5.4.270-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 5.4.270-rc1 review
This is the start of the stable review cycle for the 5.4.270 release. There are 84 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.270-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.270-rc1
Andrii Nakryiko <[email protected]>
scripts/bpf: Fix xdp_md forward declaration typo
Bart Van Assche <[email protected]>
fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
Erik Kurzinger <[email protected]>
drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set
Christian König <[email protected]>
drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3
Florian Westphal <[email protected]>
netfilter: nf_tables: set dormant flag on hook register failure
Sabrina Dubroca <[email protected]>
tls: stop recv() if initial process_rx_list gave us non-DATA
Jakub Kicinski <[email protected]>
tls: rx: drop pointless else after goto
Jakub Kicinski <[email protected]>
tls: rx: jump to a more appropriate label
Jason Gunthorpe <[email protected]>
s390: use the correct count for __iowrite64_copy()
Wolfram Sang <[email protected]>
packet: move from strlcpy with unused retval to strscpy
Vasiliy Kovalev <[email protected]>
ipv6: sr: fix possible use-after-free and null-ptr-deref
Daniil Dulov <[email protected]>
afs: Increase buffer size in afs_update_volume_status()
Eric Dumazet <[email protected]>
ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid
Eric Dumazet <[email protected]>
ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid
Arnd Bergmann <[email protected]>
nouveau: fix function cast warnings
Randy Dunlap <[email protected]>
scsi: jazz_esp: Only build if SCSI core is builtin
Gianmarco Lusvardi <[email protected]>
bpf, scripts: Correct GPL license name
Andrii Nakryiko <[email protected]>
scripts/bpf: teach bpf_helpers_doc.py to dump BPF helper definitions
Arnd Bergmann <[email protected]>
RDMA/srpt: fix function pointer cast warnings
Bart Van Assche <[email protected]>
RDMA/srpt: Make debug output more detailed
Kalesh AP <[email protected]>
RDMA/bnxt_re: Return error for SRQ resize
Zhipeng Lu <[email protected]>
IB/hfi1: Fix a memleak in init_credit_return
Xu Yang <[email protected]>
usb: roles: don't get/set_role() when usb_role_switch is unregistered
Krishna Kurapati <[email protected]>
usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
Frank Li <[email protected]>
usb: cdns3: fix memory double free when handle zero packet
Frank Li <[email protected]>
usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
Nikita Shubin <[email protected]>
ARM: ep93xx: Add terminator to gpiod_lookup_table
Tom Parkin <[email protected]>
l2tp: pass correct message length to ip6_append_data
Vidya Sagar <[email protected]>
PCI/MSI: Prevent MSI hardware interrupt number truncation
Vasiliy Kovalev <[email protected]>
gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
Mikulas Patocka <[email protected]>
dm-crypt: don't modify the data when using authenticated encryption
Daniel Vacek <[email protected]>
IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
Christophe JAILLET <[email protected]>
PCI: tegra: Fix OF node reference leak
Pali Rohár <[email protected]>
PCI: tegra: Fix reporting GPIO error value
Sireesh Kodali <[email protected]>
arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node
Nathan Chancellor <[email protected]>
drm/amdgpu: Fix type of second parameter in trans_msg() callback
Matthew Wilcox (Oracle) <[email protected]>
iomap: Set all uptodate bits for an Uptodate page
Mikulas Patocka <[email protected]>
dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata()
Kirill A. Shutemov <[email protected]>
x86/alternatives: Disable KASAN in apply_alternatives()
Trek <[email protected]>
drm/amdgpu: Check for valid number of registers to read
Icenowy Zheng <[email protected]>
Revert "drm/sun4i: dsi: Change the start delay calculation"
Kai-Heng Feng <[email protected]>
ALSA: hda/realtek - Enable micmute LED on and HP system
Björn Töpel <[email protected]>
selftests/bpf: Avoid running unprivileged tests with alignment requirements
Nikolay Aleksandrov <[email protected]>
net: bridge: clear bridge's private skb space on xmit
Christophe JAILLET <[email protected]>
spi: mt7621: Fix an error message in mt7621_spi_probe()
John Stultz <[email protected]>
driver core: Set deferred_probe_timeout to a longer default if CONFIG_MODULES is set
Miaoqian Lin <[email protected]>
pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
Lee Jones <[email protected]>
pinctrl: pinctrl-rockchip: Fix a bunch of kerneldoc misdemeanours
Eric Dumazet <[email protected]>
tcp: add annotations around sk->sk_shutdown accesses
Soheil Hassas Yeganeh <[email protected]>
tcp: return EPOLLOUT from tcp_poll only when notsent_bytes is half the limit
Paolo Abeni <[email protected]>
tcp: factor out __tcp_close() helper
Geert Uytterhoeven <[email protected]>
pmdomain: renesas: r8a77980-sysc: CR7 must be always on
Alexandra Winter <[email protected]>
s390/qeth: Fix potential loss of L3-IP@ in case of network issues
Yi Sun <[email protected]>
virtio-blk: Ensure no requests in virtqueues before deleting vqs.
Takashi Sakamoto <[email protected]>
firewire: core: send bus reset promptly on gap count error
Hannes Reinecke <[email protected]>
scsi: lpfc: Use unsigned type for num_sge
Zhang Rui <[email protected]>
hwmon: (coretemp) Enlarge per package core count limit
Daniel Wagner <[email protected]>
nvmet-fc: abort command when there is no binding
Xin Long <[email protected]>
netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new
Chen-Yu Tsai <[email protected]>
ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616
Guixin Liu <[email protected]>
nvmet-tcp: fix nvme tcp ida memory leak
Martin Blumenstingl <[email protected]>
regulator: pwm-regulator: Add validity checks in continuous .get_voltage
Baokun Li <[email protected]>
ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
Baokun Li <[email protected]>
ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
Lennert Buytenhek <[email protected]>
ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers
Conrad Kostecki <[email protected]>
ahci: asm1166: correct count of reported ports
Fullway Wang <[email protected]>
fbdev: sis: Error out if pixclock equals zero
Fullway Wang <[email protected]>
fbdev: savage: Error out if pixclock equals zero
Felix Fietkau <[email protected]>
wifi: mac80211: fix race condition on enabling fast-xmit
Michal Kazior <[email protected]>
wifi: cfg80211: fix missing interfaces when dumping
Vinod Koul <[email protected]>
dmaengine: fsl-qdma: increase size of 'irq_name'
Vinod Koul <[email protected]>
dmaengine: shdma: increase size of 'dev_id'
Dmitry Bogdanov <[email protected]>
scsi: target: core: Add TMF to tmr_list handling
Cyril Hrubis <[email protected]>
sched/rt: Disallow writing invalid values to sched_rt_period_us
Cyril Hrubis <[email protected]>
sched/rt: Fix sysctl_sched_rr_timeslice intial value
Lokesh Gidra <[email protected]>
userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb
Ryusuke Konishi <[email protected]>
nilfs2: replace WARN_ONs for invalid DAT metadata block requests
GONG, Ruiqi <[email protected]>
memcg: add refcnt for pcpu stock to avoid UAF problem in drain_all_stock()
Cyril Hrubis <[email protected]>
sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset
Jamal Hadi Salim <[email protected]>
net/sched: Retire dsmark qdisc
Jamal Hadi Salim <[email protected]>
net/sched: Retire ATM qdisc
Jamal Hadi Salim <[email protected]>
net/sched: Retire CBQ qdisc
Oliver Upton <[email protected]>
KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler
Oliver Upton <[email protected]>
KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table()
-------------
Diffstat:
Makefile | 4 +- arch/arm/mach-ep93xx/core.c | 1 + arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 +- arch/s390/pci/pci.c | 2 +- arch/x86/kernel/alternative.c | 13 + drivers/ata/ahci.c | 34 +- drivers/ata/ahci.h | 1 + drivers/base/dd.c | 9 + drivers/block/virtio_blk.c | 7 +- drivers/dma/fsl-qdma.c | 2 +- drivers/dma/sh/shdma.h | 2 +- drivers/firewire/core-card.c | 18 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 5 +- drivers/gpu/drm/drm_syncobj.c | 16 +- drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c | 8 +- drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 3 +- drivers/hwmon/coretemp.c | 2 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 5 +- drivers/infiniband/hw/hfi1/pio.c | 6 +- drivers/infiniband/hw/hfi1/sdma.c | 2 +- drivers/infiniband/ulp/srpt/ib_srpt.c | 18 +- drivers/md/dm-crypt.c | 6 + drivers/md/dm-integrity.c | 11 +- drivers/net/gtp.c | 10 +- drivers/nvme/target/fc.c | 8 +- drivers/nvme/target/tcp.c | 1 + drivers/pci/controller/pci-tegra.c | 17 +- drivers/pci/msi.c | 2 +- drivers/pinctrl/pinctrl-rockchip.c | 23 +- drivers/regulator/pwm-regulator.c | 3 + drivers/s390/net/qeth_l3_main.c | 9 +- drivers/scsi/Kconfig | 2 +- drivers/scsi/lpfc/lpfc_scsi.c | 12 +- drivers/soc/renesas/r8a77980-sysc.c | 3 +- drivers/spi/spi-mt7621.c | 8 +- drivers/target/target_core_device.c | 5 - drivers/target/target_core_transport.c | 4 + drivers/usb/cdns3/gadget.c | 8 +- drivers/usb/gadget/function/f_ncm.c | 10 +- drivers/usb/roles/class.c | 12 +- drivers/video/fbdev/savage/savagefb_driver.c | 3 + drivers/video/fbdev/sis/sis_main.c | 2 + fs/afs/volume.c | 4 +- fs/aio.c | 9 +- fs/ext4/mballoc.c | 13 +- fs/iomap/buffered-io.c | 3 + fs/nilfs2/dat.c | 27 +- include/linux/fs.h | 2 + include/linux/lockdep.h | 5 + include/net/tcp.h | 1 + kernel/sched/rt.c | 10 +- kernel/sysctl.c | 4 + mm/memcontrol.c | 6 + mm/userfaultfd.c | 14 +- net/bridge/br_device.c | 2 + net/ipv4/af_inet.c | 2 +- net/ipv4/devinet.c | 21 +- net/ipv4/tcp.c | 27 +- net/ipv4/tcp_input.c | 4 +- net/ipv6/addrconf.c | 21 +- net/ipv6/seg6.c | 20 +- net/l2tp/l2tp_ip6.c | 2 +- net/mac80211/sta_info.c | 2 + net/mac80211/tx.c | 2 +- net/netfilter/nf_conntrack_proto_sctp.c | 2 +- net/netfilter/nf_tables_api.c | 1 + net/packet/af_packet.c | 4 +- net/sched/Kconfig | 42 - net/sched/Makefile | 3 - net/sched/sch_atm.c | 710 -------- net/sched/sch_cbq.c | 1818 --------------------- net/sched/sch_dsmark.c | 523 ------ net/tls/tls_sw.c | 12 +- net/wireless/nl80211.c | 1 + scripts/bpf_helpers_doc.py | 157 +- sound/pci/hda/patch_realtek.c | 6 +- sound/soc/sunxi/sun4i-spdif.c | 5 + tools/testing/selftests/bpf/test_verifier.c | 13 + virt/kvm/arm/vgic/vgic-its.c | 5 + 80 files changed, 572 insertions(+), 3255 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/84 KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table()
5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Upton <[email protected]>
commit 8d3a7dfb801d157ac423261d7cd62c33e95375f8 upstream.
vgic_get_irq() may not return a valid descriptor if there is no ITS that holds a valid translation for the specified INTID. If that is the case, it is safe to silently ignore it and continue processing the LPI pending table.
--- virt/kvm/arm/vgic/vgic-its.c | 3 +++ 1 file changed, 3 insertions(+)
virt/kvm/arm/vgic/vgic-its.c +3 -0
@@ -459,6 +459,9 @@ static int its_sync_lpi_pending_table(st } irq =vgic_get_irq (vcpu->kvm,NULL , intids[i]); +if (!irq) +continue ; +raw_spin_lock_irqsave (&irq->irq_lock, flags); irq->pending_latch = pendmask & (1U << bit_nr);vgic_queue_irq_unlock (vcpu->kvm, irq, flags);
Greg Kroah-Hartman
maintainerPATCH 2/84 KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Upton <[email protected]>
commit 85a71ee9a0700f6c18862ef3b0011ed9dad99aca upstream.
It is possible that an LPI mapped in a different ITS gets unmapped while handling the MOVALL command. If that is the case, there is no state that can be migrated to the destination. Silently ignore it and continue migrating other LPIs.
--- virt/kvm/arm/vgic/vgic-its.c | 2 ++ 1 file changed, 2 insertions(+)
virt/kvm/arm/vgic/vgic-its.c +2 -0
@@ -1376,6 +1376,8 @@ static int vgic_its_cmd_handle_movall(stfor (i =0 ; i < irq_count; i++) { irq =vgic_get_irq (kvm,NULL , intids[i]); +if (!irq) +continue ;update_affinity (irq, vcpu2);
Greg Kroah-Hartman
maintainerPATCH 3/84 net/sched: Retire CBQ qdisc
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
commit 051d442098421c28c7951625652f61b1e15c4bd5 upstream.
While this amazing qdisc has served us well over the years it has not been getting any tender love and care and has bitrotted over time. It has become mostly a shooting target for syzkaller lately. For this reason, we are retiring it. Goodbye CBQ - we loved you.
--- net/sched/Kconfig | 17 net/sched/Makefile | 1 net/sched/sch_cbq.c | 1818 ---------------------------------------------------- 3 files changed, 1836 deletions(-) delete mode 100644 net/sched/sch_cbq.c delete mode 100644 tools/testing/selftests/tc-testing/tc-tests/qdiscs/cbq.json
net/sched/Kconfig +0 -17
@@ -45,23 +45,6 @@ if NET_SCHED comment "Queueing/Scheduling" -config NET_SCH_CBQ - tristate "Class Based Queueing (CBQ)" - ---help--- - Say Y here if you want to use the Class-Based Queueing (CBQ) packet - scheduling algorithm. This algorithm classifies the waiting packets - into a tree-like hierarchy of classes; the leaves of this tree are - in turn scheduled by separate algorithms. - - See the top of <file:net/sched/sch_cbq.c> for more details. - - CBQ is a commonly used scheduler, so if you're unsure, you should - say Y here. Then say Y to all the queueing algorithms below that you - want to use as leaf disciplines. - - To compile this code as a module, choose M here: the - module will be called sch_cbq. - config NET_SCH_HTB tristate "Hierarchical Token Bucket (HTB)" ---help---
net/sched/Makefile +0 -1
@@ -31,7 +31,6 @@ obj-$(CONFIG_NET_IFE_SKBTCINDEX) += act_ obj-$(CONFIG_NET_ACT_TUNNEL_KEY)+= act_tunnel_key.o obj-$(CONFIG_NET_ACT_CT) += act_ct.o obj-$(CONFIG_NET_SCH_FIFO) += sch_fifo.o -obj-$(CONFIG_NET_SCH_CBQ) += sch_cbq.o obj-$(CONFIG_NET_SCH_HTB) += sch_htb.o obj-$(CONFIG_NET_SCH_HFSC) += sch_hfsc.o obj-$(CONFIG_NET_SCH_RED) += sch_red.o
net/sched/sch_cbq.c deleted +0 -1818
1,818 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 4/84 net/sched: Retire ATM qdisc
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
commit fb38306ceb9e770adfb5ffa6e3c64047b55f7a07 upstream.
The ATM qdisc has served us well over the years but has not been getting much TLC due to lack of known users. Most recently it has become a shooting target for syzkaller. For this reason, we are retiring it.
--- net/sched/Kconfig | 14 - net/sched/Makefile | 1 net/sched/sch_atm.c | 710 ---------------------------------------------------- 3 files changed, 725 deletions(-) delete mode 100644 net/sched/sch_atm.c delete mode 100644 tools/testing/selftests/tc-testing/tc-tests/qdiscs/atm.json
net/sched/Kconfig +0 -14
@@ -68,20 +68,6 @@ config NET_SCH_HFSC To compile this code as a module, choose M here: the module will be called sch_hfsc. -config NET_SCH_ATM - tristate "ATM Virtual Circuits (ATM)" - depends on ATM - ---help--- - Say Y here if you want to use the ATM pseudo-scheduler. This - provides a framework for invoking classifiers, which in turn - select classes of this queuing discipline. Each class maps - the flow(s) it is handling to a given virtual circuit. - - See the top of <file:net/sched/sch_atm.c> for more details. - - To compile this code as a module, choose M here: the - module will be called sch_atm. - config NET_SCH_PRIO tristate "Multi Band Priority Queueing (PRIO)" ---help---
net/sched/Makefile +0 -1
@@ -43,7 +43,6 @@ obj-$(CONFIG_NET_SCH_TBF) += sch_tbf.o obj-$(CONFIG_NET_SCH_TEQL) += sch_teql.o obj-$(CONFIG_NET_SCH_PRIO) += sch_prio.o obj-$(CONFIG_NET_SCH_MULTIQ) += sch_multiq.o -obj-$(CONFIG_NET_SCH_ATM) += sch_atm.o obj-$(CONFIG_NET_SCH_NETEM) += sch_netem.o obj-$(CONFIG_NET_SCH_DRR) += sch_drr.o obj-$(CONFIG_NET_SCH_PLUG) += sch_plug.o
net/sched/sch_atm.c deleted +0 -710
710 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 5/84 net/sched: Retire dsmark qdisc
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
commit bbe77c14ee6185a61ba6d5e435c1cbb489d2a9ed upstream.
The dsmark qdisc has served us well over the years for diffserv but has not been getting much attention due to other more popular approaches to do diffserv services. Most recently it has become a shooting target for syzkaller. For this reason, we are retiring it.
--- net/sched/Kconfig | 11 - net/sched/Makefile | 1 net/sched/sch_dsmark.c | 523 ------------------------------------------------- 3 files changed, 535 deletions(-) delete mode 100644 net/sched/sch_dsmark.c delete mode 100644 tools/testing/selftests/tc-testing/tc-tests/qdiscs/dsmark.json
net/sched/Kconfig +0 -11
@@ -186,17 +186,6 @@ config NET_SCH_GRED To compile this code as a module, choose M here: the module will be called sch_gred. -config NET_SCH_DSMARK - tristate "Differentiated Services marker (DSMARK)" - ---help--- - Say Y if you want to schedule packets according to the - Differentiated Services architecture proposed in RFC 2475. - Technical information on this method, with pointers to associated - RFCs, is available at <http://www.gta.ufrj.br/diffserv/>. - - To compile this code as a module, choose M here: the - module will be called sch_dsmark. - config NET_SCH_NETEM tristate "Network emulator (NETEM)" ---help---
net/sched/Makefile +0 -1
@@ -36,7 +36,6 @@ obj-$(CONFIG_NET_SCH_HFSC) += sch_hfsc.o obj-$(CONFIG_NET_SCH_RED) += sch_red.o obj-$(CONFIG_NET_SCH_GRED) += sch_gred.o obj-$(CONFIG_NET_SCH_INGRESS) += sch_ingress.o -obj-$(CONFIG_NET_SCH_DSMARK) += sch_dsmark.o obj-$(CONFIG_NET_SCH_SFB) += sch_sfb.o obj-$(CONFIG_NET_SCH_SFQ) += sch_sfq.o obj-$(CONFIG_NET_SCH_TBF) += sch_tbf.o
net/sched/sch_dsmark.c deleted +0 -523
523 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 6/84 sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cyril Hrubis <[email protected]>
commit c1fc6484e1fb7cc2481d169bfef129a1b0676abe upstream.
The sched_rr_timeslice can be reset to default by writing value that is <= 0. However after reading from this file we always got the last value written, which is not useful at all.
$ echo -1 > /proc/sys/kernel/sched_rr_timeslice_ms $ cat /proc/sys/kernel/sched_rr_timeslice_ms -1
Fix this by setting the variable that holds the sysctl file value to the jiffies_to_msecs(RR_TIMESLICE) in case that <= 0 value was written.
--- kernel/sched/rt.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/sched/rt.c +3 -0
@@ -2738,6 +2738,9 @@ int sched_rr_handler(struct ctl_table *t sched_rr_timeslice = sysctl_sched_rr_timeslice <=0 ?RR_TIMESLICE :msecs_to_jiffies (sysctl_sched_rr_timeslice); + +if (sysctl_sched_rr_timeslice <=0 ) + sysctl_sched_rr_timeslice =jiffies_to_msecs (RR_TIMESLICE ); }mutex_unlock (&mutex);
Greg Kroah-Hartman
maintainerPATCH 7/84 memcg: add refcnt for pcpu stock to avoid UAF problem in drain_all_stock()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "GONG, Ruiqi" <[email protected]>
commit 1a3e1f40962c445b997151a542314f3c6097f8c3 upstream.
NOTE: This is a partial backport since we only need the refcnt between memcg and stock to fix the problem stated below, and in this way multiple versions use the same code and align with each other.
