5.10.215-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 5.10.215-rc1 review
This is the start of the stable review cycle for the 5.10.215 release. There are 294 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 13 Apr 2024 09:53:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.215-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.215-rc1
Michael Roth <[email protected]>
x86/head/64: Re-enable stack protection
Borislav Petkov (AMD) <[email protected]>
x86/retpoline: Add NOENDBR annotation to the SRSO dummy return thunk
Shin'ichiro Kawasaki <[email protected]>
scsi: sd: Fix wrong zone_write_granularity value during revalidate
Michal Kubecek <[email protected]>
kbuild: dummy-tools: adjust to stricter stackprotector check
Vasiliy Kovalev <[email protected]>
VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: btintel: Fixe build regression
Chris Wilson <[email protected]>
drm/i915/gt: Reset queue_priority_hint on parking
David Hildenbrand <[email protected]>
x86/mm/pat: fix VM_PAT handling in COW mappings
David Hildenbrand <[email protected]>
virtio: reenable config if freezing device failed
Thadeu Lima de Souza Cascardo <[email protected]>
tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: discard table flag update with pending basechain deletion
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: release batch on table validation from abort path
Roman Smirnov <[email protected]>
fbmon: prevent division by zero in fb_videomode_from_videomode()
Jiawei Fu (iBug) <[email protected]>
drivers/nvme: Add quirks for device 126f:2262
Aleksandr Burakov <[email protected]>
fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2
Colin Ian King <[email protected]>
usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined
Marco Felsch <[email protected]>
usb: typec: tcpci: add generic tcpci fallback compatible
Petre Rodan <[email protected]>
tools: iio: replace seekdir() in iio_generic_buffer
linke li <[email protected]>
ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment
Ricardo B. Marliere <[email protected]>
ktest: force $buildonly = 1 for 'make_warnings_file' test type
Alban Boyé <[email protected]>
platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi Vi8 tablet
Gergo Koteles <[email protected]>
Input: allocate keycode for Display refresh rate toggle
Manjunath Patil <[email protected]>
RDMA/cm: add timeout to cm_destroy_id wait
Roman Smirnov <[email protected]>
block: prevent division by zero in blk_rq_stat_sum()
Ian Rogers <[email protected]>
libperf evlist: Avoid out-of-bounds access
Daniel Drake <[email protected]>
Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default"
Dai Ngo <[email protected]>
SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int
Aric Cyr <[email protected]>
drm/amd/display: Fix nanosec stat overflow
Ye Bin <[email protected]>
ext4: forbid commit inconsistent quota data when errors=remount-ro
Zhang Yi <[email protected]>
ext4: add a hint for block bitmap corrupt state in mb_groups
Arnd Bergmann <[email protected]>
media: sta2x11: fix irq handler cast
Alex Henrie <[email protected]>
isofs: handle CDs with bad root inode but good Joliet root directory
Justin Tee <[email protected]>
scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
Tetsuo Handa <[email protected]>
sysv: don't call sb_bread() with pointers_lock held
Geert Uytterhoeven <[email protected]>
pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs
Kunwu Chan <[email protected]>
Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails
Edward Adam Davis <[email protected]>
Bluetooth: btintel: Fix null ptr deref in btintel_read_version
Eric Dumazet <[email protected]>
net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
David Sterba <[email protected]>
btrfs: send: handle path ref underflow in header iterate_inode_ref()
David Sterba <[email protected]>
btrfs: export: handle invalid inode or root reference in btrfs_get_parent()
David Sterba <[email protected]>
btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
Samasth Norway Ananda <[email protected]>
tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num()
Kunwu Chan <[email protected]>
pstore/zone: Add a null pointer check to the psz_kmsg_read
Shannon Nelson <[email protected]>
ionic: set adminq irq affinity
Johan Jonker <[email protected]>
arm64: dts: rockchip: fix rk3399 hdmi ports node
Johan Jonker <[email protected]>
arm64: dts: rockchip: fix rk3328 hdmi ports node
John Ogness <[email protected]>
panic: Flush kernel log buffer at the end
Harshit Mogalapalli <[email protected]>
VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
Markus Elfring <[email protected]>
batman-adv: Improve exception handling in batadv_throw_uevent()
Markus Elfring <[email protected]>
batman-adv: Return directly after a failed batadv_dat_select_candidates() in batadv_dat_forward_data()
Dmitry Antipov <[email protected]>
wifi: ath9k: fix LNA selection in ath_ant_try_scan()
Josh Poimboeuf <[email protected]>
objtool: Add asm version of STACK_FRAME_NON_STANDARD
Sean Christopherson <[email protected]>
x86/cpufeatures: Add CPUID_LNX_5 to track recently added Linux-defined word
Davide Caratti <[email protected]>
mptcp: don't account accept() of non-MPC client as fallback to TCP
Borislav Petkov (AMD) <[email protected]>
x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for !SRSO
Borislav Petkov (AMD) <[email protected]>
x86/bugs: Fix the SRSO mitigation on Zen3/4
Samuel Holland <[email protected]>
riscv: Fix spurious errors from __get/put_kernel_nofault
Sumanth Korikkar <[email protected]>
s390/entry: align system call table on 8 bytes
Borislav Petkov (AMD) <[email protected]>
x86/mce: Make sure to grab mce_sysfs_mutex in set_bank()
Herve Codina <[email protected]>
of: dynamic: Synchronize of_changeset_destroy() with the devlink removals
Herve Codina <[email protected]>
driver core: Introduce device_link_wait_removal()
I Gede Agastya Darma Laksana <[email protected]>
ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone
Arnd Bergmann <[email protected]>
ata: sata_mv: Fix PCI device ID table declaration compilation warning
Arnd Bergmann <[email protected]>
scsi: mylex: Fix sysfs buffer lengths
Arnd Bergmann <[email protected]>
ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit
Stephen Lee <[email protected]>
ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw
Johan Hovold <[email protected]>
arm64: dts: qcom: sc7180-trogdor: mark bluetooth address as broken
Venkata Lakshmi Narayana Gubba <[email protected]>
arm64: dts: qcom: sc7180: Remove clock for bluetooth on Trogdor
Paul Barker <[email protected]>
net: ravb: Always process TX descriptor ring
Antoine Tenart <[email protected]>
udp: do not accept non-tunnel GSO skbs landing in a tunnel
Alexander Stein <[email protected]>
Revert "usb: phy: generic: Get the vbus supply"
Bikash Hazarika <[email protected]>
scsi: qla2xxx: Update manufacturer detail
Bikash Hazarika <[email protected]>
scsi: qla2xxx: Update manufacturer details
Aleksandr Loktionov <[email protected]>
i40e: fix vf may be used uninitialized in this function warning
Aleksandr Loktionov <[email protected]>
i40e: fix i40e_count_filters() to count only active/new filters
Su Hui <[email protected]>
octeontx2-pf: check negative error code in otx2_open()
Antoine Tenart <[email protected]>
udp: do not transition UDP GRO fraglist partial checksums to unnecessary
Kuniyuki Iwashima <[email protected]>
ipv6: Fix infinite recursion in fib6_dump_done().
Jakub Kicinski <[email protected]>
selftests: reuseaddr_conflict: add missing new line at the end of the output
Eric Dumazet <[email protected]>
erspan: make sure erspan_base_hdr is present in skb->head
Piotr Wejman <[email protected]>
net: stmmac: fix rx queue priority assignment
Eric Dumazet <[email protected]>
net/sched: act_skbmod: prevent kernel-infoleak
Jakub Sitnicki <[email protected]>
bpf, sockmap: Prevent lock inversion deadlock in map delete elem
Christophe JAILLET <[email protected]>
vboxsf: Avoid an spurious warning if load_nls_xxx() fails
Eric Dumazet <[email protected]>
netfilter: validate user input for expected length
Ziyang Xuan <[email protected]>
netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: flush pending destroy work before exit_net release
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject new basechain after table flag update
Min Li <[email protected]>
block: add check that partition length needs to be aligned with block size
Pu Wen <[email protected]>
x86/srso: Add SRSO mitigation for Hygon processors
Vlastimil Babka <[email protected]>
mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations
Ingo Molnar <[email protected]>
Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped."
Jens Axboe <[email protected]>
io_uring: ensure '0' is returned on file registration success
Alex Williamson <[email protected]>
vfio/fsl-mc: Block calling interrupt handler without trigger
Alex Williamson <[email protected]>
vfio/platform: Create persistent IRQ handlers
Alex Williamson <[email protected]>
vfio/pci: Create persistent INTx handler
Alex Williamson <[email protected]>
vfio: Introduce interface to flush virqfd inject workqueue
Alex Williamson <[email protected]>
vfio/pci: Lock external INTx masking ops
Alex Williamson <[email protected]>
vfio/pci: Disable auto-enable of exclusive INTx IRQ
Mahmoud Adam <[email protected]>
net/rds: fix possible cp null dereference
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: disallow timeout for anonymous sets
Bastien Nocera <[email protected]>
Bluetooth: Fix TOCTOU in HCI debugfs implementation
Hui Wang <[email protected]>
Bluetooth: hci_event: set the conn encrypted before conn establishes
Sandipan Das <[email protected]>
x86/cpufeatures: Add new word for scattered features
Heiner Kallweit <[email protected]>
r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d
Arnd Bergmann <[email protected]>
dm integrity: fix out-of-range warning
Hariprasad Kelam <[email protected]>
Octeontx2-af: fix pause frame configuration in GMP mode
Andrei Matei <[email protected]>
bpf: Protect against int overflow for stack access size
Nikita Kiryushin <[email protected]>
ACPICA: debugger: check status of acpi_evaluate_object() in acpi_db_walk_for_fields()
Eric Dumazet <[email protected]>
tcp: properly terminate timers for kernel sockets
Przemek Kitszel <[email protected]>
ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa()
Ryosuke Yasuoka <[email protected]>
nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
Alan Stern <[email protected]>
USB: core: Fix deadlock in usb_deauthorize_interface()
Muhammad Usama Anjum <[email protected]>
scsi: lpfc: Correct size for wqe for memset()
Mika Westerberg <[email protected]>
PCI/DPC: Quirk PIO log size for Intel Ice Lake Root Ports
Kim Phillips <[email protected]>
x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled
Quinn Tran <[email protected]>
scsi: qla2xxx: Delay I/O Abort on PCI error
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix command flush on cable pull
Quinn Tran <[email protected]>
scsi: qla2xxx: Split FCE|EFT trace control
Christian A. Ehrhardt <[email protected]>
usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset
Christian A. Ehrhardt <[email protected]>
usb: typec: ucsi: Ack unsupported commands
yuan linyu <[email protected]>
usb: udc: remove warning when queue disabled ep
Minas Harutyunyan <[email protected]>
usb: dwc2: gadget: LPM flow fix
Minas Harutyunyan <[email protected]>
usb: dwc2: host: Fix ISOC flow in DDMA mode
Minas Harutyunyan <[email protected]>
usb: dwc2: host: Fix hibernation flow
Minas Harutyunyan <[email protected]>
usb: dwc2: host: Fix remote wakeup from hibernation
Alan Stern <[email protected]>
USB: core: Add hub_get() and hub_put() routines
Dan Carpenter <[email protected]>
staging: vc04_services: fix information leak in create_component()
Arnd Bergmann <[email protected]>
staging: vc04_services: changen strncpy() to strscpy_pad()
Guilherme G. Piccoli <[email protected]>
scsi: core: Fix unremoved procfs host directory regression
Duoming Zhou <[email protected]>
ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
Oliver Neukum <[email protected]>
usb: cdc-wdm: close race between read and workqueue
Claus Hansen Ries <[email protected]>
net: ll_temac: platform_get_resource replaced by wrong function
Mikko Rapeli <[email protected]>
mmc: core: Avoid negative index with array access
Mikko Rapeli <[email protected]>
mmc: core: Initialize mmc_blk_ioc_data
Nathan Chancellor <[email protected]>
hexagon: vmlinux.lds.S: handle attributes section
Max Filippov <[email protected]>
exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()
Felix Fietkau <[email protected]>
wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
John Sperbeck <[email protected]>
init: open /initrd.image with O_LARGEFILE
Zi Yan <[email protected]>
mm/migrate: set swap entry values of THP tail pages properly.
Liu Shixin <[email protected]>
mm/memory-failure: fix an incorrect use of tail pages
Hugo Villeneuve <[email protected]>
serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
Nathan Chancellor <[email protected]>
powerpc: xor_vmx: Add '-mhard-float' to CFLAGS
Tim Schumacher <[email protected]>
efivarfs: Request at most 512 bytes for variable names
Yang Jihong <[email protected]>
perf/core: Fix reentry problem in perf_output_read_group()
Pawan Gupta <[email protected]>
KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests
Pawan Gupta <[email protected]>
x86/rfds: Mitigate Register File Data Sampling (RFDS)
Pawan Gupta <[email protected]>
Documentation/hw-vuln: Add documentation for RFDS
Pawan Gupta <[email protected]>
x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set
Pawan Gupta <[email protected]>
KVM/VMX: Move VERW closer to VMentry for MDS mitigation
Pawan Gupta <[email protected]>
KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH
Pawan Gupta <[email protected]>
x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key
Pawan Gupta <[email protected]>
x86/entry_32: Add VERW just before userspace transition
Pawan Gupta <[email protected]>
x86/entry_64: Add VERW just before userspace transition
Pawan Gupta <[email protected]>
x86/bugs: Add asm helpers for executing VERW
Pawan Gupta <[email protected]>
x86/asm: Add _ASM_RIP() macro for x86-64 (%rip) suffix
Goldwyn Rodrigues <[email protected]>
btrfs: allocate btrfs_ioctl_defrag_range_args on stack
John Ogness <[email protected]>
printk: Update @console_may_schedule in console_trylock_spinning()
Maximilian Heyne <[email protected]>
xen/events: close evtchn after mapping cleanup
Sumit Garg <[email protected]>
tee: optee: Fix kernel panic caused by incorrect error handling
Bart Van Assche <[email protected]>
fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
Nicolas Pitre <[email protected]>
vt: fix unicode buffer corruption when deleting characters
Alexander Usyskin <[email protected]>
mei: me: add arrow lake point H DID
Alexander Usyskin <[email protected]>
mei: me: add arrow lake point S DID
Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled
Mathias Nyman <[email protected]>
usb: port: Don't try to peer unused USB ports based on location
Krishna Kurapati <[email protected]>
usb: gadget: ncm: Fix handling of zero block length packets
Alan Stern <[email protected]>
USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
Kailang Yang <[email protected]>
ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform
Sean Christopherson <[email protected]>
KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
Nathan Chancellor <[email protected]>
xfrm: Avoid clang fortify warning in copy_to_user_tmpl()
Michael Kelley <[email protected]>
Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of memory
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject constant set with timeout
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: disallow anonymous set with timeout flag
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
Greg Kroah-Hartman <[email protected]>
cpufreq: brcmstb-avs-cpufreq: fix up "add check for cpufreq_cpu_get's return value"
Ian Abbott <[email protected]>
comedi: comedi_test: Prevent timers rescheduling during deletion
Salvatore Bonaccorso <[email protected]>
scripts: kernel-doc: Fix syntax error due to undeclared args variable
Anton Altaparmakov <[email protected]>
x86/pm: Work around false positive kmemleak report in msr_build_context()
Andy Lutomirski <[email protected]>
x86/stackprotector/32: Make the canary into a regular percpu variable
Xu Wang <[email protected]>
vxge: remove unnecessary cast in kfree()
Mikulas Patocka <[email protected]>
dm snapshot: fix lockup in dm_exception_table_exit
Leo Ma <[email protected]>
drm/amd/display: Fix noise issue on HDMI AV mute
Rodrigo Siqueira <[email protected]>
drm/amd/display: Return the correct HDCP error code
Conrad Kostecki <[email protected]>
ahci: asm1064: asm1166: don't limit reported ports
Andrey Jr. Melnikov <[email protected]>
ahci: asm1064: correct count of reported ports
Jason A. Donenfeld <[email protected]>
wireguard: netlink: access device through ctx instead of peer
Jason A. Donenfeld <[email protected]>
wireguard: netlink: check for dangling peer via is_dead instead of empty list
Steven Rostedt (Google) <[email protected]>
net: hns3: tracing: fix hclgevf trace event strings
Borislav Petkov (AMD) <[email protected]>
x86/CPU/AMD: Update the Zenbleed microcode revisions
Marek Szyprowski <[email protected]>
cpufreq: dt: always allocate zeroed cpumask
Ryusuke Konishi <[email protected]>
nilfs2: prevent kernel bug at submit_bh_wbc()
Ryusuke Konishi <[email protected]>
nilfs2: fix failure to detect DAT corruption in btree and direct mappings
Qiang Zhang <[email protected]>
memtest: use {READ,WRITE}_ONCE in memory scanning
Jani Nikula <[email protected]>
drm/vc4: hdmi: do not return negative values from .get_modes()
Jani Nikula <[email protected]>
drm/imx/ipuv3: do not return negative values from .get_modes()
Jani Nikula <[email protected]>
drm/exynos: do not return negative values from .get_modes()
Jani Nikula <[email protected]>
drm/panel: do not return negative error codes from drm_panel_get_modes()
Harald Freudenberger <[email protected]>
s390/zcrypt: fix reference counting on zcrypt card objects
Sean Anderson <[email protected]>
soc: fsl: qbman: Use raw spinlock for cgr_lock
Sean Anderson <[email protected]>
soc: fsl: qbman: Add CGR update function
Sean Anderson <[email protected]>
soc: fsl: qbman: Add helper for sanity checking cgr ops
Sean Anderson <[email protected]>
soc: fsl: qbman: Always disable interrupts when taking cgr_lock
Steven Rostedt (Google) <[email protected]>
ring-buffer: Fix full_waiters_pending in poll
Steven Rostedt (Google) <[email protected]>
ring-buffer: Fix resetting of shortest_full
Steven Rostedt (Google) <[email protected]>
ring-buffer: Do not set shortest_full when full target is hit
Steven Rostedt (Google) <[email protected]>
ring-buffer: Fix waking up ring buffer readers
Alex Williamson <[email protected]>
vfio/platform: Disable virqfds on cleanup
Niklas Cassel <[email protected]>
PCI: dwc: endpoint: Fix advertised resizable BAR size
Nathan Chancellor <[email protected]>
kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1
Josef Bacik <[email protected]>
nfs: fix UAF in direct writes
Stanislaw Gruszka <[email protected]>
PCI/AER: Block runtime suspend when handling errors
Sean V Kelley <[email protected]>
PCI/ERR: Clear AER status only when we control AER
Samuel Thibault <[email protected]>
speakup: Fix 8bit characters from direct synth
Wayne Chang <[email protected]>
usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic
Jon Hunter <[email protected]>
usb: gadget: tegra-xudc: Use dev_err_probe()
Wayne Chang <[email protected]>
phy: tegra: xusb: Add API to retrieve the port number of phy
Christophe JAILLET <[email protected]>
slimbus: core: Remove usage of the deprecated ida_simple_xx() API
Jerome Brunet <[email protected]>
nvmem: meson-efuse: fix function pointer type mismatch
Maximilian Heyne <[email protected]>
ext4: fix corruption during on-line resize
Josua Mayer <[email protected]>
hwmon: (amc6821) add of_match table
Christian Gmeiner <[email protected]>
drm/etnaviv: Restore some id values
Dominique Martinet <[email protected]>
mmc: core: Fix switch on gp3 partition
Ryan Roberts <[email protected]>
mm: swap: fix race between free_swap_and_cache() and swapoff()
Fedor Pchelkin <[email protected]>
mac802154: fix llsec key resources release in mac802154_llsec_key_del
Yu Kuai <[email protected]>
dm-raid: fix lockdep waring in "pers->hot_add_disk"
Song Liu <[email protected]>
Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""
Paul Menzel <[email protected]>
PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports
Mika Westerberg <[email protected]>
PCI/DPC: Quirk PIO log size for certain Intel Root Ports
Mika Westerberg <[email protected]>
PCI/ASPM: Make Intel DG2 L1 acceptable latency unlimited
Bjorn Helgaas <[email protected]>
PCI: Work around Intel I210 ROM BAR overlap defect
Amey Narkhede <[email protected]>
PCI: Cache PCIe Device Capabilities register
Sean V Kelley <[email protected]>
PCI/ERR: Cache RCEC EA Capability offset in pci_init_capabilities()
Rafael J. Wysocki <[email protected]>
PCI/PM: Drain runtime-idle callbacks before driver removal
Uwe Kleine-König <[email protected]>
PCI: Drop pci_device_remove() test of pci_dev->driver
Filipe Manana <[email protected]>
btrfs: fix off-by-one chunk length calculation at contains_pending_extent()
Peter Collingbourne <[email protected]>
serial: Lock console when calling into driver before registration
Petr Mladek <[email protected]>
printk/console: Split out code that enables default console
Jameson Thies <[email protected]>
usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros
Miklos Szeredi <[email protected]>
fuse: don't unhash root
Miklos Szeredi <[email protected]>
fuse: fix root lookup with nonzero generation
Wolfram Sang <[email protected]>
mmc: tmio: avoid concurrent runs of mmc_request_done()
Qingliang Li <[email protected]>
PM: sleep: wakeirq: fix wake irq warning in system suspend
Toru Katagiri <[email protected]>
USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M
Aurélien Jacobs <[email protected]>
USB: serial: option: add MeiG Smart SLM320 product
Christian Häggström <[email protected]>
USB: serial: cp210x: add ID for MGP Instruments PDS100
Cameron Williams <[email protected]>
USB: serial: add device ID for VeriFone adapter
Daniel Vogelbacher <[email protected]>
USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB
Michael Ellerman <[email protected]>
powerpc/fsl: Fix mfpmr build errors with newer binutils
Gabor Juhos <[email protected]>
clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
Gabor Juhos <[email protected]>
clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
Gabor Juhos <[email protected]>
clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays
Gabor Juhos <[email protected]>
clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
Maulik Shah <[email protected]>
PM: suspend: Set mem_sleep_current during kernel command line setup
Guenter Roeck <[email protected]>
parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds
Guenter Roeck <[email protected]>
parisc: Fix csum_ipv6_magic on 64-bit systems
Guenter Roeck <[email protected]>
parisc: Fix csum_ipv6_magic on 32-bit systems
Guenter Roeck <[email protected]>
parisc: Fix ip_fast_csum
John David Anglin <[email protected]>
parisc: Avoid clobbering the C/B bits in the PSW with tophys and tovirt macros
Arseniy Krasnov <[email protected]>
mtd: rawnand: meson: fix scrambling mode value in command macro
Zhang Yi <[email protected]>
ubi: correct the calculation of fastmap size
Richard Weinberger <[email protected]>
ubi: Check for too small LEB size in VTBL code
Matthew Wilcox (Oracle) <[email protected]>
ubifs: Set page uptodate in the correct place
Jan Kara <[email protected]>
fat: fix uninitialized field in nostale filehandles
Matthew Wilcox (Oracle) <[email protected]>
bounds: support non-power-of-two CONFIG_NR_CPUS
Damien Le Moal <[email protected]>
block: Clear zone limits for a non-zoned stacked queue
Damien Le Moal <[email protected]>
block: introduce zone_write_granularity limit
Baokun Li <[email protected]>
ext4: correct best extent lstart adjustment logic
SeongJae Park <[email protected]>
selftests/mqueue: Set timeout to 180 seconds
Damian Muszynski <[email protected]>
crypto: qat - resolve race condition during AER recovery
Svyatoslav Pankratov <[email protected]>
crypto: qat - fix double free during reset
Randy Dunlap <[email protected]>
sparc: vDSO: fix return value of __setup handler
Randy Dunlap <[email protected]>
sparc64: NMI watchdog: fix return value of __setup handler
Sean Christopherson <[email protected]>
KVM: Always flush async #PF workqueue when vCPU is being destroyed
Gui-Dong Han <[email protected]>
media: xc4000: Fix atomicity violation in xc4000_get_frequency
Hugo Villeneuve <[email protected]>
serial: max310x: fix NULL pointer dereference in I2C instantiation
Zack Rusin <[email protected]>
drm/vmwgfx: Fix possible null pointer derefence with invalid contexts
Zack Rusin <[email protected]>
drm/vmwgfx: Fix some static checker warnings
Lee Jones <[email protected]>
drm/vmwgfx/vmwgfx_cmdbuf_res: Remove unused variable 'ret'
Christian König <[email protected]>
drm/vmwgfx: switch over to the new pin interface v2
Christian König <[email protected]>
drm/vmwgfx: stop using ttm_bo_create v2
Duje Mihanović <[email protected]>
arm: dts: marvell: Fix maxium->maxim typo in brownstone dts
Roberto Sassu <[email protected]>
smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity()
Roberto Sassu <[email protected]>
smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr()
Amit Pundir <[email protected]>
clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd
Hidenori Kobayashi <[email protected]>
media: staging: ipu3-imgu: Set fields before media_entity_pads_init()
Zheng Wang <[email protected]>
wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
Thomas Gleixner <[email protected]>
timers: Rename del_timer_sync() to timer_delete_sync()
Thomas Gleixner <[email protected]>
timers: Use del_timer_sync() even on UP
Thomas Gleixner <[email protected]>
timers: Update kernel-doc for various functions
Borislav Petkov <[email protected]>
x86/bugs: Use sysfs_emit()
Kim Phillips <[email protected]>
x86/cpu: Support AMD Automatic IBRS
Lin Yujun <[email protected]>
Documentation/hw-vuln: Update spectre doc
-------------
Diffstat:
Documentation/ABI/testing/sysfs-devices-system-cpu | 1 + Documentation/admin-guide/hw-vuln/index.rst | 1 + .../admin-guide/hw-vuln/reg-file-data-sampling.rst | 104 +++++++++ Documentation/admin-guide/hw-vuln/spectre.rst | 18 +- Documentation/admin-guide/kernel-parameters.txt | 27 ++- Documentation/block/queue-sysfs.rst | 7 + Documentation/x86/mds.rst | 34 ++- Makefile | 4 +- arch/arm/boot/dts/mmp2-brownstone.dts | 2 +- arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi | 3 +- arch/arm64/boot/dts/rockchip/rk3328.dtsi | 11 +- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 12 +- arch/hexagon/kernel/vmlinux.lds.S | 1 + arch/parisc/include/asm/assembly.h | 18 +- arch/parisc/include/asm/checksum.h | 10 +- arch/powerpc/include/asm/reg_fsl_emb.h | 11 +- arch/powerpc/lib/Makefile | 2 +- arch/riscv/include/asm/uaccess.h | 4 +- arch/s390/kernel/entry.S | 1 + arch/sparc/kernel/nmi.c | 2 +- arch/sparc/vdso/vma.c | 7 +- arch/x86/Kconfig | 18 +- arch/x86/Makefile | 8 + arch/x86/entry/entry.S | 23 ++ arch/x86/entry/entry_32.S | 59 +---- arch/x86/entry/entry_64.S | 10 + arch/x86/entry/entry_64_compat.S | 1 + arch/x86/include/asm/asm-prototypes.h | 1 + arch/x86/include/asm/asm.h | 5 + arch/x86/include/asm/cpufeature.h | 8 +- arch/x86/include/asm/cpufeatures.h | 5 +- arch/x86/include/asm/disabled-features.h | 3 +- arch/x86/include/asm/entry-common.h | 1 - arch/x86/include/asm/irqflags.h | 1 + arch/x86/include/asm/msr-index.h | 10 + arch/x86/include/asm/nospec-branch.h | 47 ++-- arch/x86/include/asm/processor.h | 15 +- arch/x86/include/asm/ptrace.h | 5 +- arch/x86/include/asm/required-features.h | 3 +- arch/x86/include/asm/segment.h | 30 +-- arch/x86/include/asm/setup.h | 1 - arch/x86/include/asm/stackprotector.h | 79 ++----- arch/x86/include/asm/suspend_32.h | 12 +- arch/x86/kernel/Makefile | 1 - arch/x86/kernel/asm-offsets_32.c | 5 - arch/x86/kernel/cpu/amd.c | 10 +- arch/x86/kernel/cpu/bugs.c | 245 ++++++++++++++------- arch/x86/kernel/cpu/common.c | 64 ++++-- arch/x86/kernel/cpu/mce/core.c | 4 +- arch/x86/kernel/doublefault_32.c | 4 +- arch/x86/kernel/head64.c | 9 - arch/x86/kernel/head_32.S | 18 +- arch/x86/kernel/head_64.S | 24 +- arch/x86/kernel/nmi.c | 3 - arch/x86/kernel/setup_percpu.c | 1 - arch/x86/kernel/tls.c | 8 +- arch/x86/kvm/cpuid.h | 2 + arch/x86/kvm/svm/sev.c | 18 +- arch/x86/kvm/vmx/run_flags.h | 7 +- arch/x86/kvm/vmx/vmenter.S | 9 +- arch/x86/kvm/vmx/vmx.c | 12 +- arch/x86/kvm/x86.c | 5 +- arch/x86/lib/insn-eval.c | 4 - arch/x86/lib/retpoline.S | 6 +- arch/x86/mm/ident_map.c | 23 +- arch/x86/mm/pat/memtype.c | 50 +++-- arch/x86/platform/pvh/head.S | 14 -- arch/x86/power/cpu.c | 6 +- arch/x86/xen/enlighten_pv.c | 1 - block/blk-settings.c | 41 +++- block/blk-stat.c | 2 +- block/blk-sysfs.c | 8 + block/ioctl.c | 11 +- drivers/accessibility/speakup/synth.c | 4 +- drivers/acpi/acpica/dbnames.c | 8 +- drivers/acpi/sleep.c | 12 - drivers/ata/ahci.c | 5 - drivers/ata/sata_mv.c | 63 +++--- drivers/ata/sata_sx4.c | 6 +- drivers/base/core.c | 26 ++- drivers/base/cpu.c | 8 + drivers/base/power/wakeirq.c | 4 +- drivers/bluetooth/btintel.c | 2 +- drivers/clk/qcom/gcc-ipq6018.c | 2 + drivers/clk/qcom/gcc-ipq8074.c | 2 + drivers/clk/qcom/gcc-sdm845.c | 1 + drivers/clk/qcom/mmcc-apq8084.c | 2 + drivers/clk/qcom/mmcc-msm8974.c | 2 + drivers/cpufreq/brcmstb-avs-cpufreq.c | 5 +- drivers/cpufreq/cpufreq-dt.c | 2 +- drivers/crypto/qat/qat_common/adf_aer.c | 23 +- drivers/firmware/efi/vars.c | 17 +- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 12 +- .../gpu/drm/amd/display/modules/hdcp/hdcp_psp.c | 3 + .../gpu/drm/amd/display/modules/inc/mod_stats.h | 4 +- drivers/gpu/drm/drm_panel.c | 17 +- drivers/gpu/drm/etnaviv/etnaviv_drv.c | 2 +- drivers/gpu/drm/etnaviv/etnaviv_hwdb.c | 9 + drivers/gpu/drm/exynos/exynos_drm_vidi.c | 4 +- drivers/gpu/drm/exynos/exynos_hdmi.c | 4 +- drivers/gpu/drm/i915/gt/intel_engine_pm.c | 3 - drivers/gpu/drm/i915/gt/intel_lrc.c | 3 + drivers/gpu/drm/imx/parallel-display.c | 4 +- drivers/gpu/drm/ttm/ttm_memory.c | 2 + drivers/gpu/drm/vc4/vc4_hdmi.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_binding.c | 20 +- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 92 ++++++-- drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 11 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 12 +- drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 12 +- drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_so.c | 3 +- drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c | 50 +---- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 6 +- drivers/hwmon/amc6821.c | 11 + drivers/infiniband/core/cm.c | 20 +- drivers/input/rmi4/rmi_driver.c | 6 +- drivers/md/dm-integrity.c | 2 +- drivers/md/dm-raid.c | 2 + drivers/md/dm-snap.c | 4 +- drivers/md/raid5.c | 12 + drivers/media/pci/sta2x11/sta2x11_vip.c | 9 +- drivers/media/tuners/xc4000.c | 4 +- drivers/misc/mei/hw-me-regs.h | 2 + drivers/misc/mei/pci-me.c | 2 + drivers/misc/vmw_vmci/vmci_datagram.c | 6 +- drivers/mmc/core/block.c | 14 +- drivers/mmc/host/tmio_mmc_core.c | 2 + drivers/mtd/nand/raw/meson_nand.c | 2 +- drivers/mtd/ubi/fastmap.c | 7 +- drivers/mtd/ubi/vtbl.c | 6 + .../ethernet/hisilicon/hns3/hns3pf/hclge_trace.h | 8 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_trace.h | 8 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 7 +- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 34 ++- drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 16 +- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 5 + .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +- drivers/net/ethernet/neterion/vxge/vxge-config.c | 2 +- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 5 +- drivers/net/ethernet/realtek/r8169_main.c | 9 + drivers/net/ethernet/renesas/ravb_main.c | 7 +- drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 40 +++- .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 38 +++- drivers/net/ethernet/xilinx/ll_temac_main.c | 2 +- drivers/net/wireguard/netlink.c | 10 +- drivers/net/wireless/ath/ath9k/antenna.c | 2 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 4 +- drivers/nvme/host/pci.c | 3 + drivers/nvmem/meson-efuse.c | 25 +-- drivers/of/dynamic.c | 12 + drivers/pci/controller/dwc/pcie-designware-ep.c | 7 +- drivers/pci/pci-driver.c | 23 +- drivers/pci/pci.c | 6 +- drivers/pci/pci.h | 17 ++ drivers/pci/pcie/Makefile | 2 +- drivers/pci/pcie/dpc.c | 15 +- drivers/pci/pcie/err.c | 33 ++- drivers/pci/pcie/rcec.c | 59 +++++ drivers/pci/probe.c | 7 +- drivers/pci/quirks.c | 100 +++++++++ drivers/pci/setup-res.c | 8 +- drivers/phy/tegra/xusb.c | 13 ++ drivers/pinctrl/renesas/core.c | 4 +- drivers/platform/x86/touchscreen_dmi.c | 9 + drivers/s390/crypto/zcrypt_api.c | 2 + drivers/scsi/hosts.c | 7 +- drivers/scsi/lpfc/lpfc_nportdisc.c | 6 +- drivers/scsi/lpfc/lpfc_nvmet.c | 2 +- drivers/scsi/myrb.c | 20 +- drivers/scsi/myrs.c | 24 +- drivers/scsi/qla2xxx/qla_attr.c | 14 +- drivers/scsi/qla2xxx/qla_def.h | 2 +- drivers/scsi/qla2xxx/qla_gs.c | 2 +- drivers/scsi/qla2xxx/qla_init.c | 102 ++++----- drivers/scsi/qla2xxx/qla_target.c | 10 + drivers/scsi/sd.c | 7 +- drivers/slimbus/core.c | 4 +- drivers/soc/fsl/qbman/qman.c | 98 +++++++-- drivers/staging/comedi/drivers/comedi_test.c | 30 ++- drivers/staging/media/ipu3/ipu3-v4l2.c | 16 +- .../staging/vc04_services/vchiq-mmal/mmal-vchiq.c | 5 +- drivers/tee/optee/device.c | 3 +- drivers/tty/n_gsm.c | 3 + drivers/tty/serial/8250/8250_port.c | 6 - drivers/tty/serial/fsl_lpuart.c | 7 +- drivers/tty/serial/max310x.c | 7 +- drivers/tty/serial/sc16is7xx.c | 15 +- drivers/tty/serial/serial_core.c | 12 + drivers/tty/vt/vt.c | 2 +- drivers/usb/class/cdc-wdm.c | 6 +- drivers/usb/core/hub.c | 23 +- drivers/usb/core/hub.h | 2 + drivers/usb/core/port.c | 5 +- drivers/usb/core/sysfs.c | 16 +- drivers/usb/dwc2/core.h | 14 ++ drivers/usb/dwc2/core_intr.c | 63 ++++-- drivers/usb/dwc2/gadget.c | 4 + drivers/usb/dwc2/hcd.c | 47 +++- drivers/usb/dwc2/hcd_ddma.c | 17 +- drivers/usb/dwc2/hw.h | 2 +- drivers/usb/gadget/function/f_ncm.c | 2 +- drivers/usb/gadget/udc/core.c | 4 +- drivers/usb/gadget/udc/tegra-xudc.c | 53 ++--- drivers/usb/host/sl811-hcd.c | 2 + drivers/usb/phy/phy-generic.c | 7 - drivers/usb/serial/cp210x.c | 4 + drivers/usb/serial/ftdi_sio.c | 2 + drivers/usb/serial/ftdi_sio_ids.h | 6 + drivers/usb/serial/option.c | 6 + drivers/usb/storage/isd200.c | 23 +- drivers/usb/typec/tcpm/tcpci.c | 1 + drivers/usb/typec/ucsi/ucsi.c | 42 +++- drivers/usb/typec/ucsi/ucsi.h | 4 +- drivers/vfio/fsl-mc/vfio_fsl_mc_intr.c | 7 +- drivers/vfio/pci/vfio_pci_intrs.c | 188 +++++++++------- drivers/vfio/platform/vfio_platform_irq.c | 106 ++++++--- drivers/vfio/virqfd.c | 21 ++ drivers/video/fbdev/core/fbmon.c | 7 +- drivers/video/fbdev/via/accel.c | 4 +- drivers/virtio/virtio.c | 10 +- drivers/xen/events/events_base.c | 5 +- fs/aio.c | 8 +- fs/btrfs/export.c | 9 +- fs/btrfs/ioctl.c | 25 +-- fs/btrfs/send.c | 10 +- fs/btrfs/volumes.c | 14 +- fs/exec.c | 1 + fs/ext4/mballoc.c | 22 +- fs/ext4/resize.c | 3 +- fs/ext4/super.c | 12 + fs/fat/nfs.c | 6 + fs/fuse/dir.c | 4 + fs/fuse/fuse_i.h | 1 - fs/fuse/inode.c | 7 +- fs/isofs/inode.c | 18 +- fs/nfs/direct.c | 11 +- fs/nfs/write.c | 2 +- fs/nilfs2/btree.c | 9 +- fs/nilfs2/direct.c | 9 +- fs/nilfs2/inode.c | 2 +- fs/pstore/zone.c | 2 + fs/sysv/itree.c | 10 +- fs/ubifs/file.c | 13 +- fs/vboxsf/super.c | 3 +- include/linux/blkdev.h | 15 ++ include/linux/cpu.h | 2 + include/linux/device.h | 1 + include/linux/gfp.h | 9 + include/linux/hyperv.h | 22 +- include/linux/nfs_fs.h | 1 + include/linux/objtool.h | 8 + include/linux/pci.h | 6 + include/linux/phy/tegra/xusb.h | 2 + include/linux/sunrpc/sched.h | 2 +- include/linux/timer.h | 18 +- include/linux/udp.h | 28 +++ include/linux/vfio.h | 2 + include/net/cfg802154.h | 1 + include/net/inet_connection_sock.h | 1 + include/net/sock.h | 7 + include/soc/fsl/qman.h | 9 + include/uapi/linux/input-event-codes.h | 1 + init/initramfs.c | 2 +- io_uring/io_uring.c | 2 +- kernel/bounds.c | 2 +- kernel/bpf/verifier.c | 5 + kernel/events/core.c | 9 + kernel/panic.c | 8 + kernel/power/suspend.c | 1 + kernel/printk/printk.c | 63 ++++-- kernel/time/timer.c | 160 ++++++++------ kernel/trace/ring_buffer.c | 193 +++++++++------- mm/compaction.c | 7 +- mm/memory-failure.c | 2 +- mm/memory.c | 4 + mm/memtest.c | 4 +- mm/migrate.c | 6 +- mm/page_alloc.c | 10 +- mm/swapfile.c | 13 +- mm/vmscan.c | 5 +- net/batman-adv/distributed-arp-table.c | 3 +- net/batman-adv/main.c | 14 +- net/bluetooth/hci_debugfs.c | 64 ++++-- net/bluetooth/hci_event.c | 25 +++ net/bridge/netfilter/ebtables.c | 6 + net/core/sock_map.c | 6 + net/ipv4/inet_connection_sock.c | 14 ++ net/ipv4/ip_gre.c | 5 + net/ipv4/netfilter/arp_tables.c | 4 + net/ipv4/netfilter/ip_tables.c | 4 + net/ipv4/tcp.c | 2 + net/ipv4/udp.c | 7 + net/ipv4/udp_offload.c | 13 +- net/ipv6/ip6_fib.c | 14 +- net/ipv6/ip6_gre.c | 3 + net/ipv6/netfilter/ip6_tables.c | 4 + net/ipv6/udp.c | 2 +- net/ipv6/udp_offload.c | 8 +- net/mac80211/cfg.c | 5 +- net/mac802154/llsec.c | 18 +- net/mptcp/protocol.c | 3 - net/mptcp/subflow.c | 3 + net/netfilter/nf_tables_api.c | 74 ++++++- net/nfc/nci/core.c | 5 + net/rds/rdma.c | 2 +- net/sched/act_skbmod.c | 10 +- net/smc/smc_pnet.c | 10 + net/xfrm/xfrm_user.c | 3 + scripts/Makefile.extrawarn | 2 + scripts/dummy-tools/gcc | 6 +- scripts/gcc-x86_32-has-stack-protector.sh | 6 +- scripts/kernel-doc | 2 +- security/smack/smack_lsm.c | 12 +- sound/pci/hda/patch_realtek.c | 9 +- sound/sh/aica.c | 17 +- sound/soc/soc-ops.c | 2 +- tools/iio/iio_utils.c | 2 +- tools/include/linux/objtool.h | 8 + tools/lib/perf/evlist.c | 18 +- tools/lib/perf/include/internal/evlist.h | 4 +- .../x86_energy_perf_policy.c | 1 + tools/testing/ktest/ktest.pl | 1 + tools/testing/selftests/mqueue/setting | 1 + tools/testing/selftests/net/reuseaddr_conflict.c | 2 +- virt/kvm/async_pf.c | 31 ++- 335 files changed, 3261 insertions(+), 1539 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/294 Documentation/hw-vuln: Update spectre doc
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Yujun <[email protected]>
commit 06cb31cc761823ef444ba4e1df11347342a6e745 upstream.
