefetch. +* +* The prefetch extension is applied under the following scenarios: +* 1. We're in prefetch mode > 0 (i.e. we don't support MCLK switch in blank) +* 2. We're using subvp or drr methods of p-state switch, in which case we +* we don't care if prefetch takes up more of the blanking time +* +* Mode programming typically chooses the smallest prefetch time possible +* (i.e. highest bandwidth during prefetch) presumably to create margin between +* p-states / c-states that happen in vblank and prefetch. Therefore we only +* apply this prefetch extension when p-state in vblank is not required (UCLK +* p-states take up the most vblank time). +*/ +if (ExtendPrefetchIfPossible && TPreReq ==0 && VStartup < MaxVStartup) { + MyError = true; + }else { + *DestinationLinesForPrefetch = dst_y_prefetch_equ; + TimeForFetchingMetaPTE = Tvm_equ; + TimeForFetchingRowInVBlank = Tr0_equ; + *PrefetchBandwidth = prefetch_bw_equ; +/* Clamp to equ for bandwidth calculation */ + LinesForPrefetchBandwidth = dst_y_prefetch_equ; + } } *DestinationLinesToRequestVMInVBlank =dml_ceil (4.0 * TimeForFetchingMetaPTE / LineTime,1.0 ) /4.0 ;
drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.h +1 -0
@@ -744,6 +744,7 @@ bool dml32_CalculatePrefetchSchedule(unsigned int SwathHeightC, double TWait, double TPreReq, + bool ExtendPrefetchIfPossible,/* Output */ double *DSTXAfterScaler, double *DSTYAfterScaler,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/219 drm/msm/dpu: Ratelimit framedone timeout msgs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit 2b72e50c62de60ad2d6bcd86aa38d4ccbdd633f2 ]
When we start getting these, we get a *lot*. So ratelimit it to not flood dmesg.
Patchwork: https://patchwork.freedesktop.org/patch/571584/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 5 ++++- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h | 1 + 2 files changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +4 -1
@@ -38,6 +38,9 @@#define DPU_ERROR_ENC (e, fmt, ...) DPU_ERROR("enc%d " fmt,\ (e) ? (e)->base.base.id : -1, ##__VA_ARGS__) +#define DPU_ERROR_ENC_RATELIMITED (e, fmt, ...) DPU_ERROR_RATELIMITED("enc%d " fmt,\ + (e) ? (e)->base.base.id : -1, ##__VA_ARGS__) +/* * Two to anticipate panels that can do cmd/vid dynamic switching * plan is to create all possible physical encoder types, and switch between
@@ -2385,7 +2388,7 @@ static void dpu_encoder_frame_done_timeout(struct timer_list *t)return ; } -DPU_ERROR_ENC (dpu_enc,"frame done timeout\n" ); +DPU_ERROR_ENC_RATELIMITED (dpu_enc,"frame done timeout\n" ); event =DPU_ENCODER_FRAME_EVENT_ERROR ;trace_dpu_enc_frame_done_timeout (DRMID (drm_enc), event);
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h +1 -0
@@ -51,6 +51,7 @@ } while (0)#define DPU_ERROR (fmt, ...) pr_err("[dpu error]" fmt, ##__VA_ARGS__) +#define DPU_ERROR_RATELIMITED (fmt, ...) pr_err_ratelimited("[dpu error]" fmt, ##__VA_ARGS__)/** * ktime_compare_safe - compare two ktime structures
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 134/219 drm/msm/dpu: fix writeback programming for YUV cases
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhinav Kumar <[email protected]>
[ Upstream commit 79caf2f2202b9eaad3a5a726e4b33807f67d0f1b ]
For YUV cases, setting the required format bits was missed out in the register programming. Lets fix it now in preparation of adding YUV formats support for writeback.
