6.7.4-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 6.7.4-rc1 review
This is the start of the stable review cycle for the 6.7.4 release. There are 353 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Mon, 05 Feb 2024 03:51:47 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.7.4-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.7.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.7.4-rc1
Zhengchao Shao <[email protected]>
bonding: remove print in bond_verify_device_path
Yonghong Song <[email protected]>
selftests/bpf: Remove flaky test_btf_id test
Konrad Dybcio <[email protected]>
drm/msm/dsi: Enable runtime PM
Jonathan Gray <[email protected]>
Revert "drm/amd/display: Disable PSR-SU on Parade 0803 TCON again"
Marco Elver <[email protected]>
mm, kmsan: fix infinite recursion due to RCU critical section
Huang Shijie <[email protected]>
arm64: irq: set the correct node for shadow call stack
Pavan Kumar Linga <[email protected]>
idpf: avoid compiler padding in virtchnl2_ptype struct
Paolo Abeni <[email protected]>
selftests: net: enable some more knobs
Jakub Kicinski <[email protected]>
selftests: net: add missing config for NF_TARGET_TTL
Benjamin Poirier <[email protected]>
selftests: bonding: Check initial state
Benjamin Poirier <[email protected]>
selftests: team: Add missing config options
Breno Leitao <[email protected]>
net: sysfs: Fix /sys/class/net/<iface> path
Geetha sowjanya <[email protected]>
octeontx2-pf: Remove xdp queues on program detach
Paolo Abeni <[email protected]>
selftests: net: don't access /dev/stdout in pmtu.sh
Paolo Abeni <[email protected]>
selftests: net: fix available tunnels detection
Paolo Abeni <[email protected]>
selftests: net: add missing config for pmtu.sh tests
Jakub Kicinski <[email protected]>
selftests: net: add missing config for nftables-backed iptables
Brett Creeley <[email protected]>
pds_core: Rework teardown/setup flow to be more common
Brett Creeley <[email protected]>
pds_core: Clear BARs on reset
Brett Creeley <[email protected]>
pds_core: Prevent race issues involving the adminq
Brett Creeley <[email protected]>
pds_core: Use struct pdsc for the pdsc_adminq_isr private data
Brett Creeley <[email protected]>
pds_core: Cancel AQ work on teardown
Brett Creeley <[email protected]>
pds_core: Prevent health thread from running during reset/remove
Eric Dumazet <[email protected]>
af_unix: fix lockdep positive in sk_diag_dump_icons()
Zhipeng Lu <[email protected]>
net: ipv4: fix a memleak in ip_setup_cork
Pablo Neira Ayuso <[email protected]>
netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
Pablo Neira Ayuso <[email protected]>
netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
Jozsef Kadlecsik <[email protected]>
netfilter: ipset: fix performance regression in swap operation
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV
Ryan Schaefer <[email protected]>
netfilter: conntrack: correct window scaling with retransmitted SYN
Matthias May <[email protected]>
selftests: net: add missing config for GENEVE
Parav Pandit <[email protected]>
devlink: Fix referring to hw_addr attribute during state validation
Linus Lüssing <[email protected]>
bridge: mcast: fix disabled snooping after long uptime
Ido Schimmel <[email protected]>
selftests: net: Add missing matchall classifier
Eric Dumazet <[email protected]>
llc: call sock_orphan() at release time
Helge Deller <[email protected]>
ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
Michal Vokáč <[email protected]>
net: dsa: qca8k: fix illegal usage of GPIO
Christophe JAILLET <[email protected]>
ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
Jedrzej Jagielski <[email protected]>
ixgbe: Refactor overtemp event handling
Jedrzej Jagielski <[email protected]>
ixgbe: Refactor returning internal error codes
Jacob Keller <[email protected]>
e1000e: correct maximum frequency adjustment values
Eric Dumazet <[email protected]>
tcp: add sanity checks to rx zerocopy
Linus Torvalds <[email protected]>
tracefs: remove stale 'update_gid' code
Horatiu Vultur <[email protected]>
net: lan966x: Fix port configuration when using SGMII interface
Nicolas Dichtel <[email protected]>
ipmr: fix kernel panic when forwarding mcast packets
Daniel Golle <[email protected]>
net: dsa: mt7530: fix 10M/100M speed on MT7988 switch
Eric Dumazet <[email protected]>
ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
Paolo Abeni <[email protected]>
selftests: net: give more time for GRO aggregation
Paolo Abeni <[email protected]>
selftests: net: add missing required classifier
Paolo Abeni <[email protected]>
selftests: net: add missing config for big tcp tests
Gaurav Jain <[email protected]>
crypto: caam - fix asynchronous hash
Daniel Golle <[email protected]>
net: phy: mediatek-ge-soc: sync driver with MediaTek SDK
Daniel Golle <[email protected]>
net: ethernet: mtk_eth_soc: set DMA coherent mask to get PPE working
Praveen Kaligineedi <[email protected]>
gve: Fix skb truesize underestimation
Paolo Abeni <[email protected]>
selftests: net: explicitly wait for listener ready
Paolo Abeni <[email protected]>
selftests: net: remove dependency on ebpf tests
Su Hui <[email protected]>
HID: hidraw: fix a problem of memory leak in hidraw_release()
Ming Lei <[email protected]>
scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
Romain Naour <[email protected]>
regulator: ti-abb: don't use devm_platform_ioremap_resource_byname for shared interrupt register
Marco Pagani <[email protected]>
kunit: run test suites only after module initialization completes
Su Hui <[email protected]>
scsi: isci: Fix an error code problem in isci_io_request_build()
Alexandre Ghiti <[email protected]>
riscv: Fix build error on rv32 + XIP
Jonathan Kim <[email protected]>
drm/amdkfd: only flush mes process context if mes support is there
Rob Clark <[email protected]>
drm/msm/dpu: Correct UBWC settings for sc8280xp
Stephen Rothwell <[email protected]>
drm: using mul_u32_u32() requires linux/math64.h
Edward Adam Davis <[email protected]>
wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
Peter Zijlstra <[email protected]>
perf: Fix the nr_addr_filters fix
Tim Lunn <[email protected]>
i2c: rk3x: Adjust mask/value offset for i2c2 on rv1126
Srinivasan Shanmugam <[email protected]>
drm/amdkfd: Fix 'node' NULL check in 'svm_range_get_range_boundaries()'
Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()'
Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Fix with right return code '-EIO' in 'amdgpu_gmc_vram_checking()'
Srinivasan Shanmugam <[email protected]>
drm/amd/powerplay: Fix kzalloc parameter 'ATOM_Tonga_PPM_Table' in 'get_platform_power_management_table()'
Alex Deucher <[email protected]>
drm/amdgpu: fix avg vs input power reporting on smu7
Wenchao Hao <[email protected]>
ceph: fix invalid pointer access if get_quota_realm return ERR_PTR
Xiubo Li <[email protected]>
ceph: fix deadlock or deadcode of misusing dget()
Venky Shankar <[email protected]>
ceph: reinitialize mds feature bit even when session in open
Ming Lei <[email protected]>
blk-mq: fix IO hang from sbitmap wakeup race
Zhu Yanjun <[email protected]>
virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings
Philip Yang <[email protected]>
drm/amdkfd: Fix lock dependency warning with srcu
Daniel Miess <[email protected]>
Revert "drm/amd/display: Fix conversions between bytes and KB"
Martin Tsai <[email protected]>
drm/amd/display: To adjust dprefclk by down spread percentage
Felix Kuehling <[email protected]>
drm/amdkfd: Fix lock dependency warning
ChiYuan Huang <[email protected]>
ASoC: codecs: rtq9128: Fix TDM enable and DAI format control flow
ChiYuan Huang <[email protected]>
ASoC: codecs: rtq9128: Fix PM_RUNTIME usage
Ian Rogers <[email protected]>
libsubcmd: Fix memory leak in uniq()
Hans de Goede <[email protected]>
misc: lis3lv02d_i2c: Add missing setting of the reg_ctrl callback
Yinbo Zhu <[email protected]>
usb: xhci-plat: fix usb disconnect issue after s4
Steven Rostedt (Google) <[email protected]>
tracefs/eventfs: Use root and instance inodes as default ownership
David Howells <[email protected]>
9p: Fix initialisation of netfs_inode for 9p
Bjorn Helgaas <[email protected]>
PCI/AER: Decode Requester ID when no error info found
Ilpo Järvinen <[email protected]>
PCI: Fix 64GT/s effective data rate calculation
Piro Yang <[email protected]>
staging: vme_user: Fix the issue of return the wrong error code
Yu-Che Cheng <[email protected]>
spmi: mediatek: Fix UAF on device remove
Max Kellermann <[email protected]>
fs/kernfs/dir: obey S_ISGID
Crescent CY Hsieh <[email protected]>
tty: serial: 8250: Set RS422 interface by default to fix Moxa RS422/RS485 PCIe boards
Adrian Reber <[email protected]>
tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE
Jo Van Bulck <[email protected]>
selftests/sgx: Fix linker script asserts
Hardik Gajjar <[email protected]>
usb: hub: Add quirk to decrease IN-ep poll interval for Microchip USB491x hub
Hardik Gajjar <[email protected]>
usb: hub: Replace hardcoded quirk value with BIT() macro
Yaxiong Tian <[email protected]>
extcon: fix possible name leak in extcon_dev_register()
Mathias Nyman <[email protected]>
xhci: fix possible null pointer deref during xhci urb enqueue
James Clark <[email protected]>
perf cs-etm: Bump minimum OpenCSD version to ensure a bugfix is present
Daniel Stodden <[email protected]>
PCI: switchtec: Fix stdev_release() crash after surprise hot remove
Guilherme G. Piccoli <[email protected]>
PCI: Only override AMD USB controller if required
Xiaowu.ding <[email protected]>
mailbox: arm_mhuv2: Fix a bug for mhuv2_sender_interrupt
Peter Robinson <[email protected]>
mfd: ti_am335x_tscadc: Fix TI SoC dependencies
Oleksandr Tyshchenko <[email protected]>
xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import
Frederik Haxel <[email protected]>
riscv: Make XIP bootable again
Michael Maltsev <[email protected]>
ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CGA
Ben Mayo <[email protected]>
ACPI: resource: Add DMI quirks for ASUS Vivobook E1504GA and E1504GAB
Harshit Shah <[email protected]>
i3c: master: cdns: Update maximum prescaler value for i2c clock
Johannes Berg <[email protected]>
um: time-travel: fix time corruption
Nathan Chancellor <[email protected]>
um: net: Fix return type of uml_net_start_xmit()
Benjamin Berg <[email protected]>
um: Don't use vfprintf() for os_info()
Anton Ivanov <[email protected]>
um: Fix naming clash between UML and scheduler
Heiner Kallweit <[email protected]>
leds: trigger: panic: Don't register panic notifier if creating the trigger failed
Andy Shevchenko <[email protected]>
pinctrl: baytrail: Fix types of config value in byt_pin_config_set()
bo liu <[email protected]>
ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140
Alex Deucher <[email protected]>
drm/amdgpu: apply the RV2 system aperture fix to RN/CZN as well
Srinivasan Shanmugam <[email protected]>
drm/amdkfd: Fix iterator used outside loop in 'kfd_add_peer_prop()'
Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Fix '*fw' from request_firmware() not released in 'amdgpu_ucode_request()'
Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Fix variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()'
Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper()
Ivan Lipski <[email protected]>
Re-revert "drm/amd/display: Enable Replay for static screen use cases"
Felix Kuehling <[email protected]>
drm/amdgpu: Let KFD sync with VM fences
Meenakshikumar Somasundaram <[email protected]>
drm/amd/display: Fix minor issues in BW Allocation Phase2
Stanley.Yang <[email protected]>
drm/amdgpu: Fix ecc irq enable/disable unpaired
Alexander Stein <[email protected]>
clk: imx: clk-imx8qxp: fix LVDS bypass, pixel and phy clocks
Kuan-Wei Chiu <[email protected]>
clk: imx: scu: Fix memory leak in __imx_clk_gpr_scu()
Alvin Lee <[email protected]>
drm/amd/display: Only clear symclk otg flag for HDMI
Michael Strauss <[email protected]>
drm/amd/display: Fix lightup regression with DP2 single display configs
Allen Pan <[email protected]>
drm/amd/display: fix usb-c connector_type
Josip Pavic <[email protected]>
drm/amd/display: make flip_timestamp_in_us a 64-bit variable
Dafna Hirschfeld <[email protected]>
accel/habanalabs/gaudi2: fix undef opcode reporting
Farah Kassabri <[email protected]>
accel/habanalabs: fix EQ heartbeat mechanism
Oded Gabbay <[email protected]>
accel/habanalabs: add support for Gaudi2C device
Werner Fischer <[email protected]>
watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786
Ben Dooks <[email protected]>
watchdog: starfive: add lock annotations to fix context imbalances
Kuan-Wei Chiu <[email protected]>
clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
Kuan-Wei Chiu <[email protected]>
clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
Wang, Beyond <[email protected]>
drm/amdgpu: fix ftrace event amdgpu_bo_move always move on same heap
Paloma Arellano <[email protected]>
drm/msm/dpu: Add mutex lock in control vblank irq
Abhinav Kumar <[email protected]>
drm/msm/dpu: fix writeback programming for YUV cases
Rob Clark <[email protected]>
drm/msm/dpu: Ratelimit framedone timeout msgs
Dmitry Baryshkov <[email protected]>
drm/msm/dpu: enable writeback on SM8450
Dmitry Baryshkov <[email protected]>
drm/msm/dpu: enable writeback on SM8350
Jonathan Kim <[email protected]>
drm/amdkfd: fix mes set shader debugger process management
Alvin Lee <[email protected]>
drm/amd/display: Force p-state disallow if leaving no plane config
Alvin Lee <[email protected]>
drm/amd/display: For prefetch mode > 0, extend prefetch if possible
Kieran Bingham <[email protected]>
media: i2c: imx335: Fix hblank min/max values
Hans de Goede <[email protected]>
media: ov2740: Fix hts value
Su Hui <[email protected]>
media: ddbridge: fix an error code problem in ddb_probe
Ming Qian <[email protected]>
media: amphion: remove mutext lock in condition of wait_event
Daniel Vacek <[email protected]>
IB/ipoib: Fix mcast list locking
Douglas Anderson <[email protected]>
drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
Chao Yu <[email protected]>
f2fs: fix to tag gcing flag on page during block migration
James Seo <[email protected]>
hwmon: (hp-wmi-sensors) Fix failure to load on EliteDesk 800 G6
Xing Tong Wu <[email protected]>
hwmon: (nct6775) Fix fan speed set failure in automatic mode
Laurent Pinchart <[email protected]>
media: rkisp1: resizer: Stop manual allocation of v4l2_subdev_state
Tomi Valkeinen <[email protected]>
media: rkisp1: Fix IRQ disable race issue
Tomi Valkeinen <[email protected]>
media: rkisp1: Store IRQ lines
Tomi Valkeinen <[email protected]>
media: rkisp1: Fix IRQ handler return values
Tomi Valkeinen <[email protected]>
media: rkisp1: Drop IRQF_SHARED
Ricardo Ribalda <[email protected]>
media: uvcvideo: Fix power line control for SunplusIT camera
Ricardo Ribalda <[email protected]>
media: uvcvideo: Fix power line control for a Chicony camera
Neil Armstrong <[email protected]>
drm/msm/dp: Add DisplayPort controller for SM8650
Pierre-Louis Bossart <[email protected]>
ALSA: hda: intel-dspcfg: add filters for ARL-S and ARL
Pierre-Louis Bossart <[email protected]>
ALSA: hda: Intel: add HDA_ARL PCI ID support
Pierre-Louis Bossart <[email protected]>
PCI: add INTEL_HDA_ARL to pci_ids.h
Michael Tretter <[email protected]>
media: rockchip: rga: fix swizzling for RGB formats
Ghanshyam Agrawal <[email protected]>
media: stk1160: Fixed high volume of stk1160_dbg messages
Tomi Valkeinen <[email protected]>
drm/mipi-dsi: Fix detach call without attach
Tomi Valkeinen <[email protected]>
drm/framebuffer: Fix use of uninitialized variable
Tomi Valkeinen <[email protected]>
drm/drm_file: fix use of uninitialized variable
Wenjing Liu <[email protected]>
drm/amd/display: add support for DTO genarated dscclk
Dennis Chan <[email protected]>
drm/amd/display: Fix Replay Desync Error IRQ handler
Nicholas Susanto <[email protected]>
drm/amd/display: Fix disable_otg_wa logic
Ilya Bakoulin <[email protected]>
drm/amd/display: Fix MST PBN/X.Y value calculations
Charlene Liu <[email protected]>
drm/amd/display: initialize all the dpm level's stutter latency
Venkata Prasad Potturu <[email protected]>
ASoC: amd: Add new dmi entries for acp5x platform
Jaegeuk Kim <[email protected]>
f2fs: fix write pointers on zoned device after roll forward
Meenakshikumar Somasundaram <[email protected]>
drm/amd/display: Fix tiled display misalignment
Xin Ji <[email protected]>
drm/bridge: anx7625: Fix Set HPD irq detect window to 2ms
Hsin-Yi Wang <[email protected]>
drm/panel-edp: Add override_edid_mode quirk for generic edp
Jack Wang <[email protected]>
RDMA/IPoIB: Fix error code return in ipoib_mcast_join
Danylo Piliaiev <[email protected]>
drm/msm/a690: Fix reg values for a690
Jan Kara <[email protected]>
ocfs2: Avoid touching renamed directory if parent does not change
Jan Kara <[email protected]>
reiserfs: Avoid touching renamed directory if parent does not change
Al Viro <[email protected]>
fast_dput(): handle underflows gracefully
Cristian Ciocaltea <[email protected]>
ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
Takashi Iwai <[email protected]>
ALSA: hda: Refer to correct stream index at loops
Chao Yu <[email protected]>
f2fs: fix to check return value of f2fs_reserve_new_block()
Linus Walleij <[email protected]>
ARM: dts: usr8200: Fix phy registers
Vladimir Oltean <[email protected]>
net: dsa: qca8k: put MDIO bus OF node on qca8k_mdio_register() failure
Mina Almasry <[email protected]>
net: kcm: fix direct access to bv_len
Suman Ghosh <[email protected]>
octeontx2-af: Fix max NPC MCAM entry check while validating ref_entry
Andrii Staikov <[email protected]>
i40e: Fix VF disable behavior to block all traffic
Chunyan Zhang <[email protected]>
arm64: dts: sprd: Change UMS512 idle-state nodename to match bindings
Chunyan Zhang <[email protected]>
arm64: dts: sprd: Add clock reference for pll2 on UMS512
Lin Ma <[email protected]>
bridge: cfm: fix enum typo in br_cc_ccm_tx_parse
Wen Gu <[email protected]>
net/smc: disable SEID on non-s390 archs where virtual ISM may be used
Frédéric Danis <[email protected]>
Bluetooth: L2CAP: Fix possible multiple reject send
clancy shang <[email protected]>
Bluetooth: hci_sync: fix BR/EDR wakeup bug
Iulia Tanasescu <[email protected]>
Bluetooth: ISO: Avoid creating child socket if PA sync is terminating
Zijun Hu <[email protected]>
Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for QCA2066
Benjamin Berg <[email protected]>
wifi: cfg80211: free beacon_ies when overridden from hidden BSS
Su Hui <[email protected]>
wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
Mingyi Zhang <[email protected]>
libbpf: Fix NULL pointer dereference in bpf_object__collect_prog_relos
Ching-Te Ku <[email protected]>
wifi: rtw89: coex: Fix wrong Wi-Fi role info and FDDT parameter members
Zenm Chen <[email protected]>
wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
Xianwei Zhao <[email protected]>
arm64: dts: amlogic: fix format for s4 uart node
Jesse Brandeburg <[email protected]>
ice: fix pre-shifted bit usage
Jesse Brandeburg <[email protected]>
intel: add bit macro includes where needed
Mao Jinlong <[email protected]>
arm64: dts: qcom: Fix coresight warnings in in-ports and out-ports
Mao Jinlong <[email protected]>
arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property
Mao Jinlong <[email protected]>
arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property
Alexei Starovoitov <[email protected]>
x86/cfi,bpf: Fix bpf_exception_cb() signature
Alex Lyakas <[email protected]>
md: Whenassemble the array, consult the superblock of the freshest device
Christoph Hellwig <[email protected]>
block: prevent an integer overflow in bvec_try_merge_hw_page
Linus Walleij <[email protected]>
ARM64: dts: marvell: Fix some common switch mistakes
Linus Walleij <[email protected]>
ARM: dts: marvell: Fix some common switch mistakes
Tobias Waldekranz <[email protected]>
net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error path
Igor Russkikh <[email protected]>
net: atlantic: eliminate double free in error handling logic
Ahmed Zaki <[email protected]>
ice: fix ICE_AQ_VSI_Q_OPT_RSS_* register values
Yihang Li <[email protected]>
scsi: hisi_sas: Set .phy_attached before notifing phyup event HISI_PHYE_PHY_UP_PM
Justin Tee <[email protected]>
scsi: lpfc: Move determination of vmid_flag after VMID reinitialization completes
Justin Tee <[email protected]>
scsi: lpfc: Reinitialize an NPIV's VMID data structures after FDISC
Fabio Estevam <[email protected]>
ARM: dts: imx23/28: Fix the DMA controller node name
Fabio Estevam <[email protected]>
ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
Fabio Estevam <[email protected]>
ARM: dts: imx27-apf27dev: Fix LED name
Fabio Estevam <[email protected]>
ARM: dts: imx25/27: Pass timing0
Fabio Estevam <[email protected]>
ARM: dts: imx25: Fix the iim compatible string
Andrii Nakryiko <[email protected]>
selftests/bpf: fix compiler warnings in RELEASE=1 mode
Michal Simek <[email protected]>
arm64: zynqmp: Fix clock node name in kv260 cards
Michal Simek <[email protected]>
arm64: zynqmp: Move fixed clock to / for kv260
Kees Cook <[email protected]>
block/rnbd-srv: Check for unlikely string overflow
Shannon Nelson <[email protected]>
ionic: bypass firmware cmds when stuck in reset
Shannon Nelson <[email protected]>
ionic: pass opcode to devcmd_wait
Christian Marangi <[email protected]>
net: phy: at803x: fix passing the wrong reference for config_intr
Fabio Estevam <[email protected]>
ARM: dts: imx1: Fix sram node
Fabio Estevam <[email protected]>
ARM: dts: imx27: Fix sram node
Fabio Estevam <[email protected]>
ARM: dts: imx: Use flash@0,0 pattern
Fabio Estevam <[email protected]>
ARM: dts: imx25/27-eukrea: Fix RTC node name
Johan Jonker <[email protected]>
ARM: dts: rockchip: fix rk3036 hdmi ports node
Lingbo Kong <[email protected]>
wifi: ath12k: fix the issue that the multicast/broadcast indicator is not read correctly for WCN7850
Dmitry Antipov <[email protected]>
wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap()
Hou Tao <[email protected]>
bpf: Set uattr->batch.count as zero before batched update or deletion
StanleyYP Wang <[email protected]>
wifi: mt76: mt7996: add PCI IDs for mt7992
MeiChia Chiu <[email protected]>
wifi: mt76: connac: fix EHT phy mode check
Nia Espera <[email protected]>
arm64: dts: qcom: sm8350: Fix remoteproc interrupt type
Neil Armstrong <[email protected]>
arm64: dts: qcom: sm8450: fix soundwire controllers node name
Neil Armstrong <[email protected]>
arm64: dts: qcom: sm8550: fix soundwire controllers node name
Tobias Waldekranz <[email protected]>
net: mvmdio: Avoid excessive sleeps in polled mode
Hannes Reinecke <[email protected]>
scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
Hannes Reinecke <[email protected]>
scsi: libfc: Don't schedule abort twice
Kang Yang <[email protected]>
wifi: ath12k: fix and enable AP mode for WCN7850
Hou Tao <[email protected]>
bpf: Set need_defer as false when clearing fd array during map free
Hou Tao <[email protected]>
bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
Chih-Kang Chang <[email protected]>
wifi: rtw89: fix misbehavior of TX beacon in concurrent mode
Po-Hao Huang <[email protected]>
wifi: rtw89: fix not entering PS mode after AP stops
Baochen Qiang <[email protected]>
wifi: ath11k: fix race due to setting ATH11K_FLAG_EXT_IRQ_ENABLED too early
Minsuk Kang <[email protected]>
wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
Yonghong Song <[email protected]>
bpf: Fix a few selftest failures due to llvm18 change
Alexander Stein <[email protected]>
ARM: dts: imx7s: Fix nand-controller #size-cells
Alexander Stein <[email protected]>
ARM: dts: imx7s: Fix lcdif compatible
Alexander Stein <[email protected]>
ARM: dts: imx7d: Fix coresight funnel ports
ching Huang <[email protected]>
scsi: arcmsr: Support new PCI device IDs 1883 and 1886
Sumit Saxena <[email protected]>
scsi: mpi3mr: Add PCI checks where SAS5116 diverges from SAS4116
Sumit Saxena <[email protected]>
scsi: mpi3mr: Add support for SAS5116 PCI IDs
Jose Ignacio Tornos Martinez <[email protected]>
net: usb: ax88179_178a: avoid two consecutive device resets
Zhengchao Shao <[email protected]>
bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
Ido Schimmel <[email protected]>
PCI: Add no PM reset quirk for NVIDIA Spectrum devices
Kory Maincent <[email protected]>
net: phy: micrel: fix ts_info value in case of no phc
Krzysztof Kozlowski <[email protected]>
ARM: dts: samsung: s5pv210: fix camera unit addresses/ranges
Krzysztof Kozlowski <[email protected]>
ARM: dts: samsung: exynos4: fix camera unit addresses/ranges
Justin Tee <[email protected]>
scsi: lpfc: Fix possible file string name overflow when updating firmware
Tanmay Shah <[email protected]>
soc: xilinx: fix unhandled SGI warning message
HariBabu Gattem <[email protected]>
soc: xilinx: Fix for call trace due to the usage of smp_processor_id()
Dmitry Baryshkov <[email protected]>
ARM: dts: qcom: msm8960: fix PMIC node labels
Dmitry Baryshkov <[email protected]>
ARM: dts: qcom: msm8660: fix PMIC node labels
Dmitry Baryshkov <[email protected]>
ARM: dts: qcom: mdm9615: fix PMIC node labels
Dmitry Baryshkov <[email protected]>
ARM: dts: qcom: strip prefix from PMIC files
Yafang Shao <[email protected]>
selftests/bpf: Fix issues in setup_classid_environment()
Shiji Yang <[email protected]>
wifi: rt2x00: correct wrong BBP register in RxDCOC calibration
Yonghong Song <[email protected]>
selftests/bpf: Fix pyperf180 compilation failure with clang18
Yonghong Song <[email protected]>
libbpf: Fix potential uninitialized tail padding with LIBBPF_OPTS_RESET
Andrii Nakryiko <[email protected]>
selftests/bpf: satisfy compiler by having explicit return in btf test
Andrii Nakryiko <[email protected]>
selftests/bpf: fix RELEASE=1 build for tc_opts
Shiji Yang <[email protected]>
wifi: rt2x00: restart beacon queue when hardware reset
Dmitry Antipov <[email protected]>
wifi: rtw89: fix timeout calculation in rtw89_roc_end()
Baokun Li <[email protected]>
ext4: avoid online resizing failures due to oversized flex bg
Baokun Li <[email protected]>
ext4: remove unnecessary check from alloc_flex_gd()
Baokun Li <[email protected]>
ext4: unify the type of flexbg_size to unsigned int
Ye Bin <[email protected]>
ext4: fix inconsistent between segment fstrim and full fstrim
Gabriel Krisman Bertazi <[email protected]>
ecryptfs: Reject casefold directory inodes
Shyam Prasad N <[email protected]>
cifs: fix in logging in cifs_chan_update_iface
Paulo Alcantara <[email protected]>
smb: client: fix hardlinking of reparse points
Paulo Alcantara <[email protected]>
smb: client: fix renaming of reparse points
Ojaswin Mujoo <[email protected]>
ext4: treat end of range as exclusive in ext4_zero_range()
Anna Schumaker <[email protected]>
SUNRPC: Fix a suspicious RCU usage warning
Joel Granados <[email protected]>
sysctl: Fix out of bounds access for empty sysctl registers
Heiko Carstens <[email protected]>
KVM: s390: fix setting of fpc register
Heiko Carstens <[email protected]>
s390/ptrace: handle setting of fpc register correctly
Tony Krowiak <[email protected]>
s390/vfio-ap: fix sysfs status attribute for AP queue devices
Arnd Bergmann <[email protected]>
arch: fix asm-offsets.c building with -Wmissing-prototypes
Arnd Bergmann <[email protected]>
arch: consolidate arch_irq_work_raise prototypes
Alexander Gordeev <[email protected]>
s390/boot: always align vmalloc area on segment boundary
Edward Adam Davis <[email protected]>
jfs: fix array-index-out-of-bounds in diNewExt
Oleg Nesterov <[email protected]>
rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
Oleg Nesterov <[email protected]>
afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu()
Thomas Bourgoin <[email protected]>
crypto: stm32/crc32 - fix parsing list of devices
Gao Xiang <[email protected]>
erofs: fix ztailpacking for subpage compressed blocks
Bharat Bhushan <[email protected]>
crypto: octeontx2 - Fix cptvf driver cleanup
Jia Jie Ho <[email protected]>
crypto: starfive - Fix dev_err_probe return error
Gao Xiang <[email protected]>
erofs: fix up compacted indexes for block size < 4096
Weichen Chen <[email protected]>
pstore/ram: Fix crash when setting number of cpus to an odd number
Gustavo A. R. Silva <[email protected]>
crypto: p10-aes-gcm - Avoid -Wstringop-overflow warnings
Jia Jie Ho <[email protected]>
hwrng: starfive - Fix dev_err_probe return error
Edward Adam Davis <[email protected]>
jfs: fix uaf in jfs_evict_inode
Manas Ghandat <[email protected]>
jfs: fix array-index-out-of-bounds in dbAdjTree
Manas Ghandat <[email protected]>
jfs: fix slab-out-of-bounds Read in dtSearch
Osama Muhammad <[email protected]>
UBSAN: array-index-out-of-bounds in dtSplitRoot
Osama Muhammad <[email protected]>
FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
Rafael J. Wysocki <[email protected]>
thermal: core: Fix thermal zone suspend-resume synchronization
Viresh Kumar <[email protected]>
OPP: The level field is always of unsigned int type
Shuai Xue <[email protected]>
ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous events
Mukesh Ojha <[email protected]>
PM / devfreq: Synchronize devfreq_monitor_[start/stop]
Michal Wajdeczko <[email protected]>
kunit: Reset test->priv after each param iteration
Rae Moar <[email protected]>
kunit: tool: fix parsing of test attributes
Yuntao Wang <[email protected]>
ACPI: NUMA: Fix the logic of getting the fake_pxm value
Thomas Weißschuh <[email protected]>
selftests/nolibc: fix testcase status alignment
Prarit Bhargava <[email protected]>
ACPI: extlog: fix NULL pointer dereference check
Dmitry Antipov <[email protected]>
PNP: ACPI: fix fortify warning
Yuluo Qiu <[email protected]>
ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
Yuntao Wang <[email protected]>
ACPI: tables: Correct and clean up the logic of acpi_parse_entries_array()
Chris Riches <[email protected]>
audit: Send netlink ACK before setting connection in auditd_set
Rui Zhang <[email protected]>
regulator: core: Only increment use_count when enable_count changes
Vincent Guittot <[email protected]>
sched/fair: Fix tg->load when offlining a CPU
Andrzej Hajda <[email protected]>
debugobjects: Stop accessing objects after releasing hash bucket lock
Greg KH <[email protected]>
perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file
Raghavendra K T <[email protected]>
sched/numa: Fix mm numa_scan_seq based unconditional scan
Zhiquan Li <[email protected]>
x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel
Naveen N Rao <[email protected]>
powerpc/lib: Validate size for vector operations
Stephen Rothwell <[email protected]>
powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE
Jun'ichi Nomura <[email protected]>
x86/boot: Ignore NMIs during very early boot
Michael Ellerman <[email protected]>
powerpc/64s: Fix CONFIG_NUMA=n build due to create_section_mapping()
Michael Ellerman <[email protected]>
powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
Michael Ellerman <[email protected]>
powerpc: Fix build error due to is_valid_bugaddr()
Mark Rutland <[email protected]>
drivers/perf: pmuv3: don't expose SW_INCR event in sysfs
Huang Shijie <[email protected]>
arm64: irq: set the correct node for VMAP stack
Kunwu Chan <[email protected]>
powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
Dmitry Torokhov <[email protected]>
asm-generic: make sparse happy with odd-sized put_unaligned_*()
-------------
Diffstat:
Documentation/ABI/testing/sysfs-class-net-queues | 22 +-
Documentation/sound/soc/dapm.rst | 2 +-
Makefile | 4 +-
arch/alpha/kernel/asm-offsets.c | 2 +-
.../intel/ixp/intel-ixp42x-usrobotics-usr8200.dts | 22 ++
arch/arm/boot/dts/marvell/armada-370-rd.dts | 24 +--
.../dts/marvell/armada-381-netgear-gs110emx.dts | 44 ++--
.../dts/marvell/armada-385-clearfog-gtr-l8.dts | 38 ++--
.../dts/marvell/armada-385-clearfog-gtr-s4.dts | 22 +-
arch/arm/boot/dts/marvell/armada-385-linksys.dtsi | 18 +-
.../boot/dts/marvell/armada-385-turris-omnia.dts | 20 +-
arch/arm/boot/dts/marvell/armada-388-clearfog.dts | 20 +-
.../boot/dts/marvell/armada-xp-linksys-mamba.dts | 18 +-
arch/arm/boot/dts/nxp/imx/imx1-ads.dts | 2 +-
arch/arm/boot/dts/nxp/imx/imx1-apf9328.dts | 2 +-
arch/arm/boot/dts/nxp/imx/imx1.dtsi | 5 +-
.../boot/dts/nxp/imx/imx25-eukrea-cpuimx25.dtsi | 2 +-
.../imx25-eukrea-mbimxsd25-baseboard-cmo-qvga.dts | 2 +-
.../imx25-eukrea-mbimxsd25-baseboard-dvi-svga.dts | 2 +-
.../imx25-eukrea-mbimxsd25-baseboard-dvi-vga.dts | 2 +-
arch/arm/boot/dts/nxp/imx/imx25-pdk.dts | 2 +-
arch/arm/boot/dts/nxp/imx/imx25.dtsi | 2 +-
arch/arm/boot/dts/nxp/imx/imx27-apf27dev.dts | 4 +-
.../boot/dts/nxp/imx/imx27-eukrea-cpuimx27.dtsi | 4 +-
.../nxp/imx/imx27-eukrea-mbimxsd27-baseboard.dts | 2 +-
.../dts/nxp/imx/imx27-phytec-phycard-s-rdk.dts | 2 +-
.../boot/dts/nxp/imx/imx27-phytec-phycore-rdk.dts | 2 +-
.../boot/dts/nxp/imx/imx27-phytec-phycore-som.dtsi | 2 +-
arch/arm/boot/dts/nxp/imx/imx27.dtsi | 3 +
arch/arm/boot/dts/nxp/imx/imx7d.dtsi | 3 -
arch/arm/boot/dts/nxp/imx/imx7s.dtsi | 10 +-
arch/arm/boot/dts/nxp/mxs/imx23-sansa.dts | 12 +-
arch/arm/boot/dts/nxp/mxs/imx23.dtsi | 2 +-
arch/arm/boot/dts/nxp/mxs/imx28.dtsi | 2 +-
.../dts/qcom/{qcom-pm8226.dtsi => pm8226.dtsi} | 0
.../dts/qcom/{qcom-pm8841.dtsi => pm8841.dtsi} | 0
.../dts/qcom/{qcom-pm8941.dtsi => pm8941.dtsi} | 0
.../dts/qcom/{qcom-pma8084.dtsi => pma8084.dtsi} | 0
.../boot/dts/qcom/{qcom-pmx55.dtsi => pmx55.dtsi} | 0
.../boot/dts/qcom/{qcom-pmx65.dtsi => pmx65.dtsi} | 0
.../boot/dts/qcom/qcom-apq8026-asus-sparrow.dts | 2 +-
.../boot/dts/qcom/qcom-apq8026-huawei-sturgeon.dts | 2 +-
arch/arm/boot/dts/qcom/qcom-apq8026-lg-lenok.dts | 2 +-
.../dts/qcom/qcom-apq8026-samsung-matisse-wifi.dts | 2 +-
.../arm/boot/dts/qcom/qcom-apq8060-dragonboard.dts | 4 +-
.../arm/boot/dts/qcom/qcom-apq8074-dragonboard.dts | 4 +-
arch/arm/boot/dts/qcom/qcom-apq8084-ifc6540.dts | 2 +-
arch/arm/boot/dts/qcom/qcom-apq8084-mtp.dts | 2 +-
arch/arm/boot/dts/qcom/qcom-mdm9615-wp8548.dtsi | 2 +-
arch/arm/boot/dts/qcom/qcom-mdm9615.dtsi | 14 +-
arch/arm/boot/dts/qcom/qcom-msm8660.dtsi | 16 +-
arch/arm/boot/dts/qcom/qcom-msm8960.dtsi | 8 +-
.../qcom/qcom-msm8974-lge-nexus5-hammerhead.dts | 4 +-
.../dts/qcom/qcom-msm8974-sony-xperia-rhine.dtsi | 4 +-
.../dts/qcom/qcom-msm8974pro-fairphone-fp2.dts | 4 +-
.../dts/qcom/qcom-msm8974pro-oneplus-bacon.dts | 4 +-
.../boot/dts/qcom/qcom-msm8974pro-samsung-klte.dts | 2 +-
.../qcom-msm8974pro-sony-xperia-shinano-castor.dts | 4 +-
arch/arm/boot/dts/qcom/qcom-sdx55-mtp.dts | 2 +-
arch/arm/boot/dts/qcom/qcom-sdx55-t55.dts | 2 +-
.../boot/dts/qcom/qcom-sdx55-telit-fn980-tlb.dts | 2 +-
arch/arm/boot/dts/qcom/qcom-sdx65-mtp.dts | 2 +-
arch/arm/boot/dts/rockchip/rk3036.dtsi | 14 +-
arch/arm/boot/dts/samsung/exynos4.dtsi | 26 +--
arch/arm/boot/dts/samsung/exynos4x12.dtsi | 17 +-
arch/arm/boot/dts/samsung/s5pv210.dtsi | 18 +-
arch/arm/include/asm/irq_work.h | 2 -
.../boot/dts/amlogic/meson-s4-s805x2-aq222.dts | 4 +-
arch/arm64/boot/dts/amlogic/meson-s4.dtsi | 4 +-
.../dts/marvell/armada-3720-espressobin-ultra.dts | 14 +-
.../boot/dts/marvell/armada-3720-espressobin.dtsi | 20 +-
.../boot/dts/marvell/armada-3720-gl-mv1000.dts | 20 +-
.../boot/dts/marvell/armada-3720-turris-mox.dts | 85 ++++----
.../boot/dts/marvell/armada-7040-mochabin.dts | 24 +--
.../dts/marvell/armada-8040-clearfog-gt-8k.dts | 22 +-
arch/arm64/boot/dts/marvell/cn9130-crb.dtsi | 42 ++--
arch/arm64/boot/dts/qcom/msm8996.dtsi | 21 ++
arch/arm64/boot/dts/qcom/msm8998.dtsi | 32 +--
arch/arm64/boot/dts/qcom/sdm845.dtsi | 5 +-
arch/arm64/boot/dts/qcom/sm8150.dtsi | 5 +-
arch/arm64/boot/dts/qcom/sm8250.dtsi | 24 +--
arch/arm64/boot/dts/qcom/sm8350.dtsi | 8 +-
arch/arm64/boot/dts/qcom/sm8450.dtsi | 8 +-
arch/arm64/boot/dts/qcom/sm8550.dtsi | 8 +-
arch/arm64/boot/dts/sprd/ums512.dtsi | 3 +-
.../boot/dts/xilinx/zynqmp-sck-kv-g-revA.dtso | 40 ++--
.../boot/dts/xilinx/zynqmp-sck-kv-g-revB.dtso | 42 ++--
arch/arm64/include/asm/irq_work.h | 2 -
arch/arm64/kernel/irq.c | 7 +-
arch/csky/include/asm/irq_work.h | 2 +-
arch/loongarch/kernel/asm-offsets.c | 26 +--
arch/powerpc/crypto/aes-gcm-p10-glue.c | 2 +-
arch/powerpc/include/asm/irq_work.h | 1 -
arch/powerpc/include/asm/mmu.h | 4 +
arch/powerpc/include/asm/mmzone.h | 8 -
arch/powerpc/kernel/traps.c | 2 +
arch/powerpc/lib/sstep.c | 10 +
arch/powerpc/mm/book3s64/pgtable.c | 2 +
arch/powerpc/mm/init-common.c | 5 +-
arch/powerpc/mm/mmu_decl.h | 5 +
arch/riscv/include/asm/irq_work.h | 2 +-
arch/riscv/kernel/head.S | 1 +
arch/riscv/mm/init.c | 12 +-
arch/s390/boot/ipl_parm.c | 2 +-
arch/s390/boot/startup.c | 3 +-
arch/s390/include/asm/irq_work.h | 2 -
arch/s390/kernel/ptrace.c | 6 +-
arch/s390/kvm/kvm-s390.c | 5 -
arch/sparc/kernel/asm-offsets.c | 6 +-
arch/um/drivers/net_kern.c | 2 +-
arch/um/include/shared/kern_util.h | 2 +-
arch/um/kernel/process.c | 2 +-
arch/um/kernel/time.c | 32 ++-
arch/um/os-Linux/helper.c | 6 +-
arch/um/os-Linux/util.c | 19 +-
arch/x86/boot/compressed/ident_map_64.c | 5 +
arch/x86/boot/compressed/idt_64.c | 1 +
arch/x86/boot/compressed/idt_handlers_64.S | 1 +
arch/x86/boot/compressed/misc.h | 1 +
arch/x86/include/asm/irq_work.h | 1 -
arch/x86/include/asm/kmsan.h | 17 +-
arch/x86/kernel/cpu/mce/core.c | 16 ++
block/bio.c | 2 +-
block/blk-mq.c | 16 ++
drivers/accel/habanalabs/common/device.c | 17 +-
drivers/accel/habanalabs/common/habanalabs.h | 2 +
drivers/accel/habanalabs/common/habanalabs_drv.c | 3 +
drivers/accel/habanalabs/common/mmu/mmu.c | 1 +
drivers/accel/habanalabs/common/sysfs.c | 3 +
drivers/accel/habanalabs/gaudi2/gaudi2.c | 14 +-
.../habanalabs/include/hw_ip/pci/pci_general.h | 1 +
drivers/acpi/acpi_extlog.c | 5 +-
drivers/acpi/acpi_video.c | 9 +
drivers/acpi/apei/ghes.c | 29 ++-
drivers/acpi/numa/srat.c | 4 +-
drivers/acpi/resource.c | 21 ++
drivers/base/arch_numa.c | 2 +-
drivers/block/rnbd/rnbd-srv.c | 19 +-
drivers/bluetooth/hci_qca.c | 1 +
drivers/char/hw_random/jh7110-trng.c | 2 +-
drivers/clk/hisilicon/clk-hi3620.c | 4 +-
drivers/clk/imx/clk-imx8qxp.c | 24 ++-
drivers/clk/imx/clk-scu.c | 4 +-
drivers/clk/mmp/clk-of-pxa168.c | 3 +
drivers/crypto/caam/caamalg_qi2.c | 7 +-
drivers/crypto/caam/caamhash.c | 7 +-
drivers/crypto/marvell/octeontx2/otx2_cptlf.c | 6 +-
drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c | 3 +
drivers/crypto/starfive/jh7110-cryp.c | 2 +-
drivers/crypto/stm32/stm32-crc32.c | 2 +-
drivers/devfreq/devfreq.c | 24 ++-
drivers/extcon/extcon.c | 3 +-
drivers/gpu/drm/amd/amdgpu/aldebaran.c | 26 ++-
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 1 +
drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 21 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c | 8 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 31 +++
drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h | 10 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 13 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_object.h | 4 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 3 +
drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c | 3 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 5 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 6 +-
drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c | 4 +-
drivers/gpu/drm/amd/amdgpu/gfxhub_v1_2.c | 4 +-
drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c | 4 +
drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c | 5 +
drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 4 +
drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c | 4 +-
.../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 2 +
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 42 ++--
drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 24 ++-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 30 +--
.../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 9 +-
.../amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c | 71 ++++++-
.../amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h | 11 +
.../amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 8 -
drivers/gpu/drm/amd/display/dc/core/dc.c | 4 +
drivers/gpu/drm/amd/display/dc/dc_hw_types.h | 2 +-
drivers/gpu/drm/amd/display/dc/dce/dce_audio.c | 2 +-
.../gpu/drm/amd/display/dc/dce/dce_clock_source.c | 9 +-
.../amd/display/dc/dcn35/dcn35_dio_link_encoder.c | 5 +
.../amd/display/dc/dml/dcn32/display_mode_vba_32.c | 3 +
.../dc/dml/dcn32/display_mode_vba_util_32.c | 33 ++-
.../dc/dml/dcn32/display_mode_vba_util_32.h | 1 +
.../drm/amd/display/dc/dml2/display_mode_core.c | 2 +-
.../amd/display/dc/dml2/dml2_translation_helper.c | 4 +-
drivers/gpu/drm/amd/display/dc/dml2/dml2_utils.c | 8 +
.../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 5 +-
.../drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c | 3 +-
.../drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 23 ++-
.../drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c | 3 +-
.../drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 25 +++
drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr.h | 1 +
drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h | 4 +
drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 40 +++-
.../display/dc/link/protocols/link_dp_dpia_bw.c | 221 +++++++++------------
.../display/dc/link/protocols/link_dp_dpia_bw.h | 4 +-
.../dc/link/protocols/link_dp_irq_handler.c | 12 +-
drivers/gpu/drm/amd/display/include/audio_types.h | 2 +-
.../drm/amd/display/modules/power/power_helpers.c | 2 -
drivers/gpu/drm/amd/include/amd_shared.h | 2 -
drivers/gpu/drm/amd/include/mes_v11_api_def.h | 3 +-
.../amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | 2 +-
.../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 17 +-
drivers/gpu/drm/bridge/analogix/anx7625.c | 51 +++--
drivers/gpu/drm/bridge/analogix/anx7625.h | 4 +
drivers/gpu/drm/drm_file.c | 2 +-
drivers/gpu/drm/drm_framebuffer.c | 2 +-
drivers/gpu/drm/drm_mipi_dsi.c | 17 +-
drivers/gpu/drm/exynos/exynos_drm_drv.c | 11 +
drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 23 ++-
.../gpu/drm/msm/disp/dpu1/catalog/dpu_7_0_sm8350.h | 18 ++
.../gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h | 18 ++
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 6 +-
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h | 4 +-
.../gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 32 ++-
.../gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 33 ++-
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c | 3 +
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h | 1 +
drivers/gpu/drm/msm/dp/dp_display.c | 6 +
drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 4 +
drivers/gpu/drm/msm/msm_mdss.c | 2 +-
drivers/gpu/drm/panel/panel-edp.c | 48 ++++-
drivers/hid/hidraw.c | 7 +-
drivers/hwmon/hp-wmi-sensors.c | 127 ++++++++++--
drivers/hwmon/nct6775-core.c | 7 +
drivers/i2c/busses/i2c-rk3x.c | 8 +-
drivers/i3c/master/i3c-master-cdns.c | 7 +-
drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 7 +-
drivers/leds/trigger/ledtrig-panic.c | 5 +-
drivers/mailbox/arm_mhuv2.c | 3 +-
drivers/md/md.c | 54 ++++-
drivers/media/i2c/imx335.c | 4 +-
drivers/media/i2c/ov2740.c | 17 +-
drivers/media/pci/ddbridge/ddbridge-main.c | 2 +-
drivers/media/platform/amphion/vpu.h | 3 +-
drivers/media/platform/amphion/vpu_cmds.c | 28 +--
drivers/media/platform/amphion/vpu_v4l2.c | 1 +
drivers/media/platform/rockchip/rga/rga.c | 15 +-
.../media/platform/rockchip/rkisp1/rkisp1-common.h | 11 +-
.../media/platform/rockchip/rkisp1/rkisp1-csi.c | 14 +-
.../media/platform/rockchip/rkisp1/rkisp1-dev.c | 35 +++-
.../media/platform/rockchip/rkisp1/rkisp1-isp.c | 20 +-
.../platform/rockchip/rkisp1/rkisp1-resizer.c | 38 ++--
drivers/media/usb/stk1160/stk1160-video.c | 5 +-
drivers/media/usb/uvc/uvc_driver.c | 18 ++
drivers/mfd/Kconfig | 1 +
drivers/misc/lis3lv02d/lis3lv02d_i2c.c | 1 +
drivers/net/bonding/bond_alb.c | 3 +-
drivers/net/dsa/mt7530.c | 3 +-
drivers/net/dsa/mv88e6xxx/chip.h | 4 +-
drivers/net/dsa/mv88e6xxx/serdes.c | 10 +-
drivers/net/dsa/mv88e6xxx/serdes.h | 8 +-
drivers/net/dsa/qca/qca8k-8xxx.c | 24 ++-
drivers/net/ethernet/amd/pds_core/adminq.c | 64 ++++--
drivers/net/ethernet/amd/pds_core/core.c | 46 ++++-
drivers/net/ethernet/amd/pds_core/core.h | 2 +-
drivers/net/ethernet/amd/pds_core/debugfs.c | 4 +
drivers/net/ethernet/amd/pds_core/dev.c | 16 +-
drivers/net/ethernet/amd/pds_core/devlink.c | 3 +-
drivers/net/ethernet/amd/pds_core/fw.c | 3 +
drivers/net/ethernet/amd/pds_core/main.c | 26 ++-
drivers/net/ethernet/aquantia/atlantic/aq_ptp.c | 28 +--
drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 61 ++----
drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 22 +-
drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 23 +--
drivers/net/ethernet/google/gve/gve_rx.c | 8 +-
drivers/net/ethernet/intel/e1000/e1000_hw.c | 1 +
drivers/net/ethernet/intel/e1000e/e1000.h | 20 ++
drivers/net/ethernet/intel/e1000e/ptp.c | 22 +-
drivers/net/ethernet/intel/fm10k/fm10k_pf.c | 1 +
drivers/net/ethernet/intel/fm10k/fm10k_vf.c | 1 +
drivers/net/ethernet/intel/i40e/i40e_common.c | 1 +
drivers/net/ethernet/intel/i40e/i40e_dcb.c | 2 +
drivers/net/ethernet/intel/i40e/i40e_nvm.c | 1 +
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 32 +++
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 1 +
drivers/net/ethernet/intel/iavf/iavf_common.c | 3 +-
drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 5 +-
drivers/net/ethernet/intel/iavf/iavf_fdir.c | 1 +
drivers/net/ethernet/intel/iavf/iavf_txrx.c | 1 +
drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 18 +-
drivers/net/ethernet/intel/ice/ice_lib.c | 7 +-
drivers/net/ethernet/intel/ice/ice_virtchnl.c | 12 +-
drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.c | 16 +-
drivers/net/ethernet/intel/idpf/virtchnl2.h | 2 +-
drivers/net/ethernet/intel/igb/e1000_i210.c | 4 +-
drivers/net/ethernet/intel/igb/e1000_nvm.c | 4 +-
drivers/net/ethernet/intel/igb/e1000_phy.c | 4 +-
drivers/net/ethernet/intel/igbvf/netdev.c | 28 +--
drivers/net/ethernet/intel/igc/igc_i225.c | 1 +
drivers/net/ethernet/intel/igc/igc_phy.c | 1 +
drivers/net/ethernet/intel/ixgbe/ixgbe_82598.c | 36 ++--
drivers/net/ethernet/intel/ixgbe/ixgbe_82599.c | 61 +++---
drivers/net/ethernet/intel/ixgbe/ixgbe_common.c | 145 +++++++-------
drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 2 +-
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 42 ++--
drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.c | 34 ++--
drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h | 1 -
drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c | 105 +++++-----
drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h | 2 +-
drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 2 +-
drivers/net/ethernet/intel/ixgbe/ixgbe_type.h | 43 +---
drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c | 44 ++--
drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 149 +++++++-------
drivers/net/ethernet/marvell/mvmdio.c | 53 ++---
.../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 13 +-
.../ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 1 -
.../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 3 +-
.../net/ethernet/marvell/octeontx2/nic/otx2_txrx.c | 7 +-
drivers/net/ethernet/mediatek/mtk_eth_soc.c | 5 +-
.../net/ethernet/microchip/lan966x/lan966x_port.c | 5 +-
.../net/ethernet/pensando/ionic/ionic_bus_pci.c | 4 +
drivers/net/ethernet/pensando/ionic/ionic_dev.c | 1 +
drivers/net/ethernet/pensando/ionic/ionic_dev.h | 1 +
drivers/net/ethernet/pensando/ionic/ionic_lif.c | 3 +
drivers/net/ethernet/pensando/ionic/ionic_main.c | 22 +-
drivers/net/phy/at803x.c | 6 +-
drivers/net/phy/mediatek-ge-soc.c | 147 ++++++++------
drivers/net/phy/micrel.c | 6 +-
drivers/net/usb/ax88179_178a.c | 2 -
drivers/net/virtio_net.c | 9 +-
drivers/net/wireless/ath/ath11k/pcic.c | 4 +-
drivers/net/wireless/ath/ath12k/hal.c | 4 +-
drivers/net/wireless/ath/ath12k/hw.c | 3 +-
drivers/net/wireless/ath/ath12k/mac.c | 4 +-
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 5 +-
.../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 +-
drivers/net/wireless/mediatek/mt76/mt7996/pci.c | 8 +-
drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 2 +-
drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 3 +
drivers/net/wireless/ralink/rt2x00/rt2x00mac.c | 11 +
.../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 12 ++
.../net/wireless/realtek/rtlwifi/rtl8723ae/phy.c | 6 +-
.../net/wireless/realtek/rtlwifi/rtl8723be/phy.c | 4 +-
drivers/net/wireless/realtek/rtw89/coex.c | 4 +-
drivers/net/wireless/realtek/rtw89/core.c | 2 +-
drivers/net/wireless/realtek/rtw89/core.h | 12 +-
drivers/net/wireless/realtek/rtw89/fw.c | 17 +-
drivers/net/wireless/realtek/rtw89/mac.c | 100 +++++++++-
drivers/net/wireless/realtek/rtw89/mac.h | 1 +
drivers/net/wireless/realtek/rtw89/mac80211.c | 3 +
drivers/net/wireless/realtek/rtw89/reg.h | 17 ++
drivers/net/wireless/silabs/wfx/sta.c | 42 ++--
drivers/opp/core.c | 9 +-
drivers/pci/pci.h | 2 +-
drivers/pci/pcie/aer.c | 9 +-
drivers/pci/quirks.c | 24 ++-
drivers/pci/switch/switchtec.c | 25 ++-
drivers/perf/arm_pmuv3.c | 6 +-
drivers/pinctrl/intel/pinctrl-baytrail.c | 3 +-
drivers/pnp/pnpacpi/rsparser.c | 12 +-
drivers/regulator/core.c | 56 +++---
drivers/regulator/ti-abb-regulator.c | 22 +-
drivers/s390/crypto/vfio_ap_ops.c | 16 +-
drivers/scsi/arcmsr/arcmsr.h | 4 +
drivers/scsi/arcmsr/arcmsr_hba.c | 6 +
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +-
drivers/scsi/isci/request.c | 2 +-
drivers/scsi/libfc/fc_fcp.c | 18 +-
drivers/scsi/lpfc/lpfc.h | 1 +
drivers/scsi/lpfc/lpfc_els.c | 14 +-
drivers/scsi/lpfc/lpfc_init.c | 4 +-
drivers/scsi/lpfc/lpfc_vmid.c | 1 +
drivers/scsi/mpi3mr/mpi3mr_fw.c | 3 +-
drivers/scsi/mpi3mr/mpi3mr_os.c | 13 +-
drivers/scsi/scsi_error.c | 8 +-
drivers/scsi/scsi_lib.c | 2 +-
drivers/scsi/scsi_priv.h | 2 +-
drivers/soc/xilinx/xlnx_event_manager.c | 7 +-
drivers/spmi/spmi-mtk-pmif.c | 7 +-
drivers/staging/vme_user/vme.c | 2 +-
drivers/thermal/thermal_core.c | 30 ++-
drivers/tty/serial/8250/8250_pci.c | 58 +++++-
drivers/tty/tty_ioctl.c | 4 +-
drivers/usb/core/hub.c | 33 ++-
drivers/usb/host/xhci-plat.c | 23 ++-
drivers/usb/host/xhci.c | 40 ++--
drivers/watchdog/it87_wdt.c | 14 +-
drivers/watchdog/starfive-wdt.c | 2 +
drivers/xen/gntdev-dmabuf.c | 50 ++---
fs/9p/v9fs_vfs.h | 1 +
fs/9p/vfs_inode.c | 6 +-
fs/9p/vfs_inode_dotl.c | 1 +
fs/afs/callback.c | 3 +-
fs/ceph/caps.c | 9 +-
fs/ceph/mds_client.c | 2 +-
fs/ceph/quota.c | 39 ++--
fs/dcache.c | 7 +-
fs/ecryptfs/inode.c | 8 +
fs/erofs/zdata.c | 2 +-
fs/erofs/zmap.c | 32 ++-
fs/ext4/extents.c | 6 +-
fs/ext4/mballoc.c | 11 +-
fs/ext4/resize.c | 37 ++--
fs/f2fs/compress.c | 4 +-
fs/f2fs/file.c | 2 +
fs/f2fs/recovery.c | 25 ++-
fs/jfs/jfs_dmap.c | 57 +++---
fs/jfs/jfs_dtree.c | 7 +-
fs/jfs/jfs_imap.c | 3 +
fs/jfs/jfs_mount.c | 6 +-
fs/kernfs/dir.c | 12 ++
fs/ocfs2/namei.c | 8 +-
fs/proc/proc_sysctl.c | 9 +-
fs/pstore/ram.c | 1 +
fs/reiserfs/namei.c | 54 ++---
fs/smb/client/cifsglob.h | 30 ++-
fs/smb/client/cifsproto.h | 15 +-
fs/smb/client/cifssmb.c | 17 +-
fs/smb/client/inode.c | 3 +-
fs/smb/client/link.c | 4 +-
fs/smb/client/sess.c | 14 +-
fs/smb/client/smb2inode.c | 55 +++--
fs/smb/client/smb2proto.h | 16 +-
fs/tracefs/event_inode.c | 117 +++++++----
fs/tracefs/inode.c | 198 ++++++++++--------
fs/tracefs/internal.h | 4 +-
include/asm-generic/numa.h | 2 +
include/asm-generic/unaligned.h | 24 +--
include/drm/drm_color_mgmt.h | 1 +
include/drm/drm_mipi_dsi.h | 2 +
include/linux/avf/virtchnl.h | 1 +
include/linux/bpf.h | 2 +-
include/linux/irq_work.h | 3 +
include/linux/mm_types.h | 3 +
include/linux/mmzone.h | 6 +-
include/linux/netfilter/ipset/ip_set.h | 4 +
include/linux/pci_ids.h | 1 +
include/linux/pm_opp.h | 4 +-
include/linux/thermal.h | 2 +
include/net/af_unix.h | 20 +-
include/net/ip.h | 2 +-
include/net/netfilter/nf_tables.h | 2 +
kernel/audit.c | 31 ++-
kernel/bpf/arraymap.c | 23 ++-
kernel/bpf/helpers.c | 15 +-
kernel/bpf/syscall.c | 6 +
kernel/events/core.c | 38 ++--
kernel/sched/fair.c | 56 +++++-
lib/debugobjects.c | 200 ++++++++-----------
lib/fw_table.c | 30 +--
lib/kunit/executor.c | 4 +
lib/kunit/test.c | 15 +-
net/bluetooth/hci_sync.c | 10 +-
net/bluetooth/iso.c | 51 ++++-
net/bluetooth/l2cap_core.c | 3 +-
net/bpf/test_run.c | 2 +-
net/bridge/br_cfm_netlink.c | 2 +-
net/bridge/br_multicast.c | 20 +-
net/bridge/br_private.h | 4 +-
net/devlink/port.c | 2 +-
net/ipv4/ip_output.c | 12 +-
net/ipv4/ip_sockglue.c | 6 +-
net/ipv4/ipmr.c | 2 +-
net/ipv4/raw.c | 2 +-
net/ipv4/tcp.c | 12 +-
net/ipv4/udp.c | 2 +-
net/ipv6/addrconf_core.c | 21 +-
net/ipv6/ip6_tunnel.c | 21 +-
net/kcm/kcmsock.c | 2 +-
net/llc/af_llc.c | 2 +
net/netfilter/ipset/ip_set_bitmap_gen.h | 14 +-
net/netfilter/ipset/ip_set_core.c | 37 +++-
net/netfilter/ipset/ip_set_hash_gen.h | 15 +-
net/netfilter/ipset/ip_set_list_set.c | 13 +-
net/netfilter/nf_conntrack_proto_tcp.c | 10 +-
net/netfilter/nf_log.c | 7 +-
net/netfilter/nf_tables_api.c | 14 +-
net/netfilter/nft_ct.c | 24 +++
net/netfilter/nft_tunnel.c | 1 +
net/rxrpc/conn_service.c | 3 +-
net/smc/smc_clc.c | 14 ++
net/sunrpc/xprtmultipath.c | 17 +-
net/unix/af_unix.c | 14 +-
net/unix/diag.c | 2 +-
net/wireless/scan.c | 4 +
sound/hda/hdac_stream.c | 9 +-
sound/hda/intel-dsp-config.c | 10 +
sound/pci/hda/hda_intel.c | 2 +
sound/pci/hda/patch_conexant.c | 115 ++++++++++-
sound/soc/amd/acp-config.c | 15 +-
sound/soc/codecs/rtq9128.c | 73 ++++---
tools/build/feature/test-libopencsd.c | 4 +-
tools/lib/bpf/libbpf.c | 2 +
tools/lib/bpf/libbpf_common.h | 13 +-
tools/lib/subcmd/help.c | 18 +-
tools/testing/kunit/kunit_parser.py | 4 +-
tools/testing/selftests/bpf/cgroup_helpers.c | 18 +-
tools/testing/selftests/bpf/prog_tests/btf.c | 6 +-
tools/testing/selftests/bpf/prog_tests/tc_opts.c | 6 +-
tools/testing/selftests/bpf/progs/pyperf180.c | 22 ++
.../selftests/bpf/progs/test_global_func17.c | 1 +
tools/testing/selftests/bpf/veristat.c | 2 +-
tools/testing/selftests/bpf/xdp_hw_metadata.c | 2 +-
.../selftests/drivers/net/bonding/lag_lib.sh | 11 +
tools/testing/selftests/drivers/net/team/config | 4 +-
tools/testing/selftests/net/Makefile | 5 +-
tools/testing/selftests/net/config | 16 ++
tools/testing/selftests/net/pmtu.sh | 18 +-
tools/testing/selftests/net/setup_veth.sh | 2 +-
tools/testing/selftests/net/udpgro.sh | 4 +-
tools/testing/selftests/net/udpgro_bench.sh | 4 +-
tools/testing/selftests/net/udpgro_frglist.sh | 6 +-
tools/testing/selftests/net/udpgro_fwd.sh | 8 +-
tools/testing/selftests/net/veth.sh | 4 +-
tools/testing/selftests/net/xdp_dummy.c | 13 ++
tools/testing/selftests/nolibc/nolibc-test.c | 4 +-
tools/testing/selftests/sgx/test_encl.lds | 6 +-
512 files changed, 4687 insertions(+), 2639 deletions(-)Greg Kroah-Hartman
maintainerPATCH 1/353 asm-generic: make sparse happy with odd-sized put_unaligned_*()
6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit 1ab33c03145d0f6c345823fc2da935d9a1a9e9fc ]
__put_unaligned_be24() and friends use implicit casts to convert larger-sized data to bytes, which trips sparse truncation warnings when the argument is a constant:
CC [M] drivers/input/touchscreen/hynitron_cstxxx.o
CHECK drivers/input/touchscreen/hynitron_cstxxx.c
drivers/input/touchscreen/hynitron_cstxxx.c: note: in included file (through arch/x86/include/generated/asm/unaligned.h):
include/asm-generic/unaligned.h:119:16: warning: cast truncates bits from constant value (aa01a0 becomes a0) include/asm-generic/unaligned.h:120:20: warning: cast truncates bits from constant value (aa01 becomes 1) include/asm-generic/unaligned.h:119:16: warning: cast truncates bits from constant value (ab00d0 becomes d0) include/asm-generic/unaligned.h:120:20: warning: cast truncates bits from constant value (ab00 becomes 0)
To avoid this let's mask off upper bits explicitly, the resulting code should be exactly the same, but it will keep sparse happy.