commit 7c693f54c873691 ("x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS")
adds the "ibrs " option in Documentation/admin-guide/kernel-parameters.txt but omits it to Documentation/admin-guide/hw-vuln/spectre.rst, add it.
--- Documentation/admin-guide/hw-vuln/spectre.rst | 1 + 1 file changed, 1 insertion(+)
Documentation/admin-guide/hw-vuln/spectre.rst +1 -0
@@ -625,6 +625,7 @@ kernel command line. eibrs enhanced IBRS eibrs,retpoline enhanced IBRS + Retpolines eibrs,lfence enhanced IBRS + LFENCE + ibrs use IBRS to protect kernel Not specifying this option is equivalent to spectre_v2=auto.
Greg Kroah-Hartman
maintainerPATCH 2/294 x86/cpu: Support AMD Automatic IBRS
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kim Phillips <[email protected]>
commit e7862eda309ecfccc36bb5558d937ed3ace07f3f upstream.
The AMD Zen4 core supports a new feature called Automatic IBRS.
It is a "set-and-forget" feature that means that, like Intel's Enhanced IBRS, h/w manages its IBRS mitigation resources automatically across CPL transitions.
The feature is advertised by CPUID_Fn80000021_EAX bit 8 and is enabled by setting MSR C000_0080 (EFER) bit 21.
Enable Automatic IBRS by default if the CPU feature is present. It typically provides greater performance over the incumbent generic retpolines mitigation.
Reuse the SPECTRE_V2_EIBRS spectre_v2_mitigation enum. AMD Automatic IBRS and Intel Enhanced IBRS have similar enablement. Add NO_EIBRS_PBRSB to cpu_vuln_whitelist, since AMD Automatic IBRS isn't affected by PBRSB-eIBRS.
The kernel command line option spectre_v2=eibrs is used to select AMD Automatic IBRS, if available.
--- Documentation/admin-guide/hw-vuln/spectre.rst | 6 +++--- Documentation/admin-guide/kernel-parameters.txt | 6 +++--- arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/msr-index.h | 2 ++ arch/x86/kernel/cpu/bugs.c | 20 ++++++++++++-------- arch/x86/kernel/cpu/common.c | 19 +++++++++++-------- 6 files changed, 32 insertions(+), 22 deletions(-)
Documentation/admin-guide/hw-vuln/spectre.rst +3 -3
@@ -622,9 +622,9 @@ kernel command line. retpoline,generic Retpolines retpoline,lfence LFENCE; indirect branch retpoline,amd alias for retpoline,lfence - eibrs enhanced IBRS - eibrs,retpoline enhanced IBRS + Retpolines - eibrs,lfence enhanced IBRS + LFENCE + eibrs Enhanced/Auto IBRS + eibrs,retpoline Enhanced/Auto IBRS + Retpolines + eibrs,lfence Enhanced/Auto IBRS + LFENCE ibrs use IBRS to protect kernel Not specifying this option is equivalent to
Documentation/admin-guide/kernel-parameters.txt +3 -3
@@ -5091,9 +5091,9 @@ retpoline,generic - Retpolines retpoline,lfence - LFENCE; indirect branch retpoline,amd - alias for retpoline,lfence - eibrs - enhanced IBRS - eibrs,retpoline - enhanced IBRS + Retpolines - eibrs,lfence - enhanced IBRS + LFENCE + eibrs - Enhanced/Auto IBRS + eibrs,retpoline - Enhanced/Auto IBRS + Retpolines + eibrs,lfence - Enhanced/Auto IBRS + LFENCE ibrs - use IBRS to protect kernel Not specifying this option is equivalent to
arch/x86/include/asm/cpufeatures.h +1 -0
@@ -403,6 +403,7 @@#define X86_FEATURE_SEV_ES (19*32+ 3)/* AMD Secure Encrypted Virtualization - Encrypted State */ #define X86_FEATURE_SME_COHERENT (19*32+10)/* "" AMD hardware-enforced cache coherency */ +#define X86_FEATURE_AUTOIBRS (20*32+ 8)/* "" Automatic IBRS */ #define X86_FEATURE_SBPB (20*32+27)/* "" Selective Branch Prediction Barrier */ #define X86_FEATURE_IBPB_BRTYPE (20*32+28)/* "" MSR_PRED_CMD[IBPB] flushes all branch type predictions */ #define X86_FEATURE_SRSO_NO (20*32+29)/* "" CPU is not affected by SRSO */
arch/x86/include/asm/msr-index.h +2 -0
@@ -30,6 +30,7 @@#define _EFER_SVME 12/* Enable virtualization */ #define _EFER_LMSLE 13/* Long Mode Segment Limit Enable */ #define _EFER_FFXSR 14/* Enable Fast FXSAVE/FXRSTOR */ +#define _EFER_AUTOIBRS 21/* Enable Automatic IBRS */ #define EFER_SCE (1<<_EFER_SCE)#define EFER_LME (1<<_EFER_LME)
@@ -38,6 +39,7 @@#define EFER_SVME (1<<_EFER_SVME)#define EFER_LMSLE (1<<_EFER_LMSLE)#define EFER_FFXSR (1<<_EFER_FFXSR) +#define EFER_AUTOIBRS (1<<_EFER_AUTOIBRS)/* Intel MSRs. Some also available on other CPUs */
arch/x86/kernel/cpu/bugs.c +12 -8
@@ -1293,9 +1293,9 @@ static const char * const spectre_v2_str [SPECTRE_V2_NONE] = "Vulnerable", [SPECTRE_V2_RETPOLINE] = "Mitigation: Retpolines", [SPECTRE_V2_LFENCE] = "Mitigation: LFENCE", - [SPECTRE_V2_EIBRS] = "Mitigation: Enhanced IBRS", - [SPECTRE_V2_EIBRS_LFENCE] = "Mitigation: Enhanced IBRS + LFENCE", - [SPECTRE_V2_EIBRS_RETPOLINE] = "Mitigation: Enhanced IBRS + Retpolines", + [SPECTRE_V2_EIBRS] = "Mitigation: Enhanced / Automatic IBRS", + [SPECTRE_V2_EIBRS_LFENCE] = "Mitigation: Enhanced / Automatic IBRS + LFENCE", + [SPECTRE_V2_EIBRS_RETPOLINE] = "Mitigation: Enhanced / Automatic IBRS + Retpolines", [SPECTRE_V2_IBRS] = "Mitigation: IBRS", };
@@ -1364,7 +1364,7 @@ static enum spectre_v2_mitigation_cmd __ cmd == SPECTRE_V2_CMD_EIBRS_LFENCE || cmd == SPECTRE_V2_CMD_EIBRS_RETPOLINE) && !boot_cpu_has(X86_FEATURE_IBRS_ENHANCED)) { -pr_err ("%s selected but CPU doesn't have eIBRS. Switching to AUTO select\n" , +pr_err ("%s selected but CPU doesn't have Enhanced or Automatic IBRS. Switching to AUTO select\n" , mitigation_options[i].option);return SPECTRE_V2_CMD_AUTO ; }
@@ -1549,8 +1549,12 @@ static void __init spectre_v2_select_mitpr_err (SPECTRE_V2_EIBRS_EBPF_MSG );if (spectre_v2_in_ibrs_mode (mode)) { - x86_spec_ctrl_base |=SPEC_CTRL_IBRS ; -update_spec_ctrl (x86_spec_ctrl_base); +if (boot_cpu_has (X86_FEATURE_AUTOIBRS )) { +msr_set_bit (MSR_EFER , _EFER_AUTOIBRS); + }else { + x86_spec_ctrl_base |=SPEC_CTRL_IBRS ; +update_spec_ctrl (x86_spec_ctrl_base); + } }switch (mode) {
@@ -1634,8 +1638,8 @@ static void __init spectre_v2_select_mit/* * Retpoline protects the kernel, but doesn't protect firmware. IBRS * and Enhanced IBRS protect firmware too, so enable IBRS around -* firmware calls only when IBRS / Enhanced IBRS aren't otherwise -* enabled. +* firmware calls only when IBRS / Enhanced / Automatic IBRS aren't +* otherwise enabled. * * Use "mode" to check Enhanced IBRS instead of boot_cpu_has(), because * the user might select retpoline on the kernel command line and if
arch/x86/kernel/cpu/common.c +11 -8
@@ -1098,8 +1098,8 @@ static const __initconst struct x86_cpu_VULNWL_AMD (0x12 ,NO_MELTDOWN |NO_SSB |NO_L1TF |NO_MDS |NO_SWAPGS |NO_ITLB_MULTIHIT |NO_MMIO ),/* FAMILY_ANY must be last, otherwise 0x0f - 0x12 matches won't work */ -VULNWL_AMD (X86_FAMILY_ANY ,NO_MELTDOWN |NO_L1TF |NO_MDS |NO_SWAPGS |NO_ITLB_MULTIHIT |NO_MMIO ), -VULNWL_HYGON (X86_FAMILY_ANY ,NO_MELTDOWN |NO_L1TF |NO_MDS |NO_SWAPGS |NO_ITLB_MULTIHIT |NO_MMIO ), +VULNWL_AMD (X86_FAMILY_ANY ,NO_MELTDOWN |NO_L1TF |NO_MDS |NO_SWAPGS |NO_ITLB_MULTIHIT |NO_MMIO |NO_EIBRS_PBRSB ), +VULNWL_HYGON (X86_FAMILY_ANY ,NO_MELTDOWN |NO_L1TF |NO_MDS |NO_SWAPGS |NO_ITLB_MULTIHIT |NO_MMIO |NO_EIBRS_PBRSB ),/* Zhaoxin Family 7 */ VULNWL(CENTAUR, 7, X86_MODEL_ANY, NO_SPECTRE_V2 | NO_SWAPGS | NO_MMIO),
@@ -1219,8 +1219,16 @@ static void __init cpu_set_bug_bits(stru !cpu_has(c, X86_FEATURE_AMD_SSB_NO))setup_force_cpu_bug (X86_BUG_SPEC_STORE_BYPASS ); -if (ia32_cap &ARCH_CAP_IBRS_ALL ) +/* +* AMD's AutoIBRS is equivalent to Intel's eIBRS - use the Intel feature +* flag and protect from vendor-specific bugs via the whitelist. +*/ +if ((ia32_cap &ARCH_CAP_IBRS_ALL ) ||cpu_has (c,X86_FEATURE_AUTOIBRS )) {setup_force_cpu_cap (X86_FEATURE_IBRS_ENHANCED ); +if (!cpu_matches (cpu_vuln_whitelist,NO_EIBRS_PBRSB ) && + !(ia32_cap &ARCH_CAP_PBRSB_NO )) +setup_force_cpu_bug (X86_BUG_EIBRS_PBRSB ); + }if (!cpu_matches (cpu_vuln_whitelist,NO_MDS ) && !(ia32_cap &ARCH_CAP_MDS_NO )) {
@@ -1282,11 +1290,6 @@ static void __init cpu_set_bug_bits(strusetup_force_cpu_bug (X86_BUG_RETBLEED ); } -if (cpu_has (c,X86_FEATURE_IBRS_ENHANCED ) && - !cpu_matches (cpu_vuln_whitelist,NO_EIBRS_PBRSB ) && - !(ia32_cap &ARCH_CAP_PBRSB_NO )) -setup_force_cpu_bug (X86_BUG_EIBRS_PBRSB ); -/* * Check if CPU is vulnerable to GDS. If running in a virtual machine on * an affected processor, the VMM may have disabled the use of GATHER by
Greg Kroah-Hartman
maintainerPATCH 3/294 x86/bugs: Use sysfs_emit()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov <[email protected]>
commit 1d30800c0c0ae1d086ffad2bdf0ba4403370f132 upstream.
Those mitigations are very talkative; use the printing helper which pays attention to the buffer size.
--- arch/x86/kernel/cpu/bugs.c | 105 ++++++++++++++++++++++----------------------- 1 file changed, 52 insertions(+), 53 deletions(-)
arch/x86/kernel/cpu/bugs.c +52 -53
@@ -2436,74 +2436,74 @@ static const char * const l1tf_vmx_statestatic ssize_t l1tf_show_state (char *buf) {if (l1tf_vmx_mitigation ==VMENTER_L1D_FLUSH_AUTO ) -return sprintf (buf,"%s\n" ,L1TF_DEFAULT_MSG ); +return sysfs_emit (buf,"%s\n" ,L1TF_DEFAULT_MSG );if (l1tf_vmx_mitigation ==VMENTER_L1D_FLUSH_EPT_DISABLED || (l1tf_vmx_mitigation ==VMENTER_L1D_FLUSH_NEVER &&sched_smt_active ())) { -return sprintf (buf,"%s; VMX: %s\n" ,L1TF_DEFAULT_MSG , - l1tf_vmx_states[l1tf_vmx_mitigation]); +return sysfs_emit (buf,"%s; VMX: %s\n" ,L1TF_DEFAULT_MSG , + l1tf_vmx_states[l1tf_vmx_mitigation]); } -return sprintf (buf,"%s; VMX: %s, SMT %s\n" ,L1TF_DEFAULT_MSG , - l1tf_vmx_states[l1tf_vmx_mitigation], -sched_smt_active () ?"vulnerable" :"disabled" ); +return sysfs_emit (buf,"%s; VMX: %s, SMT %s\n" ,L1TF_DEFAULT_MSG , + l1tf_vmx_states[l1tf_vmx_mitigation], +sched_smt_active () ?"vulnerable" :"disabled" ); }static ssize_t itlb_multihit_show_state (char *buf) {if (!boot_cpu_has (X86_FEATURE_MSR_IA32_FEAT_CTL ) || !boot_cpu_has (X86_FEATURE_VMX )) -return sprintf (buf,"KVM: Mitigation: VMX unsupported\n" ); +return sysfs_emit (buf,"KVM: Mitigation: VMX unsupported\n" );else if (!(cr4_read_shadow () &X86_CR4_VMXE )) -return sprintf (buf,"KVM: Mitigation: VMX disabled\n" ); +return sysfs_emit (buf,"KVM: Mitigation: VMX disabled\n" );else if (itlb_multihit_kvm_mitigation) -return sprintf (buf,"KVM: Mitigation: Split huge pages\n" ); +return sysfs_emit (buf,"KVM: Mitigation: Split huge pages\n" );else -return sprintf (buf,"KVM: Vulnerable\n" ); +return sysfs_emit (buf,"KVM: Vulnerable\n" ); }#else static ssize_t l1tf_show_state (char *buf) { -return sprintf (buf,"%s\n" ,L1TF_DEFAULT_MSG ); +return sysfs_emit (buf,"%s\n" ,L1TF_DEFAULT_MSG ); }static ssize_t itlb_multihit_show_state (char *buf) { -return sprintf (buf,"Processor vulnerable\n" ); +return sysfs_emit (buf,"Processor vulnerable\n" ); }#endif static ssize_t mds_show_state (char *buf) {if (boot_cpu_has (X86_FEATURE_HYPERVISOR )) { -return sprintf (buf,"%s; SMT Host state unknown\n" , - mds_strings[mds_mitigation]); +return sysfs_emit (buf,"%s; SMT Host state unknown\n" , + mds_strings[mds_mitigation]); }if (boot_cpu_has (X86_BUG_MSBDS_ONLY )) { -return sprintf (buf,"%s; SMT %s\n" , mds_strings[mds_mitigation], - (mds_mitigation ==MDS_MITIGATION_OFF ?"vulnerable" : -sched_smt_active () ?"mitigated" :"disabled" )); +return sysfs_emit (buf,"%s; SMT %s\n" , mds_strings[mds_mitigation], + (mds_mitigation ==MDS_MITIGATION_OFF ?"vulnerable" : +sched_smt_active () ?"mitigated" :"disabled" )); } -return sprintf (buf,"%s; SMT %s\n" , mds_strings[mds_mitigation], -sched_smt_active () ?"vulnerable" :"disabled" ); +return sysfs_emit (buf,"%s; SMT %s\n" , mds_strings[mds_mitigation], +sched_smt_active () ?"vulnerable" :"disabled" ); }static ssize_t tsx_async_abort_show_state (char *buf) {if ((taa_mitigation ==TAA_MITIGATION_TSX_DISABLED ) || (taa_mitigation ==TAA_MITIGATION_OFF )) -return sprintf (buf,"%s\n" , taa_strings[taa_mitigation]); +return sysfs_emit (buf,"%s\n" , taa_strings[taa_mitigation]);if (boot_cpu_has (X86_FEATURE_HYPERVISOR )) { -return sprintf (buf,"%s; SMT Host state unknown\n" , - taa_strings[taa_mitigation]); +return sysfs_emit (buf,"%s; SMT Host state unknown\n" , + taa_strings[taa_mitigation]); } -return sprintf (buf,"%s; SMT %s\n" , taa_strings[taa_mitigation], -sched_smt_active () ?"vulnerable" :"disabled" ); +return sysfs_emit (buf,"%s; SMT %s\n" , taa_strings[taa_mitigation], +sched_smt_active () ?"vulnerable" :"disabled" ); }static ssize_t mmio_stale_data_show_state (char *buf)
@@ -2571,47 +2571,46 @@ static char *pbrsb_eibrs_state(void)static ssize_t spectre_v2_show_state (char *buf) {if (spectre_v2_enabled ==SPECTRE_V2_LFENCE ) -return sprintf (buf,"Vulnerable: LFENCE\n" ); +return sysfs_emit (buf,"Vulnerable: LFENCE\n" );if (spectre_v2_enabled ==SPECTRE_V2_EIBRS &&unprivileged_ebpf_enabled ()) -return sprintf (buf,"Vulnerable: eIBRS with unprivileged eBPF\n" ); +return sysfs_emit (buf,"Vulnerable: eIBRS with unprivileged eBPF\n" );if (sched_smt_active () &&unprivileged_ebpf_enabled () && spectre_v2_enabled ==SPECTRE_V2_EIBRS_LFENCE ) -return sprintf (buf,"Vulnerable: eIBRS+LFENCE with unprivileged eBPF and SMT\n" ); +return sysfs_emit (buf,"Vulnerable: eIBRS+LFENCE with unprivileged eBPF and SMT\n" ); -return sprintf (buf,"%s%s%s%s%s%s%s\n" , - spectre_v2_strings[spectre_v2_enabled], -ibpb_state (), -boot_cpu_has (X86_FEATURE_USE_IBRS_FW ) ?", IBRS_FW" :"" , -stibp_state (), -boot_cpu_has (X86_FEATURE_RSB_CTXSW ) ?", RSB filling" :"" , -pbrsb_eibrs_state (), -spectre_v2_module_string ()); +return sysfs_emit (buf,"%s%s%s%s%s%s%s\n" , + spectre_v2_strings[spectre_v2_enabled], +ibpb_state (), +boot_cpu_has (X86_FEATURE_USE_IBRS_FW ) ?", IBRS_FW" :"" , +stibp_state (), +boot_cpu_has (X86_FEATURE_RSB_CTXSW ) ?", RSB filling" :"" , +pbrsb_eibrs_state (), +spectre_v2_module_string ()); }static ssize_t srbds_show_state (char *buf) { -return sprintf (buf,"%s\n" , srbds_strings[srbds_mitigation]); +return sysfs_emit (buf,"%s\n" , srbds_strings[srbds_mitigation]); }static ssize_t retbleed_show_state (char *buf) {if (retbleed_mitigation ==RETBLEED_MITIGATION_UNRET || retbleed_mitigation ==RETBLEED_MITIGATION_IBPB ) { -if (boot_cpu_data.x86_vendor !=X86_VENDOR_AMD && - boot_cpu_data.x86_vendor !=X86_VENDOR_HYGON ) -return sprintf (buf,"Vulnerable: untrained return thunk / IBPB on non-AMD based uarch\n" ); - -return sprintf (buf,"%s; SMT %s\n" , - retbleed_strings[retbleed_mitigation], - !sched_smt_active () ?"disabled" : - spectre_v2_user_stibp ==SPECTRE_V2_USER_STRICT || - spectre_v2_user_stibp ==SPECTRE_V2_USER_STRICT_PREFERRED ? -"enabled with STIBP protection" :"vulnerable" ); +if (boot_cpu_data.x86_vendor !=X86_VENDOR_AMD && + boot_cpu_data.x86_vendor !=X86_VENDOR_HYGON ) +return sysfs_emit (buf,"Vulnerable: untrained return thunk / IBPB on non-AMD based uarch\n" ); + +return sysfs_emit (buf,"%s; SMT %s\n" , retbleed_strings[retbleed_mitigation], + !sched_smt_active () ?"disabled" : + spectre_v2_user_stibp ==SPECTRE_V2_USER_STRICT || + spectre_v2_user_stibp ==SPECTRE_V2_USER_STRICT_PREFERRED ? +"enabled with STIBP protection" :"vulnerable" ); } -return sprintf (buf,"%s\n" , retbleed_strings[retbleed_mitigation]); +return sysfs_emit (buf,"%s\n" , retbleed_strings[retbleed_mitigation]); }static ssize_t gds_show_state (char *buf)
@@ -2633,26 +2632,26 @@ static ssize_t cpu_show_common(struct de char *buf, unsigned int bug) {if (!boot_cpu_has_bug (bug)) -return sprintf (buf,"Not affected\n" ); +return sysfs_emit (buf,"Not affected\n" );switch (bug) {case X86_BUG_CPU_MELTDOWN :if (boot_cpu_has (X86_FEATURE_PTI )) -return sprintf (buf,"Mitigation: PTI\n" ); +return sysfs_emit (buf,"Mitigation: PTI\n" );if (hypervisor_is_type (X86_HYPER_XEN_PV )) -return sprintf (buf,"Unknown (XEN PV detected, hypervisor mitigation required)\n" ); +return sysfs_emit (buf,"Unknown (XEN PV detected, hypervisor mitigation required)\n" );break ;case X86_BUG_SPECTRE_V1 : -return sprintf (buf,"%s\n" , spectre_v1_strings[spectre_v1_mitigation]); +return sysfs_emit (buf,"%s\n" , spectre_v1_strings[spectre_v1_mitigation]);case X86_BUG_SPECTRE_V2 :return spectre_v2_show_state (buf);case X86_BUG_SPEC_STORE_BYPASS : -return sprintf (buf,"%s\n" , ssb_strings[ssb_mode]); +return sysfs_emit (buf,"%s\n" , ssb_strings[ssb_mode]);case X86_BUG_L1TF :if (boot_cpu_has (X86_FEATURE_L1TF_PTEINV ))
@@ -2688,7 +2687,7 @@ static ssize_t cpu_show_common(struct debreak ; } -return sprintf (buf,"Vulnerable\n" ); +return sysfs_emit (buf,"Vulnerable\n" ); }ssize_t cpu_show_meltdown (struct device *dev,struct device_attribute *attr,char *buf)
Greg Kroah-Hartman
maintainerPATCH 4/294 timers: Update kernel-doc for various functions
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit 14f043f1340bf30bc60af127bff39f55889fef26 ]
The kernel-doc of timer related functions is partially uncomprehensible word salad. Rewrite it to make it useful.