changes in v2:
- dropped the fixes tag as its not a fix but adding new functionality
Patchwork: https://patchwork.freedesktop.org/patch/571814/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c +3 -0
@@ -105,6 +105,9 @@ static void dpu_hw_wb_setup_format(struct dpu_hw_wb *ctx, dst_format |=BIT (14 );/* DST_ALPHA_X */ } +if (DPU_FORMAT_IS_YUV (fmt)) + dst_format |=BIT (15 ); + pattern = (fmt->element[3 ] <<24 ) | (fmt->element[2 ] <<16 ) | (fmt->element[1] << 8) |
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 135/219 drm/amdgpu: fix ftrace event amdgpu_bo_move always move on same heap
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang, Beyond <[email protected]>
[ Upstream commit 94aeb4117343d072e3a35b9595bcbfc0058ee724 ]
Issue: during evict or validate happened on amdgpu_bo, the 'from' and 'to' is always same in ftrace event of amdgpu_bo_move
where calling the 'trace_amdgpu_bo_move', the comment says move_notify is called before move happens, but actually it is called after move happens, here the new_mem is same as bo->resource
Fix: move trace_amdgpu_bo_move from move_notify to amdgpu_bo_move
--- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 13 +------------ drivers/gpu/drm/amd/amdgpu/amdgpu_object.h | 4 +--- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 5 +++-- 3 files changed, 5 insertions(+), 17 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +1 -12
@@ -1222,19 +1222,15 @@ int amdgpu_bo_get_metadata(struct amdgpu_bo *bo, void *buffer,* amdgpu_bo_move_notify - notification about a memory move * @bo: pointer to a buffer object * @evict: if this move is evicting the buffer from the graphics address space -* @new_mem: new information of the bufer object * * Marks the corresponding &amdgpu_bo buffer object as invalid, also performs * bookkeeping. * TTM driver callback which is called when ttm moves a buffer. */ -void amdgpu_bo_move_notify (struct ttm_buffer_object *bo, -bool evict, -struct ttm_resource *new_mem) +void amdgpu_bo_move_notify (struct ttm_buffer_object *bo,bool evict) {struct amdgpu_device *adev =amdgpu_ttm_adev (bo->bdev);struct amdgpu_bo *abo; -struct ttm_resource *old_mem = bo->resource;if (!amdgpu_bo_is_amdgpu_bo (bo))return ;
@@ -1251,13 +1247,6 @@ void amdgpu_bo_move_notify(struct ttm_buffer_object *bo,/* remember the eviction */ if (evict)atomic64_inc (&adev->num_evictions); - -/* update statistics */ -if (!new_mem) -return ; - -/* move_notify is called before move happens */ -trace_amdgpu_bo_move (abo, new_mem->mem_type, old_mem->mem_type); } void amdgpu_bo_get_memory(struct amdgpu_bo *bo, uint64_t *vram_mem,
drivers/gpu/drm/amd/amdgpu/amdgpu_object.h +1 -3
@@ -312,9 +312,7 @@ int amdgpu_bo_set_metadata (struct amdgpu_bo *bo, void *metadata,int amdgpu_bo_get_metadata (struct amdgpu_bo *bo,void *buffer,size_t buffer_size,uint32_t *metadata_size,uint64_t *flags); -void amdgpu_bo_move_notify (struct ttm_buffer_object *bo, -bool evict, -struct ttm_resource *new_mem); +void amdgpu_bo_move_notify (struct ttm_buffer_object *bo,bool evict);void amdgpu_bo_release_notify (struct ttm_buffer_object *bo);vm_fault_t amdgpu_bo_fault_reserve_notify (struct ttm_buffer_object *bo); void amdgpu_bo_fence(struct amdgpu_bo *bo, struct dma_fence *fence,
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +3 -2
@@ -555,10 +555,11 @@ static int amdgpu_bo_move(struct ttm_buffer_object *bo, bool evict,return r; } +trace_amdgpu_bo_move (abo, new_mem->mem_type, old_mem->mem_type); out:/* update statistics */ atomic64_add (bo->base.size, &adev->num_bytes_moved); -amdgpu_bo_move_notify (bo, evict, new_mem); +amdgpu_bo_move_notify (bo, evict);return 0 ; }
@@ -1503,7 +1504,7 @@ static int amdgpu_ttm_access_memory(struct ttm_buffer_object *bo,static void amdgpu_bo_delete_mem_notify (struct ttm_buffer_object *bo) { -amdgpu_bo_move_notify (bo, false,NULL ); +amdgpu_bo_move_notify (bo, false); }static struct ttm_device_funcs amdgpu_bo_driver = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 136/219 clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuan-Wei Chiu <[email protected]>
[ Upstream commit bfbea9e5667cfa9552c3d88f023386f017f6c308 ]
In cases where kcalloc() fails for the 'clk_data->clks' allocation, the code path does not handle the failure gracefully, potentially leading to a memory leak. This fix ensures proper cleanup by freeing the allocated memory for 'clk_data' before returning.
--- drivers/clk/hisilicon/clk-hi3620.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/clk/hisilicon/clk-hi3620.c +3 -1
@@ -467,8 +467,10 @@ static void __init hi3620_mmc_clk_init(struct device_node *node)return ; clk_data->clks =kcalloc (num,sizeof (*clk_data->clks),GFP_KERNEL ); -if (!clk_data->clks) +if (!clk_data->clks) { +kfree (clk_data);return ; + }for (i =0 ; i < num; i++) {struct hisi_mmc_clock *mmc_clk = &hi3620_mmc_clks[i];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/219 clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuan-Wei Chiu <[email protected]>
[ Upstream commit 2fbabea626b6467eb4e6c4cb7a16523da12e43b4 ]
In cases where mapping of mpmu/apmu/apbc registers fails, the code path does not handle the failure gracefully, potentially leading to a memory leak. This fix ensures proper cleanup by freeing the allocated memory for 'pxa_unit' before returning.