--- include/asm-generic/unaligned.h | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
include/asm-generic/unaligned.h +12 -12
@@ -104,9 +104,9 @@ static inline u32 get_unaligned_le24(const void *p)static inline void __put_unaligned_be24 (const u32 val,u8 *p) { - *p++ = val >>16 ; - *p++ = val >>8 ; - *p++ = val; + *p++ = (val >>16 ) &0xff ; + *p++ = (val >>8 ) &0xff ; + *p++ = val &0xff ; }static inline void put_unaligned_be24 (const u32 val,void *p)
@@ -116,9 +116,9 @@ static inline void put_unaligned_be24(const u32 val, void *p)static inline void __put_unaligned_le24 (const u32 val,u8 *p) { - *p++ = val; - *p++ = val >>8 ; - *p++ = val >>16 ; + *p++ = val &0xff ; + *p++ = (val >>8 ) &0xff ; + *p++ = (val >>16 ) &0xff ; }static inline void put_unaligned_le24 (const u32 val,void *p)
@@ -128,12 +128,12 @@ static inline void put_unaligned_le24(const u32 val, void *p)static inline void __put_unaligned_be48 (const u64 val,u8 *p) { - *p++ = val >>40 ; - *p++ = val >>32 ; - *p++ = val >>24 ; - *p++ = val >>16 ; - *p++ = val >>8 ; - *p++ = val; + *p++ = (val >>40 ) &0xff ; + *p++ = (val >>32 ) &0xff ; + *p++ = (val >>24 ) &0xff ; + *p++ = (val >>16 ) &0xff ; + *p++ = (val >>8 ) &0xff ; + *p++ = val &0xff ; }static inline void put_unaligned_be48 (const u64 val,void *p)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/353 powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit f46c8a75263f97bda13c739ba1c90aced0d3b071 ]
kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity.
--- arch/powerpc/mm/init-common.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/powerpc/mm/init-common.c +3 -2
@@ -126,7 +126,7 @@ void pgtable_cache_add(unsigned int shift)* as to leave enough 0 bits in the address to contain it. */ unsigned long minalign =max (MAX_PGTABLE_INDEX_SIZE +1 ,HUGEPD_SHIFT_MASK +1 ); -struct kmem_cache *new; +struct kmem_cache *new =NULL ;/* It would be nice if this was a BUILD_BUG_ON(), but at the * moment, gcc doesn't seem to recognize is_power_of_2 as a
@@ -139,7 +139,8 @@ void pgtable_cache_add(unsigned int shift) align = max_t(unsigned long, align, minalign); name =kasprintf (GFP_KERNEL ,"pgtable-2^%d" , shift); - new =kmem_cache_create (name, table_size, align,0 ,ctor (shift)); +if (name) + new =kmem_cache_create (name, table_size, align,0 ,ctor (shift));if (!new)panic ("Could not allocate pgtable cache for order %d" , shift);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/353 arm64: irq: set the correct node for VMAP stack
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huang Shijie <[email protected]>
[ Upstream commit 75b5e0bf90bffaca4b1f19114065dc59f5cc161f ]
In current code, init_irq_stacks() will call cpu_to_node(). The cpu_to_node() depends on percpu "numa_node" which is initialized in:
arch_call_rest_init() --> rest_init() -- kernel_init() --> kernel_init_freeable() --> smp_prepare_cpus()
But init_irq_stacks() is called in init_IRQ() which is before arch_call_rest_init().
So in init_irq_stacks(), the cpu_to_node() does not work, it always return 0. In NUMA, it makes the node 1 cpu accesses the IRQ stack which is in the node 0.
This patch fixes it by:
1.) export the early_cpu_to_node(), and use it in the init_irq_stacks(). 2.) change init_irq_stacks() to __init function.
--- arch/arm64/kernel/irq.c | 5 +++-- drivers/base/arch_numa.c | 2 +- include/asm-generic/numa.h | 2 ++ 3 files changed, 6 insertions(+), 3 deletions(-)
arch/arm64/kernel/irq.c +3 -2
@@ -22,6 +22,7 @@#include <linux/vmalloc.h> #include <asm/daifflags.h> #include <asm/exception.h> +#include <asm/numa.h> #include <asm/softirq_stack.h> #include <asm/stacktrace.h> #include <asm/vmap_stack.h>
@@ -51,13 +52,13 @@ static void init_irq_scs(void) }#ifdef CONFIG_VMAP_STACK -static void init_irq_stacks (void ) +static void __init init_irq_stacks (void ) {int cpu;unsigned long *p;for_each_possible_cpu (cpu) { - p =arch_alloc_vmap_stack (IRQ_STACK_SIZE ,cpu_to_node (cpu)); + p =arch_alloc_vmap_stack (IRQ_STACK_SIZE ,early_cpu_to_node (cpu));per_cpu (irq_stack_ptr, cpu) = p; } }
drivers/base/arch_numa.c +1 -1
@@ -144,7 +144,7 @@ void __init early_map_cpu_to_node(unsigned int cpu, int nid)unsigned long __per_cpu_offset[NR_CPUS ]__read_mostly ;EXPORT_SYMBOL (__per_cpu_offset); -static int __init early_cpu_to_node (int cpu) +int __init early_cpu_to_node (int cpu) {return cpu_to_node_map[cpu]; }
include/asm-generic/numa.h +2 -0
@@ -35,6 +35,7 @@ int __init numa_add_memblk(int nodeid, u64 start, u64 end);void __init numa_set_distance (int from,int to,int distance);void __init numa_free_distance (void );void __init early_map_cpu_to_node (unsigned int cpu,int nid); +int __init early_cpu_to_node (int cpu);void numa_store_cpu_info (unsigned int cpu);void numa_add_cpu (unsigned int cpu);void numa_remove_cpu (unsigned int cpu);
@@ -46,6 +47,7 @@ static inline void numa_add_cpu(unsigned int cpu) { }static inline void numa_remove_cpu (unsigned int cpu) { }static inline void arch_numa_init (void ) { }static inline void early_map_cpu_to_node (unsigned int cpu,int nid) { } +static inline int early_cpu_to_node (int cpu) {return 0 ; }#endif /* CONFIG_NUMA */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/353 drivers/perf: pmuv3: dont expose SW_INCR event in sysfs
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
[ Upstream commit ca6f537e459e2da4b331fe8928d1a0b0f9301f42 ]
The SW_INCR event is somewhat unusual, and depends on the specific HW counter that it is programmed into. When programmed into PMEVCNTR<n>, SW_INCR will count any writes to PMSWINC_EL0 with bit n set, ignoring writes to SW_INCR with bit n clear.
Event rotation means that there's no fixed relationship between perf_events and HW counters, so this isn't all that useful.
Further, we program PMUSERENR.{SW,EN}=={0,0}, which causes EL0 writes to PMSWINC_EL0 to be trapped and handled as UNDEFINED, resulting in a SIGILL to userspace.
Given that, it's not a good idea to expose SW_INCR in sysfs. Hide it as we did for CHAIN back in commit:
4ba2578fa7b55701 ("arm64: perf: don't expose CHAIN event in sysfs")
--- drivers/perf/arm_pmuv3.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/perf/arm_pmuv3.c +5 -1
@@ -169,7 +169,11 @@ armv8pmu_events_sysfs_show(struct device *dev, PMU_EVENT_ATTR_ID(name, armv8pmu_events_sysfs_show, config)static struct attribute *armv8_pmuv3_event_attrs[] = { -ARMV8_EVENT_ATTR (sw_incr,ARMV8_PMUV3_PERFCTR_SW_INCR ), +/* +* Don't expose the sw_incr event in /sys. It's not usable as writes to +* PMSWINC_EL0 will trap as PMUSERENR.{SW,EN}=={0,0} and event rotation +* means we don't have a fixed event<->counter relationship regardless. +*/ ARMV8_EVENT_ATTR (l1i_cache_refill,ARMV8_PMUV3_PERFCTR_L1I_CACHE_REFILL ),ARMV8_EVENT_ATTR (l1i_tlb_refill,ARMV8_PMUV3_PERFCTR_L1I_TLB_REFILL ),ARMV8_EVENT_ATTR (l1d_cache_refill,ARMV8_PMUV3_PERFCTR_L1D_CACHE_REFILL ),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/353 powerpc: Fix build error due to is_valid_bugaddr()
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit f8d3555355653848082c351fa90775214fb8a4fa ]
With CONFIG_GENERIC_BUG=n the build fails with:
arch/powerpc/kernel/traps.c:1442:5: error: no previous prototype for ‘is_valid_bugaddr’ [-Werror=missing-prototypes] 1442 | int is_valid_bugaddr(unsigned long addr)
| ^~~~~~~~~~~~~~~~
The prototype is only defined, and the function is only needed, when CONFIG_GENERIC_BUG=y, so move the implementation under that.
--- arch/powerpc/kernel/traps.c | 2 ++ 1 file changed, 2 insertions(+)
arch/powerpc/kernel/traps.c +2 -0
@@ -1439,10 +1439,12 @@ static int emulate_instruction(struct pt_regs *regs)return -EINVAL ; } +#ifdef CONFIG_GENERIC_BUG int is_valid_bugaddr (unsigned long addr) {return is_kernel_addr (addr); } +#endif #ifdef CONFIG_MATH_EMULATION static int emulate_math (struct pt_regs *regs)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/353 powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit d8c3f243d4db24675b653f0568bb65dae34e6455 ]
With NUMA=n and FA_DUMP=y or PRESERVE_FA_DUMP=y the build fails with:
arch/powerpc/kernel/fadump.c:1739:22: error: no previous prototype for ‘arch_reserved_kernel_pages’ [-Werror=missing-prototypes] 1739 | unsigned long __init arch_reserved_kernel_pages(void)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
The prototype for arch_reserved_kernel_pages() is in include/linux/mm.h, but it's guarded by __HAVE_ARCH_RESERVED_KERNEL_PAGES. The powerpc headers define __HAVE_ARCH_RESERVED_KERNEL_PAGES in asm/mmzone.h, which is not included into the generic headers when NUMA=n.
Move the definition of __HAVE_ARCH_RESERVED_KERNEL_PAGES into asm/mmu.h which is included regardless of NUMA=n.
Additionally the ifdef around __HAVE_ARCH_RESERVED_KERNEL_PAGES needs to also check for CONFIG_PRESERVE_FA_DUMP.
--- arch/powerpc/include/asm/mmu.h | 4 ++++ arch/powerpc/include/asm/mmzone.h | 3 --- 2 files changed, 4 insertions(+), 3 deletions(-)
arch/powerpc/include/asm/mmu.h +4 -0
@@ -412,5 +412,9 @@ extern void *abatron_pteptrs[2];#include <asm/nohash/mmu.h> #endif +#if defined(CONFIG_FA_DUMP ) || defined(CONFIG_PRESERVE_FA_DUMP ) +#define __HAVE_ARCH_RESERVED_KERNEL_PAGES +#endif +#endif /* __KERNEL__ */ #endif /* _ASM_POWERPC_MMU_H_ */
arch/powerpc/include/asm/mmzone.h +0 -3
@@ -42,9 +42,6 @@ u64 memory_hotplug_max(void);#else #define memory_hotplug_max () memblock_end_of_DRAM()#endif /* CONFIG_NUMA */ -#ifdef CONFIG_FA_DUMP -#define __HAVE_ARCH_RESERVED_KERNEL_PAGES -#endif #ifdef CONFIG_MEMORY_HOTPLUG extern int create_section_mapping(unsigned long start, unsigned long end,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/353 powerpc/64s: Fix CONFIG_NUMA=n build due to create_section_mapping()
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit ede66cd22441820cbd399936bf84fdc4294bc7fa ]
With CONFIG_NUMA=n the build fails with:
arch/powerpc/mm/book3s64/pgtable.c:275:15: error: no previous prototype for ‘create_section_mapping’ [-Werror=missing-prototypes] 275 | int __meminit create_section_mapping(unsigned long start, unsigned long end,
| ^~~~~~~~~~~~~~~~~~~~~~
That happens because the prototype for create_section_mapping() is in asm/mmzone.h, but asm/mmzone.h is only included by linux/mmzone.h when CONFIG_NUMA=y.
In fact the prototype is only needed by arch/powerpc/mm code, so move the prototype into arch/powerpc/mm/mmu_decl.h, which also fixes the build error.
--- arch/powerpc/include/asm/mmzone.h | 5 ----- arch/powerpc/mm/mmu_decl.h | 5 +++++ 2 files changed, 5 insertions(+), 5 deletions(-)
arch/powerpc/include/asm/mmzone.h +0 -5
@@ -43,10 +43,5 @@ u64 memory_hotplug_max(void);#define memory_hotplug_max () memblock_end_of_DRAM()#endif /* CONFIG_NUMA */ -#ifdef CONFIG_MEMORY_HOTPLUG -extern int create_section_mapping (unsigned long start,unsigned long end, -int nid,pgprot_t prot); -#endif -#endif /* __KERNEL__ */ #endif /* _ASM_MMZONE_H_ */
arch/powerpc/mm/mmu_decl.h +5 -0
@@ -181,3 +181,8 @@ static inline bool debug_pagealloc_enabled_or_kfence(void) {return IS_ENABLED (CONFIG_KFENCE ) ||debug_pagealloc_enabled (); } + +#ifdef CONFIG_MEMORY_HOTPLUG +int create_section_mapping (unsigned long start,unsigned long end, +int nid,pgprot_t prot); +#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/353 x86/boot: Ignore NMIs during very early boot
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jun'ichi Nomura <[email protected]>
[ Upstream commit 78a509fba9c9b1fcb77f95b7c6be30da3d24823a ]
When there are two racing NMIs on x86, the first NMI invokes NMI handler and the 2nd NMI is latched until IRET is executed.
If panic on NMI and panic kexec are enabled, the first NMI triggers panic and starts booting the next kernel via kexec. Note that the 2nd NMI is still latched. During the early boot of the next kernel, once an IRET is executed as a result of a page fault, then the 2nd NMI is unlatched and invokes the NMI handler.
However, NMI handler is not set up at the early stage of boot, which results in a boot failure.
Avoid such problems by setting up a NOP handler for early NMIs.
[ mingo: Refined the changelog. ]
--- arch/x86/boot/compressed/ident_map_64.c | 5 +++++ arch/x86/boot/compressed/idt_64.c | 1 + arch/x86/boot/compressed/idt_handlers_64.S | 1 + arch/x86/boot/compressed/misc.h | 1 + 4 files changed, 8 insertions(+)
arch/x86/boot/compressed/ident_map_64.c +5 -0
@@ -386,3 +386,8 @@ void do_boot_page_fault(struct pt_regs *regs, unsigned long error_code)*/ kernel_add_identity_map (address, end); } + +void do_boot_nmi_trap (struct pt_regs *regs,unsigned long error_code) +{ +/* Empty handler to ignore NMI during early boot */ +}
arch/x86/boot/compressed/idt_64.c +1 -0
@@ -61,6 +61,7 @@ void load_stage2_idt(void) boot_idt_desc.address = (unsigned long )boot_idt;set_idt_entry (X86_TRAP_PF , boot_page_fault); +set_idt_entry (X86_TRAP_NMI , boot_nmi_trap);#ifdef CONFIG_AMD_MEM_ENCRYPT /*
arch/x86/boot/compressed/idt_handlers_64.S +1 -0
@@ -70,6 +70,7 @@ SYM_FUNC_END(\name) .code64 EXCEPTION_HANDLER boot_page_fault do_boot_page_fault error_code=1 +EXCEPTION_HANDLER boot_nmi_trap do_boot_nmi_trap error_code=0 #ifdef CONFIG_AMD_MEM_ENCRYPT EXCEPTION_HANDLER boot_stage1_vc do_vc_no_ghcb error_code=1
arch/x86/boot/compressed/misc.h +1 -0
@@ -196,6 +196,7 @@ static inline void cleanup_exception_handling(void) { }/* IDT Entry Points */ void boot_page_fault (void ); +void boot_nmi_trap (void );void boot_stage1_vc (void );void boot_stage2_vc (void );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/353 powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Rothwell <[email protected]>
[ Upstream commit 0d555b57ee660d8a871781c0eebf006e855e918d ]
The linux-next build of powerpc64 allnoconfig fails with:
arch/powerpc/mm/book3s64/pgtable.c:557:5: error: no previous prototype for 'pmd_move_must_withdraw'
557 | int pmd_move_must_withdraw(struct spinlock *new_pmd_ptl,
| ^~~~~~~~~~~~~~~~~~~~~~
Caused by commit:
c6345dfa6e3e ("Makefile.extrawarn: turn on missing-prototypes globally")
Fix it by moving the function definition under CONFIG_TRANSPARENT_HUGEPAGE like the prototype. The function is only called when CONFIG_TRANSPARENT_HUGEPAGE=y.
--- arch/powerpc/mm/book3s64/pgtable.c | 2 ++ 1 file changed, 2 insertions(+)
arch/powerpc/mm/book3s64/pgtable.c +2 -0
@@ -542,6 +542,7 @@ void ptep_modify_prot_commit(struct vm_area_struct *vma, unsigned long addr,set_pte_at (vma->vm_mm, addr, ptep, pte); } +#ifdef CONFIG_TRANSPARENT_HUGEPAGE /* * For hash translation mode, we use the deposited table to store hash slot * information and they are stored at PTRS_PER_PMD offset from related pmd
@@ -563,6 +564,7 @@ int pmd_move_must_withdraw(struct spinlock *new_pmd_ptl, return true; } +#endif /* * Does the CPU support tlbie?
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/353 powerpc/lib: Validate size for vector operations
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naveen N Rao <[email protected]>
[ Upstream commit 8f9abaa6d7de0a70fc68acaedce290c1f96e2e59 ]
Some of the fp/vmx code in sstep.c assume a certain maximum size for the instructions being emulated. The size of those operations however is determined separately in analyse_instr().
Add a check to validate the assumption on the maximum size of the operations, so as to prevent any unintended kernel stack corruption.
--- arch/powerpc/lib/sstep.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
arch/powerpc/lib/sstep.c +10 -0
@@ -586,6 +586,8 @@ static int do_fp_load(struct instruction_op *op, unsigned long ea, } u; nb =GETSIZE (op->type); +if (nb >sizeof (u)) +return -EINVAL ;if (!address_ok (regs, ea, nb))return -EFAULT ; rn = op->reg;
@@ -636,6 +638,8 @@ static int do_fp_store(struct instruction_op *op, unsigned long ea, } u; nb =GETSIZE (op->type); +if (nb >sizeof (u)) +return -EINVAL ;if (!address_ok (regs, ea, nb))return -EFAULT ; rn = op->reg;
@@ -680,6 +684,9 @@ static nokprobe_inline int do_vec_load(int rn, unsigned long ea,u8 b[sizeof (__vector128)]; } u = {}; +if (size >sizeof (u)) +return -EINVAL ; +if (!address_ok (regs, ea & ~0xfUL ,16 ))return -EFAULT ;/* align to multiple of size */
@@ -707,6 +714,9 @@ static nokprobe_inline int do_vec_store(int rn, unsigned long ea,u8 b[sizeof (__vector128)]; } u; +if (size >sizeof (u)) +return -EINVAL ; +if (!address_ok (regs, ea & ~0xfUL ,16 ))return -EFAULT ;/* align to multiple of size */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/353 x86/mce: Mark fatal MCEs page as poison to avoid panic in the kdump kernel
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiquan Li <[email protected]>
[ Upstream commit 9f3b130048bfa2e44a8cfb1b616f826d9d5d8188 ]
Memory errors don't happen very often, especially fatal ones. However, in large-scale scenarios such as data centers, that probability increases with the amount of machines present.
When a fatal machine check happens, mce_panic() is called based on the severity grading of that error. The page containing the error is not marked as poison.
However, when kexec is enabled, tools like makedumpfile understand when pages are marked as poison and do not touch them so as not to cause a fatal machine check exception again while dumping the previous kernel's memory.
Therefore, mark the page containing the error as poisoned so that the kexec'ed kernel can avoid accessing the page.
[ bp: Rewrite commit message and comment. ]
--- arch/x86/kernel/cpu/mce/core.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
arch/x86/kernel/cpu/mce/core.c +16 -0
@@ -44,6 +44,7 @@#include <linux/sync_core.h> #include <linux/task_work.h> #include <linux/hardirq.h> +#include <linux/kexec.h> #include <asm/intel-family.h> #include <asm/processor.h>
@@ -233,6 +234,7 @@ static noinstr void mce_panic(const char *msg, struct mce *final, char *exp)struct llist_node *pending;struct mce_evt_llist *l;int apei_err =0 ; +struct page *p;/* * Allow instrumentation around external facilities usage. Not that it
@@ -286,6 +288,20 @@ static noinstr void mce_panic(const char *msg, struct mce *final, char *exp)if (!fake_panic) {if (panic_timeout ==0 ) panic_timeout = mca_cfg.panic_timeout; + +/* +* Kdump skips the poisoned page in order to avoid +* touching the error bits again. Poison the page even +* if the error is fatal and the machine is about to +* panic. +*/ +if (kexec_crash_loaded ()) { +if (final && (final->status &MCI_STATUS_ADDRV )) { + p =pfn_to_online_page (final->addr >>PAGE_SHIFT ); +if (p) +SetPageHWPoison (p); + } + }panic (msg); }else pr_emerg (HW_ERR "Fake kernel panic: %s\n" , msg);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/353 sched/numa: Fix mm numa_scan_seq based unconditional scan
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raghavendra K T <[email protected]>
[ Upstream commit 84db47ca7146d7bd00eb5cf2b93989a971c84650 ]
Since commit fc137c0ddab2 ("sched/numa: enhance vma scanning logic")
NUMA Balancing allows updating PTEs to trap NUMA hinting faults if the task had previously accessed VMA. However unconditional scan of VMAs are allowed during initial phase of VMA creation until process's mm numa_scan_seq reaches 2 even though current task had not accessed VMA.
Rationale:
- Without initial scan subsequent PTE update may never happen.
- Give fair opportunity to all the VMAs to be scanned and subsequently
understand the access pattern of all the VMAs.
But it has a corner case where, if a VMA is created after some time, process's mm numa_scan_seq could be already greater than 2.
For e.g., values of mm numa_scan_seq when VMAs are created by running mmtest autonuma benchmark briefly looks like:
start_seq=0 : 459
start_seq=2 : 138
start_seq=3 : 144
start_seq=4 : 8
start_seq=8 : 1
start_seq=9 : 1
This results in no unconditional PTE updates for those VMAs created after some time.
Fix:
- Note down the initial value of mm numa_scan_seq in per VMA start_seq.
- Allow unconditional scan till start_seq + 2.
Result:
SUT: AMD EPYC Milan with 2 NUMA nodes 256 cpus. base kernel: upstream 6.6-rc6 with Mels patches [1] applied.
kernbench
========== base patched %gain
Amean elsp-128 165.09 ( 0.00%) 164.78 * 0.19%*
Duration User 41404.28 41375.08
Duration System 9862.22 9768.48
Duration Elapsed 519.87 518.72
Ops NUMA PTE updates 1041416.00 831536.00 Ops NUMA hint faults 263296.00 220966.00 Ops NUMA pages migrated 258021.00 212769.00
Ops AutoNUMA cost 1328.67 1114.69
autonumabench
NUMA01_THREADLOCAL
==================
Amean elsp-NUMA01_THREADLOCAL 81.79 (0.00%) 67.74 * 17.18%*
Duration User 54832.73 47379.67
Duration System 75.00 185.75
Duration Elapsed 576.72 476.09
Ops NUMA PTE updates 394429.00 11121044.00
Ops NUMA hint faults 1001.00 8906404.00
Ops NUMA pages migrated 288.00 2998694.00
Ops AutoNUMA cost 7.77 44666.84
--- include/linux/mm_types.h | 3 +++ kernel/sched/fair.c | 4 +++- 2 files changed, 6 insertions(+), 1 deletion(-)
include/linux/mm_types.h +3 -0
@@ -600,6 +600,9 @@ struct vma_numab_state {*/ unsigned long pids_active[2 ]; +/* MM scan sequence ID when scan first started after VMA creation */ +int start_scan_seq; +/* * MM scan sequence ID when the VMA was last completely scanned. * A VMA is not eligible for scanning if prev_scan_seq == numa_scan_seq
kernel/sched/fair.c +3 -1
@@ -3164,7 +3164,7 @@ static bool vma_is_accessed(struct mm_struct *mm, struct vm_area_struct *vma)* This is also done to avoid any side effect of task scanning * amplifying the unfairness of disjoint set of VMAs' access. */ -if (READ_ONCE (current->mm->numa_scan_seq) <2 ) +if ((READ_ONCE (current->mm->numa_scan_seq) - vma->numab_state->start_scan_seq) <2 )return true; pids = vma->numab_state->pids_active[0 ] | vma->numab_state->pids_active[1 ];
@@ -3307,6 +3307,8 @@ static void task_numa_work(struct callback_head *work)if (!vma->numab_state)continue ; + vma->numab_state->start_scan_seq = mm->numa_scan_seq; + vma->numab_state->next_scan = now +msecs_to_jiffies (sysctl_numa_balancing_scan_delay);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/353 perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg KH <[email protected]>
[ Upstream commit 652ffc2104ec1f69dd4a46313888c33527145ccf ]
--- kernel/events/core.c | 40 ++++++++++++++++++++++++++++------------ 1 file changed, 28 insertions(+), 12 deletions(-)
kernel/events/core.c +28 -12
@@ -11425,9 +11425,32 @@ static DEVICE_ATTR_RW(perf_event_mux_interval_ms);static struct attribute *pmu_dev_attrs[] = { &dev_attr_type.attr, &dev_attr_perf_event_mux_interval_ms.attr, + &dev_attr_nr_addr_filters.attr, +NULL , +}; + +static umode_t pmu_dev_is_visible (struct kobject *kobj,struct attribute *a,int n) +{ +struct device *dev =kobj_to_dev (kobj); +struct pmu *pmu =dev_get_drvdata (dev); + +if (!pmu->nr_addr_filters) +return 0 ; + +return a->mode; + +return 0 ; +} + +static struct attribute_group pmu_dev_attr_group = { + .is_visible = pmu_dev_is_visible, + .attrs = pmu_dev_attrs, +}; + +static const struct attribute_group *pmu_dev_groups[] = { + &pmu_dev_attr_group,NULL , }; -ATTRIBUTE_GROUPS (pmu_dev);static int pmu_bus_running;static struct bus_type pmu_bus = {
@@ -11464,18 +11487,11 @@ static int pmu_dev_alloc(struct pmu *pmu)if (ret) goto free_dev; -/* For PMUs with address filters, throw in an extra attribute: */ -if (pmu->nr_addr_filters) - ret =device_create_file (pmu->dev, &dev_attr_nr_addr_filters); - -if (ret) - goto del_dev; - -if (pmu->attr_update) +if (pmu->attr_update) { ret =sysfs_update_groups (&pmu->dev->kobj, pmu->attr_update); - -if (ret) - goto del_dev; +if (ret) + goto del_dev; + } out:return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/353 debugobjects: Stop accessing objects after releasing hash bucket lock
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrzej Hajda <[email protected]>
[ Upstream commit 9bb6362652f3f4d74a87d572a91ee1b38e673ef6 ]
After release of the hashbucket lock the tracking object can be modified or freed by a concurrent thread. Using it in such a case is error prone, even for printing the object state:
1. T1 tries to deactivate destroyed object, debugobjects detects it, hash bucket lock is released.
2. T2 preempts T1 and frees the tracking object.
3. The freed tracking object is allocated and initialized for a different to be tracked kernel object.
4. T1 resumes and reports error for wrong kernel object.
Create a local copy of the tracking object before releasing the hash bucket lock and use the local copy for reporting and fixups to prevent this.
--- lib/debugobjects.c | 200 ++++++++++++++++++--------------------------- 1 file changed, 78 insertions(+), 122 deletions(-)
lib/debugobjects.c +78 -122
@@ -620,9 +620,8 @@ static void debug_objects_fill_pool(void)static void __debug_object_init (void *addr,const struct debug_obj_descr *descr,int onstack) { -enum debug_obj_state state; +struct debug_obj *obj, o;struct debug_bucket *db; -struct debug_obj *obj;unsigned long flags;debug_objects_fill_pool ();
@@ -643,24 +642,18 @@ __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstackcase ODEBUG_STATE_INIT :case ODEBUG_STATE_INACTIVE : obj->state =ODEBUG_STATE_INIT ; -break ; - -case ODEBUG_STATE_ACTIVE : - state = obj->state; -raw_spin_unlock_irqrestore (&db->lock, flags); -debug_print_object (obj,"init" ); -debug_object_fixup (descr->fixup_init, addr, state); -return ; - -case ODEBUG_STATE_DESTROYED :raw_spin_unlock_irqrestore (&db->lock, flags); -debug_print_object (obj,"init" );return ;default :break ; } + o = *obj;raw_spin_unlock_irqrestore (&db->lock, flags); +debug_print_object (&o,"init" ); + +if (o.state ==ODEBUG_STATE_ACTIVE ) +debug_object_fixup (descr->fixup_init, addr, o.state); }/**
@@ -701,11 +694,9 @@ EXPORT_SYMBOL_GPL(debug_object_init_on_stack);int debug_object_activate (void *addr,const struct debug_obj_descr *descr) {struct debug_obj o = { .object = addr, .state =ODEBUG_STATE_NOTAVAILABLE , .descr = descr }; -enum debug_obj_state state;struct debug_bucket *db;struct debug_obj *obj;unsigned long flags; -int ret;if (!debug_objects_enabled)return 0 ;
@@ -717,49 +708,38 @@ int debug_object_activate(void *addr, const struct debug_obj_descr *descr)raw_spin_lock_irqsave (&db->lock, flags); obj =lookup_object_or_alloc (addr, db, descr, false, true); -if (likely (!IS_ERR_OR_NULL (obj))) { -bool print_object = false; - +if (unlikely (!obj)) { +raw_spin_unlock_irqrestore (&db->lock, flags); +debug_objects_oom (); +return 0 ; + }else if (likely (!IS_ERR (obj))) {switch (obj->state) { -case ODEBUG_STATE_INIT : -case ODEBUG_STATE_INACTIVE : - obj->state =ODEBUG_STATE_ACTIVE ; - ret =0 ; -break ; -case ODEBUG_STATE_ACTIVE : - state = obj->state; -raw_spin_unlock_irqrestore (&db->lock, flags); -debug_print_object (obj,"activate" ); - ret =debug_object_fixup (descr->fixup_activate, addr, state); -return ret ?0 : -EINVAL ; -case ODEBUG_STATE_DESTROYED : - print_object = true; - ret = -EINVAL ; + o = *obj;break ; +case ODEBUG_STATE_INIT : +case ODEBUG_STATE_INACTIVE : + obj->state =ODEBUG_STATE_ACTIVE ; + fallthrough;default : - ret =0 ; -break ; +raw_spin_unlock_irqrestore (&db->lock, flags); +return 0 ; } -raw_spin_unlock_irqrestore (&db->lock, flags); -if (print_object) -debug_print_object (obj,"activate" ); -return ret; }raw_spin_unlock_irqrestore (&db->lock, flags); +debug_print_object (&o,"activate" ); -/* If NULL the allocation has hit OOM */ -if (!obj) { -debug_objects_oom (); -return 0 ; +switch (o.state) { +case ODEBUG_STATE_ACTIVE : +case ODEBUG_STATE_NOTAVAILABLE : +if (debug_object_fixup (descr->fixup_activate, addr, o.state)) +return 0 ; + fallthrough; +default : +return -EINVAL ; } - -/* Object is neither static nor tracked. It's not initialized */ -debug_print_object (&o,"activate" ); - ret =debug_object_fixup (descr->fixup_activate, addr,ODEBUG_STATE_NOTAVAILABLE ); -return ret ?0 : -EINVAL ; }EXPORT_SYMBOL_GPL (debug_object_activate);
@@ -770,10 +750,10 @@ EXPORT_SYMBOL_GPL(debug_object_activate);*/ void debug_object_deactivate (void *addr,const struct debug_obj_descr *descr) { +struct debug_obj o = { .object = addr, .state =ODEBUG_STATE_NOTAVAILABLE , .descr = descr };struct debug_bucket *db;struct debug_obj *obj;unsigned long flags; -bool print_object = false;if (!debug_objects_enabled)return ;
@@ -785,33 +765,24 @@ void debug_object_deactivate(void *addr, const struct debug_obj_descr *descr) obj =lookup_object (addr, db);if (obj) {switch (obj->state) { +case ODEBUG_STATE_DESTROYED : +break ;case ODEBUG_STATE_INIT :case ODEBUG_STATE_INACTIVE :case ODEBUG_STATE_ACTIVE : -if (!obj->astate) - obj->state =ODEBUG_STATE_INACTIVE ; -else - print_object = true; -break ; - -case ODEBUG_STATE_DESTROYED : - print_object = true; -break ; +if (obj->astate) +break ; + obj->state =ODEBUG_STATE_INACTIVE ; + fallthrough;default : -break ; +raw_spin_unlock_irqrestore (&db->lock, flags); +return ; } + o = *obj; }raw_spin_unlock_irqrestore (&db->lock, flags); -if (!obj) { -struct debug_obj o = { .object = addr, - .state =ODEBUG_STATE_NOTAVAILABLE , - .descr = descr }; - -debug_print_object (&o,"deactivate" ); - }else if (print_object) { -debug_print_object (obj,"deactivate" ); - } +debug_print_object (&o,"deactivate" ); }EXPORT_SYMBOL_GPL (debug_object_deactivate);
@@ -822,11 +793,9 @@ EXPORT_SYMBOL_GPL(debug_object_deactivate);*/ void debug_object_destroy (void *addr,const struct debug_obj_descr *descr) { -enum debug_obj_state state; +struct debug_obj *obj, o;struct debug_bucket *db; -struct debug_obj *obj;unsigned long flags; -bool print_object = false;if (!debug_objects_enabled)return ;
@@ -836,32 +805,31 @@ void debug_object_destroy(void *addr, const struct debug_obj_descr *descr)raw_spin_lock_irqsave (&db->lock, flags); obj =lookup_object (addr, db); -if (!obj) - goto out_unlock; +if (!obj) { +raw_spin_unlock_irqrestore (&db->lock, flags); +return ; + }switch (obj->state) { +case ODEBUG_STATE_ACTIVE : +case ODEBUG_STATE_DESTROYED : +break ;case ODEBUG_STATE_NONE :case ODEBUG_STATE_INIT :case ODEBUG_STATE_INACTIVE : obj->state =ODEBUG_STATE_DESTROYED ; -break ; -case ODEBUG_STATE_ACTIVE : - state = obj->state; + fallthrough; +default :raw_spin_unlock_irqrestore (&db->lock, flags); -debug_print_object (obj,"destroy" ); -debug_object_fixup (descr->fixup_destroy, addr, state);return ; - -case ODEBUG_STATE_DESTROYED : - print_object = true; -break ; -default : -break ; } -out_unlock: + + o = *obj;raw_spin_unlock_irqrestore (&db->lock, flags); -if (print_object) -debug_print_object (obj,"destroy" ); +debug_print_object (&o,"destroy" ); + +if (o.state ==ODEBUG_STATE_ACTIVE ) +debug_object_fixup (descr->fixup_destroy, addr, o.state); }EXPORT_SYMBOL_GPL (debug_object_destroy);
@@ -872,9 +840,8 @@ EXPORT_SYMBOL_GPL(debug_object_destroy);*/ void debug_object_free (void *addr,const struct debug_obj_descr *descr) { -enum debug_obj_state state; +struct debug_obj *obj, o;struct debug_bucket *db; -struct debug_obj *obj;unsigned long flags;if (!debug_objects_enabled)
@@ -885,24 +852,26 @@ void debug_object_free(void *addr, const struct debug_obj_descr *descr)raw_spin_lock_irqsave (&db->lock, flags); obj =lookup_object (addr, db); -if (!obj) - goto out_unlock; +if (!obj) { +raw_spin_unlock_irqrestore (&db->lock, flags); +return ; + }switch (obj->state) {case ODEBUG_STATE_ACTIVE : - state = obj->state; -raw_spin_unlock_irqrestore (&db->lock, flags); -debug_print_object (obj,"free" ); -debug_object_fixup (descr->fixup_free, addr, state); -return ; +break ;default :hlist_del (&obj->node);raw_spin_unlock_irqrestore (&db->lock, flags);free_object (obj);return ; } -out_unlock: + + o = *obj;raw_spin_unlock_irqrestore (&db->lock, flags); +debug_print_object (&o,"free" ); + +debug_object_fixup (descr->fixup_free, addr, o.state); }EXPORT_SYMBOL_GPL (debug_object_free);
@@ -954,10 +923,10 @@ void debug_object_active_state(void *addr, const struct debug_obj_descr *descr, unsigned int expect, unsigned int next) { +struct debug_obj o = { .object = addr, .state =ODEBUG_STATE_NOTAVAILABLE , .descr = descr };struct debug_bucket *db;struct debug_obj *obj;unsigned long flags; -bool print_object = false;if (!debug_objects_enabled)return ;
@@ -970,28 +939,19 @@ debug_object_active_state(void *addr, const struct debug_obj_descr *descr,if (obj) {switch (obj->state) {case ODEBUG_STATE_ACTIVE : -if (obj->astate == expect) - obj->astate = next; -else - print_object = true; -break ; - +if (obj->astate != expect) +break ; + obj->astate = next; +raw_spin_unlock_irqrestore (&db->lock, flags); +return ;default : - print_object = true;break ; } + o = *obj; }raw_spin_unlock_irqrestore (&db->lock, flags); -if (!obj) { -struct debug_obj o = { .object = addr, - .state =ODEBUG_STATE_NOTAVAILABLE , - .descr = descr }; - -debug_print_object (&o,"active_state" ); - }else if (print_object) { -debug_print_object (obj,"active_state" ); - } +debug_print_object (&o,"active_state" ); }EXPORT_SYMBOL_GPL (debug_object_active_state);
@@ -999,12 +959,10 @@ EXPORT_SYMBOL_GPL(debug_object_active_state);static void __debug_check_no_obj_freed (const void *address,unsigned long size) {unsigned long flags, oaddr, saddr, eaddr, paddr, chunks; -const struct debug_obj_descr *descr; -enum debug_obj_state state; +int cnt, objs_checked =0 ; +struct debug_obj *obj, o;struct debug_bucket *db;struct hlist_node *tmp; -struct debug_obj *obj; -int cnt, objs_checked =0 ; saddr = (unsigned long ) address; eaddr = saddr + size;
@@ -1026,12 +984,10 @@ static void __debug_check_no_obj_freed(const void *address, unsigned long size)switch (obj->state) {case ODEBUG_STATE_ACTIVE : - descr = obj->descr; - state = obj->state; + o = *obj;raw_spin_unlock_irqrestore (&db->lock, flags); -debug_print_object (obj,"free" ); -debug_object_fixup (descr->fixup_free, - (void *) oaddr, state); +debug_print_object (&o,"free" ); +debug_object_fixup (o.descr->fixup_free, (void *)oaddr, o.state); goto repeat;default :hlist_del (&obj->node);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/353 sched/fair: Fix tg->load when offlining a CPU
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Guittot <[email protected]>
[ Upstream commit f60a631ab9ed5df15e446269ea515f2b8948ba0c ]
When a CPU is taken offline, the contribution of its cfs_rqs to task_groups' load may remain and will negatively impact the calculation of the share of the online CPUs.