Stable-dep-of: 0f7352557a35 ("wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach")
--- kernel/time/timer.c | 148 +++++++++++++++++++++++++++----------------- 1 file changed, 90 insertions(+), 58 deletions(-)
kernel/time/timer.c +90 -58
@@ -1068,14 +1068,16 @@ __mod_timer(struct timer_list *timer, unsigned long expires, unsigned int option }/** -* mod_timer_pending - modify a pending timer's timeout -* @timer: the pending timer to be modified -* @expires: new timeout in jiffies +* mod_timer_pending - Modify a pending timer's timeout +* @timer: The pending timer to be modified +* @expires: New absolute timeout in jiffies * -* mod_timer_pending() is the same for pending timers as mod_timer(), -* but will not re-activate and modify already deleted timers. +* mod_timer_pending() is the same for pending timers as mod_timer(), but +* will not activate inactive timers. * -* It is useful for unserialized use of timers. +* Return: +* * %0 - The timer was inactive and not modified +* * %1 - The timer was active and requeued to expire at @expires */ int mod_timer_pending (struct timer_list *timer,unsigned long expires) {
@@ -1084,24 +1086,27 @@ int mod_timer_pending(struct timer_list *timer, unsigned long expires)EXPORT_SYMBOL (mod_timer_pending);/** -* mod_timer - modify a timer's timeout -* @timer: the timer to be modified -* @expires: new timeout in jiffies -* -* mod_timer() is a more efficient way to update the expire field of an -* active timer (if the timer is inactive it will be activated) +* mod_timer - Modify a timer's timeout +* @timer: The timer to be modified +* @expires: New absolute timeout in jiffies * * mod_timer(timer, expires) is equivalent to: * * del_timer(timer); timer->expires = expires; add_timer(timer); * +* mod_timer() is more efficient than the above open coded sequence. In +* case that the timer is inactive, the del_timer() part is a NOP. The +* timer is in any case activated with the new expiry time @expires. +* * Note that if there are multiple unserialized concurrent users of the * same timer, then mod_timer() is the only safe way to modify the timeout, * since add_timer() cannot modify an already running timer. * -* The function returns whether it has modified a pending timer or not. -* (ie. mod_timer() of an inactive timer returns 0, mod_timer() of an -* active timer returns 1.) +* Return: +* * %0 - The timer was inactive and started +* * %1 - The timer was active and requeued to expire at @expires or +* the timer was active and not modified because @expires did +* not change the effective expiry time */ int mod_timer (struct timer_list *timer,unsigned long expires) {
@@ -1112,11 +1117,18 @@ EXPORT_SYMBOL(mod_timer);/** * timer_reduce - Modify a timer's timeout if it would reduce the timeout * @timer: The timer to be modified -* @expires: New timeout in jiffies +* @expires: New absolute timeout in jiffies * * timer_reduce() is very similar to mod_timer(), except that it will only -* modify a running timer if that would reduce the expiration time (it will -* start a timer that isn't running). +* modify an enqueued timer if that would reduce the expiration time. If +* @timer is not enqueued it starts the timer. +* +* Return: +* * %0 - The timer was inactive and started +* * %1 - The timer was active and requeued to expire at @expires or +* the timer was active and not modified because @expires +* did not change the effective expiry time such that the +* timer would expire earlier than already scheduled */ int timer_reduce (struct timer_list *timer,unsigned long expires) {
@@ -1125,18 +1137,21 @@ int timer_reduce(struct timer_list *timer, unsigned long expires)EXPORT_SYMBOL (timer_reduce);/** -* add_timer - start a timer -* @timer: the timer to be added +* add_timer - Start a timer +* @timer: The timer to be started * -* The kernel will do a ->function(@timer) callback from the -* timer interrupt at the ->expires point in the future. The -* current time is 'jiffies'. +* Start @timer to expire at @timer->expires in the future. @timer->expires +* is the absolute expiry time measured in 'jiffies'. When the timer expires +* timer->function(timer) will be invoked from soft interrupt context. * -* The timer's ->expires, ->function fields must be set prior calling this -* function. +* The @timer->expires and @timer->function fields must be set prior +* to calling this function. +* +* If @timer->expires is already in the past @timer will be queued to +* expire at the next timer tick. * -* Timers with an ->expires field in the past will be executed in the next -* timer tick. +* This can only operate on an inactive timer. Attempts to invoke this on +* an active timer are rejected with a warning. */ void add_timer (struct timer_list *timer) {
@@ -1146,11 +1161,13 @@ void add_timer(struct timer_list *timer)EXPORT_SYMBOL (add_timer);/** -* add_timer_on - start a timer on a particular CPU -* @timer: the timer to be added -* @cpu: the CPU to start it on +* add_timer_on - Start a timer on a particular CPU +* @timer: The timer to be started +* @cpu: The CPU to start it on +* +* Same as add_timer() except that it starts the timer on the given CPU. * -* This is not very scalable on SMP. Double adds are not possible. +* See add_timer() for further details. */ void add_timer_on (struct timer_list *timer,int cpu) {
@@ -1185,15 +1202,18 @@ void add_timer_on(struct timer_list *timer, int cpu)EXPORT_SYMBOL_GPL (add_timer_on);/** -* del_timer - deactivate a timer. -* @timer: the timer to be deactivated -* -* del_timer() deactivates a timer - this works on both active and inactive -* timers. -* -* The function returns whether it has deactivated a pending timer or not. -* (ie. del_timer() of an inactive timer returns 0, del_timer() of an -* active timer returns 1.) +* del_timer - Deactivate a timer. +* @timer: The timer to be deactivated +* +* The function only deactivates a pending timer, but contrary to +* del_timer_sync() it does not take into account whether the timer's +* callback function is concurrently executed on a different CPU or not. +* It neither prevents rearming of the timer. If @timer can be rearmed +* concurrently then the return value of this function is meaningless. +* +* Return: +* * %0 - The timer was not pending +* * %1 - The timer was pending and deactivated */ int del_timer (struct timer_list *timer) {
@@ -1215,10 +1235,19 @@ EXPORT_SYMBOL(del_timer);/** * try_to_del_timer_sync - Try to deactivate a timer -* @timer: timer to delete +* @timer: Timer to deactivate +* +* This function tries to deactivate a timer. On success the timer is not +* queued and the timer callback function is not running on any CPU. * -* This function tries to deactivate a timer. Upon successful (ret >= 0) -* exit the timer is not queued and the handler is not running on any CPU. +* This function does not guarantee that the timer cannot be rearmed right +* after dropping the base lock. That needs to be prevented by the calling +* code if necessary. +* +* Return: +* * %0 - The timer was not pending +* * %1 - The timer was pending and deactivated +* * %-1 - The timer callback function is running on a different CPU */ int try_to_del_timer_sync (struct timer_list *timer) {
@@ -1314,23 +1343,19 @@ static inline void del_timer_wait_running(struct timer_list *timer) { }#if defined(CONFIG_SMP ) || defined(CONFIG_PREEMPT_RT )/** -* del_timer_sync - deactivate a timer and wait for the handler to finish. -* @timer: the timer to be deactivated -* -* This function only differs from del_timer() on SMP: besides deactivating -* the timer it also makes sure the handler has finished executing on other -* CPUs. +* del_timer_sync - Deactivate a timer and wait for the handler to finish. +* @timer: The timer to be deactivated * * Synchronization rules: Callers must prevent restarting of the timer, * otherwise this function is meaningless. It must not be called from * interrupt contexts unless the timer is an irqsafe one. The caller must -* not hold locks which would prevent completion of the timer's -* handler. The timer's handler must not call add_timer_on(). Upon exit the -* timer is not queued and the handler is not running on any CPU. +* not hold locks which would prevent completion of the timer's callback +* function. The timer's handler must not call add_timer_on(). Upon exit +* the timer is not queued and the handler is not running on any CPU. * -* Note: For !irqsafe timers, you must not hold locks that are held in -* interrupt context while calling this function. Even if the lock has -* nothing to do with the timer in question. Here's why:: +* For !irqsafe timers, the caller must not hold locks that are held in +* interrupt context. Even if the lock has nothing to do with the timer in +* question. Here's why:: * * CPU0 CPU1 * ---- ----
@@ -1344,10 +1369,17 @@ static inline void del_timer_wait_running(struct timer_list *timer) { }* while (base->running_timer == mytimer); * * Now del_timer_sync() will never return and never release somelock. -* The interrupt on the other CPU is waiting to grab somelock but -* it has interrupted the softirq that CPU0 is waiting to finish. +* The interrupt on the other CPU is waiting to grab somelock but it has +* interrupted the softirq that CPU0 is waiting to finish. +* +* This function cannot guarantee that the timer is not rearmed again by +* some concurrent or preempting code, right after it dropped the base +* lock. If there is the possibility of a concurrent rearm then the return +* value of the function is meaningless. * -* The function returns whether it has deactivated a pending timer or not. +* Return: +* * %0 - The timer was not pending +* * %1 - The timer was pending and deactivated */ int del_timer_sync (struct timer_list *timer) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/294 timers: Use del_timer_sync() even on UP
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit 168f6b6ffbeec0b9333f3582e4cf637300858db5 ]
del_timer_sync() is assumed to be pointless on uniprocessor systems and can be mapped to del_timer() because in theory del_timer() can never be invoked while the timer callback function is executed.
This is not entirely true because del_timer() can be invoked from interrupt context and therefore hit in the middle of a running timer callback.
Contrary to that del_timer_sync() is not allowed to be invoked from interrupt context unless the affected timer is marked with TIMER_IRQSAFE. del_timer_sync() has proper checks in place to detect such a situation.
Give up on the UP optimization and make del_timer_sync() unconditionally available.
Stable-dep-of: 0f7352557a35 ("wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach")
--- include/linux/timer.h | 7 +------ kernel/time/timer.c | 2 -- 2 files changed, 1 insertion(+), 8 deletions(-)
include/linux/timer.h +1 -6
@@ -183,12 +183,7 @@ extern int timer_reduce(struct timer_list *timer, unsigned long expires);extern void add_timer (struct timer_list *timer);extern int try_to_del_timer_sync (struct timer_list *timer); - -#if defined(CONFIG_SMP ) || defined(CONFIG_PREEMPT_RT ) -extern int del_timer_sync (struct timer_list *timer); -#else -# define del_timer_sync (t) del_timer(t) -#endif +extern int del_timer_sync (struct timer_list *timer);#define del_singleshot_timer_sync (t) del_timer_sync(t)
kernel/time/timer.c +0 -2
@@ -1341,7 +1341,6 @@ static inline void timer_sync_wait_running(struct timer_base *base) { }static inline void del_timer_wait_running (struct timer_list *timer) { }#endif -#if defined(CONFIG_SMP ) || defined(CONFIG_PREEMPT_RT )/** * del_timer_sync - Deactivate a timer and wait for the handler to finish. * @timer: The timer to be deactivated
@@ -1415,7 +1414,6 @@ int del_timer_sync(struct timer_list *timer)return ret; }EXPORT_SYMBOL (del_timer_sync); -#endif static void call_timer_fn(struct timer_list *timer, void (*fn)(struct timer_list *),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/294 timers: Rename del_timer_sync() to timer_delete_sync()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit 9b13df3fb64ee95e2397585404e442afee2c7d4f ]
The timer related functions do not have a strict timer_ prefixed namespace which is really annoying.
Rename del_timer_sync() to timer_delete_sync() and provide del_timer_sync() as a wrapper. Document that del_timer_sync() is not for new code.
Stable-dep-of: 0f7352557a35 ("wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach")
--- include/linux/timer.h | 15 ++++++++++++++- kernel/time/timer.c | 18 +++++++++--------- 2 files changed, 23 insertions(+), 10 deletions(-)
include/linux/timer.h +14 -1
@@ -183,7 +183,20 @@ extern int timer_reduce(struct timer_list *timer, unsigned long expires);extern void add_timer (struct timer_list *timer);extern int try_to_del_timer_sync (struct timer_list *timer); -extern int del_timer_sync (struct timer_list *timer); +extern int timer_delete_sync (struct timer_list *timer); + +/** +* del_timer_sync - Delete a pending timer and wait for a running callback +* @timer: The timer to be deleted +* +* See timer_delete_sync() for detailed explanation. +* +* Do not use in new code. Use timer_delete_sync() instead. +*/ +static inline int del_timer_sync (struct timer_list *timer) +{ +return timer_delete_sync (timer); +}#define del_singleshot_timer_sync (t) del_timer_sync(t)
kernel/time/timer.c +9 -9
@@ -1030,7 +1030,7 @@ __mod_timer(struct timer_list *timer, unsigned long expires, unsigned int option/* * We are trying to schedule the timer on the new base. * However we can't change timer's base while it is running, -* otherwise del_timer_sync() can't detect that the timer's +* otherwise timer_delete_sync() can't detect that the timer's * handler yet has not finished. This also guarantees that the * timer is serialized wrt itself. */
@@ -1206,7 +1206,7 @@ EXPORT_SYMBOL_GPL(add_timer_on);* @timer: The timer to be deactivated * * The function only deactivates a pending timer, but contrary to -* del_timer_sync() it does not take into account whether the timer's +* timer_delete_sync() it does not take into account whether the timer's * callback function is concurrently executed on a different CPU or not. * It neither prevents rearming of the timer. If @timer can be rearmed * concurrently then the return value of this function is meaningless.
@@ -1342,7 +1342,7 @@ static inline void del_timer_wait_running(struct timer_list *timer) { }#endif /** -* del_timer_sync - Deactivate a timer and wait for the handler to finish. +* timer_delete_sync - Deactivate a timer and wait for the handler to finish. * @timer: The timer to be deactivated * * Synchronization rules: Callers must prevent restarting of the timer,
@@ -1364,10 +1364,10 @@ static inline void del_timer_wait_running(struct timer_list *timer) { }* spin_lock_irq(somelock); * <IRQ> * spin_lock(somelock); -* del_timer_sync(mytimer); +* timer_delete_sync(mytimer); * while (base->running_timer == mytimer); * -* Now del_timer_sync() will never return and never release somelock. +* Now timer_delete_sync() will never return and never release somelock. * The interrupt on the other CPU is waiting to grab somelock but it has * interrupted the softirq that CPU0 is waiting to finish. *
@@ -1380,7 +1380,7 @@ static inline void del_timer_wait_running(struct timer_list *timer) { }* * %0 - The timer was not pending * * %1 - The timer was pending and deactivated */ -int del_timer_sync (struct timer_list *timer) +int timer_delete_sync (struct timer_list *timer) {int ret;
@@ -1413,7 +1413,7 @@ int del_timer_sync(struct timer_list *timer)return ret; } -EXPORT_SYMBOL (del_timer_sync); +EXPORT_SYMBOL (timer_delete_sync); static void call_timer_fn(struct timer_list *timer, void (*fn)(struct timer_list *),
@@ -1435,8 +1435,8 @@ static void call_timer_fn(struct timer_list *timer,#endif /* * Couple the lock chain with the lock chain at -* del_timer_sync() by acquiring the lock_map around the fn() -* call here and in del_timer_sync(). +* timer_delete_sync() by acquiring the lock_map around the fn() +* call here and in timer_delete_sync(). */ lock_map_acquire (&lockdep_map);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/294 wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Wang <[email protected]>
[ Upstream commit 0f7352557a35ab7888bc7831411ec8a3cbe20d78 ]
This is the candidate patch of CVE-2023-47233 :
https://nvd.nist.gov/vuln/detail/CVE-2023-47233
In brcm80211 driver,it starts with the following invoking chain to start init a timeout worker:
->brcmf_usb_probe
->brcmf_usb_probe_cb
->brcmf_attach
->brcmf_bus_started
->brcmf_cfg80211_attach
->wl_init_priv
->brcmf_init_escan
->INIT_WORK(&cfg->escan_timeout_work,
brcmf_cfg80211_escan_timeout_worker);If we disconnect the USB by hotplug, it will call brcmf_usb_disconnect to make cleanup. The invoking chain is :
brcmf_usb_disconnect
->brcmf_usb_disconnect_cb
->brcmf_detach
->brcmf_cfg80211_detach
->kfree(cfg);While the timeout woker may still be running. This will cause a use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker.
Fix it by deleting the timer and canceling the worker in brcmf_cfg80211_detach.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +2 -2
@@ -790,8 +790,7 @@ s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg, scan_request = cfg->scan_request; cfg->scan_request =NULL ; -if (timer_pending (&cfg->escan_timeout)) -del_timer_sync (&cfg->escan_timeout); +timer_delete_sync (&cfg->escan_timeout);if (fw_abort) {/* Do a scan abort to stop the driver's scan engine */
@@ -7674,6 +7673,7 @@ void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)brcmf_btcoex_detach (cfg);wiphy_unregister (cfg->wiphy);wl_deinit_priv (cfg); +cancel_work_sync (&cfg->escan_timeout_work);brcmf_free_wiphy (cfg->wiphy);kfree (cfg); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/294 media: staging: ipu3-imgu: Set fields before media_entity_pads_init()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hidenori Kobayashi <[email protected]>
[ Upstream commit 87318b7092670d4086bfec115a0280a60c51c2dd ]
The imgu driver fails to probe with the following message because it does not set the pad's flags before calling media_entity_pads_init().
[ 14.596315] ipu3-imgu 0000:00:05.0: failed initialize subdev media entity (-22) [ 14.596322] ipu3-imgu 0000:00:05.0: failed to register subdev0 ret (-22) [ 14.596327] ipu3-imgu 0000:00:05.0: failed to register pipes (-22) [ 14.596331] ipu3-imgu 0000:00:05.0: failed to create V4L2 devices (-22)
Fix the initialization order so that the driver probe succeeds. The ops initialization is also moved together for readability.
--- drivers/staging/media/ipu3/ipu3-v4l2.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/staging/media/ipu3/ipu3-v4l2.c +8 -8
@@ -1063,6 +1063,11 @@ static int imgu_v4l2_subdev_register(struct imgu_device *imgu,struct imgu_media_pipe *imgu_pipe = &imgu->imgu_pipe[pipe];/* Initialize subdev media entity */ + imgu_sd->subdev.entity.ops = &imgu_media_ops; +for (i =0 ; i <IMGU_NODE_NUM ; i++) { + imgu_sd->subdev_pads[i].flags = imgu_pipe->nodes[i].output ? +MEDIA_PAD_FL_SINK :MEDIA_PAD_FL_SOURCE ; + } r =media_entity_pads_init (&imgu_sd->subdev.entity,IMGU_NODE_NUM , imgu_sd->subdev_pads);if (r) {
@@ -1070,11 +1075,6 @@ static int imgu_v4l2_subdev_register(struct imgu_device *imgu, "failed initialize subdev media entity (%d)\n", r);return r; } - imgu_sd->subdev.entity.ops = &imgu_media_ops; -for (i =0 ; i <IMGU_NODE_NUM ; i++) { - imgu_sd->subdev_pads[i].flags = imgu_pipe->nodes[i].output ? -MEDIA_PAD_FL_SINK :MEDIA_PAD_FL_SOURCE ; - }/* Initialize subdev */ v4l2_subdev_init (&imgu_sd->subdev, &imgu_subdev_ops);
@@ -1169,15 +1169,15 @@ static int imgu_v4l2_node_setup(struct imgu_device *imgu, unsigned int pipe, }/* Initialize media entities */ + node->vdev_pad.flags = node->output ? +MEDIA_PAD_FL_SOURCE :MEDIA_PAD_FL_SINK ; + vdev->entity.ops =NULL ; r =media_entity_pads_init (&vdev->entity,1 , &node->vdev_pad);if (r) {dev_err (dev,"failed initialize media entity (%d)\n" , r);mutex_destroy (&node->lock);return r; } - node->vdev_pad.flags = node->output ? -MEDIA_PAD_FL_SOURCE :MEDIA_PAD_FL_SINK ; - vdev->entity.ops =NULL ;/* Initialize vbq */ vbq->type = node->vdev_fmt.type;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/294 clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Pundir <[email protected]>
[ Upstream commit 1d9054e3a4fd36e2949e616f7360bdb81bcc1921 ]
With the addition of RPMh power domain to the GCC node in device tree, we noticed a significant delay in getting the UFS driver probed on AOSP which futher led to mount failures because Android do not support rootwait. So adding a soft dependency on RPMh power domain which informs modprobe to load rpmhpd module before gcc-sdm845.
--- drivers/clk/qcom/gcc-sdm845.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/qcom/gcc-sdm845.c +1 -0
@@ -3646,3 +3646,4 @@ module_exit(gcc_sdm845_exit);MODULE_DESCRIPTION ("QTI GCC SDM845 Driver" );MODULE_LICENSE ("GPL v2" );MODULE_ALIAS ("platform:gcc-sdm845" ); +MODULE_SOFTDEP ("pre: rpmhpd" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/294 smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roberto Sassu <[email protected]>
[ Upstream commit 9c82169208dde516510aaba6bbd8b13976690c5d ]
Since the SMACK64TRANSMUTE xattr makes sense only for directories, enforce this restriction in smack_inode_setxattr().
--- security/smack/smack_lsm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
security/smack/smack_lsm.c +2 -1
@@ -1280,7 +1280,8 @@ static int smack_inode_setxattr(struct dentry *dentry, const char *name, check_star =1 ; }else if (strcmp (name,XATTR_NAME_SMACKTRANSMUTE ) ==0 ) { check_priv =1 ; -if (size !=TRANS_TRUE_SIZE || +if (!S_ISDIR (d_backing_inode (dentry)->i_mode) || + size !=TRANS_TRUE_SIZE ||strncmp (value,TRANS_TRUE ,TRANS_TRUE_SIZE ) !=0 ) rc = -EINVAL ; }else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/294 smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roberto Sassu <[email protected]>
[ Upstream commit ac02f007d64eb2769d0bde742aac4d7a5fc6e8a5 ]
If the SMACK64TRANSMUTE xattr is provided, and the inode is a directory, update the in-memory inode flags by setting SMK_INODE_TRANSMUTE.
--- security/smack/smack_lsm.c | 9 +++++++++ 1 file changed, 9 insertions(+)
security/smack/smack_lsm.c +9 -0
@@ -2722,6 +2722,15 @@ static int smack_inode_setsecurity(struct inode *inode, const char *name,if (value ==NULL || size >SMK_LONGLABEL || size ==0 )return -EINVAL ; +if (strcmp (name,XATTR_SMACK_TRANSMUTE ) ==0 ) { +if (!S_ISDIR (inode->i_mode) || size !=TRANS_TRUE_SIZE || +strncmp (value,TRANS_TRUE ,TRANS_TRUE_SIZE ) !=0 ) +return -EINVAL ; + + nsp->smk_flags |=SMK_INODE_TRANSMUTE ; +return 0 ; + } + skp =smk_import_entry (value, size);if (IS_ERR (skp))return PTR_ERR (skp);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/294 arm: dts: marvell: Fix maxium->maxim typo in brownstone dts
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duje Mihanović <[email protected]>
[ Upstream commit 831e0cd4f9ee15a4f02ae10b67e7fdc10eb2b4fc ]
Fix an obvious spelling error in the PMIC compatible in the MMP2 Brownstone DTS file.
[krzysztof: Just 10 years to take a patch, not bad! Rephrased commit
msg]
--- arch/arm/boot/dts/mmp2-brownstone.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/mmp2-brownstone.dts +1 -1
@@ -28,7 +28,7 @@ &uart3 { &twsi1 { status = "okay"; pmic: max8925@3c { - compatible = "maxium,max8925"; + compatible = "maxim,max8925"; reg = <0x3c>; interrupts = <1>; interrupt-parent = <&intcmux4>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/294 drm/vmwgfx: stop using ttm_bo_create v2
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian König <[email protected]>
[ Upstream commit b254557cb244e2c18e59ee1cc2293128c52d2473 ]
Implement in the driver instead since it is the only user of that function.
v2: fix usage of ttm_bo_init_reserved
Stable-dep-of: 517621b70600 ("drm/vmwgfx: Fix possible null pointer derefence with invalid contexts")
--- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 43 ++++++++++++++++++++++ drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c | 6 +-- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 4 ++ drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c | 8 ++-- 4 files changed, 53 insertions(+), 8 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_bo.c +43 -0
@@ -487,6 +487,49 @@ static void vmw_user_bo_destroy(struct ttm_buffer_object *bo)ttm_prime_object_kfree (vmw_user_bo, prime); } +/** +* vmw_bo_create_kernel - Create a pinned BO for internal kernel use. +* +* @dev_priv: Pointer to the device private struct +* @size: size of the BO we need +* @placement: where to put it +* @p_bo: resulting BO +* +* Creates and pin a simple BO for in kernel use. +*/ +int vmw_bo_create_kernel (struct vmw_private *dev_priv,unsigned long size, +struct ttm_placement *placement, +struct ttm_buffer_object **p_bo) +{ +unsigned npages =PAGE_ALIGN (size) >>PAGE_SHIFT ; +struct ttm_operation_ctx ctx = { false, false }; +struct ttm_buffer_object *bo; +size_t acc_size; +int ret; + + bo =kzalloc (sizeof (*bo),GFP_KERNEL ); +if (unlikely (!bo)) +return -ENOMEM ; + + acc_size =ttm_round_pot (sizeof (*bo)); + acc_size +=ttm_round_pot (npages *sizeof (void *)); + acc_size +=ttm_round_pot (sizeof (struct ttm_tt )); + ret =ttm_bo_init_reserved (&dev_priv->bdev, bo, size, + ttm_bo_type_device, placement,0 , + &ctx, acc_size,NULL ,NULL ,NULL ); +if (unlikely (ret)) + goto error_free; + +ttm_bo_pin (bo); +ttm_bo_unreserve (bo); + *p_bo = bo; + +return 0 ; + +error_free: +kfree (bo); +return ret; +}/** * vmw_bo_init - Initialize a vmw buffer object
drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c +3 -3
@@ -1245,9 +1245,9 @@ int vmw_cmdbuf_set_pool_size(struct vmw_cmdbuf_man *man, !dev_priv->has_mob)return -ENOMEM ; - ret =ttm_bo_create (&dev_priv->bdev, size, ttm_bo_type_device, - &vmw_mob_ne_placement,0 , false, - &man->cmd_space); + ret =vmw_bo_create_kernel (dev_priv, size, + &vmw_mob_placement, + &man->cmd_space);if (ret)return ret;
drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +4 -0
@@ -845,6 +845,10 @@ extern void vmw_bo_get_guest_ptr(const struct ttm_buffer_object *buf, SVGAGuestPtr *ptr);extern void vmw_bo_pin_reserved (struct vmw_buffer_object *bo,bool pin);extern void vmw_bo_bo_free (struct ttm_buffer_object *bo); +extern int vmw_bo_create_kernel (struct vmw_private *dev_priv, +unsigned long size, +struct ttm_placement *placement, +struct ttm_buffer_object **p_bo); extern int vmw_bo_init(struct vmw_private *dev_priv, struct vmw_buffer_object *vmw_bo, size_t size, struct ttm_placement *placement,
drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c +3 -5
@@ -817,11 +817,9 @@ int vmw_bo_create_and_populate(struct vmw_private *dev_priv,struct ttm_buffer_object *bo;int ret; - ret =ttm_bo_create (&dev_priv->bdev, bo_size, - ttm_bo_type_device, - &vmw_sys_ne_placement, -0 , false, &bo); - + ret =vmw_bo_create_kernel (dev_priv, bo_size, + &vmw_sys_placement, + &bo);if (unlikely (ret !=0 ))return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/294 drm/vmwgfx: switch over to the new pin interface v2
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian König <[email protected]>
[ Upstream commit fbe86ca567919b22bbba1220ce55020b1868879f ]
Stop using TTM_PL_FLAG_NO_EVICT.
v2: fix unconditional pinning
Stable-dep-of: 517621b70600 ("drm/vmwgfx: Fix possible null pointer derefence with invalid contexts")
--- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 49 +++++++++++----------- drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 7 +--- drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c | 42 ------------------- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 2 +- 11 files changed, 39 insertions(+), 85 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_blit.c +2 -2
@@ -459,9 +459,9 @@ int vmw_bo_cpu_blit(struct ttm_buffer_object *dst,int ret =0 ;/* Buffer objects need to be either pinned or reserved: */ -if (!(dst->mem.placement &TTM_PL_FLAG_NO_EVICT )) +if (!(dst->pin_count))dma_resv_assert_held (dst->base.resv); -if (!(src->mem.placement &TTM_PL_FLAG_NO_EVICT )) +if (!(src->pin_count))dma_resv_assert_held (src->base.resv);if (!ttm_tt_is_populated (dst->ttm)) {
drivers/gpu/drm/vmwgfx/vmwgfx_bo.c +25 -24
115 lines not on this page · raw message
drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c +2 -2
@@ -410,8 +410,8 @@ static int vmw_cotable_resize(struct vmw_resource *res, size_t new_size)if (!buf)return -ENOMEM ; - ret =vmw_bo_init (dev_priv, buf, new_size, &vmw_mob_ne_placement, - true, vmw_bo_bo_free); + ret =vmw_bo_init (dev_priv, buf, new_size, &vmw_mob_placement, + true, true, vmw_bo_bo_free);if (ret) {DRM_ERROR ("Failed initializing new cotable MOB.\n" );return ret;
drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +1 -1
@@ -372,7 +372,7 @@ static int vmw_dummy_query_bo_create(struct vmw_private *dev_priv)return -ENOMEM ; ret =vmw_bo_init (dev_priv, vbo,PAGE_SIZE , - &vmw_sys_ne_placement, false, + &vmw_sys_placement, false, true, &vmw_bo_bo_free);if (unlikely (ret !=0 ))return ret;
drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +1 -6
@@ -99,7 +99,6 @@ struct vmw_fpriv {* struct vmw_buffer_object - TTM buffer object with vmwgfx additions * @base: The TTM buffer object * @res_tree: RB tree of resources using this buffer object as a backing MOB -* @pin_count: pin depth * @cpu_writers: Number of synccpu write grabs. Protected by reservation when * increased. May be decreased without reservation. * @dx_query_ctx: DX context if this buffer object is used as a DX query MOB
@@ -110,7 +109,6 @@ struct vmw_fpriv {struct vmw_buffer_object {struct ttm_buffer_object base;struct rb_root res_tree; -s32 pin_count;atomic_t cpu_writers;/* Not ref-counted. Protected by binding_mutex */ struct vmw_resource *dx_query_ctx;
@@ -852,7 +850,7 @@ extern int vmw_bo_create_kernel(struct vmw_private *dev_priv,extern int vmw_bo_init (struct vmw_private *dev_priv,struct vmw_buffer_object *vmw_bo,size_t size,struct ttm_placement *placement, -bool interruptible, +bool interruptible,bool pin,void (*bo_free)(struct ttm_buffer_object *bo));extern int vmw_user_bo_verify_access (struct ttm_buffer_object *bo,struct ttm_object_file *tfile);
@@ -1009,16 +1007,13 @@ extern void vmw_validation_mem_init_ttm(struct vmw_private *dev_priv,extern const size_t vmw_tt_size;extern struct ttm_placement vmw_vram_placement; -extern struct ttm_placement vmw_vram_ne_placement;extern struct ttm_placement vmw_vram_sys_placement;extern struct ttm_placement vmw_vram_gmr_placement;extern struct ttm_placement vmw_vram_gmr_ne_placement;extern struct ttm_placement vmw_sys_placement; -extern struct ttm_placement vmw_sys_ne_placement;extern struct ttm_placement vmw_evictable_placement;extern struct ttm_placement vmw_srf_placement;extern struct ttm_placement vmw_mob_placement; -extern struct ttm_placement vmw_mob_ne_placement;extern struct ttm_placement vmw_nonfixed_placement;extern struct ttm_bo_driver vmw_bo_driver; extern const struct vmw_sg_table *
drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +1 -1
@@ -406,7 +406,7 @@ static int vmw_fb_create_bo(struct vmw_private *vmw_priv, ret =vmw_bo_init (vmw_priv, vmw_bo, size, &vmw_sys_placement, - false, + false, false, &vmw_bo_bo_free);if (unlikely (ret !=0 )) goto err_unlock;/* init frees the buffer on failure */
drivers/gpu/drm/vmwgfx/vmwgfx_resource.c +2 -2
@@ -370,7 +370,7 @@ static int vmw_resource_buf_alloc(struct vmw_resource *res, ret =vmw_bo_init (res->dev_priv, backup, res->backup_size, res->func->backup_placement, - interruptible, + interruptible, false, &vmw_bo_bo_free);if (unlikely (ret !=0 )) goto out_no_bo;
@@ -1002,7 +1002,7 @@ int vmw_resource_pin(struct vmw_resource *res, bool interruptible) vbo = res->backup;ttm_bo_reserve (&vbo->base, interruptible, false,NULL ); -if (!vbo->pin_count) { +if (!vbo->base.pin_count) { ret = ttm_bo_validate (&vbo->base, res->func->backup_placement,
drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c +2 -2
@@ -451,8 +451,8 @@ vmw_sou_primary_plane_prepare_fb(struct drm_plane *plane,*/ vmw_overlay_pause_all (dev_priv); ret =vmw_bo_init (dev_priv, vps->bo, size, - &vmw_vram_ne_placement, - false, &vmw_bo_bo_free); + &vmw_vram_placement, + false, true, &vmw_bo_bo_free);vmw_overlay_resume_all (dev_priv);if (ret) { vps->bo =NULL ;/* vmw_bo_init frees on error */
drivers/gpu/drm/vmwgfx/vmwgfx_shader.c +2 -2
@@ -978,8 +978,8 @@ int vmw_compat_shader_add(struct vmw_private *dev_priv,if (unlikely (!buf))return -ENOMEM ; - ret =vmw_bo_init (dev_priv, buf, size, &vmw_sys_ne_placement, - true, vmw_bo_bo_free); + ret =vmw_bo_init (dev_priv, buf, size, &vmw_sys_placement, + true, true, vmw_bo_bo_free);if (unlikely (ret !=0 )) goto out;
drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c +0 -42
78 lines not on this page · raw message
drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +1 -1
@@ -540,7 +540,7 @@ int vmw_validation_bo_validate_single(struct ttm_buffer_object *bo,if (atomic_read (&vbo->cpu_writers))return -EBUSY ; -if (vbo->pin_count >0 ) +if (vbo->base.pin_count >0 )return 0 ;if (validate_as_mob)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/294 drm/vmwgfx/vmwgfx_cmdbuf_res: Remove unused variable ret
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <[email protected]>
[ Upstream commit 43ebfe61c3928573a5ef8d80c2f5300aa5c904c0 ]
Fixes the following W=1 kernel build warning(s):
drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c: In function ‘vmw_cmdbuf_res_revert’:
drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c:162:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable]
Stable-dep-of: 517621b70600 ("drm/vmwgfx: Fix possible null pointer derefence with invalid contexts")
--- drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c +1 -3
@@ -160,7 +160,6 @@ void vmw_cmdbuf_res_commit(struct list_head *list)void vmw_cmdbuf_res_revert (struct list_head *list) {struct vmw_cmdbuf_res *entry, *next; -int ret;list_for_each_entry_safe (entry, next, list, head) {switch (entry->state) {
@@ -168,8 +167,7 @@ void vmw_cmdbuf_res_revert(struct list_head *list)vmw_cmdbuf_res_free (entry->man, entry);break ;case VMW_CMDBUF_RES_DEL : - ret =drm_ht_insert_item (&entry->man->resources, - &entry->hash); +drm_ht_insert_item (&entry->man->resources, &entry->hash);list_del (&entry->head);list_add_tail (&entry->head, &entry->man->list); entry->state =VMW_CMDBUF_RES_COMMITTED ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/294 drm/vmwgfx: Fix some static checker warnings
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zack Rusin <[email protected]>
[ Upstream commit 74231041d14030f1ae6582b9233bfe782ac23e33 ]
Fix some minor issues that Coverity spotted in the code. None of that are serious but they're all valid concerns so fixing them makes sense.