--- drivers/clk/mmp/clk-of-pxa168.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/clk/mmp/clk-of-pxa168.c +3 -0
@@ -306,18 +306,21 @@ static void __init pxa168_clk_init(struct device_node *np) pxa_unit->mpmu_base =of_iomap (np,0 );if (!pxa_unit->mpmu_base) {pr_err ("failed to map mpmu registers\n" ); +kfree (pxa_unit);return ; } pxa_unit->apmu_base =of_iomap (np,1 );if (!pxa_unit->apmu_base) {pr_err ("failed to map apmu registers\n" ); +kfree (pxa_unit);return ; } pxa_unit->apbc_base =of_iomap (np,2 );if (!pxa_unit->apbc_base) {pr_err ("failed to map apbc registers\n" ); +kfree (pxa_unit);return ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 138/219 watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Werner Fischer <[email protected]>
[ Upstream commit d12971849d71781c1e4ffd1117d4878ce233d319 ]
WDTCTRL bit 3 sets the mode choice for the clock input of IT8784/IT8786. Some motherboards require this bit to be set to 1 (= PCICLK mode), otherwise the watchdog functionality gets broken. The BIOS of those motherboards sets WDTCTRL bit 3 already to 1.
Instead of setting all bits of WDTCTRL to 0 by writing 0x00 to it, keep bit 3 of it unchanged for IT8784/IT8786 chips. In this way, bit 3 keeps the status as set by the BIOS of the motherboard.
Watchdog tests have been successful with this patch with the following systems:
IT8784: Thomas-Krenn LES plus v2 (YANLING YL-KBRL2 V2)
IT8786: Thomas-Krenn LES plus v3 (YANLING YL-CLU L2)
IT8786: Thomas-Krenn LES network 6L v2 (YANLING YL-CLU6L)
--- drivers/watchdog/it87_wdt.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/watchdog/it87_wdt.c +13 -1
@@ -255,6 +255,7 @@ static struct watchdog_device wdt_dev = {static int __init it87_wdt_init (void ) {u8 chip_rev; +u8 ctrl;int rc; rc =superio_enter ();
@@ -313,7 +314,18 @@ static int __init it87_wdt_init(void)superio_select (GPIO );superio_outb (WDT_TOV1 ,WDTCFG ); -superio_outb (0x00 ,WDTCTRL ); + +switch (chip_type) { +case IT8784_ID : +case IT8786_ID : + ctrl =superio_inb (WDTCTRL ); + ctrl &=0x08 ; +superio_outb (ctrl,WDTCTRL ); +break ; +default : +superio_outb (0x00 ,WDTCTRL ); + } +superio_exit ();if (timeout <1 || timeout > max_units *60 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 139/219 drm/amd/display: make flip_timestamp_in_us a 64-bit variable
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josip Pavic <[email protected]>
[ Upstream commit 6fb12518ca58412dc51054e2a7400afb41328d85 ]
[Why]
This variable currently overflows after about 71 minutes. This doesn't cause any known functional issues but it does make debugging more difficult.
[How]
Make it a 64-bit variable.
--- drivers/gpu/drm/amd/display/dc/dc_hw_types.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dc_hw_types.h +1 -1
@@ -244,7 +244,7 @@ enum pixel_format {#define DC_MAX_DIRTY_RECTS 3struct dc_flip_addrs {struct dc_plane_address address; -unsigned int flip_timestamp_in_us; +unsigned long long flip_timestamp_in_us;bool flip_immediate;/* TODO: add flip duration for FreeSync */ bool triplebuffer_flips;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 140/219 clk: imx: clk-imx8qxp: fix LVDS bypass, pixel and phy clocks
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 3f5f63adeea7e7aa715e101ffe4b4ac9705f9664 ]
To be compatible with SCU firmware based on 1.15 a different clock routing for LVDS is needed.
--- drivers/clk/imx/clk-imx8qxp.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-)
drivers/clk/imx/clk-imx8qxp.c +20 -4