There was a kernel panic happened on an in-house environment running 3.10, and the same problem was reproduced on 4.19:
general protection fault: 0000 [#1] SMP PTI CPU: 1 PID: 2085 Comm: bash Kdump: loaded Tainted: G L 4.19.90+ #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010 drain_all_stock+0xad/0x140 Code: 00 00 4d 85 ff 74 2c 45 85 c9 74 27 4d 39 fc 74 42 41 80 bc 24 28 04 00 00 00 74 17 49 8b 04 24 49 8b 17 48 8b 88 90 02 00 00 <48> 39 8a 90 02 00 00 74 02 eb 86 48 63 88 3c 01 00 00 39 8a 3c 01 RSP: 0018:ffffa7efc5813d70 EFLAGS: 00010202 RAX: ffff8cb185548800 RBX: ffff8cb89f420160 RCX: ffff8cb1867b6000 RDX: babababababababa RSI: 0000000000000001 RDI: 0000000000231876 RBP: 0000000000000000 R08: 0000000000000415 R09: 0000000000000002 R10: 0000000000000000 R11: 0000000000000001 R12: ffff8cb186f89040 R13: 0000000000020160 R14: 0000000000000001 R15: ffff8cb186b27040 FS: 00007f4a308d3740(0000) GS:ffff8cb89f440000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe4d634a68 CR3: 000000010b022000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mem_cgroup_force_empty_write+0x31/0xb0 cgroup_file_write+0x60/0x140 ? __check_object_size+0x136/0x147 kernfs_fop_write+0x10e/0x190 __vfs_write+0x37/0x1b0 ? selinux_file_permission+0xe8/0x130 ? security_file_permission+0x2e/0xb0 vfs_write+0xb6/0x1a0 ksys_write+0x57/0xd0 do_syscall_64+0x63/0x250 ? async_page_fault+0x8/0x30 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 Modules linked in: ...
It is found that in case of stock->nr_pages == 0, the memcg on stock->cached could be freed due to its refcnt decreased to 0, which made stock->cached become a dangling pointer. It could cause a UAF problem in drain_all_stock() in the following concurrent scenario. Note that drain_all_stock() doesn't disable irq but only preemption.
CPU1 CPU2
==============================================================================stock->cached = memcgA (freed)
drain_all_stock(memcgB)
rcu_read_lock()
memcg = CPU1's stock->cached (memcgA)
(interrupted)refill_stock(memcgC)
drain_stock(memcgA)
stock->cached = memcgC
stock->nr_pages += xxx (> 0)
stock->nr_pages > 0 mem_cgroup_is_descendant(memcgA, memcgB) [UAF] rcu_read_unlock()
This problem is, unintentionally, fixed at 5.9, where commit 1a3e1f40962c ("mm: memcontrol: decouple reference counting from page accounting") adds memcg refcnt for stock. Therefore affected LTS versions include 4.19 and 5.4.
For 4.19, memcg's css offline process doesn't call drain_all_stock(). so it's easier for the released memcg to be left on the stock. For 5.4, although mem_cgroup_css_offline() does call drain_all_stock(), but the flushing could be skipped when stock->nr_pages happens to be 0, and besides the async draining could be delayed and take place after the UAF problem has happened.
Fix this problem by adding (and decreasing) memcg's refcnt when memcg is put onto (and removed from) stock, just like how commit 1a3e1f40962c ("mm: memcontrol: decouple reference counting from page accounting") does. After all, "being on the stock" is a kind of reference with regards to memcg. As such, it's guaranteed that a css on stock would not be freed.
It's good to mention that refill_stock() is executed in an irq-disabled context, so the drain_stock() patched with css_put() would not actually free memcgA until the end of refill_stock(), since css_put() is an RCU free and it's still in grace period. For CPU2, the access to CPU1's stock->cached is protected by rcu_read_lock(), so in this case it gets either NULL from stock->cached or a memcgA that is still good.
--- mm/memcontrol.c | 6 ++++++ 1 file changed, 6 insertions(+)
mm/memcontrol.c +6 -0
@@ -2214,6 +2214,9 @@ static void drain_stock(struct memcg_sto {struct mem_cgroup *old = stock->cached; +if (!old) +return ; +if (stock->nr_pages) {page_counter_uncharge (&old->memory, stock->nr_pages);if (do_memsw_account ())
@@ -2221,6 +2224,8 @@ static void drain_stock(struct memcg_stocss_put_many (&old->css, stock->nr_pages); stock->nr_pages =0 ; } + +css_put (&old->css); stock->cached =NULL ; }
@@ -2256,6 +2261,7 @@ static void refill_stock(struct mem_cgro stock =this_cpu_ptr (&memcg_stock);if (stock->cached != memcg) {/* reset if necessary */ drain_stock (stock); +css_get (&memcg->css); stock->cached = memcg; } stock->nr_pages += nr_pages;
Greg Kroah-Hartman
maintainerPATCH 8/84 nilfs2: replace WARN_ONs for invalid DAT metadata block requests
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit 5124a0a549857c4b87173280e192eea24dea72ad upstream.
If DAT metadata file block access fails due to corruption of the DAT file or abnormal virtual block numbers held by b-trees or inodes, a kernel warning is generated.
This replaces the WARN_ONs by error output, so that a kernel, booted with panic_on_warn, does not panic. This patch also replaces the detected return code -ENOENT with another internal code -EINVAL to notify the bmap layer of metadata corruption. When the bmap layer sees -EINVAL, it handles the abnormal situation with nilfs_bmap_convert_error() and finally returns code -EIO as it should.
--- fs/nilfs2/dat.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-)
fs/nilfs2/dat.c +17 -10
@@ -40,8 +40,21 @@ static inline struct nilfs_dat_info *NILstatic int nilfs_dat_prepare_entry (struct inode *dat,struct nilfs_palloc_req *req,int create) { -return nilfs_palloc_get_entry_block (dat, req->pr_entry_nr, - create, &req->pr_entry_bh); +int ret; + + ret =nilfs_palloc_get_entry_block (dat, req->pr_entry_nr, + create, &req->pr_entry_bh); +if (unlikely (ret == -ENOENT )) { +nilfs_msg (dat->i_sb,KERN_ERR , +"DAT doesn't have a block to manage vblocknr = %llu" , + (unsigned long long )req->pr_entry_nr); +/* +* Return internal code -EINVAL to notify bmap layer of +* metadata corruption. +*/ + ret = -EINVAL ; + } +return ret; } static void nilfs_dat_commit_entry(struct inode *dat,
@@ -123,11 +136,7 @@ static void nilfs_dat_commit_free(structint nilfs_dat_prepare_start (struct inode *dat,struct nilfs_palloc_req *req) { -int ret; - - ret =nilfs_dat_prepare_entry (dat, req,0 ); -WARN_ON (ret == -ENOENT ); -return ret; +return nilfs_dat_prepare_entry (dat, req,0 ); } void nilfs_dat_commit_start(struct inode *dat, struct nilfs_palloc_req *req,
@@ -154,10 +163,8 @@ int nilfs_dat_prepare_end(struct inode *int ret; ret =nilfs_dat_prepare_entry (dat, req,0 ); -if (ret <0 ) { -WARN_ON (ret == -ENOENT ); +if (ret <0 )return ret; - } kaddr =kmap_atomic (req->pr_entry_bh->b_page); entry = nilfs_palloc_block_get_entry(dat, req->pr_entry_nr,
Greg Kroah-Hartman
maintainerPATCH 9/84 userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lokesh Gidra <[email protected]>
commit 67695f18d55924b2013534ef3bdc363bc9e14605 upstream.
In mfill_atomic_hugetlb(), mmap_changing isn't being checked again if we drop mmap_lock and reacquire it. When the lock is not held, mmap_changing could have been incremented. This is also inconsistent with the behavior in mfill_atomic().
--- mm/userfaultfd.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
mm/userfaultfd.c +13 -1
@@ -177,6 +177,7 @@ static __always_inline ssize_t __mcopy_aunsigned long dst_start, unsigned long src_start, unsigned long len, + bool *mmap_changing, bool zeropage) { int vm_alloc_shared = dst_vma->vm_flags & VM_SHARED;
@@ -308,6 +309,15 @@ retry: goto out; }down_read (&dst_mm->mmap_sem); +/* +* If memory mappings are changing because of non-cooperative +* operation (e.g. mremap) running in parallel, bail out and +* request the user to retry later +*/ +if (mmap_changing &&READ_ONCE (*mmap_changing)) { + err = -EAGAIN ; +break ; + } dst_vma =NULL ; goto retry;
@@ -389,6 +399,7 @@ extern ssize_t __mcopy_atomic_hugetlb(stunsigned long dst_start, unsigned long src_start, unsigned long len, + bool *mmap_changing, bool zeropage);#endif /* CONFIG_HUGETLB_PAGE */
@@ -506,7 +517,8 @@ retry:*/ if (is_vm_hugetlb_page (dst_vma))return __mcopy_atomic_hugetlb (dst_mm, dst_vma, dst_start, - src_start, len, zeropage); + src_start, len, mmap_changing, + zeropage);if (!vma_is_anonymous (dst_vma) && !vma_is_shmem (dst_vma)) goto out_unlock;
Greg Kroah-Hartman
maintainerPATCH 10/84 sched/rt: Fix sysctl_sched_rr_timeslice intial value
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cyril Hrubis <[email protected]>
commit c7fcb99877f9f542c918509b2801065adcaf46fa upstream.
There is a 10% rounding error in the intial value of the sysctl_sched_rr_timeslice with CONFIG_HZ_300=y.
This was found with LTP test sched_rr_get_interval01:
sched_rr_get_interval01.c:57: TPASS: sched_rr_get_interval() passed sched_rr_get_interval01.c:64: TPASS: Time quantum 0s 99999990ns sched_rr_get_interval01.c:72: TFAIL: /proc/sys/kernel/sched_rr_timeslice_ms != 100 got 90 sched_rr_get_interval01.c:57: TPASS: sched_rr_get_interval() passed sched_rr_get_interval01.c:64: TPASS: Time quantum 0s 99999990ns sched_rr_get_interval01.c:72: TFAIL: /proc/sys/kernel/sched_rr_timeslice_ms != 100 got 90
What this test does is to compare the return value from the sched_rr_get_interval() and the sched_rr_timeslice_ms sysctl file and fails if they do not match.
The problem it found is the intial sysctl file value which was computed as:
static int sysctl_sched_rr_timeslice = (MSEC_PER_SEC / HZ) * RR_TIMESLICE;
which works fine as long as MSEC_PER_SEC is multiple of HZ, however it introduces 10% rounding error for CONFIG_HZ_300:
(MSEC_PER_SEC / HZ) * (100 * HZ / 1000)
(1000 / 300) * (100 * 300 / 1000)
3 * 30 = 90
This can be easily fixed by reversing the order of the multiplication and division. After this fix we get:
(MSEC_PER_SEC * (100 * HZ / 1000)) / HZ
(1000 * (100 * 300 / 1000)) / 300
(1000 * 30) / 300 = 100
--- kernel/sched/rt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/rt.c +1 -1
@@ -8,7 +8,7 @@#include "pelt.h" int sched_rr_timeslice =RR_TIMESLICE ; -int sysctl_sched_rr_timeslice = (MSEC_PER_SEC /HZ ) *RR_TIMESLICE ; +int sysctl_sched_rr_timeslice = (MSEC_PER_SEC *RR_TIMESLICE ) /HZ ;/* More than 4 hours if BW_SHIFT equals 20. */ static const u64 max_rt_runtime =MAX_BW ;
Greg Kroah-Hartman
maintainerPATCH 11/84 sched/rt: Disallow writing invalid values to sched_rt_period_us
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cyril Hrubis <[email protected]>
commit 079be8fc630943d9fc70a97807feb73d169ee3fc upstream.
The validation of the value written to sched_rt_period_us was broken because:
- the sysclt_sched_rt_period is declared as unsigned int
- parsed by proc_do_intvec()
- the range is asserted after the value parsed by proc_do_intvec()
Because of this negative values written to the file were written into a unsigned integer that were later on interpreted as large positive integers which did passed the check:
if (sysclt_sched_rt_period <= 0)
return EINVAL;
This commit fixes the parsing by setting explicit range for both perid_us and runtime_us into the sched_rt_sysctls table and processes the values with proc_dointvec_minmax() instead.
Alternatively if we wanted to use full range of unsigned int for the period value we would have to split the proc_handler and use proc_douintvec() for it however even the Documentation/scheduller/sched-rt-group.rst describes the range as 1 to INT_MAX.
As far as I can tell the only problem this causes is that the sysctl file allows writing negative values which when read back may confuse userspace.
There is also a LTP test being submitted for these sysctl files at:
http://patchwork.ozlabs.org/project/ltp/patch/[email protected]/
--- kernel/sched/rt.c | 5 +---- kernel/sysctl.c | 4 ++++ 2 files changed, 5 insertions(+), 4 deletions(-)
kernel/sched/rt.c +1 -4
@@ -2659,9 +2659,6 @@ static int sched_rt_global_constraints(vstatic int sched_rt_global_validate (void ) { -if (sysctl_sched_rt_period <=0 ) -return -EINVAL ; - if ((sysctl_sched_rt_runtime != RUNTIME_INF) && ((sysctl_sched_rt_runtime > sysctl_sched_rt_period) || ((u64)sysctl_sched_rt_runtime *
@@ -2693,7 +2690,7 @@ int sched_rt_handler(struct ctl_table *t old_period = sysctl_sched_rt_period; old_runtime = sysctl_sched_rt_runtime; - ret =proc_dointvec (table, write, buffer, lenp, ppos); + ret =proc_dointvec_minmax (table, write, buffer, lenp, ppos);if (!ret && write) { ret =sched_rt_global_validate ();
kernel/sysctl.c +4 -0
@@ -465,6 +465,8 @@ static struct ctl_table kern_table[] = { .maxlen = sizeof(unsigned int), .mode = 0644, .proc_handler = sched_rt_handler, + .extra1 = SYSCTL_ONE, + .extra2 = SYSCTL_INT_MAX, }, { .procname = "sched_rt_runtime_us",
@@ -472,6 +474,8 @@ static struct ctl_table kern_table[] = { .maxlen = sizeof(int), .mode = 0644, .proc_handler = sched_rt_handler, + .extra1 = &neg_one, + .extra2 = SYSCTL_INT_MAX, }, { .procname = "sched_rr_timeslice_ms",
Greg Kroah-Hartman
maintainerPATCH 12/84 scsi: target: core: Add TMF to tmr_list handling
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Bogdanov <[email protected]>
[ Upstream commit 83ab68168a3d990d5ff39ab030ad5754cbbccb25 ]
An abort that is responded to by iSCSI itself is added to tmr_list but does not go to target core. A LUN_RESET that goes through tmr_list takes a refcounter on the abort and waits for completion. However, the abort will be never complete because it was not started in target core.
Unable to locate ITT: 0x05000000 on CID: 0
Unable to locate RefTaskTag: 0x05000000 on CID: 0.
wait_for_tasks: Stopping tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop wait for tasks: tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop
...
INFO: task kworker/0:2:49 blocked for more than 491 seconds. task:kworker/0:2 state:D stack: 0 pid: 49 ppid: 2 flags:0x00000800 Workqueue: events target_tmr_work [target_core_mod] Call Trace: __switch_to+0x2c4/0x470 _schedule+0x314/0x1730 schedule+0x64/0x130 schedule_timeout+0x168/0x430 wait_for_completion+0x140/0x270 target_put_cmd_and_wait+0x64/0xb0 [target_core_mod] core_tmr_lun_reset+0x30/0xa0 [target_core_mod] target_tmr_work+0xc8/0x1b0 [target_core_mod] process_one_work+0x2d4/0x5d0 worker_thread+0x78/0x6c0
To fix this, only add abort to tmr_list if it will be handled by target core.
--- drivers/target/target_core_device.c | 5 ----- drivers/target/target_core_transport.c | 4 ++++ 2 files changed, 4 insertions(+), 5 deletions(-)
drivers/target/target_core_device.c +0 -5
@@ -151,7 +151,6 @@ int transport_lookup_tmr_lun(struct se_cmd *se_cmd, u64 unpacked_lun)struct se_session *se_sess = se_cmd->se_sess;struct se_node_acl *nacl = se_sess->se_node_acl;struct se_tmr_req *se_tmr = se_cmd->se_tmr_req; -unsigned long flags;rcu_read_lock (); deve =target_nacl_find_deve (nacl, unpacked_lun);
@@ -182,10 +181,6 @@ int transport_lookup_tmr_lun(struct se_cmd *se_cmd, u64 unpacked_lun) se_cmd->se_dev =rcu_dereference_raw (se_lun->lun_se_dev); se_tmr->tmr_dev =rcu_dereference_raw (se_lun->lun_se_dev); -spin_lock_irqsave (&se_tmr->tmr_dev->se_tmr_lock, flags); -list_add_tail (&se_tmr->tmr_list, &se_tmr->tmr_dev->dev_tmr_list); -spin_unlock_irqrestore (&se_tmr->tmr_dev->se_tmr_lock, flags); -return 0 ; }EXPORT_SYMBOL (transport_lookup_tmr_lun);
drivers/target/target_core_transport.c +4 -0
@@ -3392,6 +3392,10 @@ int transport_generic_handle_tmr(unsigned long flags;bool aborted = false; +spin_lock_irqsave (&cmd->se_dev->se_tmr_lock, flags); +list_add_tail (&cmd->se_tmr_req->tmr_list, &cmd->se_dev->dev_tmr_list); +spin_unlock_irqrestore (&cmd->se_dev->se_tmr_lock, flags); +spin_lock_irqsave (&cmd->t_state_lock, flags);if (cmd->transport_state &CMD_T_ABORTED ) { aborted = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/84 dmaengine: shdma: increase size of dev_id
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinod Koul <[email protected]>
[ Upstream commit 404290240827c3bb5c4e195174a8854eef2f89ac ]
We seem to have hit warnings of 'output may be truncated' which is fixed by increasing the size of 'dev_id'
drivers/dma/sh/shdmac.c: In function ‘sh_dmae_probe’:drivers/dma/sh/shdmac.c:541:34: error: ‘%d’ directive output may be truncated writing between 1 and 10 bytes into a region of size 9 [-Werror=format-truncation=]
541 | "sh-dmae%d.%d", pdev->id, id);
| ^~
In function ‘sh_dmae_chan_probe’,
inlined from ‘sh_dmae_probe’ at drivers/dma/sh/shdmac.c:845:9:drivers/dma/sh/shdmac.c:541:26: note: directive argument in the range [0, 2147483647]
541 | "sh-dmae%d.%d", pdev->id, id);
| ^~~~~~~~~~~~~~
drivers/dma/sh/shdmac.c:541:26: note: directive argument in the range [0, 19]
drivers/dma/sh/shdmac.c:540:17: note: ‘snprintf’ output between 11 and 21 bytes into a destination of size 16
540 | snprintf(sh_chan->dev_id, sizeof(sh_chan->dev_id),
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
541 | "sh-dmae%d.%d", pdev->id, id);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~--- drivers/dma/sh/shdma.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/sh/shdma.h +1 -1
@@ -25,7 +25,7 @@ struct sh_dmae_chan {const struct sh_dmae_slave_config *config;/* Slave DMA configuration */ int xmit_shift;/* log_2(bytes_per_xfer) */ void __iomem *base; -char dev_id[16 ];/* unique name per DMAC of channel */ +char dev_id[32 ];/* unique name per DMAC of channel */ int pm_error;dma_addr_t slave_addr; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/84 dmaengine: fsl-qdma: increase size of irq_name
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinod Koul <[email protected]>
[ Upstream commit 6386f6c995b3ab91c72cfb76e4465553c555a8da ]
We seem to have hit warnings of 'output may be truncated' which is fixed by increasing the size of 'irq_name'
drivers/dma/fsl-qdma.c: In function ‘fsl_qdma_irq_init’:drivers/dma/fsl-qdma.c:824:46: error: ‘%d’ directive writing between 1 and 11 bytes into a region of size 10 [-Werror=format-overflow=]
824 | sprintf(irq_name, "qdma-queue%d", i);
| ^~drivers/dma/fsl-qdma.c:824:35: note: directive argument in the range [-2147483641, 2147483646]
824 | sprintf(irq_name, "qdma-queue%d", i);
| ^~~~~~~~~~~~~~
drivers/dma/fsl-qdma.c:824:17: note: ‘sprintf’ output between 12 and 22 bytes into a destination of size 20
824 | sprintf(irq_name, "qdma-queue%d", i);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~--- drivers/dma/fsl-qdma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/fsl-qdma.c +1 -1
@@ -754,7 +754,7 @@ fsl_qdma_irq_init(struct platform_device *pdev,int i;int cpu;int ret; -char irq_name[20 ]; +char irq_name[32 ]; fsl_qdma->error_irq =platform_get_irq_byname (pdev,"qdma-error" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/84 wifi: cfg80211: fix missing interfaces when dumping
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Kazior <[email protected]>
[ Upstream commit a6e4f85d3820d00694ed10f581f4c650445dbcda ]
The nl80211_dump_interface() supports resumption in case nl80211_send_iface() doesn't have the resources to complete its work.
The logic would store the progress as iteration offsets for rdev and wdev loops.
However the logic did not properly handle resumption for non-last rdev. Assuming a system with 2 rdevs, with 2 wdevs each, this could happen:
dump(cb=[0, 0]):
if_start=cb[1] (=0)
send rdev0.wdev0 -> ok
send rdev0.wdev1 -> yield
cb[1] = 1
dump(cb=[0, 1]):
if_start=cb[1] (=1)
send rdev0.wdev1 -> ok
// since if_start=1 the rdev0.wdev0 got skipped // through if_idx < if_start
send rdev1.wdev1 -> ok
The if_start needs to be reset back to 0 upon wdev loop end.
The problem is actually hard to hit on a desktop, and even on most routers. The prerequisites for this manifesting was:
- more than 1 wiphy
- a few handful of interfaces
- dump without rdev or wdev filter
I was seeing this with 4 wiphys 9 interfaces each. It'd miss 6 interfaces from the last wiphy reported to userspace.