Stable-dep-of: 517621b70600 ("drm/vmwgfx: Fix possible null pointer derefence with invalid contexts")
--- drivers/gpu/drm/ttm/ttm_memory.c | 2 ++ drivers/gpu/drm/vmwgfx/vmwgfx_binding.c | 20 ++++++++------------ drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 4 +++- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 ++ drivers/gpu/drm/vmwgfx/vmwgfx_mob.c | 4 +++- drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 6 ++++-- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 8 ++++++-- drivers/gpu/drm/vmwgfx/vmwgfx_so.c | 3 ++- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 ++-- 10 files changed, 33 insertions(+), 22 deletions(-)
drivers/gpu/drm/ttm/ttm_memory.c +2 -0
@@ -431,8 +431,10 @@ int ttm_mem_global_init(struct ttm_mem_global *glob)si_meminfo (&si); +spin_lock (&glob->lock);/* set it as 0 by default to keep original behavior of OOM */ glob->lower_mem_limit =0 ; +spin_unlock (&glob->lock); ret =ttm_mem_init_kernel_zone (glob, &si);if (unlikely (ret !=0 ))
drivers/gpu/drm/vmwgfx/vmwgfx_binding.c +8 -12
@@ -713,7 +713,7 @@ static int vmw_binding_scrub_cb(struct vmw_ctx_bindinfo *bi, bool rebind)* without checking which bindings actually need to be emitted * * @cbs: Pointer to the context's struct vmw_ctx_binding_state -* @bi: Pointer to where the binding info array is stored in @cbs +* @biv: Pointer to where the binding info array is stored in @cbs * @max_num: Maximum number of entries in the @bi array. * * Scans the @bi array for bindings and builds a buffer of view id data.
@@ -723,11 +723,9 @@ static int vmw_binding_scrub_cb(struct vmw_ctx_bindinfo *bi, bool rebind)* contains the command data. */ static void vmw_collect_view_ids (struct vmw_ctx_binding_state *cbs, -const struct vmw_ctx_bindinfo *bi, +const struct vmw_ctx_bindinfo_view *biv,u32 max_num) { -const struct vmw_ctx_bindinfo_view *biv = - container_of(bi, struct vmw_ctx_bindinfo_view, bi);unsigned long i; cbs->bind_cmd_count =0 ;
@@ -835,7 +833,7 @@ static int vmw_emit_set_sr(struct vmw_ctx_binding_state *cbs,*/ static int vmw_emit_set_rt (struct vmw_ctx_binding_state *cbs) { -const struct vmw_ctx_bindinfo *loc = &cbs->render_targets[0 ].bi; +const struct vmw_ctx_bindinfo_view *loc = &cbs->render_targets[0 ];struct {SVGA3dCmdHeader header;SVGA3dCmdDXSetRenderTargets body;
@@ -871,7 +869,7 @@ static int vmw_emit_set_rt(struct vmw_ctx_binding_state *cbs)* without checking which bindings actually need to be emitted * * @cbs: Pointer to the context's struct vmw_ctx_binding_state -* @bi: Pointer to where the binding info array is stored in @cbs +* @biso: Pointer to where the binding info array is stored in @cbs * @max_num: Maximum number of entries in the @bi array. * * Scans the @bi array for bindings and builds a buffer of SVGA3dSoTarget data.
@@ -881,11 +879,9 @@ static int vmw_emit_set_rt(struct vmw_ctx_binding_state *cbs)* contains the command data. */ static void vmw_collect_so_targets (struct vmw_ctx_binding_state *cbs, -const struct vmw_ctx_bindinfo *bi, +const struct vmw_ctx_bindinfo_so_target *biso,u32 max_num) { -const struct vmw_ctx_bindinfo_so_target *biso = - container_of(bi, struct vmw_ctx_bindinfo_so_target, bi);unsigned long i;SVGA3dSoTarget *so_buffer = (SVGA3dSoTarget *) cbs->bind_cmd_buffer;
@@ -916,7 +912,7 @@ static void vmw_collect_so_targets(struct vmw_ctx_binding_state *cbs,*/ static int vmw_emit_set_so_target (struct vmw_ctx_binding_state *cbs) { -const struct vmw_ctx_bindinfo *loc = &cbs->so_targets[0 ].bi; +const struct vmw_ctx_bindinfo_so_target *loc = &cbs->so_targets[0 ];struct {SVGA3dCmdHeader header;SVGA3dCmdDXSetSOTargets body;
@@ -1063,7 +1059,7 @@ static int vmw_emit_set_vb(struct vmw_ctx_binding_state *cbs)static int vmw_emit_set_uav (struct vmw_ctx_binding_state *cbs) { -const struct vmw_ctx_bindinfo *loc = &cbs->ua_views[0 ].views[0 ].bi; +const struct vmw_ctx_bindinfo_view *loc = &cbs->ua_views[0 ].views[0 ];struct {SVGA3dCmdHeader header;SVGA3dCmdDXSetUAViews body;
@@ -1093,7 +1089,7 @@ static int vmw_emit_set_uav(struct vmw_ctx_binding_state *cbs)static int vmw_emit_set_cs_uav (struct vmw_ctx_binding_state *cbs) { -const struct vmw_ctx_bindinfo *loc = &cbs->ua_views[1 ].views[0 ].bi; +const struct vmw_ctx_bindinfo_view *loc = &cbs->ua_views[1 ].views[0 ];struct {SVGA3dCmdHeader header;SVGA3dCmdDXSetCSUAViews body;
drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c +1 -1
@@ -514,7 +514,7 @@ static void vmw_cmdbuf_work_func(struct work_struct *work)struct vmw_cmdbuf_man *man = container_of(work, struct vmw_cmdbuf_man, work);struct vmw_cmdbuf_header *entry, *next; -uint32_t dummy; +uint32_t dummy =0 ;bool send_fence = false;struct list_head restart_head[SVGA_CB_CONTEXT_MAX ];int i;
drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c +3 -1
@@ -160,6 +160,7 @@ void vmw_cmdbuf_res_commit(struct list_head *list)void vmw_cmdbuf_res_revert (struct list_head *list) {struct vmw_cmdbuf_res *entry, *next; +int ret;list_for_each_entry_safe (entry, next, list, head) {switch (entry->state) {
@@ -167,7 +168,8 @@ void vmw_cmdbuf_res_revert(struct list_head *list)vmw_cmdbuf_res_free (entry->man, entry);break ;case VMW_CMDBUF_RES_DEL : -drm_ht_insert_item (&entry->man->resources, &entry->hash); + ret =drm_ht_insert_item (&entry->man->resources, &entry->hash); +BUG_ON (ret);list_del (&entry->head);list_add_tail (&entry->head, &entry->man->list); entry->state =VMW_CMDBUF_RES_COMMITTED ;
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +2 -0
@@ -2535,6 +2535,8 @@ static int vmw_cmd_dx_so_define(struct vmw_private *dev_priv, so_type =vmw_so_cmd_to_type (header->id); res =vmw_context_cotable (ctx_node->ctx, vmw_so_cotables[so_type]); +if (IS_ERR (res)) +return PTR_ERR (res); cmd =container_of (header,typeof (*cmd), header); ret =vmw_cotable_notify (res, cmd->defined_id);
drivers/gpu/drm/vmwgfx/vmwgfx_mob.c +3 -1
@@ -494,11 +494,13 @@ static void vmw_mob_pt_setup(struct vmw_mob *mob, {unsigned long num_pt_pages =0 ;struct ttm_buffer_object *bo = mob->pt_bo; -struct vmw_piter save_pt_iter; +struct vmw_piter save_pt_iter = {0 };struct vmw_piter pt_iter;const struct vmw_sg_table *vsgt;int ret; +BUG_ON (num_data_pages ==0 ); + ret =ttm_bo_reserve (bo, false, true,NULL );BUG_ON (ret !=0 );
drivers/gpu/drm/vmwgfx/vmwgfx_msg.c +4 -2
@@ -154,6 +154,7 @@ static unsigned long vmw_port_hb_out(struct rpc_channel *channel,/* HB port can't access encrypted memory. */ if (hb && !mem_encrypt_active ()) {unsigned long bp = channel->cookie_high; +u32 channel_id = (channel->channel_id <<16 ); si = (uintptr_t ) msg; di = channel->cookie_low;
@@ -161,7 +162,7 @@ static unsigned long vmw_port_hb_out(struct rpc_channel *channel,VMW_PORT_HB_OUT ( (MESSAGE_STATUS_SUCCESS <<16 ) |VMW_PORT_CMD_HB_MSG , msg_len, si, di, -VMWARE_HYPERVISOR_HB | (channel->channel_id <<16 ) | +VMWARE_HYPERVISOR_HB | channel_id |VMWARE_HYPERVISOR_OUT ,VMW_HYPERVISOR_MAGIC , bp, eax, ebx, ecx, edx, si, di);
@@ -209,6 +210,7 @@ static unsigned long vmw_port_hb_in(struct rpc_channel *channel, char *reply,/* HB port can't access encrypted memory */ if (hb && !mem_encrypt_active ()) {unsigned long bp = channel->cookie_low; +u32 channel_id = (channel->channel_id <<16 ); si = channel->cookie_high; di = (uintptr_t ) reply;
@@ -216,7 +218,7 @@ static unsigned long vmw_port_hb_in(struct rpc_channel *channel, char *reply,VMW_PORT_HB_IN ( (MESSAGE_STATUS_SUCCESS <<16 ) |VMW_PORT_CMD_HB_MSG , reply_len, si, di, -VMWARE_HYPERVISOR_HB | (channel->channel_id <<16 ), +VMWARE_HYPERVISOR_HB | channel_id,VMW_HYPERVISOR_MAGIC , bp, eax, ebx, ecx, edx, si, di);
drivers/gpu/drm/vmwgfx/vmwgfx_resource.c +6 -2
@@ -114,6 +114,7 @@ static void vmw_resource_release(struct kref *kref) container_of(kref, struct vmw_resource, kref);struct vmw_private *dev_priv = res->dev_priv;int id; +int ret;struct idr *idr = &dev_priv->res_idr[res->func->res_type];spin_lock (&dev_priv->resource_lock);
@@ -122,7 +123,8 @@ static void vmw_resource_release(struct kref *kref)if (res->backup) {struct ttm_buffer_object *bo = &res->backup->base; -ttm_bo_reserve (bo, false, false,NULL ); + ret =ttm_bo_reserve (bo, false, false,NULL ); +BUG_ON (ret);if (vmw_resource_mob_attached (res) && res->func->unbind !=NULL ) {struct ttm_validate_buffer val_buf;
@@ -1001,7 +1003,9 @@ int vmw_resource_pin(struct vmw_resource *res, bool interruptible)if (res->backup) { vbo = res->backup; -ttm_bo_reserve (&vbo->base, interruptible, false,NULL ); + ret =ttm_bo_reserve (&vbo->base, interruptible, false,NULL ); +if (ret) + goto out_no_validate;if (!vbo->base.pin_count) { ret = ttm_bo_validate (&vbo->base,
drivers/gpu/drm/vmwgfx/vmwgfx_so.c +2 -1
@@ -538,7 +538,8 @@ const SVGACOTableType vmw_so_cotables[] = { [vmw_so_ds] = SVGA_COTABLE_DEPTHSTENCIL, [vmw_so_rs] = SVGA_COTABLE_RASTERIZERSTATE, [vmw_so_ss] = SVGA_COTABLE_SAMPLER, - [vmw_so_so] = SVGA_COTABLE_STREAMOUTPUT + [vmw_so_so] = SVGA_COTABLE_STREAMOUTPUT, + [vmw_so_max]= SVGA_COTABLE_MAX };
drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +2 -2
@@ -585,13 +585,13 @@ int vmw_validation_bo_validate(struct vmw_validation_context *ctx, bool intr)container_of (entry->base.bo,typeof (*vbo), base);if (entry->cpu_blit) { -struct ttm_operation_ctx ctx = { +struct ttm_operation_ctx ttm_ctx = { .interruptible = intr, .no_wait_gpu = false }; ret =ttm_bo_validate (entry->base.bo, - &vmw_nonfixed_placement, &ctx); + &vmw_nonfixed_placement, &ttm_ctx); }else { ret =vmw_validation_bo_validate_single (entry->base.bo, intr, entry->as_mob);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/294 drm/vmwgfx: Fix possible null pointer derefence with invalid contexts
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zack Rusin <[email protected]>
[ Upstream commit 517621b7060096e48e42f545fa6646fc00252eac ]
vmw_context_cotable can return either an error or a null pointer and its usage sometimes went unchecked. Subsequent code would then try to access either a null pointer or an error value.
The invalid dereferences were only possible with malformed userspace apps which never properly initialized the rendering contexts.
Check the results of vmw_context_cotable to fix the invalid derefs.
Thanks:
ziming zhang(@ezrak1e) from Ant Group Light-Year Security Lab who was the first person to discover it.
Niels De Graef who reported it and helped to track down the poc.
--- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +11 -3
@@ -467,7 +467,7 @@ static int vmw_resource_context_res_add(struct vmw_private *dev_priv, vmw_res_type(ctx) == vmw_res_dx_context) {for (i =0 ; i < cotable_max; ++i) { res =vmw_context_cotable (ctx, i); -if (IS_ERR (res)) +if (IS_ERR_OR_NULL (res))continue ; ret = vmw_execbuf_res_noctx_val_add(sw_context, res,
@@ -1272,6 +1272,8 @@ static int vmw_cmd_dx_define_query(struct vmw_private *dev_priv,return -EINVAL ; cotable_res =vmw_context_cotable (ctx_node->ctx,SVGA_COTABLE_DXQUERY ); +if (IS_ERR_OR_NULL (cotable_res)) +return cotable_res ?PTR_ERR (cotable_res) : -EINVAL ; ret =vmw_cotable_notify (cotable_res, cmd->body.queryId);return ret;
@@ -2450,6 +2452,8 @@ static int vmw_cmd_dx_view_define(struct vmw_private *dev_priv,return ret; res =vmw_context_cotable (ctx_node->ctx, vmw_view_cotables[view_type]); +if (IS_ERR_OR_NULL (res)) +return res ?PTR_ERR (res) : -EINVAL ; ret =vmw_cotable_notify (res, cmd->defined_id);if (unlikely (ret !=0 ))return ret;
@@ -2535,8 +2539,8 @@ static int vmw_cmd_dx_so_define(struct vmw_private *dev_priv, so_type =vmw_so_cmd_to_type (header->id); res =vmw_context_cotable (ctx_node->ctx, vmw_so_cotables[so_type]); -if (IS_ERR (res)) -return PTR_ERR (res); +if (IS_ERR_OR_NULL (res)) +return res ?PTR_ERR (res) : -EINVAL ; cmd =container_of (header,typeof (*cmd), header); ret =vmw_cotable_notify (res, cmd->defined_id);
@@ -2655,6 +2659,8 @@ static int vmw_cmd_dx_define_shader(struct vmw_private *dev_priv,return -EINVAL ; res =vmw_context_cotable (ctx_node->ctx,SVGA_COTABLE_DXSHADER ); +if (IS_ERR_OR_NULL (res)) +return res ?PTR_ERR (res) : -EINVAL ; ret =vmw_cotable_notify (res, cmd->body.shaderId);if (ret)return ret;
@@ -2976,6 +2982,8 @@ static int vmw_cmd_dx_define_streamoutput(struct vmw_private *dev_priv, } res =vmw_context_cotable (ctx_node->ctx,SVGA_COTABLE_STREAMOUTPUT ); +if (IS_ERR_OR_NULL (res)) +return res ?PTR_ERR (res) : -EINVAL ; ret =vmw_cotable_notify (res, cmd->body.soid);if (ret)return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/294 serial: max310x: fix NULL pointer dereference in I2C instantiation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <[email protected]>
[ Upstream commit 0d27056c24efd3d63a03f3edfbcfc4827086b110 ]
When trying to instantiate a max14830 device from userspace:
echo max14830 0x60 > /sys/bus/i2c/devices/i2c-2/new_device
we get the following error:
Unable to handle kernel NULL pointer dereference at virtual address...
...
Call trace:
max310x_i2c_probe+0x48/0x170 [max310x]
i2c_device_probe+0x150/0x2a0
...Add check for validity of devtype to prevent the error, and abort probe with a meaningful error message.
--- drivers/tty/serial/max310x.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/tty/serial/max310x.c +5 -2
@@ -1636,13 +1636,16 @@ static unsigned short max310x_i2c_slave_addr(unsigned short addr,static int max310x_i2c_probe (struct i2c_client *client) { -const struct max310x_devtype *devtype = -device_get_match_data (&client->dev); +const struct max310x_devtype *devtype;struct i2c_client *port_client;struct regmap *regmaps[4 ];unsigned int i;u8 port_addr; + devtype =device_get_match_data (&client->dev); +if (!devtype) +return dev_err_probe (&client->dev, -ENODEV ,"Failed to match device\n" ); +if (client->addr < devtype->slave_addr.min || client->addr > devtype->slave_addr.max) return dev_err_probe(&client->dev, -EINVAL,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/294 media: xc4000: Fix atomicity violation in xc4000_get_frequency
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <[email protected]>
[ Upstream commit 36d503ad547d1c75758a6fcdbec2806f1b6aeb41 ]
In xc4000_get_frequency():
*freq = priv->freq_hz + priv->freq_offset;
The code accesses priv->freq_hz and priv->freq_offset without holding any lock.
In xc4000_set_params():
// Code that updates priv->freq_hz and priv->freq_offset ...
xc4000_get_frequency() and xc4000_set_params() may execute concurrently, risking inconsistent reads of priv->freq_hz and priv->freq_offset. Since these related data may update during reading, it can result in incorrect frequency calculation, leading to atomicity violations.
This possible bug is found by an experimental static analysis tool developed by our team, BassCheck[1]. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. The above possible bug is reported when our tool analyzes the source code of Linux 6.2.
To address this issue, it is proposed to add a mutex lock pair in xc4000_get_frequency() to ensure atomicity. With this patch applied, our tool no longer reports the possible bug, with the kernel configuration allyesconfig for x86_64. Due to the lack of associated hardware, we cannot test the patch in runtime testing, and just verify it according to the code logic.
[1] https://sites.google.com/view/basscheck/
--- drivers/media/tuners/xc4000.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/tuners/xc4000.c +2 -2
@@ -1517,10 +1517,10 @@ static int xc4000_get_frequency(struct dvb_frontend *fe, u32 *freq) {struct xc4000_priv *priv = fe->tuner_priv; +mutex_lock (&priv->lock); *freq = priv->freq_hz + priv->freq_offset;if (debug) { -mutex_lock (&priv->lock);if ((priv->cur_fw.type & (BASE |FM |DTV6 |DTV7 |DTV78 |DTV8 )) ==BASE ) {u16 snr =0 ;
@@ -1531,8 +1531,8 @@ static int xc4000_get_frequency(struct dvb_frontend *fe, u32 *freq)return 0 ; } } -mutex_unlock (&priv->lock); } +mutex_unlock (&priv->lock);dprintk (1 ,"%s()\n" , __func__);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/294 KVM: Always flush async #PF workqueue when vCPU is being destroyed
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
[ Upstream commit 3d75b8aa5c29058a512db29da7cbee8052724157 ]
Always flush the per-vCPU async #PF workqueue when a vCPU is clearing its completion queue, e.g. when a VM and all its vCPUs is being destroyed. KVM must ensure that none of its workqueue callbacks is running when the last reference to the KVM _module_ is put. Gifting a reference to the associated VM prevents the workqueue callback from dereferencing freed vCPU/VM memory, but does not prevent the KVM module from being unloaded before the callback completes.
Drop the misguided VM refcount gifting, as calling kvm_put_kvm() from async_pf_execute() if kvm_put_kvm() flushes the async #PF workqueue will result in deadlock. async_pf_execute() can't return until kvm_put_kvm() finishes, and kvm_put_kvm() can't return until async_pf_execute() finishes:
WARNING: CPU: 8 PID: 251 at virt/kvm/kvm_main.c:1435 kvm_put_kvm+0x2d/0x320 [kvm]
Modules linked in: vhost_net vhost vhost_iotlb tap kvm_intel kvm irqbypass
CPU: 8 PID: 251 Comm: kworker/8:1 Tainted: G W 6.6.0-rc1-e7af8d17224a-x86/gmem-vm #119
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
Workqueue: events async_pf_execute [kvm]
RIP: 0010:kvm_put_kvm+0x2d/0x320 [kvm]
Call Trace:
<TASK>
async_pf_execute+0x198/0x260 [kvm]
process_one_work+0x145/0x2d0
worker_thread+0x27e/0x3a0
kthread+0xba/0xe0
ret_from_fork+0x2d/0x50
ret_from_fork_asm+0x11/0x20
</TASK>
---[ end trace 0000000000000000 ]---
INFO: task kworker/8:1:251 blocked for more than 120 seconds.
Tainted: G W 6.6.0-rc1-e7af8d17224a-x86/gmem-vm #119
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/8:1 state:D stack:0 pid:251 ppid:2 flags:0x00004000
Workqueue: events async_pf_execute [kvm]
Call Trace:
<TASK>
__schedule+0x33f/0xa40
schedule+0x53/0xc0
schedule_timeout+0x12a/0x140
__wait_for_common+0x8d/0x1d0
__flush_work.isra.0+0x19f/0x2c0
kvm_clear_async_pf_completion_queue+0x129/0x190 [kvm]
kvm_arch_destroy_vm+0x78/0x1b0 [kvm]
kvm_put_kvm+0x1c1/0x320 [kvm]
async_pf_execute+0x198/0x260 [kvm]
process_one_work+0x145/0x2d0
worker_thread+0x27e/0x3a0
kthread+0xba/0xe0
ret_from_fork+0x2d/0x50
ret_from_fork_asm+0x11/0x20
</TASK>If kvm_clear_async_pf_completion_queue() actually flushes the workqueue, then there's no need to gift async_pf_execute() a reference because all invocations of async_pf_execute() will be forced to complete before the vCPU and its VM are destroyed/freed. And that in turn fixes the module unloading bug as __fput() won't do module_put() on the last vCPU reference until the vCPU has been freed, e.g. if closing the vCPU file also puts the last reference to the KVM module.
Note that kvm_check_async_pf_completion() may also take the work item off the completion queue and so also needs to flush the work queue, as the work will not be seen by kvm_clear_async_pf_completion_queue(). Waiting on the workqueue could theoretically delay a vCPU due to waiting for the work to complete, but that's a very, very small chance, and likely a very small delay. kvm_arch_async_page_present_queued() unconditionally makes a new request, i.e. will effectively delay entering the guest, so the remaining work is really just:
trace_kvm_async_pf_completed(addr, cr2_or_gpa);
__kvm_vcpu_wake_up(vcpu);
mmput(mm);and mmput() can't drop the last reference to the page tables if the vCPU is still alive, i.e. the vCPU won't get stuck tearing down page tables.
Add a helper to do the flushing, specifically to deal with "wakeup all" work items, as they aren't actually work items, i.e. are never placed in a workqueue. Trying to flush a bogus workqueue entry rightly makes __flush_work() complain (kudos to whoever added that sanity check).
Note, commit 5f6de5cbebee ("KVM: Prevent module exit until all VMs are freed") *tried* to fix the module refcounting issue by having VMs grab a reference to the module, but that only made the bug slightly harder to hit as it gave async_pf_execute() a bit more time to complete before the KVM module could be unloaded.
--- virt/kvm/async_pf.c | 31 ++++++++++++++++++++++++++----- 1 file changed, 26 insertions(+), 5 deletions(-)
virt/kvm/async_pf.c +26 -5
@@ -88,7 +88,27 @@ static void async_pf_execute(struct work_struct *work)rcuwait_wake_up (&vcpu->wait);mmput (mm); -kvm_put_kvm (vcpu->kvm); +} + +static void kvm_flush_and_free_async_pf_work (struct kvm_async_pf *work) +{ +/* +* The async #PF is "done", but KVM must wait for the work item itself, +* i.e. async_pf_execute(), to run to completion. If KVM is a module, +* KVM must ensure *no* code owned by the KVM (the module) can be run +* after the last call to module_put(). Note, flushing the work item +* is always required when the item is taken off the completion queue. +* E.g. even if the vCPU handles the item in the "normal" path, the VM +* could be terminated before async_pf_execute() completes. +* +* Wake all events skip the queue and go straight done, i.e. don't +* need to be flushed (but sanity check that the work wasn't queued). +*/ +if (work->wakeup_all) +WARN_ON_ONCE (work->work.func); +else +flush_work (&work->work); +kmem_cache_free (async_pf_cache, work); }void kvm_clear_async_pf_completion_queue (struct kvm_vcpu *vcpu)
@@ -115,7 +135,6 @@ void kvm_clear_async_pf_completion_queue(struct kvm_vcpu *vcpu)#else if (cancel_work_sync (&work->work)) {mmput (work->mm); -kvm_put_kvm (vcpu->kvm);/* == work->vcpu->kvm */ kmem_cache_free (async_pf_cache, work); }#endif
@@ -127,7 +146,10 @@ void kvm_clear_async_pf_completion_queue(struct kvm_vcpu *vcpu)list_first_entry (&vcpu->async_pf.done,typeof (*work), link);list_del (&work->link); -kmem_cache_free (async_pf_cache, work); + +spin_unlock (&vcpu->async_pf.lock); +kvm_flush_and_free_async_pf_work (work); +spin_lock (&vcpu->async_pf.lock); }spin_unlock (&vcpu->async_pf.lock);
@@ -152,7 +174,7 @@ void kvm_check_async_pf_completion(struct kvm_vcpu *vcpu)list_del (&work->queue); vcpu->async_pf.queued--; -kmem_cache_free (async_pf_cache, work); +kvm_flush_and_free_async_pf_work (work); } }
@@ -187,7 +209,6 @@ bool kvm_setup_async_pf(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, work->arch = *arch; work->mm = current->mm;mmget (work->mm); -kvm_get_kvm (work->vcpu->kvm);INIT_WORK (&work->work, async_pf_execute);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/294 sparc64: NMI watchdog: fix return value of __setup handler
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit 3ed7c61e49d65dacb96db798c0ab6fcd55a1f20f ]
__setup() handlers should return 1 to obsolete_checksetup() in init/main.c to indicate that the boot option has been handled. A return of 0 causes the boot option/value to be listed as an Unknown kernel parameter and added to init's (limited) argument or environment strings. Also, error return codes don't mean anything to obsolete_checksetup() -- only non-zero (usually 1) or zero. So return 1 from setup_nmi_watchdog().
--- arch/sparc/kernel/nmi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/sparc/kernel/nmi.c +1 -1
@@ -274,7 +274,7 @@ static int __init setup_nmi_watchdog(char *str)if (!strncmp (str,"panic" ,5 )) panic_on_timeout =1 ; -return 0 ; +return 1 ; }__setup ("nmi_watchdog=" , setup_nmi_watchdog);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/294 sparc: vDSO: fix return value of __setup handler
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit 5378f00c935bebb846b1fdb0e79cb76c137c56b5 ]
__setup() handlers should return 1 to obsolete_checksetup() in init/main.c to indicate that the boot option has been handled. A return of 0 causes the boot option/value to be listed as an Unknown kernel parameter and added to init's (limited) argument or environment strings. Also, error return codes don't mean anything to obsolete_checksetup() -- only non-zero (usually 1) or zero. So return 1 from vdso_setup().
--- arch/sparc/vdso/vma.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
arch/sparc/vdso/vma.c +3 -4
@@ -449,9 +449,8 @@ static __init int vdso_setup(char *s)unsigned long val; err =kstrtoul (s,10 , &val); -if (err) -return err; - vdso_enabled = val; -return 0 ; +if (!err) + vdso_enabled = val; +return 1 ; }__setup ("vdso=" , vdso_setup);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/294 crypto: qat - fix double free during reset
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Svyatoslav Pankratov <[email protected]>
[ Upstream commit 01aed663e6c421aeafc9c330bda630976b50a764 ]
There is no need to free the reset_data structure if the recovery is unsuccessful and the reset is synchronous. The function adf_dev_aer_schedule_reset() handles the cleanup properly. Only asynchronous resets require such structure to be freed inside the reset worker.
Stable-dep-of: 7d42e097607c ("crypto: qat - resolve race condition during AER recovery")
--- drivers/crypto/qat/qat_common/adf_aer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/crypto/qat/qat_common/adf_aer.c +2 -1
@@ -95,7 +95,8 @@ static void adf_device_reset_worker(struct work_struct *work)if (adf_dev_init (accel_dev) ||adf_dev_start (accel_dev)) {/* The device hanged and we can't restart it so stop here */ dev_err (&GET_DEV (accel_dev),"Restart device failed\n" ); -kfree (reset_data); +if (reset_data->mode ==ADF_DEV_RESET_ASYNC ) +kfree (reset_data);WARN (1 ,"QAT: device restart failed. Device is unusable\n" );return ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/294 crypto: qat - resolve race condition during AER recovery
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damian Muszynski <[email protected]>
[ Upstream commit 7d42e097607c4d246d99225bf2b195b6167a210c ]
During the PCI AER system's error recovery process, the kernel driver may encounter a race condition with freeing the reset_data structure's memory. If the device restart will take more than 10 seconds the function scheduling that restart will exit due to a timeout, and the reset_data structure will be freed. However, this data structure is used for completion notification after the restart is completed, which leads to a UAF bug.
This results in a KFENCE bug notice.
BUG: KFENCE: use-after-free read in adf_device_reset_worker+0x38/0xa0 [intel_qat] Use-after-free read at 0x00000000bc56fddf (in kfence-#142): adf_device_reset_worker+0x38/0xa0 [intel_qat] process_one_work+0x173/0x340
To resolve this race condition, the memory associated to the container of the work_struct is freed on the worker if the timeout expired, otherwise on the function that schedules the worker.
The timeout detection can be done by checking if the caller is still waiting for completion or not by using completion_done() function.
--- drivers/crypto/qat/qat_common/adf_aer.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-)
drivers/crypto/qat/qat_common/adf_aer.c +16 -6
@@ -95,7 +95,8 @@ static void adf_device_reset_worker(struct work_struct *work)if (adf_dev_init (accel_dev) ||adf_dev_start (accel_dev)) {/* The device hanged and we can't restart it so stop here */ dev_err (&GET_DEV (accel_dev),"Restart device failed\n" ); -if (reset_data->mode ==ADF_DEV_RESET_ASYNC ) +if (reset_data->mode ==ADF_DEV_RESET_ASYNC || +completion_done (&reset_data->compl))kfree (reset_data);WARN (1 ,"QAT: device restart failed. Device is unusable\n" );return ;
@@ -103,11 +104,19 @@ static void adf_device_reset_worker(struct work_struct *work)adf_dev_restarted_notify (accel_dev);clear_bit (ADF_STATUS_RESTARTING , &accel_dev->status); -/* The dev is back alive. Notify the caller if in sync mode */ -if (reset_data->mode ==ADF_DEV_RESET_SYNC ) -complete (&reset_data->compl); -else +/* +* The dev is back alive. Notify the caller if in sync mode +* +* If device restart will take a more time than expected, +* the schedule_reset() function can timeout and exit. This can be +* detected by calling the completion_done() function. In this case +* the reset_data structure needs to be freed here. +*/ +if (reset_data->mode ==ADF_DEV_RESET_ASYNC || +completion_done (&reset_data->compl))kfree (reset_data); +else +complete (&reset_data->compl); } static int adf_dev_aer_schedule_reset(struct adf_accel_dev *accel_dev,
@@ -140,8 +149,9 @@ static int adf_dev_aer_schedule_reset(struct adf_accel_dev *accel_dev,dev_err (&GET_DEV (accel_dev),"Reset device timeout expired\n" ); ret = -EFAULT ; + }else { +kfree (reset_data); } -kfree (reset_data);return ret; }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/294 selftests/mqueue: Set timeout to 180 seconds
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <[email protected]>
[ Upstream commit 85506aca2eb4ea41223c91c5fe25125953c19b13 ]
While mq_perf_tests runs with the default kselftest timeout limit, which is 45 seconds, the test takes about 60 seconds to complete on i3.metal AWS instances. Hence, the test always times out. Increase the timeout to 180 seconds.
--- tools/testing/selftests/mqueue/setting | 1 + 1 file changed, 1 insertion(+) create mode 100644 tools/testing/selftests/mqueue/setting
tools/testing/selftests/mqueue/setting new file +1 -0
@@ -0,0 +1 @@ +timeout=180
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/294 ext4: correct best extent lstart adjustment logic
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit 4fbf8bc733d14bceb16dda46a3f5e19c6a9621c5 ]
When yangerkun review commit 93cdf49f6eca ("ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa()"), it was found that the best extent did not completely cover the original request after adjusting the best extent lstart in ext4_mb_new_inode_pa() as follows:
original request: 2/10(8)
normalized request: 0/64(64)
best extent: 0/9(9)
When we check if best ex can be kept at start of goal, ac_o_ex.fe_logical is 2 less than the adjusted best extent logical end 9, so we think the adjustment is done. But obviously 0/9(9) doesn't cover 2/10(8), so we should determine here if the original request logical end is less than or equal to the adjusted best extent logical end.