@@ -67,6 +67,22 @@ static const char * const lcd_pxl_sels[] = { "lcd_pxl_bypass_div_clk", }; +static const char *const lvds0_sels[] = { +"clk_dummy" , +"clk_dummy" , +"clk_dummy" , +"clk_dummy" , +"mipi0_lvds_bypass_clk" , +}; + +static const char *const lvds1_sels[] = { +"clk_dummy" , +"clk_dummy" , +"clk_dummy" , +"clk_dummy" , +"mipi1_lvds_bypass_clk" , +}; +static const char *const mipi_sels[] = {"clk_dummy" ,"clk_dummy" ,
@@ -201,9 +217,9 @@ static int imx8qxp_clk_probe(struct platform_device *pdev)/* MIPI-LVDS SS */ imx_clk_scu ("mipi0_bypass_clk" ,IMX_SC_R_MIPI_0 ,IMX_SC_PM_CLK_BYPASS );imx_clk_scu ("mipi0_pixel_clk" ,IMX_SC_R_MIPI_0 ,IMX_SC_PM_CLK_PER ); -imx_clk_scu ("mipi0_lvds_pixel_clk" ,IMX_SC_R_LVDS_0 ,IMX_SC_PM_CLK_MISC2 );imx_clk_scu ("mipi0_lvds_bypass_clk" ,IMX_SC_R_LVDS_0 ,IMX_SC_PM_CLK_BYPASS ); -imx_clk_scu ("mipi0_lvds_phy_clk" ,IMX_SC_R_LVDS_0 ,IMX_SC_PM_CLK_MISC3 ); +imx_clk_scu2 ("mipi0_lvds_pixel_clk" , lvds0_sels,ARRAY_SIZE (lvds0_sels),IMX_SC_R_LVDS_0 ,IMX_SC_PM_CLK_MISC2 ); +imx_clk_scu2 ("mipi0_lvds_phy_clk" , lvds0_sels,ARRAY_SIZE (lvds0_sels),IMX_SC_R_LVDS_0 ,IMX_SC_PM_CLK_MISC3 );imx_clk_scu2 ("mipi0_dsi_tx_esc_clk" , mipi_sels,ARRAY_SIZE (mipi_sels),IMX_SC_R_MIPI_0 ,IMX_SC_PM_CLK_MST_BUS );imx_clk_scu2 ("mipi0_dsi_rx_esc_clk" , mipi_sels,ARRAY_SIZE (mipi_sels),IMX_SC_R_MIPI_0 ,IMX_SC_PM_CLK_SLV_BUS );imx_clk_scu2 ("mipi0_dsi_phy_clk" , mipi_sels,ARRAY_SIZE (mipi_sels),IMX_SC_R_MIPI_0 ,IMX_SC_PM_CLK_PHY );
@@ -213,9 +229,9 @@ static int imx8qxp_clk_probe(struct platform_device *pdev)imx_clk_scu ("mipi1_bypass_clk" ,IMX_SC_R_MIPI_1 ,IMX_SC_PM_CLK_BYPASS );imx_clk_scu ("mipi1_pixel_clk" ,IMX_SC_R_MIPI_1 ,IMX_SC_PM_CLK_PER ); -imx_clk_scu ("mipi1_lvds_pixel_clk" ,IMX_SC_R_LVDS_1 ,IMX_SC_PM_CLK_MISC2 );imx_clk_scu ("mipi1_lvds_bypass_clk" ,IMX_SC_R_LVDS_1 ,IMX_SC_PM_CLK_BYPASS ); -imx_clk_scu ("mipi1_lvds_phy_clk" ,IMX_SC_R_LVDS_1 ,IMX_SC_PM_CLK_MISC3 ); +imx_clk_scu2 ("mipi1_lvds_pixel_clk" , lvds1_sels,ARRAY_SIZE (lvds1_sels),IMX_SC_R_LVDS_1 ,IMX_SC_PM_CLK_MISC2 ); +imx_clk_scu2 ("mipi1_lvds_phy_clk" , lvds1_sels,ARRAY_SIZE (lvds1_sels),IMX_SC_R_LVDS_1 ,IMX_SC_PM_CLK_MISC3 );imx_clk_scu2 ("mipi1_dsi_tx_esc_clk" , mipi_sels,ARRAY_SIZE (mipi_sels),IMX_SC_R_MIPI_1 ,IMX_SC_PM_CLK_MST_BUS );imx_clk_scu2 ("mipi1_dsi_rx_esc_clk" , mipi_sels,ARRAY_SIZE (mipi_sels),IMX_SC_R_MIPI_1 ,IMX_SC_PM_CLK_SLV_BUS );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 141/219 drm/amdgpu: Fix ecc irq enable/disable unpaired
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanley.Yang <[email protected]>
[ Upstream commit a32c6f7f5737cc7e31cd7ad5133f0d96fca12ea6 ]
The ecc_irq is disabled while GPU mode2 reset suspending process, but not be enabled during GPU mode2 reset resume process.
Changed from V1:
only do sdma/gfx ras_late_init in aldebaran_mode2_restore_ip delete amdgpu_ras_late_resume function
Changed from V2:
check umc ras supported before put ecc_irq
--- drivers/gpu/drm/amd/amdgpu/aldebaran.c | 26 +++++++++++++++++++++++++- drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c | 4 ++++ drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c | 5 +++++ drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 4 ++++ 4 files changed, 38 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/aldebaran.c +25 -1
@@ -333,6 +333,7 @@ aldebaran_mode2_restore_hwcontext(struct amdgpu_reset_control *reset_ctl, {struct list_head *reset_device_list = reset_context->reset_device_list;struct amdgpu_device *tmp_adev =NULL ; +struct amdgpu_ras *con;int r;if (reset_device_list ==NULL )