--- net/wireless/nl80211.c | 1 + 1 file changed, 1 insertion(+)
net/wireless/nl80211.c +1 -0
@@ -3350,6 +3350,7 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback * if_idx++; } + if_start =0 ; wp_idx++; } out:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/84 wifi: mac80211: fix race condition on enabling fast-xmit
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit bcbc84af1183c8cf3d1ca9b78540c2185cd85e7f ]
fast-xmit must only be enabled after the sta has been uploaded to the driver, otherwise it could end up passing the not-yet-uploaded sta via drv_tx calls to the driver, leading to potential crashes because of uninitialized drv_priv data.
Add a missing sta->uploaded check and re-check fast xmit after inserting a sta.
--- net/mac80211/sta_info.c | 2 ++ net/mac80211/tx.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-)
net/mac80211/sta_info.c +2 -0
@@ -683,6 +683,8 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)if (ieee80211_vif_is_mesh (&sdata->vif))mesh_accept_plinks_update (sdata); +ieee80211_check_fast_xmit (sta); +return 0 ; out_remove:sta_info_hash_del (local, sta);
net/mac80211/tx.c +1 -1
@@ -2919,7 +2919,7 @@ void ieee80211_check_fast_xmit(struct sta_info *sta) sdata->vif.type == NL80211_IFTYPE_STATION) goto out; -if (!test_sta_flag (sta,WLAN_STA_AUTHORIZED )) +if (!test_sta_flag (sta,WLAN_STA_AUTHORIZED ) || !sta->uploaded) goto out; if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/84 fbdev: savage: Error out if pixclock equals zero
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fullway Wang <[email protected]>
[ Upstream commit 04e5eac8f3ab2ff52fa191c187a46d4fdbc1e288 ]
The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of pixclock, it may cause divide-by-zero error.
Although pixclock is checked in savagefb_decode_var(), but it is not checked properly in savagefb_probe(). Fix this by checking whether pixclock is zero in the function savagefb_check_var() before info->var.pixclock is used as the divisor.
This is similar to CVE-2022-3061 in i740fb which was fixed by commit 15cf0b8.
--- drivers/video/fbdev/savage/savagefb_driver.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/video/fbdev/savage/savagefb_driver.c +3 -0
@@ -869,6 +869,9 @@ static int savagefb_check_var(struct fb_var_screeninfo *var,DBG ("savagefb_check_var" ); +if (!var->pixclock) +return -EINVAL ; + var->transp.offset =0 ; var->transp.length =0 ;switch (var->bits_per_pixel) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/84 fbdev: sis: Error out if pixclock equals zero
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fullway Wang <[email protected]>
[ Upstream commit e421946be7d9bf545147bea8419ef8239cb7ca52 ]
The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of pixclock, it may cause divide-by-zero error.
In sisfb_check_var(), var->pixclock is used as a divisor to caculate drate before it is checked against zero. Fix this by checking it at the beginning.
This is similar to CVE-2022-3061 in i740fb which was fixed by commit 15cf0b8.
--- drivers/video/fbdev/sis/sis_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/video/fbdev/sis/sis_main.c +2 -0
@@ -1474,6 +1474,8 @@ sisfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) vtotal = var->upper_margin + var->lower_margin + var->vsync_len; +if (!var->pixclock) +return -EINVAL ; pixclock = var->pixclock;if ((var->vmode &FB_VMODE_MASK ) ==FB_VMODE_NONINTERLACED ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/84 ahci: asm1166: correct count of reported ports
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Conrad Kostecki <[email protected]>
[ Upstream commit 0077a504e1a4468669fd2e011108db49133db56e ]
The ASM1166 SATA host controller always reports wrongly, that it has 32 ports. But in reality, it only has six ports.
This seems to be a hardware issue, as all tested ASM1166 SATA host controllers reports such high count of ports.
Example output: ahci 0000:09:00.0: AHCI 0001.0301 32 slots 32 ports 6 Gbps 0xffffff3f impl SATA mode.
By adjusting the port_map, the count is limited to six ports.
New output: ahci 0000:09:00.0: AHCI 0001.0301 32 slots 32 ports 6 Gbps 0x3f impl SATA mode.
--- drivers/ata/ahci.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/ata/ahci.c +5 -0
@@ -618,6 +618,11 @@ MODULE_PARM_DESC(mobile_lpm_policy, "Default LPM policy for mobile chipsets");static void ahci_pci_save_initial_config (struct pci_dev *pdev,struct ahci_host_priv *hpriv) { +if (pdev->vendor ==PCI_VENDOR_ID_ASMEDIA && pdev->device ==0x1166 ) { +dev_info (&pdev->dev,"ASM1166 has only six ports\n" ); + hpriv->saved_port_map =0x3f ; + } +if (pdev->vendor ==PCI_VENDOR_ID_JMICRON && pdev->device ==0x2361 ) {dev_info (&pdev->dev,"JMB361 has only one port\n" ); hpriv->force_port_map =1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/84 ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lennert Buytenhek <[email protected]>
[ Upstream commit 20730e9b277873deeb6637339edcba64468f3da3 ]
With one of the on-board ASM1061 AHCI controllers (1b21:0612) on an ASUSTeK Pro WS WRX80E-SAGE SE WIFI mainboard, a controller hang was observed that was immediately preceded by the following kernel messages:
ahci 0000:28:00.0: Using 64-bit DMA addresses
ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00000 flags=0x0000] ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00300 flags=0x0000] ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00380 flags=0x0000] ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00400 flags=0x0000] ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00680 flags=0x0000] ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00700 flags=0x0000]
The first message is produced by code in drivers/iommu/dma-iommu.c which is accompanied by the following comment that seems to apply:
/*
* Try to use all the 32-bit PCI addresses first. The original SAC vs.
* DAC reasoning loses relevance with PCIe, but enough hardware and
* firmware bugs are still lurking out there that it's safest not to
* venture into the 64-bit space until necessary.
*
* If your device goes wrong after seeing the notice then likely either
* its driver is not setting DMA masks accurately, the hardware has
* some inherent bug in handling >32-bit addresses, or not all the
* expected address bits are wired up between the device and the IOMMU. */
Asking the ASM1061 on a discrete PCIe card to DMA from I/O virtual address 0xffffffff00000000 produces the following I/O page faults:
vfio-pci 0000:07:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0021 address=0x7ff00000000 flags=0x0010] vfio-pci 0000:07:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0021 address=0x7ff00000500 flags=0x0010]
Note that the upper 21 bits of the logged DMA address are zero. (When asking a different PCIe device in the same PCIe slot to DMA to the same I/O virtual address, we do see all the upper 32 bits of the DMA address as 1, so this is not an issue with the chipset or IOMMU configuration on the test system.)
Also, hacking libahci to always set the upper 21 bits of all DMA addresses to 1 produces no discernible effect on the behavior of the ASM1061, and mkfs/mount/scrub/etc work as without this hack.
This all strongly suggests that the ASM1061 has a 43 bit DMA address limit, and this commit therefore adds a quirk to deal with this limit.
This issue probably applies to (some of) the other supported ASMedia parts as well, but we limit it to the PCI IDs known to refer to ASM1061 parts, as that's the only part we know for sure to be affected by this issue at this point.
--- drivers/ata/ahci.c | 29 +++++++++++++++++++++++------ drivers/ata/ahci.h | 1 + 2 files changed, 24 insertions(+), 6 deletions(-)
drivers/ata/ahci.c +23 -6
@@ -48,6 +48,7 @@ enum {enum board_ids {/* board IDs by feature in alphabetical order */ board_ahci, + board_ahci_43bit_dma, board_ahci_ign_iferr, board_ahci_mobile, board_ahci_nomsi,
@@ -126,6 +127,13 @@ static const struct ata_port_info ahci_port_info[] = { .udma_mask = ATA_UDMA6, .port_ops = &ahci_ops, }, + [board_ahci_43bit_dma] = { + AHCI_HFLAGS (AHCI_HFLAG_43BIT_ONLY), + .flags = AHCI_FLAG_COMMON, + .pio_mask = ATA_PIO4, + .udma_mask = ATA_UDMA6, + .port_ops = &ahci_ops, + }, [board_ahci_ign_iferr] = { AHCI_HFLAGS (AHCI_HFLAG_IGN_IRQ_IF_ERR), .flags = AHCI_FLAG_COMMON,
@@ -561,11 +569,11 @@ static const struct pci_device_id ahci_pci_tbl[] = { { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci }, /* PDC42819 */ { PCI_VDEVICE(PROMISE, 0x3781), board_ahci }, /* FastTrak TX8660 ahci-mode */ -/* Asmedia */ +/* ASMedia */ { PCI_VDEVICE(ASMEDIA, 0x0601), board_ahci }, /* ASM1060 */ { PCI_VDEVICE(ASMEDIA, 0x0602), board_ahci }, /* ASM1060 */ - { PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci }, /* ASM1061 */ - { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci }, /* ASM1062 */ + { PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci_43bit_dma }, /* ASM1061 */ + { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci_43bit_dma }, /* ASM1061/1062 */ { PCI_VDEVICE(ASMEDIA, 0x0621), board_ahci }, /* ASM1061R */ { PCI_VDEVICE(ASMEDIA, 0x0622), board_ahci }, /* ASM1062R */
@@ -916,11 +924,20 @@ static int ahci_pci_device_resume(struct device *dev)#endif /* CONFIG_PM */ -static int ahci_configure_dma_masks (struct pci_dev *pdev,int using_dac) +static int ahci_configure_dma_masks (struct pci_dev *pdev, +struct ahci_host_priv *hpriv) { -const int dma_bits = using_dac ?64 :32 ; +int dma_bits;int rc; +if (hpriv->cap &HOST_CAP_64 ) { + dma_bits =64 ; +if (hpriv->flags &AHCI_HFLAG_43BIT_ONLY ) + dma_bits =43 ; + }else { + dma_bits =32 ; + } +/* * If the device fixup already set the dma_mask to some non-standard * value, don't extend it here. This happens on STA2X11, for example.
@@ -1880,7 +1897,7 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)ahci_gtf_filter_workaround (host);/* initialize adapter */ - rc =ahci_configure_dma_masks (pdev, hpriv->cap &HOST_CAP_64 ); + rc =ahci_configure_dma_masks (pdev, hpriv);if (rc)return rc;
drivers/ata/ahci.h +1 -0
@@ -244,6 +244,7 @@ enum {AHCI_HFLAG_IGN_NOTSUPP_POWER_ON =BIT (27 ),/* ignore -EOPNOTSUPP from phy_power_on() */ AHCI_HFLAG_NO_SXS =BIT (28 ),/* SXS not supported */ + AHCI_HFLAG_43BIT_ONLY = BIT(29), /* 43bit DMA addr limit *//* ap->flags bits */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/84 ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit 4530b3660d396a646aad91a787b6ab37cf604b53 ]
Determine if the group block bitmap is corrupted before using ac_b_ex in ext4_mb_try_best_found() to avoid allocating blocks from a group with a corrupted block bitmap in the following concurrency and making the situation worse.
ext4_mb_regular_allocator
ext4_lock_group(sb, group)
ext4_mb_good_group
// check if the group bbitmap is corrupted
ext4_mb_complex_scan_group
// Scan group gets ac_b_ex but doesn't use it
ext4_unlock_group(sb, group)
ext4_mark_group_bitmap_corrupted(group)
// The block bitmap was corrupted during
// the group unlock gap.
ext4_mb_try_best_found
ext4_lock_group(ac->ac_sb, group)
ext4_mb_use_best_found
mb_mark_used
// Allocating blocks in block bitmap corrupted group--- fs/ext4/mballoc.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/ext4/mballoc.c +4 -0
@@ -1802,6 +1802,9 @@ int ext4_mb_try_best_found(struct ext4_allocation_context *ac,return err;ext4_lock_group (ac->ac_sb, group); +if (unlikely (EXT4_MB_GRP_BBITMAP_CORRUPT (e4b->bd_info))) + goto out; + max =mb_find_extent (e4b, ex.fe_start, ex.fe_len, &ex);if (max >0 ) {
@@ -1809,6 +1812,7 @@ int ext4_mb_try_best_found(struct ext4_allocation_context *ac,ext4_mb_use_best_found (ac, e4b); } +out:ext4_unlock_group (ac->ac_sb, group);ext4_mb_unload_buddy (e4b);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/84 ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit 832698373a25950942c04a512daa652c18a9b513 ]
Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avoid allocating blocks from the group with a corrupted block bitmap.
--- fs/ext4/mballoc.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
fs/ext4/mballoc.c +4 -5
@@ -1839,12 +1839,10 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac,if (err)return err; -if (unlikely (EXT4_MB_GRP_BBITMAP_CORRUPT (e4b->bd_info))) { -ext4_mb_unload_buddy (e4b); -return 0 ; - } -ext4_lock_group (ac->ac_sb, group); +if (unlikely (EXT4_MB_GRP_BBITMAP_CORRUPT (e4b->bd_info))) + goto out; + max =mb_find_extent (e4b, ac->ac_g_ex.fe_start, ac->ac_g_ex.fe_len, &ex); ex.fe_logical =0xDEADFA11 ;/* debug value */
@@ -1877,6 +1875,7 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, ac->ac_b_ex = ex;ext4_mb_use_best_found (ac, e4b); } +out:ext4_unlock_group (ac->ac_sb, group);ext4_mb_unload_buddy (e4b);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/84 regulator: pwm-regulator: Add validity checks in continuous .get_voltage
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Blumenstingl <[email protected]>
[ Upstream commit c92688cac239794e4a1d976afa5203a4d3a2ac0e ]
Continuous regulators can be configured to operate only in a certain duty cycle range (for example from 0..91%). Add a check to error out if the duty cycle translates to an unsupported (or out of range) voltage.
--- drivers/regulator/pwm-regulator.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/regulator/pwm-regulator.c +3 -0
@@ -158,6 +158,9 @@ static int pwm_regulator_get_voltage(struct regulator_dev *rdev)pwm_get_state (drvdata->pwm, &pstate); voltage =pwm_get_relative_duty_cycle (&pstate, duty_unit); +if (voltage <min (max_uV_duty, min_uV_duty) || + voltage >max (max_uV_duty, min_uV_duty)) +return -ENOTRECOVERABLE ;/* * The dutycycle for min_uV might be greater than the one for max_uV.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/84 nvmet-tcp: fix nvme tcp ida memory leak
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixin Liu <[email protected]>
[ Upstream commit 47c5dd66c1840524572dcdd956f4af2bdb6fbdff ]
The nvmet_tcp_queue_ida should be destroy when the nvmet-tcp module exit.
--- drivers/nvme/target/tcp.c | 1 + 1 file changed, 1 insertion(+)
drivers/nvme/target/tcp.c +1 -0
@@ -1817,6 +1817,7 @@ static void __exit nvmet_tcp_exit(void)flush_scheduled_work ();destroy_workqueue (nvmet_tcp_wq); +ida_destroy (&nvmet_tcp_queue_ida); }module_init (nvmet_tcp_init);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/84 ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 0adf963b8463faa44653e22e56ce55f747e68868 ]
The SPDIF hardware block found in the H616 SoC has the same layout as the one found in the H6 SoC, except that it is missing the receiver side.
Since the driver currently only supports the transmit function, support for the H616 is identical to what is currently done for the H6.
--- sound/soc/sunxi/sun4i-spdif.c | 5 +++++ 1 file changed, 5 insertions(+)
sound/soc/sunxi/sun4i-spdif.c +5 -0
@@ -464,6 +464,11 @@ static const struct of_device_id sun4i_spdif_of_match[] = { .compatible = "allwinner,sun50i-h6-spdif", .data = &sun50i_h6_spdif_quirks, }, + { + .compatible = "allwinner,sun50i-h616-spdif", + /* Essentially the same as the H6, but without RX */ + .data = &sun50i_h6_spdif_quirks, + }, {/* sentinel */ } };MODULE_DEVICE_TABLE (of, sun4i_spdif_of_match);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/84 netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 6e348067ee4bc5905e35faa3a8fafa91c9124bc7 ]
The annotation says in sctp_new(): "If it is a shutdown ack OOTB packet, we expect a return shutdown complete, otherwise an ABORT Sec 8.4 (5) and (8)". However, it does not check SCTP_CID_SHUTDOWN_ACK before setting vtag[REPLY] in the conntrack entry(ct).
Because of that, if the ct in Router disappears for some reason in [1] with the packet sequence like below:
Client > Server: sctp (1) [INIT] [init tag: 3201533963] Server > Client: sctp (1) [INIT ACK] [init tag: 972498433] Client > Server: sctp (1) [COOKIE ECHO]
Server > Client: sctp (1) [COOKIE ACK]
Client > Server: sctp (1) [DATA] (B)(E) [TSN: 3075057809] Server > Client: sctp (1) [SACK] [cum ack 3075057809] Server > Client: sctp (1) [HB REQ]
(the ct in Router disappears somehow) <-------- [1] Client > Server: sctp (1) [HB ACK]
Client > Server: sctp (1) [DATA] (B)(E) [TSN: 3075057810] Client > Server: sctp (1) [DATA] (B)(E) [TSN: 3075057810] Client > Server: sctp (1) [HB REQ]
Client > Server: sctp (1) [DATA] (B)(E) [TSN: 3075057810] Client > Server: sctp (1) [HB REQ]
Client > Server: sctp (1) [ABORT]
when processing HB ACK packet in Router it calls sctp_new() to initialize the new ct with vtag[REPLY] set to HB_ACK packet's vtag.
Later when sending DATA from Client, all the SACKs from Server will get dropped in Router, as the SACK packet's vtag does not match vtag[REPLY] in the ct. The worst thing is the vtag in this ct will never get fixed by the upcoming packets from Server.
This patch fixes it by checking SCTP_CID_SHUTDOWN_ACK before setting vtag[REPLY] in the ct in sctp_new() as the annotation says. With this fix, it will leave vtag[REPLY] in ct to 0 in the case above, and the next HB REQ/ACK from Server is able to fix the vtag as its value is 0 in nf_conntrack_sctp_packet().
--- net/netfilter/nf_conntrack_proto_sctp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_conntrack_proto_sctp.c +1 -1
@@ -299,7 +299,7 @@ sctp_new(struct nf_conn *ct, const struct sk_buff *skb,pr_debug ("Setting vtag %x for secondary conntrack\n" , sh->vtag); ct->proto.sctp.vtag[IP_CT_DIR_ORIGINAL ] = sh->vtag; - }else { + }else if (sch->type ==SCTP_CID_SHUTDOWN_ACK ) {/* If it is a shutdown ack OOTB packet, we expect a return shutdown complete, otherwise an ABORT Sec 8.4 (5) and (8) */ pr_debug("Setting vtag %x for new conn OOTB\n",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/84 nvmet-fc: abort command when there is no binding
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <[email protected]>
[ Upstream commit 3146345c2e9c2f661527054e402b0cfad80105a4 ]
When the target port has not active port binding, there is no point in trying to process the command as it has to fail anyway. Instead adding checks to all commands abort the command early.
--- drivers/nvme/target/fc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/nvme/target/fc.c +6 -2
@@ -796,6 +796,9 @@ nvmet_fc_alloc_target_assoc(struct nvmet_fc_tgtport *tgtport)int idx;bool needrandom = true; +if (!tgtport->pe) +return NULL ; + assoc =kzalloc (sizeof (*assoc),GFP_KERNEL );if (!assoc)return NULL ;
@@ -2180,8 +2183,9 @@ nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport, fod->req.cmd = &fod->cmdiubuf.sqe; fod->req.cqe = &fod->rspiubuf.cqe; -if (tgtport->pe) - fod->req.port = tgtport->pe->port; +if (!tgtport->pe) + goto transport_error; + fod->req.port = tgtport->pe->port;/* clear any response payload */ memset (&fod->rspiubuf,0 ,sizeof (fod->rspiubuf));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/84 hwmon: (coretemp) Enlarge per package core count limit
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Rui <[email protected]>
[ Upstream commit 34cf8c657cf0365791cdc658ddbca9cc907726ce ]
Currently, coretemp driver supports only 128 cores per package. This loses some core temperature information on systems that have more than 128 cores per package.
[ 58.685033] coretemp coretemp.0: Adding Core 128 failed [ 58.692009] coretemp coretemp.0: Adding Core 129 failed ...
Enlarge the limitation to 512 because there are platforms with more than 256 cores per package.
--- drivers/hwmon/coretemp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/coretemp.c +1 -1
@@ -40,7 +40,7 @@ MODULE_PARM_DESC(tjmax, "TjMax value in degrees Celsius");#define PKG_SYSFS_ATTR_NO 1/* Sysfs attribute for package temp */ #define BASE_SYSFS_ATTR_NO 2/* Sysfs Base attr no for coretemp */ -#define NUM_REAL_CORES 128/* Number of Real cores per cpu */ +#define NUM_REAL_CORES 512/* Number of Real cores per cpu */ #define CORETEMP_NAME_LENGTH 28/* String Length of attrs */ #define MAX_CORE_ATTRS 4/* Maximum no of basic attrs */ #define TOTAL_ATTRS (MAX_CORE_ATTRS + 1)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/84 scsi: lpfc: Use unsigned type for num_sge
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Reinecke <[email protected]>
[ Upstream commit d6c1b19153f92e95e5e1801d540e98771053afae ]
LUNs going into "failed ready running" state observed on >1T and on even numbers of size (2T, 4T, 6T, 8T and 10T). The issue occurs when DIF is enabled at the host.
The kernel logs:
Cannot setup S/G List for HBAIO segs 1/1 SGL 512 SCSI 256: 3 0
The host lpfc driver is failing to setup scatter/gather list (protection data) for the I/Os.