In addition, add a comment stating when adjusted best_ex will not cover the original request, and remove the duplicate assertion because adjusting lstart makes no change to b_ex.fe_len.
--- fs/ext4/mballoc.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
fs/ext4/mballoc.c +11 -6
@@ -4162,10 +4162,16 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac) .fe_len = ac->ac_g_ex.fe_len, };loff_t orig_goal_end =extent_logical_end (sbi, &ex); +loff_t o_ex_end =extent_logical_end (sbi, &ac->ac_o_ex); -/* we can't allocate as much as normalizer wants. -* so, found space must get proper lstart -* to cover original request */ +/* +* We can't allocate as much as normalizer wants, so we try +* to get proper lstart to cover the original request, except +* when the goal doesn't cover the original request as below: +* +* orig_ex:2045/2055(10), isize:8417280 -> normalized:0/2048 +* best_ex:0/200(200) -> adjusted: 1848/2048(200) +*/ BUG_ON (ac->ac_g_ex.fe_logical > ac->ac_o_ex.fe_logical);BUG_ON (ac->ac_g_ex.fe_len < ac->ac_o_ex.fe_len);
@@ -4177,7 +4183,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)* 1. Check if best ex can be kept at end of goal and still * cover original start * 2. Else, check if best ex can be kept at start of goal and -* still cover original start +* still cover original end * 3. Else, keep the best ex at start of original request. */ ex.fe_len = ac->ac_b_ex.fe_len;
@@ -4187,7 +4193,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac) goto adjust_bex; ex.fe_logical = ac->ac_g_ex.fe_logical; -if (ac->ac_o_ex.fe_logical <extent_logical_end (sbi, &ex)) +if (o_ex_end <=extent_logical_end (sbi, &ex)) goto adjust_bex; ex.fe_logical = ac->ac_o_ex.fe_logical;
@@ -4195,7 +4201,6 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac) ac->ac_b_ex.fe_logical = ex.fe_logical;BUG_ON (ac->ac_o_ex.fe_logical < ac->ac_b_ex.fe_logical); -BUG_ON (ac->ac_o_ex.fe_len > ac->ac_b_ex.fe_len);BUG_ON (extent_logical_end (sbi, &ex) > orig_goal_end); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/294 block: introduce zone_write_granularity limit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit a805a4fa4fa376bbc145762bb8b09caa2fa8af48 ]
Per ZBC and ZAC specifications, host-managed SMR hard-disks mandate that all writes into sequential write required zones be aligned to the device physical block size. However, NVMe ZNS does not have this constraint and allows write operations into sequential zones to be aligned to the device logical block size. This inconsistency does not help with software portability across device types.
To solve this, introduce the zone_write_granularity queue limit to indicate the alignment constraint, in bytes, of write operations into zones of a zoned block device. This new limit is exported as a read-only sysfs queue attribute and the helper blk_queue_zone_write_granularity() introduced for drivers to set this limit.
The function blk_queue_set_zoned() is modified to set this new limit to the device logical block size by default. NVMe ZNS devices as well as zoned nullb devices use this default value as is. The scsi disk driver is modified to execute the blk_queue_zone_write_granularity() helper to set the zone write granularity of host-managed SMR disks to the disk physical block size.
The accessor functions queue_zone_write_granularity() and bdev_zone_write_granularity() are also introduced.
Stable-dep-of: c8f6f88d2592 ("block: Clear zone limits for a non-zoned stacked queue")
--- Documentation/block/queue-sysfs.rst | 7 ++++++ block/blk-settings.c | 37 ++++++++++++++++++++++++++++- block/blk-sysfs.c | 8 +++++++ drivers/scsi/sd_zbc.c | 8 +++++++ include/linux/blkdev.h | 15 ++++++++++++ 5 files changed, 74 insertions(+), 1 deletion(-)
Documentation/block/queue-sysfs.rst +7 -0
@@ -273,4 +273,11 @@ devices are described in the ZBC (Zoned Block Commands) and ZAC do not support zone commands, they will be treated as regular block devices and zoned will report "none". +zone_write_granularity (RO) +--------------------------- +This indicates the alignment constraint, in bytes, for write operations in +sequential zones of zoned block devices (devices with a zoned attributed +that reports "host-managed" or "host-aware"). This value is always 0 for +regular block devices. + Jens Axboe <[email protected]>, February 2009
block/blk-settings.c +36 -1
@@ -60,6 +60,7 @@ void blk_set_default_limits(struct queue_limits *lim) lim->io_opt =0 ; lim->misaligned =0 ; lim->zoned =BLK_ZONED_NONE ; + lim->zone_write_granularity =0 ; }EXPORT_SYMBOL (blk_set_default_limits);
@@ -353,6 +354,28 @@ void blk_queue_physical_block_size(struct request_queue *q, unsigned int size) }EXPORT_SYMBOL (blk_queue_physical_block_size); +/** +* blk_queue_zone_write_granularity - set zone write granularity for the queue +* @q: the request queue for the zoned device +* @size: the zone write granularity size, in bytes +* +* Description: +* This should be set to the lowest possible size allowing to write in +* sequential zones of a zoned block device. +*/ +void blk_queue_zone_write_granularity (struct request_queue *q, +unsigned int size) +{ +if (WARN_ON_ONCE (!blk_queue_is_zoned (q))) +return ; + + q->limits.zone_write_granularity = size; + +if (q->limits.zone_write_granularity < q->limits.logical_block_size) + q->limits.zone_write_granularity = q->limits.logical_block_size; +} +EXPORT_SYMBOL_GPL (blk_queue_zone_write_granularity); +/** * blk_queue_alignment_offset - set physical block alignment offset * @q: the request queue for the device
@@ -630,6 +653,8 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, t->discard_granularity; } + t->zone_write_granularity =max (t->zone_write_granularity, + b->zone_write_granularity); t->zoned =max (t->zoned, b->zoned);return ret; }
@@ -846,6 +871,8 @@ EXPORT_SYMBOL_GPL(blk_queue_can_use_dma_map_merging);*/ void blk_queue_set_zoned (struct gendisk *disk,enum blk_zoned_model model) { +struct request_queue *q = disk->queue; +switch (model) {case BLK_ZONED_HM :/*
@@ -874,7 +901,15 @@ void blk_queue_set_zoned(struct gendisk *disk, enum blk_zoned_model model)break ; } - disk->queue->limits.zoned = model; + q->limits.zoned = model; +if (model !=BLK_ZONED_NONE ) { +/* +* Set the zone write granularity to the device logical block +* size by default. The driver can change this value if needed. +*/ +blk_queue_zone_write_granularity (q, +queue_logical_block_size (q)); + } }EXPORT_SYMBOL_GPL (blk_queue_set_zoned);
block/blk-sysfs.c +8 -0
@@ -219,6 +219,12 @@ static ssize_t queue_write_zeroes_max_show(struct request_queue *q, char *page) (unsigned long long)q->limits.max_write_zeroes_sectors << 9); } +static ssize_t queue_zone_write_granularity_show (struct request_queue *q, +char *page) +{ +return queue_var_show (queue_zone_write_granularity (q), page); +} +static ssize_t queue_zone_append_max_show (struct request_queue *q,char *page) {unsigned long long max_sectors = q->limits.max_zone_append_sectors;
@@ -585,6 +591,7 @@ QUEUE_RO_ENTRY(queue_discard_zeroes_data, "discard_zeroes_data");QUEUE_RO_ENTRY (queue_write_same_max,"write_same_max_bytes" );QUEUE_RO_ENTRY (queue_write_zeroes_max,"write_zeroes_max_bytes" );QUEUE_RO_ENTRY (queue_zone_append_max,"zone_append_max_bytes" ); +QUEUE_RO_ENTRY (queue_zone_write_granularity,"zone_write_granularity" );QUEUE_RO_ENTRY (queue_zoned,"zoned" );QUEUE_RO_ENTRY (queue_nr_zones,"nr_zones" );
@@ -639,6 +646,7 @@ static struct attribute *queue_attrs[] = { &queue_write_same_max_entry.attr, &queue_write_zeroes_max_entry.attr, &queue_zone_append_max_entry.attr, + &queue_zone_write_granularity_entry.attr, &queue_nonrot_entry.attr, &queue_zoned_entry.attr, &queue_nr_zones_entry.attr,
drivers/scsi/sd_zbc.c +8 -0
@@ -793,6 +793,14 @@ int sd_zbc_read_zones(struct scsi_disk *sdkp, unsigned char *buf)blk_queue_max_active_zones (q,0 ); nr_zones =round_up (sdkp->capacity, zone_blocks) >>ilog2 (zone_blocks); +/* +* Per ZBC and ZAC specifications, writes in sequential write required +* zones of host-managed devices must be aligned to the device physical +* block size. +*/ +if (blk_queue_zoned_model (q) ==BLK_ZONED_HM ) +blk_queue_zone_write_granularity (q, sdkp->physical_block_size); +/* READ16/WRITE16 is mandatory for ZBC disks */ sdkp->device->use_16_for_rw =1 ; sdkp->device->use_10_for_rw =0 ;
include/linux/blkdev.h +15 -0
@@ -345,6 +345,7 @@ struct queue_limits {unsigned int max_zone_append_sectors;unsigned int discard_granularity;unsigned int discard_alignment; +unsigned int zone_write_granularity;unsigned short max_segments;unsigned short max_integrity_segments;
@@ -1169,6 +1170,8 @@ extern void blk_queue_logical_block_size(struct request_queue *, unsigned int);extern void blk_queue_max_zone_append_sectors (struct request_queue *q,unsigned int max_zone_append_sectors);extern void blk_queue_physical_block_size (struct request_queue *,unsigned int ); +void blk_queue_zone_write_granularity (struct request_queue *q, +unsigned int size);extern void blk_queue_alignment_offset (struct request_queue *q,unsigned int alignment);void blk_queue_update_readahead (struct request_queue *q);
@@ -1480,6 +1483,18 @@ static inline int bdev_io_opt(struct block_device *bdev)return queue_io_opt (bdev_get_queue (bdev)); } +static inline unsigned int +queue_zone_write_granularity (const struct request_queue *q) +{ +return q->limits.zone_write_granularity; +} + +static inline unsigned int +bdev_zone_write_granularity (struct block_device *bdev) +{ +return queue_zone_write_granularity (bdev_get_queue (bdev)); +} +static inline int queue_alignment_offset (const struct request_queue *q) {if (q->limits.misaligned)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/294 block: Clear zone limits for a non-zoned stacked queue
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit c8f6f88d25929ad2f290b428efcae3b526f3eab0 ]
Device mapper may create a non-zoned mapped device out of a zoned device (e.g., the dm-zoned target). In such case, some queue limit such as the max_zone_append_sectors and zone_write_granularity endup being non zero values for a block device that is not zoned. Avoid this by clearing these limits in blk_stack_limits() when the stacked zoned limit is false.
--- block/blk-settings.c | 4 ++++ 1 file changed, 4 insertions(+)
block/blk-settings.c +4 -0
@@ -656,6 +656,10 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, t->zone_write_granularity =max (t->zone_write_granularity, b->zone_write_granularity); t->zoned =max (t->zoned, b->zoned); +if (!t->zoned) { + t->zone_write_granularity =0 ; + t->max_zone_append_sectors =0 ; + }return ret; }EXPORT_SYMBOL (blk_stack_limits);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/294 bounds: support non-power-of-two CONFIG_NR_CPUS
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit f2d5dcb48f7ba9e3ff249d58fc1fa963d374e66a ]
ilog2() rounds down, so for example when PowerPC 85xx sets CONFIG_NR_CPUS to 24, we will only allocate 4 bits to store the number of CPUs instead of
5. Use bits_per() instead, which rounds up. Found by code inspection. The effect of this would probably be a misaccounting when doing NUMA balancing, so to a user, it would only be a performance penalty. The effects may be more wide-spread; it's hard to tell.
--- kernel/bounds.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/bounds.c +1 -1
@@ -19,7 +19,7 @@ int main(void)DEFINE (NR_PAGEFLAGS , __NR_PAGEFLAGS);DEFINE (MAX_NR_ZONES , __MAX_NR_ZONES);#ifdef CONFIG_SMP -DEFINE (NR_CPUS_BITS ,ilog2 (CONFIG_NR_CPUS )); +DEFINE (NR_CPUS_BITS ,bits_per (CONFIG_NR_CPUS ));#endif DEFINE (SPINLOCK_SIZE ,sizeof (spinlock_t));/* End of constants */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/294 fat: fix uninitialized field in nostale filehandles
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit fde2497d2bc3a063d8af88b258dbadc86bd7b57c ]
When fat_encode_fh_nostale() encodes file handle without a parent it stores only first 10 bytes of the file handle. However the length of the file handle must be a multiple of 4 so the file handle is actually 12 bytes long and the last two bytes remain uninitialized. This is not great at we potentially leak uninitialized information with the handle to userspace. Properly initialize the full handle length.
--- fs/fat/nfs.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/fat/nfs.c +6 -0
@@ -130,6 +130,12 @@ fat_encode_fh_nostale(struct inode *inode, __u32 *fh, int *lenp, fid->parent_i_gen = parent->i_generation; type =FILEID_FAT_WITH_PARENT ; *lenp =FAT_FID_SIZE_WITH_PARENT ; + }else { +/* +* We need to initialize this field because the fh is actually +* 12 bytes long +*/ + fid->parent_i_pos_hi =0 ; }return type;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/294 ubifs: Set page uptodate in the correct place
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit 723012cab779eee8228376754e22c6594229bf8f ]
Page cache reads are lockless, so setting the freshly allocated page uptodate before we've overwritten it with the data it's supposed to have in it will allow a simultaneous reader to see old data. Move the call to SetPageUptodate into ubifs_write_end(), which is after we copied the new data into the page.
--- fs/ubifs/file.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-)
fs/ubifs/file.c +4 -9
@@ -262,9 +262,6 @@ static int write_begin_slow(struct address_space *mapping,return err; } } - -SetPageUptodate (page); -ClearPageError (page); }if (PagePrivate (page))
@@ -463,9 +460,6 @@ static int ubifs_write_begin(struct file *file, struct address_space *mapping,return err; } } - -SetPageUptodate (page); -ClearPageError (page); } err =allocate_budget (c, page, ui, appending);
@@ -475,10 +469,8 @@ static int ubifs_write_begin(struct file *file, struct address_space *mapping,* If we skipped reading the page because we were going to * write all of it, then it is not up to date. */ -if (skipped_read) { +if (skipped_read)ClearPageChecked (page); -ClearPageUptodate (page); - }/* * Budgeting failed which means it would have to force * write-back but didn't, because we set the @fast flag in the
@@ -569,6 +561,9 @@ static int ubifs_write_end(struct file *file, struct address_space *mapping, goto out; } +if (len ==PAGE_SIZE ) +SetPageUptodate (page); +if (!PagePrivate (page)) {attach_page_private (page, (void *)1 );atomic_long_inc (&c->dirty_pg_cnt);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/294 ubi: Check for too small LEB size in VTBL code
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Weinberger <[email protected]>
[ Upstream commit 68a24aba7c593eafa8fd00f2f76407b9b32b47a9 ]
If the LEB size is smaller than a volume table record we cannot have volumes.
In this case abort attaching.
--- drivers/mtd/ubi/vtbl.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/mtd/ubi/vtbl.c +6 -0
@@ -791,6 +791,12 @@ int ubi_read_volume_table(struct ubi_device *ubi, struct ubi_attach_info *ai)* The number of supported volumes is limited by the eraseblock size * and by the UBI_MAX_VOLUMES constant. */ + +if (ubi->leb_size <UBI_VTBL_RECORD_SIZE ) { +ubi_err (ubi,"LEB size too small for a volume record" ); +return -EINVAL ; + } + ubi->vtbl_slots = ubi->leb_size /UBI_VTBL_RECORD_SIZE ;if (ubi->vtbl_slots >UBI_MAX_VOLUMES ) ubi->vtbl_slots =UBI_MAX_VOLUMES ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/294 ubi: correct the calculation of fastmap size
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
[ Upstream commit 7f174ae4f39e8475adcc09d26c5a43394689ad6c ]
Now that the calculation of fastmap size in ubi_calc_fm_size() is incorrect since it miss each user volume's ubi_fm_eba structure and the Internal UBI volume info. Let's correct the calculation.
--- drivers/mtd/ubi/fastmap.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/mtd/ubi/fastmap.c +4 -3
@@ -86,9 +86,10 @@ size_t ubi_calc_fm_size(struct ubi_device *ubi)sizeof (struct ubi_fm_scan_pool ) +sizeof (struct ubi_fm_scan_pool ) + (ubi->peb_count *sizeof (struct ubi_fm_ec )) + - (sizeof (struct ubi_fm_eba ) + - (ubi->peb_count *sizeof (__be32))) + -sizeof (struct ubi_fm_volhdr ) *UBI_MAX_VOLUMES ; + ((sizeof (struct ubi_fm_eba ) + +sizeof (struct ubi_fm_volhdr )) * + (UBI_MAX_VOLUMES +UBI_INT_VOL_COUNT )) + + (ubi->peb_count *sizeof (__be32));return roundup (size, ubi->leb_size); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/294 mtd: rawnand: meson: fix scrambling mode value in command macro
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arseniy Krasnov <[email protected]>
[ Upstream commit ef6f463599e16924cdd02ce5056ab52879dc008c ]
Scrambling mode is enabled by value (1 << 19). NFC_CMD_SCRAMBLER_ENABLE is already (1 << 19), so there is no need to shift it again in CMDRWGEN macro.
--- drivers/mtd/nand/raw/meson_nand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/nand/raw/meson_nand.c +1 -1
@@ -59,7 +59,7 @@#define CMDRWGEN (cmd_dir, ran, bch, short_mode, page_size, pages) \ ( \ (cmd_dir) | \ - ((ran) << 19) | \ + (ran) | \ ((bch) << 14) | \ ((short_mode) << 13) | \ (((page_size) & 0x7f) << 6) | \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/294 parisc: Avoid clobbering the C/B bits in the PSW with tophys and tovirt macros
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John David Anglin <[email protected]>
[ Upstream commit 4603fbaa76b5e703b38ac8cc718102834eb6e330 ]
Use add,l to avoid clobbering the C/B bits in the PSW.
--- arch/parisc/include/asm/assembly.h | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
arch/parisc/include/asm/assembly.h +10 -8
@@ -83,26 +83,28 @@* version takes two arguments: a src and destination register. * However, the source and destination registers can not be * the same register. +* +* We use add,l to avoid clobbering the C/B bits in the PSW. */ .macro tophys grvirt, grphys - ldil L%(__PAGE_OFFSET), \grphys - sub \grvirt, \grphys, \grphys + ldil L%(-__PAGE_OFFSET), \grphys + addl \grvirt, \grphys, \grphys .endm - + .macro tovirt grphys, grvirt ldil L%(__PAGE_OFFSET), \grvirt - add \grphys, \grvirt, \grvirt + addl \grphys, \grvirt, \grvirt .endm .macro tophys_r1 gr - ldil L%(__PAGE_OFFSET), %r1 - sub \gr, %r1, \gr + ldil L%(-__PAGE_OFFSET), %r1 + addl \gr, %r1, \gr .endm - + .macro tovirt_r1 gr ldil L%(__PAGE_OFFSET), %r1 - add \gr, %r1, \gr + addl \gr, %r1, \gr .endm .macro delay value
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/294 parisc: Fix ip_fast_csum
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit a2abae8f0b638c31bb9799d9dd847306e0d005bd ]
IP checksum unit tests report the following error when run on hppa/hppa64.
# test_ip_fast_csum: ASSERTION FAILED at lib/checksum_kunit.c:463
Expected ( u64)csum_result == ( u64)expected, but
( u64)csum_result == 33754 (0x83da)
( u64)expected == 10946 (0x2ac2)
not ok 4 test_ip_fast_csum0x83da is the expected result if the IP header length is 20 bytes. 0x2ac2 is the expected result if the IP header length is 24 bytes. The test fails with an IP header length of 24 bytes. It appears that ip_fast_csum() always returns the checksum for a 20-byte header, no matter how long the header actually is.
Code analysis shows a suspicious assembler sequence in ip_fast_csum().
" addc %0, %3, %0\n" "1: ldws,ma 4(%1), %3\n" " addib,< 0, %2, 1b\n" <---
While my understanding of HPPA assembler is limited, it does not seem to make much sense to subtract 0 from a register and to expect the result to ever be negative. Subtracting 1 from the length parameter makes more sense. On top of that, the operation should be repeated if and only if the result is still > 0, so change the suspicious instruction to
" addib,> -1, %2, 1b\n"
The IP checksum unit test passes after this change.
--- arch/parisc/include/asm/checksum.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/parisc/include/asm/checksum.h +1 -1
@@ -40,7 +40,7 @@ static inline __sum16 ip_fast_csum(const void *iph, unsigned int ihl)" addc %0, %5, %0\n" " addc %0, %3, %0\n" "1: ldws,ma 4(%1), %3\n" -" addib,< 0, %2, 1b\n" +" addib,> -1, %2, 1b\n" " addc %0, %3, %0\n" "\n" " extru %0, 31, 16, %4\n"
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/294 parisc: Fix csum_ipv6_magic on 32-bit systems
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 4408ba75e4ba80c91fde7e10bccccf388f5c09be ]
Calculating the IPv6 checksum on 32-bit systems missed overflows when adding the proto+len fields into the checksum. This results in the following unit test failure.
# test_csum_ipv6_magic: ASSERTION FAILED at lib/checksum_kunit.c:506
Expected ( u64)csum_result == ( u64)expected, but
( u64)csum_result == 46722 (0xb682)
( u64)expected == 46721 (0xb681)
not ok 5 test_csum_ipv6_magicThis is probably rarely seen in the real world because proto+len are usually small values which will rarely result in overflows when calculating the checksum. However, the unit test code uses large values for the length field, causing the test to fail.
Fix the problem by adding the missing carry into the final checksum.
--- arch/parisc/include/asm/checksum.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/parisc/include/asm/checksum.h +2 -1
@@ -163,7 +163,8 @@ static __inline__ __sum16 csum_ipv6_magic(const struct in6_addr *saddr," ldw,ma 4(%2), %7\n" /* 4th daddr */ " addc %6, %0, %0\n" " addc %7, %0, %0\n" -" addc %3, %0, %0\n" /* fold in proto+len, catch carry */ +" addc %3, %0, %0\n" /* fold in proto+len */ +" addc 0, %0, %0\n" /* add carry */ #endif : "=r" (sum), "=r" (saddr), "=r" (daddr), "=r" (len),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/294 parisc: Fix csum_ipv6_magic on 64-bit systems
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 4b75b12d70506e31fc02356bbca60f8d5ca012d0 ]
hppa 64-bit systems calculates the IPv6 checksum using 64-bit add operations. The last add folds protocol and length fields into the 64-bit result. While unlikely, this operation can overflow. The overflow can be triggered with a code sequence such as the following.
/* try to trigger massive overflows */ memset(tmp_buf, 0xff, sizeof(struct in6_addr)); csum_result = csum_ipv6_magic((struct in6_addr *)tmp_buf, (struct in6_addr *)tmp_buf, 0xffff, 0xff, 0xffffffff);
Fix the problem by adding any overflows from the final add operation into the calculated checksum. Fortunately, we can do this without additional cost by replacing the add operation used to fold the checksum into 32 bit with "add,dc" to add in the missing carry.
--- arch/parisc/include/asm/checksum.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/parisc/include/asm/checksum.h +2 -2
@@ -137,8 +137,8 @@ static __inline__ __sum16 csum_ipv6_magic(const struct in6_addr *saddr," add,dc %3, %0, %0\n" /* fold in proto+len | carry bit */ " extrd,u %0, 31, 32, %4\n" /* copy upper half down */ " depdi 0, 31, 32, %0\n" /* clear upper half */ -" add %4, %0, %0\n" /* fold into 32-bits */ -" addc 0, %0, %0\n" /* add carry */ +" add,dc %4, %0, %0\n" /* fold into 32-bits, plus carry */ +" addc 0, %0, %0\n" /* add final carry */ #else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/294 parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 0568b6f0d863643db2edcc7be31165740c89fa82 ]
IPv6 checksum tests with unaligned addresses on 64-bit builds result in unexpected failures.
Expected expected == csum_result, but
expected == 46591 (0xb5ff)
csum_result == 46381 (0xb52d)with alignment offset 1
Oddly enough, the problem disappeared after adding test code into the beginning of csum_ipv6_magic().
As it turns out, the 'sum' parameter of csum_ipv6_magic() is declared as __wsum, which is a 32-bit variable. However, it is treated as 64-bit variable in the 64-bit assembler code. Tests showed that the upper 32 bit of the register used to pass the variable are _not_ cleared when entering the function. This can result in checksum calculation errors.
Clearing the upper 32 bit of 'sum' as first operation in the assembler code fixes the problem.
--- arch/parisc/include/asm/checksum.h | 1 + 1 file changed, 1 insertion(+)
arch/parisc/include/asm/checksum.h +1 -0
@@ -126,6 +126,7 @@ static __inline__ __sum16 csum_ipv6_magic(const struct in6_addr *saddr,** Try to keep 4 registers with "live" values ahead of the ALU. */ +" depdi 0, 31, 32, %0\n" /* clear upper half of incoming checksum */ " ldd,ma 8(%1), %4\n" /* get 1st saddr word */ " ldd,ma 8(%2), %5\n" /* get 1st daddr word */ " add %4, %0, %0\n"
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/294 PM: suspend: Set mem_sleep_current during kernel command line setup
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maulik Shah <[email protected]>
[ Upstream commit 9bc4ffd32ef8943f5c5a42c9637cfd04771d021b ]
psci_init_system_suspend() invokes suspend_set_ops() very early during bootup even before kernel command line for mem_sleep_default is setup. This leads to kernel command line mem_sleep_default=s2idle not working as mem_sleep_current gets changed to deep via suspend_set_ops() and never changes back to s2idle.
Set mem_sleep_current along with mem_sleep_default during kernel command line setup as default suspend mode.
--- kernel/power/suspend.c | 1 + 1 file changed, 1 insertion(+)
kernel/power/suspend.c +1 -0
@@ -187,6 +187,7 @@ static int __init mem_sleep_default_setup(char *str)if (mem_sleep_labels[state] && !strcmp (str, mem_sleep_labels[state])) { mem_sleep_default = state; + mem_sleep_current = state;break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/294 clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
[ Upstream commit cdbc6e2d8108bc47895e5a901cfcaf799b00ca8d ]
The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where it is missing in order to avoid possible out-of-bound access when the table is traversed by functions like qcom_find_freq() or qcom_find_freq_floor().
Only compile tested.
--- drivers/clk/qcom/gcc-ipq6018.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/clk/qcom/gcc-ipq6018.c +2 -0
@@ -1557,6 +1557,7 @@ static struct clk_regmap_div nss_ubi0_div_clk_src = {static const struct freq_tbl ftbl_pcie_aux_clk_src[] = {F (24000000 ,P_XO ,1 ,0 ,0 ), + { } };static const struct clk_parent_data gcc_xo_gpll0_core_pi_sleep_clk[] = {
@@ -1737,6 +1738,7 @@ static const struct freq_tbl ftbl_sdcc_ice_core_clk_src[] = {F (160000000 ,P_GPLL0 ,5 ,0 ,0 ),F (216000000 ,P_GPLL6 ,5 ,0 ,0 ), F(308570000, P_GPLL6, 3.5, 0, 0), + { } }; static const struct clk_parent_data gcc_xo_gpll0_gpll6_gpll0_div2[] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/294 clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
[ Upstream commit 1040ef5ed95d6fd2628bad387d78a61633e09429 ]
The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where it is missing in order to avoid possible out-of-bound access when the table is traversed by functions like qcom_find_freq() or qcom_find_freq_floor().
Only compile tested.
--- drivers/clk/qcom/gcc-ipq8074.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/clk/qcom/gcc-ipq8074.c +2 -0
@@ -972,6 +972,7 @@ static struct clk_rcg2 pcie0_axi_clk_src = {static const struct freq_tbl ftbl_pcie_aux_clk_src[] = {F (19200000 ,P_XO ,1 ,0 ,0 ), + { } };static struct clk_rcg2 pcie0_aux_clk_src = {
@@ -1077,6 +1078,7 @@ static const struct freq_tbl ftbl_sdcc_ice_core_clk_src[] = {F (19200000 ,P_XO ,1 ,0 ,0 ),F (160000000 ,P_GPLL0 ,5 ,0 ,0 ), F(308570000, P_GPLL6, 3.5, 0, 0), + { } }; static struct clk_rcg2 sdcc1_ice_core_clk_src = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/294 clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
[ Upstream commit a903cfd38d8dee7e754fb89fd1bebed99e28003d ]
The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where it is missing in order to avoid possible out-of-bound access when the table is traversed by functions like qcom_find_freq() or qcom_find_freq_floor().
Only compile tested.
--- drivers/clk/qcom/mmcc-apq8084.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/clk/qcom/mmcc-apq8084.c +2 -0
@@ -333,6 +333,7 @@ static struct freq_tbl ftbl_mmss_axi_clk[] = {F (333430000 ,P_MMPLL1 ,3.5 ,0 ,0 ),F (400000000 ,P_MMPLL0 ,2 ,0 ,0 ), F(466800000, P_MMPLL1, 2.5, 0, 0), + { } }; static struct clk_rcg2 mmss_axi_clk_src = {
@@ -357,6 +358,7 @@ static struct freq_tbl ftbl_ocmemnoc_clk[] = {F (150000000 ,P_GPLL0 ,4 ,0 ,0 ),F (228570000 ,P_MMPLL0 ,3.5 ,0 ,0 ), F(320000000, P_MMPLL0, 2.5, 0, 0), + { } }; static struct clk_rcg2 ocmemnoc_clk_src = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/294 clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
[ Upstream commit e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96 ]
The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where it is missing in order to avoid possible out-of-bound access when the table is traversed by functions like qcom_find_freq() or qcom_find_freq_floor().
Only compile tested.
--- drivers/clk/qcom/mmcc-msm8974.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/clk/qcom/mmcc-msm8974.c +2 -0
@@ -283,6 +283,7 @@ static struct freq_tbl ftbl_mmss_axi_clk[] = {F (291750000 ,P_MMPLL1 ,4 ,0 ,0 ),F (400000000 ,P_MMPLL0 ,2 ,0 ,0 ), F(466800000, P_MMPLL1, 2.5, 0, 0), + { } }; static struct clk_rcg2 mmss_axi_clk_src = {
@@ -307,6 +308,7 @@ static struct freq_tbl ftbl_ocmemnoc_clk[] = {F (150000000 ,P_GPLL0 ,4 ,0 ,0 ),F (291750000 ,P_MMPLL1 ,4 ,0 ,0 ), F(400000000, P_MMPLL0, 2, 0, 0), + { } }; static struct clk_rcg2 ocmemnoc_clk_src = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/294 powerpc/fsl: Fix mfpmr build errors with newer binutils
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit 5f491356b7149564ab22323ccce79c8d595bfd0c ]
Binutils 2.38 complains about the use of mfpmr when building ppc6xx_defconfig:
CC arch/powerpc/kernel/pmc.o
{standard input}: Assembler messages:
{standard input}:45: Error: unrecognized opcode: mfpmr' {standard input}:56: Error: unrecognized opcode: mtpmr'
This is because by default the kernel is built with -mcpu=powerpc, and the mt/mfpmr instructions are not defined.
It can be avoided by enabling CONFIG_E300C3_CPU, but just adding that to the defconfig will leave open the possibility of randconfig failures.
So add machine directives around the mt/mfpmr instructions to tell binutils how to assemble them.
--- arch/powerpc/include/asm/reg_fsl_emb.h | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
arch/powerpc/include/asm/reg_fsl_emb.h +9 -2
@@ -12,9 +12,16 @@#ifndef __ASSEMBLY__/* Performance Monitor Registers */ #define mfpmr (rn) ({unsigned int rval; \ - asm volatile("mfpmr %0," __stringify(rn) \ + asm volatile(".machine push; " \ + ".machine e300; " \ + "mfpmr %0," __stringify(rn) ";" \ + ".machine pop; " \ : "=r" (rval)); rval;}) -#define mtpmr (rn, v) asm volatile("mtpmr " __stringify(rn) ",%0" : : "r" (v)) +#define mtpmr (rn, v) asm volatile(".machine push; " \ + ".machine e300; " \ + "mtpmr " __stringify(rn) ",%0; " \ + ".machine pop; " \ + : : "r" (v))#endif /* __ASSEMBLY__ */ /* Freescale Book E Performance Monitor APU Registers */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/294 USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vogelbacher <[email protected]>
[ Upstream commit 3fb7bc4f3a98c48981318b87cf553c5f115fd5ca ]
The GMC IR-USB adapter cable utilizes a FTDI FT232R chip.
Add VID/PID for this adapter so it can be used as serial device via ftdi_sio.