@@ -358,7 +359,30 @@ aldebaran_mode2_restore_hwcontext(struct amdgpu_reset_control *reset_ctl,*/ amdgpu_register_gpu_instance (tmp_adev); -/* Resume RAS */ +/* Resume RAS, ecc_irq */ + con =amdgpu_ras_get_context (tmp_adev); +if (!amdgpu_sriov_vf (tmp_adev) && con) { +if (tmp_adev->sdma.ras && + tmp_adev->sdma.ras->ras_block.ras_late_init) { + r = tmp_adev->sdma.ras->ras_block.ras_late_init (tmp_adev, + &tmp_adev->sdma.ras->ras_block.ras_comm); +if (r) { +dev_err (tmp_adev->dev,"SDMA failed to execute ras_late_init! ret:%d\n" , r); + goto end; + } + } + +if (tmp_adev->gfx.ras && + tmp_adev->gfx.ras->ras_block.ras_late_init) { + r = tmp_adev->gfx.ras->ras_block.ras_late_init (tmp_adev, + &tmp_adev->gfx.ras->ras_block.ras_comm); +if (r) { +dev_err (tmp_adev->dev,"GFX failed to execute ras_late_init! ret:%d\n" , r); + goto end; + } + } + } +amdgpu_ras_resume (tmp_adev);/* Update PSP FW topology after reset */
drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c +4 -0
@@ -1144,6 +1144,10 @@ static int gmc_v10_0_hw_fini(void *handle)amdgpu_irq_put (adev, &adev->gmc.vm_fault,0 ); +if (adev->gmc.ecc_irq.funcs && +amdgpu_ras_is_supported (adev,AMDGPU_RAS_BLOCK__UMC )) +amdgpu_irq_put (adev, &adev->gmc.ecc_irq,0 ); +return 0 ; }
drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c +5 -0
@@ -951,6 +951,11 @@ static int gmc_v11_0_hw_fini(void *handle) }amdgpu_irq_put (adev, &adev->gmc.vm_fault,0 ); + +if (adev->gmc.ecc_irq.funcs && +amdgpu_ras_is_supported (adev,AMDGPU_RAS_BLOCK__UMC )) +amdgpu_irq_put (adev, &adev->gmc.ecc_irq,0 ); +gmc_v11_0_gart_disable (adev);return 0 ;
drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c +4 -0
@@ -1900,6 +1900,10 @@ static int gmc_v9_0_hw_fini(void *handle)amdgpu_irq_put (adev, &adev->gmc.vm_fault,0 ); +if (adev->gmc.ecc_irq.funcs && +amdgpu_ras_is_supported (adev,AMDGPU_RAS_BLOCK__UMC )) +amdgpu_irq_put (adev, &adev->gmc.ecc_irq,0 ); +return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 142/219 drm/amdgpu: Let KFD sync with VM fences
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Kuehling <[email protected]>
[ Upstream commit ec9ba4821fa52b5efdbc4cdf0a77497990655231 ]
Change the rules for amdgpu_sync_resv to let KFD synchronize with VM fences on page table reservations. This fixes intermittent memory corruption after evictions when using amdgpu_vm_handle_moved to update page tables for VM mappings managed through render nodes.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c +2 -1
@@ -191,7 +191,8 @@ static bool amdgpu_sync_test_fence(struct amdgpu_device *adev,/* Never sync to VM updates either. */ if (fence_owner ==AMDGPU_FENCE_OWNER_VM && - owner !=AMDGPU_FENCE_OWNER_UNDEFINED ) + owner !=AMDGPU_FENCE_OWNER_UNDEFINED && + owner !=AMDGPU_FENCE_OWNER_KFD )return false;/* Ignore fences depending on the sync mode */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 143/219 drm/amdgpu: Fix *fw from request_firmware() not released in amdgpu_ucode_request()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit 13a1851f923d9a7a78a477497295c2dfd16ad4a4 ]
Fixes the below:drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c:1404 amdgpu_ucode_request() warn: '*fw' from request_firmware() not released on lines: 1404.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +5 -1
@@ -1110,9 +1110,13 @@ int amdgpu_ucode_request(struct amdgpu_device *adev, const struct firmware **fw,if (err)return -ENODEV ; + err =amdgpu_ucode_validate (*fw); -if (err) +if (err) {dev_dbg (adev->dev,"\"%s\" failed to validate\n" , fw_name); +release_firmware (*fw); + *fw =NULL ; + }return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 144/219 drm/amdgpu: Drop fence check in to_amdgpu_amdkfd_fence()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit bf2ad4fb8adca89374b54b225d494e0b1956dbea ]
Return value of container_of(...) can't be null, so null check is not required for 'fence'. Hence drop its NULL check.
Fixes the below:drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c:93 to_amdgpu_amdkfd_fence() warn: can 'fence' even be NULL?