The return type lpfc_bg_setup_sgl()/lpfc_bg_setup_sgl_prot() causes the compiler to remove the most significant bit. Use an unsigned type instead.
--- drivers/scsi/lpfc/lpfc_scsi.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/scsi/lpfc/lpfc_scsi.c +6 -6
@@ -1942,7 +1942,7 @@ lpfc_bg_setup_bpl_prot(struct lpfc_hba *phba, struct scsi_cmnd *sc,* * Returns the number of SGEs added to the SGL. **/ -static int +static uint32_t lpfc_bg_setup_sgl (struct lpfc_hba *phba,struct scsi_cmnd *sc,struct sli4_sge *sgl,int datasegcnt,struct lpfc_io_buf *lpfc_cmd)
@@ -1950,8 +1950,8 @@ lpfc_bg_setup_sgl(struct lpfc_hba *phba, struct scsi_cmnd *sc,struct scatterlist *sgde =NULL ;/* s/g data entry */ struct sli4_sge_diseed *diseed =NULL ;dma_addr_t physaddr; -int i =0 , num_sge =0 , status; -uint32_t reftag; +int i =0 , status; +uint32_t reftag, num_sge =0 ;uint8_t txop, rxop;#ifdef CONFIG_SCSI_LPFC_DEBUG_FS uint32_t rc;
@@ -2122,7 +2122,7 @@ lpfc_bg_setup_sgl(struct lpfc_hba *phba, struct scsi_cmnd *sc,* * Returns the number of SGEs added to the SGL. **/ -static int +static uint32_t lpfc_bg_setup_sgl_prot (struct lpfc_hba *phba,struct scsi_cmnd *sc,struct sli4_sge *sgl,int datacnt,int protcnt,struct lpfc_io_buf *lpfc_cmd)
@@ -2146,8 +2146,8 @@ lpfc_bg_setup_sgl_prot(struct lpfc_hba *phba, struct scsi_cmnd *sc,uint32_t rc;#endif uint32_t checking =1 ; -uint32_t dma_offset =0 ; -int num_sge =0 , j =2 ; +uint32_t dma_offset =0 , num_sge =0 ; +int j =2 ;struct sli4_hybrid_sgl *sgl_xtra =NULL ; sgpe =scsi_prot_sglist (sc);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/84 firewire: core: send bus reset promptly on gap count error
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <[email protected]>
[ Upstream commit 7ed4380009e96d9e9c605e12822e987b35b05648 ]
If we are bus manager and the bus has inconsistent gap counts, send a bus reset immediately instead of trying to read the root node's config ROM first. Otherwise, we could spend a lot of time trying to read the config ROM but never succeeding.
This eliminates a 50+ second delay before the FireWire bus is usable after a newly connected device is powered on in certain circumstances.
The delay occurs if a gap count inconsistency occurs, we are not the root node, and we become bus manager. One scenario that causes this is with a TI XIO2213B OHCI, the first time a Sony DSR-25 is powered on after being connected to the FireWire cable. In this configuration, the Linux box will not receive the initial PHY configuration packet sent by the DSR-25 as IRM, resulting in the DSR-25 having a gap count of 44 while the Linux box has a gap count of 63.
FireWire devices have a gap count parameter, which is set to 63 on power-up and can be changed with a PHY configuration packet. This determines the duration of the subaction and arbitration gaps. For reliable communication, all nodes on a FireWire bus must have the same gap count.
A node may have zero or more of the following roles: root node, bus manager (BM), isochronous resource manager (IRM), and cycle master. Unless a root node was forced with a PHY configuration packet, any node might become root node after a bus reset. Only the root node can become cycle master. If the root node is not cycle master capable, the BM or IRM should force a change of root node.
After a bus reset, each node sends a self-ID packet, which contains its current gap count. A single bus reset does not change the gap count, but two bus resets in a row will set the gap count to 63. Because a consistent gap count is required for reliable communication, IEEE 1394a-2000 requires that the bus manager generate a bus reset if it detects that the gap count is inconsistent.
When the gap count is inconsistent, build_tree() will notice this after the self identification process. It will set card->gap_count to the invalid value 0. If we become bus master, this will force bm_work() to send a bus reset when it performs gap count optimization.
After a bus reset, there is no bus manager. We will almost always try to become bus manager. Once we become bus manager, we will first determine whether the root node is cycle master capable. Then, we will determine if the gap count should be changed. If either the root node or the gap count should be changed, we will generate a bus reset.
To determine if the root node is cycle master capable, we read its configuration ROM. bm_work() will wait until we have finished trying to read the configuration ROM.
However, an inconsistent gap count can make this take a long time. read_config_rom() will read the first few quadlets from the config ROM. Due to the gap count inconsistency, eventually one of the reads will time out. When read_config_rom() fails, fw_device_init() calls it again until MAX_RETRIES is reached. This takes 50+ seconds.
Once we give up trying to read the configuration ROM, bm_work() will wake up, assume that the root node is not cycle master capable, and do a bus reset. Hopefully, this will resolve the gap count inconsistency.
This change makes bm_work() check for an inconsistent gap count before waiting for the root node's configuration ROM. If the gap count is inconsistent, bm_work() will immediately do a bus reset. This eliminates the 50+ second delay and rapidly brings the bus to a working state.
I considered that if the gap count is inconsistent, a PHY configuration packet might not be successful, so it could be desirable to skip the PHY configuration packet before the bus reset in this case. However, IEEE 1394a-2000 and IEEE 1394-2008 say that the bus manager may transmit a PHY configuration packet before a bus reset when correcting a gap count error. Since the standard endorses this, I decided it's safe to retain the PHY configuration packet transmission.
Normally, after a topology change, we will reset the bus a maximum of 5 times to change the root node and perform gap count optimization. However, if there is a gap count inconsistency, we must always generate a bus reset. Otherwise the gap count inconsistency will persist and communication will be unreliable. For that reason, if there is a gap count inconstency, we generate a bus reset even if we already reached the 5 reset limit.
Reference: https://sourceforge.net/p/linux1394/mailman/message/58727806/
--- drivers/firewire/core-card.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
drivers/firewire/core-card.c +17 -1
@@ -429,7 +429,23 @@ static void bm_work(struct work_struct *work)*/ card->bm_generation = generation; -if (root_device ==NULL ) { +if (card->gap_count ==0 ) { +/* +* If self IDs have inconsistent gap counts, do a +* bus reset ASAP. The config rom read might never +* complete, so don't wait for it. However, still +* send a PHY configuration packet prior to the +* bus reset. The PHY configuration packet might +* fail, but 1394-2008 8.4.5.2 explicitly permits +* it in this case, so it should be safe to try. +*/ + new_root_id = local_id; +/* +* We must always send a bus reset if the gap count +* is inconsistent, so bypass the 5-reset limit. +*/ + card->bm_retries =0 ; + }else if (root_device ==NULL ) {/* * Either link_on is false, or we failed to read the * config rom. In either case, pick another root.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/84 virtio-blk: Ensure no requests in virtqueues before deleting vqs.
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Sun <[email protected]>
[ Upstream commit 4ce6e2db00de8103a0687fb0f65fd17124a51aaa ]
Ensure no remaining requests in virtqueues before resetting vdev and deleting virtqueues. Otherwise these requests will never be completed. It may cause the system to become unresponsive.
Function blk_mq_quiesce_queue() can ensure that requests have become in_flight status, but it cannot guarantee that requests have been processed by the device. Virtqueues should never be deleted before all requests become complete status.
Function blk_mq_freeze_queue() ensure that all requests in virtqueues become complete status. And no requests can enter in virtqueues.
--- drivers/block/virtio_blk.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/block/virtio_blk.c +4 -3
@@ -1063,14 +1063,15 @@ static int virtblk_freeze(struct virtio_device *vdev) {struct virtio_blk *vblk = vdev->priv; +/* Ensure no requests in virtqueues before deleting vqs. */ +blk_mq_freeze_queue (vblk->disk->queue); +/* Ensure we don't receive any more interrupts */ vdev->config->reset (vdev);/* Make sure no work handler is accessing the device. */ flush_work (&vblk->config_work); -blk_mq_quiesce_queue (vblk->disk->queue); - vdev->config->del_vqs (vdev);kfree (vblk->vqs);
@@ -1088,7 +1089,7 @@ static int virtblk_restore(struct virtio_device *vdev)virtio_device_ready (vdev); -blk_mq_unquiesce_queue (vblk->disk->queue); +blk_mq_unfreeze_queue (vblk->disk->queue); return 0; }#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/84 s390/qeth: Fix potential loss of L3-IP@ in case of network issues
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandra Winter <[email protected]>
[ Upstream commit 2fe8a236436fe40d8d26a1af8d150fc80f04ee1a ]
Symptom:
In case of a bad cable connection (e.g. dirty optics) a fast sequence of network DOWN-UP-DOWN-UP could happen. UP triggers recovery of the qeth interface. In case of a second DOWN while recovery is still ongoing, it can happen that the IP@ of a Layer3 qeth interface is lost and will not be recovered by the second UP.
Problem:
When registration of IP addresses with Layer 3 qeth devices fails, (e.g. because of bad address format) the respective IP address is deleted from its hash-table in the driver. If registration fails because of a ENETDOWN condition, the address should stay in the hashtable, so a subsequent recovery can restore it.
3caa4af834df ("qeth: keep ip-address after LAN_OFFLINE failure") fixes this for registration failures during normal operation, but not during recovery.
Solution:
Keep L3-IP address in case of ENETDOWN in qeth_l3_recover_ip(). For consistency with qeth_l3_add_ip() we also keep it in case of EADDRINUSE, i.e. for some reason the card already/still has this address registered.
--- drivers/s390/net/qeth_l3_main.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/s390/net/qeth_l3_main.c +6 -3
@@ -305,9 +305,10 @@ static void qeth_l3_clear_ip_htable(struct qeth_card *card, int recover)if (!recover) {hash_del (&addr->hnode);kfree (addr); -continue ; + }else { +/* prepare for recovery */ + addr->disp_flag =QETH_DISP_ADDR_ADD ; } - addr->disp_flag =QETH_DISP_ADDR_ADD ; }mutex_unlock (&card->ip_lock);
@@ -335,11 +336,13 @@ static void qeth_l3_recover_ip(struct qeth_card *card) }else rc =qeth_l3_register_addr_entry (card, addr); -if (!rc) { +if (!rc || rc == -EADDRINUSE || rc == -ENETDOWN ) { +/* keep it in the records */ addr->disp_flag =QETH_DISP_ADDR_DO_NOTHING ;if (addr->ref_counter <1 )qeth_l3_delete_ip (card, addr); }else { +/* bad address */ hash_del (&addr->hnode);kfree (addr); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/84 pmdomain: renesas: r8a77980-sysc: CR7 must be always on
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit f0e4a1356466ec1858ae8e5c70bea2ce5e55008b ]
The power domain containing the Cortex-R7 CPU core on the R-Car V3H SoC must always be in power-on state, unlike on other SoCs in the R-Car Gen3 family. See Table 9.4 "Power domains" in the R-Car Series, 3rd Generation Hardware User’s Manual Rev.1.00 and later.
Fix this by marking the domain as a CPU domain without control registers, so the driver will not touch it.
--- drivers/soc/renesas/r8a77980-sysc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/soc/renesas/r8a77980-sysc.c +2 -1
@@ -25,7 +25,8 @@ static const struct rcar_sysc_area r8a77980_areas[] __initconst = { PD_CPU_NOCR }, {"ca53-cpu3" ,0x200 ,3 ,R8A77980_PD_CA53_CPU3 ,R8A77980_PD_CA53_SCU , PD_CPU_NOCR }, - { "cr7", 0x240, 0, R8A77980_PD_CR7, R8A77980_PD_ALWAYS_ON }, + { "cr7", 0x240, 0, R8A77980_PD_CR7, R8A77980_PD_ALWAYS_ON, + PD_CPU_NOCR }, { "a3ir", 0x180, 0, R8A77980_PD_A3IR, R8A77980_PD_ALWAYS_ON }, { "a2ir0", 0x400, 0, R8A77980_PD_A2IR0, R8A77980_PD_A3IR }, { "a2ir1", 0x400, 1, R8A77980_PD_A2IR1, R8A77980_PD_A3IR },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/84 tcp: factor out __tcp_close() helper
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
[ Upstream commit 77c3c95637526f1e4330cc9a4b2065f668c2c4fe ]
unlocked version of protocol level close, will be used by MPTCP to allow decouple orphaning and subflow level close.
--- include/net/tcp.h | 1 + net/ipv4/tcp.c | 9 +++++++-- 2 files changed, 8 insertions(+), 2 deletions(-)
include/net/tcp.h +1 -0
@@ -391,6 +391,7 @@ void tcp_update_metrics(struct sock *sk);void tcp_init_metrics (struct sock *sk);void tcp_metrics_init (void );bool tcp_peer_is_proven (struct request_sock *req,struct dst_entry *dst); +void __tcp_close (struct sock *sk,long timeout);void tcp_close (struct sock *sk,long timeout);void tcp_init_sock (struct sock *sk);void tcp_init_transfer (struct sock *sk,int bpf_op);
net/ipv4/tcp.c +7 -2
@@ -2351,13 +2351,12 @@ bool tcp_check_oom(struct sock *sk, int shift)return too_many_orphans || out_of_socket_memory; } -void tcp_close (struct sock *sk,long timeout) +void __tcp_close (struct sock *sk,long timeout) {struct sk_buff *skb;int data_was_unread =0 ;int state; -lock_sock (sk); sk->sk_shutdown =SHUTDOWN_MASK ;if (sk->sk_state ==TCP_LISTEN ) {
@@ -2521,6 +2520,12 @@ void tcp_close(struct sock *sk, long timeout) out:bh_unlock_sock (sk);local_bh_enable (); +} + +void tcp_close (struct sock *sk,long timeout) +{ +lock_sock (sk); +__tcp_close (sk, timeout);release_sock (sk);sock_put (sk); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/84 tcp: return EPOLLOUT from tcp_poll only when notsent_bytes is half the limit
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Soheil Hassas Yeganeh <[email protected]>
[ Upstream commit 8ba3c9d1c6d75d1e6af2087278b30e17f68e1fff ]
If there was any event available on the TCP socket, tcp_poll() will be called to retrieve all the events. In tcp_poll(), we call sk_stream_is_writeable() which returns true as long as we are at least one byte below notsent_lowat. This will result in quite a few spurious EPLLOUT and frequent tiny sendmsg() calls as a result.
Similar to sk_stream_write_space(), use __sk_stream_is_writeable with a wake value of 1, so that we set EPOLLOUT only if half the space is available for write.
--- net/ipv4/tcp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/ipv4/tcp.c +2 -2
@@ -566,7 +566,7 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait) mask |=EPOLLIN |EPOLLRDNORM ;if (!(sk->sk_shutdown &SEND_SHUTDOWN )) { -if (sk_stream_is_writeable (sk)) { +if (__sk_stream_is_writeable (sk,1 )) { mask |=EPOLLOUT |EPOLLWRNORM ; }else {/* send SIGIO later */ sk_set_bit (SOCKWQ_ASYNC_NOSPACE , sk);
@@ -578,7 +578,7 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait)* pairs with the input side. */ smp_mb__after_atomic (); -if (sk_stream_is_writeable (sk)) +if (__sk_stream_is_writeable (sk,1 )) mask |=EPOLLOUT |EPOLLWRNORM ; } }else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/84 tcp: add annotations around sk->sk_shutdown accesses
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit e14cadfd80d76f01bfaa1a8d745b1db19b57d6be ]
Now sk->sk_shutdown is no longer a bitfield, we can add standard READ_ONCE()/WRITE_ONCE() annotations to silence KCSAN reports like the following:
BUG: KCSAN: data-race in tcp_disconnect / tcp_poll
write to 0xffff88814588582c of 1 bytes by task 3404 on cpu 1:
tcp_disconnect+0x4d6/0xdb0 net/ipv4/tcp.c:3121 __inet_stream_connect+0x5dd/0x6e0 net/ipv4/af_inet.c:715 inet_stream_connect+0x48/0x70 net/ipv4/af_inet.c:727 __sys_connect_file net/socket.c:2001 [inline] __sys_connect+0x19b/0x1b0 net/socket.c:2018 __do_sys_connect net/socket.c:2028 [inline] __se_sys_connect net/socket.c:2025 [inline] __x64_sys_connect+0x41/0x50 net/socket.c:2025 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
read to 0xffff88814588582c of 1 bytes by task 3374 on cpu 0:
tcp_poll+0x2e6/0x7d0 net/ipv4/tcp.c:562 sock_poll+0x253/0x270 net/socket.c:1383 vfs_poll include/linux/poll.h:88 [inline] io_poll_check_events io_uring/poll.c:281 [inline] io_poll_task_func+0x15a/0x820 io_uring/poll.c:333 handle_tw_list io_uring/io_uring.c:1184 [inline] tctx_task_work+0x1fe/0x4d0 io_uring/io_uring.c:1246 task_work_run+0x123/0x160 kernel/task_work.c:179 get_signal+0xe64/0xff0 kernel/signal.c:2635 arch_do_signal_or_restart+0x89/0x2a0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop+0x6f/0xe0 kernel/entry/common.c:168 exit_to_user_mode_prepare+0x6c/0xb0 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x26/0x140 kernel/entry/common.c:297 do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd
value changed: 0x03 -> 0x00
--- net/ipv4/af_inet.c | 2 +- net/ipv4/tcp.c | 14 ++++++++------ net/ipv4/tcp_input.c | 4 ++-- 3 files changed, 11 insertions(+), 9 deletions(-)
net/ipv4/af_inet.c +1 -1
@@ -876,7 +876,7 @@ int inet_shutdown(struct socket *sock, int how)EPOLLHUP, even on eg. unconnected UDP sockets -- RR */ /* fall through */ default : - sk->sk_shutdown |= how; +WRITE_ONCE (sk->sk_shutdown, sk->sk_shutdown | how);if (sk->sk_prot->shutdown) sk->sk_prot->shutdown (sk, how);break ;
net/ipv4/tcp.c +8 -6
@@ -505,6 +505,7 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait)__poll_t mask;struct sock *sk = sock->sk;const struct tcp_sock *tp =tcp_sk (sk); +u8 shutdown;int state;sock_poll_wait (file, sock, wait);
@@ -547,9 +548,10 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait)* NOTE. Check for TCP_CLOSE is added. The goal is to prevent * blocking on fresh not-connected or disconnected socket. --ANK */ -if (sk->sk_shutdown ==SHUTDOWN_MASK || state ==TCP_CLOSE ) + shutdown =READ_ONCE (sk->sk_shutdown); +if (shutdown ==SHUTDOWN_MASK || state ==TCP_CLOSE ) mask |=EPOLLHUP ; -if (sk->sk_shutdown &RCV_SHUTDOWN ) +if (shutdown &RCV_SHUTDOWN ) mask |=EPOLLIN |EPOLLRDNORM |EPOLLRDHUP ;/* Connected or passive Fast Open socket? */
@@ -565,7 +567,7 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait)if (tcp_stream_is_readable (tp, target, sk)) mask |=EPOLLIN |EPOLLRDNORM ; -if (!(sk->sk_shutdown &SEND_SHUTDOWN )) { +if (!(shutdown &SEND_SHUTDOWN )) {if (__sk_stream_is_writeable (sk,1 )) { mask |=EPOLLOUT |EPOLLWRNORM ; }else {/* send SIGIO later */
@@ -2357,7 +2359,7 @@ void __tcp_close(struct sock *sk, long timeout)int data_was_unread =0 ;int state; - sk->sk_shutdown =SHUTDOWN_MASK ; +WRITE_ONCE (sk->sk_shutdown,SHUTDOWN_MASK );if (sk->sk_state ==TCP_LISTEN ) {tcp_set_state (sk,TCP_CLOSE );
@@ -2629,7 +2631,7 @@ int tcp_disconnect(struct sock *sk, int flags)if (!(sk->sk_userlocks &SOCK_BINDADDR_LOCK ))inet_reset_saddr (sk); - sk->sk_shutdown =0 ; +WRITE_ONCE (sk->sk_shutdown,0 );sock_reset_flag (sk,SOCK_DONE ); tp->srtt_us =0 ; tp->mdev_us =jiffies_to_usecs (TCP_TIMEOUT_INIT );
@@ -3905,7 +3907,7 @@ void tcp_done(struct sock *sk)if (req)reqsk_fastopen_remove (sk, req, false); - sk->sk_shutdown =SHUTDOWN_MASK ; +WRITE_ONCE (sk->sk_shutdown,SHUTDOWN_MASK );if (!sock_flag (sk,SOCK_DEAD )) sk->sk_state_change (sk);
net/ipv4/tcp_input.c +2 -2
@@ -4216,7 +4216,7 @@ void tcp_fin(struct sock *sk)inet_csk_schedule_ack (sk); - sk->sk_shutdown |=RCV_SHUTDOWN ; +WRITE_ONCE (sk->sk_shutdown, sk->sk_shutdown |RCV_SHUTDOWN );sock_set_flag (sk,SOCK_DONE );switch (sk->sk_state) {
@@ -6354,7 +6354,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)break ;tcp_set_state (sk,TCP_FIN_WAIT2 ); - sk->sk_shutdown |=SEND_SHUTDOWN ; +WRITE_ONCE (sk->sk_shutdown, sk->sk_shutdown |SEND_SHUTDOWN );sk_dst_confirm (sk);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/84 pinctrl: pinctrl-rockchip: Fix a bunch of kerneldoc misdemeanours
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <[email protected]>
[ Upstream commit e1524ea84af7172acc20827f8dca3fc8f72b8f37 ]
Demote headers which are clearly not kerneldoc, provide titles for struct definition blocks, fix API slip (bitrot) misspellings and provide some missing entries.