To fix this bug, clear the contribution of an offlining CPU to task groups' load and skip its contribution while it is inactive.
Here's the reproducer of the anomaly, by Imran Khan:
"So far I have encountered only one rather lengthy way of reproducing this issue, which is as follows:
1. Take a KVM guest (booted with 4 CPUs and can be scaled up to 124 CPUs) and create 2 custom cgroups: /sys/fs/cgroup/cpu/test_group_1 and /sys/fs/cgroup/ cpu/test_group_2
2. Assign a CPU intensive workload to each of these cgroups and start the workload.
For my tests I am using following app:
int main(int argc, char *argv[])
{
unsigned long count, i, val;
if (argc != 2) {
printf("usage: ./a.out <number of random nums to generate> \n"); return 0;
}
count = strtoul(argv[1], NULL, 10);
printf("Generating %lu random numbers \n", count); for (i = 0; i < count; i++) {
val = rand();
val = val % 2;
//usleep(1);
}
printf("Generated %lu random numbers \n", count); return 0;
}
Also since the system is booted with 4 CPUs, in order to completely load the system I am also launching 4 instances of same test app under:
/sys/fs/cgroup/cpu/
3. We can see that both of the cgroups get similar CPU time:
# systemd-cgtop --depth 1
Path Tasks %CPU Memory Input/s Output/s
/ 659 - 5.5G - -
/system.slice - - 5.7G - -
/test_group_1 4 - - - -
/test_group_2 3 - - - -
/user.slice 31 - 56.5M - -
Path Tasks %CPU Memory Input/s Output/s
/ 659 394.6 5.5G - -
/test_group_2 3 65.7 - - -
/user.slice 29 55.1 48.0M - -
/test_group_1 4 47.3 - - -
/system.slice - 2.2 5.7G - -
Path Tasks %CPU Memory Input/s Output/s
/ 659 394.8 5.5G - -
/test_group_1 4 62.9 - - -
/user.slice 28 44.9 54.2M - -
/test_group_2 3 44.7 - - -
/system.slice - 0.9 5.7G - -
Path Tasks %CPU Memory Input/s Output/s
/ 659 394.4 5.5G - -
/test_group_2 3 58.8 - - -
/test_group_1 4 51.9 - - -
/user.slice 30 39.3 59.6M - -
/system.slice - 1.9 5.7G - -
Path Tasks %CPU Memory Input/s Output/s
/ 659 394.7 5.5G - -
/test_group_1 4 60.9 - - -
/test_group_2 3 57.9 - - -
/user.slice 28 43.5 36.9M - -
/system.slice - 3.0 5.7G - -
Path Tasks %CPU Memory Input/s Output/s
/ 659 395.0 5.5G - -
/test_group_1 4 66.8 - - -
/test_group_2 3 56.3 - - -
/user.slice 29 43.1 51.8M - -
/system.slice - 0.7 5.7G - -
4. Now move systemd-udevd to one of these test groups, say test_group_1, and perform scale up to 124 CPUs followed by scale down back to 4 CPUs from the host side.
5. Run the same workload i.e 4 instances of CPU hogger under /sys/fs/cgroup/cpu and one instance of CPU hogger each in /sys/fs/cgroup/cpu/test_group_1 and /sys/fs/cgroup/test_group_2.
It can be seen that test_group_1 (the one where systemd-udevd was moved) is getting much less CPU time than the test_group_2, even though at this point of time both of these groups have only CPU hogger running:
# systemd-cgtop --depth 1
Path Tasks %CPU Memory Input/s Output/s
/ 1219 - 5.4G - -
/system.slice - - 5.6G - -
/test_group_1 4 - - - -
/test_group_2 3 - - - -
/user.slice 26 - 91.3M - -
Path Tasks %CPU Memory Input/s Output/s
/ 1221 394.3 5.4G - -
/test_group_2 3 82.7 - - -
/test_group_1 4 14.3 - - -
/system.slice - 0.8 5.6G - -
/user.slice 26 0.4 91.2M - -
Path Tasks %CPU Memory Input/s Output/s
/ 1221 394.6 5.4G - -
/test_group_2 3 67.4 - - -
/system.slice - 24.6 5.6G - -
/test_group_1 4 12.5 - - -
/user.slice 26 0.4 91.2M - -
Path Tasks %CPU Memory Input/s Output/s
/ 1221 395.2 5.4G - -
/test_group_2 3 60.9 - - -
/system.slice - 27.9 5.6G - -
/test_group_1 4 12.2 - - -
/user.slice 26 0.4 91.2M - -
Path Tasks %CPU Memory Input/s Output/s
/ 1221 395.2 5.4G - -
/test_group_2 3 69.4 - - -
/test_group_1 4 13.9 - - -
/user.slice 28 1.6 92.0M - -
/system.slice - 1.0 5.6G - -
Path Tasks %CPU Memory Input/s Output/s
/ 1221 395.6 5.4G - -
/test_group_2 3 59.3 - - -
/test_group_1 4 14.1 - - -
/user.slice 28 1.3 92.2M - -
/system.slice - 0.7 5.6G - -
Path Tasks %CPU Memory Input/s Output/s
/ 1221 395.5 5.4G - -
/test_group_2 3 67.2 - - -
/test_group_1 4 11.5 - - -
/user.slice 28 1.3 92.5M - -
/system.slice - 0.6 5.6G - -
Path Tasks %CPU Memory Input/s Output/s
/ 1221 395.1 5.4G - -
/test_group_2 3 76.8 - - -
/test_group_1 4 12.9 - - -
/user.slice 28 1.3 92.8M - -
/system.slice - 1.2 5.6G - -
From sched_debug data it can be seen that in bad case the load.weight of per-CPU sched entities corresponding to test_group_1 has reduced significantly and also load_avg of test_group_1 remains much higher than that of test_group_2, even though systemd-udevd stopped running long time back and at this point of time both cgroups just have the CPU hogger app as running entity."
[ mingo: Added details from the original discussion, plus minor edits to the patch. ]
--- kernel/sched/fair.c | 52 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+)
kernel/sched/fair.c +52 -0
@@ -4098,6 +4098,10 @@ static inline void update_tg_load_avg(struct cfs_rq *cfs_rq)if (cfs_rq->tg == &root_task_group)return ; +/* rq has been offline and doesn't contribute to the share anymore: */ +if (!cpu_active (cpu_of (rq_of (cfs_rq)))) +return ; +/* * For migration heavy workloads, access to tg->load_avg can be * unbound. Limit the update rate to at most once per ms.
@@ -4114,6 +4118,49 @@ static inline void update_tg_load_avg(struct cfs_rq *cfs_rq) } } +static inline void clear_tg_load_avg (struct cfs_rq *cfs_rq) +{ +long delta; +u64 now; + +/* +* No need to update load_avg for root_task_group, as it is not used. +*/ +if (cfs_rq->tg == &root_task_group) +return ; + + now =sched_clock_cpu (cpu_of (rq_of (cfs_rq))); + delta =0 - cfs_rq->tg_load_avg_contrib; +atomic_long_add (delta, &cfs_rq->tg->load_avg); + cfs_rq->tg_load_avg_contrib =0 ; + cfs_rq->last_update_tg_load_avg = now; +} + +/* CPU offline callback: */ +static void __maybe_unused clear_tg_offline_cfs_rqs (struct rq *rq) +{ +struct task_group *tg; + +lockdep_assert_rq_held (rq); + +/* +* The rq clock has already been updated in +* set_rq_offline(), so we should skip updating +* the rq clock again in unthrottle_cfs_rq(). +*/ +rq_clock_start_loop_update (rq); + +rcu_read_lock (); +list_for_each_entry_rcu (tg, &task_groups, list) { +struct cfs_rq *cfs_rq = tg->cfs_rq[cpu_of (rq)]; + +clear_tg_load_avg (cfs_rq); + } +rcu_read_unlock (); + +rq_clock_stop_loop_update (rq); +} +/* * Called within set_task_rq() right before setting a task's CPU. The * caller only guarantees p->pi_lock is held; no other assumptions,
@@ -4410,6 +4457,8 @@ static inline bool skip_blocked_update(struct sched_entity *se)static inline void update_tg_load_avg (struct cfs_rq *cfs_rq) {} +static inline void clear_tg_offline_cfs_rqs (struct rq *rq) {} +static inline int propagate_entity_load_avg (struct sched_entity *se) {return 0 ;
@@ -12415,6 +12464,9 @@ static void rq_offline_fair(struct rq *rq)/* Ensure any throttled groups are reachable by pick_next_task */ unthrottle_offline_cfs_rqs (rq); + +/* Ensure that we remove rq contribution to group share: */ + clear_tg_offline_cfs_rqs(rq); }#endif /* CONFIG_SMP */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/353 regulator: core: Only increment use_count when enable_count changes
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rui Zhang <[email protected]>
[ Upstream commit 7993d3a9c34f609c02171e115fd12c10e2105ff4 ]
The use_count of a regulator should only be incremented when the enable_count changes from 0 to 1. Similarly, the use_count should only be decremented when the enable_count changes from 1 to 0.
In the previous implementation, use_count was sometimes decremented to 0 when some consumer called unbalanced disable, leading to unexpected disable even the regulator is enabled by other consumers. With this change, the use_count accurately reflects the number of users which the regulator is enabled.
This should make things more robust in the case where a consumer does leak references.
--- drivers/regulator/core.c | 56 +++++++++++++++++++++------------------- 1 file changed, 30 insertions(+), 26 deletions(-)
drivers/regulator/core.c +30 -26
@@ -2918,7 +2918,8 @@ static int _regulator_enable(struct regulator *regulator)/* Fallthrough on positive return values - already enabled */ } - rdev->use_count++; +if (regulator->enable_count ==1 ) + rdev->use_count++;return 0 ;
@@ -2993,37 +2994,40 @@ static int _regulator_disable(struct regulator *regulator)lockdep_assert_held_once (&rdev->mutex.base); -if (WARN (rdev->use_count <=0 , +if (WARN (regulator->enable_count ==0 ,"unbalanced disables for %s\n" ,rdev_get_name (rdev)))return -EIO ; -/* are we the last user and permitted to disable ? */ -if (rdev->use_count ==1 && - (rdev->constraints && !rdev->constraints->always_on)) { - -/* we are last user */ -if (regulator_ops_is_valid (rdev,REGULATOR_CHANGE_STATUS )) { - ret =_notifier_call_chain (rdev, -REGULATOR_EVENT_PRE_DISABLE , -NULL ); -if (ret &NOTIFY_STOP_MASK ) -return -EINVAL ; - - ret =_regulator_do_disable (rdev); -if (ret <0 ) { -rdev_err (rdev,"failed to disable: %pe\n" ,ERR_PTR (ret)); -_notifier_call_chain (rdev, -REGULATOR_EVENT_ABORT_DISABLE , +if (regulator->enable_count ==1 ) { +/* disabling last enable_count from this regulator */ +/* are we the last user and permitted to disable ? */ +if (rdev->use_count ==1 && + (rdev->constraints && !rdev->constraints->always_on)) { + +/* we are last user */ +if (regulator_ops_is_valid (rdev,REGULATOR_CHANGE_STATUS )) { + ret =_notifier_call_chain (rdev, +REGULATOR_EVENT_PRE_DISABLE , +NULL ); +if (ret &NOTIFY_STOP_MASK ) +return -EINVAL ; + + ret =_regulator_do_disable (rdev); +if (ret <0 ) { +rdev_err (rdev,"failed to disable: %pe\n" ,ERR_PTR (ret)); +_notifier_call_chain (rdev, +REGULATOR_EVENT_ABORT_DISABLE , +NULL ); +return ret; + } +_notifier_call_chain (rdev,REGULATOR_EVENT_DISABLE ,NULL ); -return ret; } -_notifier_call_chain (rdev,REGULATOR_EVENT_DISABLE , -NULL ); - } - rdev->use_count =0 ; - }else if (rdev->use_count >1 ) { - rdev->use_count--; + rdev->use_count =0 ; + }else if (rdev->use_count >1 ) { + rdev->use_count--; + } }if (ret ==0 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/353 audit: Send netlink ACK before setting connection in auditd_set
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Riches <[email protected]>
[ Upstream commit 022732e3d846e197539712e51ecada90ded0572a ]
When auditd_set sets the auditd_conn pointer, audit messages can immediately be put on the socket by other kernel threads. If the backlog is large or the rate is high, this can immediately fill the socket buffer. If the audit daemon requested an ACK for this operation, a full socket buffer causes the ACK to get dropped, also setting ENOBUFS on the socket.
To avoid this race and ensure ACKs get through, fast-track the ACK in this specific case to ensure it is sent before auditd_conn is set.
--- kernel/audit.c | 31 ++++++++++++++++++++++++------- 1 file changed, 24 insertions(+), 7 deletions(-)
kernel/audit.c +24 -7
@@ -487,15 +487,19 @@ static void auditd_conn_free(struct rcu_head *rcu)* @pid: auditd PID * @portid: auditd netlink portid * @net: auditd network namespace pointer +* @skb: the netlink command from the audit daemon +* @ack: netlink ack flag, cleared if ack'd here * * Description: * This function will obtain and drop network namespace references as * necessary. Returns zero on success, negative values on failure. */ -static int auditd_set (struct pid *pid,u32 portid,struct net *net) +static int auditd_set (struct pid *pid,u32 portid,struct net *net, +struct sk_buff *skb,bool *ack) {unsigned long flags;struct auditd_connection *ac_old, *ac_new; +struct nlmsghdr *nlh;if (!pid || !net)return -EINVAL ;
@@ -507,6 +511,13 @@ static int auditd_set(struct pid *pid, u32 portid, struct net *net) ac_new->portid = portid; ac_new->net =get_net (net); +/* send the ack now to avoid a race with the queue backlog */ +if (*ack) { + nlh =nlmsg_hdr (skb); +netlink_ack (skb, nlh,0 ,NULL ); + *ack = false; + } +spin_lock_irqsave (&auditd_conn_lock, flags); ac_old =rcu_dereference_protected (auditd_conn,lockdep_is_held (&auditd_conn_lock));
@@ -1200,7 +1211,8 @@ static int audit_replace(struct pid *pid)return auditd_send_unicast_skb (skb); } -static int audit_receive_msg (struct sk_buff *skb,struct nlmsghdr *nlh) +static int audit_receive_msg (struct sk_buff *skb,struct nlmsghdr *nlh, +bool *ack) {u32 seq;void *data;
@@ -1293,7 +1305,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)/* register a new auditd connection */ err =auditd_set (req_pid,NETLINK_CB (skb).portid, -sock_net (NETLINK_CB (skb).sk)); +sock_net (NETLINK_CB (skb).sk), + skb, ack);if (audit_enabled !=AUDIT_OFF ) audit_log_config_change("audit_pid", new_pid,
@@ -1538,9 +1551,10 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)* Parse the provided skb and deal with any messages that may be present, * malformed skbs are discarded. */ -static void audit_receive (struct sk_buff *skb) +static void audit_receive (struct sk_buff *skb) {struct nlmsghdr *nlh; +bool ack;/* * len MUST be signed for nlmsg_next to be able to dec it below 0 * if the nlmsg_len was not aligned
@@ -1553,9 +1567,12 @@ static void audit_receive(struct sk_buff *skb)audit_ctl_lock ();while (nlmsg_ok (nlh, len)) { - err =audit_receive_msg (skb, nlh); -/* if err or if this message says it wants a response */ -if (err || (nlh->nlmsg_flags &NLM_F_ACK )) + ack = nlh->nlmsg_flags &NLM_F_ACK ; + err =audit_receive_msg (skb, nlh, &ack); + +/* send an ack if the user asked for one and audit_receive_msg +* didn't already do it, or if there was an error. */ +if (ack || err)netlink_ack (skb, nlh, err,NULL ); nlh =nlmsg_next (nlh, &len);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/353 ACPI: tables: Correct and clean up the logic of acpi_parse_entries_array()
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Wang <[email protected]>
[ Upstream commit 4b3805daaacb2168665c6222f261e68accb120dc ]
The original intention of acpi_parse_entries_array() is to return the number of all matching entries on success. This number may be greater than the value of the max_entries parameter. When this happens, the function will output a warning message, indicating that count - max_entries matching entries remain unprocessed and have been ignored.
However, commit 4ceacd02f5a1 ("ACPI / table: Always count matched and successfully parsed entries") changed this logic to return the number of entries successfully processed by the handler. In this case, when the max_entries parameter is not zero, the number of entries successfully processed can never be greater than the value of max_entries. In other words, the expression count > max_entries will always evaluate to false. This means that the logic in the final if statement will never be executed.
Commit 99b0efd7c886 ("ACPI / tables: do not report the number of entries ignored by acpi_parse_entries()") mentioned this issue, but it tried to fix it by removing part of the warning message. This is meaningless because the pr_warn statement will never be executed in the first place.
Commit 8726d4f44150 ("ACPI / tables: fix acpi_parse_entries_array() so it traverses all subtables") introduced an errs variable, which is intended to make acpi_parse_entries_array() always traverse all of the subtables, calling as many of the callbacks as possible. However, it seems that the commit does not achieve this goal. For example, when a handler returns an error, none of the handlers will be called again in the subsequent iterations. This result appears to be no different from before the change.
This patch corrects and cleans up the logic of acpi_parse_entries_array(), making it return the number of all matching entries, rather than the number of entries successfully processed by handlers. Additionally, if an error occurs when executing a handler, the function will return -EINVAL immediately.
This patch should not affect existing users of acpi_parse_entries_array().
--- lib/fw_table.c | 30 +++++++++--------------------- 1 file changed, 9 insertions(+), 21 deletions(-)
lib/fw_table.c +9 -21
@@ -85,11 +85,6 @@ acpi_get_subtable_type(char *id)return ACPI_SUBTABLE_COMMON ; } -static __init_or_acpilib bool has_handler(struct acpi_subtable_proc *proc) -{ -return proc->handler || proc->handler_arg; -} - static __init_or_acpilib int call_handler(struct acpi_subtable_proc *proc,union acpi_subtable_headers *hdr,unsigned long end)
@@ -133,7 +128,6 @@ acpi_parse_entries_array(char *id, unsigned long table_size,unsigned long table_end, subtable_len, entry_len;struct acpi_subtable_entry entry;int count =0 ; -int errs =0 ;int i; table_end = (unsigned long )table_header + table_header->length;
@@ -145,25 +139,19 @@ acpi_parse_entries_array(char *id, unsigned long table_size, ((unsigned long )table_header + table_size); subtable_len =acpi_get_subtable_header_length (&entry); -while (((unsigned long )entry.hdr) + subtable_len < table_end) { -if (max_entries && count >= max_entries) -break ; - +while (((unsigned long )entry.hdr) + subtable_len < table_end) {for (i =0 ; i < proc_num; i++) {if (acpi_get_entry_type (&entry) != proc[i].id)continue ; -if (!has_handler (&proc[i]) || - (!errs && -call_handler (&proc[i], entry.hdr, table_end))) { - errs++; -continue ; - } + +if (!max_entries || count < max_entries) +if (call_handler (&proc[i], entry.hdr, table_end)) +return -EINVAL ; proc[i].count++; + count++;break ; } -if (i != proc_num) - count++;/* * If entry->length is 0, break from this loop to avoid
@@ -180,9 +168,9 @@ acpi_parse_entries_array(char *id, unsigned long table_size, }if (max_entries && count > max_entries) { -pr_warn ("[%4.4s:0x%02x] found the maximum %i entries\n" , - id, proc->id, count); +pr_warn ("[%4.4s:0x%02x] ignored %i entries of %i found\n" , + id, proc->id, count - max_entries, count); } -return errs ? -EINVAL : count; +return count; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/353 ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuluo Qiu <[email protected]>
[ Upstream commit 143176a46bdd3bfbe9ba2462bf94458e80d65ebf ]
The Colorful X15 AT 23 ACPI video-bus device report spurious ACPI_VIDEO_NOTIFY_CYCLE events resulting in spurious KEY_SWITCHVIDEOMODE events being reported to userspace (and causing trouble there) when an external screen plugged in.
Add a quirk setting the report_key_events mask to REPORT_BRIGHTNESS_KEY_EVENTS so that the ACPI_VIDEO_NOTIFY_CYCLE events will be ignored, while still reporting brightness up/down hotkey-presses to userspace normally.
--- drivers/acpi/acpi_video.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/acpi/acpi_video.c +9 -0
@@ -500,6 +500,15 @@ static const struct dmi_system_id video_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 3350"), }, }, + { + .callback = video_set_report_key_events, + .driver_data = (void *)((uintptr_t)REPORT_BRIGHTNESS_KEY_EVENTS), + .ident = "COLORFUL X15 AT 23", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "COLORFUL"), + DMI_MATCH(DMI_PRODUCT_NAME, "X15 AT 23"), + }, + },/* * Some machines change the brightness themselves when a brightness * hotkey gets pressed, despite us telling them not to. In this case
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/353 PNP: ACPI: fix fortify warning
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit ba3f5058db437d919f8468db50483dd9028ff688 ]
When compiling with gcc version 14.0.0 20231126 (experimental) and CONFIG_FORTIFY_SOURCE=y, I've noticed the following:
In file included from ./include/linux/string.h:295,
from ./include/linux/bitmap.h:12,
from ./include/linux/cpumask.h:12,
from ./arch/x86/include/asm/paravirt.h:17,
from ./arch/x86/include/asm/cpuid.h:62,
from ./arch/x86/include/asm/processor.h:19,
from ./arch/x86/include/asm/cpufeature.h:5,
from ./arch/x86/include/asm/thread_info.h:53,
from ./include/linux/thread_info.h:60,
from ./arch/x86/include/asm/preempt.h:9,
from ./include/linux/preempt.h:79,
from ./include/linux/spinlock.h:56,
from ./include/linux/mmzone.h:8,
from ./include/linux/gfp.h:7,
from ./include/linux/slab.h:16,
from ./include/linux/resource_ext.h:11,
from ./include/linux/acpi.h:13,
from drivers/pnp/pnpacpi/rsparser.c:11:In function 'fortify_memcpy_chk',
inlined from 'pnpacpi_parse_allocated_vendor' at drivers/pnp/pnpacpi/rsparser.c:158:3, inlined from 'pnpacpi_allocated_resource' at drivers/pnp/pnpacpi/rsparser.c:249:3:./include/linux/fortify-string.h:588:25: warning: call to '__read_overflow2_field' declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning]
588 | __read_overflow2_field(q_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~According to the comments in include/linux/fortify-string.h, 'memcpy()', 'memmove()' and 'memset()' must not be used beyond individual struct members to ensure that the compiler can enforce protection against buffer overflows, and, IIUC, this also applies to partial copies from the particular member ('vendor->byte_data' in this case). So it should be better (and safer) to do both copies at once (and 'byte_data' of 'struct acpi_resource_vendor_typed' seems to be a good candidate for '__counted_by(byte_length)' as well).
--- drivers/pnp/pnpacpi/rsparser.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/pnp/pnpacpi/rsparser.c +6 -6
@@ -151,13 +151,13 @@ static int vendor_resource_matches(struct pnp_dev *dev,static void pnpacpi_parse_allocated_vendor (struct pnp_dev *dev,struct acpi_resource_vendor_typed *vendor) { -if (vendor_resource_matches (dev, vendor, &hp_ccsr_uuid,16 )) { -u64 start, length; +struct {u64 start, length; } range; -memcpy (&start, vendor->byte_data,sizeof (start)); -memcpy (&length, vendor->byte_data +8 ,sizeof (length)); - -pnp_add_mem_resource (dev, start, start + length -1 ,0 ); +if (vendor_resource_matches (dev, vendor, &hp_ccsr_uuid, +sizeof (range))) { +memcpy (&range, vendor->byte_data,sizeof (range)); +pnp_add_mem_resource (dev, range.start, range.start + + range.length -1 ,0 ); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/353 ACPI: extlog: fix NULL pointer dereference check
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prarit Bhargava <[email protected]>
[ Upstream commit 72d9b9747e78979510e9aafdd32eb99c7aa30dd1 ]
The gcc plugin -fanalyzer [1] tries to detect various patterns of incorrect behaviour. The tool reports:
drivers/acpi/acpi_extlog.c: In function ‘extlog_exit’:drivers/acpi/acpi_extlog.c:307:12: warning: check of ‘extlog_l1_addr’ for NULL after already dereferencing it [-Wanalyzer-deref-before-check]
|
| 306 | ((struct extlog_l1_head *)extlog_l1_addr)->flags &= ~FLAG_OS_OPTIN;
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~
| | |
| | (1) pointer ‘extlog_l1_addr’ is dereferenced here
| 307 | if (extlog_l1_addr)
| | ~
| | |
| | (2) pointer ‘extlog_l1_addr’ is checked for NULL here but it was already dereferenced at (1)
|Fix the NULL pointer dereference check in extlog_exit().
--- drivers/acpi/acpi_extlog.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/acpi/acpi_extlog.c +3 -2
@@ -308,9 +308,10 @@ static int __init extlog_init(void) static void __exit extlog_exit(void) {mce_unregister_decode_chain (&extlog_mce_dec); - ((struct extlog_l1_head *)extlog_l1_addr)->flags &= ~FLAG_OS_OPTIN ; -if (extlog_l1_addr) +if (extlog_l1_addr) { + ((struct extlog_l1_head *)extlog_l1_addr)->flags &= ~FLAG_OS_OPTIN ;acpi_os_unmap_iomem (extlog_l1_addr, l1_size); + }if (elog_addr)acpi_os_unmap_iomem (elog_addr, elog_size);release_mem_region (elog_base, elog_size);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/353 selftests/nolibc: fix testcase status alignment
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 07f679b50252dc9e3d0c19aca5801f82c230c527 ]
Center-align all possible status reports.
Before OK and FAIL were center-aligned in relation to each other but SKIPPED and FAILED would be left-aligned.
Before:
7 environ_addr = <0x7fffef3e7c50> [OK]
8 environ_envp = <0x7fffef3e7c58> [FAIL] 9 environ_auxv [SKIPPED] 10 environ_total [SKIPPED]
11 environ_HOME = <0x7fffef3e99bd> [OK]
12 auxv_addr [SKIPPED]
13 auxv_AT_UID = 1000 [OK]
After:
7 environ_addr = <0x7ffff13b00a0> [OK]
8 environ_envp = <0x7ffff13b00a8> [FAIL]
9 environ_auxv [SKIPPED]
10 environ_total [SKIPPED]
11 environ_HOME = <0x7ffff13b19bd> [OK]
12 auxv_addr [SKIPPED]
13 auxv_AT_UID = 1000 [OK]
--- tools/testing/selftests/nolibc/nolibc-test.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/nolibc/nolibc-test.c +2 -2
@@ -150,11 +150,11 @@ static void result(int llen, enum RESULT r)const char *msg;if (r ==OK ) - msg =" [OK]" ; + msg =" [OK]" ;else if (r ==SKIPPED ) msg ="[SKIPPED]" ;else - msg ="[FAIL]" ; + msg =" [FAIL]" ;if (llen <64 )putcharn (' ' ,64 - llen);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/353 ACPI: NUMA: Fix the logic of getting the fake_pxm value
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Wang <[email protected]>
[ Upstream commit e3f577830ce216b0ca21d4750cbbd64cfc21efff ]
The for loop does not iterate over the last element of the node_to_pxm_map array. This could lead to a conflict between the final fake_pxm value and the existing pxm values. That is, the final fake_pxm value can not be guaranteed to be an unused pxm value.
While at it, fix up white space in slit_valid().
--- drivers/acpi/numa/srat.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/acpi/numa/srat.c +2 -2
@@ -183,7 +183,7 @@ static int __init slit_valid(struct acpi_table_slit *slit)int i, j;int d = slit->locality_count;for (i =0 ; i < d; i++) { -for (j =0 ; j < d; j++) { +for (j =0 ; j < d; j++) {u8 val = slit->entry[d*i + j];if (i == j) {if (val !=LOCAL_DISTANCE )
@@ -532,7 +532,7 @@ int __init acpi_numa_init(void)*/ /* fake_pxm is the next unused PXM value after SRAT parsing */ -for (i =0 , fake_pxm =-1 ; i <MAX_NUMNODES -1 ; i++) { +for (i =0 , fake_pxm =-1 ; i <MAX_NUMNODES ; i++) {if (node_to_pxm_map[i] > fake_pxm) fake_pxm = node_to_pxm_map[i]; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/353 kunit: tool: fix parsing of test attributes
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rae Moar <[email protected]>
[ Upstream commit 8ae27bc7fff4ef467a7964821a6cedb34a05d3b2 ]
Add parsing of attributes as diagnostic data. Fixes issue with test plan being parsed incorrectly as diagnostic data when located after suite-level attributes.
Note that if there does not exist a test plan line, the diagnostic lines between the suite header and the first result will be saved in the suite log rather than the first test case log.
--- tools/testing/kunit/kunit_parser.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/testing/kunit/kunit_parser.py +3 -1
@@ -450,7 +450,7 @@ def parse_diagnostic(lines: LineStream) -> List[str]: Log of diagnostic lines """ log = [] # type: List[str] - non_diagnostic_lines = [TEST_RESULT, TEST_HEADER, KTAP_START, TAP_START] + non_diagnostic_lines = [TEST_RESULT, TEST_HEADER, KTAP_START, TAP_START, TEST_PLAN] while lines and not any(re.match(lines.peek()) for re in non_diagnostic_lines): log.append(lines.pop())
@@ -726,6 +726,7 @@ def parse_test(lines: LineStream, expected_num: int, log: List[str], is_subtest: # test plan test.name = "main" ktap_line = parse_ktap_header(lines, test) + test.log.extend(parse_diagnostic(lines)) parse_test_plan(lines, test) parent_test = True else:
@@ -737,6 +738,7 @@ def parse_test(lines: LineStream, expected_num: int, log: List[str], is_subtest: if parent_test: # If KTAP version line and/or subtest header is found, attempt # to parse test plan and print test header + test.log.extend(parse_diagnostic(lines)) parse_test_plan(lines, test) print_test_header(test) expected_count = test.expected_count
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/353 kunit: Reset test->priv after each param iteration
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Wajdeczko <[email protected]>
[ Upstream commit 342fb9789267ee3908959bfa136b82e88e2ce918 ]
If we run parameterized test that uses test->priv to prepare some custom data, then value of test->priv will leak to the next param iteration and may be unexpected. This could be easily seen if we promote example_priv_test to parameterized test as then only first test iteration will be successful:
$ ./tools/testing/kunit/kunit.py run \ --kunitconfig ./lib/kunit/.kunitconfig *.example_priv*
[ ] Starting KUnit Kernel (1/1)...
[ ] ============================================================
[ ] =================== example (1 subtest) ====================
[ ] ==================== example_priv_test ====================
[ ] [PASSED] example value 3
[ ] # example_priv_test: initializing
[ ] # example_priv_test: ASSERTION FAILED at lib/kunit/kunit-example-test.c:230 [ ] Expected test->priv == ((void *)0), but
[ ] test->priv == 0000000060dfe290
[ ] ((void *)0) == 0000000000000000
[ ] # example_priv_test: cleaning up
[ ] [FAILED] example value 2
[ ] # example_priv_test: initializing
[ ] # example_priv_test: ASSERTION FAILED at lib/kunit/kunit-example-test.c:230 [ ] Expected test->priv == ((void *)0), but
[ ] test->priv == 0000000060dfe290
[ ] ((void *)0) == 0000000000000000
[ ] # example_priv_test: cleaning up
[ ] [FAILED] example value 1
[ ] # example_priv_test: initializing
[ ] # example_priv_test: ASSERTION FAILED at lib/kunit/kunit-example-test.c:230 [ ] Expected test->priv == ((void *)0), but
[ ] test->priv == 0000000060dfe290
[ ] ((void *)0) == 0000000000000000
[ ] # example_priv_test: cleaning up
[ ] [FAILED] example value 0
[ ] # example_priv_test: initializing
[ ] # example_priv_test: cleaning up
[ ] # example_priv_test: pass:1 fail:3 skip:0 total:4
[ ] ================ [FAILED] example_priv_test ================
[ ] # example: initializing suite [ ] # module: kunit_example_test [ ] # example: exiting suite
[ ] # Totals: pass:1 fail:3 skip:0 total:4
[ ] ===================== [FAILED] example =====================
Fix that by resetting test->priv after each param iteration, in similar way what we did for the test->status.
--- lib/kunit/test.c | 1 + 1 file changed, 1 insertion(+)
lib/kunit/test.c +1 -0
@@ -660,6 +660,7 @@ int kunit_run_tests(struct kunit_suite *suite) test.param_index++; test.status =KUNIT_SUCCESS ; test.status_comment[0 ] ='\0' ; + test.priv =NULL ; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/353 PM / devfreq: Synchronize devfreq_monitor_[start/stop]
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukesh Ojha <[email protected]>
[ Upstream commit aed5ed595960c6d301dcd4ed31aeaa7a8054c0c6 ]
There is a chance if a frequent switch of the governor done in a loop result in timer list corruption where timer cancel being done from two place one from cancel_delayed_work_sync() and followed by expire_timers() can be seen from the traces[1].
while true
do
echo "simple_ondemand" > /sys/class/devfreq/1d84000.ufshc/governor echo "performance" > /sys/class/devfreq/1d84000.ufshc/governor
done
It looks to be issue with devfreq driver where device_monitor_[start/stop] need to synchronized so that delayed work should get corrupted while it is either being queued or running or being cancelled.
Let's use polling flag and devfreq lock to synchronize the queueing the timer instance twice and work data being corrupted.
[1]
...
..
<idle>-0 [003] 9436.209662: timer_cancel timer=0xffffff80444f0428 <idle>-0 [003] 9436.209664: timer_expire_entry timer=0xffffff80444f0428 now=0x10022da1c function=__typeid__ZTSFvP10timer_listE_global_addr baseclk=0x10022da1c <idle>-0 [003] 9436.209718: timer_expire_exit timer=0xffffff80444f0428 kworker/u16:6-14217 [003] 9436.209863: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2b now=0x10022da1c flags=182452227 vendor.xxxyyy.ha-1593 [004] 9436.209888: timer_cancel timer=0xffffff80444f0428 vendor.xxxyyy.ha-1593 [004] 9436.216390: timer_init timer=0xffffff80444f0428 vendor.xxxyyy.ha-1593 [004] 9436.216392: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2c now=0x10022da1d flags=186646532 vendor.xxxyyy.ha-1593 [005] 9436.220992: timer_cancel timer=0xffffff80444f0428 xxxyyyTraceManag-7795 [004] 9436.261641: timer_cancel timer=0xffffff80444f0428
[2]
9436.261653][ C4] Unable to handle kernel paging request at virtual address dead00000000012a
[ 9436.261664][ C4] Mem abort info: [ 9436.261666][ C4] ESR = 0x96000044 [ 9436.261669][ C4] EC = 0x25: DABT (current EL), IL = 32 bits [ 9436.261671][ C4] SET = 0, FnV = 0 [ 9436.261673][ C4] EA = 0, S1PTW = 0 [ 9436.261675][ C4] Data abort info: [ 9436.261677][ C4] ISV = 0, ISS = 0x00000044 [ 9436.261680][ C4] CM = 0, WnR = 1 [ 9436.261682][ C4] [dead00000000012a] address between user and kernel address ranges [ 9436.261685][ C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP [ 9436.261701][ C4] Skip md ftrace buffer dump for: 0x3a982d0
...
[ 9436.262138][ C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S W O 5.10.149-android12-9-o-g17f915d29d0c #1 [ 9436.262141][ C4] Hardware name: Qualcomm Technologies, Inc. (DT) [ 9436.262144][ C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--) [ 9436.262161][ C4] pc : expire_timers+0x9c/0x438 [ 9436.262164][ C4] lr : expire_timers+0x2a4/0x438 [ 9436.262168][ C4] sp : ffffffc010023dd0 [ 9436.262171][ C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18 [ 9436.262178][ C4] x27: ffffffd063569dd0 x26: ffffffd063536008 [ 9436.262182][ C4] x25: 0000000000000001 x24: ffffff88f7c69280 [ 9436.262185][ C4] x23: 00000000000000e0 x22: dead000000000122 [ 9436.262188][ C4] x21: 000000010022da29 x20: ffffff8af72b4e80 [ 9436.262191][ C4] x19: ffffffc010023e50 x18: ffffffc010025038 [ 9436.262195][ C4] x17: 0000000000000240 x16: 0000000000000201 [ 9436.262199][ C4] x15: ffffffffffffffff x14: ffffff889f3c3100 [ 9436.262203][ C4] x13: ffffff889f3c3100 x12: 00000000049f56b8 [ 9436.262207][ C4] x11: 00000000049f56b8 x10: 00000000ffffffff [ 9436.262212][ C4] x9 : ffffffc010023e50 x8 : dead000000000122 [ 9436.262216][ C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8 [ 9436.262220][ C4] x5 : 0000000000000000 x4 : 0000000000000101 [ 9436.262223][ C4] x3 : 0000000000000080 x2 : ffffff889edc155c [ 9436.262227][ C4] x1 : ffffff8001005200 x0 : ffffff80444f0428 [ 9436.262232][ C4] Call trace: [ 9436.262236][ C4] expire_timers+0x9c/0x438 [ 9436.262240][ C4] __run_timers+0x1f0/0x330 [ 9436.262245][ C4] run_timer_softirq+0x28/0x58 [ 9436.262255][ C4] efi_header_end+0x168/0x5ec [ 9436.262265][ C4] __irq_exit_rcu+0x108/0x124 [ 9436.262274][ C4] __handle_domain_irq+0x118/0x1e4 [ 9436.262282][ C4] gic_handle_irq.30369+0x6c/0x2bc [ 9436.262286][ C4] el0_irq_naked+0x60/0x6c
--- drivers/devfreq/devfreq.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-)
drivers/devfreq/devfreq.c +22 -2
@@ -461,10 +461,14 @@ static void devfreq_monitor(struct work_struct *work)if (err)dev_err (&devfreq->dev,"dvfs failed with (%d) error\n" , err); +if (devfreq->stop_polling) + goto out; +queue_delayed_work (devfreq_wq, &devfreq->work,msecs_to_jiffies (devfreq->profile->polling_ms)); -mutex_unlock (&devfreq->lock); +out: +mutex_unlock (&devfreq->lock);trace_devfreq_monitor (devfreq); }
@@ -483,6 +487,10 @@ void devfreq_monitor_start(struct devfreq *devfreq)if (IS_SUPPORTED_FLAG (devfreq->governor->flags,IRQ_DRIVEN ))return ; +mutex_lock (&devfreq->lock); +if (delayed_work_pending (&devfreq->work)) + goto out; +switch (devfreq->profile->timer) {case DEVFREQ_TIMER_DEFERRABLE :INIT_DEFERRABLE_WORK (&devfreq->work, devfreq_monitor);
@@ -491,12 +499,16 @@ void devfreq_monitor_start(struct devfreq *devfreq)INIT_DELAYED_WORK (&devfreq->work, devfreq_monitor);break ;default : -return ; + goto out; }if (devfreq->profile->polling_ms)queue_delayed_work (devfreq_wq, &devfreq->work,msecs_to_jiffies (devfreq->profile->polling_ms)); + +out: + devfreq->stop_polling = false; +mutex_unlock (&devfreq->lock); }EXPORT_SYMBOL (devfreq_monitor_start);
@@ -513,6 +525,14 @@ void devfreq_monitor_stop(struct devfreq *devfreq)if (IS_SUPPORTED_FLAG (devfreq->governor->flags,IRQ_DRIVEN ))return ; +mutex_lock (&devfreq->lock); +if (devfreq->stop_polling) { +mutex_unlock (&devfreq->lock); +return ; + } + + devfreq->stop_polling = true; +mutex_unlock (&devfreq->lock);cancel_delayed_work_sync (&devfreq->work); }EXPORT_SYMBOL (devfreq_monitor_stop);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/353 ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous events
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <[email protected]>
[ Upstream commit a70297d2213253853e95f5b49651f924990c6d3b ]
There are two major types of uncorrected recoverable (UCR) errors :
- Synchronous error: The error is detected and raised at the point of the consumption in the execution flow, e.g. when a CPU tries to access a poisoned cache line. The CPU will take a synchronous error exception such as Synchronous External Abort (SEA) on Arm64 and Machine Check Exception (MCE) on X86. OS requires to take action (for example, offline failure page/kill failure thread) to recover this uncorrectable error.
- Asynchronous error: The error is detected out of processor execution context, e.g. when an error is detected by a background scrubber. Some data in the memory are corrupted. But the data have not been consumed. OS is optional to take action to recover this uncorrectable error.
When APEI firmware first is enabled, a platform may describe one error source for the handling of synchronous errors (e.g. MCE or SEA notification ), or for handling asynchronous errors (e.g. SCI or External Interrupt notification). In other words, we can distinguish synchronous errors by APEI notification. For synchronous errors, kernel will kill the current process which accessing the poisoned page by sending SIGBUS with BUS_MCEERR_AR. In addition, for asynchronous errors, kernel will notify the process who owns the poisoned page by sending SIGBUS with BUS_MCEERR_AO in early kill mode. However, the GHES driver always sets mf_flags to 0 so that all synchronous errors are handled as asynchronous errors in memory failure.
To this end, set memory failure flags as MF_ACTION_REQUIRED on synchronous events.
--- drivers/acpi/apei/ghes.c | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-)
drivers/acpi/apei/ghes.c +23 -6
@@ -101,6 +101,20 @@ static inline bool is_hest_type_generic_v2(struct ghes *ghes)return ghes->generic->header.type ==ACPI_HEST_TYPE_GENERIC_ERROR_V2 ; } +/* +* A platform may describe one error source for the handling of synchronous +* errors (e.g. MCE or SEA), or for handling asynchronous errors (e.g. SCI +* or External Interrupt). On x86, the HEST notifications are always +* asynchronous, so only SEA on ARM is delivered as a synchronous +* notification. +*/ +static inline bool is_hest_sync_notify (struct ghes *ghes) +{ +u8 notify_type = ghes->generic->notify.type; + +return notify_type ==ACPI_HEST_NOTIFY_SEA ; +} +/* * This driver isn't really modular, however for the time being, * continuing to use module_param is the easiest way to remain
@@ -489,7 +503,7 @@ static bool ghes_do_memory_failure(u64 physical_addr, int flags) }static bool ghes_handle_memory_failure (struct acpi_hest_generic_data *gdata, -int sev) +int sev,bool sync) {int flags =-1 ;int sec_sev =ghes_severity (gdata->error_severity);
@@ -503,7 +517,7 @@ static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata, (gdata->flags & CPER_SEC_ERROR_THRESHOLD_EXCEEDED)) flags =MF_SOFT_OFFLINE ;if (sev ==GHES_SEV_RECOVERABLE && sec_sev ==GHES_SEV_RECOVERABLE ) - flags =0 ; + flags = sync ?MF_ACTION_REQUIRED :0 ;if (flags !=-1 )return ghes_do_memory_failure (mem_err->physical_addr, flags);
@@ -511,9 +525,11 @@ static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata,return false; } -static bool ghes_handle_arm_hw_error (struct acpi_hest_generic_data *gdata,int sev) +static bool ghes_handle_arm_hw_error (struct acpi_hest_generic_data *gdata, +int sev,bool sync) {struct cper_sec_proc_arm *err =acpi_hest_get_payload (gdata); +int flags = sync ?MF_ACTION_REQUIRED :0 ;bool queued = false;int sec_sev, i;char *p;
@@ -538,7 +554,7 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, int s* and don't filter out 'corrected' error here. */ if (is_cache && has_pa) { - queued =ghes_do_memory_failure (err_info->physical_fault_addr,0 ); + queued =ghes_do_memory_failure (err_info->physical_fault_addr, flags); p += err_info->length;continue ; }
@@ -666,6 +682,7 @@ static bool ghes_do_proc(struct ghes *ghes,const guid_t *fru_id = &guid_null;char *fru_text ="" ;bool queued = false; +bool sync =is_hest_sync_notify (ghes); sev =ghes_severity (estatus->error_severity);apei_estatus_for_each_section (estatus, gdata) {
@@ -683,13 +700,13 @@ static bool ghes_do_proc(struct ghes *ghes,atomic_notifier_call_chain (&ghes_report_chain, sev, mem_err);arch_apei_report_mem_error (sev, mem_err); - queued =ghes_handle_memory_failure (gdata, sev); + queued =ghes_handle_memory_failure (gdata, sev, sync); }else if (guid_equal (sec_type, &CPER_SEC_PCIE )) {ghes_handle_aer (gdata); }else if (guid_equal (sec_type, &CPER_SEC_PROC_ARM )) { - queued =ghes_handle_arm_hw_error (gdata, sev); + queued =ghes_handle_arm_hw_error (gdata, sev, sync); }else {void *err =acpi_hest_get_payload (gdata);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/353 OPP: The level field is always of unsigned int type
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <[email protected]>
[ Upstream commit ba367479c7ad0b870461024cd5ae7a1ea6e1e3db ]
By mistake, dev_pm_opp_find_level_floor() used the level parameter as unsigned long instead of unsigned int. Fix it.
--- drivers/opp/core.c | 9 +++++++-- include/linux/pm_opp.h | 4 ++-- 2 files changed, 9 insertions(+), 4 deletions(-)
drivers/opp/core.c +7 -2
@@ -832,9 +832,14 @@ EXPORT_SYMBOL_GPL(dev_pm_opp_find_level_ceil);* use. */ struct dev_pm_opp *dev_pm_opp_find_level_floor (struct device *dev, -unsigned long *level) +unsigned int *level) { -return _find_key_floor (dev, level,0 , true, _read_level,NULL ); +unsigned long temp = *level; +struct dev_pm_opp *opp; + + opp =_find_key_floor (dev, &temp,0 , true, _read_level,NULL ); + *level = temp; +return opp; }EXPORT_SYMBOL_GPL (dev_pm_opp_find_level_floor);
include/linux/pm_opp.h +2 -2
@@ -157,7 +157,7 @@ struct dev_pm_opp *dev_pm_opp_find_level_ceil(struct device *dev, unsigned int *level);struct dev_pm_opp *dev_pm_opp_find_level_floor (struct device *dev, -unsigned long *level); +unsigned int *level);struct dev_pm_opp *dev_pm_opp_find_bw_ceil (struct device *dev,unsigned int *bw,int index);
@@ -324,7 +324,7 @@ static inline struct dev_pm_opp *dev_pm_opp_find_level_ceil(struct device *dev, }static inline struct dev_pm_opp *dev_pm_opp_find_level_floor (struct device *dev, -unsigned long *level) +unsigned int *level) {return ERR_PTR (-EOPNOTSUPP ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/353 thermal: core: Fix thermal zone suspend-resume synchronization
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 4e814173a8c4f432fd068b1c796f0416328c9d99 ]
There are 3 synchronization issues with thermal zone suspend-resume during system-wide transitions:
1. The resume code runs in a PM notifier which is invoked after user space has been thawed, so it can run concurrently with user space which can trigger a thermal zone device removal. If that happens, the thermal zone resume code may use a stale pointer to the next list element and crash, because it does not hold thermal_list_lock while walking thermal_tz_list.
2. The thermal zone resume code calls thermal_zone_device_init() outside the zone lock, so user space or an update triggered by the platform firmware may see an inconsistent state of a thermal zone leading to unexpected behavior.
3. Clearing the in_suspend global variable in thermal_pm_notify() allows __thermal_zone_device_update() to continue for all thermal zones and it may as well run before the thermal_tz_list walk (or at any point during the list walk for that matter) and attempt to operate on a thermal zone that has not been resumed yet. It may also race destructively with thermal_zone_device_init().
To address these issues, add thermal_list_lock locking to thermal_pm_notify(), especially arount the thermal_tz_list, make it call thermal_zone_device_init() back-to-back with __thermal_zone_device_update() under the zone lock and replace in_suspend with per-zone bool "suspend" indicators set and unset under the given zone's lock.