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c +1 -1
@@ -90,7 +90,7 @@ struct amdgpu_amdkfd_fence *to_amdgpu_amdkfd_fence(struct dma_fence *f)return NULL ; fence = container_of(f, struct amdgpu_amdkfd_fence, base); -if (fence && f->ops == &amdkfd_fence_ops) +if (f->ops == &amdkfd_fence_ops)return fence;return NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 145/219 drm/amdkfd: Fix iterator used outside loop in kfd_add_peer_prop()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit b1a428b45dc7e47c7acc2ad0d08d8a6dda910c4c ]
Fix the following about iterator use:drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1456 kfd_add_peer_prop() warn: iterator used outside loop: 'iolink3'
--- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 24 ++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_topology.c +13 -11
@@ -1513,17 +1513,19 @@ static int kfd_add_peer_prop(struct kfd_topology_device *kdev,/* CPU->CPU link*/ cpu_dev =kfd_topology_device_by_proximity_domain (iolink1->node_to);if (cpu_dev) { -list_for_each_entry (iolink3, &cpu_dev->io_link_props, list) -if (iolink3->node_to == iolink2->node_to) -break ; - - props->weight += iolink3->weight; - props->min_latency += iolink3->min_latency; - props->max_latency += iolink3->max_latency; - props->min_bandwidth =min (props->min_bandwidth, - iolink3->min_bandwidth); - props->max_bandwidth =min (props->max_bandwidth, - iolink3->max_bandwidth); +list_for_each_entry (iolink3, &cpu_dev->io_link_props, list) { +if (iolink3->node_to != iolink2->node_to) +continue ; + + props->weight += iolink3->weight; + props->min_latency += iolink3->min_latency; + props->max_latency += iolink3->max_latency; + props->min_bandwidth =min (props->min_bandwidth, + iolink3->min_bandwidth); + props->max_bandwidth =min (props->max_bandwidth, + iolink3->max_bandwidth); +break ; + } }else {WARN (1 ,"CPU node not found" ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 146/219 ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: bo liu <[email protected]>
[ Upstream commit 7aeb259086487417f0fecf66e325bee133e8813a ]
When OMTP headset plugin the headset jack of CX8070 and SN6160 sound cards, the headset type detection circuit will recognize the headset type as CTIA. At this point, plugout and plugin the headset will get the correct headset type as OMTP.
The reason for the failure of headset type recognition is that the sound card creation will enable the VREF voltage of the headset mic, which interferes with the headset type automatic detection circuit. Plugout and plugin the headset will restart the headset detection and get the correct headset type.
The patch is disable the VREF voltage when the headset is not present, and will enable the VREF voltage when the headset is present.
--- sound/pci/hda/patch_conexant.c | 115 ++++++++++++++++++++++++++++++++- 1 file changed, 113 insertions(+), 2 deletions(-)
sound/pci/hda/patch_conexant.c +113 -2
@@ -21,6 +21,12 @@#include "hda_jack.h" #include "hda_generic.h" +enum { +CX_HEADSET_NOPRESENT =0 , +CX_HEADSET_PARTPRESENT , +CX_HEADSET_ALLPRESENT , +}; +struct conexant_spec {struct hda_gen_spec gen;
@@ -42,7 +48,8 @@ struct conexant_spec {unsigned int gpio_led;unsigned int gpio_mute_led_mask;unsigned int gpio_mic_led_mask; - +unsigned int headset_present_flag; +bool is_cx8070_sn6140; };
@@ -164,6 +171,27 @@ static void cxt_init_gpio_led(struct hda_codec *codec) } } +static void cx_fixup_headset_recog (struct hda_codec *codec) +{ +unsigned int mic_persent; + +/* fix some headset type recognize fail issue, such as EDIFIER headset */ +/* set micbiasd output current comparator threshold from 66% to 55%. */ +snd_hda_codec_write (codec,0x1c ,0 ,0x320 ,0x010 ); +/* set OFF voltage for DFET from -1.2V to -0.8V, set headset micbias registor +* value adjustment trim from 2.2K ohms to 2.0K ohms. +*/ +snd_hda_codec_write (codec,0x1c ,0 ,0x3b0 ,0xe10 ); +/* fix reboot headset type recognize fail issue */ + mic_persent =snd_hda_codec_read (codec,0x19 ,0 ,AC_VERB_GET_PIN_SENSE ,0x0 ); +if (mic_persent &AC_PINSENSE_PRESENCE ) +/* enable headset mic VREF */ +snd_hda_codec_write (codec,0x19 ,0 ,AC_VERB_SET_PIN_WIDGET_CONTROL ,0x24 ); +else +/* disable headset mic VREF */ +snd_hda_codec_write (codec,0x19 ,0 ,AC_VERB_SET_PIN_WIDGET_CONTROL ,0x20 ); +} +static int cx_auto_init (struct hda_codec *codec) {struct conexant_spec *spec = codec->spec;
@@ -174,6 +202,9 @@ static int cx_auto_init(struct hda_codec *codec)cxt_init_gpio_led (codec);snd_hda_apply_fixup (codec,HDA_FIXUP_ACT_INIT ); +if (spec->is_cx8070_sn6140) +cx_fixup_headset_recog (codec); +return 0 ; }