Fixes the following W=1 kernel build warning(s):
drivers/pinctrl/pinctrl-rockchip.c:82: warning: cannot understand function prototype: 'struct rockchip_iomux ' drivers/pinctrl/pinctrl-rockchip.c:97: warning: Enum value 'DRV_TYPE_IO_DEFAULT' not described in enum 'rockchip_pin_drv_type' drivers/pinctrl/pinctrl-rockchip.c:97: warning: Enum value 'DRV_TYPE_IO_1V8_OR_3V0' not described in enum 'rockchip_pin_drv_type' drivers/pinctrl/pinctrl-rockchip.c:97: warning: Enum value 'DRV_TYPE_IO_1V8_ONLY' not described in enum 'rockchip_pin_drv_type' drivers/pinctrl/pinctrl-rockchip.c:97: warning: Enum value 'DRV_TYPE_IO_1V8_3V0_AUTO' not described in enum 'rockchip_pin_drv_type' drivers/pinctrl/pinctrl-rockchip.c:97: warning: Enum value 'DRV_TYPE_IO_3V3_ONLY' not described in enum 'rockchip_pin_drv_type' drivers/pinctrl/pinctrl-rockchip.c:97: warning: Enum value 'DRV_TYPE_MAX' not described in enum 'rockchip_pin_drv_type' drivers/pinctrl/pinctrl-rockchip.c:106: warning: Enum value 'PULL_TYPE_IO_DEFAULT' not described in enum 'rockchip_pin_pull_type' drivers/pinctrl/pinctrl-rockchip.c:106: warning: Enum value 'PULL_TYPE_IO_1V8_ONLY' not described in enum 'rockchip_pin_pull_type' drivers/pinctrl/pinctrl-rockchip.c:106: warning: Enum value 'PULL_TYPE_MAX' not described in enum 'rockchip_pin_pull_type' drivers/pinctrl/pinctrl-rockchip.c:109: warning: Cannot understand * @drv_type: drive strength variant using rockchip_perpin_drv_type on line 109 - I thought it was a doc line
drivers/pinctrl/pinctrl-rockchip.c:122: warning: Cannot understand * @reg_base: register base of the gpio bank
on line 109 - I thought it was a doc line
drivers/pinctrl/pinctrl-rockchip.c:325: warning: Function parameter or member 'route_location' not described in 'rockchip_mux_route_data' drivers/pinctrl/pinctrl-rockchip.c:328: warning: Cannot understand */
on line 109 - I thought it was a doc line
drivers/pinctrl/pinctrl-rockchip.c:375: warning: Function parameter or member 'data' not described in 'rockchip_pin_group' drivers/pinctrl/pinctrl-rockchip.c:387: warning: Function parameter or member 'ngroups' not described in 'rockchip_pmx_func'
--- drivers/pinctrl/pinctrl-rockchip.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
drivers/pinctrl/pinctrl-rockchip.c +12 -10
@@ -62,7 +62,7 @@ enum rockchip_pinctrl_type { RK3399, }; -/** +/* * Encode variants of iomux registers into a type variable */ #define IOMUX_GPIO_ONLY BIT(0)
@@ -72,6 +72,7 @@ enum rockchip_pinctrl_type {#define IOMUX_WIDTH_3BIT BIT(4)/** +* struct rockchip_iomux * @type: iomux variant using IOMUX_* constants * @offset: if initialized to -1 it will be autocalculated, by specifying * an initial offset value the relevant source offset can be reset
@@ -82,7 +83,7 @@ struct rockchip_iomux {int offset; }; -/** +/* * enum type index corresponding to rockchip_perpin_drv_list arrays index. */ enum rockchip_pin_drv_type {
@@ -94,7 +95,7 @@ enum rockchip_pin_drv_type {DRV_TYPE_MAX }; -/** +/* * enum type index corresponding to rockchip_pull_list arrays index. */ enum rockchip_pin_pull_type {
@@ -104,6 +105,7 @@ enum rockchip_pin_pull_type { };/** +* struct rockchip_drv * @drv_type: drive strength variant using rockchip_perpin_drv_type * @offset: if initialized to -1 it will be autocalculated, by specifying * an initial offset value the relevant source offset can be reset
@@ -117,8 +119,9 @@ struct rockchip_drv { };/** +* struct rockchip_pin_bank * @reg_base: register base of the gpio bank -* @reg_pull: optional separate register for additional pull settings +* @regmap_pull: optional separate register for additional pull settings * @clk: clock of the gpio bank * @irq: interrupt of the gpio bank * @saved_masks: Saved content of GPIO_INTEN at suspend time.
@@ -136,6 +139,8 @@ struct rockchip_drv {* @gpio_chip: gpiolib chip * @grange: gpio range * @slock: spinlock for the gpio bank +* @toggle_edge_mode: bit mask to toggle (falling/rising) edge mode +* @recalced_mask: bit mask to indicate a need to recalulate the mask * @route_mask: bits describing the routing pins of per bank */ struct rockchip_pin_bank {
@@ -310,6 +315,7 @@ enum rockchip_mux_route_location {* @bank_num: bank number. * @pin: index at register or used to calc index. * @func: the min pin. +* @route_location: the mux route location (same, pmu, grf). * @route_offset: the max pin. * @route_val: the register offset. */
@@ -322,8 +328,6 @@ struct rockchip_mux_route_data {u32 route_val; }; -/** -*/ struct rockchip_pin_ctrl {struct rockchip_pin_bank *pin_banks;u32 nr_banks;
@@ -361,9 +365,7 @@ struct rockchip_pin_config {* @name: name of the pin group, used to lookup the group. * @pins: the pins included in this group. * @npins: number of pins included in this group. -* @func: the mux function number to be programmed when selected. -* @configs: the config values to be set for each pin -* @nconfigs: number of configs for each pin +* @data: local pin configuration */ struct rockchip_pin_group {const char *name;
@@ -376,7 +378,7 @@ struct rockchip_pin_group {* struct rockchip_pmx_func: represent a pin function. * @name: name of the pin function, used to lookup the function. * @groups: one or more names of pin groups that provide this function. -* @num_groups: number of groups included in @groups. +* @ngroups: number of groups included in @groups. */ struct rockchip_pmx_func {const char *name;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/84 pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
[ Upstream commit c818ae563bf99457f02e8170aabd6b174f629f65 ]
of_find_node_by_phandle() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore.
Add missing of_node_put() to avoid refcount leak.
--- drivers/pinctrl/pinctrl-rockchip.c | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/pinctrl-rockchip.c +1 -0
@@ -2536,6 +2536,7 @@ static int rockchip_pinctrl_parse_groups(struct device_node *np, np_config =of_find_node_by_phandle (be32_to_cpup (phandle)); ret =pinconf_generic_parse_dt_config (np_config,NULL , &grp->data[j].configs, &grp->data[j].nconfigs); +of_node_put (np_config);if (ret)return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/84 driver core: Set deferred_probe_timeout to a longer default if CONFIG_MODULES is set
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Stultz <[email protected]>
[ Upstream commit e2cec7d6853712295cef5377762165a489b2957f ]
When using modules, its common for the modules not to be loaded until quite late by userland. With the current code, driver_deferred_probe_check_state() will stop returning EPROBE_DEFER after late_initcall, which can cause module dependency resolution to fail after that.
So allow a longer window of 30 seconds (picked somewhat arbitrarily, but influenced by the similar regulator core timeout value) in the case where modules are enabled.
--- drivers/base/dd.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/base/dd.c +9 -0
@@ -224,7 +224,16 @@ static int deferred_devs_show(struct seq_file *s, void *data) }DEFINE_SHOW_ATTRIBUTE (deferred_devs); +#ifdef CONFIG_MODULES +/* +* In the case of modules, set the default probe timeout to +* 30 seconds to give userland some time to load needed modules +*/ +static int deferred_probe_timeout =30 ; +#else +/* In the case of !modules, no probe timeout needed */ static int deferred_probe_timeout =-1 ; +#endif static int __init deferred_probe_timeout_setup (char *str) {int timeout;
Signature · 1 line
2.43.0
Re: [PATCH 5.4 39/84] driver core: Set deferred_probe_timeout to a longer default if CONFIG_MODULES is set
Quoted 40 lines · Greg Kroah-Hartman
5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Stultz <[email protected]>
[ Upstream commit
e2cec7d6853712295cef5377762165a489b2957f]When using modules, its common for the modules not to be loaded until quite late by userland. With the current code,
driver_deferred_probe_check_state()will stop returningEPROBE_DEFERafterlate_initcall, which can cause module dependency resolution to fail after that.So allow a longer window of 30 seconds (picked somewhat arbitrarily, but influenced by the similar regulator core timeout value) in the case where modules are enabled.
Cc Greg Kroah-Hartman <[email protected]>Cc Linus Walleij <[email protected]>Cc Thierry Reding <[email protected]>Cc Mark Brown <[email protected]>Cc Liam Girdwood <[email protected]>Cc Bjorn Andersson <[email protected]>Cc Saravana Kannan <[email protected]>Cc Todd Kjos <[email protected]>Cc Len Brown <[email protected]>Cc Pavel Machek <[email protected]>Cc Ulf Hansson <[email protected]>Cc Kevin Hilman <[email protected]>Cc "Rafael J. Wysocki" <[email protected]>Cc Rob Herring <[email protected]>Reviewed-by Bjorn Andersson <[email protected]>Reviewed-by Rafael J. Wysocki <[email protected]>Signed-off-by John Stultz <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>Signed-off-by Sasha Levin <[email protected]>
Quoted 3 lines
--- drivers/base/dd.c | 9 +++++++++ 1 file changed, 9 insertions(+)
This change ended up being reverted upstream in ce68929f07de
Is there some specific reason it got selected to be pulled into -stable?
thanks
-john
Greg Kroah-Hartman
maintainerRe: [PATCH 5.4 39/84] driver core: Set deferred_probe_timeout to a longer default if CONFIG_MODULES is set
Quoted 46 lines · John Stultz
Quoted 40 lines · Greg Kroah-Hartman
5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Stultz <[email protected]>
[ Upstream commit
e2cec7d6853712295cef5377762165a489b2957f]When using modules, its common for the modules not to be loaded until quite late by userland. With the current code,
driver_deferred_probe_check_state()will stop returningEPROBE_DEFERafterlate_initcall, which can cause module dependency resolution to fail after that.So allow a longer window of 30 seconds (picked somewhat arbitrarily, but influenced by the similar regulator core timeout value) in the case where modules are enabled.
Cc Greg Kroah-Hartman <[email protected]>Cc Linus Walleij <[email protected]>Cc Thierry Reding <[email protected]>Cc Mark Brown <[email protected]>Cc Liam Girdwood <[email protected]>Cc Bjorn Andersson <[email protected]>Cc Saravana Kannan <[email protected]>Cc Todd Kjos <[email protected]>Cc Len Brown <[email protected]>Cc Pavel Machek <[email protected]>Cc Ulf Hansson <[email protected]>Cc Kevin Hilman <[email protected]>Cc "Rafael J. Wysocki" <[email protected]>Cc Rob Herring <[email protected]>Reviewed-by Bjorn Andersson <[email protected]>Reviewed-by Rafael J. Wysocki <[email protected]>Signed-off-by John Stultz <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>Signed-off-by Sasha Levin <[email protected]>Quoted 3 lines
--- drivers/base/dd.c | 9 +++++++++ 1 file changed, 9 insertions(+)
Quoted 3 lines
This change ended up being reverted upstream in
ce68929f07deIs there some specific reason it got selected to be pulled into -stable?
It was an attempt to sync up with what had been added to the 4.19.y tree but not newer kernels. I'll go drop this from 5.4.y now, thanks for noticing the revert, my scripts did not pick that up :(
Also, this is in the 4.19.y tree, but in a different form, and one that no one seemed to have problems with, so I'll leave it alone there for now.
thanks,
greg k-h
Greg Kroah-Hartman
maintainerPATCH 40/84 spi: mt7621: Fix an error message in mt7621_spi_probe()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 2b2bf6b7faa9010fae10dc7de76627a3fdb525b3 ]
'status' is known to be 0 at this point. The expected error code is PTR_ERR(clk).
Switch to dev_err_probe() in order to display the expected error code (in a human readable way).
This also filters -EPROBE_DEFER cases, should it happen.
--- drivers/spi/spi-mt7621.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/spi/spi-mt7621.c +3 -5
@@ -340,11 +340,9 @@ static int mt7621_spi_probe(struct platform_device *pdev)return PTR_ERR (base); clk =devm_clk_get (&pdev->dev,NULL ); -if (IS_ERR (clk)) { -dev_err (&pdev->dev,"unable to get SYS clock, err=%d\n" , - status); -return PTR_ERR (clk); - } +if (IS_ERR (clk)) +return dev_err_probe (&pdev->dev,PTR_ERR (clk), +"unable to get SYS clock\n" ); status =clk_prepare_enable (clk);if (status)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/84 net: bridge: clear bridges private skb space on xmit
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <[email protected]>
[ Upstream commit fd65e5a95d08389444e8591a20538b3edece0e15 ]
We need to clear all of the bridge private skb variables as they can be stale due to the packet being recirculated through the stack and then transmitted through the bridge device. Similar memset is already done on bridge's input. We've seen cases where proxyarp_replied was 1 on routed multicast packets transmitted through the bridge to ports with neigh suppress which were getting dropped. Same thing can in theory happen with the port isolation bit as well.
--- net/bridge/br_device.c | 2 ++ 1 file changed, 2 insertions(+)
net/bridge/br_device.c +2 -0
@@ -35,6 +35,8 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)const unsigned char *dest;u16 vid =0 ; +memset (skb->cb,0 ,sizeof (struct br_input_skb_cb )); +rcu_read_lock (); nf_ops =rcu_dereference (nf_br_ops);if (nf_ops && nf_ops->br_dev_xmit_hook (skb)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/84 selftests/bpf: Avoid running unprivileged tests with alignment requirements
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Björn Töpel <[email protected]>
[ Upstream commit c77b0589ca29ad1859fe7d7c1ecd63c0632379fa ]
Some architectures have strict alignment requirements. In that case, the BPF verifier detects if a program has unaligned accesses and rejects them. A user can pass BPF_F_ANY_ALIGNMENT to a program to override this check. That, however, will only work when a privileged user loads a program. An unprivileged user loading a program with this flag will be rejected prior entering the verifier.
Hence, it does not make sense to load unprivileged programs without strict alignment when testing the verifier. This patch avoids exactly that.
--- tools/testing/selftests/bpf/test_verifier.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
tools/testing/selftests/bpf/test_verifier.c +13 -0
@@ -1091,6 +1091,19 @@ static void get_unpriv_disabled()static bool test_as_unpriv (struct bpf_test *test) { +#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS +/* Some architectures have strict alignment requirements. In +* that case, the BPF verifier detects if a program has +* unaligned accesses and rejects them. A user can pass +* BPF_F_ANY_ALIGNMENT to a program to override this +* check. That, however, will only work when a privileged user +* loads a program. An unprivileged user loading a program +* with this flag will be rejected prior entering the +* verifier. +*/ +if (test->flags &F_NEEDS_EFFICIENT_UNALIGNED_ACCESS ) +return false; +#endif return !test->prog_type || test->prog_type ==BPF_PROG_TYPE_SOCKET_FILTER || test->prog_type ==BPF_PROG_TYPE_CGROUP_SKB ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/84 ALSA: hda/realtek - Enable micmute LED on and HP system
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai-Heng Feng <[email protected]>
[ Upstream commit 3e0650ab26e2010ee312311612e40e076ed1feca ]
Though the system uses DMIC, headset mic still uses the HDA, let's use GPIO 0x1 to control the micmute LED.
The micmute LED GPIO has a different polarity to the mute LED GPIO, we can use the newly added micmute_led_polarity to indicate that.
--- sound/pci/hda/patch_realtek.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +5 -1
@@ -4326,7 +4326,11 @@ static void alc269_fixup_hp_gpio_led(struct hda_codec *codec,static void alc285_fixup_hp_gpio_led (struct hda_codec *codec,const struct hda_fixup *fix,int action) { -alc_fixup_hp_gpio_led (codec, action,0x04 ,0x00 ); +struct alc_spec *spec = codec->spec; + + spec->micmute_led_polarity =1 ; + +alc_fixup_hp_gpio_led (codec, action,0x04 ,0x01 ); } static void alc286_fixup_hp_gpio_led(struct hda_codec *codec,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/84 Revert "drm/sun4i: dsi: Change the start delay calculation"
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Icenowy Zheng <[email protected]>
[ Upstream commit a00d17e0a71ae2e4fdaac46e1c12785d3346c3f2 ]
This reverts commit da676c6aa6413d59ab0a80c97bbc273025e640b2.
The original commit adds a start parameter to the calculation of the start delay according to some old BSP versions from Allwinner. However, there're two ways to add this delay -- add it in DSI controller or add it in the TCON. Add it in both controllers won't work.
The code before this commit is picked from new versions of BSP kernel, which has a comment for the 1 that says "put start_delay to tcon". By checking the sun4i_tcon0_mode_set_cpu() in sun4i_tcon driver, it has already added this delay, so we shouldn't repeat to add the delay in DSI controller, otherwise the timing won't match.
--- drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c +1 -2
@@ -365,8 +365,7 @@ static void sun6i_dsi_inst_init(struct sun6i_dsi *dsi,static u16 sun6i_dsi_get_video_start_delay (struct sun6i_dsi *dsi,struct drm_display_mode *mode) { -u16 start =clamp (mode->vtotal - mode->vdisplay -10 ,8 ,100 ); -u16 delay = mode->vtotal - (mode->vsync_end - mode->vdisplay) + start; +u16 delay = mode->vtotal - (mode->vsync_end - mode->vdisplay) +1 ;if (delay > mode->vtotal) delay = delay % mode->vtotal;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/84 drm/amdgpu: Check for valid number of registers to read
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trek <[email protected]>
[ Upstream commit 13238d4fa6764fa74dcf863d5f2227765b3753eb ]
Do not try to allocate any amount of memory requested by the user. Instead limit it to 128 registers. Actually the longest series of consecutive allowed registers are 48, mmGB_TILE_MODE0-31 and mmGB_MACROTILE_MODE0-15 (0x2644-0x2673).
--- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +3 -0
@@ -650,6 +650,9 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_fileif (info->read_mmr_reg.count >128 )return -EINVAL ; +if (info->read_mmr_reg.count >128 ) +return -EINVAL ; + regs =kmalloc_array (info->read_mmr_reg.count,sizeof (*regs),GFP_KERNEL );if (!regs)return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/84 x86/alternatives: Disable KASAN in apply_alternatives()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill A. Shutemov <[email protected]>
[ Upstream commit d35652a5fc9944784f6f50a5c979518ff8dacf61 ]
Fei has reported that KASAN triggers during apply_alternatives() on a 5-level paging machine:
BUG: KASAN: out-of-bounds in rcu_is_watching() Read of size 4 at addr ff110003ee6419a0 by task swapper/0/0 ... __asan_load4() rcu_is_watching() trace_hardirqs_on() text_poke_early() apply_alternatives() ...
On machines with 5-level paging, cpu_feature_enabled(X86_FEATURE_LA57) gets patched. It includes KASAN code, where KASAN_SHADOW_START depends on __VIRTUAL_MASK_SHIFT, which is defined with cpu_feature_enabled().
KASAN gets confused when apply_alternatives() patches the KASAN_SHADOW_START users. A test patch that makes KASAN_SHADOW_START static, by replacing __VIRTUAL_MASK_SHIFT with 56, works around the issue.
Fix it for real by disabling KASAN while the kernel is patching alternatives.
[ mingo: updated the changelog ]
--- arch/x86/kernel/alternative.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
arch/x86/kernel/alternative.c +13 -0
@@ -374,6 +374,17 @@ void __init_or_module noinline apply_alternatives(struct alt_instr *start,u8 insn_buff[MAX_PATCH_LEN ];DPRINTK ("alt table %px, -> %px" , start, end); + +/* +* In the case CONFIG_X86_5LEVEL=y, KASAN_SHADOW_START is defined using +* cpu_feature_enabled(X86_FEATURE_LA57) and is therefore patched here. +* During the process, KASAN becomes confused seeing partial LA57 +* conversion and triggers a false-positive out-of-bound report. +* +* Disable KASAN until the patching is complete. +*/ +kasan_disable_current (); +/* * The scan order should be from start to end. A later scanned * alternative code can overwrite previously scanned alternative code.
@@ -434,6 +445,8 @@ void __init_or_module noinline apply_alternatives(struct alt_instr *start,text_poke_early (instr, insn_buff, insn_buff_sz); } + +kasan_enable_current (); }#ifdef CONFIG_SMP
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/84 dm-integrity: dont modify bios immutable bio_vec in integrity_metadata()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit b86f4b790c998afdbc88fe1aa55cfe89c4068726 upstream.
__bio_for_each_segment assumes that the first struct bio_vec argument doesn't change - it calls "bio_advance_iter_single((bio), &(iter), (bvl).bv_len)" to advance the iterator. Unfortunately, the dm-integrity code changes the bio_vec with "bv.bv_len -= pos". When this code path is taken, the iterator would be out of sync and dm-integrity would report errors. This happens if the machine is out of memory and "kmalloc" fails.
Fix this bug by making a copy of "bv" and changing the copy instead.