--- drivers/thermal/thermal_core.c | 30 +++++++++++++++++++++++------- include/linux/thermal.h | 2 ++ 2 files changed, 25 insertions(+), 7 deletions(-)
drivers/thermal/thermal_core.c +23 -7
@@ -37,8 +37,6 @@ static LIST_HEAD(thermal_governor_list);static DEFINE_MUTEX (thermal_list_lock);static DEFINE_MUTEX (thermal_governor_lock); -static atomic_t in_suspend; -static struct thermal_governor *def_governor;/*
@@ -405,7 +403,7 @@ void __thermal_zone_device_update(struct thermal_zone_device *tz, {const struct thermal_trip *trip; -if (atomic_read (&in_suspend)) +if (tz->suspended)return ; if (WARN_ONCE(!tz->ops->get_temp,
@@ -1514,17 +1512,35 @@ static int thermal_pm_notify(struct notifier_block *nb,case PM_HIBERNATION_PREPARE :case PM_RESTORE_PREPARE :case PM_SUSPEND_PREPARE : -atomic_set (&in_suspend,1 ); +mutex_lock (&thermal_list_lock); + +list_for_each_entry (tz, &thermal_tz_list, node) { +mutex_lock (&tz->lock); + + tz->suspended = true; + +mutex_unlock (&tz->lock); + } + +mutex_unlock (&thermal_list_lock);break ;case PM_POST_HIBERNATION :case PM_POST_RESTORE :case PM_POST_SUSPEND : -atomic_set (&in_suspend,0 ); +mutex_lock (&thermal_list_lock); +list_for_each_entry (tz, &thermal_tz_list, node) { +mutex_lock (&tz->lock); + + tz->suspended = false; +thermal_zone_device_init (tz); -thermal_zone_device_update (tz, -THERMAL_EVENT_UNSPECIFIED ); +__thermal_zone_device_update (tz,THERMAL_EVENT_UNSPECIFIED ); + +mutex_unlock (&tz->lock); } + +mutex_unlock (&thermal_list_lock);break ;default :break ;
include/linux/thermal.h +2 -0
@@ -149,6 +149,7 @@ struct thermal_cooling_device {* @node: node in thermal_tz_list (in thermal_core.c) * @poll_queue: delayed work for polling * @notify_event: Last notification event +* @suspended: thermal zone suspend indicator */ struct thermal_zone_device {int id;
@@ -181,6 +182,7 @@ struct thermal_zone_device {struct list_head node;struct delayed_work poll_queue;enum thermal_notify_event notify_event; +bool suspended; };/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/353 FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Osama Muhammad <[email protected]>
[ Upstream commit 9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68 ]
Syzkaller reported the following issue:
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6 index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]') CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> ================================================================================ Kernel panic - not syncing: UBSAN: panic_on_warn set ... CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 panic+0x30f/0x770 kernel/panic.c:340 check_panic_on_warn+0x82/0xa0 kernel/panic.c:236 ubsan_epilogue lib/ubsan.c:223 [inline] __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..
The issue is caused when the value of lp becomes greater than CTLTREESIZE which is the max size of stree. Adding a simple check solves this issue.
Dave:
As the function returns a void, good error handling would require a more intrusive code reorganization, so I modified Osama's patch at use WARN_ON_ONCE for lack of a cleaner option.
The patch is tested via syzbot.
--- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+)
fs/jfs/jfs_dmap.c +3 -0
@@ -2871,6 +2871,9 @@ static void dbAdjTree(dmtree_t * tp, int leafno, int newval)/* is the current value the same as the old value ? if so, * there is nothing to do. */ +if (WARN_ON_ONCE (lp >=CTLTREESIZE )) +return ; +if (tp->dmt_stree[lp] == newval)return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/353 UBSAN: array-index-out-of-bounds in dtSplitRoot
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Osama Muhammad <[email protected]>
[ Upstream commit 27e56f59bab5ddafbcfe69ad7a4a6ea1279c1b16 ]
Syzkaller reported the following issue:
oop0: detected capacity change from 0 to 32768
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1971:9 index -2 is out of range for type 'struct dtslot [128]' CPU: 0 PID: 3613 Comm: syz-executor270 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_out_of_bounds+0xdb/0x130 lib/ubsan.c:283 dtSplitRoot+0x8d8/0x1900 fs/jfs/jfs_dtree.c:1971 dtSplitUp fs/jfs/jfs_dtree.c:985 [inline] dtInsert+0x1189/0x6b80 fs/jfs/jfs_dtree.c:863 jfs_mkdir+0x757/0xb00 fs/jfs/namei.c:270 vfs_mkdir+0x3b3/0x590 fs/namei.c:4013 do_mkdirat+0x279/0x550 fs/namei.c:4038 __do_sys_mkdirat fs/namei.c:4053 [inline] __se_sys_mkdirat fs/namei.c:4051 [inline] __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4051 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fcdc0113fd9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffeb8bc67d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcdc0113fd9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003 RBP: 00007fcdc00d37a0 R08: 0000000000000000 R09: 00007fcdc00d37a0 R10: 00005555559a72c0 R11: 0000000000000246 R12: 00000000f8008000 R13: 0000000000000000 R14: 00083878000000f8 R15: 0000000000000000 </TASK>
The issue is caused when the value of fsi becomes less than -1. The check to break the loop when fsi value becomes -1 is present but syzbot was able to produce value less than -1 which cause the error. This patch simply add the change for the values less than 0.
The patch is tested via syzbot.
--- fs/jfs/jfs_dtree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/jfs/jfs_dtree.c +1 -1
@@ -1970,7 +1970,7 @@ static int dtSplitRoot(tid_t tid,do { f = &rp->slot[fsi]; fsi = f->next; - }while (fsi !=-1 ); + }while (fsi >=0 ); f->next = n; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/353 jfs: fix slab-out-of-bounds Read in dtSearch
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manas Ghandat <[email protected]>
[ Upstream commit fa5492ee89463a7590a1449358002ff7ef63529f ]
Currently while searching for current page in the sorted entry table of the page there is a out of bound access. Added a bound check to fix the error.
Dave:
Set return code to -EIO
--- fs/jfs/jfs_dtree.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/jfs/jfs_dtree.c +5 -0
@@ -633,6 +633,11 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data,for (base =0 , lim = p->header.nextindex; lim; lim >>=1 ) { index = base + (lim >>1 ); +if (stbl[index] <0 ) { + rc = -EIO ; + goto out; + } +if (p->header.flag &BT_LEAF ) {/* uppercase leaf name to compare */ cmp =
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/353 jfs: fix array-index-out-of-bounds in dbAdjTree
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manas Ghandat <[email protected]>
[ Upstream commit 74ecdda68242b174920fe7c6133a856fb7d8559b ]
Currently there is a bound check missing in the dbAdjTree while accessing the dmt_stree. To add the required check added the bool is_ctl which is required to determine the size as suggest in the following commit.
https://lore.kernel.org/linux-kernel-mentees/[email protected]/
--- fs/jfs/jfs_dmap.c | 60 ++++++++++++++++++++++++----------------------- 1 file changed, 31 insertions(+), 29 deletions(-)
fs/jfs/jfs_dmap.c +31 -29
@@ -63,10 +63,10 @@*/ static void dbAllocBits (struct bmap * bmp,struct dmap * dp,s64 blkno,int nblocks); -static void dbSplit (dmtree_t * tp,int leafno,int splitsz,int newval); -static int dbBackSplit (dmtree_t * tp,int leafno); -static int dbJoin (dmtree_t * tp,int leafno,int newval); -static void dbAdjTree (dmtree_t * tp,int leafno,int newval); +static void dbSplit (dmtree_t *tp,int leafno,int splitsz,int newval,bool is_ctl); +static int dbBackSplit (dmtree_t *tp,int leafno,bool is_ctl); +static int dbJoin (dmtree_t *tp,int leafno,int newval,bool is_ctl); +static void dbAdjTree (dmtree_t *tp,int leafno,int newval,bool is_ctl);static int dbAdjCtl (struct bmap * bmp,s64 blkno,int newval,int alloc,int level);static int dbAllocAny (struct bmap * bmp,s64 nblocks,int l2nb,s64 * results);
@@ -2103,7 +2103,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno,* system. */ if (dp->tree.stree[word] ==NOFREE ) -dbBackSplit ((dmtree_t *) & dp->tree, word); +dbBackSplit ((dmtree_t *)&dp->tree, word, false);dbAllocBits (bmp, dp, blkno, nblocks); }
@@ -2189,7 +2189,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno,* the binary system of the leaves if need be. */ dbSplit (tp, word,BUDMIN , -dbMaxBud ((u8 *) & dp->wmap[word])); +dbMaxBud ((u8 *)&dp->wmap[word]), false); word +=1 ; }else {
@@ -2229,7 +2229,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno,* system of the leaves to reflect the current * allocation (size). */ -dbSplit (tp, word, size,NOFREE ); +dbSplit (tp, word, size,NOFREE , false);/* get the number of dmap words handled */ nw =BUDSIZE (size,BUDMIN );
@@ -2336,7 +2336,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno,/* update the leaf for this dmap word. */ rc =dbJoin (tp, word, -dbMaxBud ((u8 *) & dp->wmap[word])); +dbMaxBud ((u8 *)&dp->wmap[word]), false);if (rc)return rc;
@@ -2369,7 +2369,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno,/* update the leaf. */ - rc =dbJoin (tp, word, size); + rc =dbJoin (tp, word, size, false);if (rc)return rc;
@@ -2521,16 +2521,16 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)* that it is at the front of a binary buddy system. */ if (oldval ==NOFREE ) { - rc =dbBackSplit ((dmtree_t *) dcp, leafno); + rc =dbBackSplit ((dmtree_t *)dcp, leafno, true);if (rc) {release_metapage (mp);return rc; } oldval = dcp->stree[ti]; } -dbSplit ((dmtree_t *) dcp, leafno, dcp->budmin, newval); +dbSplit ((dmtree_t *) dcp, leafno, dcp->budmin, newval, true); }else { - rc =dbJoin ((dmtree_t *) dcp, leafno, newval); + rc =dbJoin ((dmtree_t *) dcp, leafno, newval, true);if (rc) {release_metapage (mp);return rc;
@@ -2561,7 +2561,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)*/ if (alloc) {dbJoin ((dmtree_t *) dcp, leafno, - oldval); + oldval, true); }else {/* the dbJoin() above might have * caused a larger binary buddy system
@@ -2571,9 +2571,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)*/ if (dcp->stree[ti] ==NOFREE )dbBackSplit ((dmtree_t *) - dcp, leafno); + dcp, leafno, true);dbSplit ((dmtree_t *) dcp, leafno, - dcp->budmin, oldval); + dcp->budmin, oldval, true); }/* release the buffer and return the error.
@@ -2621,7 +2621,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)* * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static void dbSplit (dmtree_t * tp,int leafno,int splitsz,int newval) +static void dbSplit (dmtree_t *tp,int leafno,int splitsz,int newval,bool is_ctl) {int budsz;int cursz;
@@ -2643,7 +2643,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval)while (cursz >= splitsz) {/* update the buddy's leaf with its new value. */ -dbAdjTree (tp, leafno ^ budsz, cursz); +dbAdjTree (tp, leafno ^ budsz, cursz, is_ctl);/* on to the next size and buddy. */
@@ -2655,7 +2655,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval)/* adjust the dmap tree to reflect the specified leaf's new * value. */ -dbAdjTree (tp, leafno, newval); +dbAdjTree (tp, leafno, newval, is_ctl); }
@@ -2686,7 +2686,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval)* * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit; */ -static int dbBackSplit (dmtree_t * tp,int leafno) +static int dbBackSplit (dmtree_t *tp,int leafno,bool is_ctl) {int budsz, bud, w, bsz, size;int cursz;
@@ -2737,7 +2737,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno)* system in two. */ cursz = leaf[bud] -1 ; -dbSplit (tp, bud, cursz, cursz); +dbSplit (tp, bud, cursz, cursz, is_ctl);break ; } }
@@ -2765,7 +2765,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno)* * RETURN VALUES: none */ -static int dbJoin (dmtree_t * tp,int leafno,int newval) +static int dbJoin (dmtree_t *tp,int leafno,int newval,bool is_ctl) {int budsz, buddy;s8 *leaf;
@@ -2820,12 +2820,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval)if (leafno < buddy) {/* leafno is the left buddy. */ -dbAdjTree (tp, buddy,NOFREE ); +dbAdjTree (tp, buddy,NOFREE , is_ctl); }else {/* buddy is the left buddy and becomes * leafno. */ -dbAdjTree (tp, leafno,NOFREE ); +dbAdjTree (tp, leafno,NOFREE , is_ctl); leafno = buddy; }
@@ -2838,7 +2838,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval)/* update the leaf value. */ -dbAdjTree (tp, leafno, newval); +dbAdjTree (tp, leafno, newval, is_ctl);return 0 ; }
@@ -2859,21 +2859,23 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval)* * RETURN VALUES: none */ -static void dbAdjTree (dmtree_t * tp,int leafno,int newval) +static void dbAdjTree (dmtree_t *tp,int leafno,int newval,bool is_ctl) {int lp, pp, k; -int max; +int max, size; + + size = is_ctl ?CTLTREESIZE :TREESIZE ;/* pick up the index of the leaf for this leafno. */ lp = leafno +le32_to_cpu (tp->dmt_leafidx); +if (WARN_ON_ONCE (lp >= size || lp <0 )) +return ; +/* is the current value the same as the old value ? if so, * there is nothing to do. */ -if (WARN_ON_ONCE (lp >=CTLTREESIZE )) -return ; -if (tp->dmt_stree[lp] == newval)return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/353 jfs: fix uaf in jfs_evict_inode
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit e0e1958f4c365e380b17ccb35617345b31ef7bf3 ]
When the execution of diMount(ipimap) fails, the object ipimap that has been released may be accessed in diFreeSpecial(). Asynchronous ipimap release occurs when rcu_core() calls jfs_free_node().
Therefore, when diMount(ipimap) fails, sbi->ipimap should not be initialized as ipimap.
--- fs/jfs/jfs_mount.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/jfs/jfs_mount.c +3 -3
@@ -172,15 +172,15 @@ int jfs_mount(struct super_block *sb) }jfs_info ("jfs_mount: ipimap:0x%p" , ipimap); -/* map further access of per fileset inodes by the fileset inode */ - sbi->ipimap = ipimap; -/* initialize fileset inode allocation map */ if ((rc =diMount (ipimap))) {jfs_err ("jfs_mount: diMount failed w/rc = %d" , rc); goto err_ipimap; } +/* map further access of per fileset inodes by the fileset inode */ + sbi->ipimap = ipimap; +return rc;/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/353 hwrng: starfive - Fix dev_err_probe return error
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jia Jie Ho <[email protected]>
[ Upstream commit 2d37b3649c412b3bcecfea932cb677f7a5775b15 ]
Current dev_err_probe will return 0 instead of proper error code if driver failed to get irq number. Fix the return err code.
--- drivers/char/hw_random/jh7110-trng.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/hw_random/jh7110-trng.c +1 -1
@@ -300,7 +300,7 @@ static int starfive_trng_probe(struct platform_device *pdev) ret =devm_request_irq (&pdev->dev, irq, starfive_trng_irq,0 , pdev->name, (void *)trng);if (ret) -return dev_err_probe (&pdev->dev, irq, +return dev_err_probe (&pdev->dev, ret,"Failed to register interrupt handler\n" ); trng->hclk =devm_clk_get (&pdev->dev,"hclk" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/353 crypto: p10-aes-gcm - Avoid -Wstringop-overflow warnings
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
[ Upstream commit aaa03fdb56c781db4a4831dd5d6ec8817918c726 ]
The compiler doesn't know that 32 is an offset into the Hash table:
56 struct Hash_ctx {
57 u8 H[16]; /* subkey */
58 u8 Htable[256]; /* Xi, Hash table(offset 32) */
59 };
So, it legitimately complains about a potential out-of-bounds issue if 256 bytes are accessed in htable (this implies going 32 bytes beyond the boundaries of Htable):
arch/powerpc/crypto/aes-gcm-p10-glue.c: In function 'gcmp10_init':arch/powerpc/crypto/aes-gcm-p10-glue.c:120:9: error: 'gcm_init_htable' accessing 256 bytes in a region of size 224 [-Werror=stringop-overflow=]
120 | gcm_init_htable(hash->Htable+32, hash->H);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
arch/powerpc/crypto/aes-gcm-p10-glue.c:120:9: note: referencing argument 1 of type 'unsigned char[256]'
arch/powerpc/crypto/aes-gcm-p10-glue.c:120:9: note: referencing argument 2 of type 'unsigned char[16]'
arch/powerpc/crypto/aes-gcm-p10-glue.c:40:17: note: in a call to function 'gcm_init_htable'
40 | asmlinkage void gcm_init_htable(unsigned char htable[256], unsigned char Xi[16]);
| ^~~~~~~~~~~~~~~Address this by avoiding specifying the size of htable in the function prototype; and just for consistency, do the same for parameter Xi.
--- arch/powerpc/crypto/aes-gcm-p10-glue.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/crypto/aes-gcm-p10-glue.c +1 -1
@@ -37,7 +37,7 @@ asmlinkage void aes_p10_gcm_encrypt(u8 *in, u8 *out, size_t len, void *rkey, u8 *iv, void *Xi); asmlinkage void aes_p10_gcm_decrypt(u8 *in, u8 *out, size_t len,void *rkey,u8 *iv,void *Xi); -asmlinkage void gcm_init_htable(unsigned char htable[256], unsigned char Xi[16]); +asmlinkage void gcm_init_htable(unsigned char htable[], unsigned char Xi[]); asmlinkage void gcm_ghash_p10(unsigned char *Xi, unsigned char *Htable,unsigned char *aad,unsigned int alen);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/353 pstore/ram: Fix crash when setting number of cpus to an odd number
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weichen Chen <[email protected]>
[ Upstream commit d49270a04623ce3c0afddbf3e984cb245aa48e9c ]
When the number of cpu cores is adjusted to 7 or other odd numbers, the zone size will become an odd number.
The address of the zone will become:
addr of zone0 = BASE
addr of zone1 = BASE + zone_size
addr of zone2 = BASE + zone_size*2
...
The address of zone1/3/5/7 will be mapped to non-alignment va. Eventually crashes will occur when accessing these va.
So, use ALIGN_DOWN() to make sure the zone size is even to avoid this bug.
--- fs/pstore/ram.c | 1 + 1 file changed, 1 insertion(+)
fs/pstore/ram.c +1 -0
@@ -529,6 +529,7 @@ static int ramoops_init_przs(const char *name, } zone_sz = mem_sz / *cnt; + zone_sz =ALIGN_DOWN (zone_sz,2 );if (!zone_sz) {dev_err (dev,"%s zone size == 0\n" , name); goto fail;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/353 erofs: fix up compacted indexes for block size < 4096
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
[ Upstream commit 8d2517aaeea3ab8651bb517bca8f3c8664d318ea ]
Previously, the block size always equaled to PAGE_SIZE, therefore lclusterbits couldn't be less than 12.
Since sub-page compressed blocks are now considered, lobits for a lcluster in each pack cannot always be lclusterbits as before. Otherwise, there is no enough room for the special value Z_EROFS_LI_D0_CBLKCNT.
To support smaller block sizes, lobits for each compacted lcluster is now calculated as:
lobits = max(lclusterbits, ilog2(Z_EROFS_LI_D0_CBLKCNT) + 1)
--- fs/erofs/zmap.c | 32 ++++++++++++++------------------ 1 file changed, 14 insertions(+), 18 deletions(-)
fs/erofs/zmap.c +14 -18
@@ -82,29 +82,26 @@ static int z_erofs_load_full_lcluster(struct z_erofs_maprecorder *m, }static unsigned int decode_compactedbits (unsigned int lobits, -unsigned int lomask,u8 *in,unsigned int pos,u8 *type) {const unsigned int v =get_unaligned_le32 (in + pos /8 ) >> (pos &7 ); -const unsigned int lo = v & lomask; +const unsigned int lo = v & ((1 << lobits) -1 ); *type = (v >> lobits) &3 ;return lo; } -static int get_compacted_la_distance (unsigned int lclusterbits, +static int get_compacted_la_distance (unsigned int lobits,unsigned int encodebits,unsigned int vcnt,u8 *in,int i) { -const unsigned int lomask = (1 << lclusterbits) -1 ;unsigned int lo, d1 =0 ;u8 type;DBG_BUGON (i >= vcnt); do { - lo = decode_compactedbits(lclusterbits, lomask, - in, encodebits * i, &type); + lo = decode_compactedbits(lobits, in, encodebits * i, &type); if (type != Z_EROFS_LCLUSTER_TYPE_NONHEAD) return d1;
@@ -123,15 +120,14 @@ static int unpack_compacted_index(struct z_erofs_maprecorder *m, {struct erofs_inode *const vi =EROFS_I (m->inode);const unsigned int lclusterbits = vi->z_logical_clusterbits; -const unsigned int lomask = (1 << lclusterbits) -1 ; -unsigned int vcnt, base, lo, encodebits, nblk, eofs; +unsigned int vcnt, base, lo, lobits, encodebits, nblk, eofs;int i;u8 *in, type;bool big_pcluster;if (1 << amortizedshift ==4 && lclusterbits <=14 ) vcnt =2 ; -else if (1 << amortizedshift ==2 && lclusterbits ==12 ) +else if (1 << amortizedshift ==2 && lclusterbits <=12 ) vcnt =16 ;else return -EOPNOTSUPP ;
@@ -140,6 +136,7 @@ static int unpack_compacted_index(struct z_erofs_maprecorder *m, m->nextpackoff =round_down (pos, vcnt << amortizedshift) + (vcnt << amortizedshift); big_pcluster = vi->z_advise &Z_EROFS_ADVISE_BIG_PCLUSTER_1 ; + lobits =max (lclusterbits,ilog2 (Z_EROFS_LI_D0_CBLKCNT ) +1U ); encodebits = ((vcnt << amortizedshift) -sizeof (__le32)) *8 / vcnt; eofs =erofs_blkoff (m->inode->i_sb, pos); base =round_down (eofs, vcnt << amortizedshift);
@@ -147,15 +144,14 @@ static int unpack_compacted_index(struct z_erofs_maprecorder *m, i = (eofs - base) >> amortizedshift; - lo =decode_compactedbits (lclusterbits, lomask, - in, encodebits * i, &type); + lo =decode_compactedbits (lobits, in, encodebits * i, &type); m->type = type;if (type ==Z_EROFS_LCLUSTER_TYPE_NONHEAD ) { m->clusterofs =1 << lclusterbits;/* figure out lookahead_distance: delta[1] if needed */ if (lookahead) - m->delta[1 ] =get_compacted_la_distance (lclusterbits, + m->delta[1 ] =get_compacted_la_distance (lobits, encodebits, vcnt, in, i);if (lo &Z_EROFS_LI_D0_CBLKCNT ) {if (!big_pcluster) {
@@ -174,8 +170,8 @@ static int unpack_compacted_index(struct z_erofs_maprecorder *m,* of which lo saves delta[1] rather than delta[0]. * Hence, get delta[0] by the previous lcluster indirectly. */ - lo =decode_compactedbits (lclusterbits, lomask, - in, encodebits * (i -1 ), &type); + lo =decode_compactedbits (lobits, in, + encodebits * (i -1 ), &type);if (type !=Z_EROFS_LCLUSTER_TYPE_NONHEAD ) lo =0 ;else if (lo &Z_EROFS_LI_D0_CBLKCNT )
@@ -190,8 +186,8 @@ static int unpack_compacted_index(struct z_erofs_maprecorder *m, nblk =1 ;while (i >0 ) { --i; - lo =decode_compactedbits (lclusterbits, lomask, - in, encodebits * i, &type); + lo =decode_compactedbits (lobits, in, + encodebits * i, &type);if (type ==Z_EROFS_LCLUSTER_TYPE_NONHEAD ) i -= lo;
@@ -202,8 +198,8 @@ static int unpack_compacted_index(struct z_erofs_maprecorder *m, nblk =0 ;while (i >0 ) { --i; - lo =decode_compactedbits (lclusterbits, lomask, - in, encodebits * i, &type); + lo =decode_compactedbits (lobits, in, + encodebits * i, &type);if (type ==Z_EROFS_LCLUSTER_TYPE_NONHEAD ) {if (lo &Z_EROFS_LI_D0_CBLKCNT ) { --i;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/353 crypto: starfive - Fix dev_err_probe return error
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jia Jie Ho <[email protected]>
[ Upstream commit 8517c34e87025b3f74f3c07813d493828f369598 ]
Current dev_err_probe will return 0 instead of proper error code if driver failed to get irq number. Fix the return code.
--- drivers/crypto/starfive/jh7110-cryp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/starfive/jh7110-cryp.c +1 -1
@@ -168,7 +168,7 @@ static int starfive_cryp_probe(struct platform_device *pdev) ret =devm_request_irq (&pdev->dev, irq, starfive_cryp_irq,0 , pdev->name, (void *)cryp);if (ret) -return dev_err_probe (&pdev->dev, irq, +return dev_err_probe (&pdev->dev, ret,"Failed to register interrupt handler\n" );clk_prepare_enable (cryp->hclk);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/353 crypto: octeontx2 - Fix cptvf driver cleanup
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bharat Bhushan <[email protected]>
[ Upstream commit c480a421a4faf693c38e60b0fe6e554c9a3fee02 ]
This patch fixes following cleanup issues:
- Missing instruction queue free on cleanup. This will lead to memory leak.
- lfs->lfs_num is set to zero before cleanup, which will lead to improper cleanup.
--- drivers/crypto/marvell/octeontx2/otx2_cptlf.c | 6 ++++-- drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c | 3 +++ 2 files changed, 7 insertions(+), 2 deletions(-)
drivers/crypto/marvell/octeontx2/otx2_cptlf.c +4 -2
@@ -419,8 +419,8 @@ int otx2_cptlf_init(struct otx2_cptlfs_info *lfs, u8 eng_grp_mask, int pri,return 0 ; free_iq: -otx2_cpt_free_instruction_queues (lfs);cptlf_hw_cleanup (lfs); +otx2_cpt_free_instruction_queues (lfs); detach_rsrcs:otx2_cpt_detach_rsrcs_msg (lfs); clear_lfs_num:
@@ -431,11 +431,13 @@ EXPORT_SYMBOL_NS_GPL(otx2_cptlf_init, CRYPTO_DEV_OCTEONTX2_CPT);void otx2_cptlf_shutdown (struct otx2_cptlfs_info *lfs) { - lfs->lfs_num =0 ;/* Cleanup LFs hardware side */ cptlf_hw_cleanup (lfs); +/* Free instruction queues */ +otx2_cpt_free_instruction_queues (lfs);/* Send request to detach LFs */ otx2_cpt_detach_rsrcs_msg (lfs); + lfs->lfs_num =0 ; }EXPORT_SYMBOL_NS_GPL (otx2_cptlf_shutdown,CRYPTO_DEV_OCTEONTX2_CPT );
drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c +3 -0
@@ -249,8 +249,11 @@ static void cptvf_lf_shutdown(struct otx2_cptlfs_info *lfs)otx2_cptlf_unregister_interrupts (lfs);/* Cleanup LFs software side */ lf_sw_cleanup (lfs); +/* Free instruction queues */ +otx2_cpt_free_instruction_queues (lfs);/* Send request to detach LFs */ otx2_cpt_detach_rsrcs_msg (lfs); + lfs->lfs_num =0 ; }static int cptvf_lf_init (struct otx2_cptvf_dev *cptvf)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/353 erofs: fix ztailpacking for subpage compressed blocks
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
[ Upstream commit e5aba911dee5e20fa82efbe13e0af8f38ea459e7 ]
pageofs_in should be the compressed data offset of the page rather than of the block.
--- fs/erofs/zdata.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/erofs/zdata.c +1 -1
@@ -815,7 +815,6 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe)if (ztailpacking) { pcl->obj.index =0 ;/* which indicates ztailpacking */ - pcl->pageofs_in =erofs_blkoff (fe->inode->i_sb, map->m_pa); pcl->tailpacking_size = map->m_plen; }else { pcl->obj.index = map->m_pa >>PAGE_SHIFT ;
@@ -893,6 +892,7 @@ static int z_erofs_pcluster_begin(struct z_erofs_decompress_frontend *fe) }get_page (map->buf.page);WRITE_ONCE (fe->pcl->compressed_bvecs[0 ].page, map->buf.page); + fe->pcl->pageofs_in = map->m_pa & ~PAGE_MASK ; fe->mode =Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE ; }/* file-backed inplace I/O pages are traversed in reverse order */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/353 crypto: stm32/crc32 - fix parsing list of devices
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Bourgoin <[email protected]>
[ Upstream commit 0eaef675b94c746900dcea7f6c41b9a103ed5d53 ]
smatch warnings:drivers/crypto/stm32/stm32-crc32.c:108 stm32_crc_get_next_crc() warn:
can 'crc' even be NULL?
Use list_first_entry_or_null instead of list_first_entry to retrieve the first device registered.
The function list_first_entry always return a non NULL pointer even if the list is empty. Hence checking if the pointer returned is NULL does not tell if the list is empty or not.
--- drivers/crypto/stm32/stm32-crc32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/stm32/stm32-crc32.c +1 -1
@@ -104,7 +104,7 @@ static struct stm32_crc *stm32_crc_get_next_crc(void)struct stm32_crc *crc;spin_lock_bh (&crc_list.lock); - crc = list_first_entry(&crc_list.dev_list, struct stm32_crc, list); + crc = list_first_entry_or_null(&crc_list.dev_list, struct stm32_crc, list);if (crc)list_move_tail (&crc->list, &crc_list.dev_list);spin_unlock_bh (&crc_list.lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/353 afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu()
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
[ Upstream commit 4121b4337146b64560d1e46ebec77196d9287802 ]
David Howells says:
(2) afs_lookup_volume_rcu().
There can be a lot of volumes known by a system. A thousand would require a 10-step walk and this is drivable by remote operation, so I think this should probably take a lock on the second pass too.
Make the "seq" counter odd on the 2nd pass, otherwise read_seqbegin_or_lock() never takes the lock.
--- fs/afs/callback.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/afs/callback.c +2 -1
@@ -110,13 +110,14 @@ static struct afs_volume *afs_lookup_volume_rcu(struct afs_cell *cell, {struct afs_volume *volume =NULL ;struct rb_node *p; -int seq =0 ; +int seq =1 ; do { /* Unfortunately, rbtree walking doesn't give reliable results * under just the RCU read lock, so we have to check for * changes. */ + seq++; /* 2 on the 1st/lockless path, otherwise odd */ read_seqbegin_or_lock(&cell->volume_lock, &seq); p = rcu_dereference_raw(cell->volumes.rb_node);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/353 rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
[ Upstream commit bad1a11c0f061aa073bab785389fe04f19ba02e1 ]
rxrpc_find_service_conn_rcu() should make the "seq" counter odd on the second pass, otherwise read_seqbegin_or_lock() never takes the lock.
--- net/rxrpc/conn_service.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/rxrpc/conn_service.c +2 -1
@@ -25,7 +25,7 @@ struct rxrpc_connection *rxrpc_find_service_conn_rcu(struct rxrpc_peer *peer,struct rxrpc_conn_proto k;struct rxrpc_skb_priv *sp =rxrpc_skb (skb);struct rb_node *p; -unsigned int seq =0 ; +unsigned int seq =1 ; k.epoch = sp->hdr.epoch; k.cid = sp->hdr.cid &RXRPC_CIDMASK ;
@@ -35,6 +35,7 @@ struct rxrpc_connection *rxrpc_find_service_conn_rcu(struct rxrpc_peer *peer,* under just the RCU read lock, so we have to check for * changes. */ + seq++;/* 2 on the 1st/lockless path, otherwise odd */ read_seqbegin_or_lock (&peer->service_conn_lock, &seq); p =rcu_dereference_raw (peer->service_conns.rb_node);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/353 jfs: fix array-index-out-of-bounds in diNewExt
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit 49f9637aafa6e63ba686c13cb8549bf5e6920402 ]
[Syz report]
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:2360:2 index -878706688 is out of range for type 'struct iagctl[128]' CPU: 1 PID: 5065 Comm: syz-executor282 Not tainted 6.7.0-rc4-syzkaller-00009-gbee0e7762ad2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 diNewExt+0x3cf3/0x4000 fs/jfs/jfs_imap.c:2360 diAllocExt fs/jfs/jfs_imap.c:1949 [inline] diAllocAG+0xbe8/0x1e50 fs/jfs/jfs_imap.c:1666 diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587 ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56 jfs_mkdir+0x1c5/0xb90 fs/jfs/namei.c:225 vfs_mkdir+0x2f1/0x4b0 fs/namei.c:4106 do_mkdirat+0x264/0x3a0 fs/namei.c:4129 __do_sys_mkdir fs/namei.c:4149 [inline] __se_sys_mkdir fs/namei.c:4147 [inline] __x64_sys_mkdir+0x6e/0x80 fs/namei.c:4147 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7fcb7e6a0b57 Code: ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd83023038 EFLAGS: 00000286 ORIG_RAX: 0000000000000053 RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007fcb7e6a0b57 RDX: 00000000000a1020 RSI: 00000000000001ff RDI: 0000000020000140 RBP: 0000000020000140 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000286 R12: 00007ffd830230d0 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[Analysis]
When the agstart is too large, it can cause agno overflow.
[Fix]
After obtaining agno, if the value is invalid, exit the subsequent process.
Modified the test from agno > MAXAG to agno >= MAXAG based on linux-next report by kernel test robot (Dan Carpenter).
--- fs/jfs/jfs_imap.c | 3 +++ 1 file changed, 3 insertions(+)
fs/jfs/jfs_imap.c +3 -0
@@ -2179,6 +2179,9 @@ static int diNewExt(struct inomap * imap, struct iag * iagp, int extno)/* get the ag and iag numbers for this iag. */ agno =BLKTOAG (le64_to_cpu (iagp->agstart), sbi); +if (agno >=MAXAG || agno <0 ) +return -EIO ; + iagno =le32_to_cpu (iagp->iagnum);/* check if this is the last free extent within the
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/353 s390/boot: always align vmalloc area on segment boundary
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Gordeev <[email protected]>
[ Upstream commit 65f8780e2d70257200547b5a7654974aa7c37ce1 ]
The size of vmalloc area depends from various factors on boot and could be set to:
1. Default size as determined by VMALLOC_DEFAULT_SIZE macro;
2. One half of the virtual address space not occupied by modules and fixed mappings;
3. The size provided by user with vmalloc= kernel command line parameter;
In cases [1] and [2] the vmalloc area base address is aligned on Region3 table type boundary, while in case [3] in might get aligned on page boundary.
Limit the waste of page tables and always align vmalloc area size and base address on segment boundary.
--- arch/s390/boot/ipl_parm.c | 2 +- arch/s390/boot/startup.c | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-)
arch/s390/boot/ipl_parm.c +1 -1
@@ -274,7 +274,7 @@ void parse_boot_command_line(void) memory_limit =round_down (memparse (val,NULL ),PAGE_SIZE );if (!strcmp (param,"vmalloc" ) && val) { - vmalloc_size =round_up (memparse (val,NULL ),PAGE_SIZE ); + vmalloc_size =round_up (memparse (val,NULL ), _SEGMENT_SIZE); vmalloc_size_set =1 ; }
arch/s390/boot/startup.c +2 -1
@@ -255,7 +255,8 @@ static unsigned long setup_kernel_memory_layout(void)VMALLOC_END =MODULES_VADDR ;/* allow vmalloc area to occupy up to about 1/2 of the rest virtual space left */ - vmalloc_size =min (vmalloc_size,round_down (VMALLOC_END /2 , _REGION3_SIZE)); + vsize =round_down (VMALLOC_END /2 , _SEGMENT_SIZE); + vmalloc_size =min (vmalloc_size, vsize);VMALLOC_START =VMALLOC_END - vmalloc_size;/* split remaining virtual space between 1:1 mapping & vmemmap array */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/353 arch: consolidate arch_irq_work_raise prototypes
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 64bac5ea17d527872121adddfee869c7a0618f8f ]
The prototype was hidden in an #ifdef on x86, which causes a warning:
kernel/irq_work.c:72:13: error: no previous prototype for 'arch_irq_work_raise' [-Werror=missing-prototypes]
Some architectures have a working prototype, while others don't. Fix this by providing it in only one place that is always visible.
--- arch/arm/include/asm/irq_work.h | 2 -- arch/arm64/include/asm/irq_work.h | 2 -- arch/csky/include/asm/irq_work.h | 2 +- arch/powerpc/include/asm/irq_work.h | 1 - arch/riscv/include/asm/irq_work.h | 2 +- arch/s390/include/asm/irq_work.h | 2 -- arch/x86/include/asm/irq_work.h | 1 - include/linux/irq_work.h | 3 +++ 8 files changed, 5 insertions(+), 10 deletions(-)
arch/arm/include/asm/irq_work.h +0 -2
@@ -9,6 +9,4 @@ static inline bool arch_irq_work_has_interrupt(void) return is_smp(); } -extern void arch_irq_work_raise (void ); -#endif /* _ASM_ARM_IRQ_WORK_H */
arch/arm64/include/asm/irq_work.h +0 -2
@@ -2,8 +2,6 @@#ifndef __ASM_IRQ_WORK_H#define __ASM_IRQ_WORK_H -extern void arch_irq_work_raise (void ); -static inline bool arch_irq_work_has_interrupt (void ) {return true;
arch/csky/include/asm/irq_work.h +1 -1
@@ -7,5 +7,5 @@ static inline bool arch_irq_work_has_interrupt(void) {return true; } -extern void arch_irq_work_raise (void ); +#endif /* __ASM_CSKY_IRQ_WORK_H */
arch/powerpc/include/asm/irq_work.h +0 -1
@@ -6,6 +6,5 @@ static inline bool arch_irq_work_has_interrupt(void) {return true; } -extern void arch_irq_work_raise (void );#endif /* _ASM_POWERPC_IRQ_WORK_H */
arch/riscv/include/asm/irq_work.h +1 -1
@@ -6,5 +6,5 @@ static inline bool arch_irq_work_has_interrupt(void) {return IS_ENABLED (CONFIG_SMP ); } -extern void arch_irq_work_raise (void ); +#endif /* _ASM_RISCV_IRQ_WORK_H */
arch/s390/include/asm/irq_work.h +0 -2
@@ -7,6 +7,4 @@ static inline bool arch_irq_work_has_interrupt(void) return true; } -void arch_irq_work_raise (void ); -#endif /* _ASM_S390_IRQ_WORK_H */
arch/x86/include/asm/irq_work.h +0 -1
@@ -9,7 +9,6 @@ static inline bool arch_irq_work_has_interrupt(void) {return boot_cpu_has (X86_FEATURE_APIC ); } -extern void arch_irq_work_raise (void );#else static inline bool arch_irq_work_has_interrupt (void ) {
include/linux/irq_work.h +3 -0
@@ -66,6 +66,9 @@ void irq_work_sync(struct irq_work *work);void irq_work_run (void );bool irq_work_needs_cpu (void );void irq_work_single (void *arg); + +void arch_irq_work_raise (void ); +#else static inline bool irq_work_needs_cpu (void ) {return false; }static inline void irq_work_run (void ) { }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/353 arch: fix asm-offsets.c building with -Wmissing-prototypes
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 4d86896793dd6eeacdf32b85af1ef130349db4be ]
When -Wmissing-prototypes is enabled, the some asm-offsets.c files fail to build, even when this warning is disabled in the Makefile for normal files:
arch/sparc/kernel/asm-offsets.c:22:5: error: no previous prototype for 'sparc32_foo' [-Werror=missing-prototypes] arch/sparc/kernel/asm-offsets.c:48:5: error: no previous prototype for 'foo' [-Werror=missing-prototypes]
Address this by making use of the same trick as x86, marking these functions as 'static __used' to avoid the need for a prototype by not drop them in dead-code elimination.
--- arch/alpha/kernel/asm-offsets.c | 2 +- arch/loongarch/kernel/asm-offsets.c | 26 +++++++++++++------------- arch/sparc/kernel/asm-offsets.c | 6 +++--- 3 files changed, 17 insertions(+), 17 deletions(-)
arch/alpha/kernel/asm-offsets.c +1 -1
@@ -12,7 +12,7 @@#include <linux/kbuild.h> #include <asm/io.h> -void foo (void ) +static void __used foo (void ) {DEFINE (TI_TASK , offsetof(struct thread_info , task));DEFINE (TI_FLAGS , offsetof(struct thread_info , flags));
arch/loongarch/kernel/asm-offsets.c +13 -13
@@ -15,7 +15,7 @@#include <asm/processor.h> #include <asm/ftrace.h> -void output_ptreg_defines (void ) +static void __used output_ptreg_defines (void ) {COMMENT ("LoongArch pt_regs offsets." );OFFSET (PT_R0 , pt_regs, regs[0 ]);
@@ -62,7 +62,7 @@ void output_ptreg_defines(void)BLANK (); } -void output_task_defines (void ) +static void __used output_task_defines (void ) {COMMENT ("LoongArch task_struct offsets." );OFFSET (TASK_STATE , task_struct, __state);
@@ -77,7 +77,7 @@ void output_task_defines(void)BLANK (); } -void output_thread_info_defines (void ) +static void __used output_thread_info_defines (void ) {COMMENT ("LoongArch thread_info offsets." );OFFSET (TI_TASK , thread_info, task);
@@ -93,7 +93,7 @@ void output_thread_info_defines(void)BLANK (); } -void output_thread_defines (void ) +static void __used output_thread_defines (void ) {COMMENT ("LoongArch specific thread_struct offsets." );OFFSET (THREAD_REG01 , task_struct, thread.reg01);
@@ -129,7 +129,7 @@ void output_thread_defines(void)BLANK (); } -void output_thread_fpu_defines (void ) +static void __used output_thread_fpu_defines (void ) {OFFSET (THREAD_FPR0 , loongarch_fpu, fpr[0 ]);OFFSET (THREAD_FPR1 , loongarch_fpu, fpr[1 ]);
@@ -170,7 +170,7 @@ void output_thread_fpu_defines(void)BLANK (); } -void output_thread_lbt_defines (void ) +static void __used output_thread_lbt_defines (void ) {OFFSET (THREAD_SCR0 , loongarch_lbt, scr0);OFFSET (THREAD_SCR1 , loongarch_lbt, scr1);
@@ -180,7 +180,7 @@ void output_thread_lbt_defines(void)BLANK (); } -void output_mm_defines (void ) +static void __used output_mm_defines (void ) {COMMENT ("Size of struct page" );DEFINE (STRUCT_PAGE_SIZE ,sizeof (struct page ));
@@ -212,7 +212,7 @@ void output_mm_defines(void)BLANK (); } -void output_sc_defines (void ) +static void __used output_sc_defines (void ) {COMMENT ("Linux sigcontext offsets." );OFFSET (SC_REGS , sigcontext, sc_regs);
@@ -220,7 +220,7 @@ void output_sc_defines(void)BLANK (); } -void output_signal_defines (void ) +static void __used output_signal_defines (void ) {COMMENT ("Linux signal numbers." );DEFINE (_SIGHUP,SIGHUP );
@@ -258,7 +258,7 @@ void output_signal_defines(void) }#ifdef CONFIG_SMP -void output_smpboot_defines (void ) +static void __used output_smpboot_defines (void ) {COMMENT ("Linux smp cpu boot offsets." );OFFSET (CPU_BOOT_STACK , secondary_data, stack);
@@ -268,7 +268,7 @@ void output_smpboot_defines(void)#endif #ifdef CONFIG_HIBERNATION -void output_pbe_defines (void ) +static void __used output_pbe_defines (void ) {COMMENT ("Linux struct pbe offsets." );OFFSET (PBE_ADDRESS , pbe, address);
@@ -280,7 +280,7 @@ void output_pbe_defines(void)#endif #ifdef CONFIG_FUNCTION_GRAPH_TRACER -void output_fgraph_ret_regs_defines (void ) +static void __used output_fgraph_ret_regs_defines (void ) {COMMENT ("LoongArch fgraph_ret_regs offsets." );OFFSET (FGRET_REGS_A0 , fgraph_ret_regs, regs[0 ]);
@@ -291,7 +291,7 @@ void output_fgraph_ret_regs_defines(void) }#endif -void output_kvm_defines (void ) +static void __used output_kvm_defines (void ) {COMMENT ("KVM/LoongArch Specific offsets." );
arch/sparc/kernel/asm-offsets.c +3 -3
@@ -19,14 +19,14 @@#include <asm/hibernate.h> #ifdef CONFIG_SPARC32 -int sparc32_foo (void ) +static int __used sparc32_foo (void ) {DEFINE (AOFF_thread_fork_kpsr, offsetof(struct thread_struct , fork_kpsr));return 0 ; }#else -int sparc64_foo (void ) +static int __used sparc64_foo (void ) {#ifdef CONFIG_HIBERNATION BLANK ();
@@ -45,7 +45,7 @@ int sparc64_foo(void) }#endif -int foo (void ) +static int __used foo (void ) {BLANK ();DEFINE (AOFF_task_thread, offsetof(struct task_struct , thread));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/353 s390/vfio-ap: fix sysfs status attribute for AP queue devices
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Krowiak <[email protected]>
[ Upstream commit a0d8f4eeb7c4ffaee21702bcc91a09b3988c5b7a ]
The 'status' attribute for AP queue devices bound to the vfio_ap device driver displays incorrect status when the mediated device is attached to a guest, but the queue device is not passed through. In the current implementation, the status displayed is 'in_use' which is not correct; it should be 'assigned'. This can happen if one of the queue devices associated with a given adapter is not bound to the vfio_ap device driver. For example:
Queues listed in /sys/bus/ap/drivers/vfio_ap:
14.0005
14.0006
14.000d
16.0006
16.000d
Queues listed in /sys/devices/vfio_ap/matrix/$UUID/matrix 14.0005
14.0006
14.000d
16.0005
16.0006
16.000d
Queues listed in /sys/devices/vfio_ap/matrix/$UUID/guest_matrix 14.0005
14.0006
14.000d
The reason no queues for adapter 0x16 are listed in the guest_matrix is because queue 16.0005 is not bound to the vfio_ap device driver, so no queue associated with the adapter is passed through to the guest; therefore, each queue device for adapter 0x16 should display 'assigned' instead of 'in_use', because those queues are not in use by a guest, but only assigned to the mediated device.
Let's check the AP configuration for the guest to determine whether a queue device is passed through before displaying a status of 'in_use'.
--- drivers/s390/crypto/vfio_ap_ops.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
drivers/s390/crypto/vfio_ap_ops.c +15 -1
@@ -2044,6 +2044,7 @@ static ssize_t status_show(struct device *dev, {ssize_t nchars =0 ;struct vfio_ap_queue *q; +unsigned long apid, apqi;struct ap_matrix_mdev *matrix_mdev;struct ap_device *apdev =to_ap_dev (dev);
@@ -2051,8 +2052,21 @@ static ssize_t status_show(struct device *dev, q =dev_get_drvdata (&apdev->device); matrix_mdev =vfio_ap_mdev_for_queue (q); +/* If the queue is assigned to the matrix mediated device, then +* determine whether it is passed through to a guest; otherwise, +* indicate that it is unassigned. +*/ if (matrix_mdev) { -if (matrix_mdev->kvm) + apid =AP_QID_CARD (q->apqn); + apqi =AP_QID_QUEUE (q->apqn); +/* +* If the queue is passed through to the guest, then indicate +* that it is in use; otherwise, indicate that it is +* merely assigned to a matrix mediated device. +*/ +if (matrix_mdev->kvm && +test_bit_inv (apid, matrix_mdev->shadow_apcb.apm) && +test_bit_inv (apqi, matrix_mdev->shadow_apcb.aqm)) nchars =scnprintf (buf,PAGE_SIZE ,"%s\n" ,AP_QUEUE_IN_USE );else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/353 s390/ptrace: handle setting of fpc register correctly
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit 8b13601d19c541158a6e18b278c00ba69ae37829 ]
If the content of the floating point control (fpc) register of a traced process is modified with the ptrace interface the new value is tested for validity by temporarily loading it into the fpc register.
This may lead to corruption of the fpc register of the tracing process:
if an interrupt happens while the value is temporarily loaded into the fpc register, and within interrupt context floating point or vector registers are used, the current fp/vx registers are saved with save_fpu_regs() assuming they belong to user space and will be loaded into fp/vx registers when returning to user space.
test_fp_ctl() restores the original user space fpc register value, however it will be discarded, when returning to user space.
In result the tracer will incorrectly continue to run with the value that was supposed to be used for the traced process.
Fix this by saving fpu register contents with save_fpu_regs() before using test_fp_ctl().
--- arch/s390/kernel/ptrace.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/s390/kernel/ptrace.c +3 -3
@@ -392,6 +392,7 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data)/* * floating point control reg. is in the thread structure */ +save_fpu_regs ();if ((unsigned int ) data !=0 ||test_fp_ctl (data >> (BITS_PER_LONG -32 )))return -EINVAL ;
@@ -748,6 +749,7 @@ static int __poke_user_compat(struct task_struct *child,/* * floating point control reg. is in the thread structure */ +save_fpu_regs ();if (test_fp_ctl (tmp))return -EINVAL ; child->thread.fpu.fpc = data;
@@ -911,9 +913,7 @@ static int s390_fpregs_set(struct task_struct *target,int rc =0 ;freg_t fprs[__NUM_FPRS]; -if (target == current) -save_fpu_regs (); - +save_fpu_regs ();if (MACHINE_HAS_VX )convert_vx_to_fp (fprs, target->thread.fpu.vxrs);else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/353 KVM: s390: fix setting of fpc register
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit b988b1bb0053c0dcd26187d29ef07566a565cf55 ]
kvm_arch_vcpu_ioctl_set_fpu() allows to set the floating point control (fpc) register of a guest cpu. The new value is tested for validity by temporarily loading it into the fpc register.
This may lead to corruption of the fpc register of the host process:
if an interrupt happens while the value is temporarily loaded into the fpc register, and within interrupt context floating point or vector registers are used, the current fp/vx registers are saved with save_fpu_regs() assuming they belong to user space and will be loaded into fp/vx registers when returning to user space.
test_fp_ctl() restores the original user space / host process fpc register value, however it will be discarded, when returning to user space.
In result the host process will incorrectly continue to run with the value that was supposed to be used for a guest cpu.
Fix this by simply removing the test. There is another test right before the SIE context is entered which will handles invalid values.
This results in a change of behaviour: invalid values will now be accepted instead of that the ioctl fails with -EINVAL. This seems to be acceptable, given that this interface is most likely not used anymore, and this is in addition the same behaviour implemented with the memory mapped interface (replace invalid values with zero) - see sync_regs() in kvm-s390.c.