--- drivers/usb/serial/ftdi_sio.c | 2 ++ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ 2 files changed, 8 insertions(+)
drivers/usb/serial/ftdi_sio.c +2 -0
@@ -1055,6 +1055,8 @@ static const struct usb_device_id id_table_combined[] = { .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID), .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, +/* GMC devices */ + { USB_DEVICE(GMC_VID, GMC_Z216C_PID) }, { }/* Terminating entry */ };
drivers/usb/serial/ftdi_sio_ids.h +6 -0
@@ -1599,3 +1599,9 @@#define UBLOX_VID 0x1546#define UBLOX_C099F9P_ZED_PID 0x0502#define UBLOX_C099F9P_ODIN_PID 0x0503 + +/* +* GMC devices +*/ +#define GMC_VID 0x1cd7 +#define GMC_Z216C_PID 0x0217/* GMC Z216C Adapter IR-USB */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/294 USB: serial: add device ID for VeriFone adapter
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cameron Williams <[email protected]>
[ Upstream commit cda704809797a8a86284f9df3eef5e62ec8a3175 ]
Add device ID for a (probably fake) CP2102 UART device.
lsusb -v output:
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0 [unknown] bDeviceSubClass 0 [unknown] bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x11ca VeriFone Inc idProduct 0x0212 Verifone USB to Printer bcdDevice 1.00 iManufacturer 1 Silicon Labs iProduct 2 Verifone USB to Printer iSerial 3 0001 bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x0020
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 0 [unknown]
bInterfaceProtocol 0
iInterface 2 Verifone USB to Printer
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 0
Device Status: 0x0000
(Bus Powered)
--- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/cp210x.c +1 -0
@@ -181,6 +181,7 @@ static const struct usb_device_id id_table[] = { { USB_DEVICE(0x10C4, 0xF004) }, /* Elan Digital Systems USBcount50 */ { USB_DEVICE(0x10C5, 0xEA61) }, /* Silicon Labs MobiData GPRS USB Modem */ { USB_DEVICE(0x10CE, 0xEA6A) }, /* Silicon Labs MobiData GPRS USB Modem 100EU */ + { USB_DEVICE(0x11CA, 0x0212) }, /* Verifone USB to Printer (UART, CP2102) */ { USB_DEVICE(0x12B8, 0xEC60) }, /* Link G4 ECU */ { USB_DEVICE(0x12B8, 0xEC62) }, /* Link G4+ ECU */ { USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/294 USB: serial: cp210x: add ID for MGP Instruments PDS100
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Häggström <[email protected]>
[ Upstream commit a0d9d868491a362d421521499d98308c8e3a0398 ]
The radiation meter has the text MGP Instruments PDS-100G or PDS-100GN produced by Mirion Technologies. Tested by forcing the driver association with
echo 10c4 863c > /sys/bus/usb-serial/drivers/cp210x/new_id
and then setting the serial port in 115200 8N1 mode. The device announces ID_USB_VENDOR_ENC=Silicon\x20Labs and ID_USB_MODEL_ENC=PDS100
--- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/cp210x.c +1 -0
@@ -148,6 +148,7 @@ static const struct usb_device_id id_table[] = { { USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */ { USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */ { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */ + { USB_DEVICE(0x10C4, 0x863C) }, /* MGP Instruments PDS100 */ { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */ { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */ { USB_DEVICE(0x10C4, 0x87ED) }, /* IMST USB-Stick for Smart Meter */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/294 USB: serial: option: add MeiG Smart SLM320 product
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aurélien Jacobs <[email protected]>
[ Upstream commit 46809c51565b83881aede6cdf3b0d25254966a41 ]
Update the USB serial option driver to support MeiG Smart SLM320.
ID 2dee:4d41 UNISOC UNISOC-8910
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=2dee ProdID=4d41 Rev=00.00
S: Manufacturer=UNISOC
S: Product=UNISOC-8910
C: #Ifs= 8 Cfg#= 1 Atr=e0 MxPwr=400mA
I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Tested successfully a PPP LTE connection using If#= 0. Not sure of the purpose of every other serial interfaces.
--- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/serial/option.c +6 -0
@@ -613,6 +613,11 @@ static void option_instat_callback(struct urb *urb);/* Luat Air72*U series based on UNISOC UIS8910 uses UNISOC's vendor ID */ #define LUAT_PRODUCT_AIR720U 0x4e00 +/* MeiG Smart Technology products */ +#define MEIGSMART_VENDOR_ID 0x2dee +/* MeiG Smart SLM320 based on UNISOC UIS8910 */ +#define MEIGSMART_PRODUCT_SLM320 0x4d41 +/* Device flags */ /* Highest interface number which can be used with NCTRL() and RSVD() */
@@ -2282,6 +2287,7 @@ static const struct usb_device_id option_ids[] = { { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) }, { } /* Terminating entry */ };MODULE_DEVICE_TABLE (usb, option_ids);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/294 USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toru Katagiri <[email protected]>
[ Upstream commit b1a8da9ff1395c4879b4bd41e55733d944f3d613 ]
TDK NC0110013M and MM0110113M have custom USB IDs for CP210x, so we need to add them to the driver.
--- drivers/usb/serial/cp210x.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/cp210x.c +2 -0
@@ -60,6 +60,8 @@ static const struct usb_device_id id_table[] = { { USB_DEVICE(0x0471, 0x066A) }, /* AKTAKOM ACE-1001 cable */ { USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */ { USB_DEVICE(0x0489, 0xE003) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */ + { USB_DEVICE(0x04BF, 0x1301) }, /* TDK Corporation NC0110013M - Network Controller */ + { USB_DEVICE(0x04BF, 0x1303) }, /* TDK Corporation MM0110113M - i3 Micro Module */ { USB_DEVICE(0x0745, 0x1000) }, /* CipherLab USB CCD Barcode Scanner 1000 */ { USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */ { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/294 PM: sleep: wakeirq: fix wake irq warning in system suspend
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qingliang Li <[email protected]>
[ Upstream commit e7a7681c859643f3f2476b2a28a494877fd89442 ]
When driver uses pm_runtime_force_suspend() as the system suspend callback function and registers the wake irq with reverse enable ordering, the wake irq will be re-enabled when entering system suspend, triggering an 'Unbalanced enable for IRQ xxx' warning. In this scenario, the call sequence during system suspend is as follows:
suspend_devices_and_enter()
-> dpm_suspend_start()
-> dpm_run_callback()
-> pm_runtime_force_suspend()
-> dev_pm_enable_wake_irq_check()
-> dev_pm_enable_wake_irq_complete()
-> suspend_enter()
-> dpm_suspend_noirq()
-> device_wakeup_arm_wake_irqs()
-> dev_pm_arm_wake_irq()To fix this issue, complete the setting of WAKE_IRQ_DEDICATED_ENABLED flag in dev_pm_enable_wake_irq_complete() to avoid redundant irq enablement.
--- drivers/base/power/wakeirq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/base/power/wakeirq.c +3 -1
@@ -365,8 +365,10 @@ void dev_pm_enable_wake_irq_complete(struct device *dev)return ;if (wirq->status &WAKE_IRQ_DEDICATED_MANAGED && - wirq->status &WAKE_IRQ_DEDICATED_REVERSE ) + wirq->status &WAKE_IRQ_DEDICATED_REVERSE ) {enable_irq (wirq->irq); + wirq->status |=WAKE_IRQ_DEDICATED_ENABLED ; + } }/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/294 mmc: tmio: avoid concurrent runs of mmc_request_done()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit e8d1b41e69d72c62865bebe8f441163ec00b3d44 ]
With the to-be-fixed commit, the reset_work handler cleared 'host->mrq' outside of the spinlock protected critical section. That leaves a small race window during execution of 'tmio_mmc_reset()' where the done_work handler could grab a pointer to the now invalid 'host->mrq'. Both would use it to call mmc_request_done() causing problems (see link below).
However, 'host->mrq' cannot simply be cleared earlier inside the critical section. That would allow new mrqs to come in asynchronously while the actual reset of the controller still needs to be done. So, like 'tmio_mmc_set_ios()', an ERR_PTR is used to prevent new mrqs from coming in but still avoiding concurrency between work handlers.
--- drivers/mmc/host/tmio_mmc_core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mmc/host/tmio_mmc_core.c +2 -0
@@ -216,6 +216,8 @@ static void tmio_mmc_reset_work(struct work_struct *work)else mrq->cmd->error = -ETIMEDOUT ; +/* No new calls yet, but disallow concurrent tmio_mmc_done_work() */ + host->mrq =ERR_PTR (-EBUSY ); host->cmd =NULL ; host->data =NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/294 fuse: fix root lookup with nonzero generation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
[ Upstream commit 68ca1b49e430f6534d0774a94147a823e3b8b26e ]
The root inode has a fixed nodeid and generation (1, 0).
Prior to the commit 15db16837a35 ("fuse: fix illegal access to inode with reused nodeid") generation number on lookup was ignored. After this commit lookup with the wrong generation number resulted in the inode being unhashed. This is correct for non-root inodes, but replacing the root inode is wrong and results in weird behavior.
Fix by reverting to the old behavior if ignoring the generation for the root inode, but issuing a warning in dmesg.
--- fs/fuse/dir.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/fuse/dir.c +4 -0
@@ -451,6 +451,10 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name goto out_put_forget;if (fuse_invalid_attr (&outarg->attr)) goto out_put_forget; +if (outarg->nodeid ==FUSE_ROOT_ID && outarg->generation !=0 ) { +pr_warn_once ("root generation should be zero\n" ); + outarg->generation =0 ; + } *inode = fuse_iget(sb, outarg->nodeid, outarg->generation, &outarg->attr, entry_attr_timeout(outarg),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/294 fuse: dont unhash root
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
[ Upstream commit b1fe686a765e6c0d71811d825b5a1585a202b777 ]
The root inode is assumed to be always hashed. Do not unhash the root inode even if it is marked BAD.
--- fs/fuse/fuse_i.h | 1 - fs/fuse/inode.c | 7 +++++-- 2 files changed, 5 insertions(+), 3 deletions(-)
fs/fuse/fuse_i.h +0 -1
@@ -873,7 +873,6 @@ static inline bool fuse_stale_inode(const struct inode *inode, int generation,static inline void fuse_make_bad (struct inode *inode) { -remove_inode_hash (inode);set_bit (FUSE_I_BAD , &get_fuse_inode (inode)->state); }
fs/fuse/inode.c +5 -2
@@ -352,8 +352,11 @@ struct inode *fuse_iget(struct super_block *sb, u64 nodeid, }else if (fuse_stale_inode (inode, generation, attr)) {/* nodeid was reused, any I/O on the old inode should fail */ fuse_make_bad (inode); -iput (inode); - goto retry; +if (inode !=d_inode (sb->s_root)) { +remove_inode_hash (inode); +iput (inode); + goto retry; + } } done: fi =get_fuse_inode (inode);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/294 usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jameson Thies <[email protected]>
[ Upstream commit 4d0a5a9915793377c0fe1a8d78de6bcd92cea963 ]
Clean up UCSI_CABLE_PROP macros by fixing a bitmask shifting error for plug type and updating the modal support macro for consistent naming.
--- drivers/usb/typec/ucsi/ucsi.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/typec/ucsi/ucsi.h +2 -2
@@ -219,12 +219,12 @@ struct ucsi_cable_property {#define UCSI_CABLE_PROP_FLAG_VBUS_IN_CABLE BIT(0)#define UCSI_CABLE_PROP_FLAG_ACTIVE_CABLE BIT(1)#define UCSI_CABLE_PROP_FLAG_DIRECTIONALITY BIT(2) -#define UCSI_CABLE_PROP_FLAG_PLUG_TYPE (_f_) ((_f_) & GENMASK(3, 0)) +#define UCSI_CABLE_PROP_FLAG_PLUG_TYPE (_f_) (((_f_) & GENMASK(4, 3)) >> 3)#define UCSI_CABLE_PROPERTY_PLUG_TYPE_A 0#define UCSI_CABLE_PROPERTY_PLUG_TYPE_B 1#define UCSI_CABLE_PROPERTY_PLUG_TYPE_C 2#define UCSI_CABLE_PROPERTY_PLUG_OTHER 3 -#define UCSI_CABLE_PROP_MODE_SUPPORT BIT(5) +#define UCSI_CABLE_PROP_FLAG_MODE_SUPPORT BIT(5)u8 latency; } __packed;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/294 printk/console: Split out code that enables default console
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Mladek <[email protected]>
[ Upstream commit ed758b30d541e9bf713cd58612a4414e57dc6d73 ]
Put the code enabling a console by default into a separate function called try_enable_default_console().
Rename try_enable_new_console() to try_enable_preferred_console() to make the purpose of the different variants more clear.
It is a code refactoring without any functional change.
Stable-dep-of: 801410b26a0e ("serial: Lock console when calling into driver before registration")
--- kernel/printk/printk.c | 38 +++++++++++++++++++++++--------------- 1 file changed, 23 insertions(+), 15 deletions(-)
kernel/printk/printk.c +23 -15
@@ -2693,7 +2693,8 @@ early_param("keep_bootcon", keep_bootcon_setup);* Care need to be taken with consoles that are statically * enabled such as netconsole */ -static int try_enable_new_console (struct console *newcon,bool user_specified) +static int try_enable_preferred_console (struct console *newcon, +bool user_specified) {struct console_cmdline *c;int i, err;
@@ -2741,6 +2742,23 @@ static int try_enable_new_console(struct console *newcon, bool user_specified)return -ENOENT ; } +/* Try to enable the console unconditionally */ +static void try_enable_default_console (struct console *newcon) +{ +if (newcon->index <0 ) + newcon->index =0 ; + +if (newcon->setup && newcon->setup (newcon,NULL ) !=0 ) +return ; + + newcon->flags |=CON_ENABLED ; + +if (newcon->device) { + newcon->flags |=CON_CONSDEV ; + has_preferred_console = true; + } +} +/* * The console driver calls this routine during kernel initialization * to register the console printing procedure with printk() and to
@@ -2797,25 +2815,15 @@ void register_console(struct console *newcon)* didn't select a console we take the first one * that registers here. */ -if (!has_preferred_console) { -if (newcon->index <0 ) - newcon->index =0 ; -if (newcon->setup ==NULL || - newcon->setup (newcon,NULL ) ==0 ) { - newcon->flags |=CON_ENABLED ; -if (newcon->device) { - newcon->flags |=CON_CONSDEV ; - has_preferred_console = true; - } - } - } +if (!has_preferred_console) +try_enable_default_console (newcon);/* See if this console matches one we selected on the command line */ - err =try_enable_new_console (newcon, true); + err =try_enable_preferred_console (newcon, true);/* If not, try to match against the platform default(s) */ if (err == -ENOENT ) - err =try_enable_new_console (newcon, false); + err =try_enable_preferred_console (newcon, false);/* printk() messages are not printed to the Braille console. */ if (err || newcon->flags &CON_BRL )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/294 serial: Lock console when calling into driver before registration
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Collingbourne <[email protected]>
[ Upstream commit 801410b26a0e8b8a16f7915b2b55c9528b69ca87 ]
During the handoff from earlycon to the real console driver, we have two separate drivers operating on the same device concurrently. In the case of the 8250 driver these concurrent accesses cause problems due to the driver's use of banked registers, controlled by LCR.DLAB. It is possible for the setup(), config_port(), pm() and set_mctrl() callbacks to set DLAB, which can cause the earlycon code that intends to access TX to instead access DLL, leading to missed output and corruption on the serial line due to unintended modifications to the baud rate.
In particular, for setup() we have:
univ8250_console_setup()
-> serial8250_console_setup()
-> uart_set_options()
-> serial8250_set_termios()
-> serial8250_do_set_termios()
-> serial8250_do_set_divisor()
For config_port() we have:
serial8250_config_port()
-> autoconfig()
For pm() we have:
serial8250_pm()
-> serial8250_do_pm()
-> serial8250_set_sleep()
For set_mctrl() we have (for some devices):
serial8250_set_mctrl()
-> omap8250_set_mctrl()
-> __omap8250_set_mctrl()
To avoid such problems, let's make it so that the console is locked during pre-registration calls to these callbacks, which will prevent the earlycon driver from running concurrently.
Remove the partial solution to this problem in the 8250 driver that locked the console only during autoconfig_irq(), as this would result in a deadlock with the new approach. The console continues to be locked during autoconfig_irq() because it can only be called through uart_configure_port().
Although this patch introduces more locking than strictly necessary (and in particular it also locks during the call to rs485_config() which is not affected by this issue as far as I can tell), it follows the principle that it is the responsibility of the generic console code to manage the earlycon handoff by ensuring that earlycon and real console driver code cannot run concurrently, and not the individual drivers.
--- drivers/tty/serial/8250/8250_port.c | 6 ------ drivers/tty/serial/serial_core.c | 12 ++++++++++++ kernel/printk/printk.c | 21 ++++++++++++++++++--- 3 files changed, 30 insertions(+), 9 deletions(-)
drivers/tty/serial/8250/8250_port.c +0 -6
@@ -1358,9 +1358,6 @@ static void autoconfig_irq(struct uart_8250_port *up)inb_p (ICP ); } -if (uart_console (port)) -console_lock (); -/* forget possible initially masked and pending IRQ */ probe_irq_off (probe_irq_on ()); save_mcr =serial8250_in_MCR (up);
@@ -1391,9 +1388,6 @@ static void autoconfig_irq(struct uart_8250_port *up)if (port->flags &UPF_FOURPORT )outb_p (save_ICP,ICP ); -if (uart_console (port)) -console_unlock (); - port->irq = (irq >0 ) ? irq :0 ; }
drivers/tty/serial/serial_core.c +12 -0
@@ -2431,7 +2431,12 @@ uart_configure_port(struct uart_driver *drv, struct uart_state *state, port->type =PORT_UNKNOWN ; flags |=UART_CONFIG_TYPE ; } +/* Synchronize with possible boot console. */ +if (uart_console (port)) +console_lock (); port->ops->config_port (port, flags); +if (uart_console (port)) +console_unlock (); }if (port->type !=PORT_UNKNOWN ) {
@@ -2439,6 +2444,10 @@ uart_configure_port(struct uart_driver *drv, struct uart_state *state,uart_report_port (drv, port); +/* Synchronize with possible boot console. */ +if (uart_console (port)) +console_lock (); +/* Power up port for set_mctrl() */ uart_change_pm (state,UART_PM_STATE_ON );
@@ -2455,6 +2464,9 @@ uart_configure_port(struct uart_driver *drv, struct uart_state *state, port->rs485_config (port, &port->rs485);spin_unlock_irqrestore (&port->lock, flags); +if (uart_console (port)) +console_unlock (); +/* * If this driver supports console, and it hasn't been * successfully registered yet, try to re-register it.
kernel/printk/printk.c +18 -3
@@ -2684,6 +2684,21 @@ static int __init keep_bootcon_setup(char *str)early_param ("keep_bootcon" , keep_bootcon_setup); +static int console_call_setup (struct console *newcon,char *options) +{ +int err; + +if (!newcon->setup) +return 0 ; + +/* Synchronize with possible boot console. */ +console_lock (); + err = newcon->setup (newcon, options); +console_unlock (); + +return err; +} +/* * This is called by register_console() to try to match * the newly registered console with any of the ones selected
@@ -2719,8 +2734,8 @@ static int try_enable_preferred_console(struct console *newcon,if (_braille_register_console (newcon, c))return 0 ; -if (newcon->setup && - (err = newcon->setup (newcon, c->options)) !=0 ) + err =console_call_setup (newcon, c->options); +if (err)return err; } newcon->flags |=CON_ENABLED ;
@@ -2748,7 +2763,7 @@ static void try_enable_default_console(struct console *newcon)if (newcon->index <0 ) newcon->index =0 ; -if (newcon->setup && newcon->setup (newcon,NULL ) !=0 ) +if (console_call_setup (newcon,NULL ) !=0 )return ; newcon->flags |=CON_ENABLED ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/294 btrfs: fix off-by-one chunk length calculation at contains_pending_extent()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit ae6bd7f9b46a29af52ebfac25d395757e2031d0d ]
At contains_pending_extent() the value of the end offset of a chunk we found in the device's allocation state io tree is inclusive, so when we calculate the length we pass to the in_range() macro, we must sum 1 to the expression "physical_end - physical_offset".
In practice the wrong calculation should be harmless as chunks sizes are never 1 byte and we should never have 1 byte ranges of unallocated space. Nevertheless fix the wrong calculation.
--- fs/btrfs/volumes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/volumes.c +1 -1
@@ -1471,7 +1471,7 @@ static bool contains_pending_extent(struct btrfs_device *device, u64 *start,if (in_range (physical_start, *start, len) ||in_range (*start, physical_start, - physical_end - physical_start)) { + physical_end +1 - physical_start)) { *start = physical_end +1 ;return true; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/294 PCI: Drop pci_device_remove() test of pci_dev->driver
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 097d9d414433315122f759ee6c2d8a7417a8ff0f ]
When the driver core calls pci_device_remove(), there is a driver bound to the device, so pci_dev->driver is never NULL.
Remove the unnecessary test of pci_dev->driver.
Stable-dep-of: 9d5286d4e7f6 ("PCI/PM: Drain runtime-idle callbacks before driver removal")
--- drivers/pci/pci-driver.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
drivers/pci/pci-driver.c +7 -9
@@ -444,16 +444,14 @@ static int pci_device_remove(struct device *dev)struct pci_dev *pci_dev =to_pci_dev (dev);struct pci_driver *drv = pci_dev->driver; -if (drv) { -if (drv->remove) { -pm_runtime_get_sync (dev); - drv->remove (pci_dev); -pm_runtime_put_noidle (dev); - } -pcibios_free_irq (pci_dev); - pci_dev->driver =NULL ; -pci_iov_remove (pci_dev); +if (drv->remove) { +pm_runtime_get_sync (dev); + drv->remove (pci_dev); +pm_runtime_put_noidle (dev); } +pcibios_free_irq (pci_dev); + pci_dev->driver =NULL ; +pci_iov_remove (pci_dev);/* Undo the runtime PM settings in local_pci_probe() */ pm_runtime_put_sync (dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/294 PCI/PM: Drain runtime-idle callbacks before driver removal
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 9d5286d4e7f68beab450deddbb6a32edd5ecf4bf ]
A race condition between the .runtime_idle() callback and the .remove() callback in the rtsx_pcr PCI driver leads to a kernel crash due to an unhandled page fault [1].
The problem is that rtsx_pci_runtime_idle() is not expected to be running after pm_runtime_get_sync() has been called, but the latter doesn't really guarantee that. It only guarantees that the suspend and resume callbacks will not be running when it returns.
However, if a .runtime_idle() callback is already running when pm_runtime_get_sync() is called, the latter will notice that the runtime PM status of the device is RPM_ACTIVE and it will return right away without waiting for the former to complete. In fact, it cannot wait for .runtime_idle() to complete because it may be called from that callback (it arguably does not make much sense to do that, but it is not strictly prohibited).
Thus in general, whoever is providing a .runtime_idle() callback needs to protect it from running in parallel with whatever code runs after pm_runtime_get_sync(). [Note that .runtime_idle() will not start after pm_runtime_get_sync() has returned, but it may continue running then if it has started earlier.]
One way to address that race condition is to call pm_runtime_barrier() after pm_runtime_get_sync() (not before it, because a nonzero value of the runtime PM usage counter is necessary to prevent runtime PM callbacks from being invoked) to wait for the .runtime_idle() callback to complete should it be running at that point. A suitable place for doing that is in pci_device_remove() which calls pm_runtime_get_sync() before removing the driver, so it may as well call pm_runtime_barrier() subsequently, which will prevent the race in question from occurring, not just in the rtsx_pcr driver, but in any PCI drivers providing .runtime_idle() callbacks.
--- drivers/pci/pci-driver.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/pci/pci-driver.c +7 -0
@@ -446,6 +446,13 @@ static int pci_device_remove(struct device *dev)if (drv->remove) {pm_runtime_get_sync (dev); +/* +* If the driver provides a .runtime_idle() callback and it has +* started to run already, it may continue to run in parallel +* with the code below, so wait until all of the runtime PM +* activity has completed. +*/ +pm_runtime_barrier (dev); drv->remove (pci_dev);pm_runtime_put_noidle (dev); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/294 PCI/ERR: Cache RCEC EA Capability offset in pci_init_capabilities()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean V Kelley <[email protected]>
[ Upstream commit 90655631988f8f501529e6de5f13614389717ead ]
Extend support for Root Complex Event Collectors by decoding and caching the RCEC Endpoint Association Extended Capabilities when enumerating. Use that cached information for later error source reporting. See PCIe r5.0, sec 7.9.10.
Stable-dep-of: 627c6db20703 ("PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports")
--- drivers/pci/pci.h | 17 +++++++++++ drivers/pci/pcie/Makefile | 2 +- drivers/pci/pcie/rcec.c | 59 +++++++++++++++++++++++++++++++++++++++ drivers/pci/probe.c | 2 ++ include/linux/pci.h | 4 +++ 5 files changed, 83 insertions(+), 1 deletion(-) create mode 100644 drivers/pci/pcie/rcec.c
drivers/pci/pci.h +17 -0
@@ -442,6 +442,15 @@ int aer_get_device_error_info(struct pci_dev *dev, struct aer_err_info *info);void aer_print_error (struct pci_dev *dev,struct aer_err_info *info);#endif /* CONFIG_PCIEAER */ +#ifdef CONFIG_PCIEPORTBUS +/* Cached RCEC Endpoint Association */ +struct rcec_ea { +u8 nextbusn; +u8 lastbusn; +u32 bitmap; +}; +#endif +#ifdef CONFIG_PCIE_DPC void pci_save_dpc_state (struct pci_dev *dev);void pci_restore_dpc_state (struct pci_dev *dev);
@@ -456,6 +465,14 @@ static inline void pci_dpc_init(struct pci_dev *pdev) {}static inline bool pci_dpc_recovered (struct pci_dev *pdev) {return false; }#endif +#ifdef CONFIG_PCIEPORTBUS +void pci_rcec_init (struct pci_dev *dev); +void pci_rcec_exit (struct pci_dev *dev); +#else +static inline void pci_rcec_init (struct pci_dev *dev) {} +static inline void pci_rcec_exit (struct pci_dev *dev) {} +#endif +#ifdef CONFIG_PCI_ATS /* Address Translation Service */ void pci_ats_init (struct pci_dev *dev);
drivers/pci/pcie/Makefile +1 -1
@@ -2,7 +2,7 @@ # # Makefile for PCI Express features and port driver -pcieportdrv-y := portdrv_core.o portdrv_pci.o err.o +pcieportdrv-y := portdrv_core.o portdrv_pci.o err.o rcec.o obj-$(CONFIG_PCIEPORTBUS) += pcieportdrv.o
drivers/pci/pcie/rcec.c new file +59 -0
59 lines not on this page · raw message
drivers/pci/probe.c +2 -0
@@ -2216,6 +2216,7 @@ static void pci_configure_device(struct pci_dev *dev)static void pci_release_capabilities (struct pci_dev *dev) {pci_aer_exit (dev); +pci_rcec_exit (dev);pci_vpd_release (dev);pci_iov_release (dev);pci_free_cap_save_buffers (dev);
@@ -2416,6 +2417,7 @@ static void pci_init_capabilities(struct pci_dev *dev)pci_ptm_init (dev);/* Precision Time Measurement */ pci_aer_init (dev);/* Advanced Error Reporting */ pci_dpc_init (dev);/* Downstream Port Containment */ +pci_rcec_init (dev);/* Root Complex Event Collector */ pcie_report_downtraining (dev);
include/linux/pci.h +4 -0
@@ -306,6 +306,7 @@ struct pcie_link_state;struct pci_vpd ;struct pci_sriov ;struct pci_p2pdma ; +struct rcec_ea ;/* The pci_dev structure describes PCI devices */ struct pci_dev {
@@ -328,6 +329,9 @@ struct pci_dev {#ifdef CONFIG_PCIEAER u16 aer_cap;/* AER capability offset */ struct aer_stats *aer_stats;/* AER stats for this device */ +#endif +#ifdef CONFIG_PCIEPORTBUS +struct rcec_ea *rcec_ea;/* RCEC cached endpoint association */ #endif u8 pcie_cap;/* PCIe capability offset */ u8 msi_cap;/* MSI capability offset */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/294 PCI: Cache PCIe Device Capabilities register
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amey Narkhede <[email protected]>
[ Upstream commit 69139244806537f9d51364f37fe146bb2ee88a05 ]
Add a new member called devcap in struct pci_dev for caching the PCIe Device Capabilities register to avoid reading PCI_EXP_DEVCAP multiple times.
Refactor pcie_has_flr() to use cached device capabilities.
Stable-dep-of: 627c6db20703 ("PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports")
--- drivers/pci/pci.c | 6 ++---- drivers/pci/probe.c | 5 +++-- include/linux/pci.h | 1 + 3 files changed, 6 insertions(+), 6 deletions(-)
drivers/pci/pci.c +2 -4
@@ -31,6 +31,7 @@#include <linux/vmalloc.h> #include <asm/dma.h> #include <linux/aer.h> +#include <linux/bitfield.h> #include "pci.h" DEFINE_MUTEX (pci_slot_mutex);
@@ -4572,13 +4573,10 @@ EXPORT_SYMBOL(pci_wait_for_pending_transaction);*/ bool pcie_has_flr (struct pci_dev *dev) { -u32 cap; -if (dev->dev_flags &PCI_DEV_FLAGS_NO_FLR_RESET )return false; -pcie_capability_read_dword (dev,PCI_EXP_DEVCAP , &cap); -return cap &PCI_EXP_DEVCAP_FLR ; +return FIELD_GET (PCI_EXP_DEVCAP_FLR , dev->devcap) ==1 ; }EXPORT_SYMBOL_GPL (pcie_has_flr);
drivers/pci/probe.c +3 -2
@@ -19,6 +19,7 @@#include <linux/hypervisor.h> #include <linux/irqdomain.h> #include <linux/pm_runtime.h> +#include <linux/bitfield.h> #include "pci.h" #define CARDBUS_LATENCY_TIMER 176/* secondary latency timer */
@@ -1496,8 +1497,8 @@ void set_pcie_port_type(struct pci_dev *pdev) pdev->pcie_cap = pos;pci_read_config_word (pdev, pos +PCI_EXP_FLAGS , ®16); pdev->pcie_flags_reg = reg16; -pci_read_config_word (pdev, pos +PCI_EXP_DEVCAP , ®16); - pdev->pcie_mpss = reg16 &PCI_EXP_DEVCAP_PAYLOAD ; +pci_read_config_dword (pdev, pos +PCI_EXP_DEVCAP , &pdev->devcap); + pdev->pcie_mpss =FIELD_GET (PCI_EXP_DEVCAP_PAYLOAD , pdev->devcap); parent =pci_upstream_bridge (pdev);if (!parent)
include/linux/pci.h +1 -0
@@ -333,6 +333,7 @@ struct pci_dev {#ifdef CONFIG_PCIEPORTBUS struct rcec_ea *rcec_ea;/* RCEC cached endpoint association */ #endif +u32 devcap;/* PCIe Device Capabilities */ u8 pcie_cap;/* PCIe capability offset */ u8 msi_cap;/* MSI capability offset */ u8 msix_cap;/* MSI-X capability offset */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/294 PCI: Work around Intel I210 ROM BAR overlap defect
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <[email protected]>
[ Upstream commit 500b55b05d0a21c4adddf4c3b29ee6f32b502046 ]
Per PCIe r5, sec 7.5.1.2.4, a device must not claim accesses to its Expansion ROM unless both the Memory Space Enable and the Expansion ROM Enable bit are set. But apparently some Intel I210 NICs don't work correctly if the ROM BAR overlaps another BAR, even if the Expansion ROM is disabled.
Michael reported that on a Kontron SMARC-sAL28 ARM64 system with U-Boot v2021.01-rc3, the ROM BAR overlaps BAR 3, and networking doesn't work at all:
BAR 0: 0x40000000 (32-bit, non-prefetchable) [size=1M] BAR 3: 0x40200000 (32-bit, non-prefetchable) [size=16K]
ROM: 0x40200000 (disabled) [size=1M]
NETDEV WATCHDOG: enP2p1s0 (igb): transmit queue 0 timed out
Hardware name: Kontron SMARC-sAL28 (Single PHY) on SMARC Eval 2.0 carrier (DT) igb 0002:01:00.0 enP2p1s0: Reset adapter
Previously, pci_std_update_resource() wrote the assigned ROM address to the BAR only when the ROM was enabled. This meant that the I210 ROM BAR could be left with an address assigned by firmware, which might overlap with other BARs.
Quirk these I210 devices so pci_std_update_resource() always writes the assigned address to the ROM BAR, whether or not the ROM is enabled.
Stable-dep-of: 627c6db20703 ("PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports")
--- drivers/pci/quirks.c | 10 ++++++++++ drivers/pci/setup-res.c | 8 ++++++-- include/linux/pci.h | 1 + 3 files changed, 17 insertions(+), 2 deletions(-)
drivers/pci/quirks.c +10 -0
@@ -5852,3 +5852,13 @@ static void nvidia_ion_ahci_fixup(struct pci_dev *pdev) pdev->dev_flags |=PCI_DEV_FLAGS_HAS_MSI_MASKING ; }DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_NVIDIA ,0x0ab8 , nvidia_ion_ahci_fixup); + +static void rom_bar_overlap_defect (struct pci_dev *dev) +{ +pci_info (dev,"working around ROM BAR overlap defect\n" ); + dev->rom_bar_overlap =1 ; +} +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_INTEL ,0x1533 , rom_bar_overlap_defect); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_INTEL ,0x1536 , rom_bar_overlap_defect); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_INTEL ,0x1537 , rom_bar_overlap_defect); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_INTEL ,0x1538 , rom_bar_overlap_defect);
drivers/pci/setup-res.c +6 -2
@@ -75,12 +75,16 @@ static void pci_std_update_resource(struct pci_dev *dev, int resno)* as zero when disabled, so don't update ROM BARs unless * they're enabled. See * https://lore.kernel.org/r/[email protected]/ +* But we must update ROM BAR for buggy devices where even a +* disabled ROM can conflict with other BARs. */ -if (!(res->flags &IORESOURCE_ROM_ENABLE )) +if (!(res->flags &IORESOURCE_ROM_ENABLE ) && + !dev->rom_bar_overlap)return ; reg = dev->rom_base_reg; - new |=PCI_ROM_ADDRESS_ENABLE ; +if (res->flags &IORESOURCE_ROM_ENABLE ) + new |=PCI_ROM_ADDRESS_ENABLE ; }else return ;
include/linux/pci.h +1 -0
@@ -454,6 +454,7 @@ struct pci_dev { unsigned int link_active_reporting:1;/* Device capable of reporting link active */ unsigned int no_vf_scan:1; /* Don't scan for VFs after IOV enablement */ unsigned int no_command_memory:1; /* No PCI_COMMAND_MEMORY */ + unsigned int rom_bar_overlap:1; /* ROM BAR disable broken */pci_dev_flags_t dev_flags;atomic_t enable_cnt;/* pci_enable_device has been called */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/294 PCI/ASPM: Make Intel DG2 L1 acceptable latency unlimited
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <[email protected]>
[ Upstream commit 03038d84ace72678a9944524508f218a00377dc0 ]
Intel DG2 discrete graphics PCIe endpoints advertise L1 acceptable exit latency to be < 1us even though they can actually tolerate unlimited exit latencies just fine. Quirk the L1 acceptable exit latency for these endpoints to be unlimited so ASPM L1 can be enabled.