--- drivers/md/dm-integrity.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/md/dm-integrity.c +6 -5
@@ -1582,11 +1582,12 @@ static void integrity_metadata(struct work_struct *w) }__bio_for_each_segment (bv, bio, iter, dio->bio_details.bi_iter) { +struct bio_vec bv_copy = bv;unsigned pos;char *mem, *checksums_ptr; again: - mem = (char *)kmap_atomic (bv.bv_page) + bv.bv_offset; + mem = (char *)kmap_atomic (bv_copy.bv_page) + bv_copy.bv_offset; pos =0 ; checksums_ptr = checksums; do {
@@ -1595,7 +1596,7 @@ static void integrity_metadata(struct work_struct *w) sectors_to_process -= ic->sectors_per_block; pos += ic->sectors_per_block <<SECTOR_SHIFT ; sector += ic->sectors_per_block; - }while (pos < bv.bv_len && sectors_to_process && checksums != checksums_onstack); + }while (pos < bv_copy.bv_len && sectors_to_process && checksums != checksums_onstack);kunmap_atomic (mem); r = dm_integrity_rw_tag(ic, checksums, &dio->metadata_block, &dio->metadata_offset,
@@ -1615,9 +1616,9 @@ static void integrity_metadata(struct work_struct *w)if (!sectors_to_process)break ; -if (unlikely (pos < bv.bv_len)) { - bv.bv_offset += pos; - bv.bv_len -= pos; +if (unlikely (pos < bv_copy.bv_len)) { + bv_copy.bv_offset += pos; + bv_copy.bv_len -= pos; goto again; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/84 iomap: Set all uptodate bits for an Uptodate page
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit 4595a298d5563cf76c1d852970f162051fd1a7a6 ]
For filesystems with block size < page size, we need to set all the per-block uptodate bits if the page was already uptodate at the time we create the per-block metadata. This can happen if the page is invalidated (eg by a write to drop_caches) but ultimately not removed from the page cache.
This is a data corruption issue as page writeback skips blocks which are marked !uptodate.
--- fs/iomap/buffered-io.c | 3 +++ 1 file changed, 3 insertions(+)
fs/iomap/buffered-io.c +3 -0
@@ -23,6 +23,7 @@ static struct iomap_page * iomap_page_create(struct inode *inode, struct page *page) { struct iomap_page *iop = to_iomap_page(page); +unsigned int nr_blocks =PAGE_SIZE /i_blocksize (inode);if (iop ||i_blocksize (inode) ==PAGE_SIZE )return iop;
@@ -32,6 +33,8 @@ iomap_page_create(struct inode *inode, struct page *page)atomic_set (&iop->write_count,0 );spin_lock_init (&iop->uptodate_lock);bitmap_zero (iop->uptodate,PAGE_SIZE /SECTOR_SIZE ); +if (PageUptodate (page)) +bitmap_fill (iop->uptodate, nr_blocks);/* * migrate_page_move_mapping() assumes that pages with private data have
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/84 drm/amdgpu: Fix type of second parameter in trans_msg() callback
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
[ Upstream commit f0d0f1087333714ee683cc134a95afe331d7ddd9 ]
With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. A proposed warning in clang aims to catch these at compile time, which reveals:
drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c:412:15: error: incompatible function pointer types initializing 'void (*)(struct amdgpu_device *, u32, u32, u32, u32)' (aka 'void (*)(struct amdgpu_device *, unsigned int, unsigned int, unsigned int, unsigned int)') with an expression of type 'void (struct amdgpu_device *, enum idh_request, u32, u32, u32)' (aka 'void (struct amdgpu_device *, enum idh_request, unsigned int, unsigned int, unsigned int)') [-Werror,-Wincompatible-function-pointer-types-strict]
.trans_msg = xgpu_ai_mailbox_trans_msg,
^~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.
drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c:435:15: error: incompatible function pointer types initializing 'void (*)(struct amdgpu_device *, u32, u32, u32, u32)' (aka 'void (*)(struct amdgpu_device *, unsigned int, unsigned int, unsigned int, unsigned int)') with an expression of type 'void (struct amdgpu_device *, enum idh_request, u32, u32, u32)' (aka 'void (struct amdgpu_device *, enum idh_request, unsigned int, unsigned int, unsigned int)') [-Werror,-Wincompatible-function-pointer-types-strict]
.trans_msg = xgpu_nv_mailbox_trans_msg,
^~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.
The type of the second parameter in the prototype should be 'enum idh_request' instead of 'u32'. Update it to clear up the warnings.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h +4 -1
@@ -48,6 +48,8 @@ struct amdgpu_vf_error_buffer {uint64_t data[AMDGPU_VF_ERROR_ENTRY_SIZE ]; }; +enum idh_request ; +/** * struct amdgpu_virt_ops - amdgpu device virt operations */
@@ -56,7 +58,8 @@ struct amdgpu_virt_ops {int (*rel_full_gpu)(struct amdgpu_device *adev,bool init);int (*reset_gpu)(struct amdgpu_device *adev);int (*wait_reset)(struct amdgpu_device *adev); -void (*trans_msg)(struct amdgpu_device *adev,u32 req,u32 data1,u32 data2,u32 data3); +void (*trans_msg)(struct amdgpu_device *adev,enum idh_request req, +u32 data1,u32 data2,u32 data3);int (*get_pp_clk)(struct amdgpu_device *adev,u32 type,char *buf);int (*force_dpm_level)(struct amdgpu_device *adev,u32 level); };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/84 arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sireesh Kodali <[email protected]>
[ Upstream commit 5458d6f2827cd30218570f266b8d238417461f2f ]
The smem-state properties for the pronto node were incorrectly labelled, reading qcom,state* rather than qcom,smem-state*. Fix that, allowing the stop state to be used.
--- arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/qcom/msm8916.dtsi +2 -2
@@ -1097,8 +1097,8 @@ vddmx-supply = <&pm8916_l3>; vddpx-supply = <&pm8916_l7>; - qcom,state = <&wcnss_smp2p_out 0>; - qcom,state-names = "stop"; + qcom,smem-states = <&wcnss_smp2p_out 0>; + qcom,smem-state-names = "stop"; pinctrl-names = "default"; pinctrl-0 = <&wcnss_pin_a>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/84 PCI: tegra: Fix reporting GPIO error value
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pali Rohár <[email protected]>
[ Upstream commit 63605f1cfcc56bcb25c48bbee75a679d85ba7675 ]
Error code is stored in rp->reset_gpio and not in err variable.
Stable-dep-of: eff21f5da308 ("PCI: tegra: Fix OF node reference leak")
--- drivers/pci/controller/pci-tegra.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/controller/pci-tegra.c +2 -2
@@ -2289,8 +2289,8 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie)if (PTR_ERR (rp->reset_gpio) == -ENOENT ) { rp->reset_gpio =NULL ; }else { -dev_err (dev,"failed to get reset GPIO: %d\n" , - err); +dev_err (dev,"failed to get reset GPIO: %ld\n" , +PTR_ERR (rp->reset_gpio));return PTR_ERR (rp->reset_gpio); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/84 PCI: tegra: Fix OF node reference leak
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit eff21f5da308265678e7e59821795e606f3e560f ]
Commit 9e38e690ace3 ("PCI: tegra: Fix OF node reference leak") has fixed some node reference leaks in this function but missed some of them.
In fact, having 'port' referenced in the 'rp' structure is not enough to prevent the leak, until 'rp' is actually added in the 'pcie->ports' list.
Add the missing 'goto err_node_put' accordingly.
--- drivers/pci/controller/pci-tegra.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/pci/controller/pci-tegra.c +8 -5
@@ -2267,13 +2267,15 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie) rp->np = port; rp->base =devm_pci_remap_cfg_resource (dev, &rp->regs); -if (IS_ERR (rp->base)) -return PTR_ERR (rp->base); +if (IS_ERR (rp->base)) { + err =PTR_ERR (rp->base); + goto err_node_put; + } label =devm_kasprintf (dev,GFP_KERNEL ,"pex-reset-%u" , index);if (!label) { -dev_err (dev,"failed to create reset GPIO label\n" ); -return -ENOMEM ; + err = -ENOMEM ; + goto err_node_put; }/*
@@ -2291,7 +2293,8 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie) }else {dev_err (dev,"failed to get reset GPIO: %ld\n" ,PTR_ERR (rp->reset_gpio)); -return PTR_ERR (rp->reset_gpio); + err =PTR_ERR (rp->reset_gpio); + goto err_node_put; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/84 IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vacek <[email protected]>
commit e6f57c6881916df39db7d95981a8ad2b9c3458d6 upstream.
Unfortunately the commit fd8958efe877 introduced another error causing the descs array to overflow. This reults in further crashes easily reproducible by sendmsg system call.
[ 1080.836473] general protection fault, probably for non-canonical address 0x400300015528b00a: 0000 [#1] PREEMPT SMP PTI [ 1080.869326] RIP: 0010:hfi1_ipoib_build_ib_tx_headers.constprop.0+0xe1/0x2b0 [hfi1] -- [ 1080.974535] Call Trace: [ 1080.976990] <TASK> [ 1081.021929] hfi1_ipoib_send_dma_common+0x7a/0x2e0 [hfi1] [ 1081.027364] hfi1_ipoib_send_dma_list+0x62/0x270 [hfi1] [ 1081.032633] hfi1_ipoib_send+0x112/0x300 [hfi1] [ 1081.042001] ipoib_start_xmit+0x2a9/0x2d0 [ib_ipoib] [ 1081.046978] dev_hard_start_xmit+0xc4/0x210 -- [ 1081.148347] __sys_sendmsg+0x59/0xa0
crash> ipoib_txreq 0xffff9cfeba229f00
struct ipoib_txreq {
txreq = {
list = {
next = 0xffff9cfeba229f00,
prev = 0xffff9cfeba229f00
},
descp = 0xffff9cfeba229f40,
coalesce_buf = 0x0,
wait = 0xffff9cfea4e69a48,
complete = 0xffffffffc0fe0760 <hfi1_ipoib_sdma_complete>,
packet_len = 0x46d,
tlen = 0x0,
num_desc = 0x0,
desc_limit = 0x6,
next_descq_idx = 0x45c,
coalesce_idx = 0x0,
flags = 0x0,
descs = {{
qw = {0x8024000120dffb00, 0x4} # SDMA_DESC0_FIRST_DESC_FLAG (bit 63)
}, {
qw = { 0x3800014231b108, 0x4}
}, {
qw = { 0x310000e4ee0fcf0, 0x8}
}, {
qw = { 0x3000012e9f8000, 0x8}
}, {
qw = { 0x59000dfb9d0000, 0x8}
}, {
qw = { 0x78000e02e40000, 0x8}
}} },
sdma_hdr = 0x400300015528b000, <<< invalid pointer in the tx request structure
sdma_status = 0x0, SDMA_DESC0_LAST_DESC_FLAG (bit 62)
complete = 0x0,
priv = 0x0,
txq = 0xffff9cfea4e69880,
skb = 0xffff9d099809f400
}
If an SDMA send consists of exactly 6 descriptors and requires dword padding (in the 7th descriptor), the sdma_txreq descriptor array is not properly expanded and the packet will overflow into the container structure. This results in a panic when the send completion runs. The exact panic varies depending on what elements of the container structure get corrupted. The fix is to use the correct expression in _pad_sdma_tx_descs() to test the need to expand the descriptor array.
With this patch the crashes are no longer reproducible and the machine is stable.
--- drivers/infiniband/hw/hfi1/sdma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/hfi1/sdma.c +1 -1
@@ -3203,7 +3203,7 @@ int _pad_sdma_tx_descs(struct hfi1_devda {int rval =0 ; -if ((unlikely (tx->num_desc +1 == tx->desc_limit))) { +if ((unlikely (tx->num_desc == tx->desc_limit))) { rval =_extend_sdma_tx_descs (dd, tx);if (rval) {__sdma_txclean (dd, tx);
Greg Kroah-Hartman
maintainerPATCH 54/84 dm-crypt: dont modify the data when using authenticated encryption
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit 50c70240097ce41fe6bce6478b80478281e4d0f7 upstream.
It was said that authenticated encryption could produce invalid tag when the data that is being encrypted is modified [1]. So, fix this problem by copying the data into the clone bio first and then encrypt them inside the clone bio.
This may reduce performance, but it is needed to prevent the user from corrupting the device by writing data with O_DIRECT and modifying them at the same time.
[1] https://lore.kernel.org/all/[email protected]/T/
--- drivers/md/dm-crypt.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/md/dm-crypt.c +6 -0
@@ -1627,6 +1627,12 @@ static void kcryptd_crypt_write_convert( io->ctx.bio_out = clone; io->ctx.iter_out = clone->bi_iter; +if (crypt_integrity_aead (cc)) { +bio_copy_data (clone, io->base_bio); + io->ctx.bio_in = clone; + io->ctx.iter_in = clone->bi_iter; + } + sector +=bio_sectors (clone);crypt_inc_pending (io);
Greg Kroah-Hartman
maintainerPATCH 55/84 gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <[email protected]>
commit 136cfaca22567a03bbb3bf53a43d8cb5748b80ec upstream.
The gtp_net_ops pernet operations structure for the subsystem must be registered before registering the generic netlink family.
Syzkaller hit 'general protection fault in gtp_genl_dump_pdp' bug:
general protection fault, probably for non-canonical address
0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 1 PID: 5826 Comm: gtp Not tainted 6.8.0-rc3-std-def-alt1 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014
RIP: 0010:gtp_genl_dump_pdp+0x1be/0x800 [gtp]
Code: c6 89 c6 e8 64 e9 86 df 58 45 85 f6 0f 85 4e 04 00 00 e8 c5 ee 86
df 48 8b 54 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80>
3c 02 00 0f 85 de 05 00 00 48 8b 44 24 18 4c 8b 30 4c 39 f0 74
RSP: 0018:ffff888014107220 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88800fcda588 R14: 0000000000000001 R15: 0000000000000000
FS: 00007f1be4eb05c0(0000) GS:ffff88806ce80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1be4e766cf CR3: 000000000c33e000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
<TASK>
? show_regs+0x90/0xa0
? die_addr+0x50/0xd0
? exc_general_protection+0x148/0x220
? asm_exc_general_protection+0x22/0x30
? gtp_genl_dump_pdp+0x1be/0x800 [gtp]
? __alloc_skb+0x1dd/0x350
? __pfx___alloc_skb+0x10/0x10
genl_dumpit+0x11d/0x230
netlink_dump+0x5b9/0xce0
? lockdep_hardirqs_on_prepare+0x253/0x430
? __pfx_netlink_dump+0x10/0x10
? kasan_save_track+0x10/0x40
? __kasan_kmalloc+0x9b/0xa0
? genl_start+0x675/0x970
__netlink_dump_start+0x6fc/0x9f0
genl_family_rcv_msg_dumpit+0x1bb/0x2d0
? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10
? genl_op_from_small+0x2a/0x440
? cap_capable+0x1d0/0x240
? __pfx_genl_start+0x10/0x10
? __pfx_genl_dumpit+0x10/0x10
? __pfx_genl_done+0x10/0x10
? security_capable+0x9d/0xe0--- drivers/net/gtp.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/net/gtp.c +5 -5
@@ -1381,20 +1381,20 @@ static int __init gtp_init(void)if (err <0 ) goto error_out; - err =genl_register_family (>p_genl_family); + err =register_pernet_subsys (>p_net_ops);if (err <0 ) goto unreg_rtnl_link; - err =register_pernet_subsys (>p_net_ops); + err =genl_register_family (>p_genl_family);if (err <0 ) - goto unreg_genl_family; + goto unreg_pernet_subsys;pr_info ("GTP module loaded (pdp ctx size %zd bytes)\n" ,sizeof (struct pdp_ctx ));return 0 ; -unreg_genl_family: -genl_unregister_family (>p_genl_family); +unreg_pernet_subsys: +unregister_pernet_subsys (>p_net_ops); unreg_rtnl_link:rtnl_link_unregister (>p_link_ops); error_out:
Greg Kroah-Hartman
maintainerPATCH 56/84 PCI/MSI: Prevent MSI hardware interrupt number truncation
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vidya Sagar <[email protected]>
commit db744ddd59be798c2627efbfc71f707f5a935a40 upstream.
While calculating the hardware interrupt number for a MSI interrupt, the higher bits (i.e. from bit-5 onwards a.k.a domain_nr >= 32) of the PCI domain number gets truncated because of the shifted value casting to return type of pci_domain_nr() which is 'int'. This for example is resulting in same hardware interrupt number for devices 0019:00:00.0 and 0039:00:00.0.
To address this cast the PCI domain number to 'irq_hw_number_t' before left shifting it to calculate the hardware interrupt number.
Please note that this fixes the issue only on 64-bit systems and doesn't change the behavior for 32-bit systems i.e. the 32-bit systems continue to have the issue. Since the issue surfaces only if there are too many PCIe controllers in the system which usually is the case in modern server systems and they don't tend to run 32-bit kernels.
--- drivers/pci/msi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/msi.c +1 -1
@@ -1428,7 +1428,7 @@ irq_hw_number_t pci_msi_domain_calc_hwir {return (irq_hw_number_t )desc->msi_attrib.entry_nr |pci_dev_id (dev) <<11 | - (pci_domain_nr (dev->bus) &0xFFFFFFFF ) <<27 ; + ((irq_hw_number_t)(pci_domain_nr (dev->bus) &0xFFFFFFFF )) <<27 ; }static inline bool pci_msi_desc_is_multi_msi (struct msi_desc *desc)
Greg Kroah-Hartman
maintainerPATCH 57/84 l2tp: pass correct message length to ip6_append_data
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Parkin <[email protected]>
commit 359e54a93ab43d32ee1bff3c2f9f10cb9f6b6e79 upstream.
l2tp_ip6_sendmsg needs to avoid accounting for the transport header twice when splicing more data into an already partially-occupied skbuff.
To manage this, we check whether the skbuff contains data using skb_queue_empty when deciding how much data to append using ip6_append_data.
However, the code which performed the calculation was incorrect:
ulen = len + skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0;
...due to C operator precedence, this ends up setting ulen to transhdrlen for messages with a non-zero length, which results in corrupted packets on the wire.
Add parentheses to correct the calculation in line with the original intent.
--- net/l2tp/l2tp_ip6.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/l2tp/l2tp_ip6.c +1 -1
@@ -644,7 +644,7 @@ static int l2tp_ip6_sendmsg(struct sock back_from_confirm:lock_sock (sk); - ulen = len +skb_queue_empty (&sk->sk_write_queue) ? transhdrlen :0 ; + ulen = len + (skb_queue_empty (&sk->sk_write_queue) ? transhdrlen :0 ); err = ip6_append_data(sk, ip_generic_getfrag, msg, ulen, transhdrlen, &ipc6, &fl6, (struct rt6_info *)dst,
Greg Kroah-Hartman
maintainerPATCH 58/84 ARM: ep93xx: Add terminator to gpiod_lookup_table
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Shubin <[email protected]>
commit fdf87a0dc26d0550c60edc911cda42f9afec3557 upstream.
Without the terminator, if a con_id is passed to gpio_find() that does not exist in the lookup table the function will not stop looping correctly, and eventually cause an oops.
--- arch/arm/mach-ep93xx/core.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-ep93xx/core.c +1 -0
@@ -337,6 +337,7 @@ static struct gpiod_lookup_table ep93xx_ GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN), GPIO_LOOKUP_IDX("G", 0, NULL, 1, GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN), + { } }, };
Greg Kroah-Hartman
maintainerPATCH 59/84 usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
commit cd45f99034b0c8c9cb346dd0d6407a95ca3d36f6 upstream.
... cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request); list_del_init(&priv_req->list); ...
'priv_req' actually free at cdns3_gadget_ep_free_request(). But list_del_init() use priv_req->list after it.
[ 1542.642868][ T534] BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xd4 [ 1542.642868][ T534] [ 1542.653162][ T534] Use-after-free read at 0x000000009ed0ba99 (in kfence-#3): [ 1542.660311][ T534] __list_del_entry_valid+0x10/0xd4 [ 1542.665375][ T534] cdns3_gadget_ep_disable+0x1f8/0x388 [cdns3] [ 1542.671571][ T534] usb_ep_disable+0x44/0xe4 [ 1542.675948][ T534] ffs_func_eps_disable+0x64/0xc8 [ 1542.680839][ T534] ffs_func_set_alt+0x74/0x368 [ 1542.685478][ T534] ffs_func_disable+0x18/0x28
Move list_del_init() before cdns3_gadget_ep_free_request() to resolve this problem.
--- drivers/usb/cdns3/gadget.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/cdns3/gadget.c +1 -1
@@ -1951,11 +1951,11 @@ static int cdns3_gadget_ep_disable(strucwhile (!list_empty (&priv_ep->wa2_descmiss_req_list)) { priv_req =cdns3_next_priv_request (&priv_ep->wa2_descmiss_req_list); +list_del_init (&priv_req->list);kfree (priv_req->request.buf);cdns3_gadget_ep_free_request (&priv_ep->endpoint, &priv_req->request); -list_del_init (&priv_req->list); --priv_ep->wa2_counter; }
Greg Kroah-Hartman
maintainerPATCH 60/84 usb: cdns3: fix memory double free when handle zero packet
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
commit 5fd9e45f1ebcd57181358af28506e8a661a260b3 upstream.
829 if (request->complete) {
830 spin_unlock(&priv_dev->lock);
831 usb_gadget_giveback_request(&priv_ep->endpoint,
832 request);
833 spin_lock(&priv_dev->lock);
834 }
835
836 if (request->buf == priv_dev->zlp_buf)
837 cdns3_gadget_ep_free_request(&priv_ep->endpoint, request);
Driver append an additional zero packet request when queue a packet, which length mod max packet size is 0. When transfer complete, run to line 831, usb_gadget_giveback_request() will free this requestion. 836 condition is true, so cdns3_gadget_ep_free_request() free this request again.