--- arch/s390/kvm/kvm-s390.c | 5 ----- 1 file changed, 5 deletions(-)
arch/s390/kvm/kvm-s390.c +0 -5
@@ -4316,10 +4316,6 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)vcpu_load (vcpu); -if (test_fp_ctl (fpu->fpc)) { - ret = -EINVAL ; - goto out; - } vcpu->run->s.regs.fpc = fpu->fpc;if (MACHINE_HAS_VX ) convert_fp_to_vx((__vector128 *) vcpu->run->s.regs.vrs,
@@ -4327,7 +4323,6 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)else memcpy (vcpu->run->s.regs.fprs, &fpu->fprs,sizeof (fpu->fprs)); -out:vcpu_put (vcpu);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/353 sysctl: Fix out of bounds access for empty sysctl registers
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joel Granados <[email protected]>
[ Upstream commit 315552310c7de92baea4e570967066569937a843 ]
When registering tables to the sysctl subsystem there is a check to see if header is a permanently empty directory (used for mounts). This check evaluates the first element of the ctl_table. This results in an out of bounds evaluation when registering empty directories.
The function register_sysctl_mount_point now passes a ctl_table of size 1 instead of size 0. It now relies solely on the type to identify a permanently empty register.
Make sure that the ctl_table has at least one element before testing for permanent emptiness.
--- fs/proc/proc_sysctl.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
fs/proc/proc_sysctl.c +7 -2
@@ -44,7 +44,7 @@ static struct ctl_table sysctl_mount_point[] = {*/ struct ctl_table_header *register_sysctl_mount_point (const char *path) { -return register_sysctl_sz (path, sysctl_mount_point,0 ); +return register_sysctl (path, sysctl_mount_point); }EXPORT_SYMBOL (register_sysctl_mount_point);
@@ -233,7 +233,8 @@ static int insert_header(struct ctl_dir *dir, struct ctl_table_header *header)return -EROFS ;/* Am I creating a permanently empty directory? */ -if (sysctl_is_perm_empty_ctl_table (header->ctl_table)) { +if (header->ctl_table_size >0 && +sysctl_is_perm_empty_ctl_table (header->ctl_table)) {if (!RB_EMPTY_ROOT (&dir->root))return -EINVAL ;sysctl_set_perm_empty_ctl_header (dir_h);
@@ -1213,6 +1214,10 @@ static bool get_links(struct ctl_dir *dir,struct ctl_table_header *tmp_head;struct ctl_table *entry, *link; +if (header->ctl_table_size ==0 || +sysctl_is_perm_empty_ctl_table (header->ctl_table)) +return true; +/* Are there links available for every entry in table? */ list_for_each_table_entry (entry, header) {const char *procname = entry->procname;
Signature · 1 line
2.43.0
Re: [PATCH 6.7 052/353] sysctl: Fix out of bounds access for empty sysctl registers
Looks good to me
This patch depends on 53f3811dfd5e39507ee3aaea1be09aabce8f9c98 "sysctl:
Use ctl_table_size as stopping criteria for list macro" and 1e887723545e037b5e200e77edf79802f58fc818 "sysctl: Add ctl_table_size to ctl_table_header" which are both in 6.7 and 6.6.
Best
Quoted 68 lines · Greg Kroah-Hartman
6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joel Granados <[email protected]>
[ Upstream commit
315552310c7de92baea4e570967066569937a843]When registering tables to the sysctl subsystem there is a check to see if header is a permanently empty directory (used for mounts). This check evaluates the first element of the
ctl_table. This results in an out of bounds evaluation when registering empty directories.The function
register_sysctl_mount_pointnow passes actl_tableof size 1 instead of size 0. It now relies solely on the type to identify a permanently empty register.Make sure that the
ctl_tablehas at least one element before testing for permanent emptiness.Signed-off-by Joel Granados <[email protected]>Reported-by kernel test robot <[email protected]>Signed-off-by Luis Chamberlain <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- fs/proc/proc_sysctl.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)fs/proc/proc_sysctl.c +7
-2@@ -44,7 +44,7 @@ static struct ctl_table sysctl_mount_point[] = {*/ struct ctl_table_header *register_sysctl_mount_point (const char *path) { -return register_sysctl_sz (path, sysctl_mount_point,0 ); +return register_sysctl (path, sysctl_mount_point); }EXPORT_SYMBOL (register_sysctl_mount_point);@@ -233,7 +233,8 @@ static int insert_header(struct ctl_dir *dir, struct ctl_table_header *header)return -EROFS ;/* Am I creating a permanently empty directory? */ -if (sysctl_is_perm_empty_ctl_table (header->ctl_table)) { +if (header->ctl_table_size >0 && +sysctl_is_perm_empty_ctl_table (header->ctl_table)) {if (!RB_EMPTY_ROOT (&dir->root))return -EINVAL ;sysctl_set_perm_empty_ctl_header (dir_h);@@ -1213,6 +1214,10 @@ static bool get_links(struct ctl_dir *dir,struct ctl_table_header *tmp_head;struct ctl_table *entry, *link; +if (header->ctl_table_size ==0 || +sysctl_is_perm_empty_ctl_table (header->ctl_table)) +return true; +/* Are there links available for every entry in table? */ list_for_each_table_entry (entry, header) {const char *procname = entry->procname;Signature · 1 line
2.43.0
Signature · 1 line
Joel Granados
Greg Kroah-Hartman
maintainerPATCH 53/353 SUNRPC: Fix a suspicious RCU usage warning
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anna Schumaker <[email protected]>
[ Upstream commit 31b62908693c90d4d07db597e685d9f25a120073 ]
I received the following warning while running cthon against an ontap server running pNFS:
[ 57.202521] =============================
[ 57.202522] WARNING: suspicious RCU usage
[ 57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted
[ 57.202525] -----------------------------
[ 57.202525] net/sunrpc/xprtmultipath.c:349 RCU-list traversed in non-reader section!!
[ 57.202527]
other info that might help us debug this:[ 57.202528]
rcu_scheduler_active = 2, debug_locks = 1
[ 57.202529] no locks held by test5/3567.
[ 57.202530]
stack backtrace:
[ 57.202532] CPU: 0 PID: 3567 Comm: test5 Not tainted 6.7.0-rc3-g2cc14f52aeb7 #41492 5b09971b4965c0aceba19f3eea324a4a806e227e
[ 57.202534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 2/2/2022
[ 57.202536] Call Trace:
[ 57.202537] <TASK>
[ 57.202540] dump_stack_lvl+0x77/0xb0
[ 57.202551] lockdep_rcu_suspicious+0x154/0x1a0
[ 57.202556] rpc_xprt_switch_has_addr+0x17c/0x190 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]
[ 57.202596] rpc_clnt_setup_test_and_add_xprt+0x50/0x180 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]
[ 57.202621] ? rpc_clnt_add_xprt+0x254/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]
[ 57.202646] rpc_clnt_add_xprt+0x27a/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]
[ 57.202671] ? __pfx_rpc_clnt_setup_test_and_add_xprt+0x10/0x10 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]
[ 57.202696] nfs4_pnfs_ds_connect+0x345/0x760 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]
[ 57.202728] ? __pfx_nfs4_test_session_trunk+0x10/0x10 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]
[ 57.202754] nfs4_fl_prepare_ds+0x75/0xc0 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a]
[ 57.202760] filelayout_write_pagelist+0x4a/0x200 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a]
[ 57.202765] pnfs_generic_pg_writepages+0xbe/0x230 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]
[ 57.202788] __nfs_pageio_add_request+0x3fd/0x520 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]
[ 57.202813] nfs_pageio_add_request+0x18b/0x390 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]
[ 57.202831] nfs_do_writepage+0x116/0x1e0 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]
[ 57.202849] nfs_writepages_callback+0x13/0x30 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]
[ 57.202866] write_cache_pages+0x265/0x450
[ 57.202870] ? __pfx_nfs_writepages_callback+0x10/0x10 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]
[ 57.202891] nfs_writepages+0x141/0x230 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]
[ 57.202913] do_writepages+0xd2/0x230
[ 57.202917] ? filemap_fdatawrite_wbc+0x5c/0x80
[ 57.202921] filemap_fdatawrite_wbc+0x67/0x80
[ 57.202924] filemap_write_and_wait_range+0xd9/0x170
[ 57.202930] nfs_wb_all+0x49/0x180 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]
[ 57.202947] nfs4_file_flush+0x72/0xb0 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]
[ 57.202969] __se_sys_close+0x46/0xd0
[ 57.202972] do_syscall_64+0x68/0x100
[ 57.202975] ? do_syscall_64+0x77/0x100
[ 57.202976] ? do_syscall_64+0x77/0x100
[ 57.202979] entry_SYSCALL_64_after_hwframe+0x6e/0x76
[ 57.202982] RIP: 0033:0x7fe2b12e4a94
[ 57.202985] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d d5 18 0e 00 00 74 13 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 44 c3 0f 1f 00 48 83 ec 18 89 7c 24 0c e8 c3
[ 57.202987] RSP: 002b:00007ffe857ddb38 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
[ 57.202989] RAX: ffffffffffffffda RBX: 00007ffe857dfd68 RCX: 00007fe2b12e4a94
[ 57.202991] RDX: 0000000000002000 RSI: 00007ffe857ddc40 RDI: 0000000000000003
[ 57.202992] RBP: 00007ffe857dfc50 R08: 7fffffffffffffff R09: 0000000065650f49
[ 57.202993] R10: 00007fe2b11f8300 R11: 0000000000000202 R12: 0000000000000000
[ 57.202994] R13: 00007ffe857dfd80 R14: 00007fe2b1445000 R15: 0000000000000000
[ 57.202999] </TASK>The problem seems to be that two out of three callers aren't taking the rcu_read_lock() before calling the list_for_each_entry_rcu() function in rpc_xprt_switch_has_addr(). I fix this by having rpc_xprt_switch_has_addr() unconditionaly take the rcu_read_lock(), which is okay to do recursively in the case that the lock has already been taken by a caller.
--- net/sunrpc/xprtmultipath.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
net/sunrpc/xprtmultipath.c +15 -2
@@ -336,8 +336,9 @@ struct rpc_xprt *xprt_iter_current_entry_offline(struct rpc_xprt_iter *xpi) xprt_switch_find_current_entry_offline); } -bool rpc_xprt_switch_has_addr (struct rpc_xprt_switch *xps, -const struct sockaddr *sap) +static +bool __rpc_xprt_switch_has_addr (struct rpc_xprt_switch *xps, +const struct sockaddr *sap) {struct list_head *head;struct rpc_xprt *pos;
@@ -356,6 +357,18 @@ bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps,return false; } +bool rpc_xprt_switch_has_addr (struct rpc_xprt_switch *xps, +const struct sockaddr *sap) +{ +bool res; + +rcu_read_lock (); + res =__rpc_xprt_switch_has_addr (xps, sap); +rcu_read_unlock (); + +return res; +} +static struct rpc_xprt *xprt_switch_find_next_entry (struct list_head *head,const struct rpc_xprt *cur,bool check_active)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/353 ext4: treat end of range as exclusive in ext4_zero_range()
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ojaswin Mujoo <[email protected]>
[ Upstream commit 92573369144f40397e8514440afdf59f24905b40 ]
The call to filemap_write_and_wait_range() assumes the range passed to be inclusive, so fix the call to make sure we follow that.
--- fs/ext4/extents.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/ext4/extents.c +4 -2
@@ -4523,7 +4523,8 @@ static long ext4_zero_range(struct file *file, loff_t offset,* Round up offset. This is not fallocate, we need to zero out * blocks, so convert interior block aligned part of the range to * unwritten and possibly manually zero out unaligned parts of the -* range. +* range. Here, start and partial_begin are inclusive, end and +* partial_end are exclusive. */ start =round_up (offset,1 << blkbits); end =round_down ((offset + len),1 << blkbits);
@@ -4609,7 +4610,8 @@ static long ext4_zero_range(struct file *file, loff_t offset,* disk in case of crash before zeroing trans is committed. */ if (ext4_should_journal_data (inode)) { - ret =filemap_write_and_wait_range (mapping, start, end); + ret =filemap_write_and_wait_range (mapping, start, + end -1 );if (ret) {filemap_invalidate_unlock (mapping); goto out_mutex;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/353 smb: client: fix renaming of reparse points
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit 7435d51b7ea2ab7801279c43ecd72063e9d5c92f ]
The client was sending an SMB2_CREATE request without setting OPEN_REPARSE_POINT flag thus failing the entire rename operation.
Fix this by setting OPEN_REPARSE_POINT in create options for SMB2_CREATE request when the source inode is a repase point.
--- fs/smb/client/cifsglob.h | 22 +++++++++++++++++----- fs/smb/client/cifsproto.h | 7 ++++--- fs/smb/client/cifssmb.c | 8 ++++---- fs/smb/client/inode.c | 3 ++- fs/smb/client/smb2inode.c | 38 +++++++++++++++++++++++--------------- fs/smb/client/smb2proto.h | 8 +++++--- 6 files changed, 55 insertions(+), 31 deletions(-)
fs/smb/client/cifsglob.h +17 -5
@@ -205,9 +205,18 @@ struct cifs_open_info_data { }; }; -#define cifs_open_data_reparse (d) \ - ((d)->reparse_point || \ - (le32_to_cpu((d)->fi.Attributes) & ATTR_REPARSE)) +static inline bool cifs_open_data_reparse (struct cifs_open_info_data *data) +{ +struct smb2_file_all_info *fi = &data->fi; +u32 attrs =le32_to_cpu (fi->Attributes); +bool ret; + + ret = data->reparse_point || (attrs &ATTR_REPARSE ); +if (ret) + attrs |=ATTR_REPARSE ; + fi->Attributes =cpu_to_le32 (attrs); +return ret; +}static inline void cifs_free_open_info (struct cifs_open_info_data *data) {
@@ -390,8 +399,11 @@ struct smb_version_operations {int (*rename_pending_delete)(const char *,struct dentry *,const unsigned int );/* send rename request */ -int (*rename)(const unsigned int ,struct cifs_tcon *,const char *, -const char *,struct cifs_sb_info *); +int (*rename)(const unsigned int xid, +struct cifs_tcon *tcon, +struct dentry *source_dentry, +const char *from_name,const char *to_name, +struct cifs_sb_info *cifs_sb);/* send create hardlink request */ int (*create_hardlink)(const unsigned int, struct cifs_tcon *, const char *, const char *,
fs/smb/client/cifsproto.h +4 -3
@@ -435,9 +435,10 @@ extern int CIFSPOSIXDelFile(const unsigned int xid, struct cifs_tcon *tcon, int remap_special_chars);extern int CIFSSMBDelFile (const unsigned int xid,struct cifs_tcon *tcon,const char *name,struct cifs_sb_info *cifs_sb); -extern int CIFSSMBRename (const unsigned int xid,struct cifs_tcon *tcon, -const char *from_name,const char *to_name, -struct cifs_sb_info *cifs_sb); +int CIFSSMBRename (const unsigned int xid,struct cifs_tcon *tcon, +struct dentry *source_dentry, +const char *from_name,const char *to_name, +struct cifs_sb_info *cifs_sb); extern int CIFSSMBRenameOpenFile(const unsigned int xid, struct cifs_tcon *tcon, int netfid, const char *target_name, const struct nls_table *nls_codepage,
fs/smb/client/cifssmb.c +4 -4
@@ -2149,10 +2149,10 @@ CIFSSMBFlush(const unsigned int xid, struct cifs_tcon *tcon, int smb_file_id)return rc; } -int -CIFSSMBRename (const unsigned int xid,struct cifs_tcon *tcon, -const char *from_name,const char *to_name, -struct cifs_sb_info *cifs_sb) +int CIFSSMBRename (const unsigned int xid,struct cifs_tcon *tcon, +struct dentry *source_dentry, +const char *from_name,const char *to_name, +struct cifs_sb_info *cifs_sb) {int rc =0 ;RENAME_REQ *pSMB =NULL ;
fs/smb/client/inode.c +2 -1
@@ -2219,7 +2219,8 @@ cifs_do_rename(const unsigned int xid, struct dentry *from_dentry,return -ENOSYS ;/* try path-based rename first */ - rc = server->ops->rename (xid, tcon, from_path, to_path, cifs_sb); + rc = server->ops->rename (xid, tcon, from_dentry, + from_path, to_path, cifs_sb);/* * Don't bother with rename by filehandle unless file is busy and
fs/smb/client/smb2inode.c +23 -15
@@ -781,11 +781,11 @@ smb2_unlink(const unsigned int xid, struct cifs_tcon *tcon, const char *name, ACL_NO_MODE, NULL, SMB2_OP_DELETE, NULL, NULL, NULL, NULL, NULL); } -static int -smb2_set_path_attr (const unsigned int xid,struct cifs_tcon *tcon, -const char *from_name,const char *to_name, -struct cifs_sb_info *cifs_sb,__u32 access,int command, -struct cifsFileInfo *cfile) +static int smb2_set_path_attr (const unsigned int xid,struct cifs_tcon *tcon, +const char *from_name,const char *to_name, +struct cifs_sb_info *cifs_sb, +__u32 create_options,__u32 access, +int command,struct cifsFileInfo *cfile) {__le16 *smb2_to_name =NULL ;int rc;
@@ -796,25 +796,33 @@ smb2_set_path_attr(const unsigned int xid, struct cifs_tcon *tcon, goto smb2_rename_path; } rc =smb2_compound_op (xid, tcon, cifs_sb, from_name, access, -FILE_OPEN ,0 ,ACL_NO_MODE , smb2_to_name, +FILE_OPEN , create_options,ACL_NO_MODE , smb2_to_name, command, cfile,NULL ,NULL ,NULL ,NULL ); smb2_rename_path:kfree (smb2_to_name);return rc; } -int -smb2_rename_path (const unsigned int xid,struct cifs_tcon *tcon, -const char *from_name,const char *to_name, -struct cifs_sb_info *cifs_sb) +int smb2_rename_path (const unsigned int xid, +struct cifs_tcon *tcon, +struct dentry *source_dentry, +const char *from_name,const char *to_name, +struct cifs_sb_info *cifs_sb) { +struct cifsInodeInfo *ci;struct cifsFileInfo *cfile; +__u32 co =0 ; +if (source_dentry) { + ci =CIFS_I (d_inode (source_dentry)); +if (ci->cifsAttrs &ATTR_REPARSE ) + co |=OPEN_REPARSE_POINT ; + }drop_cached_dir_by_name (xid, tcon, from_name, cifs_sb);cifs_get_writable_path (tcon, from_name,FIND_WR_WITH_DELETE , &cfile); -return smb2_set_path_attr (xid, tcon, from_name, to_name, - cifs_sb,DELETE ,SMB2_OP_RENAME , cfile); +return smb2_set_path_attr (xid, tcon, from_name, to_name, cifs_sb, + co,DELETE ,SMB2_OP_RENAME , cfile); }int
@@ -822,9 +830,9 @@ smb2_create_hardlink(const unsigned int xid, struct cifs_tcon *tcon, const char *from_name, const char *to_name, struct cifs_sb_info *cifs_sb) { - return smb2_set_path_attr(xid, tcon, from_name, to_name, cifs_sb, -FILE_READ_ATTRIBUTES ,SMB2_OP_HARDLINK , -NULL ); + return smb2_set_path_attr(xid, tcon, from_name, to_name, + cifs_sb, 0, FILE_READ_ATTRIBUTES, +SMB2_OP_HARDLINK ,NULL ); }int
fs/smb/client/smb2proto.h +5 -3
@@ -80,9 +80,11 @@ extern int smb2_rmdir(const unsigned int xid, struct cifs_tcon *tcon, const char *name, struct cifs_sb_info *cifs_sb);extern int smb2_unlink (const unsigned int xid,struct cifs_tcon *tcon,const char *name,struct cifs_sb_info *cifs_sb); -extern int smb2_rename_path (const unsigned int xid,struct cifs_tcon *tcon, -const char *from_name,const char *to_name, -struct cifs_sb_info *cifs_sb); +int smb2_rename_path (const unsigned int xid, +struct cifs_tcon *tcon, +struct dentry *source_dentry, +const char *from_name,const char *to_name, +struct cifs_sb_info *cifs_sb);extern int smb2_create_hardlink (const unsigned int xid,struct cifs_tcon *tcon,const char *from_name,const char *to_name,struct cifs_sb_info *cifs_sb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/353 smb: client: fix hardlinking of reparse points
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit 5408990aa662bcfd6ba894734023a023a16e8729 ]
The client was sending an SMB2_CREATE request without setting OPEN_REPARSE_POINT flag thus failing the entire hardlink operation.
Fix this by setting OPEN_REPARSE_POINT in create options for SMB2_CREATE request when the source inode is a repase point.
--- fs/smb/client/cifsglob.h | 8 +++++--- fs/smb/client/cifsproto.h | 8 +++++--- fs/smb/client/cifssmb.c | 9 +++++---- fs/smb/client/link.c | 4 ++-- fs/smb/client/smb2inode.c | 33 +++++++++++++++++++++------------ fs/smb/client/smb2proto.h | 8 +++++--- 6 files changed, 43 insertions(+), 27 deletions(-)
fs/smb/client/cifsglob.h +5 -3
@@ -405,9 +405,11 @@ struct smb_version_operations { const char *from_name, const char *to_name, struct cifs_sb_info *cifs_sb);/* send create hardlink request */ -int (*create_hardlink)(const unsigned int ,struct cifs_tcon *, -const char *,const char *, -struct cifs_sb_info *); +int (*create_hardlink)(const unsigned int xid, +struct cifs_tcon *tcon, +struct dentry *source_dentry, +const char *from_name,const char *to_name, +struct cifs_sb_info *cifs_sb);/* query symlink target */ int (*query_symlink)(const unsigned int xid, struct cifs_tcon *tcon,
fs/smb/client/cifsproto.h +5 -3
@@ -443,9 +443,11 @@ extern int CIFSSMBRenameOpenFile(const unsigned int xid, struct cifs_tcon *tcon, int netfid, const char *target_name, const struct nls_table *nls_codepage, int remap_special_chars); -extern int CIFSCreateHardLink (const unsigned int xid,struct cifs_tcon *tcon, -const char *from_name,const char *to_name, -struct cifs_sb_info *cifs_sb); +int CIFSCreateHardLink (const unsigned int xid, +struct cifs_tcon *tcon, +struct dentry *source_dentry, +const char *from_name,const char *to_name, +struct cifs_sb_info *cifs_sb); extern int CIFSUnixCreateHardLink(const unsigned int xid, struct cifs_tcon *tcon, const char *fromName, const char *toName,
fs/smb/client/cifssmb.c +5 -4
@@ -2530,10 +2530,11 @@ CIFSUnixCreateHardLink(const unsigned int xid, struct cifs_tcon *tcon,return rc; } -int -CIFSCreateHardLink (const unsigned int xid,struct cifs_tcon *tcon, -const char *from_name,const char *to_name, -struct cifs_sb_info *cifs_sb) +int CIFSCreateHardLink (const unsigned int xid, +struct cifs_tcon *tcon, +struct dentry *source_dentry, +const char *from_name,const char *to_name, +struct cifs_sb_info *cifs_sb) {int rc =0 ;NT_RENAME_REQ *pSMB =NULL ;
fs/smb/client/link.c +2 -2
@@ -510,8 +510,8 @@ cifs_hardlink(struct dentry *old_file, struct inode *inode, rc = -ENOSYS ; goto cifs_hl_exit; } - rc = server->ops->create_hardlink (xid, tcon, from_name, to_name, - cifs_sb); + rc = server->ops->create_hardlink (xid, tcon, old_file, + from_name, to_name, cifs_sb);if ((rc == -EIO ) || (rc == -EINVAL )) rc = -EOPNOTSUPP ; }
fs/smb/client/smb2inode.c +21 -12
@@ -35,6 +35,18 @@ free_set_inf_compound(struct smb_rqst *rqst)SMB2_close_free (&rqst[2 ]); } +static inline __u32 file_create_options (struct dentry *dentry) +{ +struct cifsInodeInfo *ci; + +if (dentry) { + ci =CIFS_I (d_inode (dentry)); +if (ci->cifsAttrs &ATTR_REPARSE ) +return OPEN_REPARSE_POINT ; + } +return 0 ; +} +/* * note: If cfile is passed, the reference to it is dropped here. * So make sure that you do not reuse cfile after return from this func.
@@ -809,15 +821,9 @@ int smb2_rename_path(const unsigned int xid, const char *from_name, const char *to_name, struct cifs_sb_info *cifs_sb) { - struct cifsInodeInfo *ci; struct cifsFileInfo *cfile; -__u32 co =0 ; +__u32 co =file_create_options (source_dentry); -if (source_dentry) { - ci =CIFS_I (d_inode (source_dentry)); -if (ci->cifsAttrs &ATTR_REPARSE ) - co |=OPEN_REPARSE_POINT ; - }drop_cached_dir_by_name (xid, tcon, from_name, cifs_sb);cifs_get_writable_path (tcon, from_name,FIND_WR_WITH_DELETE , &cfile);
@@ -825,13 +831,16 @@ int smb2_rename_path(const unsigned int xid, co, DELETE, SMB2_OP_RENAME, cfile); } -int -smb2_create_hardlink (const unsigned int xid,struct cifs_tcon *tcon, -const char *from_name,const char *to_name, -struct cifs_sb_info *cifs_sb) +int smb2_create_hardlink (const unsigned int xid, +struct cifs_tcon *tcon, +struct dentry *source_dentry, +const char *from_name,const char *to_name, +struct cifs_sb_info *cifs_sb) { +__u32 co =file_create_options (source_dentry); +return smb2_set_path_attr (xid, tcon, from_name, to_name, - cifs_sb,0 ,FILE_READ_ATTRIBUTES , + cifs_sb, co,FILE_READ_ATTRIBUTES ,SMB2_OP_HARDLINK ,NULL ); }
fs/smb/client/smb2proto.h +5 -3
@@ -85,9 +85,11 @@ int smb2_rename_path(const unsigned int xid,struct dentry *source_dentry, const char *from_name, const char *to_name, struct cifs_sb_info *cifs_sb); -extern int smb2_create_hardlink (const unsigned int xid,struct cifs_tcon *tcon, -const char *from_name,const char *to_name, -struct cifs_sb_info *cifs_sb); +int smb2_create_hardlink (const unsigned int xid, +struct cifs_tcon *tcon, +struct dentry *source_dentry, +const char *from_name,const char *to_name, +struct cifs_sb_info *cifs_sb);extern int smb3_create_mf_symlink (unsigned int xid,struct cifs_tcon *tcon,struct cifs_sb_info *cifs_sb,const unsigned char *path,char *pbuf,unsigned int *pbytes_written);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/353 cifs: fix in logging in cifs_chan_update_iface
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shyam Prasad N <[email protected]>
[ Upstream commit 516eea97f92f1e7271f20835cfe9e73774b0f8cc ]
Recently, cifs_chan_update_iface was modified to not remove an iface if a suitable replacement was not found. With that, there were two conditionals that were exactly the same. This change removes that extra condition check.
Also, fixed a logging in the same function to indicate the correct message.
--- fs/smb/client/sess.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
fs/smb/client/sess.c +8 -6
@@ -440,8 +440,14 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) }if (!iface) { -cifs_dbg (FYI ,"unable to get the interface matching: %pIS\n" , - &ss); +if (!chan_index) +cifs_dbg (FYI ,"unable to get the interface matching: %pIS\n" , + &ss); +else { +cifs_dbg (FYI ,"unable to find another interface to replace: %pIS\n" , + &old_iface->sockaddr); + } +spin_unlock (&ses->iface_lock);return 0 ; }
@@ -459,10 +465,6 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server) iface->weight_fulfilled++;kref_put (&old_iface->refcount, release_iface); - }else if (old_iface) { -/* if a new candidate is not found, keep things as is */ -cifs_dbg (FYI ,"could not replace iface: %pIS\n" , - &old_iface->sockaddr); }else if (!chan_index) {/* special case: update interface for primary channel */ if (iface) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/353 ecryptfs: Reject casefold directory inodes
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriel Krisman Bertazi <[email protected]>
[ Upstream commit cd72c7ef5fed44272272a105b1da22810c91be69 ]
Even though it seems to be able to resolve some names of case-insensitive directories, the lack of d_hash and d_compare means we end up with a broken state in the d_cache. Considering it was never a goal to support these two together, and we are preparing to use d_revalidate in case-insensitive filesystems, which would make the combination even more broken, reject any attempt to get a casefolded inode from ecryptfs.
--- fs/ecryptfs/inode.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/ecryptfs/inode.c +8 -0
@@ -78,6 +78,14 @@ static struct inode *__ecryptfs_get_inode(struct inode *lower_inode,if (lower_inode->i_sb !=ecryptfs_superblock_to_lower (sb))return ERR_PTR (-EXDEV ); + +/* Reject dealing with casefold directories. */ +if (IS_CASEFOLDED (lower_inode)) { +pr_err_ratelimited ("%s: Can't handle casefolded directory.\n" , + __func__); +return ERR_PTR (-EREMOTE ); + } +if (!igrab (lower_inode))return ERR_PTR (-ESTALE ); inode = iget5_locked(sb, (unsigned long)lower_inode,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/353 ext4: fix inconsistent between segment fstrim and full fstrim
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
[ Upstream commit 68da4c44b994aea797eb9821acb3a4a36015293e ]
Suppose we issue two FITRIM ioctls for ranges [0,15] and [16,31] with mininum length of trimmed range set to 8 blocks. If we have say a range of blocks 10-22 free, this range will not be trimmed because it straddles the boundary of the two FITRIM ranges and neither part is big enough. This is a bit surprising to some users that call FITRIM on smaller ranges of blocks to limit impact on the system. Also XFS trims all free space extents that overlap with the specified range so we are inconsistent among filesystems. Let's change ext4_try_to_trim_range() to consider for trimming the whole free space extent that straddles the end of specified range, not just the part of it within the range.
--- fs/ext4/mballoc.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
fs/ext4/mballoc.c +8 -3
@@ -6758,13 +6758,15 @@ static int ext4_try_to_trim_range(struct super_block *sb, __acquires(ext4_group_lock_ptr(sb, e4b->bd_group)) __releases(ext4_group_lock_ptr(sb, e4b->bd_group)) { -ext4_grpblk_t next, count, free_count; +ext4_grpblk_t next, count, free_count, last, origin_start;bool set_trimmed = false;void *bitmap; + last =ext4_last_grp_cluster (sb, e4b->bd_group); bitmap = e4b->bd_bitmap; -if (start ==0 && max >=ext4_last_grp_cluster (sb, e4b->bd_group)) +if (start ==0 && max >= last) set_trimmed = true; + origin_start = start; start =max (e4b->bd_info->bb_first_free, start); count =0 ; free_count =0 ;
@@ -6773,7 +6775,10 @@ __releases(ext4_group_lock_ptr(sb, e4b->bd_group)) start =mb_find_next_zero_bit (bitmap, max +1 , start);if (start > max)break ; - next =mb_find_next_bit (bitmap, max +1 , start); + + next =mb_find_next_bit (bitmap, last +1 , start); +if (origin_start ==0 && next >= last) + set_trimmed = true;if ((next - start) >= minblocks) {int ret =ext4_trim_extent (sb, start, next - start, e4b);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/353 ext4: unify the type of flexbg_size to unsigned int
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit 658a52344fb139f9531e7543a6e0015b630feb38 ]
The maximum value of flexbg_size is 2^31, but the maximum value of int is (2^31 - 1), so overflow may occur when the type of flexbg_size is declared as int.
For example, when uninit_mask is initialized in ext4_alloc_group_tables(), if flexbg_size == 2^31, the initialized uninit_mask is incorrect, and this may causes set_flexbg_block_bitmap() to trigger a BUG_ON().
Therefore, the flexbg_size type is declared as unsigned int to avoid overflow and memory waste.
Stable-dep-of: 5d1935ac02ca ("ext4: avoid online resizing failures due to oversized flex bg")
--- fs/ext4/resize.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
fs/ext4/resize.c +7 -6
@@ -228,7 +228,7 @@ struct ext4_new_flex_group_data {* * Returns NULL on failure otherwise address of the allocated structure. */ -static struct ext4_new_flex_group_data *alloc_flex_gd (unsigned long flexbg_size) +static struct ext4_new_flex_group_data *alloc_flex_gd (unsigned int flexbg_size) {struct ext4_new_flex_group_data *flex_gd;
@@ -283,7 +283,7 @@ static void free_flex_gd(struct ext4_new_flex_group_data *flex_gd)*/ static int ext4_alloc_group_tables (struct super_block *sb,struct ext4_new_flex_group_data *flex_gd, -int flexbg_size) +unsigned int flexbg_size) {struct ext4_new_group_data *group_data = flex_gd->groups;ext4_fsblk_t start_blk;
@@ -384,12 +384,12 @@ static int ext4_alloc_group_tables(struct super_block *sb, group = group_data[0 ].group;printk (KERN_DEBUG "EXT4-fs: adding a flex group with " -"%d groups, flexbg size is %d:\n" , flex_gd->count, +"%u groups, flexbg size is %u:\n" , flex_gd->count, flexbg_size);for (i =0 ; i < flex_gd->count; i++) { ext4_debug( - "adding %s group %u: %u blocks (%d free, %d mdata blocks)\n", + "adding %s group %u: %u blocks (%u free, %u mdata blocks)\n", ext4_bg_has_super(sb, group + i) ? "normal" : "no-super", group + i, group_data[i].blocks_count,
@@ -1606,7 +1606,7 @@ static int ext4_flex_group_add(struct super_block *sb,static int ext4_setup_next_flex_gd (struct super_block *sb,struct ext4_new_flex_group_data *flex_gd,ext4_fsblk_t n_blocks_count, -unsigned long flexbg_size) +unsigned int flexbg_size) {struct ext4_sb_info *sbi =EXT4_SB (sb);struct ext4_super_block *es = sbi->s_es;
@@ -1990,8 +1990,9 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count)ext4_fsblk_t o_blocks_count;ext4_fsblk_t n_blocks_count_retry =0 ;unsigned long last_update_time =0 ; -int err =0 , flexbg_size =1 << sbi->s_log_groups_per_flex; +int err =0 ;int meta_bg; +unsigned int flexbg_size =ext4_flex_bg_size (sbi);/* See if the device is actually as big as what was requested */ bh =ext4_sb_bread (sb, n_blocks_count -1 ,0 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/353 ext4: remove unnecessary check from alloc_flex_gd()
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit b099eb87de105cf07cad731ded6fb40b2675108b ]
In commit 967ac8af4475 ("ext4: fix potential integer overflow in alloc_flex_gd()"), an overflow check is added to alloc_flex_gd() to prevent the allocated memory from being smaller than expected due to the overflow. However, after kmalloc() is replaced with kmalloc_array() in commit 6da2ec56059c ("treewide: kmalloc() -> kmalloc_array()"), the kmalloc_array() function has an overflow check, so the above problem will not occur. Therefore, the extra check is removed.
Stable-dep-of: 5d1935ac02ca ("ext4: avoid online resizing failures due to oversized flex bg")
--- fs/ext4/resize.c | 3 --- 1 file changed, 3 deletions(-)
fs/ext4/resize.c +0 -3
@@ -236,10 +236,7 @@ static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned int flexbg_size)if (flex_gd ==NULL ) goto out3; -if (flexbg_size >=UINT_MAX /sizeof (struct ext4_new_group_data )) - goto out2; flex_gd->count = flexbg_size; - flex_gd->groups =kmalloc_array (flexbg_size,sizeof (struct ext4_new_group_data ),GFP_NOFS );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/353 ext4: avoid online resizing failures due to oversized flex bg
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit 5d1935ac02ca5aee364a449a35e2977ea84509b0 ]
When we online resize an ext4 filesystem with a oversized flexbg_size,
mkfs.ext4 -F -G 67108864 $dev -b 4096 100M
mount $dev $dir
resize2fs $dev 16G
the following WARN_ON is triggered:
==================================================================
WARNING: CPU: 0 PID: 427 at mm/page_alloc.c:4402 __alloc_pages+0x411/0x550 Modules linked in: sg(E) CPU: 0 PID: 427 Comm: resize2fs Tainted: G E 6.6.0-rc5+ #314 RIP: 0010:__alloc_pages+0x411/0x550 Call Trace: <TASK> __kmalloc_large_node+0xa2/0x200 __kmalloc+0x16e/0x290 ext4_resize_fs+0x481/0xd80 __ext4_ioctl+0x1616/0x1d90 ext4_ioctl+0x12/0x20 __x64_sys_ioctl+0xf0/0x150 do_syscall_64+0x3b/0x90 ==================================================================
This is because flexbg_size is too large and the size of the new_group_data array to be allocated exceeds MAX_ORDER. Currently, the minimum value of MAX_ORDER is 8, the minimum value of PAGE_SIZE is 4096, the corresponding maximum number of groups that can be allocated is:
(PAGE_SIZE << MAX_ORDER) / sizeof(struct ext4_new_group_data) ≈ 21845
And the value that is down-aligned to the power of 2 is 16384. Therefore, this value is defined as MAX_RESIZE_BG, and the number of groups added each time does not exceed this value during resizing, and is added multiple times to complete the online resizing. The difference is that the metadata in a flex_bg may be more dispersed.
--- fs/ext4/resize.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-)
fs/ext4/resize.c +17 -8
@@ -218,10 +218,17 @@ struct ext4_new_flex_group_data {in the flex group */ __u16 *bg_flags;/* block group flags of groups in @groups */ +ext4_group_t resize_bg;/* number of allocated +new_group_data */ ext4_group_t count;/* number of groups in @groups */ }; +/* +* Avoiding memory allocation failures due to too many groups added each time. +*/ +#define MAX_RESIZE_BG 16384 +/* * alloc_flex_gd() allocates a ext4_new_flex_group_data with size of * @flexbg_size.
@@ -236,14 +243,18 @@ static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned int flexbg_size)if (flex_gd ==NULL ) goto out3; - flex_gd->count = flexbg_size; - flex_gd->groups =kmalloc_array (flexbg_size, +if (unlikely (flexbg_size >MAX_RESIZE_BG )) + flex_gd->resize_bg =MAX_RESIZE_BG ; +else + flex_gd->resize_bg = flexbg_size; + + flex_gd->groups =kmalloc_array (flex_gd->resize_bg,sizeof (struct ext4_new_group_data ),GFP_NOFS );if (flex_gd->groups ==NULL ) goto out2; - flex_gd->bg_flags =kmalloc_array (flexbg_size,sizeof (__u16), + flex_gd->bg_flags =kmalloc_array (flex_gd->resize_bg,sizeof (__u16),GFP_NOFS );if (flex_gd->bg_flags ==NULL ) goto out1;
@@ -1602,8 +1613,7 @@ static int ext4_flex_group_add(struct super_block *sb,static int ext4_setup_next_flex_gd (struct super_block *sb,struct ext4_new_flex_group_data *flex_gd, -ext4_fsblk_t n_blocks_count, -unsigned int flexbg_size) +ext4_fsblk_t n_blocks_count) {struct ext4_sb_info *sbi =EXT4_SB (sb);struct ext4_super_block *es = sbi->s_es;
@@ -1627,7 +1637,7 @@ static int ext4_setup_next_flex_gd(struct super_block *sb,BUG_ON (last);ext4_get_group_no_and_offset (sb, n_blocks_count -1 , &n_group, &last); - last_group = group | (flexbg_size -1 ); + last_group = group | (flex_gd->resize_bg -1 );if (last_group > n_group) last_group = n_group;
@@ -2130,8 +2140,7 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count)/* Add flex groups. Note that a regular group is a * flex group with 1 group. */ -while (ext4_setup_next_flex_gd (sb, flex_gd, n_blocks_count, - flexbg_size)) { +while (ext4_setup_next_flex_gd (sb, flex_gd, n_blocks_count)) {if (time_is_before_jiffies (last_update_time +HZ *10 )) {if (last_update_time) ext4_msg(sb, KERN_INFO,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/353 wifi: rtw89: fix timeout calculation in rtw89_roc_end()
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit e416514e309f7e25e577fee45a65f246f67b2261 ]
Since 'rtw89_core_tx_kick_off_and_wait()' assumes timeout (actually RTW89_ROC_TX_TIMEOUT) in milliseconds, I suppose that RTW89_ROC_IDLE_TIMEOUT is in milliseconds as well. If so, 'msecs_to_jiffies()' should be used in a call to 'ieee80211_queue_delayed_work()' from 'rtw89_roc_end()'. Compile tested only.
--- drivers/net/wireless/realtek/rtw89/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/realtek/rtw89/core.c +1 -1
@@ -2886,7 +2886,7 @@ void rtw89_roc_end(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif)if (hw->conf.flags &IEEE80211_CONF_IDLE )ieee80211_queue_delayed_work (hw, &roc->roc_work, -RTW89_ROC_IDLE_TIMEOUT ); +msecs_to_jiffies (RTW89_ROC_IDLE_TIMEOUT )); }void rtw89_roc_work (struct work_struct *work)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/353 wifi: rt2x00: restart beacon queue when hardware reset
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shiji Yang <[email protected]>
[ Upstream commit a11d965a218f0cd95b13fe44d0bcd8a20ce134a8 ]
When a hardware reset is triggered, all registers are reset, so all queues are forced to stop in hardware interface. However, mac80211 will not automatically stop the queue. If we don't manually stop the beacon queue, the queue will be deadlocked and unable to start again. This patch fixes the issue where Apple devices cannot connect to the AP after calling ieee80211_restart_hw().
--- drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 3 +++ drivers/net/wireless/ralink/rt2x00/rt2x00mac.c | 11 +++++++++++ 2 files changed, 14 insertions(+)
drivers/net/wireless/ralink/rt2x00/rt2x00dev.c +3 -0
@@ -101,6 +101,7 @@ void rt2x00lib_disable_radio(struct rt2x00_dev *rt2x00dev)rt2x00link_stop_tuner (rt2x00dev);rt2x00queue_stop_queues (rt2x00dev);rt2x00queue_flush_queues (rt2x00dev, true); +rt2x00queue_stop_queue (rt2x00dev->bcn);/* * Disable radio.
@@ -1286,6 +1287,7 @@ int rt2x00lib_start(struct rt2x00_dev *rt2x00dev) rt2x00dev->intf_ap_count =0 ; rt2x00dev->intf_sta_count =0 ; rt2x00dev->intf_associated =0 ; + rt2x00dev->intf_beaconing =0 ;/* Enable the radio */ retval =rt2x00lib_enable_radio (rt2x00dev);
@@ -1312,6 +1314,7 @@ void rt2x00lib_stop(struct rt2x00_dev *rt2x00dev) rt2x00dev->intf_ap_count =0 ; rt2x00dev->intf_sta_count =0 ; rt2x00dev->intf_associated =0 ; + rt2x00dev->intf_beaconing =0 ; }static inline void rt2x00lib_set_if_combinations (struct rt2x00_dev *rt2x00dev)
drivers/net/wireless/ralink/rt2x00/rt2x00mac.c +11 -0
@@ -598,6 +598,17 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,*/ if (changes &BSS_CHANGED_BEACON_ENABLED ) {mutex_lock (&intf->beacon_skb_mutex); + +/* +* Clear the 'enable_beacon' flag and clear beacon because +* the beacon queue has been stopped after hardware reset. +*/ +if (test_bit (DEVICE_STATE_RESET , &rt2x00dev->flags) && + intf->enable_beacon) { + intf->enable_beacon = false; +rt2x00queue_clear_beacon (rt2x00dev, vif); + } +if (!bss_conf->enable_beacon && intf->enable_beacon) { rt2x00dev->intf_beaconing--; intf->enable_beacon = false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/353 selftests/bpf: fix RELEASE=1 build for tc_opts
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit 2b62aa59d02ed281fa4fc218df3ca91b773e1e62 ]
Compiler complains about malloc(). We also don't need to dynamically allocate anything, so make the life easier by using statically sized buffer.
--- tools/testing/selftests/bpf/prog_tests/tc_opts.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
tools/testing/selftests/bpf/prog_tests/tc_opts.c +1 -5
@@ -2387,12 +2387,9 @@ static int generate_dummy_prog(void)const size_t prog_insn_cnt =sizeof (prog_insns) /sizeof (struct bpf_insn );LIBBPF_OPTS (bpf_prog_load_opts, opts);const size_t log_buf_sz =256 ; -char *log_buf; +char log_buf[log_buf_sz];int fd =-1 ; - log_buf =malloc (log_buf_sz); -if (!ASSERT_OK_PTR (log_buf,"log_buf_alloc" )) -return fd; opts.log_buf = log_buf; opts.log_size = log_buf_sz;
@@ -2402,7 +2399,6 @@ static int generate_dummy_prog(void) prog_insns, prog_insn_cnt, &opts);ASSERT_STREQ (log_buf,"" ,"log_0" );ASSERT_GE (fd,0 ,"prog_fd" ); -free (log_buf);return fd; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/353 selftests/bpf: satisfy compiler by having explicit return in btf test
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit f4c7e887324f5776eef6e6e47a90e0ac8058a7a8 ]
Some compilers complain about get_pprint_mapv_size() not returning value in some code paths. Fix with explicit return.
--- tools/testing/selftests/bpf/prog_tests/btf.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/bpf/prog_tests/btf.c +1 -0
@@ -5265,6 +5265,7 @@ static size_t get_pprint_mapv_size(enum pprint_mapv_kind_t mapv_kind)#endif assert (0 ); +return 0 ; } static void set_pprint_mapv(enum pprint_mapv_kind_t mapv_kind,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/353 libbpf: Fix potential uninitialized tail padding with LIBBPF_OPTS_RESET
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <[email protected]>
[ Upstream commit 7f7c43693c1b46652cfafb7af67ba31726d6ec4e ]
Martin reported that there is a libbpf complaining of non-zero-value tail padding with LIBBPF_OPTS_RESET macro if struct bpf_netkit_opts is modified to have a 4-byte tail padding. This only happens to clang compiler. The commend line is: ./test_progs -t tc_netkit_multi_links Martin and I did some investigation and found this indeed the case and the following are the investigation details.
Clang:
clang version 18.0.0
<I tried clang15/16/17 and they all have similar results>
tools/lib/bpf/libbpf_common.h:
#define LIBBPF_OPTS_RESET(NAME, ...) \
do { \
memset(&NAME, 0, sizeof(NAME)); \
NAME = (typeof(NAME)) { \
.sz = sizeof(NAME), \
__VA_ARGS__ \
}; \
} while (0)#endif
tools/lib/bpf/libbpf.h:
struct bpf_netkit_opts {
/* size of this struct, for forward/backward compatibility */
size_t sz;
__u32 flags;
__u32 relative_fd;
__u32 relative_id;
__u64 expected_revision;
size_t :0; };
#define bpf_netkit_opts__last_field expected_revision
In the above struct bpf_netkit_opts, there is no tail padding.
prog_tests/tc_netkit.c:
static void serial_test_tc_netkit_multi_links_target(int mode, int target)
{
...
LIBBPF_OPTS(bpf_netkit_opts, optl);
...
LIBBPF_OPTS_RESET(optl,
.flags = BPF_F_BEFORE,
.relative_fd = bpf_program__fd(skel->progs.tc1),
);
...}
Let us make the following source change, note that we have a 4-byte tailing padding now.
# diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h # index 6cd9c501624f..0dd83910ae9a 100644 # --- a/tools/lib/bpf/libbpf.h # +++ b/tools/lib/bpf/libbpf.h # @@ -803,13 +803,13 @@ bpf_program__attach_tcx(const struct bpf_program *prog, int ifindex,
# struct bpf_netkit_opts {
# /* size of this struct, for forward/backward compatibility */
# size_t sz;
# - __u32 flags;
# __u32 relative_fd; # __u32 relative_id; # __u64 expected_revision;
# + __u32 flags;
# size_t :0;
# };
# -#define bpf_netkit_opts__last_field expected_revision # +#define bpf_netkit_opts__last_field flags
The clang 18 generated asm code looks like below:
; LIBBPF_OPTS_RESET(optl,
55e3: 48 8d 7d 98 leaq -0x68(%rbp), %rdi
55e7: 31 f6 xorl %esi, %esi
55e9: ba 20 00 00 00 movl $0x20, %edx
55ee: e8 00 00 00 00 callq 0x55f3 <serial_test_tc_netkit_multi_links_target+0x18d3>
55f3: 48 c7 85 10 fd ff ff 20 00 00 00 movq $0x20, -0x2f0(%rbp)
55fe: 48 8b 85 68 ff ff ff movq -0x98(%rbp), %rax
5605: 48 8b 78 18 movq 0x18(%rax), %rdi
5609: e8 00 00 00 00 callq 0x560e <serial_test_tc_netkit_multi_links_target+0x18ee>
560e: 89 85 18 fd ff ff movl %eax, -0x2e8(%rbp)
5614: c7 85 1c fd ff ff 00 00 00 00 movl $0x0, -0x2e4(%rbp)
561e: 48 c7 85 20 fd ff ff 00 00 00 00 movq $0x0, -0x2e0(%rbp)
5629: c7 85 28 fd ff ff 08 00 00 00 movl $0x8, -0x2d8(%rbp)
5633: 48 8b 85 10 fd ff ff movq -0x2f0(%rbp), %rax
563a: 48 89 45 98 movq %rax, -0x68(%rbp)
563e: 48 8b 85 18 fd ff ff movq -0x2e8(%rbp), %rax
5645: 48 89 45 a0 movq %rax, -0x60(%rbp)
5649: 48 8b 85 20 fd ff ff movq -0x2e0(%rbp), %rax
5650: 48 89 45 a8 movq %rax, -0x58(%rbp)
5654: 48 8b 85 28 fd ff ff movq -0x2d8(%rbp), %rax
565b: 48 89 45 b0 movq %rax, -0x50(%rbp)
; link = bpf_program__attach_netkit(skel->progs.tc2, ifindex, &optl);At -O0 level, the clang compiler creates an intermediate copy. We have below to store 'flags' with 4-byte store and leave another 4 byte in the same 8-byte-aligned storage undefined,
5629: c7 85 28 fd ff ff 08 00 00 00 movl $0x8, -0x2d8(%rbp)
and later we store 8-byte to the original zero'ed buffer
5654: 48 8b 85 28 fd ff ff movq -0x2d8(%rbp), %rax
565b: 48 89 45 b0 movq %rax, -0x50(%rbp)This caused a problem as the 4-byte value at [%rbp-0x2dc, %rbp-0x2e0) may be garbage.
gcc (gcc 11.4) does not have this issue as it does zeroing struct first before doing assignments:
; LIBBPF_OPTS_RESET(optl,
50fd: 48 8d 85 40 fc ff ff leaq -0x3c0(%rbp), %rax
5104: ba 20 00 00 00 movl $0x20, %edx
5109: be 00 00 00 00 movl $0x0, %esi
510e: 48 89 c7 movq %rax, %rdi
5111: e8 00 00 00 00 callq 0x5116 <serial_test_tc_netkit_multi_links_target+0x1522>
5116: 48 8b 45 f0 movq -0x10(%rbp), %rax
511a: 48 8b 40 18 movq 0x18(%rax), %rax
511e: 48 89 c7 movq %rax, %rdi
5121: e8 00 00 00 00 callq 0x5126 <serial_test_tc_netkit_multi_links_target+0x1532>
5126: 48 c7 85 40 fc ff ff 00 00 00 00 movq $0x0, -0x3c0(%rbp)
5131: 48 c7 85 48 fc ff ff 00 00 00 00 movq $0x0, -0x3b8(%rbp)
513c: 48 c7 85 50 fc ff ff 00 00 00 00 movq $0x0, -0x3b0(%rbp)
5147: 48 c7 85 58 fc ff ff 00 00 00 00 movq $0x0, -0x3a8(%rbp)
5152: 48 c7 85 40 fc ff ff 20 00 00 00 movq $0x20, -0x3c0(%rbp)
515d: 89 85 48 fc ff ff movl %eax, -0x3b8(%rbp)
5163: c7 85 58 fc ff ff 08 00 00 00 movl $0x8, -0x3a8(%rbp) ; link = bpf_program__attach_netkit(skel->progs.tc2, ifindex, &optl);
It is not clear how to resolve the compiler code generation as the compiler generates correct code w.r.t. how to handle unnamed padding in C standard. So this patch changed LIBBPF_OPTS_RESET macro to avoid uninitialized tail padding. We already knows LIBBPF_OPTS macro works on both gcc and clang, even with tail padding. So LIBBPF_OPTS_RESET is changed to be a LIBBPF_OPTS followed by a memcpy(), thus avoiding uninitialized tail padding.