Stable-dep-of: 627c6db20703 ("PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports")
--- drivers/pci/quirks.c | 47 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+)
drivers/pci/quirks.c +47 -0
@@ -12,6 +12,7 @@* file, where their drivers can use them. */ +#include <linux/bitfield.h> #include <linux/types.h> #include <linux/kernel.h> #include <linux/export.h>
@@ -5862,3 +5863,49 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1533, rom_bar_overlap_defect);DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_INTEL ,0x1536 , rom_bar_overlap_defect);DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_INTEL ,0x1537 , rom_bar_overlap_defect);DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_INTEL ,0x1538 , rom_bar_overlap_defect); + +#ifdef CONFIG_PCIEASPM +/* +* Several Intel DG2 graphics devices advertise that they can only tolerate +* 1us latency when transitioning from L1 to L0, which may prevent ASPM L1 +* from being enabled. But in fact these devices can tolerate unlimited +* latency. Override their Device Capabilities value to allow ASPM L1 to +* be enabled. +*/ +static void aspm_l1_acceptable_latency (struct pci_dev *dev) +{ +u32 l1_lat =FIELD_GET (PCI_EXP_DEVCAP_L1 , dev->devcap); + +if (l1_lat <7 ) { + dev->devcap |=FIELD_PREP (PCI_EXP_DEVCAP_L1 ,7 ); +pci_info (dev,"ASPM: overriding L1 acceptable latency from %#x to 0x7\n" , + l1_lat); + } +} +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x4f80 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x4f81 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x4f82 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x4f83 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x4f84 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x4f85 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x4f86 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x4f87 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x4f88 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x5690 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x5691 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x5692 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x5693 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x5694 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x5695 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x56a0 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x56a1 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x56a2 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x56a3 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x56a4 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x56a5 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x56a6 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x56b0 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x56b1 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x56c0 , aspm_l1_acceptable_latency); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x56c1 , aspm_l1_acceptable_latency); +#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/294 PCI/DPC: Quirk PIO log size for certain Intel Root Ports
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <[email protected]>
[ Upstream commit 5459c0b7046752e519a646e1c2404852bb628459 ]
Some Root Ports on Intel Tiger Lake and Alder Lake systems support the RP Extensions for DPC and the RP PIO Log registers but incorrectly advertise an RP PIO Log Size of zero. This means the kernel complains that:
DPC: RP PIO log size 0 is invalid
and if DPC is triggered, the DPC driver will not dump the RP PIO Log registers when it should.
This is caused by a BIOS bug and should be fixed the BIOS for future CPUs.
Add a quirk to set the correct RP PIO Log size for the affected Root Ports.
Stable-dep-of: 627c6db20703 ("PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports")
--- drivers/pci/pcie/dpc.c | 15 ++++++++++----- drivers/pci/quirks.c | 36 ++++++++++++++++++++++++++++++++++++ 2 files changed, 46 insertions(+), 5 deletions(-)
drivers/pci/pcie/dpc.c +10 -5
@@ -335,11 +335,16 @@ void pci_dpc_init(struct pci_dev *pdev)return ; pdev->dpc_rp_extensions = true; - pdev->dpc_rp_log_size = (cap &PCI_EXP_DPC_RP_PIO_LOG_SIZE ) >>8 ; -if (pdev->dpc_rp_log_size <4 || pdev->dpc_rp_log_size >9 ) { -pci_err (pdev,"RP PIO log size %u is invalid\n" , - pdev->dpc_rp_log_size); - pdev->dpc_rp_log_size =0 ; + +/* Quirks may set dpc_rp_log_size if device or firmware is buggy */ +if (!pdev->dpc_rp_log_size) { + pdev->dpc_rp_log_size = + (cap &PCI_EXP_DPC_RP_PIO_LOG_SIZE ) >>8 ; +if (pdev->dpc_rp_log_size <4 || pdev->dpc_rp_log_size >9 ) { +pci_err (pdev,"RP PIO log size %u is invalid\n" , + pdev->dpc_rp_log_size); + pdev->dpc_rp_log_size =0 ; + } } }
drivers/pci/quirks.c +36 -0
@@ -5909,3 +5909,39 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x56b1, aspm_l1_acceptable_latencyDECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x56c0 , aspm_l1_acceptable_latency);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x56c1 , aspm_l1_acceptable_latency);#endif + +#ifdef CONFIG_PCIE_DPC +/* +* Intel Tiger Lake and Alder Lake BIOS has a bug that clears the DPC +* RP PIO Log Size of the integrated Thunderbolt PCIe Root Ports. +*/ +static void dpc_log_size (struct pci_dev *dev) +{ +u16 dpc, val; + + dpc =pci_find_ext_capability (dev,PCI_EXT_CAP_ID_DPC ); +if (!dpc) +return ; + +pci_read_config_word (dev, dpc +PCI_EXP_DPC_CAP , &val); +if (!(val &PCI_EXP_DPC_CAP_RP_EXT )) +return ; + +if (!((val &PCI_EXP_DPC_RP_PIO_LOG_SIZE ) >>8 )) { +pci_info (dev,"Overriding RP PIO Log Size to 4\n" ); + dev->dpc_rp_log_size =4 ; + } +} +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x461f , dpc_log_size); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x462f , dpc_log_size); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x463f , dpc_log_size); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x466e , dpc_log_size); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x9a23 , dpc_log_size); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x9a25 , dpc_log_size); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x9a27 , dpc_log_size); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x9a29 , dpc_log_size); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x9a2b , dpc_log_size); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x9a2d , dpc_log_size); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x9a2f , dpc_log_size); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x9a31 , dpc_log_size); +#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/294 PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Menzel <[email protected]>
[ Upstream commit 627c6db20703b5d18d928464f411d0d4ec327508 ]
Commit 5459c0b70467 ("PCI/DPC: Quirk PIO log size for certain Intel Root Ports") and commit 3b8803494a06 ("PCI/DPC: Quirk PIO log size for Intel Ice Lake Root Ports") add quirks for Ice, Tiger and Alder Lake Root Ports. System firmware for Raptor Lake still has the bug, so Linux logs the warning below on several Raptor Lake systems like Dell Precision 3581 with Intel Raptor Lake processor (0W18NX) system firmware/BIOS version 1.10.1.
pci 0000:00:07.0: [8086:a76e] type 01 class 0x060400 pci 0000:00:07.0: DPC: RP PIO log size 0 is invalid pci 0000:00:07.1: [8086:a73f] type 01 class 0x060400 pci 0000:00:07.1: DPC: RP PIO log size 0 is invalid
Apply the quirk for Raptor Lake Root Ports as well.
This also enables the DPC driver to dump the RP PIO Log registers when DPC is triggered.
--- drivers/pci/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/quirks.c +2 -0
@@ -5944,4 +5944,6 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a2b, dpc_log_size);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x9a2d , dpc_log_size);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x9a2f , dpc_log_size);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x9a31 , dpc_log_size); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0xa73f , dpc_log_size); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0xa76e , dpc_log_size);#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/294 Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Song Liu <[email protected]>
[ Upstream commit 3445139e3a594be77eff48bc17eff67cf983daed ]
This reverts commit bed9e27baf52a09b7ba2a3714f1e24e17ced386d.
The original set [1][2] was expected to undo a suboptimal fix in [2], and replace it with a better fix [1]. However, as reported by Dan Moulding [2] causes an issue with raid5 with journal device.
Revert [2] for now to close the issue. We will follow up on another issue reported by Juxiao Bi, as [2] is expected to fix it. We believe this is a good trade-off, because the latter issue happens less freqently.
In the meanwhile, we will NOT revert [1], as it contains the right logic.
[1] commit d6e035aad6c0 ("md: bypass block throttle for superblock update")
[2] commit bed9e27baf52 ("Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"")
--- drivers/md/raid5.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/md/raid5.c +12 -0
@@ -36,6 +36,7 @@*/ #include <linux/blkdev.h> +#include <linux/delay.h> #include <linux/kthread.h> #include <linux/raid/pq.h> #include <linux/async_tx.h>
@@ -6519,7 +6520,18 @@ static void raid5d(struct md_thread *thread)spin_unlock_irq (&conf->device_lock);md_check_recovery (mddev);spin_lock_irq (&conf->device_lock); + +/* +* Waiting on MD_SB_CHANGE_PENDING below may deadlock +* seeing md_check_recovery() is needed to clear +* the flag when using mdmon. +*/ +continue ; } + +wait_event_lock_irq (mddev->sb_wait, + !test_bit (MD_SB_CHANGE_PENDING , &mddev->sb_flags), + conf->device_lock); }pr_debug ("%d stripes handled\n" , handled);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/294 dm-raid: fix lockdep waring in "pers->hot_add_disk"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 95009ae904b1e9dca8db6f649f2d7c18a6e42c75 ]
The lockdep assert is added by commit a448af25becf ("md/raid10: remove rcu protection to access rdev from conf") in print_conf(). And I didn't notice that dm-raid is calling "pers->hot_add_disk" without holding 'reconfig_mutex'.
"pers->hot_add_disk" read and write many fields that is protected by 'reconfig_mutex', and raid_resume() already grab the lock in other contex. Hence fix this problem by protecting "pers->host_add_disk" with the lock.
--- drivers/md/dm-raid.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/md/dm-raid.c +2 -0
@@ -4019,7 +4019,9 @@ static void raid_resume(struct dm_target *ti)* Take this opportunity to check whether any failed * devices are reachable again. */ +mddev_lock_nointr (mddev);attempt_restore_of_faulty_devices (rs); +mddev_unlock (mddev); }if (test_and_clear_bit (RT_FLAG_RS_SUSPENDED , &rs->runtime_flags)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/294 mac802154: fix llsec key resources release in mac802154_llsec_key_del
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
[ Upstream commit e8a1e58345cf40b7b272e08ac7b32328b2543e40 ]
mac802154_llsec_key_del() can free resources of a key directly without following the RCU rules for waiting before the end of a grace period. This may lead to use-after-free in case llsec_lookup_key() is traversing the list of keys in parallel with a key deletion:
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 4 PID: 16000 at lib/refcount.c:25 refcount_warn_saturate+0x162/0x2a0 Modules linked in: CPU: 4 PID: 16000 Comm: wpan-ping Not tainted 6.7.0 #19 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:refcount_warn_saturate+0x162/0x2a0 Call Trace: <TASK> llsec_lookup_key.isra.0+0x890/0x9e0 mac802154_llsec_encrypt+0x30c/0x9c0 ieee802154_subif_start_xmit+0x24/0x1e0 dev_hard_start_xmit+0x13e/0x690 sch_direct_xmit+0x2ae/0xbc0 __dev_queue_xmit+0x11dd/0x3c20 dgram_sendmsg+0x90b/0xd60 __sys_sendto+0x466/0x4c0 __x64_sys_sendto+0xe0/0x1c0 do_syscall_64+0x45/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76
Also, ieee802154_llsec_key_entry structures are not freed by mac802154_llsec_key_del():
unreferenced object 0xffff8880613b6980 (size 64):
comm "iwpan", pid 2176, jiffies 4294761134 (age 60.475s) hex dump (first 32 bytes):
78 0d 8f 18 80 88 ff ff 22 01 00 00 00 00 ad de x.......".......
00 00 00 00 00 00 00 00 03 00 cd ab 00 00 00 00 ................
backtrace:
[<ffffffff81dcfa62>] __kmem_cache_alloc_node+0x1e2/0x2d0
[<ffffffff81c43865>] kmalloc_trace+0x25/0xc0
[<ffffffff88968b09>] mac802154_llsec_key_add+0xac9/0xcf0
[<ffffffff8896e41a>] ieee802154_add_llsec_key+0x5a/0x80
[<ffffffff8892adc6>] nl802154_add_llsec_key+0x426/0x5b0
[<ffffffff86ff293e>] genl_family_rcv_msg_doit+0x1fe/0x2f0
[<ffffffff86ff46d1>] genl_rcv_msg+0x531/0x7d0
[<ffffffff86fee7a9>] netlink_rcv_skb+0x169/0x440
[<ffffffff86ff1d88>] genl_rcv+0x28/0x40
[<ffffffff86fec15c>] netlink_unicast+0x53c/0x820
[<ffffffff86fecd8b>] netlink_sendmsg+0x93b/0xe60
[<ffffffff86b91b35>] ____sys_sendmsg+0xac5/0xca0
[<ffffffff86b9c3dd>] ___sys_sendmsg+0x11d/0x1c0
[<ffffffff86b9c65a>] __sys_sendmsg+0xfa/0x1d0
[<ffffffff88eadbf5>] do_syscall_64+0x45/0xf0
[<ffffffff890000ea>] entry_SYSCALL_64_after_hwframe+0x6e/0x76Handle the proper resource release in the RCU callback function mac802154_llsec_key_del_rcu().
Note that if llsec_lookup_key() finds a key, it gets a refcount via llsec_key_get() and locally copies key id from key_entry (which is a list element). So it's safe to call llsec_key_put() and free the list entry after the RCU grace period elapses.
Found by Linux Verification Center (linuxtesting.org).
Message-ID: <[email protected]>
--- include/net/cfg802154.h | 1 + net/mac802154/llsec.c | 18 +++++++++++++----- 2 files changed, 14 insertions(+), 5 deletions(-)
include/net/cfg802154.h +1 -0
@@ -257,6 +257,7 @@ struct ieee802154_llsec_key {struct ieee802154_llsec_key_entry {struct list_head list; +struct rcu_head rcu;struct ieee802154_llsec_key_id id;struct ieee802154_llsec_key *key;
net/mac802154/llsec.c +13 -5
@@ -265,19 +265,27 @@ int mac802154_llsec_key_add(struct mac802154_llsec *sec,return -ENOMEM ; } +static void mac802154_llsec_key_del_rcu (struct rcu_head *rcu) +{ +struct ieee802154_llsec_key_entry *pos; +struct mac802154_llsec_key *mkey; + + pos = container_of(rcu, struct ieee802154_llsec_key_entry, rcu); + mkey = container_of(pos->key, struct mac802154_llsec_key, key); + +llsec_key_put (mkey); +kfree_sensitive (pos); +} +int mac802154_llsec_key_del (struct mac802154_llsec *sec,const struct ieee802154_llsec_key_id *key) {struct ieee802154_llsec_key_entry *pos;list_for_each_entry (pos, &sec->table.keys, list) { -struct mac802154_llsec_key *mkey; - - mkey = container_of(pos->key, struct mac802154_llsec_key, key); -if (llsec_key_id_equal (&pos->id, key)) {list_del_rcu (&pos->list); -llsec_key_put (mkey); +call_rcu (&pos->rcu, mac802154_llsec_key_del_rcu);return 0 ; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/294 mm: swap: fix race between free_swap_and_cache() and swapoff()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Roberts <[email protected]>
[ Upstream commit 82b1c07a0af603e3c47b906c8e991dc96f01688e ]
There was previously a theoretical window where swapoff() could run and teardown a swap_info_struct while a call to free_swap_and_cache() was running in another thread. This could cause, amongst other bad possibilities, swap_page_trans_huge_swapped() (called by free_swap_and_cache()) to access the freed memory for swap_map.
This is a theoretical problem and I haven't been able to provoke it from a test case. But there has been agreement based on code review that this is possible (see link below).
Fix it by using get_swap_device()/put_swap_device(), which will stall swapoff(). There was an extra check in _swap_info_get() to confirm that the swap entry was not free. This isn't present in get_swap_device() because it doesn't make sense in general due to the race between getting the reference and swapoff. So I've added an equivalent check directly in free_swap_and_cache().
Details of how to provoke one possible issue (thanks to David Hildenbrand for deriving this):
--8<-----
__swap_entry_free() might be the last user and result in "count == SWAP_HAS_CACHE".
swapoff->try_to_unuse() will stop as soon as soon as si->inuse_pages==0.
So the question is: could someone reclaim the folio and turn si->inuse_pages==0, before we completed swap_page_trans_huge_swapped().
Imagine the following: 2 MiB folio in the swapcache. Only 2 subpages are still references by swap entries.
Process 1 still references subpage 0 via swap entry. Process 2 still references subpage 1 via swap entry.
Process 1 quits. Calls free_swap_and_cache().
-> count == SWAP_HAS_CACHE
[then, preempted in the hypervisor etc.]
Process 2 quits. Calls free_swap_and_cache().
-> count == SWAP_HAS_CACHE
Process 2 goes ahead, passes swap_page_trans_huge_swapped(), and calls __try_to_reclaim_swap().
__try_to_reclaim_swap()->folio_free_swap()->delete_from_swap_cache()-> put_swap_folio()->free_swap_slot()->swapcache_free_entries()-> swap_entry_free()->swap_range_free()->
...WRITE_ONCE(si->inuse_pages, si->inuse_pages - nr_entries);
What stops swapoff to succeed after process 2 reclaimed the swap cache but before process1 finished its call to swap_page_trans_huge_swapped()?
--8<-----
--- mm/swapfile.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
mm/swapfile.c +12 -1
@@ -1271,6 +1271,11 @@ static unsigned char __swap_entry_free_locked(struct swap_info_struct *p, }/* +* Note that when only holding the PTL, swapoff might succeed immediately +* after freeing a swap entry. Therefore, immediately after +* __swap_entry_free(), the swap info might become stale and should not +* be touched without a prior get_swap_device(). +* * Check whether swap entry is valid in the swap device. If so, * return pointer to swap_info_struct, and keep the swap entry valid * via preventing the swap device from being swapoff, until
@@ -1797,13 +1802,19 @@ int free_swap_and_cache(swp_entry_t entry)if (non_swap_entry (entry))return 1 ; - p =_swap_info_get (entry); + p =get_swap_device (entry);if (p) { +if (WARN_ON (data_race (!p->swap_map[swp_offset (entry)]))) { +put_swap_device (p); +return 0 ; + } + count =__swap_entry_free (p, entry);if (count ==SWAP_HAS_CACHE && !swap_page_trans_huge_swapped (p, entry))__try_to_reclaim_swap (p,swp_offset (entry),TTRS_UNMAPPED |TTRS_FULL ); +put_swap_device (p); }return p !=NULL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/294 mmc: core: Fix switch on gp3 partition
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dominique Martinet <[email protected]>
[ Upstream commit 4af59a8df5ea930038cd3355e822f5eedf4accc1 ]
Commit e7794c14fd73 ("mmc: rpmb: fixes pause retune on all RPMB partitions.") added a mask check for 'part_type', but the mask used was wrong leading to the code intended for rpmb also being executed for GP3.
On some MMCs (but not all) this would make gp3 partition inaccessible:
armadillo:~# head -c 1 < /dev/mmcblk2gp3 head: standard input: I/O error armadillo:~# dmesg -c [ 422.976583] mmc2: running CQE recovery [ 423.058182] mmc2: running CQE recovery [ 423.137607] mmc2: running CQE recovery [ 423.137802] blk_update_request: I/O error, dev mmcblk2gp3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 4 prio class 0 [ 423.237125] mmc2: running CQE recovery [ 423.318206] mmc2: running CQE recovery [ 423.397680] mmc2: running CQE recovery [ 423.397837] blk_update_request: I/O error, dev mmcblk2gp3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 423.408287] Buffer I/O error on dev mmcblk2gp3, logical block 0, async page read
the part_type values of interest here are defined as follow:
main 0
boot0 1
boot1 2
rpmb 3 gp0 4 gp1 5 gp2 6 gp3 7
so mask with EXT_CSD_PART_CONFIG_ACC_MASK (7) to correctly identify rpmb
--- drivers/mmc/core/block.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/mmc/core/block.c +6 -4
@@ -823,10 +823,11 @@ static const struct block_device_operations mmc_bdops = {static int mmc_blk_part_switch_pre (struct mmc_card *card,unsigned int part_type) { -const unsigned int mask =EXT_CSD_PART_CONFIG_ACC_RPMB ; +const unsigned int mask =EXT_CSD_PART_CONFIG_ACC_MASK ; +const unsigned int rpmb =EXT_CSD_PART_CONFIG_ACC_RPMB ;int ret =0 ; -if ((part_type & mask) == mask) { +if ((part_type & mask) == rpmb) {if (card->ext_csd.cmdq_en) { ret =mmc_cmdq_disable (card);if (ret)
@@ -841,10 +842,11 @@ static int mmc_blk_part_switch_pre(struct mmc_card *card,static int mmc_blk_part_switch_post (struct mmc_card *card,unsigned int part_type) { -const unsigned int mask =EXT_CSD_PART_CONFIG_ACC_RPMB ; +const unsigned int mask =EXT_CSD_PART_CONFIG_ACC_MASK ; +const unsigned int rpmb =EXT_CSD_PART_CONFIG_ACC_RPMB ;int ret =0 ; -if ((part_type & mask) == mask) { +if ((part_type & mask) == rpmb) {mmc_retune_unpause (card->host);if (card->reenable_cmdq && !card->ext_csd.cmdq_en) ret =mmc_cmdq_enable (card);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/294 drm/etnaviv: Restore some id values
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Gmeiner <[email protected]>
[ Upstream commit b735ee173f84d5d0d0733c53946a83c12d770d05 ]
The hwdb selection logic as a feature that allows it to mark some fields as 'don't care'. If we match with such a field we memcpy(..) the current etnaviv_chip_identity into ident.
This step can overwrite some id values read from the GPU with the 'don't care' value.
Fix this issue by restoring the affected values after the memcpy(..).
As this is crucial for user space to know when this feature works as expected increment the minor version too.
--- drivers/gpu/drm/etnaviv/etnaviv_drv.c | 2 +- drivers/gpu/drm/etnaviv/etnaviv_hwdb.c | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-)
drivers/gpu/drm/etnaviv/etnaviv_drv.c +1 -1
@@ -511,7 +511,7 @@ static struct drm_driver etnaviv_drm_driver = { .desc = "etnaviv DRM", .date = "20151214", .major = 1, - .minor = 3, + .minor = 4, };/*
drivers/gpu/drm/etnaviv/etnaviv_hwdb.c +9 -0
@@ -73,6 +73,9 @@ static const struct etnaviv_chip_identity etnaviv_chip_identities[] = {bool etnaviv_fill_identity_from_hwdb (struct etnaviv_gpu *gpu) {struct etnaviv_chip_identity *ident = &gpu->identity; +const u32 product_id = ident->product_id; +const u32 customer_id = ident->customer_id; +const u32 eco_id = ident->eco_id;int i;for (i =0 ; i <ARRAY_SIZE (etnaviv_chip_identities); i++) {
@@ -86,6 +89,12 @@ bool etnaviv_fill_identity_from_hwdb(struct etnaviv_gpu *gpu) etnaviv_chip_identities[i].eco_id == ~0U)) {memcpy (ident, &etnaviv_chip_identities[i],sizeof (*ident)); + +/* Restore some id values as ~0U aka 'don't care' might been used. */ + ident->product_id = product_id; + ident->customer_id = customer_id; + ident->eco_id = eco_id; +return true; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/294 hwmon: (amc6821) add of_match table
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josua Mayer <[email protected]>
[ Upstream commit 3f003fda98a7a8d5f399057d92e6ed56b468657c ]
Add of_match table for "ti,amc6821" compatible string.
This fixes automatic driver loading by userspace when using device-tree, and if built as a module like major linux distributions do.
While devices probe just fine with i2c_device_id table, userspace can't match the "ti,amc6821" compatible string from dt with the plain "amc6821" device id. As a result, the kernel module can not be loaded.
--- drivers/hwmon/amc6821.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/hwmon/amc6821.c +11 -0
@@ -934,10 +934,21 @@ static const struct i2c_device_id amc6821_id[] = {MODULE_DEVICE_TABLE (i2c, amc6821_id); +static const struct of_device_id __maybe_unused amc6821_of_match[] = { + { + .compatible ="ti,amc6821" , + .data = (void *)amc6821, + }, + { } +}; + +MODULE_DEVICE_TABLE (of, amc6821_of_match); +static struct i2c_driver amc6821_driver = { .class =I2C_CLASS_HWMON , .driver = { .name ="amc6821" , + .of_match_table =of_match_ptr (amc6821_of_match), }, .probe_new = amc6821_probe, .id_table = amc6821_id,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/294 ext4: fix corruption during on-line resize
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maximilian Heyne <[email protected]>
[ Upstream commit a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc ]
We observed a corruption during on-line resize of a file system that is larger than 16 TiB with 4k block size. With having more then 2^32 blocks resize_inode is turned off by default by mke2fs. The issue can be reproduced on a smaller file system for convenience by explicitly turning off resize_inode. An on-line resize across an 8 GiB boundary (the size of a meta block group in this setup) then leads to a corruption:
dev=/dev/<some_dev> # should be >= 16 GiB mkdir -p /corruption /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15)) mount -t ext4 $dev /corruption dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15)) sha1sum /corruption/test # 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test /sbin/resize2fs $dev $((2*2**21)) # drop page cache to force reload the block from disk echo 1 > /proc/sys/vm/drop_caches
sha1sum /corruption/test
# 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test
2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per block group and 2^6 are the number of block groups that make a meta block group.
The last checksum might be different depending on how the file is laid out across the physical blocks. The actual corruption occurs at physical block 63*2^15 = 2064384 which would be the location of the backup of the meta block group's block descriptor. During the on-line resize the file system will be converted to meta_bg starting at s_first_meta_bg which is 2 in the example - meaning all block groups after 16 GiB. However, in ext4_flex_group_add we might add block groups that are not part of the first meta block group yet. In the reproducer we achieved this by substracting the size of a whole block group from the point where the meta block group would start. This must be considered when updating the backup block group descriptors to follow the non-meta_bg layout. The fix is to add a test whether the group to add is already part of the meta block group or not.
--- fs/ext4/resize.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/ext4/resize.c +2 -1
@@ -1545,7 +1545,8 @@ static int ext4_flex_group_add(struct super_block *sb,int gdb_num = group /EXT4_DESC_PER_BLOCK (sb);int gdb_num_end = ((group + flex_gd->count -1 ) /EXT4_DESC_PER_BLOCK (sb)); -int meta_bg =ext4_has_feature_meta_bg (sb); +int meta_bg =ext4_has_feature_meta_bg (sb) && + gdb_num >=le32_to_cpu (es->s_first_meta_bg);sector_t padding_blocks = meta_bg ?0 : sbi->s_sbh->b_blocknr -ext4_group_first_block_no (sb,0 );sector_t old_gdb =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/294 nvmem: meson-efuse: fix function pointer type mismatch
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit cbd38332c140829ab752ba4e727f98be5c257f18 ]
clang-16 warns about casting functions to incompatible types, as is done here to call clk_disable_unprepare:
drivers/nvmem/meson-efuse.c:78:12: error: cast from 'void (*)(struct clk *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
78 | (void(*)(void *))clk_disable_unprepare,
The pattern of getting, enabling and setting a disable callback for a clock can be replaced with devm_clk_get_enabled(), which also fixes this warning.
--- drivers/nvmem/meson-efuse.c | 25 +++---------------------- 1 file changed, 3 insertions(+), 22 deletions(-)
drivers/nvmem/meson-efuse.c +3 -22
@@ -47,7 +47,6 @@ static int meson_efuse_probe(struct platform_device *pdev)struct nvmem_config *econfig;struct clk *clk;unsigned int size; -int ret; sm_np =of_parse_phandle (pdev->dev.of_node,"secure-monitor" ,0 );if (!sm_np) {
@@ -60,27 +59,9 @@ static int meson_efuse_probe(struct platform_device *pdev)if (!fw)return -EPROBE_DEFER ; - clk =devm_clk_get (dev,NULL ); -if (IS_ERR (clk)) { - ret =PTR_ERR (clk); -if (ret != -EPROBE_DEFER ) -dev_err (dev,"failed to get efuse gate" ); -return ret; - } - - ret =clk_prepare_enable (clk); -if (ret) { -dev_err (dev,"failed to enable gate" ); -return ret; - } - - ret =devm_add_action_or_reset (dev, - (void (*)(void *))clk_disable_unprepare, - clk); -if (ret) { -dev_err (dev,"failed to add disable callback" ); -return ret; - } + clk =devm_clk_get_enabled (dev,NULL ); +if (IS_ERR (clk)) +return dev_err_probe (dev,PTR_ERR (clk),"failed to get efuse gate" );if (meson_sm_call (fw,SM_EFUSE_USER_MAX , &size,0 ,0 ,0 ,0 ,0 ) <0 ) {dev_err (dev,"failed to get max user" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/294 slimbus: core: Remove usage of the deprecated ida_simple_xx() API
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 89ffa4cccec54467446f141a79b9e36893079fb8 ]
ida_alloc() and ida_free() should be preferred to the deprecated ida_simple_get() and ida_simple_remove().
Note that the upper limit of ida_simple_get() is exclusive, but the one of ida_alloc_range() is inclusive. So change this change allows one more device. Previously address 0xFE was never used.
--- drivers/slimbus/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/slimbus/core.c +2 -2
@@ -438,8 +438,8 @@ static int slim_device_alloc_laddr(struct slim_device *sbdev,if (ret <0 ) goto err; }else if (report_present) { - ret =ida_simple_get (&ctrl->laddr_ida, -0 ,SLIM_LA_MANAGER -1 ,GFP_KERNEL ); + ret =ida_alloc_max (&ctrl->laddr_ida, +SLIM_LA_MANAGER -1 ,GFP_KERNEL );if (ret <0 ) goto err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/294 phy: tegra: xusb: Add API to retrieve the port number of phy
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Chang <[email protected]>
[ Upstream commit d843f031d9e90462253015bc0bd9e3852d206bf2 ]
This patch introduces a new API, tegra_xusb_padctl_get_port_number, to the Tegra XUSB Pad Controller driver. This API is used to identify the USB port that is associated with a given PHY.
The function takes a PHY pointer for either a USB2 PHY or USB3 PHY as input and returns the corresponding port number. If the PHY pointer is invalid, it returns -ENODEV.
--- drivers/phy/tegra/xusb.c | 13 +++++++++++++ include/linux/phy/tegra/xusb.h | 2 ++ 2 files changed, 15 insertions(+)
drivers/phy/tegra/xusb.c +13 -0
@@ -1399,6 +1399,19 @@ int tegra_xusb_padctl_get_usb3_companion(struct tegra_xusb_padctl *padctl, }EXPORT_SYMBOL_GPL (tegra_xusb_padctl_get_usb3_companion); +int tegra_xusb_padctl_get_port_number (struct phy *phy) +{ +struct tegra_xusb_lane *lane; + +if (!phy) +return -ENODEV ; + + lane =phy_get_drvdata (phy); + +return lane->index; +} +EXPORT_SYMBOL_GPL (tegra_xusb_padctl_get_port_number); +MODULE_AUTHOR ("Thierry Reding <[email protected]>" );MODULE_DESCRIPTION ("Tegra XUSB Pad Controller driver" );MODULE_LICENSE ("GPL v2" );
include/linux/phy/tegra/xusb.h +2 -0
@@ -23,4 +23,6 @@ int tegra_xusb_padctl_set_vbus_override(struct tegra_xusb_padctl *padctl,int tegra_phy_xusb_utmi_port_reset (struct phy *phy);int tegra_xusb_padctl_get_usb3_companion (struct tegra_xusb_padctl *padctl,unsigned int port); +int tegra_xusb_padctl_get_port_number (struct phy *phy); +#endif /* PHY_TEGRA_XUSB_H */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/294 usb: gadget: tegra-xudc: Use dev_err_probe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Hunter <[email protected]>
[ Upstream commit 77b57218ac2f37da4e8b72e78f002944b9f85091 ]
Rather than testing if the error code is -EPROBE_DEFER before printing an error message, use dev_err_probe() instead to simplify the code.