Log:
[ 1920.140696][ T150] BUG: KFENCE: use-after-free read in cdns3_gadget_giveback+0x134/0x2c0 [cdns3] [ 1920.140696][ T150] [ 1920.151837][ T150] Use-after-free read at 0x000000003d1cd10b (in kfence-#36): [ 1920.159082][ T150] cdns3_gadget_giveback+0x134/0x2c0 [cdns3] [ 1920.164988][ T150] cdns3_transfer_completed+0x438/0x5f8 [cdns3]
Add check at line 829, skip call usb_gadget_giveback_request() if it is additional zero length packet request. Needn't call usb_gadget_giveback_request() because it is allocated in this driver.
--- drivers/usb/cdns3/gadget.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/usb/cdns3/gadget.c +5 -1
@@ -661,7 +661,11 @@ void cdns3_gadget_giveback(struct cdns3_return ; } -if (request->complete) { +/* +* zlp request is appended by driver, needn't call usb_gadget_giveback_request() to notify +* gadget composite driver. +*/ +if (request->complete && request->buf != priv_dev->zlp_buf) {spin_unlock (&priv_dev->lock);usb_gadget_giveback_request (&priv_ep->endpoint, request);
Greg Kroah-Hartman
maintainerPATCH 61/84 usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Kurapati <[email protected]>
commit 76c51146820c5dac629f21deafab0a7039bc3ccd upstream.
It is observed sometimes when tethering is used over NCM with Windows 11 as host, at some instances, the gadget_giveback has one byte appended at the end of a proper NTB. When the NTB is parsed, unwrap call looks for any leftover bytes in SKB provided by u_ether and if there are any pending bytes, it treats them as a separate NTB and parses it. But in case the second NTB (as per unwrap call) is faulty/corrupt, all the datagrams that were parsed properly in the first NTB and saved in rx_list are dropped.
Adding a few custom traces showed the following:
[002] d..1 7828.532866: dwc3_gadget_giveback: ep1out:
req 000000003868811a length 1025/16384 zsI ==> 0
[002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb toprocess: 1025 [002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb seq: 0xce67 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x400 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb ndp_len: 0x10 [002] d..1 7828.532869: ncm_unwrap_ntb: K: Parsed NTB with 1 frames
In this case, the giveback is of 1025 bytes and block length is 1024. The rest 1 byte (which is 0x00) won't be parsed resulting in drop of all datagrams in rx_list.
Same is case with packets of size 2048:
[002] d..1 7828.557948: dwc3_gadget_giveback: ep1out:
req 0000000011dfd96e length 2049/16384 zsI ==> 0
[002] d..1 7828.557949: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342
[002] d..1 7828.557950: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x800
Lecroy shows one byte coming in extra confirming that the byte is coming in from PC:
Transfer 2959 - Bytes Transferred(1025) Timestamp((18.524 843 590)
- Transaction 8391 - Data(1025 bytes) Timestamp(18.524 843 590) --- Packet 4063861
Data(1024 bytes)
Duration(2.117us) Idle(14.700ns) Timestamp(18.524 843 590)
--- Packet 4063863
Data(1 byte)
Duration(66.160ns) Time(282.000ns) Timestamp(18.524 845 722)According to Windows driver, no ZLP is needed if wBlockLength is non-zero, because the non-zero wBlockLength has already told the function side the size of transfer to be expected. However, there are in-market NCM devices that rely on ZLP as long as the wBlockLength is multiple of wMaxPacketSize. To deal with such devices, it pads an extra 0 at end so the transfer is no longer multiple of wMaxPacketSize.
--- drivers/usb/gadget/function/f_ncm.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/f_ncm.c +9 -1
@@ -1349,7 +1349,15 @@ parse_ntb: "Parsed NTB with %d frames\n", dgram_counter); to_process -= block_len; -if (to_process !=0 ) { + +/* +* Windows NCM driver avoids USB ZLPs by adding a 1-byte +* zero pad as needed. +*/ +if (to_process ==1 && + (*(unsigned char *)(ntb_ptr + block_len) ==0x00 )) { + to_process--; + }else if (to_process >0 ) { ntb_ptr = (unsigned char *)(ntb_ptr + block_len); goto parse_ntb; }
Greg Kroah-Hartman
maintainerPATCH 62/84 usb: roles: dont get/set_role() when usb_role_switch is unregistered
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
commit b787a3e781759026a6212736ef8e52cf83d1821a upstream.
There is a possibility that usb_role_switch device is unregistered before the user put usb_role_switch. In this case, the user may still want to get/set_role() since the user can't sense the changes of usb_role_switch.
This will add a flag to show if usb_role_switch is already registered and avoid unwanted behaviors.
--- drivers/usb/roles/class.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/usb/roles/class.c +10 -2
@@ -20,6 +20,7 @@ struct usb_role_switch {struct device dev;struct mutex lock;/* device lock*/ enum usb_role role; +bool registered;/* From descriptor */ struct device *usb2_port;
@@ -46,6 +47,9 @@ int usb_role_switch_set_role(struct usb_if (IS_ERR_OR_NULL (sw))return 0 ; +if (!sw->registered) +return -EOPNOTSUPP ; +mutex_lock (&sw->lock); ret = sw->set (sw->dev.parent, role);
@@ -69,7 +73,7 @@ enum usb_role usb_role_switch_get_role(s {enum usb_role role; -if (IS_ERR_OR_NULL (sw)) +if (IS_ERR_OR_NULL (sw) || !sw->registered)return USB_ROLE_NONE ;mutex_lock (&sw->lock);
@@ -319,6 +323,8 @@ usb_role_switch_register(struct device *return ERR_PTR (ret); } + sw->registered = true; +/* TODO: Symlinks for the host port and the device controller. */ return sw;
@@ -333,8 +339,10 @@ EXPORT_SYMBOL_GPL(usb_role_switch_regist*/ void usb_role_switch_unregister (struct usb_role_switch *sw) { -if (!IS_ERR_OR_NULL (sw)) +if (!IS_ERR_OR_NULL (sw)) { + sw->registered = false;device_unregister (&sw->dev); + } }EXPORT_SYMBOL_GPL (usb_role_switch_unregister);
Greg Kroah-Hartman
maintainerPATCH 63/84 IB/hfi1: Fix a memleak in init_credit_return
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhipeng Lu <[email protected]>
[ Upstream commit 809aa64ebff51eb170ee31a95f83b2d21efa32e2 ]
When dma_alloc_coherent fails to allocate dd->cr_base[i].va, init_credit_return should deallocate dd->cr_base and dd->cr_base[i] that allocated before. Or those resources would be never freed and a memleak is triggered.
--- drivers/infiniband/hw/hfi1/pio.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/infiniband/hw/hfi1/pio.c +5 -1
@@ -2131,7 +2131,7 @@ int init_credit_return(struct hfi1_devdata *dd)"Unable to allocate credit return DMA range for NUMA %d\n" , i); ret = -ENOMEM ; - goto done; + goto free_cr_base; } }set_dev_node (&dd->pcidev->dev, dd->node);
@@ -2139,6 +2139,10 @@ int init_credit_return(struct hfi1_devdata *dd) ret =0 ; done:return ret; + +free_cr_base: +free_credit_return (dd); + goto done; }void free_credit_return (struct hfi1_devdata *dd)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/84 RDMA/bnxt_re: Return error for SRQ resize
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalesh AP <[email protected]>
[ Upstream commit 3687b450c5f32e80f179ce4b09e0454da1449eac ]
SRQ resize is not supported in the driver. But driver is not returning error from bnxt_re_modify_srq() for SRQ resize.
--- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/infiniband/hw/bnxt_re/ib_verbs.c +2 -3
@@ -1623,7 +1623,7 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr,switch (srq_attr_mask) {case IB_SRQ_MAX_WR :/* SRQ resize is not supported */ -break ; +return -EINVAL ;case IB_SRQ_LIMIT :/* Change the SRQ threshold */ if (srq_attr->srq_limit > srq->qplib_srq.max_wqe)
@@ -1638,13 +1638,12 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr,/* On success, update the shadow */ srq->srq_limit = srq_attr->srq_limit;/* No need to Build and send response back to udata */ -break ; +return 0 ;default :dev_err (rdev_to_dev (rdev),"Unsupported srq_attr_mask 0x%x" , srq_attr_mask);return -EINVAL ; } -return 0 ; }int bnxt_re_query_srq (struct ib_srq *ib_srq,struct ib_srq_attr *srq_attr)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/84 RDMA/srpt: Make debug output more detailed
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
[ Upstream commit d4ee7f3a4445ec1b0b88af216f4032c4d30abf5a ]
Since the session name by itself is not sufficient to uniquely identify a queue pair, include the queue pair number. Show the ASCII channel state name instead of the numeric value. This change makes the ib_srpt debug output more consistent.
Stable-dep-of: eb5c7465c324 ("RDMA/srpt: fix function pointer cast warnings")
--- drivers/infiniband/ulp/srpt/ib_srpt.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/infiniband/ulp/srpt/ib_srpt.c +5 -4
@@ -217,8 +217,9 @@ static const char *get_ch_state_name(enum rdma_ch_state s)*/ static void srpt_qp_event (struct ib_event *event,struct srpt_rdma_ch *ch) { -pr_debug ("QP event %d on ch=%p sess_name=%s state=%d\n" , - event->event, ch, ch->sess_name, ch->state); +pr_debug ("QP event %d on ch=%p sess_name=%s-%d state=%s\n" , + event->event, ch, ch->sess_name, ch->qp->qp_num, +get_ch_state_name (ch->state));switch (event->event) {case IB_EVENT_COMM_EST :
@@ -2005,8 +2006,8 @@ static void __srpt_close_all_ch(struct srpt_port *sport)list_for_each_entry (nexus, &sport->nexus_list, entry) {list_for_each_entry (ch, &nexus->ch_list, list) {if (srpt_disconnect_ch (ch) >=0 ) -pr_info ("Closing channel %s because target %s_%d has been disabled\n" , - ch->sess_name, +pr_info ("Closing channel %s-%d because target %s_%d has been disabled\n" , + ch->sess_name, ch->qp->qp_num,dev_name (&sport->sdev->device->dev), sport->port);srpt_close_ch (ch);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/84 RDMA/srpt: fix function pointer cast warnings
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit eb5c7465c3240151cd42a55c7ace9da0026308a1 ]
clang-16 notices that srpt_qp_event() gets called through an incompatible pointer here:
drivers/infiniband/ulp/srpt/ib_srpt.c:1815:5: error: cast from 'void (*)(struct ib_event *, struct srpt_rdma_ch *)' to 'void (*)(struct ib_event *, void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
1815 | = (void(*)(struct ib_event *, void*))srpt_qp_event;
Change srpt_qp_event() to use the correct prototype and adjust the argument inside of it.
--- drivers/infiniband/ulp/srpt/ib_srpt.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/infiniband/ulp/srpt/ib_srpt.c +5 -4
@@ -213,10 +213,12 @@ static const char *get_ch_state_name(enum rdma_ch_state s)/** * srpt_qp_event - QP event callback function * @event: Description of the event that occurred. -* @ch: SRPT RDMA channel. +* @ptr: SRPT RDMA channel. */ -static void srpt_qp_event (struct ib_event *event,struct srpt_rdma_ch *ch) +static void srpt_qp_event (struct ib_event *event,void *ptr) { +struct srpt_rdma_ch *ch = ptr; +pr_debug ("QP event %d on ch=%p sess_name=%s-%d state=%s\n" , event->event, ch, ch->sess_name, ch->qp->qp_num,get_ch_state_name (ch->state));
@@ -1802,8 +1804,7 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch) } qp_init->qp_context = (void *)ch; - qp_init->event_handler - = (void (*)(struct ib_event *,void *))srpt_qp_event; + qp_init->event_handler = srpt_qp_event; qp_init->send_cq = ch->cq; qp_init->recv_cq = ch->cq; qp_init->sq_sig_type =IB_SIGNAL_REQ_WR ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/84 scripts/bpf: teach bpf_helpers_doc.py to dump BPF helper definitions
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit 7a387bed47f7e80e257d966cd64a3e92a63e26a1 ]
Enhance scripts/bpf_helpers_doc.py to emit C header with BPF helper definitions (to be included from libbpf's bpf_helpers.h).
Stable-dep-of: e37243b65d52 ("bpf, scripts: Correct GPL license name")
--- scripts/bpf_helpers_doc.py | 155 ++++++++++++++++++++++++++++++++++++- 1 file changed, 154 insertions(+), 1 deletion(-)
scripts/bpf_helpers_doc.py +154 -1
@@ -391,6 +391,154 @@ SEE ALSO print('') +class PrinterHelpers(Printer): + """ + A printer for dumping collected information about helpers as C header to + be included from BPF program. + @helpers: array of Helper objects to print to standard output + """ + + type_fwds = [ + 'struct bpf_fib_lookup', + 'struct bpf_perf_event_data', + 'struct bpf_perf_event_value', + 'struct bpf_sock', + 'struct bpf_sock_addr', + 'struct bpf_sock_ops', + 'struct bpf_sock_tuple', + 'struct bpf_spin_lock', + 'struct bpf_sysctl', + 'struct bpf_tcp_sock', + 'struct bpf_tunnel_key', + 'struct bpf_xfrm_state', + 'struct pt_regs', + 'struct sk_reuseport_md', + 'struct sockaddr', + 'struct tcphdr', + + 'struct __sk_buff', + 'struct sk_msg_md', + 'struct xpd_md', + ] + known_types = { + '...', + 'void', + 'const void', + 'char', + 'const char', + 'int', + 'long', + 'unsigned long', + + '__be16', + '__be32', + '__wsum', + + 'struct bpf_fib_lookup', + 'struct bpf_perf_event_data', + 'struct bpf_perf_event_value', + 'struct bpf_sock', + 'struct bpf_sock_addr', + 'struct bpf_sock_ops', + 'struct bpf_sock_tuple', + 'struct bpf_spin_lock', + 'struct bpf_sysctl', + 'struct bpf_tcp_sock', + 'struct bpf_tunnel_key', + 'struct bpf_xfrm_state', + 'struct pt_regs', + 'struct sk_reuseport_md', + 'struct sockaddr', + 'struct tcphdr', + } + mapped_types = { + 'u8': '__u8', + 'u16': '__u16', + 'u32': '__u32', + 'u64': '__u64', + 's8': '__s8', + 's16': '__s16', + 's32': '__s32', + 's64': '__s64', + 'size_t': 'unsigned long', + 'struct bpf_map': 'void', + 'struct sk_buff': 'struct __sk_buff', + 'const struct sk_buff': 'const struct __sk_buff', + 'struct sk_msg_buff': 'struct sk_msg_md', + 'struct xdp_buff': 'struct xdp_md', + } + + def print_header(self): + header = '''\ +/* This is auto-generated file. See bpf_helpers_doc.py for details. */ + +/* Forward declarations of BPF structs */''' + + print(header) + for fwd in self.type_fwds: + print('%s;' % fwd) + print('') + + def print_footer(self): + footer = '' + print(footer) + + def map_type(self, t): + if t in self.known_types: + return t + if t in self.mapped_types: + return self.mapped_types[t] + print("") + print("Unrecognized type '%s', please add it to known types!" % t) + sys.exit(1) + + seen_helpers = set() + + def print_one(self, helper): + proto = helper.proto_break_down() + + if proto['name'] in self.seen_helpers: + return + self.seen_helpers.add(proto['name']) + + print('/*') + print(" * %s" % proto['name']) + print(" *") + if (helper.desc): + # Do not strip all newline characters: formatted code at the end of + # a section must be followed by a blank line. + for line in re.sub('\n$', '', helper.desc, count=1).split('\n'): + print(' *{}{}'.format(' \t' if line else '', line)) + + if (helper.ret): + print(' *') + print(' * Returns') + for line in helper.ret.rstrip().split('\n'): + print(' *{}{}'.format(' \t' if line else '', line)) + + print(' */') + print('static %s %s(*%s)(' % (self.map_type(proto['ret_type']), + proto['ret_star'], proto['name']), end='') + comma = '' + for i, a in enumerate(proto['args']): + t = a['type'] + n = a['name'] + if proto['name'] == 'bpf_get_socket_cookie' and i == 0: + t = 'void' + n = 'ctx' + one_arg = '{}{}'.format(comma, self.map_type(t)) + if n: + if a['star']: + one_arg += ' {}'.format(a['star']) + else: + one_arg += ' ' + one_arg += '{}'.format(n) + comma = ', ' + print(one_arg, end='') + + print(') = (void *) %d;' % len(self.seen_helpers)) + print('') + ############################################################################### # If script is launched from scripts/ from kernel tree and can access
@@ -405,6 +553,8 @@ Parse eBPF header file and generate documentation for eBPF helper functions. The RST-formatted output produced can be turned into a manual page with the rst2man utility. """) +argParser.add_argument('--header', action='store_true', + help='generate C header file') if (os.path.isfile(bpfh)): argParser.add_argument('--filename', help='path to include/uapi/linux/bpf.h', default=bpfh)
@@ -417,5 +567,8 @@ headerParser = HeaderParser(args.filename) headerParser.run() # Print formatted output to standard output. -printer = PrinterRST(headerParser.helpers) +if args.header: + printer = PrinterHelpers(headerParser.helpers) +else: + printer = PrinterRST(headerParser.helpers) printer.print_all()
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/84 bpf, scripts: Correct GPL license name
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gianmarco Lusvardi <[email protected]>
[ Upstream commit e37243b65d528a8a9f8b9a57a43885f8e8dfc15c ]
The bpf_doc script refers to the GPL as the "GNU Privacy License". I strongly suspect that the author wanted to refer to the GNU General Public License, under which the Linux kernel is released, as, to the best of my knowledge, there is no license named "GNU Privacy License". This patch corrects the license name in the script accordingly.
--- scripts/bpf_helpers_doc.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/bpf_helpers_doc.py +1 -1
@@ -286,7 +286,7 @@ eBPF programs can have an associated license, passed along with the bytecode instructions to the kernel when the programs are loaded. The format for that string is identical to the one in use for kernel modules (Dual licenses, such as "Dual BSD/GPL", may be used). Some helper functions are only accessible to -programs that are compatible with the GNU Privacy License (GPL). +programs that are compatible with the GNU General Public License (GNU GPL). In order to use such helpers, the eBPF program must be loaded with the correct license string passed (via **attr**) to the **bpf**\ () system call, and this
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/84 scsi: jazz_esp: Only build if SCSI core is builtin
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit 9ddf190a7df77b77817f955fdb9c2ae9d1c9c9a3 ]
JAZZ_ESP is a bool kconfig symbol that selects SCSI_SPI_ATTRS. When CONFIG_SCSI=m, this results in SCSI_SPI_ATTRS=m while JAZZ_ESP=y, which causes many undefined symbol linker errors.
Fix this by only offering to build this driver when CONFIG_SCSI=y.
[mkp: JAZZ_ESP is unique in that it does not support being compiled as a module unlike the remaining SPI SCSI HBA drivers]
--- drivers/scsi/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/Kconfig +1 -1
@@ -1286,7 +1286,7 @@ source "drivers/scsi/arm/Kconfig" config JAZZ_ESP bool "MIPS JAZZ FAS216 SCSI support" - depends on MACH_JAZZ && SCSI + depends on MACH_JAZZ && SCSI=y select SCSI_SPI_ATTRS help This is the driver for the onboard SCSI host adapter of MIPS Magnum
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/84 nouveau: fix function cast warnings
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 0affdba22aca5573f9d989bcb1d71d32a6a03efe ]
clang-16 warns about casting between incompatible function types:
drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c:161:10: error: cast from 'void (*)(const struct firmware *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
161 | .fini = (void(*)(void *))release_firmware,
This one was done to use the generic shadow_fw_release() function as a callback for struct nvbios_source. Change it to use the same prototype as the other five instances, with a trivial helper function that actually calls release_firmware.
--- drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c +7 -1
@@ -154,11 +154,17 @@ shadow_fw_init(struct nvkm_bios *bios, const char *name)return (void *)fw; } +static void +shadow_fw_release (void *fw) +{ +release_firmware (fw); +} +static const struct nvbios_source shadow_fw = { .name ="firmware" , .init = shadow_fw_init, - .fini = (void (*)(void *))release_firmware, + .fini = shadow_fw_release, .read = shadow_fw_read, .rw = false, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/84 ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 081a0e3b0d4c061419d3f4679dec9f68725b17e4 ]
net->dev_base_seq and ipv4.dev_addr_genid are monotonically increasing.
If we XOR their values, we could miss to detect if both values were changed with the same amount.