The below is asm code generated with this patch and with clang compiler:
; LIBBPF_OPTS_RESET(optl,
55e3: 48 8d bd 10 fd ff ff leaq -0x2f0(%rbp), %rdi
55ea: 31 f6 xorl %esi, %esi
55ec: ba 20 00 00 00 movl $0x20, %edx
55f1: e8 00 00 00 00 callq 0x55f6 <serial_test_tc_netkit_multi_links_target+0x18d6>
55f6: 48 c7 85 10 fd ff ff 20 00 00 00 movq $0x20, -0x2f0(%rbp)
5601: 48 8b 85 68 ff ff ff movq -0x98(%rbp), %rax
5608: 48 8b 78 18 movq 0x18(%rax), %rdi
560c: e8 00 00 00 00 callq 0x5611 <serial_test_tc_netkit_multi_links_target+0x18f1>
5611: 89 85 18 fd ff ff movl %eax, -0x2e8(%rbp)
5617: c7 85 1c fd ff ff 00 00 00 00 movl $0x0, -0x2e4(%rbp)
5621: 48 c7 85 20 fd ff ff 00 00 00 00 movq $0x0, -0x2e0(%rbp)
562c: c7 85 28 fd ff ff 08 00 00 00 movl $0x8, -0x2d8(%rbp)
5636: 48 8b 85 10 fd ff ff movq -0x2f0(%rbp), %rax
563d: 48 89 45 98 movq %rax, -0x68(%rbp)
5641: 48 8b 85 18 fd ff ff movq -0x2e8(%rbp), %rax
5648: 48 89 45 a0 movq %rax, -0x60(%rbp)
564c: 48 8b 85 20 fd ff ff movq -0x2e0(%rbp), %rax
5653: 48 89 45 a8 movq %rax, -0x58(%rbp)
5657: 48 8b 85 28 fd ff ff movq -0x2d8(%rbp), %rax
565e: 48 89 45 b0 movq %rax, -0x50(%rbp)
; link = bpf_program__attach_netkit(skel->progs.tc2, ifindex, &optl);In the above code, a temporary buffer is zeroed and then has proper value assigned. Finally, values in temporary buffer are copied to the original variable buffer, hence tail padding is guaranteed to be 0.
--- tools/lib/bpf/libbpf_common.h | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
tools/lib/bpf/libbpf_common.h +8 -5
@@ -79,11 +79,14 @@*/ #define LIBBPF_OPTS_RESET (NAME , ...) \ do { \ - memset(&NAME, 0, sizeof(NAME)); \ - NAME = (typeof(NAME)) { \ - .sz = sizeof(NAME), \ - __VA_ARGS__ \ - }; \ + typeof(NAME) ___##NAME = ({ \ + memset(&___##NAME, 0, sizeof(NAME)); \ + (typeof(NAME)) { \ + .sz = sizeof(NAME), \ + __VA_ARGS__ \ + }; \ + }); \ + memcpy(&NAME, &___##NAME, sizeof(NAME)); \ } while (0)#endif /* __LIBBPF_LIBBPF_COMMON_H */
Greg Kroah-Hartman
maintainerPATCH 68/353 selftests/bpf: Fix pyperf180 compilation failure with clang18
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <[email protected]>
[ Upstream commit 100888fb6d8a185866b1520031ee7e3182b173de ]
With latest clang18 (main branch of llvm-project repo), when building bpf selftests,
[~/work/bpf-next (master)]$ make -C tools/testing/selftests/bpf LLVM=1 -j
The following compilation error happens:
fatal error: error in backend: Branch target out of insn range
...
Stack dump:
0. Program arguments: clang -g -Wall -Werror -D__TARGET_ARCH_x86 -mlittle-endian
-I/home/yhs/work/bpf-next/tools/testing/selftests/bpf/tools/include -I/home/yhs/work/bpf-next/tools/testing/selftests/bpf -I/home/yhs/work/bpf-next/tools/include/uapi -I/home/yhs/work/bpf-next/tools/testing/selftests/usr/include -idirafter /home/yhs/work/llvm-project/llvm/build.18/install/lib/clang/18/include -idirafter /usr/local/include -idirafter /usr/include -Wno-compare-distinct-pointer-types -DENABLE_ATOMICS_TESTS -O2 --target=bpf -c progs/pyperf180.c -mcpu=v3 -o /home/yhs/work/bpf-next/tools/testing/selftests/bpf/pyperf180.bpf.o
1. <eof> parser at end of file
2. Code generation
...
The compilation failure only happens to cpu=v2 and cpu=v3. cpu=v4 is okay since cpu=v4 supports 32-bit branch target offset.
The above failure is due to upstream llvm patch [1] where some inlining behavior are changed in clang18.
To workaround the issue, previously all 180 loop iterations are fully unrolled. The bpf macro __BPF_CPU_VERSION__ (implemented in clang18 recently) is used to avoid unrolling changes if cpu=v4. If __BPF_CPU_VERSION__ is not available and the compiler is clang18, the unrollng amount is unconditionally reduced.
[1] https://github.com/llvm/llvm-project/commit/1a2e77cf9e11dbf56b5720c607313a566eebb16e
--- tools/testing/selftests/bpf/progs/pyperf180.c | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+)
tools/testing/selftests/bpf/progs/pyperf180.c +22 -0
@@ -1,4 +1,26 @@// SPDX-License-Identifier: GPL-2.0 // Copyright (c) 2019 Facebook #define STACK_MAX_LEN 180 + +/* llvm upstream commit at clang18 +* https://github.com/llvm/llvm-project/commit/1a2e77cf9e11dbf56b5720c607313a566eebb16e +* changed inlining behavior and caused compilation failure as some branch +* target distance exceeded 16bit representation which is the maximum for +* cpu v1/v2/v3. Macro __BPF_CPU_VERSION__ is later implemented in clang18 +* to specify which cpu version is used for compilation. So a smaller +* unroll_count can be set if __BPF_CPU_VERSION__ is less than 4, which +* reduced some branch target distances and resolved the compilation failure. +* +* To capture the case where a developer/ci uses clang18 but the corresponding +* repo checkpoint does not have __BPF_CPU_VERSION__, a smaller unroll_count +* will be set as well to prevent potential compilation failures. +*/ +#ifdef __BPF_CPU_VERSION__ +#if __BPF_CPU_VERSION__ <4 +#define UNROLL_COUNT 90 +#endif +#elif __clang_major__ ==18 +#define UNROLL_COUNT 90 +#endif +#include "pyperf.h"
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/353 wifi: rt2x00: correct wrong BBP register in RxDCOC calibration
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shiji Yang <[email protected]>
[ Upstream commit 50da74e1e8b682853d1e07fc8bbe3a0774ae5e09 ]
Refer to Mediatek vendor driver RxDCOC_Calibration() function, when performing gainfreeze calibration, we should write register 140 instead of 141. This fix can reduce the total calibration time from 6 seconds to 1 second.
--- drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ralink/rt2x00/rt2800lib.c +1 -1
@@ -8659,7 +8659,7 @@ static void rt2800_rxdcoc_calibration(struct rt2x00_dev *rt2x00dev)rt2800_rfcsr_write_bank (rt2x00dev,5 ,4 , saverfb5r4);rt2800_rfcsr_write_bank (rt2x00dev,7 ,4 , saverfb7r4); -rt2800_bbp_write (rt2x00dev,158 ,141 ); +rt2800_bbp_write (rt2x00dev,158 ,140 ); bbpreg =rt2800_bbp_read (rt2x00dev,159 ); bbpreg = bbpreg & (~0x40 );rt2800_bbp_write (rt2x00dev,159 , bbpreg);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/353 selftests/bpf: Fix issues in setup_classid_environment()
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yafang Shao <[email protected]>
[ Upstream commit 4849775587844e44d215289c425bcd70f315efe7 ]
If the net_cls subsystem is already mounted, attempting to mount it again in setup_classid_environment() will result in a failure with the error code EBUSY. Despite this, tmpfs will have been successfully mounted at /sys/fs/cgroup/net_cls. Consequently, the /sys/fs/cgroup/net_cls directory will be empty, causing subsequent setup operations to fail.
Here's an error log excerpt illustrating the issue when net_cls has already been mounted at /sys/fs/cgroup/net_cls prior to running setup_classid_environment():
- Before that change
$ tools/testing/selftests/bpf/test_progs --name=cgroup_v1v2 test_cgroup_v1v2:PASS:server_fd 0 nsec test_cgroup_v1v2:PASS:client_fd 0 nsec test_cgroup_v1v2:PASS:cgroup_fd 0 nsec test_cgroup_v1v2:PASS:server_fd 0 nsec run_test:PASS:skel_open 0 nsec run_test:PASS:prog_attach 0 nsec test_cgroup_v1v2:PASS:cgroup-v2-only 0 nsec (cgroup_helpers.c:248: errno: No such file or directory) Opening Cgroup Procs: /sys/fs/cgroup/net_cls/cgroup.procs (cgroup_helpers.c:540: errno: No such file or directory) Opening cgroup classid: /sys/fs/cgroup/net_cls/cgroup-test-work-dir/net_cls.classid run_test:PASS:skel_open 0 nsec run_test:PASS:prog_attach 0 nsec (cgroup_helpers.c:248: errno: No such file or directory) Opening Cgroup Procs: /sys/fs/cgroup/net_cls/cgroup-test-work-dir/cgroup.procs run_test:FAIL:join_classid unexpected error: 1 (errno 2) test_cgroup_v1v2:FAIL:cgroup-v1v2 unexpected error: -1 (errno 2) (cgroup_helpers.c:248: errno: No such file or directory) Opening Cgroup Procs: /sys/fs/cgroup/net_cls/cgroup.procs #44 cgroup_v1v2:FAIL Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED
- After that change
$ tools/testing/selftests/bpf/test_progs --name=cgroup_v1v2 #44 cgroup_v1v2:OK Summary: 1/0 PASSED, 0 SKIPPED, 0 FAILED
--- tools/testing/selftests/bpf/cgroup_helpers.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
tools/testing/selftests/bpf/cgroup_helpers.c +14 -4
@@ -523,10 +523,20 @@ int setup_classid_environment(void)return 1 ; } -if (mount ("net_cls" ,NETCLS_MOUNT_PATH ,"cgroup" ,0 ,"net_cls" ) && - errno !=EBUSY ) { -log_err ("mount cgroup net_cls" ); -return 1 ; +if (mount ("net_cls" ,NETCLS_MOUNT_PATH ,"cgroup" ,0 ,"net_cls" )) { +if (errno !=EBUSY ) { +log_err ("mount cgroup net_cls" ); +return 1 ; + } + +if (rmdir (NETCLS_MOUNT_PATH )) { +log_err ("rmdir cgroup net_cls" ); +return 1 ; + } +if (umount (CGROUP_MOUNT_DFLT )) { +log_err ("umount cgroup base" ); +return 1 ; + } }cleanup_classid_environment ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/353 ARM: dts: qcom: strip prefix from PMIC files
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 455a4c46e023ab84263eae0fc7acca9a5ee8b7ac ]
As the vendor DTS files were moved to per-vendor subdirs, there no need to use common prefixes. Drop the `qcom-' prefix from PMIC dtsi file. This makes 32-bit qcom/ dts files closer to arm64 ones.
---
arch/arm/boot/dts/qcom/{qcom-pm8226.dtsi => pm8226.dtsi} | 0
arch/arm/boot/dts/qcom/{qcom-pm8841.dtsi => pm8841.dtsi} | 0
arch/arm/boot/dts/qcom/{qcom-pm8941.dtsi => pm8941.dtsi} | 0
arch/arm/boot/dts/qcom/{qcom-pma8084.dtsi => pma8084.dtsi} | 0
arch/arm/boot/dts/qcom/{qcom-pmx55.dtsi => pmx55.dtsi} | 0
arch/arm/boot/dts/qcom/{qcom-pmx65.dtsi => pmx65.dtsi} | 0
arch/arm/boot/dts/qcom/qcom-apq8026-asus-sparrow.dts | 2 +-
arch/arm/boot/dts/qcom/qcom-apq8026-huawei-sturgeon.dts | 2 +-
arch/arm/boot/dts/qcom/qcom-apq8026-lg-lenok.dts | 2 +-
arch/arm/boot/dts/qcom/qcom-apq8026-samsung-matisse-wifi.dts | 2 +-
arch/arm/boot/dts/qcom/qcom-apq8074-dragonboard.dts | 4 ++--
arch/arm/boot/dts/qcom/qcom-apq8084-ifc6540.dts | 2 +-
arch/arm/boot/dts/qcom/qcom-apq8084-mtp.dts | 2 +-
arch/arm/boot/dts/qcom/qcom-msm8974-lge-nexus5-hammerhead.dts | 4 ++--
arch/arm/boot/dts/qcom/qcom-msm8974-sony-xperia-rhine.dtsi | 4 ++--
arch/arm/boot/dts/qcom/qcom-msm8974pro-fairphone-fp2.dts | 4 ++--
arch/arm/boot/dts/qcom/qcom-msm8974pro-oneplus-bacon.dts | 4 ++--
arch/arm/boot/dts/qcom/qcom-msm8974pro-samsung-klte.dts | 2 +-
.../dts/qcom/qcom-msm8974pro-sony-xperia-shinano-castor.dts | 4 ++--
arch/arm/boot/dts/qcom/qcom-sdx55-mtp.dts | 2 +-
arch/arm/boot/dts/qcom/qcom-sdx55-t55.dts | 2 +-
arch/arm/boot/dts/qcom/qcom-sdx55-telit-fn980-tlb.dts | 2 +-
arch/arm/boot/dts/qcom/qcom-sdx65-mtp.dts | 2 +-
23 files changed, 23 insertions(+), 23 deletions(-)
rename arch/arm/boot/dts/qcom/{qcom-pm8226.dtsi => pm8226.dtsi} (100%)
rename arch/arm/boot/dts/qcom/{qcom-pm8841.dtsi => pm8841.dtsi} (100%)
rename arch/arm/boot/dts/qcom/{qcom-pm8941.dtsi => pm8941.dtsi} (100%)
rename arch/arm/boot/dts/qcom/{qcom-pma8084.dtsi => pma8084.dtsi} (100%)
rename arch/arm/boot/dts/qcom/{qcom-pmx55.dtsi => pmx55.dtsi} (100%)
rename arch/arm/boot/dts/qcom/{qcom-pmx65.dtsi => pmx65.dtsi} (100%)arch/arm/boot/dts/qcom/pm8226.dtsi renamed from arch/arm/boot/dts/qcom/qcom-pm8226.dtsi +0 -0
arch/arm/boot/dts/qcom/pm8841.dtsi renamed from arch/arm/boot/dts/qcom/qcom-pm8841.dtsi +0 -0
arch/arm/boot/dts/qcom/pm8941.dtsi renamed from arch/arm/boot/dts/qcom/qcom-pm8941.dtsi +0 -0
arch/arm/boot/dts/qcom/pma8084.dtsi renamed from arch/arm/boot/dts/qcom/qcom-pma8084.dtsi +0 -0
arch/arm/boot/dts/qcom/pmx55.dtsi renamed from arch/arm/boot/dts/qcom/qcom-pmx55.dtsi +0 -0
arch/arm/boot/dts/qcom/pmx65.dtsi renamed from arch/arm/boot/dts/qcom/qcom-pmx65.dtsi +0 -0
arch/arm/boot/dts/qcom/qcom-apq8026-asus-sparrow.dts +1 -1
@@ -6,7 +6,7 @@ /dts-v1/; #include "qcom-msm8226.dtsi" -#include "qcom-pm8226.dtsi" +#include "pm8226.dtsi" /delete-node/ &adsp_region;
arch/arm/boot/dts/qcom/qcom-apq8026-huawei-sturgeon.dts +1 -1
@@ -6,7 +6,7 @@ /dts-v1/; #include "qcom-msm8226.dtsi" -#include "qcom-pm8226.dtsi" +#include "pm8226.dtsi" #include <dt-bindings/input/ti-drv260x.h> /delete-node/ &adsp_region;
arch/arm/boot/dts/qcom/qcom-apq8026-lg-lenok.dts +1 -1
@@ -6,7 +6,7 @@ /dts-v1/; #include "qcom-msm8226.dtsi" -#include "qcom-pm8226.dtsi" +#include "pm8226.dtsi" /delete-node/ &adsp_region;
arch/arm/boot/dts/qcom/qcom-apq8026-samsung-matisse-wifi.dts +1 -1
@@ -7,7 +7,7 @@ #include <dt-bindings/input/input.h> #include "qcom-msm8226.dtsi" -#include "qcom-pm8226.dtsi" +#include "pm8226.dtsi" /delete-node/ &adsp_region; /delete-node/ &smem_region;
arch/arm/boot/dts/qcom/qcom-apq8074-dragonboard.dts +2 -2
@@ -4,8 +4,8 @@ #include <dt-bindings/leds/common.h> #include <dt-bindings/pinctrl/qcom,pmic-gpio.h> #include "qcom-msm8974.dtsi" -#include "qcom-pm8841.dtsi" -#include "qcom-pm8941.dtsi" +#include "pm8841.dtsi" +#include "pm8941.dtsi" /delete-node/ &mpss_region;
arch/arm/boot/dts/qcom/qcom-apq8084-ifc6540.dts +1 -1
@@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0 #include "qcom-apq8084.dtsi" -#include "qcom-pma8084.dtsi" +#include "pma8084.dtsi" / { model = "Qualcomm APQ8084/IFC6540";
arch/arm/boot/dts/qcom/qcom-apq8084-mtp.dts +1 -1
@@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0 #include "qcom-apq8084.dtsi" -#include "qcom-pma8084.dtsi" +#include "pma8084.dtsi" / { model = "Qualcomm APQ 8084-MTP";
arch/arm/boot/dts/qcom/qcom-msm8974-lge-nexus5-hammerhead.dts +2 -2
@@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0 #include "qcom-msm8974.dtsi" -#include "qcom-pm8841.dtsi" -#include "qcom-pm8941.dtsi" +#include "pm8841.dtsi" +#include "pm8941.dtsi" #include <dt-bindings/input/input.h> #include <dt-bindings/leds/common.h> #include <dt-bindings/pinctrl/qcom,pmic-gpio.h>
arch/arm/boot/dts/qcom/qcom-msm8974-sony-xperia-rhine.dtsi +2 -2
@@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0 #include "qcom-msm8974.dtsi" -#include "qcom-pm8841.dtsi" -#include "qcom-pm8941.dtsi" +#include "pm8841.dtsi" +#include "pm8941.dtsi" #include <dt-bindings/input/input.h> #include <dt-bindings/leds/common.h> #include <dt-bindings/pinctrl/qcom,pmic-gpio.h>
arch/arm/boot/dts/qcom/qcom-msm8974pro-fairphone-fp2.dts +2 -2
@@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0 #include "qcom-msm8974pro.dtsi" -#include "qcom-pm8841.dtsi" -#include "qcom-pm8941.dtsi" +#include "pm8841.dtsi" +#include "pm8941.dtsi" #include <dt-bindings/input/input.h> #include <dt-bindings/leds/common.h> #include <dt-bindings/pinctrl/qcom,pmic-gpio.h>
arch/arm/boot/dts/qcom/qcom-msm8974pro-oneplus-bacon.dts +2 -2
@@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0 #include "qcom-msm8974pro.dtsi" -#include "qcom-pm8841.dtsi" -#include "qcom-pm8941.dtsi" +#include "pm8841.dtsi" +#include "pm8941.dtsi" #include <dt-bindings/input/input.h> #include <dt-bindings/pinctrl/qcom,pmic-gpio.h>
arch/arm/boot/dts/qcom/qcom-msm8974pro-samsung-klte.dts +1 -1
@@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0 #include "qcom-msm8974pro.dtsi" -#include "qcom-pma8084.dtsi" +#include "pma8084.dtsi" #include <dt-bindings/input/input.h> #include <dt-bindings/pinctrl/qcom,pmic-gpio.h> #include <dt-bindings/leds/common.h>
arch/arm/boot/dts/qcom/qcom-msm8974pro-sony-xperia-shinano-castor.dts +2 -2
@@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0 #include "qcom-msm8974pro.dtsi" -#include "qcom-pm8841.dtsi" -#include "qcom-pm8941.dtsi" +#include "pm8841.dtsi" +#include "pm8941.dtsi" #include <dt-bindings/input/input.h> #include <dt-bindings/leds/common.h> #include <dt-bindings/pinctrl/qcom,pmic-gpio.h>
arch/arm/boot/dts/qcom/qcom-sdx55-mtp.dts +1 -1
@@ -9,7 +9,7 @@ #include "qcom-sdx55.dtsi" #include <dt-bindings/regulator/qcom,rpmh-regulator.h> #include <arm64/qcom/pm8150b.dtsi> -#include "qcom-pmx55.dtsi" +#include "pmx55.dtsi" / { model = "Qualcomm Technologies, Inc. SDX55 MTP";
arch/arm/boot/dts/qcom/qcom-sdx55-t55.dts +1 -1
@@ -8,7 +8,7 @@ #include <dt-bindings/gpio/gpio.h> #include <dt-bindings/regulator/qcom,rpmh-regulator.h> #include "qcom-sdx55.dtsi" -#include "qcom-pmx55.dtsi" +#include "pmx55.dtsi" / { model = "Thundercomm T55 Development Kit";
arch/arm/boot/dts/qcom/qcom-sdx55-telit-fn980-tlb.dts +1 -1
@@ -8,7 +8,7 @@ #include <dt-bindings/gpio/gpio.h> #include <dt-bindings/regulator/qcom,rpmh-regulator.h> #include "qcom-sdx55.dtsi" -#include "qcom-pmx55.dtsi" +#include "pmx55.dtsi" / { model = "Telit FN980 TLB";
arch/arm/boot/dts/qcom/qcom-sdx65-mtp.dts +1 -1
@@ -12,7 +12,7 @@ #include <dt-bindings/regulator/qcom,rpmh-regulator.h> #include <arm64/qcom/pmk8350.dtsi> #include <arm64/qcom/pm7250b.dtsi> -#include "qcom-pmx65.dtsi" +#include "pmx65.dtsi" / { model = "Qualcomm Technologies, Inc. SDX65 MTP";
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/353 ARM: dts: qcom: mdm9615: fix PMIC node labels
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 0e4688cd4ee6efbeae2b31f75e16961fd7f72735 ]
Change PM8018 node labels to start with pm8018_ prefix, following other Qualcomm PMIC device nodes.
--- arch/arm/boot/dts/qcom/qcom-mdm9615-wp8548.dtsi | 2 +- arch/arm/boot/dts/qcom/qcom-mdm9615.dtsi | 14 +++++++------- 2 files changed, 8 insertions(+), 8 deletions(-)
arch/arm/boot/dts/qcom/qcom-mdm9615-wp8548.dtsi +1 -1
@@ -76,7 +76,7 @@ }; }; -&pmicgpio { +&pm8018_gpio { usb_vbus_5v_pins: usb-vbus-5v-state { pins = "gpio4"; function = "normal";
arch/arm/boot/dts/qcom/qcom-mdm9615.dtsi +7 -7
@@ -261,7 +261,7 @@ reg = <0x500000 0x1000>; qcom,controller-type = "pmic-arbiter"; - pmicintc: pmic { + pm8018: pmic { compatible = "qcom,pm8018", "qcom,pm8921"; interrupts = <GIC_PPI 226 IRQ_TYPE_LEVEL_HIGH>; #interrupt-cells = <2>;
@@ -272,38 +272,38 @@ pwrkey@1c { compatible = "qcom,pm8018-pwrkey", "qcom,pm8921-pwrkey"; reg = <0x1c>; - interrupt-parent = <&pmicintc>; + interrupt-parent = <&pm8018>; interrupts = <50 IRQ_TYPE_EDGE_RISING>, <51 IRQ_TYPE_EDGE_RISING>; debounce = <15625>; pull-up; }; - pmicmpp: mpps@50 { + pm8018_mpps: mpps@50 { compatible = "qcom,pm8018-mpp", "qcom,ssbi-mpp"; interrupt-controller; #interrupt-cells = <2>; reg = <0x50>; gpio-controller; #gpio-cells = <2>; - gpio-ranges = <&pmicmpp 0 0 6>; + gpio-ranges = <&pm8018_mpps 0 0 6>; }; rtc@11d { compatible = "qcom,pm8018-rtc", "qcom,pm8921-rtc"; - interrupt-parent = <&pmicintc>; + interrupt-parent = <&pm8018>; interrupts = <39 IRQ_TYPE_EDGE_RISING>; reg = <0x11d>; allow-set-time; }; - pmicgpio: gpio@150 { + pm8018_gpio: gpio@150 { compatible = "qcom,pm8018-gpio", "qcom,ssbi-gpio"; reg = <0x150>; interrupt-controller; #interrupt-cells = <2>; gpio-controller; - gpio-ranges = <&pmicgpio 0 0 6>; + gpio-ranges = <&pm8018_gpio 0 0 6>; #gpio-cells = <2>; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/353 ARM: dts: qcom: msm8660: fix PMIC node labels
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit c6d86aa8a12194d1c9c2f9108910a46c8a3ddc90 ]
Change PM8058 node labels to start with pm8058_ prefix, following other Qualcomm PMIC device nodes.
--- .../boot/dts/qcom/qcom-apq8060-dragonboard.dts | 4 ++-- arch/arm/boot/dts/qcom/qcom-msm8660.dtsi | 16 ++++++++-------- 2 files changed, 10 insertions(+), 10 deletions(-)
arch/arm/boot/dts/qcom/qcom-apq8060-dragonboard.dts +2 -2
@@ -71,7 +71,7 @@ /* Trig on both edges - getting close or far away */ interrupts-extended = <&pm8058_gpio 34 IRQ_TYPE_EDGE_BOTH>; /* MPP05 analog input to the XOADC */ - io-channels = <&xoadc 0x00 0x05>; + io-channels = <&pm8058_xoadc 0x00 0x05>; io-channel-names = "aout"; pinctrl-names = "default"; pinctrl-0 = <&dragon_cm3605_gpios>, <&dragon_cm3605_mpps>;
@@ -944,7 +944,7 @@ }; }; -&xoadc { +&pm8058_xoadc { /* Reference voltage 2.2 V */ xoadc-ref-supply = <&pm8058_l18>;
arch/arm/boot/dts/qcom/qcom-msm8660.dtsi +8 -8
@@ -80,13 +80,13 @@ */ iio-hwmon { compatible = "iio-hwmon"; - io-channels = <&xoadc 0x00 0x01>, /* Battery */ - <&xoadc 0x00 0x02>, /* DC in (charger) */ - <&xoadc 0x00 0x04>, /* VPH the main system voltage */ - <&xoadc 0x00 0x0b>, /* Die temperature */ - <&xoadc 0x00 0x0c>, /* Reference voltage 1.25V */ - <&xoadc 0x00 0x0d>, /* Reference voltage 0.625V */ - <&xoadc 0x00 0x0e>; /* Reference voltage 0.325V */ + io-channels = <&pm8058_xoadc 0x00 0x01>, /* Battery */ + <&pm8058_xoadc 0x00 0x02>, /* DC in (charger) */ + <&pm8058_xoadc 0x00 0x04>, /* VPH the main system voltage */ + <&pm8058_xoadc 0x00 0x0b>, /* Die temperature */ + <&pm8058_xoadc 0x00 0x0c>, /* Reference voltage 1.25V */ + <&pm8058_xoadc 0x00 0x0d>, /* Reference voltage 0.625V */ + <&pm8058_xoadc 0x00 0x0e>; /* Reference voltage 0.325V */ }; soc: soc {
@@ -390,7 +390,7 @@ row-hold = <91500>; }; - xoadc: xoadc@197 { + pm8058_xoadc: xoadc@197 { compatible = "qcom,pm8058-adc"; reg = <0x197>; interrupts-extended = <&pm8058 76 IRQ_TYPE_EDGE_RISING>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/353 ARM: dts: qcom: msm8960: fix PMIC node labels
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit a10a09f34eb80b83ca7275e23bf982dae2aa7632 ]
Change PM8921 node labels to start with pm8921_ prefix, following other Qualcomm PMIC device nodes.
--- arch/arm/boot/dts/qcom/qcom-msm8960.dtsi | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm/boot/dts/qcom/qcom-msm8960.dtsi +4 -4
@@ -264,7 +264,7 @@ reg = <0x500000 0x1000>; qcom,controller-type = "pmic-arbiter"; - pmicintc: pmic { + pm8921: pmic { compatible = "qcom,pm8921"; interrupt-parent = <&msmgpio>; interrupts = <104 IRQ_TYPE_LEVEL_LOW>;
@@ -276,7 +276,7 @@ pwrkey@1c { compatible = "qcom,pm8921-pwrkey"; reg = <0x1c>; - interrupt-parent = <&pmicintc>; + interrupt-parent = <&pm8921>; interrupts = <50 IRQ_TYPE_EDGE_RISING>, <51 IRQ_TYPE_EDGE_RISING>; debounce = <15625>;
@@ -286,7 +286,7 @@ keypad@148 { compatible = "qcom,pm8921-keypad"; reg = <0x148>; - interrupt-parent = <&pmicintc>; + interrupt-parent = <&pm8921>; interrupts = <74 IRQ_TYPE_EDGE_RISING>, <75 IRQ_TYPE_EDGE_RISING>; debounce = <15>;
@@ -296,7 +296,7 @@ rtc@11d { compatible = "qcom,pm8921-rtc"; - interrupt-parent = <&pmicintc>; + interrupt-parent = <&pm8921>; interrupts = <39 IRQ_TYPE_EDGE_RISING>; reg = <0x11d>; allow-set-time;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/353 soc: xilinx: Fix for call trace due to the usage of smp_processor_id()
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: HariBabu Gattem <[email protected]>
[ Upstream commit daed80ed07580e5adc0e6d8bc79933a35154135a ]
When preemption is enabled in kernel and if any task which can be preempted should not use smp_processor_id() directly, since CPU switch can happen at any time, the previous value of cpu_id differs with current cpu_id. As a result we see the below call trace during xlnx_event_manager_probe.
[ 6.140197] dump_backtrace+0x0/0x190 [ 6.143884] show_stack+0x18/0x40 [ 6.147220] dump_stack_lvl+0x7c/0xa0 [ 6.150907] dump_stack+0x18/0x34 [ 6.154241] check_preemption_disabled+0x124/0x134 [ 6.159068] debug_smp_processor_id+0x20/0x2c [ 6.163453] xlnx_event_manager_probe+0x48/0x250
To protect cpu_id, It is recommended to use get_cpu()/put_cpu() to disable preemption, get the cpu_id and enable preemption respectively. (For Reference, Documentation/locking/preempt-locking.rst and Documentation/kernel-hacking/hacking.rst)
Use preempt_disable()/smp_processor_id()/preempt_enable() API's to achieve the same.
--- drivers/soc/xilinx/xlnx_event_manager.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/soc/xilinx/xlnx_event_manager.c +4 -1
@@ -555,7 +555,7 @@ static void xlnx_disable_percpu_irq(void *data)static int xlnx_event_init_sgi (struct platform_device *pdev) {int ret =0 ; -int cpu =smp_processor_id (); +int cpu;/* * IRQ related structures are used for the following: * for each SGI interrupt ensure its mapped by GIC IRQ domain
@@ -592,9 +592,12 @@ static int xlnx_event_init_sgi(struct platform_device *pdev) sgi_fwspec.param[0 ] = sgi_num; virq_sgi =irq_create_fwspec_mapping (&sgi_fwspec); + cpu =get_cpu ();per_cpu (cpu_number1, cpu) = cpu; ret =request_percpu_irq (virq_sgi, xlnx_event_handler,"xlnx_event_mgmt" , &cpu_number1); +put_cpu (); +WARN_ON (ret);if (ret) {irq_dispose_mapping (virq_sgi);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/353 soc: xilinx: fix unhandled SGI warning message
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tanmay Shah <[email protected]>
[ Upstream commit 9c6724abf969251af53cdae525ad8100ec78d3c2 ]
Xen broadcasts SGI to each VM when multiple VMs run on Xen hypervisor. In such case spurious SGI is expected if one event is registered by one VM and not registered by another VM. We let users know that Unhandled SGI is not error and expected if kernel is running on Xen hypervisor.
--- drivers/soc/xilinx/xlnx_event_manager.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/xilinx/xlnx_event_manager.c +1 -1
@@ -477,7 +477,7 @@ static void xlnx_call_notify_cb_handler(const u32 *payload) } }if (!is_callback_found) -pr_warn ("Didn't find any registered callback for 0x%x 0x%x\n" , +pr_warn ("Unhandled SGI node 0x%x event 0x%x. Expected with Xen hypervisor\n" , payload[1 ], payload[2 ]); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/353 scsi: lpfc: Fix possible file string name overflow when updating firmware
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit f5779b529240b715f0e358489ad0ed933bf77c97 ]
Because file_name and phba->ModelName are both declared a size 80 bytes, the extra ".grp" file extension could cause an overflow into file_name.
Define a ELX_FW_NAME_SIZE macro with value 84. 84 incorporates the 4 extra characters from ".grp". file_name is changed to be declared as a char and initialized to zeros i.e. null chars.
--- drivers/scsi/lpfc/lpfc.h | 1 + drivers/scsi/lpfc/lpfc_init.c | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-)
drivers/scsi/lpfc/lpfc.h +1 -0
@@ -33,6 +33,7 @@struct lpfc_sli2_slim ;#define ELX_MODEL_NAME_SIZE 80 +#define ELX_FW_NAME_SIZE 84#define LPFC_PCI_DEV_LP 0x1#define LPFC_PCI_DEV_OC 0x2
drivers/scsi/lpfc/lpfc_init.c +2 -2
@@ -14721,7 +14721,7 @@ lpfc_write_firmware(const struct firmware *fw, void *context)int lpfc_sli4_request_firmware_update (struct lpfc_hba *phba,uint8_t fw_upgrade) { -uint8_t file_name[ELX_MODEL_NAME_SIZE ]; +char file_name[ELX_FW_NAME_SIZE ] = {0 };int ret;const struct firmware *fw;
@@ -14730,7 +14730,7 @@ lpfc_sli4_request_firmware_update(struct lpfc_hba *phba, uint8_t fw_upgrade) LPFC_SLI_INTF_IF_TYPE_2)return -EPERM ; -snprintf (file_name,ELX_MODEL_NAME_SIZE ,"%s.grp" , phba->ModelName); +scnprintf (file_name,sizeof (file_name),"%s.grp" , phba->ModelName);if (fw_upgrade ==INT_FW_UPGRADE ) { ret = request_firmware_nowait(THIS_MODULE, FW_ACTION_UEVENT,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/353 ARM: dts: samsung: exynos4: fix camera unit addresses/ranges
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit ba2a45a48503665f7e8eeec51f8b40456566b0cd ]
The camera node has both unit address and children within the same bus mapping, thus needs proper ranges property to fix dtc W=1 warnings:
Warning (unit_address_vs_reg): /soc/camera@11800000: node has a unit name, but no reg or ranges property Warning (simple_bus_reg): /soc/camera@11800000: missing or empty reg/ranges property
Subtract 0x11800000 from all its children nodes. No functional impact expected.
--- arch/arm/boot/dts/samsung/exynos4.dtsi | 26 +++++++++++------------ arch/arm/boot/dts/samsung/exynos4x12.dtsi | 17 ++++++++------- 2 files changed, 22 insertions(+), 21 deletions(-)
arch/arm/boot/dts/samsung/exynos4.dtsi +13 -13
@@ -203,16 +203,16 @@ camera: camera@11800000 { compatible = "samsung,fimc"; + ranges = <0x0 0x11800000 0xa0000>; status = "disabled"; #address-cells = <1>; #size-cells = <1>; #clock-cells = <1>; clock-output-names = "cam_a_clkout", "cam_b_clkout"; - ranges; - fimc_0: fimc@11800000 { + fimc_0: fimc@0 { compatible = "samsung,exynos4210-fimc"; - reg = <0x11800000 0x1000>; + reg = <0x0 0x1000>; interrupts = <GIC_SPI 84 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clock CLK_FIMC0>, <&clock CLK_SCLK_FIMC0>;
@@ -223,9 +223,9 @@ status = "disabled"; }; - fimc_1: fimc@11810000 { + fimc_1: fimc@10000 { compatible = "samsung,exynos4210-fimc"; - reg = <0x11810000 0x1000>; + reg = <0x00010000 0x1000>; interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clock CLK_FIMC1>, <&clock CLK_SCLK_FIMC1>;
@@ -236,9 +236,9 @@ status = "disabled"; }; - fimc_2: fimc@11820000 { + fimc_2: fimc@20000 { compatible = "samsung,exynos4210-fimc"; - reg = <0x11820000 0x1000>; + reg = <0x00020000 0x1000>; interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clock CLK_FIMC2>, <&clock CLK_SCLK_FIMC2>;
@@ -249,9 +249,9 @@ status = "disabled"; }; - fimc_3: fimc@11830000 { + fimc_3: fimc@30000 { compatible = "samsung,exynos4210-fimc"; - reg = <0x11830000 0x1000>; + reg = <0x00030000 0x1000>; interrupts = <GIC_SPI 87 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clock CLK_FIMC3>, <&clock CLK_SCLK_FIMC3>;
@@ -262,9 +262,9 @@ status = "disabled"; }; - csis_0: csis@11880000 { + csis_0: csis@80000 { compatible = "samsung,exynos4210-csis"; - reg = <0x11880000 0x4000>; + reg = <0x00080000 0x4000>; interrupts = <GIC_SPI 78 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clock CLK_CSIS0>, <&clock CLK_SCLK_CSIS0>;
@@ -278,9 +278,9 @@ #size-cells = <0>; }; - csis_1: csis@11890000 { + csis_1: csis@90000 { compatible = "samsung,exynos4210-csis"; - reg = <0x11890000 0x4000>; + reg = <0x00090000 0x4000>; interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clock CLK_CSIS1>, <&clock CLK_SCLK_CSIS1>;
arch/arm/boot/dts/samsung/exynos4x12.dtsi +9 -8
@@ -451,14 +451,15 @@ }; &camera { + ranges = <0x0 0x11800000 0xba1000>; clocks = <&clock CLK_SCLK_CAM0>, <&clock CLK_SCLK_CAM1>, <&clock CLK_PIXELASYNCM0>, <&clock CLK_PIXELASYNCM1>; clock-names = "sclk_cam0", "sclk_cam1", "pxl_async0", "pxl_async1"; /* fimc_[0-3] are configured outside, under phandles */ - fimc_lite_0: fimc-lite@12390000 { + fimc_lite_0: fimc-lite@b90000 { compatible = "samsung,exynos4212-fimc-lite"; - reg = <0x12390000 0x1000>; + reg = <0x00b90000 0x1000>; interrupts = <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH>; power-domains = <&pd_isp>; clocks = <&isp_clock CLK_ISP_FIMC_LITE0>;
@@ -467,9 +468,9 @@ status = "disabled"; }; - fimc_lite_1: fimc-lite@123a0000 { + fimc_lite_1: fimc-lite@ba0000 { compatible = "samsung,exynos4212-fimc-lite"; - reg = <0x123a0000 0x1000>; + reg = <0x00ba0000 0x1000>; interrupts = <GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>; power-domains = <&pd_isp>; clocks = <&isp_clock CLK_ISP_FIMC_LITE1>;
@@ -478,9 +479,9 @@ status = "disabled"; }; - fimc_is: fimc-is@12000000 { + fimc_is: fimc-is@800000 { compatible = "samsung,exynos4212-fimc-is"; - reg = <0x12000000 0x260000>; + reg = <0x00800000 0x260000>; interrupts = <GIC_SPI 90 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 95 IRQ_TYPE_LEVEL_HIGH>; power-domains = <&pd_isp>;
@@ -525,9 +526,9 @@ reg = <0x10020000 0x3000>; }; - i2c1_isp: i2c-isp@12140000 { + i2c1_isp: i2c-isp@940000 { compatible = "samsung,exynos4212-i2c-isp"; - reg = <0x12140000 0x100>; + reg = <0x00940000 0x100>; clocks = <&isp_clock CLK_ISP_I2C1_ISP>; clock-names = "i2c_isp"; #address-cells = <1>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/353 ARM: dts: samsung: s5pv210: fix camera unit addresses/ranges
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 07e6a553c2f1d385edfc9185081dee442a9dd38d ]
The camera node has both unit address and children within the same bus mapping, thus needs proper ranges property to fix dtc W=1 warnings:
Warning (unit_address_vs_reg): /soc/camera@fa600000: node has a unit name, but no reg or ranges property Warning (simple_bus_reg): /soc/camera@fa600000: missing or empty reg/ranges property
Subtract 0xfa600000 from all its children nodes. No functional impact expected.
--- arch/arm/boot/dts/samsung/s5pv210.dtsi | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
arch/arm/boot/dts/samsung/s5pv210.dtsi +9 -9
@@ -549,17 +549,17 @@ camera: camera@fa600000 { compatible = "samsung,fimc"; + ranges = <0x0 0xfa600000 0xe01000>; clocks = <&clocks SCLK_CAM0>, <&clocks SCLK_CAM1>; clock-names = "sclk_cam0", "sclk_cam1"; #address-cells = <1>; #size-cells = <1>; #clock-cells = <1>; clock-output-names = "cam_a_clkout", "cam_b_clkout"; - ranges; - csis0: csis@fa600000 { + csis0: csis@0 { compatible = "samsung,s5pv210-csis"; - reg = <0xfa600000 0x4000>; + reg = <0x00000000 0x4000>; interrupt-parent = <&vic2>; interrupts = <29>; clocks = <&clocks CLK_CSIS>,
@@ -572,9 +572,9 @@ #size-cells = <0>; }; - fimc0: fimc@fb200000 { + fimc0: fimc@c00000 { compatible = "samsung,s5pv210-fimc"; - reg = <0xfb200000 0x1000>; + reg = <0x00c00000 0x1000>; interrupts = <5>; interrupt-parent = <&vic2>; clocks = <&clocks CLK_FIMC0>,
@@ -586,9 +586,9 @@ samsung,cam-if; }; - fimc1: fimc@fb300000 { + fimc1: fimc@d00000 { compatible = "samsung,s5pv210-fimc"; - reg = <0xfb300000 0x1000>; + reg = <0x00d00000 0x1000>; interrupt-parent = <&vic2>; interrupts = <6>; clocks = <&clocks CLK_FIMC1>,
@@ -602,9 +602,9 @@ samsung,lcd-wb; }; - fimc2: fimc@fb400000 { + fimc2: fimc@e00000 { compatible = "samsung,s5pv210-fimc"; - reg = <0xfb400000 0x1000>; + reg = <0x00e00000 0x1000>; interrupt-parent = <&vic2>; interrupts = <7>; clocks = <&clocks CLK_FIMC2>,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/353 net: phy: micrel: fix ts_info value in case of no phc
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kory Maincent <[email protected]>
[ Upstream commit 915d25a9d69be969c1cc6c1dd0c3861f6da7b55e ]
In case of no phc we should not return SOFTWARE TIMESTAMPING flags as we do not know whether the netdev supports of timestamping.
Remove it from the lan8841_ts_info and simply return 0.
--- drivers/net/phy/micrel.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/net/phy/micrel.c +1 -5
@@ -3650,12 +3650,8 @@ static int lan8841_ts_info(struct mii_timestamper *mii_ts, info->phc_index = ptp_priv->ptp_clock ?ptp_clock_index (ptp_priv->ptp_clock) :-1 ; -if (info->phc_index ==-1 ) { - info->so_timestamping |=SOF_TIMESTAMPING_TX_SOFTWARE | -SOF_TIMESTAMPING_RX_SOFTWARE | -SOF_TIMESTAMPING_SOFTWARE ; +if (info->phc_index ==-1 )return 0 ; - } info->so_timestamping =SOF_TIMESTAMPING_TX_HARDWARE | SOF_TIMESTAMPING_RX_HARDWARE |
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/353 PCI: Add no PM reset quirk for NVIDIA Spectrum devices
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 3ed48c80b28d8dcd584d6ddaf00c75b7673e1a05 ]
Spectrum-{1,2,3,4} devices report that a D3hot->D0 transition causes a reset (i.e., they advertise NoSoftRst-). However, this transition does not have any effect on the device: It continues to be operational and network ports remain up. Advertising this support makes it seem as if a PM reset is viable for these devices. Mark it as unavailable to skip it when testing reset methods.
Before:
# cat /sys/bus/pci/devices/0000\:03\:00.0/reset_method pm bus
After:
# cat /sys/bus/pci/devices/0000\:03\:00.0/reset_method bus
--- drivers/pci/quirks.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/pci/quirks.c +13 -0
@@ -3786,6 +3786,19 @@ static void quirk_no_pm_reset(struct pci_dev *dev)DECLARE_PCI_FIXUP_CLASS_HEADER (PCI_VENDOR_ID_ATI ,PCI_ANY_ID ,PCI_CLASS_DISPLAY_VGA ,8 , quirk_no_pm_reset); +/* +* Spectrum-{1,2,3,4} devices report that a D3hot->D0 transition causes a reset +* (i.e., they advertise NoSoftRst-). However, this transition does not have +* any effect on the device: It continues to be operational and network ports +* remain up. Advertising this support makes it seem as if a PM reset is viable +* for these devices. Mark it as unavailable to skip it when testing reset +* methods. +*/ +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_MELLANOX ,0xcb84 , quirk_no_pm_reset); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_MELLANOX ,0xcf6c , quirk_no_pm_reset); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_MELLANOX ,0xcf70 , quirk_no_pm_reset); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_MELLANOX ,0xcf80 , quirk_no_pm_reset); +/* * Thunderbolt controllers with broken MSI hotplug signaling: * Entire 1st generation (Light Ridge, Eagle Ridge, Light Peak) and part
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/353 bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhengchao Shao <[email protected]>
[ Upstream commit d6b83f1e3707c4d60acfa58afd3515e17e5d5384 ]
If failed to allocate "tags" or could not find the final upper device from start_dev's upper list in bond_verify_device_path(), only the loopback detection of the current upper device should be affected, and the system is no need to be panic.
So return -ENOMEM in alb_upper_dev_walk to stop walking, print some warn information when failed to allocate memory for vlan tags in bond_verify_device_path.
I also think that the following function callsnetdev_walk_all_upper_dev_rcu
---->>>alb_upper_dev_walk
---------->>>bond_verify_device_path
Quoted 1 line
From this way, "end device" can eventually be obtained from "start device"
in bond_verify_device_path, IS_ERR(tags) could be instead of IS_ERR_OR_NULL(tags) in alb_upper_dev_walk.
--- drivers/net/bonding/bond_alb.c | 3 ++- drivers/net/bonding/bond_main.c | 5 ++++- 2 files changed, 6 insertions(+), 2 deletions(-)
drivers/net/bonding/bond_alb.c +2 -1
@@ -985,7 +985,8 @@ static int alb_upper_dev_walk(struct net_device *upper,if (netif_is_macvlan (upper) && !strict_match) { tags =bond_verify_device_path (bond->dev, upper,0 );if (IS_ERR_OR_NULL (tags)) -BUG (); +return -ENOMEM ; +alb_send_lp_vid (slave, upper->dev_addr, tags[0 ].vlan_proto, tags[0 ].vlan_id);kfree (tags);
drivers/net/bonding/bond_main.c +4 -1
@@ -2973,8 +2973,11 @@ struct bond_vlan_tag *bond_verify_device_path(struct net_device *start_dev,if (start_dev == end_dev) { tags =kcalloc (level +1 ,sizeof (*tags),GFP_ATOMIC ); -if (!tags) +if (!tags) { +net_err_ratelimited ("%s: %s: Failed to allocate tags\n" , + __func__, start_dev->name);return ERR_PTR (-ENOMEM ); + } tags[level].vlan_proto =BOND_VLAN_PROTO_NONE ;return tags; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/353 net: usb: ax88179_178a: avoid two consecutive device resets
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jose Ignacio Tornos Martinez <[email protected]>
[ Upstream commit d2689b6a86b9d23574bd4b654bf770b6034e2c7e ]
The device is always reset two consecutive times (ax88179_reset is called twice), one from usbnet_probe during the device binding and the other from usbnet_open.
Remove the non-necessary reset during the device binding and let the reset operation from open to keep the normal behavior (tested with generic ASIX Electronics Corp. AX88179 Gigabit Ethernet device).
--- drivers/net/usb/ax88179_178a.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/usb/ax88179_178a.c +0 -2
@@ -1315,8 +1315,6 @@ static int ax88179_bind(struct usbnet *dev, struct usb_interface *intf)netif_set_tso_max_size (dev->net,16384 ); -ax88179_reset (dev); -return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/353 scsi: mpi3mr: Add support for SAS5116 PCI IDs
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumit Saxena <[email protected]>
[ Upstream commit 6fa21eab82be57a3ad2470fac27b982793805336 ]
Add support for Broadcom's SAS5116 IO/RAID controllers PCI IDs.