@@ -192,6 +223,77 @@ static void cx_auto_free(struct hda_codec *codec)snd_hda_gen_free (codec); } +static void cx_process_headset_plugin (struct hda_codec *codec) +{ +unsigned int val; +unsigned int count =0 ; + +/* Wait headset detect done. */ +do { + val =snd_hda_codec_read (codec,0x1c ,0 ,0xca0 ,0x0 ); +if (val &0x080 ) { +codec_dbg (codec,"headset type detect done!\n" ); +break ; + } +msleep (20 ); + count++; + }while (count <3 ); + val =snd_hda_codec_read (codec,0x1c ,0 ,0xcb0 ,0x0 ); +if (val &0x800 ) { +codec_dbg (codec,"headset plugin, type is CTIA\n" ); +snd_hda_codec_write (codec,0x19 ,0 ,AC_VERB_SET_PIN_WIDGET_CONTROL ,0x24 ); + }else if (val &0x400 ) { +codec_dbg (codec,"headset plugin, type is OMTP\n" ); +snd_hda_codec_write (codec,0x19 ,0 ,AC_VERB_SET_PIN_WIDGET_CONTROL ,0x24 ); + }else { +codec_dbg (codec,"headphone plugin\n" ); + } +} + +static void cx_update_headset_mic_vref (struct hda_codec *codec,unsigned int res) +{ +unsigned int phone_present, mic_persent, phone_tag, mic_tag; +struct conexant_spec *spec = codec->spec; + +/* In cx8070 and sn6140, the node 16 can only be config to headphone or disabled, +* the node 19 can only be config to microphone or disabled. +* Check hp&mic tag to process headset pulgin&plugout. +*/ + phone_tag =snd_hda_codec_read (codec,0x16 ,0 ,AC_VERB_GET_UNSOLICITED_RESPONSE ,0x0 ); + mic_tag =snd_hda_codec_read (codec,0x19 ,0 ,AC_VERB_GET_UNSOLICITED_RESPONSE ,0x0 ); +if ((phone_tag & (res >>AC_UNSOL_RES_TAG_SHIFT )) || + (mic_tag & (res >>AC_UNSOL_RES_TAG_SHIFT ))) { + phone_present =snd_hda_codec_read (codec,0x16 ,0 ,AC_VERB_GET_PIN_SENSE ,0x0 ); +if (!(phone_present &AC_PINSENSE_PRESENCE )) {/* headphone plugout */ + spec->headset_present_flag =CX_HEADSET_NOPRESENT ; +snd_hda_codec_write (codec,0x19 ,0 ,AC_VERB_SET_PIN_WIDGET_CONTROL ,0x20 ); +return ; + } +if (spec->headset_present_flag ==CX_HEADSET_NOPRESENT ) { + spec->headset_present_flag =CX_HEADSET_PARTPRESENT ; + }else if (spec->headset_present_flag ==CX_HEADSET_PARTPRESENT ) { + mic_persent =snd_hda_codec_read (codec,0x19 ,0 , +AC_VERB_GET_PIN_SENSE ,0x0 ); +/* headset is present */ +if ((phone_present &AC_PINSENSE_PRESENCE ) && + (mic_persent &AC_PINSENSE_PRESENCE )) { +cx_process_headset_plugin (codec); + spec->headset_present_flag =CX_HEADSET_ALLPRESENT ; + } + } + } +} + +static void cx_jack_unsol_event (struct hda_codec *codec,unsigned int res) +{ +struct conexant_spec *spec = codec->spec; + +if (spec->is_cx8070_sn6140) +cx_update_headset_mic_vref (codec, res); + +snd_hda_jack_unsol_event (codec, res); +} +#ifdef CONFIG_PM static int cx_auto_suspend (struct hda_codec *codec) {
@@ -205,7 +307,7 @@ static const struct hda_codec_ops cx_auto_patch_ops = { .build_pcms = snd_hda_gen_build_pcms, .init = cx_auto_init, .free = cx_auto_free, - .unsol_event = snd_hda_jack_unsol_event, + .unsol_event = cx_jack_unsol_event, #ifdef CONFIG_PM .suspend = cx_auto_suspend, .check_power_status = snd_hda_gen_check_power_status,
@@ -1042,6 +1144,15 @@ static int patch_conexant_auto(struct hda_codec *codec) codec->spec = spec; codec->patch_ops = cx_auto_patch_ops; +/* init cx8070/sn6140 flag and reset headset_present_flag */ +switch (codec->core.vendor_id) { +case 0x14f11f86 : +case 0x14f11f87 : + spec->is_cx8070_sn6140 = true; + spec->headset_present_flag =CX_HEADSET_NOPRESENT ; +break ; + } +cx_auto_parse_eapd (codec); spec->gen.own_eapd_ctl =1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 147/219 leds: trigger: panic: Dont register panic notifier if creating the trigger failed
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
[ Upstream commit afacb21834bb02785ddb0c3ec197208803b74faa ]
It doesn't make sense to register the panic notifier if creating the panic trigger failed.
--- drivers/leds/trigger/ledtrig-panic.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/leds/trigger/ledtrig-panic.c +4 -1
@@ -64,10 +64,13 @@ static long led_panic_blink(int state)static int __init ledtrig_panic_init (void ) { +led_trigger_register_simple ("panic" , &trigger); +if (!trigger) +return -ENOMEM ; +atomic_notifier_chain_register (&panic_notifier_list, &led_trigger_panic_nb); -led_trigger_register_simple ("panic" , &trigger); panic_blink = led_panic_blink;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 148/219 um: Fix naming clash between UML and scheduler
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Ivanov <[email protected]>
[ Upstream commit 541d4e4d435c8b9bfd29f70a1da4a2db97794e0a ]