--- net/ipv4/devinet.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-)
net/ipv4/devinet.c +17 -4
@@ -1798,6 +1798,21 @@ static int in_dev_dump_addr(struct in_device *in_dev, struct sk_buff *skb,return err; } +/* Combine dev_addr_genid and dev_base_seq to detect changes. +*/ +static u32 inet_base_seq (const struct net *net) +{ +u32 res =atomic_read (&net->ipv4.dev_addr_genid) + + net->dev_base_seq; + +/* Must not return 0 (see nl_dump_check_consistent()). +* Chose a value far away from 0. +*/ +if (!res) + res =0x80000000 ; +return res; +} +static int inet_dump_ifaddr (struct sk_buff *skb,struct netlink_callback *cb) {const struct nlmsghdr *nlh = cb->nlh;
@@ -1849,8 +1864,7 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb) idx =0 ; head = &tgt_net->dev_index_head[h];rcu_read_lock (); - cb->seq =atomic_read (&tgt_net->ipv4.dev_addr_genid) ^ - tgt_net->dev_base_seq; + cb->seq =inet_base_seq (tgt_net);hlist_for_each_entry_rcu (dev, head, index_hlist) {if (idx < s_idx) goto cont;
@@ -2249,8 +2263,7 @@ static int inet_netconf_dump_devconf(struct sk_buff *skb, idx =0 ; head = &net->dev_index_head[h];rcu_read_lock (); - cb->seq =atomic_read (&net->ipv4.dev_addr_genid) ^ - net->dev_base_seq; + cb->seq =inet_base_seq (net);hlist_for_each_entry_rcu (dev, head, index_hlist) {if (idx < s_idx) goto cont;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/84 ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit e898e4cd1aab271ca414f9ac6e08e4c761f6913c ]
net->dev_base_seq and ipv6.dev_addr_genid are monotonically increasing.
If we XOR their values, we could miss to detect if both values were changed with the same amount.
--- net/ipv6/addrconf.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
net/ipv6/addrconf.c +18 -3
@@ -696,6 +696,22 @@ static int inet6_netconf_get_devconf(struct sk_buff *in_skb,return err; } +/* Combine dev_addr_genid and dev_base_seq to detect changes. +*/ +static u32 inet6_base_seq (const struct net *net) +{ +u32 res =atomic_read (&net->ipv6.dev_addr_genid) + + net->dev_base_seq; + +/* Must not return 0 (see nl_dump_check_consistent()). +* Chose a value far away from 0. +*/ +if (!res) + res =0x80000000 ; +return res; +} + +static int inet6_netconf_dump_devconf (struct sk_buff *skb,struct netlink_callback *cb) {
@@ -729,8 +745,7 @@ static int inet6_netconf_dump_devconf(struct sk_buff *skb, idx =0 ; head = &net->dev_index_head[h];rcu_read_lock (); - cb->seq =atomic_read (&net->ipv6.dev_addr_genid) ^ - net->dev_base_seq; + cb->seq =inet6_base_seq (net);hlist_for_each_entry_rcu (dev, head, index_hlist) {if (idx < s_idx) goto cont;
@@ -5232,7 +5247,7 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb, }rcu_read_lock (); - cb->seq =atomic_read (&tgt_net->ipv6.dev_addr_genid) ^ tgt_net->dev_base_seq; + cb->seq =inet6_base_seq (tgt_net);for (h = s_h; h <NETDEV_HASHENTRIES ; h++, s_idx =0 ) { idx =0 ; head = &tgt_net->dev_index_head[h];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/84 afs: Increase buffer size in afs_update_volume_status()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniil Dulov <[email protected]>
[ Upstream commit 6ea38e2aeb72349cad50e38899b0ba6fbcb2af3d ]
The max length of volume->vid value is 20 characters. So increase idbuf[] size up to 24 to avoid overflow.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
[DH: Actually, it's 20 + NUL, so increase it to 24 and use snprintf()]
--- fs/afs/volume.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/afs/volume.c +2 -2
@@ -221,7 +221,7 @@ static int afs_update_volume_status(struct afs_volume *volume, struct key *key) {struct afs_server_list *new, *old, *discard;struct afs_vldb_entry *vldb; -char idbuf[16 ]; +char idbuf[24 ];int ret, idsz;_enter ("" );
@@ -229,7 +229,7 @@ static int afs_update_volume_status(struct afs_volume *volume, struct key *key)/* We look up an ID by passing it as a decimal string in the * operation's name parameter. */ - idsz =sprintf (idbuf,"%llu" , volume->vid); + idsz =snprintf (idbuf,sizeof (idbuf),"%llu" , volume->vid); vldb =afs_vl_lookup_vldb (volume->cell, key, idbuf, idsz);if (IS_ERR (vldb)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/84 ipv6: sr: fix possible use-after-free and null-ptr-deref
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <[email protected]>
[ Upstream commit 5559cea2d5aa3018a5f00dd2aca3427ba09b386b ]
The pernet operations structure for the subsystem must be registered before registering the generic netlink family.
--- net/ipv6/seg6.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
net/ipv6/seg6.c +11 -9
@@ -441,22 +441,24 @@ int __init seg6_init(void) {int err = -ENOMEM ; - err =genl_register_family (&seg6_genl_family); + err =register_pernet_subsys (&ip6_segments_ops);if (err) goto out; - err =register_pernet_subsys (&ip6_segments_ops); + err =genl_register_family (&seg6_genl_family);if (err) - goto out_unregister_genl; + goto out_unregister_pernet;#ifdef CONFIG_IPV6_SEG6_LWTUNNEL err =seg6_iptunnel_init ();if (err) - goto out_unregister_pernet; + goto out_unregister_genl; err =seg6_local_init (); -if (err) - goto out_unregister_pernet; +if (err) { +seg6_iptunnel_exit (); + goto out_unregister_genl; + }#endif #ifdef CONFIG_IPV6_SEG6_HMAC
@@ -477,11 +479,11 @@ int __init seg6_init(void)#endif #endif #ifdef CONFIG_IPV6_SEG6_LWTUNNEL -out_unregister_pernet: -unregister_pernet_subsys (&ip6_segments_ops); -#endif out_unregister_genl:genl_unregister_family (&seg6_genl_family); +#endif +out_unregister_pernet: +unregister_pernet_subsys (&ip6_segments_ops); goto out; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/84 packet: move from strlcpy with unused retval to strscpy
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit 8fc9d51ea2d32a05f7d7cf86a25cc86ecc57eb45 ]
Follow the advice of the below link and prefer 'strscpy' in this subsystem. Conversion is 1:1 because the return value is not used. Generated by a coccinelle script.
Stable-dep-of: a7d6027790ac ("arp: Prevent overflow in arp_req_get().")
--- net/packet/af_packet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/packet/af_packet.c +2 -2
@@ -1850,7 +1850,7 @@ static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,*/ spkt->spkt_family = dev->type; -strlcpy (spkt->spkt_device, dev->name,sizeof (spkt->spkt_device)); +strscpy (spkt->spkt_device, dev->name,sizeof (spkt->spkt_device)); spkt->spkt_protocol = skb->protocol;/*
@@ -3511,7 +3511,7 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,rcu_read_lock (); dev =dev_get_by_index_rcu (sock_net (sk),READ_ONCE (pkt_sk (sk)->ifindex));if (dev) -strlcpy (uaddr->sa_data, dev->name,sizeof (uaddr->sa_data)); +strscpy (uaddr->sa_data, dev->name,sizeof (uaddr->sa_data));rcu_read_unlock ();return sizeof (*uaddr);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/84 s390: use the correct count for __iowrite64_copy()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
[ Upstream commit 723a2cc8d69d4342b47dfddbfe6c19f1b135f09b ]
The signature for __iowrite64_copy() requires the number of 64 bit quantities, not bytes. Multiple by 8 to get to a byte length before invoking zpci_memcpy_toio()
--- arch/s390/pci/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/pci/pci.c +1 -1
@@ -223,7 +223,7 @@ resource_size_t pcibios_align_resource(void *data, const struct resource *res,/* combine single writes by using store-block insn */ void __iowrite64_copy (void __iomem *to,const void *from,size_t count) { -zpci_memcpy_toio (to, from, count); +zpci_memcpy_toio (to, from, count *8 ); }void __iomem *ioremap (unsigned long ioaddr,unsigned long size)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/84 tls: rx: jump to a more appropriate label
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit bfc06e1aaa130b86a81ce3c41ec71a2f5e191690 ]
'recv_end:' checks num_async and decrypted, and is then followed by the 'end' label. Since we know that decrypted and num_async are 0 at the start we can jump to 'end'.
Move the init of decrypted and num_async to let the compiler catch if I'm wrong.
Stable-dep-of: fdfbaec5923d ("tls: stop recv() if initial process_rx_list gave us non-DATA")
--- net/tls/tls_sw.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/tls/tls_sw.c +4 -3
@@ -1748,6 +1748,7 @@ int tls_sw_recvmsg(struct sock *sk,struct tls_sw_context_rx *ctx =tls_sw_ctx_rx (tls_ctx);struct tls_prot_info *prot = &tls_ctx->prot_info;struct sk_psock *psock; +int num_async, pending;unsigned char control =0 ;ssize_t decrypted =0 ;struct strp_msg *rxm;
@@ -1760,8 +1761,6 @@ int tls_sw_recvmsg(struct sock *sk,bool is_kvec =iov_iter_is_kvec (&msg->msg_iter);bool is_peek = flags &MSG_PEEK ;bool bpf_strp_enabled; -int num_async =0 ; -int pending; flags |= nonblock;
@@ -1783,12 +1782,14 @@ int tls_sw_recvmsg(struct sock *sk, }if (len <= copied) - goto recv_end; + goto end; target =sock_rcvlowat (sk, flags &MSG_WAITALL , len); len = len - copied; timeo =sock_rcvtimeo (sk, flags &MSG_DONTWAIT ); + decrypted =0 ; + num_async =0 ;while (len && (decrypted + copied < target || ctx->recv_pkt)) {bool retain_skb = false;bool zc = false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/84 tls: rx: drop pointless else after goto
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit d5123edd10cf9d324fcb88e276bdc7375f3c5321 ]
Pointless else branch after goto makes the code harder to refactor down the line.
Stable-dep-of: fdfbaec5923d ("tls: stop recv() if initial process_rx_list gave us non-DATA")
--- net/tls/tls_sw.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/tls/tls_sw.c +1 -2
@@ -1777,10 +1777,9 @@ int tls_sw_recvmsg(struct sock *sk,if (err <0 ) {tls_err_abort (sk, err); goto end; - }else { - copied = err; } + copied = err;if (len <= copied) goto end;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/84 tls: stop recv() if initial process_rx_list gave us non-DATA
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit fdfbaec5923d9359698cbb286bc0deadbb717504 ]
If we have a non-DATA record on the rx_list and another record of the same type still on the queue, we will end up merging them:
- process_rx_list copies the non-DATA record
- we start the loop and process the first available record since it's of the same type
- we break out of the loop since the record was not DATA
Just check the record type and jump to the end in case process_rx_list did some work.
--- net/tls/tls_sw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tls/tls_sw.c +1 -1
@@ -1780,7 +1780,7 @@ int tls_sw_recvmsg(struct sock *sk, } copied = err; -if (len <= copied) +if (len <= copied || (copied && control !=TLS_RECORD_TYPE_DATA )) goto end; target =sock_rcvlowat (sk, flags &MSG_WAITALL , len);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/84 netfilter: nf_tables: set dormant flag on hook register failure
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit bccebf64701735533c8db37773eeacc6566cc8ec ]
We need to set the dormant flag again if we fail to register the hooks.
During memory pressure hook registration can fail and we end up with a table marked as active but no registered hooks.
On table/base chain deletion, nf_tables will attempt to unregister the hook again which yields a warn splat from the nftables core.
--- net/netfilter/nf_tables_api.c | 1 + 1 file changed, 1 insertion(+)
net/netfilter/nf_tables_api.c +1 -0
@@ -951,6 +951,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx)return 0 ; err_register_hooks: + ctx->table->flags |=NFT_TABLE_F_DORMANT ;nft_trans_destroy (trans);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/84 drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian König <[email protected]>
[ Upstream commit 7621350c6bb20fb6ab7eb988833ab96eac3dcbef ]
DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT can't be used when we hold locks since we are basically waiting for userspace to do something.
Holding a lock while doing so can trivial deadlock with page faults etc...
So make lockdep complain when a driver tries to do this.
v2: Add lockdep_assert_none_held() macro.
v3: Add might_sleep() and also use lockdep_assert_none_held() in the
IOCTL path.
Stable-dep-of: 3c43177ffb54 ("drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set")
--- drivers/gpu/drm/drm_syncobj.c | 12 ++++++++++++ include/linux/lockdep.h | 5 +++++ 2 files changed, 17 insertions(+)
drivers/gpu/drm/drm_syncobj.c +12 -0
@@ -325,6 +325,15 @@ int drm_syncobj_find_fence(struct drm_file *file_private,if (!syncobj)return -ENOENT ; +/* Waiting for userspace with locks help is illegal cause that can +* trivial deadlock with page faults for example. Make lockdep complain +* about it early on. +*/ +if (flags &DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT ) { +might_sleep (); +lockdep_assert_none_held_once (); + } + *fence =drm_syncobj_fence_get (syncobj);if (*fence) {
@@ -889,6 +898,9 @@ static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs,uint64_t *points;uint32_t signaled_count, i; +if (flags &DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT ) +lockdep_assert_none_held_once (); + points =kmalloc_array (count,sizeof (*points),GFP_KERNEL );if (points ==NULL )return -ENOMEM ;
include/linux/lockdep.h +5 -0
@@ -403,6 +403,10 @@ extern void lock_unpin_lock(struct lockdep_map *lock, struct pin_cookie);WARN_ON_ONCE (debug_locks && !lockdep_is_held (l)); \ } while (0) +#define lockdep_assert_none_held_once () do { \ + WARN_ON_ONCE(debug_locks && current->lockdep_depth); \ + } while (0) +#define lockdep_recursing (tsk) ((tsk)->lockdep_recursion)#define lockdep_pin_lock (l) lock_pin_lock(&(l)->dep_map)
@@ -479,6 +483,7 @@ struct lockdep_map { };#define lockdep_assert_held_write (l) do { (void)(l); } while (0)#define lockdep_assert_held_read (l) do { (void)(l); } while (0)#define lockdep_assert_held_once (l) do { (void)(l); } while (0) +#define lockdep_assert_none_held_once () do { } while (0)#define lockdep_recursing (tsk) (0)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/84 drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erik Kurzinger <[email protected]>
[ Upstream commit 3c43177ffb54ea5be97505eb8e2690e99ac96bc9 ]
When waiting for a syncobj timeline point whose fence has not yet been submitted with the WAIT_FOR_SUBMIT flag, a callback is registered using drm_syncobj_fence_add_wait and the thread is put to sleep until the timeout expires. If the fence is submitted before then, drm_syncobj_add_point will wake up the sleeping thread immediately which will proceed to wait for the fence to be signaled.
However, if the WAIT_AVAILABLE flag is used instead, drm_syncobj_fence_add_wait won't get called, meaning the waiting thread will always sleep for the full timeout duration, even if the fence gets submitted earlier. If it turns out that the fence *has* been submitted by the time it eventually wakes up, it will still indicate to userspace that the wait completed successfully (it won't return -ETIME), but it will have taken much longer than it should have.
To fix this, we must call drm_syncobj_fence_add_wait if *either* the WAIT_FOR_SUBMIT flag or the WAIT_AVAILABLE flag is set. The only difference being that with WAIT_FOR_SUBMIT we will also wait for the fence to be signaled after it has been submitted while with WAIT_AVAILABLE we will return immediately.
IGT test patch: https://lists.freedesktop.org/archives/igt-dev/2024-January/067537.html
v1 -> v2: adjust lockdep_assert_none_held_once condition
(cherry picked from commit 8c44ea81634a4a337df70a32621a5f3791be23df)
--- drivers/gpu/drm/drm_syncobj.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/drm_syncobj.c +4 -2
@@ -898,7 +898,8 @@ static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs,uint64_t *points;uint32_t signaled_count, i; -if (flags &DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT ) +if (flags & (DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT | +DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE ))lockdep_assert_none_held_once (); points =kmalloc_array (count,sizeof (*points),GFP_KERNEL );
@@ -967,7 +968,8 @@ static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs,* fallthough and try a 0 timeout wait! */ -if (flags &DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT ) { +if (flags & (DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT | +DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE )) {for (i =0 ; i < count; ++i)drm_syncobj_fence_add_wait (syncobjs[i], &entries[i]); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/84 fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit b820de741ae48ccf50dd95e297889c286ff4f760 upstream.
If kiocb_set_cancel_fn() is called for I/O submitted via io_uring, the following kernel warning appears:
WARNING: CPU: 3 PID: 368 at fs/aio.c:598 kiocb_set_cancel_fn+0x9c/0xa8 Call trace: kiocb_set_cancel_fn+0x9c/0xa8 ffs_epfile_read_iter+0x144/0x1d0 io_read+0x19c/0x498 io_issue_sqe+0x118/0x27c io_submit_sqes+0x25c/0x5fc __arm64_sys_io_uring_enter+0x104/0xab0 invoke_syscall+0x58/0x11c el0_svc_common+0xb4/0xf4 do_el0_svc+0x2c/0xb0 el0_svc+0x2c/0xa4 el0t_64_sync_handler+0x68/0xb4 el0t_64_sync+0x1a4/0x1a8
Fix this by setting the IOCB_AIO_RW flag for read and write I/O that is submitted by libaio.
--- fs/aio.c | 9 ++++++++- include/linux/fs.h | 2 ++ 2 files changed, 10 insertions(+), 1 deletion(-)
fs/aio.c +8 -1
@@ -570,6 +570,13 @@ void kiocb_set_cancel_fn(struct kiocb *istruct kioctx *ctx = req->ki_ctx;unsigned long flags; +/* +* kiocb didn't come from aio or is neither a read nor a write, hence +* ignore it. +*/ +if (!(iocb->ki_flags &IOCB_AIO_RW )) +return ; +if (WARN_ON_ONCE (!list_empty (&req->ki_list)))return ;
@@ -1455,7 +1462,7 @@ static int aio_prep_rw(struct kiocb *req req->ki_complete = aio_complete_rw; req->private =NULL ; req->ki_pos = iocb->aio_offset; - req->ki_flags =iocb_flags (req->ki_filp); + req->ki_flags =iocb_flags (req->ki_filp) |IOCB_AIO_RW ;if (iocb->aio_flags &IOCB_FLAG_RESFD ) req->ki_flags |=IOCB_EVENTFD ; req->ki_hint =ki_hint_validate (file_write_hint (req->ki_filp));
include/linux/fs.h +2 -0
@@ -314,6 +314,8 @@ enum rw_hint {#define IOCB_SYNC (1 << 5)#define IOCB_WRITE (1 << 6)#define IOCB_NOWAIT (1 << 7) +/* kiocb is a read or write operation submitted by fs/aio.c. */ +#define IOCB_AIO_RW (1 << 23)struct kiocb {struct file *ki_filp;
Greg Kroah-Hartman
maintainerPATCH 84/84 scripts/bpf: Fix xdp_md forward declaration typo
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
commit e0b68fb186b251374adbd870f99b1ecea236e770 upstream.
Fix typo in struct xpd_md, generated from bpf_helpers_doc.py, which is causing compilation warnings for programs using bpf_helpers.h
--- scripts/bpf_helpers_doc.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/bpf_helpers_doc.py +1 -1
@@ -418,7 +418,7 @@ class PrinterHelpers(Printer): 'struct __sk_buff', 'struct sk_msg_md', - 'struct xpd_md', + 'struct xdp_md', ] known_types = { '...',
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.270 release. There are 84 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.270-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.270 release. There are 84 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.270-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.4:
10 builds: 10 pass, 0 fail
24 boots: 24 pass, 0 fail
54 tests: 54 pass, 0 failLinux version: 5.4.270-rc1-g331c26fedbd3
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.270 release. There are 84 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.270-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.270 release. There are 84 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.270-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 5.4.270-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-5.4.y
* git commit: 331c26fedbd3ec4b446d0f2ae002f93421d3daa6
* git describe: v5.4.269-85-g331c26fedbd3
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.4.y/build/v5.4.269-85-g331c26fedbd3
## Test Regressions (compared to v5.4.269)
## Metric Regressions (compared to v5.4.269)
## Test Fixes (compared to v5.4.269)
## Metric Fixes (compared to v5.4.269)
## Test result summary
total: 97761, pass: 78074, fail: 3337, skip: 16283, xfail: 67
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 138 total, 138 passed, 0 failed
* arm64: 38 total, 36 passed, 2 failed
* i386: 25 total, 19 passed, 6 failed
* mips: 27 total, 27 passed, 0 failed
* parisc: 3 total, 0 passed, 3 failed
* powerpc: 32 total, 31 passed, 1 failed
* riscv: 12 total, 12 passed, 0 failed
* s390: 8 total, 8 passed, 0 failed
* sh: 10 total, 10 passed, 0 failed
* sparc: 8 total, 8 passed, 0 failed
* x86_64: 34 total, 34 passed, 0 failed
## Test suites summary
* boot
* kselftest-android
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers-dma-buf
* kselftest-efivarfs
* kselftest-exec
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-filesystems-epoll
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-lib
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mm
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-net-forwarding
* kselftest-net-mptcp
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-user_events
* kselftest-vDSO
* kselftest-watchdog
* kselftest-x86
* kselftest-zram
* kunit
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-smoketest
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture
--
Linaro LKFT
https://lkft.linaro.org
Hi Greg,
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.270 release. There are 84 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
No problems seen on x86_64 and aarch64 with our testing.
Thanks,
Harshit
Quoted 10 lines
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.270-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.270 release. There are 84 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 9 lines
Responses should be made by Thu, 29 Feb 2024 13:15:36 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.270-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.
KernelCI report for stable-rc/linux-5.4.y for this week.
## stable-rc HEAD for linux-5.4.y:
Date: 2024-02-27
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/log/?h=331c26fedbd3ec4b446d0f2ae002f93421d3daa6
## Build failures:
No build failures seen for the stable-rc/linux-5.4.y commit head \o/
## Boot failures:
No **new** boot failures seen for the stable-rc/linux-5.4.y commit head \o/
Thanks,
Shreeya Patel