--- drivers/scsi/mpi3mr/mpi3mr_os.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/scsi/mpi3mr/mpi3mr_os.c +8 -0
@@ -5441,6 +5441,14 @@ static const struct pci_device_id mpi3mr_pci_id_table[] = {PCI_DEVICE_SUB (MPI3_MFGPAGE_VENDORID_BROADCOM ,MPI3_MFGPAGE_DEVID_SAS4116 ,PCI_ANY_ID ,PCI_ANY_ID ) }, + { +PCI_DEVICE_SUB (MPI3_MFGPAGE_VENDORID_BROADCOM , +MPI3_MFGPAGE_DEVID_SAS5116_MPI ,PCI_ANY_ID ,PCI_ANY_ID ) + }, + { +PCI_DEVICE_SUB (MPI3_MFGPAGE_VENDORID_BROADCOM , +MPI3_MFGPAGE_DEVID_SAS5116_MPI_MGMT ,PCI_ANY_ID ,PCI_ANY_ID ) + }, { 0 } };MODULE_DEVICE_TABLE (pci, mpi3mr_pci_id_table);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/353 scsi: mpi3mr: Add PCI checks where SAS5116 diverges from SAS4116
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumit Saxena <[email protected]>
[ Upstream commit c9260ff28ee561fca5f96425c9328a9698e8427b ]
Add PCI IDs checks for the cases where SAS5116 diverges from SAS4116 in behavior.
--- drivers/scsi/mpi3mr/mpi3mr_fw.c | 3 ++- drivers/scsi/mpi3mr/mpi3mr_os.c | 5 ++++- 2 files changed, 6 insertions(+), 2 deletions(-)
drivers/scsi/mpi3mr/mpi3mr_fw.c +2 -1
@@ -1892,7 +1892,8 @@ static int mpi3mr_create_op_reply_q(struct mpi3mr_ioc *mrioc, u16 qidx) reply_qid = qidx +1 ; op_reply_q->num_replies =MPI3MR_OP_REP_Q_QD ; -if (!mrioc->pdev->revision) +if ((mrioc->pdev->device ==MPI3_MFGPAGE_DEVID_SAS4116 ) && + !mrioc->pdev->revision) op_reply_q->num_replies =MPI3MR_OP_REP_Q_QD4K ; op_reply_q->ci =0 ; op_reply_q->ephase =1 ;
drivers/scsi/mpi3mr/mpi3mr_os.c +4 -1
@@ -5112,7 +5112,10 @@ mpi3mr_probe(struct pci_dev *pdev, const struct pci_device_id *id)mpi3mr_init_drv_cmd (&mrioc->evtack_cmds[i],MPI3MR_HOSTTAG_EVTACKCMD_MIN + i); -if (pdev->revision) +if ((pdev->device ==MPI3_MFGPAGE_DEVID_SAS4116 ) && + !pdev->revision) + mrioc->enable_segqueue = false; +else mrioc->enable_segqueue = true;init_waitqueue_head (&mrioc->reset_waitq);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/353 scsi: arcmsr: Support new PCI device IDs 1883 and 1886
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: ching Huang <[email protected]>
[ Upstream commit 41c8a1a1e90fa4721f856bf3cf71211fd16d6434 ]
Add support for Areca RAID controllers with PCI device IDs 1883 and 1886.
--- drivers/scsi/arcmsr/arcmsr.h | 4 ++++ drivers/scsi/arcmsr/arcmsr_hba.c | 6 ++++++ 2 files changed, 10 insertions(+)
drivers/scsi/arcmsr/arcmsr.h +4 -0
@@ -78,9 +78,13 @@ struct device_attribute;#ifndef PCI_DEVICE_ID_ARECA_1203 #define PCI_DEVICE_ID_ARECA_1203 0x1203#endif +#ifndef PCI_DEVICE_ID_ARECA_1883 +#define PCI_DEVICE_ID_ARECA_1883 0x1883 +#endif #ifndef PCI_DEVICE_ID_ARECA_1884 #define PCI_DEVICE_ID_ARECA_1884 0x1884#endif +#define PCI_DEVICE_ID_ARECA_1886_0 0x1886#define PCI_DEVICE_ID_ARECA_1886 0x188A#define ARCMSR_HOURS (1000 * 60 * 60 * 4)#define ARCMSR_MINUTES (1000 * 60 * 60)
drivers/scsi/arcmsr/arcmsr_hba.c +6 -0
@@ -214,8 +214,12 @@ static struct pci_device_id arcmsr_device_id_table[] = { .driver_data = ACB_ADAPTER_TYPE_A}, {PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1880), .driver_data = ACB_ADAPTER_TYPE_C}, + {PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1883), + .driver_data = ACB_ADAPTER_TYPE_C}, {PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1884), .driver_data = ACB_ADAPTER_TYPE_E}, + {PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1886_0), + .driver_data = ACB_ADAPTER_TYPE_F}, {PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1886), .driver_data = ACB_ADAPTER_TYPE_F}, {0, 0}, /* Terminating entry */
@@ -4706,9 +4710,11 @@ static const char *arcmsr_info(struct Scsi_Host *host)case PCI_DEVICE_ID_ARECA_1680 :case PCI_DEVICE_ID_ARECA_1681 :case PCI_DEVICE_ID_ARECA_1880 : +case PCI_DEVICE_ID_ARECA_1883 :case PCI_DEVICE_ID_ARECA_1884 : type ="SAS/SATA" ;break ; +case PCI_DEVICE_ID_ARECA_1886_0 :case PCI_DEVICE_ID_ARECA_1886 : type ="NVMe/SAS/SATA" ;break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/353 ARM: dts: imx7d: Fix coresight funnel ports
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 0d4ac04fa7c3f6dc263dba6f575a2ec7a2d4eca8 ]
imx7d uses two ports for 'in-ports', so the syntax port@<num> has to be used. imx7d has both port and port@1 nodes present, raising these error:
funnel@30041000: in-ports: More than one condition true in oneOf schema funnel@30041000: Unevaluated properties are not allowed ('in-ports' was unexpected)
Fix this by also using port@0 for imx7s as well.
--- arch/arm/boot/dts/nxp/imx/imx7d.dtsi | 3 --- arch/arm/boot/dts/nxp/imx/imx7s.dtsi | 6 +++++- 2 files changed, 5 insertions(+), 4 deletions(-)
arch/arm/boot/dts/nxp/imx/imx7d.dtsi +0 -3
@@ -217,9 +217,6 @@ }; &ca_funnel_in_ports { - #address-cells = <1>; - #size-cells = <0>; - port@1 { reg = <1>; ca_funnel_in_port1: endpoint {
arch/arm/boot/dts/nxp/imx/imx7s.dtsi +5 -1
@@ -190,7 +190,11 @@ clock-names = "apb_pclk"; ca_funnel_in_ports: in-ports { - port { + #address-cells = <1>; + #size-cells = <0>; + + port@0 { + reg = <0>; ca_funnel_in_port0: endpoint { remote-endpoint = <&etm0_out_port>; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/353 ARM: dts: imx7s: Fix lcdif compatible
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 5f55da4cc37051cda600ea870ce8cf29f1297715 ]
imx7d-lcdif is compatible to imx6sx-lcdif. MXSFB_V6 supports overlay by using LCDC_AS_CTRL register. This registers used by overlay plane:
* LCDC_AS_CTRL
* LCDC_AS_BUF
* LCDC_AS_NEXT_BUF
are listed in i.MX7D RM as well.
--- arch/arm/boot/dts/nxp/imx/imx7s.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/nxp/imx/imx7s.dtsi +1 -1
@@ -815,7 +815,7 @@ }; lcdif: lcdif@30730000 { - compatible = "fsl,imx7d-lcdif", "fsl,imx28-lcdif"; + compatible = "fsl,imx7d-lcdif", "fsl,imx6sx-lcdif"; reg = <0x30730000 0x10000>; interrupts = <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clks IMX7D_LCDIF_PIXEL_ROOT_CLK>,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/353 ARM: dts: imx7s: Fix nand-controller #size-cells
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 4aadb841ed49bada1415c48c44d21f5b69e01299 ]
nand-controller.yaml bindings says #size-cells shall be set to 0. Fixes the dtbs_check warning:arch/arm/boot/dts/nxp/imx/imx7s-mba7.dtb: nand-controller@33002000:
#size-cells:0:0: 0 was expected
from schema $id: http://devicetree.org/schemas/mtd/gpmi-nand.yaml#
--- arch/arm/boot/dts/nxp/imx/imx7s.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/nxp/imx/imx7s.dtsi +1 -1
@@ -1279,7 +1279,7 @@ gpmi: nand-controller@33002000 { compatible = "fsl,imx7d-gpmi-nand"; #address-cells = <1>; - #size-cells = <1>; + #size-cells = <0>; reg = <0x33002000 0x2000>, <0x33004000 0x4000>; reg-names = "gpmi-nand", "bch"; interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/353 bpf: Fix a few selftest failures due to llvm18 change
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <[email protected]>
[ Upstream commit b16904fd9f01b580db357ef2b1cc9e86d89576c2 ]
With latest upstream llvm18, the following test cases failed:
$ ./test_progs -j #13/2 bpf_cookie/multi_kprobe_link_api:FAIL #13/3 bpf_cookie/multi_kprobe_attach_api:FAIL #13 bpf_cookie:FAIL #77 fentry_fexit:FAIL #78/1 fentry_test/fentry:FAIL #78 fentry_test:FAIL #82/1 fexit_test/fexit:FAIL #82 fexit_test:FAIL #112/1 kprobe_multi_test/skel_api:FAIL #112/2 kprobe_multi_test/link_api_addrs:FAIL [...] #112 kprobe_multi_test:FAIL #356/17 test_global_funcs/global_func17:FAIL #356 test_global_funcs:FAIL
Further analysis shows llvm upstream patch [1] is responsible for the above failures. For example, for function bpf_fentry_test7() in net/bpf/test_run.c, without [1], the asm code is:
0000000000000400 <bpf_fentry_test7>:
400: f3 0f 1e fa endbr64
404: e8 00 00 00 00 callq 0x409 <bpf_fentry_test7+0x9>
409: 48 89 f8 movq %rdi, %rax
40c: c3 retq
40d: 0f 1f 00 nopl (%rax)... and with [1], the asm code is:
0000000000005d20 <bpf_fentry_test7.specialized.1>:
5d20: e8 00 00 00 00 callq 0x5d25 <bpf_fentry_test7.specialized.1+0x5>
5d25: c3 retq
... and <bpf_fentry_test7.specialized.1> is called instead of <bpf_fentry_test7> and this caused test failures for #13/#77 etc. except #356.
For test case #356/17, with [1] (progs/test_global_func17.c)), the main prog looks like:
0000000000000000 <global_func17>:
0: b4 00 00 00 2a 00 00 00 w0 = 0x2a
1: 95 00 00 00 00 00 00 00 exit... which passed verification while the test itself expects a verification failure.
Let us add 'barrier_var' style asm code in both places to prevent function specialization which caused selftests failure.
[1] https://github.com/llvm/llvm-project/pull/72903
--- net/bpf/test_run.c | 2 +- tools/testing/selftests/bpf/progs/test_global_func17.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)
net/bpf/test_run.c +1 -1
@@ -542,7 +542,7 @@ struct bpf_fentry_test_t { int noinline bpf_fentry_test7(struct bpf_fentry_test_t *arg) { - asmvolatile ("" ); + asmvolatile ("" :"+r" (arg));return (long )arg; }
tools/testing/selftests/bpf/progs/test_global_func17.c +1 -0
@@ -5,6 +5,7 @@ __noinline int foo(int *p) { +barrier_var (p);return p ? (*p =42 ) :0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/353 wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minsuk Kang <[email protected]>
[ Upstream commit 2adc886244dff60f948497b59affb6c6ebb3c348 ]
Fix an array-index-out-of-bounds read in ath9k_htc_txstatus(). The bug occurs when txs->cnt, data from a URB provided by a USB device, is bigger than the size of the array txs->txstatus, which is HTC_MAX_TX_STATUS. WARN_ON() already checks it, but there is no bug handling code after the check. Make the function return if that is the case.
Found by a modified version of syzkaller.
UBSAN: array-index-out-of-bounds in htc_drv_txrx.c index 13 is out of range for type '__wmi_event_txstatus [12]' Call Trace: ath9k_htc_txstatus ath9k_wmi_event_tasklet tasklet_action_common __do_softirq irq_exit_rxu sysvec_apic_timer_interrupt
--- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +3 -2
@@ -652,9 +652,10 @@ void ath9k_htc_txstatus(struct ath9k_htc_priv *priv, void *wmi_event)struct ath9k_htc_tx_event *tx_pend;int i; -for (i =0 ; i < txs->cnt; i++) { -WARN_ON (txs->cnt >HTC_MAX_TX_STATUS ); +if (WARN_ON_ONCE (txs->cnt >HTC_MAX_TX_STATUS )) +return ; +for (i =0 ; i < txs->cnt; i++) { __txs = &txs->txstatus[i]; skb =ath9k_htc_tx_get_packet (priv, __txs);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/353 wifi: ath11k: fix race due to setting ATH11K_FLAG_EXT_IRQ_ENABLED too early
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit 5082b3e3027eae393a4e86874bffb4ce3f83c26e ]
We are seeing below error randomly in the case where only one MSI vector is configured:
kernel: ath11k_pci 0000:03:00.0: wmi command 16387 timeout
The reason is, currently, in ath11k_pcic_ext_irq_enable(), ATH11K_FLAG_EXT_IRQ_ENABLED is set before NAPI is enabled. This results in a race condition: after ATH11K_FLAG_EXT_IRQ_ENABLED is set but before NAPI enabled, CE interrupt breaks in. Since IRQ is shared by CE and data path, ath11k_pcic_ext_interrupt_handler() is also called where we call disable_irq_nosync() to disable IRQ. Then napi_schedule() is called but it does nothing because NAPI is not enabled at that time, meaning ath11k_pcic_ext_grp_napi_poll() will never run, so we have no chance to call enable_irq() to enable IRQ back. Finally we get above error.
Fix it by setting ATH11K_FLAG_EXT_IRQ_ENABLED after all NAPI and IRQ work are done. With the fix, we are sure that by the time ATH11K_FLAG_EXT_IRQ_ENABLED is set, NAPI is enabled.
Note that the fix above also introduce some side effects:
if ath11k_pcic_ext_interrupt_handler() breaks in after NAPI enabled but before ATH11K_FLAG_EXT_IRQ_ENABLED set, nothing will be done by the handler this time, the work will be postponed till the next time the IRQ fires.
Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23
--- drivers/net/wireless/ath/ath11k/pcic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath11k/pcic.c +2 -2
@@ -460,8 +460,6 @@ void ath11k_pcic_ext_irq_enable(struct ath11k_base *ab) {int i; -set_bit (ATH11K_FLAG_EXT_IRQ_ENABLED , &ab->dev_flags); -for (i =0 ; i <ATH11K_EXT_IRQ_GRP_NUM_MAX ; i++) {struct ath11k_ext_irq_grp *irq_grp = &ab->ext_irq_grp[i];
@@ -471,6 +469,8 @@ void ath11k_pcic_ext_irq_enable(struct ath11k_base *ab) }ath11k_pcic_ext_grp_enable (irq_grp); } + +set_bit (ATH11K_FLAG_EXT_IRQ_ENABLED , &ab->dev_flags); }EXPORT_SYMBOL (ath11k_pcic_ext_irq_enable);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/353 wifi: rtw89: fix not entering PS mode after AP stops
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Po-Hao Huang <[email protected]>
[ Upstream commit 0052b3c401cdf39d3c3d12a0c3852175bc9a39c7 ]
The attempt to enter power save mode might fail if there are still beacons pending in the queue. This sometimes happens after stopping P2P GO or AP mode. Extend stop AP function and flush all beacons to resolve this.
--- drivers/net/wireless/realtek/rtw89/mac.c | 71 ++++++++++++++++++++++-- drivers/net/wireless/realtek/rtw89/reg.h | 17 ++++++ 2 files changed, 82 insertions(+), 6 deletions(-)
drivers/net/wireless/realtek/rtw89/mac.c +65 -6
@@ -3747,6 +3747,50 @@ static const struct rtw89_port_reg rtw89_port_base_ax = { R_AX_PORT_HGQ_WINDOW_CFG + 3}, }; +static void rtw89_mac_check_packet_ctrl (struct rtw89_dev *rtwdev, +struct rtw89_vif *rtwvif,u8 type) +{ +u8 mask =B_AX_PTCL_DBG_INFO_MASK_BY_PORT (rtwvif->port); +u32 reg_info, reg_ctrl; +u32 val; +int ret; + + reg_info =rtw89_mac_reg_by_idx (rtwdev,R_AX_PTCL_DBG_INFO , rtwvif->mac_idx); + reg_ctrl =rtw89_mac_reg_by_idx (rtwdev,R_AX_PTCL_DBG , rtwvif->mac_idx); + +rtw89_write32_mask (rtwdev, reg_ctrl,B_AX_PTCL_DBG_SEL_MASK , type); +rtw89_write32_set (rtwdev, reg_ctrl,B_AX_PTCL_DBG_EN ); +fsleep (100 ); + + ret =read_poll_timeout (rtw89_read32_mask, val, val ==0 ,1000 ,100000 , + true, rtwdev, reg_info, mask); +if (ret) +rtw89_warn (rtwdev,"Polling beacon packet empty fail\n" ); +} + +static void rtw89_mac_bcn_drop (struct rtw89_dev *rtwdev,struct rtw89_vif *rtwvif) +{ +const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def; +const struct rtw89_port_reg *p = mac->port_base; + +rtw89_write32_set (rtwdev,R_AX_BCN_DROP_ALL0 ,BIT (rtwvif->port)); +rtw89_write32_port_mask (rtwdev, rtwvif, p->tbtt_prohib,B_AX_TBTT_SETUP_MASK ,1 ); +rtw89_write32_port_mask (rtwdev, rtwvif, p->bcn_area,B_AX_BCN_MSK_AREA_MASK ,0 ); +rtw89_write32_port_mask (rtwdev, rtwvif, p->tbtt_prohib,B_AX_TBTT_HOLD_MASK ,0 ); +rtw89_write32_port_mask (rtwdev, rtwvif, p->bcn_early,B_AX_BCNERLY_MASK ,2 ); +rtw89_write16_port_mask (rtwdev, rtwvif, p->tbtt_early,B_AX_TBTTERLY_MASK ,1 ); +rtw89_write32_port_mask (rtwdev, rtwvif, p->bcn_space,B_AX_BCN_SPACE_MASK ,1 ); +rtw89_write32_port_set (rtwdev, rtwvif, p->port_cfg,B_AX_BCNTX_EN ); + +rtw89_mac_check_packet_ctrl (rtwdev, rtwvif,AX_PTCL_DBG_BCNQ_NUM0 ); +if (rtwvif->port ==RTW89_PORT_0 ) +rtw89_mac_check_packet_ctrl (rtwdev, rtwvif,AX_PTCL_DBG_BCNQ_NUM1 ); + +rtw89_write32_clr (rtwdev,R_AX_BCN_DROP_ALL0 ,BIT (rtwvif->port)); +rtw89_write32_port_clr (rtwdev, rtwvif, p->port_cfg,B_AX_TBTT_PROHIB_EN ); +fsleep (2 ); +} +#define BCN_INTERVAL 100#define BCN_ERLY_DEF 160#define BCN_SETUP_DEF 2
@@ -3762,21 +3806,36 @@ static void rtw89_mac_port_cfg_func_sw(struct rtw89_dev *rtwdev,const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;const struct rtw89_port_reg *p = mac->port_base;struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif); +const struct rtw89_chip_info *chip = rtwdev->chip; +bool need_backup = false; +u32 backup_val;if (!rtw89_read32_port_mask (rtwdev, rtwvif, p->port_cfg,B_AX_PORT_FUNC_EN ))return ; -rtw89_write32_port_clr (rtwdev, rtwvif, p->tbtt_prohib,B_AX_TBTT_SETUP_MASK ); -rtw89_write32_port_mask (rtwdev, rtwvif, p->tbtt_prohib,B_AX_TBTT_HOLD_MASK ,1 ); -rtw89_write16_port_clr (rtwdev, rtwvif, p->tbtt_early,B_AX_TBTTERLY_MASK ); -rtw89_write16_port_clr (rtwdev, rtwvif, p->bcn_early,B_AX_BCNERLY_MASK ); +if (chip->chip_id ==RTL8852A && rtwvif->port !=RTW89_PORT_0 ) { + need_backup = true; + backup_val =rtw89_read32_port (rtwdev, rtwvif, p->tbtt_prohib); + } -msleep (vif->bss_conf.beacon_int +1 ); +if (rtwvif->net_type ==RTW89_NET_TYPE_AP_MODE ) +rtw89_mac_bcn_drop (rtwdev, rtwvif); + +if (chip->chip_id ==RTL8852A ) { +rtw89_write32_port_clr (rtwdev, rtwvif, p->tbtt_prohib,B_AX_TBTT_SETUP_MASK ); +rtw89_write32_port_mask (rtwdev, rtwvif, p->tbtt_prohib,B_AX_TBTT_HOLD_MASK ,1 ); +rtw89_write16_port_clr (rtwdev, rtwvif, p->tbtt_early,B_AX_TBTTERLY_MASK ); +rtw89_write16_port_clr (rtwdev, rtwvif, p->bcn_early,B_AX_BCNERLY_MASK ); + } +msleep (vif->bss_conf.beacon_int +1 );rtw89_write32_port_clr (rtwdev, rtwvif, p->port_cfg,B_AX_PORT_FUNC_EN |B_AX_BRK_SETUP );rtw89_write32_port_set (rtwdev, rtwvif, p->port_cfg,B_AX_TSFTR_RST );rtw89_write32_port (rtwdev, rtwvif, p->bcn_cnt_tmr,0 ); + +if (need_backup) +rtw89_write32_port (rtwdev, rtwvif, p->tbtt_prohib, backup_val); } static void rtw89_mac_port_cfg_tx_rpt(struct rtw89_dev *rtwdev,
@@ -4261,7 +4320,7 @@ void rtw89_mac_set_he_obss_narrow_bw_ru(struct rtw89_dev *rtwdev,void rtw89_mac_stop_ap (struct rtw89_dev *rtwdev,struct rtw89_vif *rtwvif) { -rtw89_mac_port_cfg_func_en (rtwdev, rtwvif, false); +rtw89_mac_port_cfg_func_sw (rtwdev, rtwvif); }int rtw89_mac_add_vif (struct rtw89_dev *rtwdev,struct rtw89_vif *rtwvif)
drivers/net/wireless/realtek/rtw89/reg.h +17 -0
@@ -2375,6 +2375,14 @@#define R_AX_TSFTR_HIGH_P4 0xC53C#define B_AX_TSFTR_HIGH_MASK GENMASK(31, 0) +#define R_AX_BCN_DROP_ALL0 0xC560 +#define R_AX_BCN_DROP_ALL0_C1 0xE560 +#define B_AX_BCN_DROP_ALL_P4 BIT(4) +#define B_AX_BCN_DROP_ALL_P3 BIT(3) +#define B_AX_BCN_DROP_ALL_P2 BIT(2) +#define B_AX_BCN_DROP_ALL_P1 BIT(1) +#define B_AX_BCN_DROP_ALL_P0 BIT(0) +#define R_AX_MBSSID_CTRL 0xC568#define R_AX_MBSSID_CTRL_C1 0xE568#define B_AX_P0MB_ALL_MASK GENMASK(23, 1)
@@ -2554,11 +2562,20 @@#define R_AX_PTCL_DBG_INFO 0xC6F0#define R_AX_PTCL_DBG_INFO_C1 0xE6F0 +#define B_AX_PTCL_DBG_INFO_MASK_BY_PORT (port) \ +({\ + typeof(port) _port = (port); \ + GENMASK((_port) * 2 + 1, (_port) * 2); \ +}) +#define B_AX_PTCL_DBG_INFO_MASK GENMASK(31, 0)#define R_AX_PTCL_DBG 0xC6F4#define R_AX_PTCL_DBG_C1 0xE6F4#define B_AX_PTCL_DBG_EN BIT(8)#define B_AX_PTCL_DBG_SEL_MASK GENMASK(7, 0) +#define AX_PTCL_DBG_BCNQ_NUM0 8 +#define AX_PTCL_DBG_BCNQ_NUM1 9 +#define R_AX_DLE_CTRL 0xC800#define R_AX_DLE_CTRL_C1 0xE800
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/353 wifi: rtw89: fix misbehavior of TX beacon in concurrent mode
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chih-Kang Chang <[email protected]>
[ Upstream commit 756b31203d482d2dd1aa6c208978b0410dc7530f ]
In concurrent mode, when STA interface is scanning, it causes AP interface TX beacon on wrong channel. We modified it to scan with the operating channel when one of the interfaces is already connected. Additionally, STA interface need to stop scan when AP interface is starting to avoid TX beacon on wrong channel. Finally, AP interface need to stop TX beacon when STA interface is scanning and switching to non-OP channel,This prevent other device to get beacons on wrong channel.
--- drivers/net/wireless/realtek/rtw89/fw.c | 17 +++++++++-- drivers/net/wireless/realtek/rtw89/mac.c | 29 +++++++++++++++---- drivers/net/wireless/realtek/rtw89/mac.h | 1 + drivers/net/wireless/realtek/rtw89/mac80211.c | 3 ++ 4 files changed, 43 insertions(+), 7 deletions(-)
drivers/net/wireless/realtek/rtw89/fw.c +15 -2
@@ -4043,6 +4043,7 @@ void rtw89_hw_scan_complete(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif,rtw89_core_scan_complete (rtwdev, vif, true);ieee80211_scan_completed (rtwdev->hw, &info);ieee80211_wake_queues (rtwdev->hw); +rtw89_mac_enable_beacon_for_ap_vifs (rtwdev, true);rtw89_release_pkt_list (rtwdev); rtwvif = (struct rtw89_vif *)vif->drv_priv;
@@ -4060,6 +4061,19 @@ void rtw89_hw_scan_abort(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif)rtw89_hw_scan_complete (rtwdev, vif, true); } +static bool rtw89_is_any_vif_connected_or_connecting (struct rtw89_dev *rtwdev) +{ +struct rtw89_vif *rtwvif; + +rtw89_for_each_rtwvif (rtwdev, rtwvif) { +/* This variable implies connected or during attempt to connect */ +if (!is_zero_ether_addr (rtwvif->bssid)) +return true; + } + +return false; +} +int rtw89_hw_scan_offload (struct rtw89_dev *rtwdev,struct ieee80211_vif *vif,bool enable) {
@@ -4072,8 +4086,7 @@ int rtw89_hw_scan_offload(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif,if (!rtwvif)return -EINVAL ; -/* This variable implies connected or during attempt to connect */ - connected = !is_zero_ether_addr (rtwvif->bssid); + connected =rtw89_is_any_vif_connected_or_connecting (rtwdev); opt.enable = enable; opt.target_ch_mode = connected;if (enable) {
drivers/net/wireless/realtek/rtw89/mac.c +24 -5
@@ -3916,12 +3916,10 @@ static void rtw89_mac_port_cfg_rx_sync(struct rtw89_dev *rtwdev, }static void rtw89_mac_port_cfg_tx_sw (struct rtw89_dev *rtwdev, -struct rtw89_vif *rtwvif) +struct rtw89_vif *rtwvif,bool en) {const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;const struct rtw89_port_reg *p = mac->port_base; -bool en = rtwvif->net_type ==RTW89_NET_TYPE_AP_MODE || - rtwvif->net_type ==RTW89_NET_TYPE_AD_HOC ;if (en)rtw89_write32_port_set (rtwdev, rtwvif, p->port_cfg,B_AX_BCNTX_EN );
@@ -3929,6 +3927,24 @@ static void rtw89_mac_port_cfg_tx_sw(struct rtw89_dev *rtwdev,rtw89_write32_port_clr (rtwdev, rtwvif, p->port_cfg,B_AX_BCNTX_EN ); } +static void rtw89_mac_port_cfg_tx_sw_by_nettype (struct rtw89_dev *rtwdev, +struct rtw89_vif *rtwvif) +{ +bool en = rtwvif->net_type ==RTW89_NET_TYPE_AP_MODE || + rtwvif->net_type ==RTW89_NET_TYPE_AD_HOC ; + +rtw89_mac_port_cfg_tx_sw (rtwdev, rtwvif, en); +} + +void rtw89_mac_enable_beacon_for_ap_vifs (struct rtw89_dev *rtwdev,bool en) +{ +struct rtw89_vif *rtwvif; + +rtw89_for_each_rtwvif (rtwdev, rtwvif) +if (rtwvif->net_type ==RTW89_NET_TYPE_AP_MODE ) +rtw89_mac_port_cfg_tx_sw (rtwdev, rtwvif, en); +} +static void rtw89_mac_port_cfg_bcn_intv (struct rtw89_dev *rtwdev,struct rtw89_vif *rtwvif) {
@@ -4235,7 +4251,7 @@ int rtw89_mac_port_update(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif)rtw89_mac_port_cfg_bcn_prct (rtwdev, rtwvif);rtw89_mac_port_cfg_rx_sw (rtwdev, rtwvif);rtw89_mac_port_cfg_rx_sync (rtwdev, rtwvif); -rtw89_mac_port_cfg_tx_sw (rtwdev, rtwvif); +rtw89_mac_port_cfg_tx_sw_by_nettype (rtwdev, rtwvif);rtw89_mac_port_cfg_bcn_intv (rtwdev, rtwvif);rtw89_mac_port_cfg_hiq_win (rtwdev, rtwvif);rtw89_mac_port_cfg_hiq_dtim (rtwdev, rtwvif);
@@ -4397,8 +4413,10 @@ rtw89_mac_c2h_scanofld_rsp(struct rtw89_dev *rtwdev, struct sk_buff *c2h,switch (reason) {case RTW89_SCAN_LEAVE_CH_NOTIFY : -if (rtw89_is_op_chan (rtwdev, band, chan)) +if (rtw89_is_op_chan (rtwdev, band, chan)) { +rtw89_mac_enable_beacon_for_ap_vifs (rtwdev, false);ieee80211_stop_queues (rtwdev->hw); + }return ;case RTW89_SCAN_END_SCAN_NOTIFY : if (rtwvif && rtwvif->scan_req &&
@@ -4416,6 +4434,7 @@ rtw89_mac_c2h_scanofld_rsp(struct rtw89_dev *rtwdev, struct sk_buff *c2h,if (rtw89_is_op_chan (rtwdev, band, chan)) {rtw89_assign_entity_chan (rtwdev, rtwvif->sub_entity_idx, &rtwdev->scan_info.op_chan); +rtw89_mac_enable_beacon_for_ap_vifs (rtwdev, true);ieee80211_wake_queues (rtwdev->hw); }else { rtw89_chan_create(&new, chan, chan, band,
drivers/net/wireless/realtek/rtw89/mac.h +1 -0
@@ -992,6 +992,7 @@ int rtw89_mac_port_get_tsf(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif,void rtw89_mac_set_he_obss_narrow_bw_ru (struct rtw89_dev *rtwdev,struct ieee80211_vif *vif);void rtw89_mac_stop_ap (struct rtw89_dev *rtwdev,struct rtw89_vif *rtwvif); +void rtw89_mac_enable_beacon_for_ap_vifs (struct rtw89_dev *rtwdev,bool en);int rtw89_mac_remove_vif (struct rtw89_dev *rtwdev,struct rtw89_vif *vif);int rtw89_mac_enable_bb_rf (struct rtw89_dev *rtwdev);int rtw89_mac_disable_bb_rf (struct rtw89_dev *rtwdev);
drivers/net/wireless/realtek/rtw89/mac80211.c +3 -0
@@ -477,6 +477,9 @@ static int rtw89_ops_start_ap(struct ieee80211_hw *hw,return -EOPNOTSUPP ; } +if (rtwdev->scanning) +rtw89_hw_scan_abort (rtwdev, rtwdev->scan_info.scanning_vif); +ether_addr_copy (rtwvif->bssid, vif->bss_conf.bssid);rtw89_cam_bssid_changed (rtwdev, rtwvif);rtw89_mac_port_update (rtwdev, rtwvif);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/353 bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Tao <[email protected]>
[ Upstream commit 169410eba271afc9f0fb476d996795aa26770c6d ]
These three bpf_map_{lookup,update,delete}_elem() helpers are also available for sleepable bpf program, so add the corresponding lock assertion for sleepable bpf program, otherwise the following warning will be reported when a sleepable bpf program manipulates bpf map under interpreter mode (aka bpf_jit_enable=0):
WARNING: CPU: 3 PID: 4985 at kernel/bpf/helpers.c:40 ...... CPU: 3 PID: 4985 Comm: test_progs Not tainted 6.6.0+ #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:bpf_map_lookup_elem+0x54/0x60 ...... Call Trace: <TASK> ? __warn+0xa5/0x240 ? bpf_map_lookup_elem+0x54/0x60 ? report_bug+0x1ba/0x1f0 ? handle_bug+0x40/0x80 ? exc_invalid_op+0x18/0x50 ? asm_exc_invalid_op+0x1b/0x20 ? __pfx_bpf_map_lookup_elem+0x10/0x10 ? rcu_lockdep_current_cpu_online+0x65/0xb0 ? rcu_is_watching+0x23/0x50 ? bpf_map_lookup_elem+0x54/0x60 ? __pfx_bpf_map_lookup_elem+0x10/0x10 ___bpf_prog_run+0x513/0x3b70 __bpf_prog_run32+0x9d/0xd0 ? __bpf_prog_enter_sleepable_recur+0xad/0x120 ? __bpf_prog_enter_sleepable_recur+0x3e/0x120 bpf_trampoline_6442580665+0x4d/0x1000 __x64_sys_getpgid+0x5/0x30 ? do_syscall_64+0x36/0xb0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK>
--- kernel/bpf/helpers.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
kernel/bpf/helpers.c +8 -5
@@ -32,12 +32,13 @@* * Different map implementations will rely on rcu in map methods * lookup/update/delete, therefore eBPF programs must run under rcu lock -* if program is allowed to access maps, so check rcu_read_lock_held in -* all three functions. +* if program is allowed to access maps, so check rcu_read_lock_held() or +* rcu_read_lock_trace_held() in all three functions. */ BPF_CALL_2(bpf_map_lookup_elem, struct bpf_map *, map, void *, key) { -WARN_ON_ONCE (!rcu_read_lock_held () && !rcu_read_lock_bh_held ()); +WARN_ON_ONCE (!rcu_read_lock_held () && !rcu_read_lock_trace_held () && + !rcu_read_lock_bh_held ());return (unsigned long ) map->ops->map_lookup_elem (map, key); }
@@ -53,7 +54,8 @@ const struct bpf_func_proto bpf_map_lookup_elem_proto = { BPF_CALL_4(bpf_map_update_elem, struct bpf_map *, map, void *, key, void *, value, u64, flags) { -WARN_ON_ONCE (!rcu_read_lock_held () && !rcu_read_lock_bh_held ()); +WARN_ON_ONCE (!rcu_read_lock_held () && !rcu_read_lock_trace_held () && + !rcu_read_lock_bh_held ());return map->ops->map_update_elem (map, key, value, flags); }
@@ -70,7 +72,8 @@ const struct bpf_func_proto bpf_map_update_elem_proto = { BPF_CALL_2(bpf_map_delete_elem, struct bpf_map *, map, void *, key) { -WARN_ON_ONCE (!rcu_read_lock_held () && !rcu_read_lock_bh_held ()); +WARN_ON_ONCE (!rcu_read_lock_held () && !rcu_read_lock_trace_held () && + !rcu_read_lock_bh_held ());return map->ops->map_delete_elem (map, key); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/353 bpf: Set need_defer as false when clearing fd array during map free
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Tao <[email protected]>
[ Upstream commit 79d93b3c6ffd79abcd8e43345980aa1e904879c4 ]
Both map deletion operation, map release and map free operation use fd_array_map_delete_elem() to remove the element from fd array and need_defer is always true in fd_array_map_delete_elem(). For the map deletion operation and map release operation, need_defer=true is necessary, because the bpf program, which accesses the element in fd array, may still alive. However for map free operation, it is certain that the bpf program which owns the fd array has already been exited, so setting need_defer as false is appropriate for map free operation.
So fix it by adding need_defer parameter to bpf_fd_array_map_clear() and adding a new helper __fd_array_map_delete_elem() to handle the map deletion, map release and map free operations correspondingly.
--- kernel/bpf/arraymap.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
kernel/bpf/arraymap.c +14 -9
@@ -871,7 +871,7 @@ int bpf_fd_array_map_update_elem(struct bpf_map *map, struct file *map_file,return 0 ; } -static long fd_array_map_delete_elem (struct bpf_map *map,void *key) +static long __fd_array_map_delete_elem (struct bpf_map *map,void *key,bool need_defer) { struct bpf_array *array = container_of(map, struct bpf_array, map);void *old_ptr;
@@ -890,13 +890,18 @@ static long fd_array_map_delete_elem(struct bpf_map *map, void *key) }if (old_ptr) { - map->ops->map_fd_put_ptr (map, old_ptr, true); + map->ops->map_fd_put_ptr (map, old_ptr, need_defer);return 0 ; }else {return -ENOENT ; } } +static long fd_array_map_delete_elem (struct bpf_map *map,void *key) +{ +return __fd_array_map_delete_elem (map, key, true); +} +static void *prog_fd_array_get_ptr (struct bpf_map *map,struct file *map_file,int fd) {
@@ -925,13 +930,13 @@ static u32 prog_fd_array_sys_lookup_elem(void *ptr) }/* decrement refcnt of all bpf_progs that are stored in this map */ -static void bpf_fd_array_map_clear (struct bpf_map *map) +static void bpf_fd_array_map_clear (struct bpf_map *map,bool need_defer) { struct bpf_array *array = container_of(map, struct bpf_array, map);int i;for (i =0 ; i < array->map.max_entries; i++) -fd_array_map_delete_elem (map, &i); +__fd_array_map_delete_elem (map, &i, need_defer); } static void prog_array_map_seq_show_elem(struct bpf_map *map, void *key,
@@ -1072,7 +1077,7 @@ static void prog_array_map_clear_deferred(struct work_struct *work) { struct bpf_map *map = container_of(work, struct bpf_array_aux, work)->map; -bpf_fd_array_map_clear (map); +bpf_fd_array_map_clear (map, true);bpf_map_put (map); }
@@ -1222,7 +1227,7 @@ static void perf_event_fd_array_release(struct bpf_map *map,for (i =0 ; i < array->map.max_entries; i++) { ee =READ_ONCE (array->ptrs[i]);if (ee && ee->map_file == map_file) -fd_array_map_delete_elem (map, &i); +__fd_array_map_delete_elem (map, &i, true); }rcu_read_unlock (); }
@@ -1230,7 +1235,7 @@ static void perf_event_fd_array_release(struct bpf_map *map,static void perf_event_fd_array_map_free (struct bpf_map *map) {if (map->map_flags &BPF_F_PRESERVE_ELEMS ) -bpf_fd_array_map_clear (map); +bpf_fd_array_map_clear (map, false);fd_array_map_free (map); }
@@ -1266,7 +1271,7 @@ static void cgroup_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_destatic void cgroup_fd_array_free (struct bpf_map *map) { -bpf_fd_array_map_clear (map); +bpf_fd_array_map_clear (map, false);fd_array_map_free (map); }
@@ -1311,7 +1316,7 @@ static void array_of_map_free(struct bpf_map *map)* is protected by fdget/fdput. */ bpf_map_meta_free (map->inner_map_meta); -bpf_fd_array_map_clear (map); +bpf_fd_array_map_clear (map, false);fd_array_map_free (map); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/353 wifi: ath12k: fix and enable AP mode for WCN7850
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kang Yang <[email protected]>
[ Upstream commit ed7e818a7b501012038d6bc6fedadaf7375a380a ]
For AP mode, the peer is created earlier in ath12k_mac_op_add_interface() but ath12k_mac_op_assign_vif_chanctx() will try to create peer again. Then an error will return which makes AP mode startup fail.
Kernel log:
[ 5017.665006] ath12k_pci 0000:04:00.0: failed to create peer after vdev start delay: -22
wpa_supplicant log:
Failed to set beacon parameters
Interface initialization failed
wls1: interface state UNINITIALIZED->DISABLED
wls1: AP-DISABLED
wls1: Unable to setup interface.
Failed to initialize AP interface
wls1: interface state DISABLED->DISABLED
wls1: AP-DISABLED
So fix this check and enable AP mode for WCN7850, as now AP mode works normally.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4
--- drivers/net/wireless/ath/ath12k/hw.c | 3 ++- drivers/net/wireless/ath/ath12k/mac.c | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath12k/hw.c +2 -1
@@ -949,7 +949,8 @@ static const struct ath12k_hw_params ath12k_hw_params[] = { .rx_mac_buf_ring = true, .vdev_start_delay = true, - .interface_modes = BIT(NL80211_IFTYPE_STATION), + .interface_modes =BIT (NL80211_IFTYPE_STATION ) | + BIT(NL80211_IFTYPE_AP), .supports_monitor = false, .idle_ps = true,
drivers/net/wireless/ath/ath12k/mac.c +2 -2
@@ -6380,8 +6380,8 @@ ath12k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw, }if (ab->hw_params->vdev_start_delay && - (arvif->vdev_type ==WMI_VDEV_TYPE_AP || - arvif->vdev_type ==WMI_VDEV_TYPE_MONITOR )) { + arvif->vdev_type !=WMI_VDEV_TYPE_AP && + arvif->vdev_type !=WMI_VDEV_TYPE_MONITOR ) { param.vdev_id = arvif->vdev_id; param.peer_type =WMI_PEER_TYPE_DEFAULT ; param.peer_addr = ar->mac_addr;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/353 scsi: libfc: Dont schedule abort twice
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Reinecke <[email protected]>
[ Upstream commit b57c4db5d23b9df0118a25e2441c9288edd73710 ]
The current FC error recovery is sending up to three REC (recovery) frames in 10 second intervals, and as a final step sending an ABTS after 30 seconds for the command itself. Unfortunately sending an ABTS is also the action for the SCSI abort handler, and the default timeout for SCSI commands is also 30 seconds. This causes two ABTS to be scheduled, with the libfc one slightly earlier. The ABTS scheduled by SCSI EH then sees the command to be already aborted, and will always return with a 'GOOD' status irrespective on the actual result from the first ABTS. This causes the SCSI EH abort handler to always succeed, and SCSI EH never to be engaged. Fix this by not issuing an ABTS when a SCSI command is present for the exchange, but rather wait for the abort scheduled from SCSI EH. And warn if an abort is already scheduled to avoid similar errors in the future.
--- drivers/scsi/libfc/fc_fcp.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
drivers/scsi/libfc/fc_fcp.c +11 -5
@@ -265,6 +265,11 @@ static int fc_fcp_send_abort(struct fc_fcp_pkt *fsp)if (!fsp->seq_ptr)return -EINVAL ; +if (fsp->state &FC_SRB_ABORT_PENDING ) { +FC_FCP_DBG (fsp,"abort already pending\n" ); +return -EBUSY ; + } +this_cpu_inc (fsp->lp->stats->FcpPktAborts); fsp->state |=FC_SRB_ABORT_PENDING ;
@@ -1690,11 +1695,12 @@ static void fc_fcp_recovery(struct fc_fcp_pkt *fsp, u8 code) fsp->status_code = code; fsp->cdb_status =0 ; fsp->io_status =0 ; -/* -* if this fails then we let the scsi command timer fire and -* scsi-ml escalate. -*/ -fc_fcp_send_abort (fsp); +if (!fsp->cmd) +/* +* Only abort non-scsi commands; otherwise let the +* scsi command timer fire and scsi-ml escalate. +*/ +fc_fcp_send_abort (fsp); }/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/353 scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Reinecke <[email protected]>
[ Upstream commit 53122a49f49796beb2c4a1bb702303b66347e29f ]
We should set the status to FC_TIMED_OUT when a timeout error is passed to fc_fcp_rec_error().
--- drivers/scsi/libfc/fc_fcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/libfc/fc_fcp.c +1 -1
@@ -1676,7 +1676,7 @@ static void fc_fcp_rec_error(struct fc_fcp_pkt *fsp, struct fc_frame *fp)if (fsp->recov_retry++ <FC_MAX_RECOV_RETRY )fc_fcp_rec (fsp);else -fc_fcp_recovery (fsp,FC_ERROR ); +fc_fcp_recovery (fsp,FC_TIMED_OUT );break ; }fc_fcp_unlock_pkt (fsp);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/353 net: mvmdio: Avoid excessive sleeps in polled mode
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Waldekranz <[email protected]>
[ Upstream commit 7dd12fe34686d89c332b1a05104d18d728591f0a ]
Before this change, when operating in polled mode, i.e. no IRQ is available, every individual C45 access would be hit with a 150us sleep after the bus access.
For example, on a board with a CN9130 SoC connected to an MV88X3310 PHY, a single C45 read would take around 165us:
root@infix:~$ mdio f212a600.mdio-mii mmd 4:1 bench 0xc003
Performed 1000 reads in 165msBy replacing the long sleep with a tighter poll loop, we observe a 10x increase in bus throughput:
root@infix:~$ mdio f212a600.mdio-mii mmd 4:1 bench 0xc003
Performed 1000 reads in 15ms--- drivers/net/ethernet/marvell/mvmdio.c | 53 ++++++++------------------- 1 file changed, 16 insertions(+), 37 deletions(-)
drivers/net/ethernet/marvell/mvmdio.c +16 -37
@@ -23,6 +23,7 @@#include <linux/delay.h> #include <linux/interrupt.h> #include <linux/io.h> +#include <linux/iopoll.h> #include <linux/kernel.h> #include <linux/mod_devicetable.h> #include <linux/module.h>
@@ -58,11 +59,6 @@* - Armada 370 (Globalscale Mirabox): 41us to 43us (Polled) */ #define MVMDIO_SMI_TIMEOUT 1000/* 1000us = 1ms */ -#define MVMDIO_SMI_POLL_INTERVAL_MIN 45 -#define MVMDIO_SMI_POLL_INTERVAL_MAX 55 - -#define MVMDIO_XSMI_POLL_INTERVAL_MIN 150 -#define MVMDIO_XSMI_POLL_INTERVAL_MAX 160struct orion_mdio_dev {void __iomem *regs;
@@ -84,8 +80,6 @@ enum orion_mdio_bus_type {struct orion_mdio_ops {int (*is_done)(struct orion_mdio_dev *); -unsigned int poll_interval_min; -unsigned int poll_interval_max; };/* Wait for the SMI unit to be ready for another operation
@@ -94,34 +88,23 @@ static int orion_mdio_wait_ready(const struct orion_mdio_ops *ops, struct mii_bus *bus) {struct orion_mdio_dev *dev = bus->priv; -unsigned long timeout =usecs_to_jiffies (MVMDIO_SMI_TIMEOUT ); -unsigned long end = jiffies + timeout; -int timedout =0 ; +unsigned long timeout; +int done; -while (1 ) { -if (ops->is_done (dev)) +if (dev->err_interrupt <=0 ) { +if (!read_poll_timeout_atomic (ops->is_done, done, done,2 , +MVMDIO_SMI_TIMEOUT , false, dev)) +return 0 ; + }else { +/* wait_event_timeout does not guarantee a delay of at +* least one whole jiffie, so timeout must be no less +* than two. +*/ + timeout =max (usecs_to_jiffies (MVMDIO_SMI_TIMEOUT ),2 ); + +if (wait_event_timeout (dev->smi_busy_wait, + ops->is_done (dev), timeout))return 0 ; -else if (timedout) -break ; - -if (dev->err_interrupt <=0 ) { -usleep_range (ops->poll_interval_min, - ops->poll_interval_max); - -if (time_is_before_jiffies (end)) - ++timedout; - }else { -/* wait_event_timeout does not guarantee a delay of at -* least one whole jiffie, so timeout must be no less -* than two. -*/ -if (timeout <2 ) - timeout =2 ; -wait_event_timeout (dev->smi_busy_wait, - ops->is_done (dev), timeout); - - ++timedout; - } }dev_err (bus->parent,"Timeout: SMI busy for too long\n" );
@@ -135,8 +118,6 @@ static int orion_mdio_smi_is_done(struct orion_mdio_dev *dev)static const struct orion_mdio_ops orion_mdio_smi_ops = { .is_done = orion_mdio_smi_is_done, - .poll_interval_min =MVMDIO_SMI_POLL_INTERVAL_MIN , - .poll_interval_max =MVMDIO_SMI_POLL_INTERVAL_MAX , }; static int orion_mdio_smi_read(struct mii_bus *bus, int mii_id,
@@ -194,8 +175,6 @@ static int orion_mdio_xsmi_is_done(struct orion_mdio_dev *dev)static const struct orion_mdio_ops orion_mdio_xsmi_ops = { .is_done = orion_mdio_xsmi_is_done, - .poll_interval_min =MVMDIO_XSMI_POLL_INTERVAL_MIN , - .poll_interval_max =MVMDIO_XSMI_POLL_INTERVAL_MAX , }; static int orion_mdio_xsmi_read_c45(struct mii_bus *bus, int mii_id,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/353 arm64: dts: qcom: sm8550: fix soundwire controllers node name
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neil Armstrong <[email protected]>
[ Upstream commit 07c88da81caf0e72c3690b689d30f0d325cfeff4 ]
Fix the following dt bindings check:arch/arm64/boot/dts/qcom/sm8550-mtp.dtb: soundwire-controller@6ab0000: $nodename:0: 'soundwire-controller@6ab0000' does not match '^soundwire(@.*)?$' from schema $id: http://devicetree.org/schemas/soundwire/qcom,soundwire.yaml#
--- arch/arm64/boot/dts/qcom/sm8550.dtsi | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/qcom/sm8550.dtsi +4 -4
@@ -2060,7 +2060,7 @@ #sound-dai-cells = <1>; }; - swr3: soundwire-controller@6ab0000 { + swr3: soundwire@6ab0000 { compatible = "qcom,soundwire-v2.0.0"; reg = <0 0x06ab0000 0 0x10000>; interrupts = <GIC_SPI 171 IRQ_TYPE_LEVEL_HIGH>;
@@ -2106,7 +2106,7 @@ #sound-dai-cells = <1>; }; - swr1: soundwire-controller@6ad0000 { + swr1: soundwire@6ad0000 { compatible = "qcom,soundwire-v2.0.0"; reg = <0 0x06ad0000 0 0x10000>; interrupts = <GIC_SPI 155 IRQ_TYPE_LEVEL_HIGH>;
@@ -2171,7 +2171,7 @@ #sound-dai-cells = <1>; }; - swr0: soundwire-controller@6b10000 { + swr0: soundwire@6b10000 { compatible = "qcom,soundwire-v2.0.0"; reg = <0 0x06b10000 0 0x10000>; interrupts = <GIC_SPI 170 IRQ_TYPE_LEVEL_HIGH>;
@@ -2198,7 +2198,7 @@ status = "disabled"; }; - swr2: soundwire-controller@6d30000 { + swr2: soundwire@6d30000 { compatible = "qcom,soundwire-v2.0.0"; reg = <0 0x06d30000 0 0x10000>; interrupts = <GIC_SPI 496 IRQ_TYPE_LEVEL_HIGH>,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/353 arm64: dts: qcom: sm8450: fix soundwire controllers node name
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neil Armstrong <[email protected]>
[ Upstream commit 11fcb81373de52eeb1d3ff135a8d24a4b18978d3 ]
Fix the following dt bindings check:arch/arm64/boot/dts/qcom/sm8450-hdk.dtb: soundwire-controller@31f0000: $nodename:0: 'soundwire-controller@31f0000' does not match '^soundwire(@.*)?$'
from schema $id: http://devicetree.org/schemas/soundwire/qcom,soundwire.yaml#
--- arch/arm64/boot/dts/qcom/sm8450.dtsi | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/qcom/sm8450.dtsi +4 -4
@@ -2160,7 +2160,7 @@ #sound-dai-cells = <1>; }; - swr4: soundwire-controller@31f0000 { + swr4: soundwire@31f0000 { compatible = "qcom,soundwire-v1.7.0"; reg = <0 0x031f0000 0 0x2000>; interrupts = <GIC_SPI 171 IRQ_TYPE_LEVEL_HIGH>;
@@ -2208,7 +2208,7 @@ #sound-dai-cells = <1>; }; - swr1: soundwire-controller@3210000 { + swr1: soundwire@3210000 { compatible = "qcom,soundwire-v1.7.0"; reg = <0 0x03210000 0 0x2000>; interrupts = <GIC_SPI 155 IRQ_TYPE_LEVEL_HIGH>;
@@ -2275,7 +2275,7 @@ #sound-dai-cells = <1>; }; - swr0: soundwire-controller@3250000 { + swr0: soundwire@3250000 { compatible = "qcom,soundwire-v1.7.0"; reg = <0 0x03250000 0 0x2000>; interrupts = <GIC_SPI 170 IRQ_TYPE_LEVEL_HIGH>;
@@ -2302,7 +2302,7 @@ status = "disabled"; }; - swr2: soundwire-controller@33b0000 { + swr2: soundwire@33b0000 { compatible = "qcom,soundwire-v1.7.0"; reg = <0 0x033b0000 0 0x2000>; interrupts = <GIC_SPI 496 IRQ_TYPE_LEVEL_HIGH>,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/353 arm64: dts: qcom: sm8350: Fix remoteproc interrupt type
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nia Espera <[email protected]>
[ Upstream commit 54ee322f845c7f25fbf6e43e11147b6cae8eff56 ]
In a similar vein to
https://lore.kernel.org/lkml/[email protected]/,
the remote processors on sm8350 fail to initialize with the 'correct' (i.e., specified in downstream) IRQ type. Change this to EDGE_RISING.