__cant_sleep was already used and exported by the scheduler. The name had to be changed to a UML specific one.
--- arch/um/include/shared/kern_util.h | 2 +- arch/um/kernel/process.c | 2 +- arch/um/os-Linux/helper.c | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-)
arch/um/include/shared/kern_util.h +1 -1
@@ -50,7 +50,7 @@ extern void do_uml_exitcalls(void);* Are we disallowed to sleep? Used to choose between GFP_KERNEL and * GFP_ATOMIC. */ -extern int __cant_sleep (void ); +extern int __uml_cant_sleep (void );extern int get_current_pid (void );extern int copy_from_user_proc (void *to,void *from,int size);extern char *uml_strdup (const char *string);
arch/um/kernel/process.c +1 -1
@@ -220,7 +220,7 @@ void arch_cpu_idle(void)raw_local_irq_enable (); } -int __cant_sleep (void ) { +int __uml_cant_sleep (void ) {return in_atomic () ||irqs_disabled () ||in_interrupt ();/* Is in_interrupt() really needed? */ }
arch/um/os-Linux/helper.c +3 -3
@@ -46,7 +46,7 @@ int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv)unsigned long stack, sp;int pid, fds[2 ], ret, n; - stack =alloc_stack (0 ,__cant_sleep ()); + stack =alloc_stack (0 ,__uml_cant_sleep ());if (stack ==0 )return -ENOMEM ;
@@ -70,7 +70,7 @@ int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv) data.pre_data = pre_data; data.argv = argv; data.fd = fds[1 ]; - data.buf =__cant_sleep () ?uml_kmalloc (PATH_MAX ,UM_GFP_ATOMIC ) : + data.buf =__uml_cant_sleep () ?uml_kmalloc (PATH_MAX ,UM_GFP_ATOMIC ) :uml_kmalloc (PATH_MAX ,UM_GFP_KERNEL ); pid =clone (helper_child, (void *) sp,CLONE_VM , &data);if (pid <0 ) {
@@ -121,7 +121,7 @@ int run_helper_thread(int (*proc)(void *), void *arg, unsigned int flags,unsigned long stack, sp;int pid, status, err; - stack =alloc_stack (0 ,__cant_sleep ()); + stack =alloc_stack (0 ,__uml_cant_sleep ());if (stack ==0 )return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 149/219 um: Dont use vfprintf() for os_info()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit 236f9fe39b02c15fa5530b53e9cca48354394389 ]
The threads allocated inside the kernel have only a single page of stack. Unfortunately, the vfprintf function in standard glibc may use too much stack-space, overflowing it.
To make os_info safe to be used by helper threads, use the kernel vscnprintf function into a smallish buffer and write out the information to stderr.
--- arch/um/os-Linux/util.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
arch/um/os-Linux/util.c +17 -2
@@ -173,23 +173,38 @@ __uml_setup("quiet", quiet_cmd_param,"quiet\n" " Turns off information messages during boot.\n\n"); +/* +* The os_info/os_warn functions will be called by helper threads. These +* have a very limited stack size and using the libc formatting functions +* may overflow the stack. +* So pull in the kernel vscnprintf and use that instead with a fixed +* on-stack buffer. +*/ +int vscnprintf (char *buf,size_t size,const char *fmt,va_list args); +void os_info (const char *fmt, ...) { +char buf[256 ];va_list list; +int len;if (quiet_info)return ;va_start (list, fmt); -vfprintf (stderr, fmt, list); + len =vscnprintf (buf,sizeof (buf), fmt, list); +fwrite (buf, len,1 , stderr);va_end (list); }void os_warn (const char *fmt, ...) { +char buf[256 ];va_list list; +int len;va_start (list, fmt); -vfprintf (stderr, fmt, list); + len =vscnprintf (buf,sizeof (buf), fmt, list); +fwrite (buf, len,1 , stderr);va_end (list); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 150/219 um: net: Fix return type of uml_net_start_xmit()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
[ Upstream commit 7d748f60a4b82b50bf25fad1bd42d33f049f76aa ]
With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. A warning in clang aims to catch these at compile time, which reveals:
arch/um/drivers/net_kern.c:353:21: warning: incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)' (aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)' [-Wincompatible-function-pointer-types-strict]
353 | .ndo_start_xmit = uml_net_start_xmit,
| ^~~~~~~~~~~~~~~~~~
1 warning generated.
->ndo_start_xmit() in 'struct net_device_ops' expects a return type of 'netdev_tx_t', not 'int'. Adjust the return type of uml_net_start_xmit() to match the prototype's to resolve the warning. While UML does not currently implement support for kCFI, it could in the future, which means this warning becomes a fatal CFI failure at run time.
--- arch/um/drivers/net_kern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/um/drivers/net_kern.c +1 -1
@@ -204,7 +204,7 @@ static int uml_net_close(struct net_device *dev)return 0 ; } -static int uml_net_start_xmit (struct sk_buff *skb,struct net_device *dev) +static netdev_tx_t uml_net_start_xmit (struct sk_buff *skb,struct net_device *dev) {struct uml_net_private *lp =netdev_priv (dev);unsigned long flags;
Signature · 1 line
2.43.0