--- arch/arm64/boot/dts/qcom/sm8350.dtsi | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/qcom/sm8350.dtsi +4 -4
@@ -2021,7 +2021,7 @@ compatible = "qcom,sm8350-mpss-pas"; reg = <0x0 0x04080000 0x0 0x4040>; - interrupts-extended = <&intc GIC_SPI 264 IRQ_TYPE_LEVEL_HIGH>, + interrupts-extended = <&intc GIC_SPI 264 IRQ_TYPE_EDGE_RISING>, <&smp2p_modem_in 0 IRQ_TYPE_EDGE_RISING>, <&smp2p_modem_in 1 IRQ_TYPE_EDGE_RISING>, <&smp2p_modem_in 2 IRQ_TYPE_EDGE_RISING>,
@@ -2063,7 +2063,7 @@ compatible = "qcom,sm8350-slpi-pas"; reg = <0 0x05c00000 0 0x4000>; - interrupts-extended = <&pdc 9 IRQ_TYPE_LEVEL_HIGH>, + interrupts-extended = <&pdc 9 IRQ_TYPE_EDGE_RISING>, <&smp2p_slpi_in 0 IRQ_TYPE_EDGE_RISING>, <&smp2p_slpi_in 1 IRQ_TYPE_EDGE_RISING>, <&smp2p_slpi_in 2 IRQ_TYPE_EDGE_RISING>,
@@ -3207,7 +3207,7 @@ compatible = "qcom,sm8350-adsp-pas"; reg = <0 0x17300000 0 0x100>; - interrupts-extended = <&pdc 6 IRQ_TYPE_LEVEL_HIGH>, + interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>, <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>, <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>, <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>,
@@ -3512,7 +3512,7 @@ compatible = "qcom,sm8350-cdsp-pas"; reg = <0 0x98900000 0 0x1400000>; - interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_LEVEL_HIGH>, + interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>, <&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>, <&smp2p_cdsp_in 1 IRQ_TYPE_EDGE_RISING>, <&smp2p_cdsp_in 2 IRQ_TYPE_EDGE_RISING>,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/353 wifi: mt76: connac: fix EHT phy mode check
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: MeiChia Chiu <[email protected]>
[ Upstream commit 2c2f50bf6407e1fd43a1a257916aeaa5ffdacd6c ]
Add a BSS eht_support check before returning EHT phy mode. Without this patch, there might be an inconsistency where the softmac layer thinks the BSS is in HE mode, while the FW thinks it is in EHT mode.
--- drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c +1 -1
@@ -1359,7 +1359,7 @@ u8 mt76_connac_get_phy_mode_ext(struct mt76_phy *phy, struct ieee80211_vif *vif, sband = phy->hw->wiphy->bands[band]; eht_cap =ieee80211_get_eht_iftype_cap (sband, vif->type); -if (!eht_cap || !eht_cap->has_eht) +if (!eht_cap || !eht_cap->has_eht || !vif->bss_conf.eht_support)return mode;switch (band) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/353 wifi: mt76: mt7996: add PCI IDs for mt7992
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: StanleyYP Wang <[email protected]>
[ Upstream commit 3d3f117a259a65353bf2714a18e25731b3ca5770 ]
Add PCI device IDs to enable mt7992 chipsets support.
--- drivers/net/wireless/mediatek/mt76/mt7996/pci.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/pci.c +6 -2
@@ -17,11 +17,13 @@ static u32 hif_idx;static const struct pci_device_id mt7996_pci_device_table[] = { {PCI_DEVICE (PCI_VENDOR_ID_MEDIATEK ,0x7990 ) }, + {PCI_DEVICE (PCI_VENDOR_ID_MEDIATEK ,0x7992 ) }, { }, };static const struct pci_device_id mt7996_hif_device_table[] = { {PCI_DEVICE (PCI_VENDOR_ID_MEDIATEK ,0x7991 ) }, + {PCI_DEVICE (PCI_VENDOR_ID_MEDIATEK ,0x799a ) }, { }, };
@@ -60,7 +62,9 @@ static void mt7996_put_hif2(struct mt7996_hif *hif)static struct mt7996_hif *mt7996_pci_init_hif2 (struct pci_dev *pdev) { hif_idx++; -if (!pci_get_device (PCI_VENDOR_ID_MEDIATEK ,0x7991 ,NULL )) + +if (!pci_get_device (PCI_VENDOR_ID_MEDIATEK ,0x7991 ,NULL ) && + !pci_get_device (PCI_VENDOR_ID_MEDIATEK ,0x799a ,NULL ))return NULL ; writel(hif_idx | MT_PCIE_RECOG_ID_SEM,
@@ -113,7 +117,7 @@ static int mt7996_pci_probe(struct pci_dev *pdev,mt76_pci_disable_aspm (pdev); -if (id->device ==0x7991 ) +if (id->device ==0x7991 || id->device ==0x799a )return mt7996_pci_hif2_probe (pdev); dev = mt7996_mmio_probe(&pdev->dev, pcim_iomap_table(pdev)[0],
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/353 bpf: Set uattr->batch.count as zero before batched update or deletion
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Tao <[email protected]>
[ Upstream commit 06e5c999f10269a532304e89a6adb2fbfeb0593c ]
generic_map_{delete,update}_batch() doesn't set uattr->batch.count as zero before it tries to allocate memory for key. If the memory allocation fails, the value of uattr->batch.count will be incorrect.
Fix it by setting uattr->batch.count as zero beore batched update or deletion.
--- kernel/bpf/syscall.c | 6 ++++++ 1 file changed, 6 insertions(+)
kernel/bpf/syscall.c +6 -0
@@ -1702,6 +1702,9 @@ int generic_map_delete_batch(struct bpf_map *map,if (!max_count)return 0 ; +if (put_user (0 , &uattr->batch.count)) +return -EFAULT ; + key =kvmalloc (map->key_size,GFP_USER | __GFP_NOWARN);if (!key)return -ENOMEM ;
@@ -1759,6 +1762,9 @@ int generic_map_update_batch(struct bpf_map *map, struct file *map_file,if (!max_count)return 0 ; +if (put_user (0 , &uattr->batch.count)) +return -EFAULT ; + key =kvmalloc (map->key_size,GFP_USER | __GFP_NOWARN);if (!key)return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/353 wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap()
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit fe0a7776d4d19e613bb8dd80fe2d78ae49e8b49d ]
Since 'ieee80211_beacon_get()' can return NULL, 'wfx_set_mfp_ap()' should check the return value before examining skb data. So convert the latter to return an appropriate error code and propagate it to return from 'wfx_start_ap()' as well. Compile tested only.
--- drivers/net/wireless/silabs/wfx/sta.c | 42 ++++++++++++++++----------- 1 file changed, 25 insertions(+), 17 deletions(-)
drivers/net/wireless/silabs/wfx/sta.c +25 -17
@@ -336,29 +336,38 @@ static int wfx_upload_ap_templates(struct wfx_vif *wvif)return 0 ; } -static void wfx_set_mfp_ap (struct wfx_vif *wvif) +static int wfx_set_mfp_ap (struct wfx_vif *wvif) {struct ieee80211_vif *vif =wvif_to_vif (wvif);struct sk_buff *skb =ieee80211_beacon_get (wvif->wdev->hw, vif,0 ); const int ieoffset = offsetof(struct ieee80211_mgmt, u.beacon.variable); -const u16 *ptr = (u16 *)cfg80211_find_ie (WLAN_EID_RSN , skb->data + ieoffset, - skb->len - ieoffset);const int pairwise_cipher_suite_count_offset =8 /sizeof (u16);const int pairwise_cipher_suite_size =4 /sizeof (u16);const int akm_suite_size =4 /sizeof (u16); +const u16 *ptr; -if (ptr) { - ptr += pairwise_cipher_suite_count_offset; -if (WARN_ON (ptr > (u16 *)skb_tail_pointer (skb))) -return ; - ptr +=1 + pairwise_cipher_suite_size * *ptr; -if (WARN_ON (ptr > (u16 *)skb_tail_pointer (skb))) -return ; - ptr +=1 + akm_suite_size * *ptr; -if (WARN_ON (ptr > (u16 *)skb_tail_pointer (skb))) -return ; -wfx_hif_set_mfp (wvif, *ptr &BIT (7 ), *ptr &BIT (6 )); - } +if (unlikely (!skb)) +return -ENOMEM ; + + ptr = (u16 *)cfg80211_find_ie (WLAN_EID_RSN , skb->data + ieoffset, + skb->len - ieoffset); +if (unlikely (!ptr)) +return -EINVAL ; + + ptr += pairwise_cipher_suite_count_offset; +if (WARN_ON (ptr > (u16 *)skb_tail_pointer (skb))) +return -EINVAL ; + + ptr +=1 + pairwise_cipher_suite_size * *ptr; +if (WARN_ON (ptr > (u16 *)skb_tail_pointer (skb))) +return -EINVAL ; + + ptr +=1 + akm_suite_size * *ptr; +if (WARN_ON (ptr > (u16 *)skb_tail_pointer (skb))) +return -EINVAL ; + +wfx_hif_set_mfp (wvif, *ptr &BIT (7 ), *ptr &BIT (6 )); +return 0 ; } int wfx_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -376,8 +385,7 @@ int wfx_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif, ret =wfx_hif_start (wvif, &vif->bss_conf, wvif->channel);if (ret >0 )return -EIO ; -wfx_set_mfp_ap (wvif); -return ret; +return wfx_set_mfp_ap (wvif); } void wfx_stop_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/353 wifi: ath12k: fix the issue that the multicast/broadcast indicator is not read correctly for WCN7850
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lingbo Kong <[email protected]>
[ Upstream commit 7133b072dfbfac8763ffb017642c9c894894c50d ]
We observe some packets are discarded in ieee80211_rx_handlers_result function for WCN7850. This is because the way to get multicast/broadcast indicator with RX_MSDU_END_INFO5_DA_IS_MCBC & info5 is incorrect. It should use RX_MSDU_END_INFO13_MCAST_BCAST & info13 to get multicast/broadcast indicator.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4
--- drivers/net/wireless/ath/ath12k/hal.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath12k/hal.c +2 -2
@@ -889,8 +889,8 @@ static u8 *ath12k_hw_wcn7850_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc)static bool ath12k_hw_wcn7850_rx_desc_is_da_mcbc (struct hal_rx_desc *desc) { -return __le16_to_cpu (desc->u.wcn7850.msdu_end.info5) & -RX_MSDU_END_INFO5_DA_IS_MCBC ; +return __le32_to_cpu (desc->u.wcn7850.msdu_end.info13) & +RX_MSDU_END_INFO13_MCAST_BCAST ; } static void ath12k_hw_wcn7850_rx_desc_get_dot11_hdr(struct hal_rx_desc *desc,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/353 ARM: dts: rockchip: fix rk3036 hdmi ports node
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Jonker <[email protected]>
[ Upstream commit 27ded76ef0fcfcf939914532aae575cf23c221b4 ]
Fix hdmi ports node so that it matches the
rockchip,inno-hdmi.yaml binding.
--- arch/arm/boot/dts/rockchip/rk3036.dtsi | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
arch/arm/boot/dts/rockchip/rk3036.dtsi +11 -3
@@ -402,12 +402,20 @@ pinctrl-0 = <&hdmi_ctl>; status = "disabled"; - hdmi_in: port { + ports { #address-cells = <1>; #size-cells = <0>; - hdmi_in_vop: endpoint@0 { + + hdmi_in: port@0 { reg = <0>; - remote-endpoint = <&vop_out_hdmi>; + + hdmi_in_vop: endpoint { + remote-endpoint = <&vop_out_hdmi>; + }; + }; + + hdmi_out: port@1 { + reg = <1>; }; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/353 ARM: dts: imx25/27-eukrea: Fix RTC node name
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit 68c711b882c262e36895547cddea2c2d56ce611d ]
Node names should be generic. Use 'rtc' as node name to fix the following dt-schema warning:
imx25-eukrea-mbimxsd25-baseboard.dtb: pcf8563@51: $nodename:0: 'pcf8563@51' does not match '^rtc(@.*|-([0-9]|[1-9][0-9]+))?$'
from schema $id: http://devicetree.org/schemas/rtc/nxp,pcf8563.yaml#
--- arch/arm/boot/dts/nxp/imx/imx25-eukrea-cpuimx25.dtsi | 2 +- arch/arm/boot/dts/nxp/imx/imx27-eukrea-cpuimx27.dtsi | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/nxp/imx/imx25-eukrea-cpuimx25.dtsi +1 -1
@@ -27,7 +27,7 @@ pinctrl-0 = <&pinctrl_i2c1>; status = "okay"; - pcf8563@51 { + rtc@51 { compatible = "nxp,pcf8563"; reg = <0x51>; };
arch/arm/boot/dts/nxp/imx/imx27-eukrea-cpuimx27.dtsi +1 -1
@@ -33,7 +33,7 @@ pinctrl-0 = <&pinctrl_i2c1>; status = "okay"; - pcf8563@51 { + rtc@51 { compatible = "nxp,pcf8563"; reg = <0x51>; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/353 ARM: dts: imx: Use flash@0,0 pattern
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit 1e1d7cc478fb16816de09740e3c323c0c188d58f ]
Per mtd-physmap.yaml, 'nor@0,0' is not a valid node pattern.
Change it to 'flash@0,0' to fix the following dt-schema warning:
imx1-ads.dtb: nor@0,0: $nodename:0: 'nor@0,0' does not match '^(flash|.*sram|nand)(@.*)?$'
from schema $id: http://devicetree.org/schemas/mtd/mtd-physmap.yaml#
--- arch/arm/boot/dts/nxp/imx/imx1-ads.dts | 2 +- arch/arm/boot/dts/nxp/imx/imx1-apf9328.dts | 2 +- arch/arm/boot/dts/nxp/imx/imx27-eukrea-cpuimx27.dtsi | 2 +- arch/arm/boot/dts/nxp/imx/imx27-phytec-phycore-som.dtsi | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-)
arch/arm/boot/dts/nxp/imx/imx1-ads.dts +1 -1
@@ -65,7 +65,7 @@ pinctrl-0 = <&pinctrl_weim>; status = "okay"; - nor: nor@0,0 { + nor: flash@0,0 { compatible = "cfi-flash"; reg = <0 0x00000000 0x02000000>; bank-width = <4>;
arch/arm/boot/dts/nxp/imx/imx1-apf9328.dts +1 -1
@@ -45,7 +45,7 @@ pinctrl-0 = <&pinctrl_weim>; status = "okay"; - nor: nor@0,0 { + nor: flash@0,0 { compatible = "cfi-flash"; reg = <0 0x00000000 0x02000000>; bank-width = <2>;
arch/arm/boot/dts/nxp/imx/imx27-eukrea-cpuimx27.dtsi +1 -1
@@ -90,7 +90,7 @@ &weim { status = "okay"; - nor: nor@0,0 { + nor: flash@0,0 { #address-cells = <1>; #size-cells = <1>; compatible = "cfi-flash";
arch/arm/boot/dts/nxp/imx/imx27-phytec-phycore-som.dtsi +1 -1
@@ -314,7 +314,7 @@ &weim { status = "okay"; - nor: nor@0,0 { + nor: flash@0,0 { compatible = "cfi-flash"; reg = <0 0x00000000 0x02000000>; bank-width = <2>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/353 ARM: dts: imx27: Fix sram node
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit 2fb7b2a2f06bb3f8321cf26c33e4e820c5b238b6 ]
Per sram.yaml, address-cells, size-cells and ranges are mandatory.
Pass them to fix the following dt-schema warnings:
--- arch/arm/boot/dts/nxp/imx/imx27.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm/boot/dts/nxp/imx/imx27.dtsi +3 -0
@@ -588,6 +588,9 @@ iram: sram@ffff4c00 { compatible = "mmio-sram"; reg = <0xffff4c00 0xb400>; + ranges = <0 0xffff4c00 0xb400>; + #address-cells = <1>; + #size-cells = <1>; }; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/353 ARM: dts: imx1: Fix sram node
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit c248e535973088ba7071ff6f26ab7951143450af ]
Per sram.yaml, address-cells, size-cells and ranges are mandatory.
The node name should be sram.
Change the node name and pass the required properties to fix the following dt-schema warnings:
imx1-apf9328.dtb: esram@300000: $nodename:0: 'esram@300000' does not match '^sram(@.*)?'
from schema $id: http://devicetree.org/schemas/sram/sram.yaml#
imx1-apf9328.dtb: esram@300000: '#address-cells' is a required property
from schema $id: http://devicetree.org/schemas/sram/sram.yaml#
imx1-apf9328.dtb: esram@300000: '#size-cells' is a required property
from schema $id: http://devicetree.org/schemas/sram/sram.yaml#
imx1-apf9328.dtb: esram@300000: 'ranges' is a required property
from schema $id: http://devicetree.org/schemas/sram/sram.yaml#
--- arch/arm/boot/dts/nxp/imx/imx1.dtsi | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/arm/boot/dts/nxp/imx/imx1.dtsi +4 -1
@@ -268,9 +268,12 @@ status = "disabled"; }; - esram: esram@300000 { + esram: sram@300000 { compatible = "mmio-sram"; reg = <0x00300000 0x20000>; + ranges = <0 0x00300000 0x20000>; + #address-cells = <1>; + #size-cells = <1>; }; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/353 net: phy: at803x: fix passing the wrong reference for config_intr
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Marangi <[email protected]>
[ Upstream commit f8fdbf3389f44c7026f16e36cb1f2ff017f7f5b2 ]
Fix passing the wrong reference for config_initr on passing the function pointer, drop the wrong & from at803x_config_intr in the PHY struct.
--- drivers/net/phy/at803x.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/phy/at803x.c +3 -3
@@ -2104,7 +2104,7 @@ static struct phy_driver at803x_driver[] = { .write_page = at803x_write_page, .get_features = at803x_get_features, .read_status = at803x_read_status, - .config_intr = &at803x_config_intr, + .config_intr = at803x_config_intr, .handle_interrupt = at803x_handle_interrupt, .get_tunable = at803x_get_tunable, .set_tunable = at803x_set_tunable,
@@ -2134,7 +2134,7 @@ static struct phy_driver at803x_driver[] = { .resume = at803x_resume, .flags = PHY_POLL_CABLE_TEST,/* PHY_BASIC_FEATURES */ - .config_intr = &at803x_config_intr, + .config_intr = at803x_config_intr, .handle_interrupt = at803x_handle_interrupt, .cable_test_start = at803x_cable_test_start, .cable_test_get_status = at803x_cable_test_get_status,
@@ -2150,7 +2150,7 @@ static struct phy_driver at803x_driver[] = { .resume = at803x_resume, .flags = PHY_POLL_CABLE_TEST,/* PHY_BASIC_FEATURES */ - .config_intr = &at803x_config_intr, + .config_intr = at803x_config_intr, .handle_interrupt = at803x_handle_interrupt, .cable_test_start = at803x_cable_test_start, .cable_test_get_status = at803x_cable_test_get_status,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/353 ionic: pass opcode to devcmd_wait
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shannon Nelson <[email protected]>
[ Upstream commit 24f110240c03c6b5368f1203bac72883d511e606 ]
Don't rely on the PCI memory for the devcmd opcode because we read a 0xff value if the PCI bus is broken, which can cause us to report a bogus dev_cmd opcode later.
--- drivers/net/ethernet/pensando/ionic/ionic_dev.c | 1 + drivers/net/ethernet/pensando/ionic/ionic_dev.h | 1 + drivers/net/ethernet/pensando/ionic/ionic_main.c | 2 +- 3 files changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/pensando/ionic/ionic_dev.c +1 -0
@@ -321,6 +321,7 @@ void ionic_dev_cmd_comp(struct ionic_dev *idev, union ionic_dev_cmd_comp *comp)void ionic_dev_cmd_go (struct ionic_dev *idev,union ionic_dev_cmd *cmd) { + idev->opcode = cmd->cmd.opcode;memcpy_toio (&idev->dev_cmd_regs->cmd, cmd,sizeof (*cmd));iowrite32 (0 , &idev->dev_cmd_regs->done);iowrite32 (1 , &idev->dev_cmd_regs->doorbell);
drivers/net/ethernet/pensando/ionic/ionic_dev.h +1 -0
@@ -153,6 +153,7 @@ struct ionic_dev {bool fw_hb_ready;bool fw_status_ready;u8 fw_generation; +u8 opcode;u64 __iomem *db_pages;dma_addr_t phy_db_pages;
drivers/net/ethernet/pensando/ionic/ionic_main.c +1 -1
@@ -465,7 +465,7 @@ static int __ionic_dev_cmd_wait(struct ionic *ionic, unsigned long max_seconds,*/ max_wait = jiffies + (max_seconds *HZ ); try_again: - opcode =readb (&idev->dev_cmd_regs->cmd.cmd.opcode); + opcode = idev->opcode; start_time = jiffies; for (fw_up = ionic_is_fw_running(idev); !done && fw_up && time_before(jiffies, max_wait);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/353 ionic: bypass firmware cmds when stuck in reset
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shannon Nelson <[email protected]>
[ Upstream commit ca5fdf9a7c5b65968c718f2be159cda4c13556a1 ]
If the driver or firmware is stuck in reset state, don't bother trying to use adminq commands. This speeds up shutdown and prevents unnecessary timeouts and error messages.
This includes a bit of rework on ionic_adminq_post_wait() and ionic_adminq_post_wait_nomsg() to both use __ionic_adminq_post_wait() which can do the checks needed in both cases.
--- .../ethernet/pensando/ionic/ionic_bus_pci.c | 4 ++++ .../net/ethernet/pensando/ionic/ionic_lif.c | 3 +++ .../net/ethernet/pensando/ionic/ionic_main.c | 20 ++++++++++++------- 3 files changed, 20 insertions(+), 7 deletions(-)
drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c +4 -0
@@ -392,6 +392,10 @@ static void ionic_remove(struct pci_dev *pdev)del_timer_sync (&ionic->watchdog_timer);if (ionic->lif) { +/* prevent adminq cmds if already known as down */ +if (test_and_clear_bit (IONIC_LIF_F_FW_RESET , ionic->lif->state)) +set_bit (IONIC_LIF_F_FW_STOPPING , ionic->lif->state); +ionic_lif_unregister (ionic->lif);ionic_devlink_unregister (ionic);ionic_lif_deinit (ionic->lif);
drivers/net/ethernet/pensando/ionic/ionic_lif.c +3 -0
@@ -3238,6 +3238,9 @@ static void ionic_lif_reset(struct ionic_lif *lif) {struct ionic_dev *idev = &lif->ionic->idev; +if (!ionic_is_fw_running (idev)) +return ; +mutex_lock (&lif->ionic->dev_cmd_lock);ionic_dev_cmd_lif_reset (idev, lif->index);ionic_dev_cmd_wait (lif->ionic,DEVCMD_TIMEOUT );
drivers/net/ethernet/pensando/ionic/ionic_main.c +13 -7
@@ -410,22 +410,28 @@ int ionic_adminq_wait(struct ionic_lif *lif, struct ionic_admin_ctx *ctx, do_msg); } -int ionic_adminq_post_wait (struct ionic_lif *lif,struct ionic_admin_ctx *ctx) +static int __ionic_adminq_post_wait (struct ionic_lif *lif, +struct ionic_admin_ctx *ctx, +const bool do_msg) {int err; +if (!ionic_is_fw_running (&lif->ionic->idev)) +return 0 ; + err =ionic_adminq_post (lif, ctx); -return ionic_adminq_wait (lif, ctx, err, true); +return ionic_adminq_wait (lif, ctx, err, do_msg); } -int ionic_adminq_post_wait_nomsg (struct ionic_lif *lif,struct ionic_admin_ctx *ctx) +int ionic_adminq_post_wait (struct ionic_lif *lif,struct ionic_admin_ctx *ctx) { -int err; - - err =ionic_adminq_post (lif, ctx); +return __ionic_adminq_post_wait (lif, ctx, true); +} -return ionic_adminq_wait (lif, ctx, err, false); +int ionic_adminq_post_wait_nomsg (struct ionic_lif *lif,struct ionic_admin_ctx *ctx) +{ +return __ionic_adminq_post_wait (lif, ctx, false); }static void ionic_dev_cmd_clean (struct ionic *ionic)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/353 block/rnbd-srv: Check for unlikely string overflow
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 9e4bf6a08d1e127bcc4bd72557f2dfafc6bc7f41 ]
Since "dev_search_path" can technically be as large as PATH_MAX, there was a risk of truncation when copying it and a second string into "full_path" since it was also PATH_MAX sized. The W=1 builds were reporting this warning:
drivers/block/rnbd/rnbd-srv.c: In function 'process_msg_open.isra':drivers/block/rnbd/rnbd-srv.c:616:51: warning: '%s' directive output may be truncated writing up to 254 bytes into a region of size between 0 and 4095 [-Wformat-truncation=]
616 | snprintf(full_path, PATH_MAX, "%s/%s",
| ^~
In function 'rnbd_srv_get_full_path',
inlined from 'process_msg_open.isra' at drivers/block/rnbd/rnbd-srv.c:721:14: drivers/block/rnbd/rnbd-srv.c:616:17: note: 'snprintf' output between 2 and 4351 bytes into a destination of size 4096
616 | snprintf(full_path, PATH_MAX, "%s/%s",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
617 | dev_search_path, dev_name);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~To fix this, unconditionally check for truncation (as was already done for the case where "%SESSNAME%" was present).
--- drivers/block/rnbd/rnbd-srv.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
drivers/block/rnbd/rnbd-srv.c +10 -9
@@ -585,6 +585,7 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess, {char *full_path;char *a, *b; +int len; full_path =kmalloc (PATH_MAX ,GFP_KERNEL );if (!full_path)
@@ -596,19 +597,19 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess,*/ a =strnstr (dev_search_path,"%SESSNAME%" ,sizeof (dev_search_path));if (a) { -int len = a - dev_search_path; + len = a - dev_search_path; len =snprintf (full_path,PATH_MAX ,"%.*s/%s/%s" , len, dev_search_path, srv_sess->sessname, dev_name); -if (len >=PATH_MAX ) { -pr_err ("Too long path: %s, %s, %s\n" , - dev_search_path, srv_sess->sessname, dev_name); -kfree (full_path); -return ERR_PTR (-EINVAL ); - } }else { -snprintf (full_path,PATH_MAX ,"%s/%s" , - dev_search_path, dev_name); + len =snprintf (full_path,PATH_MAX ,"%s/%s" , + dev_search_path, dev_name); + } +if (len >=PATH_MAX ) { +pr_err ("Too long path: %s, %s, %s\n" , + dev_search_path, srv_sess->sessname, dev_name); +kfree (full_path); +return ERR_PTR (-EINVAL ); }/* eliminitate duplicated slashes */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/353 arm64: zynqmp: Move fixed clock to / for kv260
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Simek <[email protected]>
[ Upstream commit 6a10a19a6bd2fd8d27a510678bf87bd9408f51d8 ]
fixed clock nodes can't be on the bus because they are missing reg property. That's why move them to root.
And because it is root it is good to have it as the first node in a file.
--- .../boot/dts/xilinx/zynqmp-sck-kv-g-revA.dtso | 28 ++++++++--------- .../boot/dts/xilinx/zynqmp-sck-kv-g-revB.dtso | 30 +++++++++---------- 2 files changed, 29 insertions(+), 29 deletions(-)
arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revA.dtso +14 -14
@@ -21,20 +21,7 @@ /dts-v1/; /plugin/; -&i2c1 { /* I2C_SCK C23/C24 - MIO from SOM */ - #address-cells = <1>; - #size-cells = <0>; - pinctrl-names = "default", "gpio"; - pinctrl-0 = <&pinctrl_i2c1_default>; - pinctrl-1 = <&pinctrl_i2c1_gpio>; - scl-gpios = <&gpio 24 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; - sda-gpios = <&gpio 25 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; - - /* u14 - 0x40 - ina260 */ - /* u27 - 0xe0 - STDP4320 DP/HDMI splitter */ -}; - -&amba { +&{/} { si5332_0: si5332_0 { /* u17 */ compatible = "fixed-clock"; #clock-cells = <0>;
@@ -72,6 +59,19 @@ }; }; +&i2c1 { /* I2C_SCK C23/C24 - MIO from SOM */ + #address-cells = <1>; + #size-cells = <0>; + pinctrl-names = "default", "gpio"; + pinctrl-0 = <&pinctrl_i2c1_default>; + pinctrl-1 = <&pinctrl_i2c1_gpio>; + scl-gpios = <&gpio 24 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + sda-gpios = <&gpio 25 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + + /* u14 - 0x40 - ina260 */ + /* u27 - 0xe0 - STDP4320 DP/HDMI splitter */ +}; + /* DP/USB 3.0 and SATA */ &psgtr { status = "okay";
arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revB.dtso +15 -15
@@ -16,21 +16,7 @@ /dts-v1/; /plugin/; -&i2c1 { /* I2C_SCK C23/C24 - MIO from SOM */ - #address-cells = <1>; - #size-cells = <0>; - pinctrl-names = "default", "gpio"; - pinctrl-0 = <&pinctrl_i2c1_default>; - pinctrl-1 = <&pinctrl_i2c1_gpio>; - scl-gpios = <&gpio 24 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; - sda-gpios = <&gpio 25 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; - - /* u14 - 0x40 - ina260 */ - /* u43 - 0x2d - usb5744 */ - /* u27 - 0xe0 - STDP4320 DP/HDMI splitter */ -}; - -&amba { +&{/} { si5332_0: si5332_0 { /* u17 */ compatible = "fixed-clock"; #clock-cells = <0>;
@@ -68,6 +54,20 @@ }; }; +&i2c1 { /* I2C_SCK C23/C24 - MIO from SOM */ + #address-cells = <1>; + #size-cells = <0>; + pinctrl-names = "default", "gpio"; + pinctrl-0 = <&pinctrl_i2c1_default>; + pinctrl-1 = <&pinctrl_i2c1_gpio>; + scl-gpios = <&gpio 24 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + sda-gpios = <&gpio 25 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + + /* u14 - 0x40 - ina260 */ + /* u43 - 0x2d - usb5744 */ + /* u27 - 0xe0 - STDP4320 DP/HDMI splitter */ +}; + /* DP/USB 3.0 */ &psgtr { status = "okay";
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/353 arm64: zynqmp: Fix clock node name in kv260 cards
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Simek <[email protected]>
[ Upstream commit 0bfb7950cc1975372c4c58c3d3f9803f05245d46 ]
node name shouldn't use '_' that's why convert it to '-'.
--- arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revA.dtso | 12 ++++++------ arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revB.dtso | 12 ++++++------ 2 files changed, 12 insertions(+), 12 deletions(-)
arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revA.dtso +6 -6
@@ -22,37 +22,37 @@ /plugin/; &{/} { - si5332_0: si5332_0 { /* u17 */ + si5332_0: si5332-0 { /* u17 */ compatible = "fixed-clock"; #clock-cells = <0>; clock-frequency = <125000000>; }; - si5332_1: si5332_1 { /* u17 */ + si5332_1: si5332-1 { /* u17 */ compatible = "fixed-clock"; #clock-cells = <0>; clock-frequency = <25000000>; }; - si5332_2: si5332_2 { /* u17 */ + si5332_2: si5332-2 { /* u17 */ compatible = "fixed-clock"; #clock-cells = <0>; clock-frequency = <48000000>; }; - si5332_3: si5332_3 { /* u17 */ + si5332_3: si5332-3 { /* u17 */ compatible = "fixed-clock"; #clock-cells = <0>; clock-frequency = <24000000>; }; - si5332_4: si5332_4 { /* u17 */ + si5332_4: si5332-4 { /* u17 */ compatible = "fixed-clock"; #clock-cells = <0>; clock-frequency = <26000000>; }; - si5332_5: si5332_5 { /* u17 */ + si5332_5: si5332-5 { /* u17 */ compatible = "fixed-clock"; #clock-cells = <0>; clock-frequency = <27000000>;
arch/arm64/boot/dts/xilinx/zynqmp-sck-kv-g-revB.dtso +6 -6
@@ -17,37 +17,37 @@ /plugin/; &{/} { - si5332_0: si5332_0 { /* u17 */ + si5332_0: si5332-0 { /* u17 */ compatible = "fixed-clock"; #clock-cells = <0>; clock-frequency = <125000000>; }; - si5332_1: si5332_1 { /* u17 */ + si5332_1: si5332-1 { /* u17 */ compatible = "fixed-clock"; #clock-cells = <0>; clock-frequency = <25000000>; }; - si5332_2: si5332_2 { /* u17 */ + si5332_2: si5332-2 { /* u17 */ compatible = "fixed-clock"; #clock-cells = <0>; clock-frequency = <48000000>; }; - si5332_3: si5332_3 { /* u17 */ + si5332_3: si5332-3 { /* u17 */ compatible = "fixed-clock"; #clock-cells = <0>; clock-frequency = <24000000>; }; - si5332_4: si5332_4 { /* u17 */ + si5332_4: si5332-4 { /* u17 */ compatible = "fixed-clock"; #clock-cells = <0>; clock-frequency = <26000000>; }; - si5332_5: si5332_5 { /* u17 */ + si5332_5: si5332-5 { /* u17 */ compatible = "fixed-clock"; #clock-cells = <0>; clock-frequency = <27000000>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/353 selftests/bpf: fix compiler warnings in RELEASE=1 mode
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit 62d9a969f4a95219c757831e9ad66cd4dd9edee5 ]
When compiling BPF selftests with RELEASE=1, we get two new warnings, which are treated as errors. Fix them.
--- tools/testing/selftests/bpf/veristat.c | 2 +- tools/testing/selftests/bpf/xdp_hw_metadata.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/bpf/veristat.c +1 -1
@@ -1214,7 +1214,7 @@ static int cmp_join_stat(const struct verif_stats_join *s1, enum stat_id id, enum stat_variant var, bool asc) { const char *str1 = NULL, *str2 = NULL; -double v1, v2; +double v1 =0.0 , v2 =0.0 ;int cmp =0 ;fetch_join_stat_value (s1, id, var, &str1, &v1);
tools/testing/selftests/bpf/xdp_hw_metadata.c +1 -1
@@ -70,7 +70,7 @@ static int open_xsk(int ifindex, struct xsk *xsk, __u32 queue_id) .frame_size = XSK_UMEM__DEFAULT_FRAME_SIZE, .flags = XDP_UMEM_UNALIGNED_CHUNK_FLAG, }; -__u32 idx; +__u32 idx =0 ;u64 addr;int ret;int i;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/353 ARM: dts: imx25: Fix the iim compatible string
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit f0b929f58719fc57a4926ab4fc972f185453d6a5 ]
Per imx-iim.yaml, the compatible string should only contain a single entry.
Use it as "fsl,imx25-iim" to fix the following dt-schema warning:
imx25-karo-tx25.dtb: efuse@53ff0000: compatible: ['fsl,imx25-iim', 'fsl,imx27-iim'] is too long
from schema $id: http://devicetree.org/schemas/nvmem/imx-iim.yaml#
--- arch/arm/boot/dts/nxp/imx/imx25.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/nxp/imx/imx25.dtsi +1 -1
@@ -542,7 +542,7 @@ }; iim: efuse@53ff0000 { - compatible = "fsl,imx25-iim", "fsl,imx27-iim"; + compatible = "fsl,imx25-iim"; reg = <0x53ff0000 0x4000>; interrupts = <19>; clocks = <&clks 99>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/353 ARM: dts: imx25/27: Pass timing0
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit 11ab7ad6f795ae23c398a4a5c56505d3dab27c4c ]
Per display-timings.yaml, the 'timing' pattern should be used to describe the display timings.
Change it accordingly to fix the following dt-schema warning:
imx27-apf27dev.dtb: display-timings: '800x480' does not match any of the regexes: '^timing', 'pinctrl-[0-9]+'
from schema $id: http://devicetree.org/schemas/display/panel/display-timings.yaml#
--- .../dts/nxp/imx/imx25-eukrea-mbimxsd25-baseboard-cmo-qvga.dts | 2 +- .../dts/nxp/imx/imx25-eukrea-mbimxsd25-baseboard-dvi-svga.dts | 2 +- .../dts/nxp/imx/imx25-eukrea-mbimxsd25-baseboard-dvi-vga.dts | 2 +- arch/arm/boot/dts/nxp/imx/imx25-pdk.dts | 2 +- arch/arm/boot/dts/nxp/imx/imx27-apf27dev.dts | 2 +- arch/arm/boot/dts/nxp/imx/imx27-eukrea-mbimxsd27-baseboard.dts | 2 +- arch/arm/boot/dts/nxp/imx/imx27-phytec-phycard-s-rdk.dts | 2 +- arch/arm/boot/dts/nxp/imx/imx27-phytec-phycore-rdk.dts | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-)
arch/arm/boot/dts/nxp/imx/imx25-eukrea-mbimxsd25-baseboard-cmo-qvga.dts +1 -1
@@ -16,7 +16,7 @@ bus-width = <18>; display-timings { native-mode = <&qvga_timings>; - qvga_timings: 320x240 { + qvga_timings: timing0 { clock-frequency = <6500000>; hactive = <320>; vactive = <240>;
arch/arm/boot/dts/nxp/imx/imx25-eukrea-mbimxsd25-baseboard-dvi-svga.dts +1 -1
@@ -16,7 +16,7 @@ bus-width = <18>; display-timings { native-mode = <&dvi_svga_timings>; - dvi_svga_timings: 800x600 { + dvi_svga_timings: timing0 { clock-frequency = <40000000>; hactive = <800>; vactive = <600>;
arch/arm/boot/dts/nxp/imx/imx25-eukrea-mbimxsd25-baseboard-dvi-vga.dts +1 -1
@@ -16,7 +16,7 @@ bus-width = <18>; display-timings { native-mode = <&dvi_vga_timings>; - dvi_vga_timings: 640x480 { + dvi_vga_timings: timing0 { clock-frequency = <31250000>; hactive = <640>; vactive = <480>;
arch/arm/boot/dts/nxp/imx/imx25-pdk.dts +1 -1
@@ -68,7 +68,7 @@ bus-width = <18>; display-timings { native-mode = <&wvga_timings>; - wvga_timings: 640x480 { + wvga_timings: timing0 { hactive = <640>; vactive = <480>; hback-porch = <45>;
arch/arm/boot/dts/nxp/imx/imx27-apf27dev.dts +1 -1
@@ -16,7 +16,7 @@ fsl,pcr = <0xfae80083>; /* non-standard but required */ display-timings { native-mode = <&timing0>; - timing0: 800x480 { + timing0: timing0 { clock-frequency = <33000033>; hactive = <800>; vactive = <480>;
arch/arm/boot/dts/nxp/imx/imx27-eukrea-mbimxsd27-baseboard.dts +1 -1
@@ -16,7 +16,7 @@ display-timings { native-mode = <&timing0>; - timing0: 320x240 { + timing0: timing0 { clock-frequency = <6500000>; hactive = <320>; vactive = <240>;
arch/arm/boot/dts/nxp/imx/imx27-phytec-phycard-s-rdk.dts +1 -1
@@ -19,7 +19,7 @@ fsl,pcr = <0xf0c88080>; /* non-standard but required */ display-timings { native-mode = <&timing0>; - timing0: 640x480 { + timing0: timing0 { hactive = <640>; vactive = <480>; hback-porch = <112>;
arch/arm/boot/dts/nxp/imx/imx27-phytec-phycore-rdk.dts +1 -1
@@ -19,7 +19,7 @@ display-timings { native-mode = <&timing0>; - timing0: 240x320 { + timing0: timing0 { clock-frequency = <5500000>; hactive = <240>; vactive = <320>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/353 ARM: dts: imx27-apf27dev: Fix LED name
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit dc35e253d032b959d92e12f081db5b00db26ae64 ]
Per leds-gpio.yaml, the led names should start with 'led'.
Change it to fix the following dt-schema warning:
imx27-apf27dev.dtb: leds: 'user' does not match any of the regexes: '(^led-[0-9a-f]$|led)', 'pinctrl-[0-9]+'
from schema $id: http://devicetree.org/schemas/leds/leds-gpio.yaml#
--- arch/arm/boot/dts/nxp/imx/imx27-apf27dev.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/nxp/imx/imx27-apf27dev.dts +1 -1
@@ -47,7 +47,7 @@ pinctrl-names = "default"; pinctrl-0 = <&pinctrl_gpio_leds>; - user { + led-user { label = "Heartbeat"; gpios = <&gpio6 14 GPIO_ACTIVE_HIGH>; linux,default-trigger = "heartbeat";
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/353 ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit e3aa1a82fb20ee97597022f6528823a8ab82bde6 ]
The 'gpios' property to describe the SDA and SCL GPIOs is considered deprecated according to i2c-gpio.yaml.
Switch to the preferred 'sda-gpios' and 'scl-gpios' properties.
This fixes the following schema warnings:
imx23-sansa.dtb: i2c-0: 'sda-gpios' is a required property
from schema $id: http://devicetree.org/schemas/i2c/i2c-gpio.yaml#
imx23-sansa.dtb: i2c-0: 'scl-gpios' is a required property
from schema $id: http://devicetree.org/schemas/i2c/i2c-gpio.yaml#
--- arch/arm/boot/dts/nxp/mxs/imx23-sansa.dts | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
arch/arm/boot/dts/nxp/mxs/imx23-sansa.dts +4 -8
@@ -175,10 +175,8 @@ #address-cells = <1>; #size-cells = <0>; compatible = "i2c-gpio"; - gpios = < - &gpio1 24 0 /* SDA */ - &gpio1 22 0 /* SCL */ - >; + sda-gpios = <&gpio1 24 0>; + scl-gpios = <&gpio1 22 0>; i2c-gpio,delay-us = <2>; /* ~100 kHz */ };
@@ -186,10 +184,8 @@ #address-cells = <1>; #size-cells = <0>; compatible = "i2c-gpio"; - gpios = < - &gpio0 31 0 /* SDA */ - &gpio0 30 0 /* SCL */ - >; + sda-gpios = <&gpio0 31 0>; + scl-gpios = <&gpio0 30 0>; i2c-gpio,delay-us = <2>; /* ~100 kHz */ touch: touch@20 {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/353 ARM: dts: imx23/28: Fix the DMA controller node name
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit 858d83ca4b50bbc8693d95cc94310e6d791fb2e6 ]
Per fsl,mxs-dma.yaml, the node name should be 'dma-controller'.
Change it to fix the following dt-schema warning.
imx28-apf28.dtb: dma-apbx@80024000: $nodename:0: 'dma-apbx@80024000' does not match '^dma-controller(@.*)?$'
from schema $id: http://devicetree.org/schemas/dma/fsl,mxs-dma.yaml#
--- arch/arm/boot/dts/nxp/mxs/imx23.dtsi | 2 +- arch/arm/boot/dts/nxp/mxs/imx28.dtsi | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/nxp/mxs/imx23.dtsi +1 -1
@@ -412,7 +412,7 @@ status = "disabled"; }; - dma_apbx: dma-apbx@80024000 { + dma_apbx: dma-controller@80024000 { compatible = "fsl,imx23-dma-apbx"; reg = <0x80024000 0x2000>; interrupts = <7>, <5>, <9>, <26>,
arch/arm/boot/dts/nxp/mxs/imx28.dtsi +1 -1
@@ -990,7 +990,7 @@ status = "disabled"; }; - dma_apbx: dma-apbx@80024000 { + dma_apbx: dma-controller@80024000 { compatible = "fsl,imx28-dma-apbx"; reg = <0x80024000 0x2000>; interrupts = <78>, <79>, <66>, <0>,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/353 scsi: lpfc: Reinitialize an NPIVs VMID data structures after FDISC
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 8dc8eb89f4df74593ba4bf30c3d31a0fc6d3ea47 ]
After a follow up FDISC cmpl, an NPIV's VMID data structures are not updated.
Fix by calling lpfc_reinit_vmid and copying the physical port's vmid_flag to the NPIV's vmid_flag in the NPIV registration cmpl code path.
--- drivers/scsi/lpfc/lpfc_els.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/scsi/lpfc/lpfc_els.c +8 -0
@@ -11130,6 +11130,14 @@ lpfc_cmpl_reg_new_vport(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)lpfc_nlp_put (ndlp);mempool_free (pmb, phba->mbox_mem_pool); + +/* reinitialize the VMID datastructure before returning. +* this is specifically for vport +*/ +if (lpfc_is_vmid_enabled (phba)) +lpfc_reinit_vmid (vport); + vport->vmid_flag = vport->phba->pport->vmid_flag; +return ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/353 scsi: lpfc: Move determination of vmid_flag after VMID reinitialization completes
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit aba0fb0ef607a71511d23a07406f11130c1a54c5 ]
If priority tagging is set in the service parameters of a FLOGI cmpl, then we update the vmid_flag. In the current logic, if a follow up FLOGI cmpl updates its service parameters such that priority tagging is no longer set, then the vmid_flag ends up keeping stale data.
Fix by ensuring we clear the vmid_flag member during lpfc_reinit_vmid, and check the priority tagging service parameter after reinitialization of the vmid data structures.
--- drivers/scsi/lpfc/lpfc_els.c | 6 +++--- drivers/scsi/lpfc/lpfc_vmid.c | 1 + 2 files changed, 4 insertions(+), 3 deletions(-)
drivers/scsi/lpfc/lpfc_els.c +3 -3
@@ -1130,12 +1130,12 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, vport->port_state, vport->fc_flag, sp->cmn.priority_tagging, kref_read(&ndlp->kref)); -if (sp->cmn.priority_tagging) - vport->phba->pport->vmid_flag |= (LPFC_VMID_ISSUE_QFPA | -LPFC_VMID_TYPE_PRIO );/* reinitialize the VMID datastructure before returning */ if (lpfc_is_vmid_enabled (phba))lpfc_reinit_vmid (vport); +if (sp->cmn.priority_tagging) + vport->phba->pport->vmid_flag |= (LPFC_VMID_ISSUE_QFPA | +LPFC_VMID_TYPE_PRIO );/* * Address a timing race with dev_loss. If dev_loss is active on
drivers/scsi/lpfc/lpfc_vmid.c +1 -0
@@ -321,5 +321,6 @@ lpfc_reinit_vmid(struct lpfc_vport *vport)if (!hash_empty (vport->hash_table))hash_for_each_safe (vport->hash_table, bucket, tmp, cur, hnode)hash_del (&cur->hnode); + vport->vmid_flag =0 ;write_unlock (&vport->vmid_lock); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/353 scsi: hisi_sas: Set .phy_attached before notifing phyup event HISI_PHYE_PHY_UP_PM
In reply to Greg Kroah-Hartman6.7-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihang Li <[email protected]>
[ Upstream commit ce26497c745d0541aec930d5211b431a1c26af97 ]
Currently in directly attached scenario, the phyup event HISI_PHYE_PHY_UP_PM is notified before .phy_attached is set - this may cause the phyup work hisi_sas_bytes_dmaed() execution failed and the attached device will not be found.
To fix it, set .phy_attached before notifing phyup event.
--- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +5 -5
@@ -1605,6 +1605,11 @@ static irqreturn_t phy_up_v3_hw(int phy_no, struct hisi_hba *hisi_hba) } phy->port_id = port_id; +spin_lock (&phy->lock); +/* Delete timer and set phy_attached atomically */ +del_timer (&phy->timer); + phy->phy_attached =1 ; +spin_unlock (&phy->lock);/* * Call pm_runtime_get_noresume() which pairs with
@@ -1618,11 +1623,6 @@ static irqreturn_t phy_up_v3_hw(int phy_no, struct hisi_hba *hisi_hba) res =IRQ_HANDLED ; -spin_lock (&phy->lock); -/* Delete timer and set phy_attached atomically */ -del_timer (&phy->timer); - phy->phy_attached =1 ; -spin_unlock (&phy->lock); end:if (phy->reset_completion)complete (phy->reset_completion);
Signature · 1 line
2.43.0