Stable-dep-of: 84fa943d93c3 ("usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic")
--- drivers/usb/gadget/udc/tegra-xudc.c | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-)
drivers/usb/gadget/udc/tegra-xudc.c +6 -14
@@ -3508,10 +3508,8 @@ static int tegra_xudc_phy_get(struct tegra_xudc *xudc) xudc->utmi_phy[i] =devm_phy_optional_get (xudc->dev, phy_name);if (IS_ERR (xudc->utmi_phy[i])) { err =PTR_ERR (xudc->utmi_phy[i]); -if (err != -EPROBE_DEFER ) -dev_err (xudc->dev,"failed to get usb2-%d PHY: %d\n" , - i, err); - +dev_err_probe (xudc->dev, err, +"failed to get usb2-%d PHY\n" , i); goto clean_up; }else if (xudc->utmi_phy[i]) {/* Get usb-phy, if utmi phy is available */
@@ -3538,10 +3536,8 @@ static int tegra_xudc_phy_get(struct tegra_xudc *xudc) xudc->usb3_phy[i] =devm_phy_optional_get (xudc->dev, phy_name);if (IS_ERR (xudc->usb3_phy[i])) { err =PTR_ERR (xudc->usb3_phy[i]); -if (err != -EPROBE_DEFER ) -dev_err (xudc->dev,"failed to get usb3-%d PHY: %d\n" , - usb3, err); - +dev_err_probe (xudc->dev, err, +"failed to get usb3-%d PHY\n" , usb3); goto clean_up; }else if (xudc->usb3_phy[i])dev_dbg (xudc->dev,"usb3-%d PHY registered" , usb3);
@@ -3781,9 +3777,7 @@ static int tegra_xudc_probe(struct platform_device *pdev) err =devm_clk_bulk_get (&pdev->dev, xudc->soc->num_clks, xudc->clks);if (err) { -if (err != -EPROBE_DEFER ) -dev_err (xudc->dev,"failed to request clocks: %d\n" , err); - +dev_err_probe (xudc->dev, err,"failed to request clocks\n" );return err; }
@@ -3798,9 +3792,7 @@ static int tegra_xudc_probe(struct platform_device *pdev) err =devm_regulator_bulk_get (&pdev->dev, xudc->soc->num_supplies, xudc->supplies);if (err) { -if (err != -EPROBE_DEFER ) -dev_err (xudc->dev,"failed to request regulators: %d\n" , err); - +dev_err_probe (xudc->dev, err,"failed to request regulators\n" );return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/294 usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Chang <[email protected]>
[ Upstream commit 84fa943d93c31ee978355e6c6c69592dae3c9f59 ]
This commit resolves an issue in the tegra-xudc USB gadget driver that incorrectly fetched USB3 PHY instances. The problem stemmed from the assumption of a one-to-one correspondence between USB2 and USB3 PHY names and their association with physical USB ports in the device tree.
Previously, the driver associated USB3 PHY names directly with the USB3 instance number, leading to mismatches when mapping the physical USB ports. For instance, if using USB3-1 PHY, the driver expect the corresponding PHY name as 'usb3-1'. However, the physical USB ports in the device tree were designated as USB2-0 and USB3-0 as we only have one device controller, causing a misalignment.
This commit rectifies the issue by adjusting the PHY naming logic. Now, the driver correctly correlates the USB2 and USB3 PHY instances, allowing the USB2-0 and USB3-1 PHYs to form a physical USB port pair while accurately reflecting their configuration in the device tree by naming them USB2-0 and USB3-0, respectively.
The change ensures that the PHY and PHY names align appropriately, resolving the mismatch between physical USB ports and their associated names in the device tree.
--- drivers/usb/gadget/udc/tegra-xudc.c | 39 ++++++++++++++++++----------- 1 file changed, 25 insertions(+), 14 deletions(-)
drivers/usb/gadget/udc/tegra-xudc.c +25 -14
@@ -3480,8 +3480,8 @@ static void tegra_xudc_device_params_init(struct tegra_xudc *xudc)static int tegra_xudc_phy_get (struct tegra_xudc *xudc) { -int err =0 , usb3; -unsigned int i; +int err =0 , usb3_companion_port; +unsigned int i, j; xudc->utmi_phy =devm_kcalloc (xudc->dev, xudc->soc->num_phys,sizeof (*xudc->utmi_phy),GFP_KERNEL );
@@ -3509,7 +3509,7 @@ static int tegra_xudc_phy_get(struct tegra_xudc *xudc)if (IS_ERR (xudc->utmi_phy[i])) { err =PTR_ERR (xudc->utmi_phy[i]);dev_err_probe (xudc->dev, err, -"failed to get usb2-%d PHY\n" , i); +"failed to get PHY for phy-name usb2-%d\n" , i); goto clean_up; }else if (xudc->utmi_phy[i]) {/* Get usb-phy, if utmi phy is available */
@@ -3528,19 +3528,30 @@ static int tegra_xudc_phy_get(struct tegra_xudc *xudc) }/* Get USB3 phy */ - usb3 =tegra_xusb_padctl_get_usb3_companion (xudc->padctl, i); -if (usb3 <0 ) + usb3_companion_port =tegra_xusb_padctl_get_usb3_companion (xudc->padctl, i); +if (usb3_companion_port <0 )continue ; -snprintf (phy_name,sizeof (phy_name),"usb3-%d" , usb3); - xudc->usb3_phy[i] =devm_phy_optional_get (xudc->dev, phy_name); -if (IS_ERR (xudc->usb3_phy[i])) { - err =PTR_ERR (xudc->usb3_phy[i]); -dev_err_probe (xudc->dev, err, -"failed to get usb3-%d PHY\n" , usb3); - goto clean_up; - }else if (xudc->usb3_phy[i]) -dev_dbg (xudc->dev,"usb3-%d PHY registered" , usb3); +for (j =0 ; j < xudc->soc->num_phys; j++) { +snprintf (phy_name,sizeof (phy_name),"usb3-%d" , j); + xudc->usb3_phy[i] =devm_phy_optional_get (xudc->dev, phy_name); +if (IS_ERR (xudc->usb3_phy[i])) { + err =PTR_ERR (xudc->usb3_phy[i]); +dev_err_probe (xudc->dev, err, +"failed to get PHY for phy-name usb3-%d\n" , j); + goto clean_up; + }else if (xudc->usb3_phy[i]) { +int usb2_port = +tegra_xusb_padctl_get_port_number (xudc->utmi_phy[i]); +int usb3_port = +tegra_xusb_padctl_get_port_number (xudc->usb3_phy[i]); +if (usb3_port == usb3_companion_port) { +dev_dbg (xudc->dev,"USB2 port %d is paired with USB3 port %d for device mode port %d\n" , + usb2_port, usb3_port, i); +break ; + } + } + } }return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/294 speakup: Fix 8bit characters from direct synth
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Thibault <[email protected]>
[ Upstream commit b6c8dafc9d86eb77e502bb018ec4105e8d2fbf78 ]
When userland echoes 8bit characters to /dev/synth with e.g.
echo -e '\xe9' > /dev/synth
synth_write would get characters beyond 0x7f, and thus negative when char is signed. When given to synth_buffer_add which takes a u16, this would sign-extend and produce a U+ffxy character rather than U+xy. Users thus get garbled text instead of accents in their output.
Let's fix this by making sure that we read unsigned characters.
--- drivers/accessibility/speakup/synth.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/accessibility/speakup/synth.c +3 -1
@@ -208,8 +208,10 @@ void spk_do_flush(void)wake_up_process (speakup_task); } -void synth_write (const char *buf,size_t count) +void synth_write (const char *_buf,size_t count) { +const unsigned char *buf = (const unsigned char *) _buf; +while (count--)synth_buffer_add (*buf++);synth_start ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/294 PCI/ERR: Clear AER status only when we control AER
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean V Kelley <[email protected]>
[ Upstream commit aa344bc8b727b47b4350b59d8166216a3f351e55 ]
In some cases a bridge may not exist as the hardware controlling may be handled only by firmware and so is not visible to the OS. This scenario is also possible in future use cases involving non-native use of RCECs by firmware. In this scenario, we expect the platform to retain control of the bridge and to clear error status itself.
Clear error status only when the OS has native control of AER.
Stable-dep-of: 002bf2fbc00e ("PCI/AER: Block runtime suspend when handling errors")
--- drivers/pci/pcie/err.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/pci/pcie/err.c +11 -2
@@ -176,6 +176,7 @@ pci_ers_result_t pcie_do_recovery(struct pci_dev *dev,int type =pci_pcie_type (dev);struct pci_dev *bridge;pci_ers_result_t status =PCI_ERS_RESULT_CAN_RECOVER ; +struct pci_host_bridge *host =pci_find_host_bridge (dev->bus);/* * If the error was detected by a Root Port, Downstream Port, or
@@ -227,9 +228,17 @@ pci_ers_result_t pcie_do_recovery(struct pci_dev *dev,pci_dbg (bridge,"broadcast resume message\n" );pci_walk_bridge (bridge, report_resume, &status); -if (pcie_aer_is_native (bridge)) +/* +* If we have native control of AER, clear error status in the Root +* Port or Downstream Port that signaled the error. If the +* platform retained control of AER, it is responsible for clearing +* this status. In that case, the signaling device may not even be +* visible to the OS. +*/ +if (host->native_aer || pcie_ports_native) {pcie_clear_device_status (bridge); -pci_aer_clear_nonfatal_status (bridge); +pci_aer_clear_nonfatal_status (bridge); + }pci_info (bridge,"device recovery successful\n" );return status;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/294 PCI/AER: Block runtime suspend when handling errors
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislaw Gruszka <[email protected]>
[ Upstream commit 002bf2fbc00e5c4b95fb167287e2ae7d1973281e ]
PM runtime can be done simultaneously with AER error handling. Avoid that by using pm_runtime_get_sync() before and pm_runtime_put() after reset in pcie_do_recovery() for all recovering devices.
pm_runtime_get_sync() will increase dev->power.usage_count counter to prevent any possible future request to runtime suspend a device. It will also resume a device, if it was previously in D3hot state.
I tested with igc device by doing simultaneous aer_inject and rpm suspend/resume via /sys/bus/pci/devices/PCI_ID/power/control and can reproduce:
igc 0000:02:00.0: not ready 65535ms after bus reset; giving up pcieport 0000:00:1c.2: AER: Root Port link has been reset (-25) pcieport 0000:00:1c.2: AER: subordinate device reset failed
pcieport 0000:00:1c.2: AER: device recovery failed
igc 0000:02:00.0: Unable to change power state from D3hot to D0, device inaccessible
The problem disappears when this patch is applied.
--- drivers/pci/pcie/err.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/pci/pcie/err.c +20 -0
@@ -13,6 +13,7 @@#define dev_fmt (fmt) "AER: " fmt#include <linux/pci.h> +#include <linux/pm_runtime.h> #include <linux/module.h> #include <linux/kernel.h> #include <linux/errno.h>
@@ -79,6 +80,18 @@ static int report_error_detected(struct pci_dev *dev,return 0 ; } +static int pci_pm_runtime_get_sync (struct pci_dev *pdev,void *data) +{ +pm_runtime_get_sync (&pdev->dev); +return 0 ; +} + +static int pci_pm_runtime_put (struct pci_dev *pdev,void *data) +{ +pm_runtime_put (&pdev->dev); +return 0 ; +} +static int report_frozen_detected (struct pci_dev *dev,void *data) {return report_error_detected (dev, pci_channel_io_frozen, data);
@@ -194,6 +207,8 @@ pci_ers_result_t pcie_do_recovery(struct pci_dev *dev,else bridge =pci_upstream_bridge (dev); +pci_walk_bridge (bridge, pci_pm_runtime_get_sync,NULL ); +pci_dbg (bridge,"broadcast error_detected message\n" );if (state == pci_channel_io_frozen) {pci_walk_bridge (bridge, report_frozen_detected, &status);
@@ -239,10 +254,15 @@ pci_ers_result_t pcie_do_recovery(struct pci_dev *dev,pcie_clear_device_status (bridge);pci_aer_clear_nonfatal_status (bridge); } + +pci_walk_bridge (bridge, pci_pm_runtime_put,NULL ); +pci_info (bridge,"device recovery successful\n" );return status; failed: +pci_walk_bridge (bridge, pci_pm_runtime_put,NULL ); +pci_uevent_ers (bridge,PCI_ERS_RESULT_DISCONNECT );/* TODO: Should kernel panic here? */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/294 nfs: fix UAF in direct writes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
[ Upstream commit 17f46b803d4f23c66cacce81db35fef3adb8f2af ]
In production we have been hitting the following warning consistently
------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 17 PID: 1800359 at lib/refcount.c:28 refcount_warn_saturate+0x9c/0xe0 Workqueue: nfsiod nfs_direct_write_schedule_work [nfs] RIP: 0010:refcount_warn_saturate+0x9c/0xe0 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x9f/0x130 ? refcount_warn_saturate+0x9c/0xe0 ? report_bug+0xcc/0x150 ? handle_bug+0x3d/0x70 ? exc_invalid_op+0x16/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0x9c/0xe0 nfs_direct_write_schedule_work+0x237/0x250 [nfs] process_one_work+0x12f/0x4a0 worker_thread+0x14e/0x3b0 ? ZSTD_getCParams_internal+0x220/0x220 kthread+0xdc/0x120 ? __btf_name_valid+0xa0/0xa0 ret_from_fork+0x1f/0x30
This is because we're completing the nfs_direct_request twice in a row.
The source of this is when we have our commit requests to submit, we process them and send them off, and then in the completion path for the commit requests we have
if (nfs_commit_end(cinfo.mds))
nfs_direct_write_complete(dreq);
However since we're submitting asynchronous requests we sometimes have one that completes before we submit the next one, so we end up calling complete on the nfs_direct_request twice.
The only other place we use nfs_generic_commit_list() is in __nfs_commit_inode, which wraps this call in a
nfs_commit_begin();nfs_commit_end();
Which is a common pattern for this style of completion handling, one that is also repeated in the direct code with get_dreq()/put_dreq() calls around where we process events as well as in the completion paths.
Fix this by using the same pattern for the commit requests.
Before with my 200 node rocksdb stress running this warning would pop every 10ish minutes. With my patch the stress test has been running for several hours without popping.
--- fs/nfs/direct.c | 11 +++++++++-- fs/nfs/write.c | 2 +- include/linux/nfs_fs.h | 1 + 3 files changed, 11 insertions(+), 3 deletions(-)
fs/nfs/direct.c +9 -2
@@ -678,10 +678,17 @@ static void nfs_direct_commit_schedule(struct nfs_direct_req *dreq)LIST_HEAD (mds_list);nfs_init_cinfo_from_dreq (&cinfo, dreq); +nfs_commit_begin (cinfo.mds);nfs_scan_commit (dreq->inode, &mds_list, &cinfo); res =nfs_generic_commit_list (dreq->inode, &mds_list,0 , &cinfo); -if (res <0 )/* res == -ENOMEM */ -nfs_direct_write_reschedule (dreq); +if (res <0 ) {/* res == -ENOMEM */ +spin_lock (&dreq->lock); +if (dreq->flags ==0 ) + dreq->flags =NFS_ODIRECT_RESCHED_WRITES ; +spin_unlock (&dreq->lock); + } +if (nfs_commit_end (cinfo.mds)) +nfs_direct_write_complete (dreq); }static void nfs_direct_write_clear_reqs (struct nfs_direct_req *dreq)
fs/nfs/write.c +1 -1
@@ -1637,7 +1637,7 @@ static int wait_on_commit(struct nfs_mds_commit_info *cinfo) !atomic_read(&cinfo->rpcs_out)); } -static void nfs_commit_begin (struct nfs_mds_commit_info *cinfo) +void nfs_commit_begin (struct nfs_mds_commit_info *cinfo) {atomic_inc (&cinfo->rpcs_out); }
include/linux/nfs_fs.h +1 -0
@@ -553,6 +553,7 @@ extern int nfs_wb_page_cancel(struct inode *inode, struct page* page);extern int nfs_commit_inode (struct inode *,int );extern struct nfs_commit_data *nfs_commitdata_alloc (void );extern void nfs_commit_free (struct nfs_commit_data *data); +void nfs_commit_begin (struct nfs_mds_commit_info *cinfo);bool nfs_commit_end (struct nfs_mds_commit_info *cinfo); static inline int
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/294 kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
[ Upstream commit 75b5ab134bb5f657ef7979a59106dce0657e8d87 ]
Clang enables -Wenum-enum-conversion and -Wenum-compare-conditional under -Wenum-conversion. A recent change in Clang strengthened these warnings and they appear frequently in common builds, primarily due to several instances in common headers but there are quite a few drivers that have individual instances as well.
include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~ ^
509 | item];
| ~~~~ drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c:955:24: warning: conditional expression between different enumeration types ('enum iwl_mac_beacon_flags' and 'enum iwl_mac_beacon_flags_v1') [-Wenum-compare-conditional]
955 | flags |= is_new_rate ? IWL_MAC_BEACON_CCK
| ^ ~~~~~~~~~~~~~~~~~~
956 | : IWL_MAC_BEACON_CCK_V1;
| ~~~~~~~~~~~~~~~~~~~~~
drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c:1120:21: warning: conditional expression between different enumeration types ('enum iwl_mac_beacon_flags' and 'enum iwl_mac_beacon_flags_v1') [-Wenum-compare-conditional]
1120 | 0) > 10 ?
| ^
1121 | IWL_MAC_BEACON_FILS :
| ~~~~~~~~~~~~~~~~~~~
1122 | IWL_MAC_BEACON_FILS_V1;
| ~~~~~~~~~~~~~~~~~~~~~~Doing arithmetic between or returning two different types of enums could be a bug, so each of the instance of the warning needs to be evaluated. Unfortunately, as mentioned above, there are many instances of this warning in many different configurations, which can break the build when CONFIG_WERROR is enabled.
To avoid introducing new instances of the warnings while cleaning up the disruption for the majority of users, disable these warnings for the default build while leaving them on for W=1 builds.
--- scripts/Makefile.extrawarn | 2 ++ 1 file changed, 2 insertions(+)
scripts/Makefile.extrawarn +2 -0
@@ -53,6 +53,8 @@ KBUILD_CFLAGS += $(call cc-disable-warning, pointer-to-enum-cast) KBUILD_CFLAGS += -Wno-tautological-constant-out-of-range-compare KBUILD_CFLAGS += $(call cc-disable-warning, unaligned-access) KBUILD_CFLAGS += $(call cc-disable-warning, cast-function-type-strict) +KBUILD_CFLAGS += -Wno-enum-compare-conditional +KBUILD_CFLAGS += -Wno-enum-enum-conversion endif endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/294 PCI: dwc: endpoint: Fix advertised resizable BAR size
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit 72e34b8593e08a0ee759b7a038e0b178418ea6f8 ]
The commit message in commit fc9a77040b04 ("PCI: designware-ep: Configure Resizable BAR cap to advertise the smallest size") claims that it modifies the Resizable BAR capability to only advertise support for 1 MB size BARs.
However, the commit writes all zeroes to PCI_REBAR_CAP (the register which contains the possible BAR sizes that a BAR be resized to).
According to the spec, it is illegal to not have a bit set in PCI_REBAR_CAP, and 1 MB is the smallest size allowed.
Set bit 4 in PCI_REBAR_CAP, so that we actually advertise support for a 1 MB BAR size.
Before:
Capabilities: [2e8 v1] Physical Resizable BAR
BAR 0: current size: 1MB
BAR 1: current size: 1MB
BAR 2: current size: 1MB
BAR 3: current size: 1MB
BAR 4: current size: 1MB
BAR 5: current size: 1MB
After:
Capabilities: [2e8 v1] Physical Resizable BAR
BAR 0: current size: 1MB, supported: 1MB BAR 1: current size: 1MB, supported: 1MB BAR 2: current size: 1MB, supported: 1MB BAR 3: current size: 1MB, supported: 1MB BAR 4: current size: 1MB, supported: 1MB BAR 5: current size: 1MB, supported: 1MB
--- drivers/pci/controller/dwc/pcie-designware-ep.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/pci/controller/dwc/pcie-designware-ep.c +6 -1
@@ -662,8 +662,13 @@ int dw_pcie_ep_init_complete(struct dw_pcie_ep *ep) nbars = (reg &PCI_REBAR_CTRL_NBAR_MASK ) >>PCI_REBAR_CTRL_NBAR_SHIFT ; +/* +* PCIe r6.0, sec 7.8.6.2 require us to support at least one +* size in the range from 1 MB to 512 GB. Advertise support +* for 1 MB BAR size only. +*/ for (i =0 ; i < nbars; i++, offset +=PCI_REBAR_CTRL ) -dw_pcie_writel_dbi (pci, offset +PCI_REBAR_CAP ,0x0 ); +dw_pcie_writel_dbi (pci, offset +PCI_REBAR_CAP ,BIT (4 )); }dw_pcie_setup (pci);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/294 vfio/platform: Disable virqfds on cleanup
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <[email protected]>
[ Upstream commit fcdc0d3d40bc26c105acf8467f7d9018970944ae ]
irqfds for mask and unmask that are not specifically disabled by the user are leaked. Remove any irqfds during cleanup
--- drivers/vfio/platform/vfio_platform_irq.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/vfio/platform/vfio_platform_irq.c +4 -1
@@ -321,8 +321,11 @@ void vfio_platform_irq_cleanup(struct vfio_platform_device *vdev) {int i; -for (i =0 ; i < vdev->num_irqs; i++) +for (i =0 ; i < vdev->num_irqs; i++) { +vfio_virqfd_disable (&vdev->irqs[i].mask); +vfio_virqfd_disable (&vdev->irqs[i].unmask);vfio_set_trigger (vdev, i,-1 ,NULL ); + } vdev->num_irqs =0 ;kfree (vdev->irqs);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/294 ring-buffer: Fix waking up ring buffer readers
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
[ Upstream commit b3594573681b53316ec0365332681a30463edfd6 ]
A task can wait on a ring buffer for when it fills up to a specific watermark. The writer will check the minimum watermark that waiters are waiting for and if the ring buffer is past that, it will wake up all the waiters.
The waiters are in a wait loop, and will first check if a signal is pending and then check if the ring buffer is at the desired level where it should break out of the loop.
If a file that uses a ring buffer closes, and there's threads waiting on the ring buffer, it needs to wake up those threads. To do this, a "wait_index" was used.
Before entering the wait loop, the waiter will read the wait_index. On wakeup, it will check if the wait_index is different than when it entered the loop, and will exit the loop if it is. The waker will only need to update the wait_index before waking up the waiters.
This had a couple of bugs. One trivial one and one broken by design.
The trivial bug was that the waiter checked the wait_index after the schedule() call. It had to be checked between the prepare_to_wait() and the schedule() which it was not.
The main bug is that the first check to set the default wait_index will always be outside the prepare_to_wait() and the schedule(). That's because the ring_buffer_wait() doesn't have enough context to know if it should break out of the loop.
The loop itself is not needed, because all the callers to the ring_buffer_wait() also has their own loop, as the callers have a better sense of what the context is to decide whether to break out of the loop or not.
Just have the ring_buffer_wait() block once, and if it gets woken up, exit the function and let the callers decide what to do next.
Stable-dep-of: 761d9473e27f ("ring-buffer: Do not set shortest_full when full target is hit")
--- kernel/trace/ring_buffer.c | 139 ++++++++++++++++++------------------- 1 file changed, 68 insertions(+), 71 deletions(-)
kernel/trace/ring_buffer.c +68 -71
@@ -415,7 +415,6 @@ struct rb_irq_work {struct irq_work work;wait_queue_head_t waiters;wait_queue_head_t full_waiters; -long wait_index;bool waiters_pending;bool full_waiters_pending;bool wakeup_full;
@@ -862,14 +861,40 @@ void ring_buffer_wake_waiters(struct trace_buffer *buffer, int cpu) rbwork = &cpu_buffer->irq_work; } - rbwork->wait_index++; -/* make sure the waiters see the new index */ -smp_wmb (); -/* This can be called in any context */ irq_work_queue (&rbwork->work); } +static bool rb_watermark_hit (struct trace_buffer *buffer,int cpu,int full) +{ +struct ring_buffer_per_cpu *cpu_buffer; +bool ret = false; + +/* Reads of all CPUs always waits for any data */ +if (cpu ==RING_BUFFER_ALL_CPUS ) +return !ring_buffer_empty (buffer); + + cpu_buffer = buffer->buffers[cpu]; + +if (!ring_buffer_empty_cpu (buffer, cpu)) { +unsigned long flags; +bool pagebusy; + +if (!full) +return true; + +raw_spin_lock_irqsave (&cpu_buffer->reader_lock, flags); + pagebusy = cpu_buffer->reader_page == cpu_buffer->commit_page; + ret = !pagebusy &&full_hit (buffer, cpu, full); + +if (!cpu_buffer->shortest_full || + cpu_buffer->shortest_full > full) + cpu_buffer->shortest_full = full; +raw_spin_unlock_irqrestore (&cpu_buffer->reader_lock, flags); + } +return ret; +} +/** * ring_buffer_wait - wait for input to the ring buffer * @buffer: buffer to wait on
@@ -885,7 +910,6 @@ int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full)struct ring_buffer_per_cpu *cpu_buffer;DEFINE_WAIT (wait);struct rb_irq_work *work; -long wait_index;int ret =0 ;/*
@@ -904,81 +928,54 @@ int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full) work = &cpu_buffer->irq_work; } - wait_index =READ_ONCE (work->wait_index); - -while (true) { -if (full) -prepare_to_wait (&work->full_waiters, &wait,TASK_INTERRUPTIBLE ); -else -prepare_to_wait (&work->waiters, &wait,TASK_INTERRUPTIBLE ); - -/* -* The events can happen in critical sections where -* checking a work queue can cause deadlocks. -* After adding a task to the queue, this flag is set -* only to notify events to try to wake up the queue -* using irq_work. -* -* We don't clear it even if the buffer is no longer -* empty. The flag only causes the next event to run -* irq_work to do the work queue wake up. The worse -* that can happen if we race with !trace_empty() is that -* an event will cause an irq_work to try to wake up -* an empty queue. -* -* There's no reason to protect this flag either, as -* the work queue and irq_work logic will do the necessary -* synchronization for the wake ups. The only thing -* that is necessary is that the wake up happens after -* a task has been queued. It's OK for spurious wake ups. -*/ -if (full) - work->full_waiters_pending = true; -else - work->waiters_pending = true; - -if (signal_pending (current)) { - ret = -EINTR ; -break ; - } - -if (cpu ==RING_BUFFER_ALL_CPUS && !ring_buffer_empty (buffer)) -break ; - -if (cpu !=RING_BUFFER_ALL_CPUS && - !ring_buffer_empty_cpu (buffer, cpu)) { -unsigned long flags; -bool pagebusy; -bool done; - -if (!full) -break ; - -raw_spin_lock_irqsave (&cpu_buffer->reader_lock, flags); - pagebusy = cpu_buffer->reader_page == cpu_buffer->commit_page; - done = !pagebusy &&full_hit (buffer, cpu, full); +if (full) +prepare_to_wait (&work->full_waiters, &wait,TASK_INTERRUPTIBLE ); +else +prepare_to_wait (&work->waiters, &wait,TASK_INTERRUPTIBLE ); -if (!cpu_buffer->shortest_full || - cpu_buffer->shortest_full > full) - cpu_buffer->shortest_full = full; -raw_spin_unlock_irqrestore (&cpu_buffer->reader_lock, flags); -if (done) -break ; - } +/* +* The events can happen in critical sections where +* checking a work queue can cause deadlocks. +* After adding a task to the queue, this flag is set +* only to notify events to try to wake up the queue +* using irq_work. +* +* We don't clear it even if the buffer is no longer +* empty. The flag only causes the next event to run +* irq_work to do the work queue wake up. The worse +* that can happen if we race with !trace_empty() is that +* an event will cause an irq_work to try to wake up +* an empty queue. +* +* There's no reason to protect this flag either, as +* the work queue and irq_work logic will do the necessary +* synchronization for the wake ups. The only thing +* that is necessary is that the wake up happens after +* a task has been queued. It's OK for spurious wake ups. +*/ +if (full) + work->full_waiters_pending = true; +else + work->waiters_pending = true; -schedule (); +if (rb_watermark_hit (buffer, cpu, full)) + goto out; -/* Make sure to see the new wait index */ -smp_rmb (); -if (wait_index != work->wait_index) -break ; +if (signal_pending (current)) { + ret = -EINTR ; + goto out; } +schedule (); + out:if (full)finish_wait (&work->full_waiters, &wait);else finish_wait (&work->waiters, &wait); +if (!ret && !rb_watermark_hit (buffer, cpu, full) &&signal_pending (current)) + ret = -EINTR ; +return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/294 ring-buffer: Do not set shortest_full when full target is hit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
[ Upstream commit 761d9473e27f0c8782895013a3e7b52a37c8bcfc ]
The rb_watermark_hit() checks if the amount of data in the ring buffer is above the percentage level passed in by the "full" variable. If it is, it returns true.
But it also sets the "shortest_full" field of the cpu_buffer that informs writers that it needs to call the irq_work if the amount of data on the ring buffer is above the requested amount.
The rb_watermark_hit() always sets the shortest_full even if the amount in the ring buffer is what it wants. As it is not going to wait, because it has what it wants, there's no reason to set shortest_full.
--- kernel/trace/ring_buffer.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
kernel/trace/ring_buffer.c +4 -3
@@ -887,9 +887,10 @@ static bool rb_watermark_hit(struct trace_buffer *buffer, int cpu, int full) pagebusy = cpu_buffer->reader_page == cpu_buffer->commit_page; ret = !pagebusy &&full_hit (buffer, cpu, full); -if (!cpu_buffer->shortest_full || - cpu_buffer->shortest_full > full) - cpu_buffer->shortest_full = full; +if (!ret && (!cpu_buffer->shortest_full || + cpu_buffer->shortest_full > full)) { + cpu_buffer->shortest_full = full; + }raw_spin_unlock_irqrestore (&cpu_buffer->reader_lock, flags); }return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/294 ring-buffer: Fix resetting of shortest_full
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
[ Upstream commit 68282dd930ea38b068ce2c109d12405f40df3f93 ]
The "shortest_full" variable is used to keep track of the waiter that is waiting for the smallest amount on the ring buffer before being woken up. When a tasks waits on the ring buffer, it passes in a "full" value that is a percentage. 0 means wake up on any data. 1-100 means wake up from 1% to 100% full buffer.
As all waiters are on the same wait queue, the wake up happens for the waiter with the smallest percentage.
The problem is that the smallest_full on the cpu_buffer that stores the smallest amount doesn't get reset when all the waiters are woken up. It does get reset when the ring buffer is reset (echo > /sys/kernel/tracing/trace).
This means that tasks may be woken up more often then when they want to be. Instead, have the shortest_full field get reset just before waking up all the tasks. If the tasks wait again, they will update the shortest_full before sleeping.
Also add locking around setting of shortest_full in the poll logic, and change "work" to "rbwork" to match the variable name for rb_irq_work structures that are used in other places.
Stable-dep-of: 8145f1c35fa6 ("ring-buffer: Fix full_waiters_pending in poll")
--- kernel/trace/ring_buffer.c | 30 +++++++++++++++++++++++------- 1 file changed, 23 insertions(+), 7 deletions(-)
kernel/trace/ring_buffer.c +23 -7
@@ -831,8 +831,19 @@ static void rb_wake_up_waiters(struct irq_work *work)wake_up_all (&rbwork->waiters);if (rbwork->full_waiters_pending || rbwork->wakeup_full) { +/* Only cpu_buffer sets the above flags */ +struct ring_buffer_per_cpu *cpu_buffer = + container_of(rbwork, struct ring_buffer_per_cpu, irq_work); + +/* Called from interrupt context */ +raw_spin_lock (&cpu_buffer->reader_lock); rbwork->wakeup_full = false; rbwork->full_waiters_pending = false; + +/* Waking up all waiters, they will reset the shortest full */ + cpu_buffer->shortest_full =0 ; +raw_spin_unlock (&cpu_buffer->reader_lock); +wake_up_all (&rbwork->full_waiters); } }
@@ -999,28 +1010,33 @@ __poll_t ring_buffer_poll_wait(struct trace_buffer *buffer, int cpu, struct file *filp, poll_table *poll_table, int full) { struct ring_buffer_per_cpu *cpu_buffer; -struct rb_irq_work *work; +struct rb_irq_work *rbwork;if (cpu ==RING_BUFFER_ALL_CPUS ) { - work = &buffer->irq_work; + rbwork = &buffer->irq_work; full =0 ; }else {if (!cpumask_test_cpu (cpu, buffer->cpumask))return EPOLLERR ; cpu_buffer = buffer->buffers[cpu]; - work = &cpu_buffer->irq_work; + rbwork = &cpu_buffer->irq_work; }if (full) { -poll_wait (filp, &work->full_waiters, poll_table); - work->full_waiters_pending = true; +unsigned long flags; + +poll_wait (filp, &rbwork->full_waiters, poll_table); + +raw_spin_lock_irqsave (&cpu_buffer->reader_lock, flags); + rbwork->full_waiters_pending = true;if (!cpu_buffer->shortest_full || cpu_buffer->shortest_full > full) cpu_buffer->shortest_full = full; +raw_spin_unlock_irqrestore (&cpu_buffer->reader_lock, flags); }else { -poll_wait (filp, &work->waiters, poll_table); - work->waiters_pending = true; +poll_wait (filp, &rbwork->waiters, poll_table); + rbwork->waiters_pending = true; }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/294 ring-buffer: Fix full_waiters_pending in poll
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
[ Upstream commit 8145f1c35fa648da662078efab299c4467b85ad5 ]
If a reader of the ring buffer is doing a poll, and waiting for the ring buffer to hit a specific watermark, there could be a case where it gets into an infinite ping-pong loop.
The poll code has:
rbwork->full_waiters_pending = true;
if (!cpu_buffer->shortest_full ||
cpu_buffer->shortest_full > full)
cpu_buffer->shortest_full = full;The writer will see full_waiters_pending and check if the ring buffer is filled over the percentage of the shortest_full value. If it is, it calls an irq_work to wake up all the waiters.
But the code could get into a circular loop:
CPU 0 CPU 1
----- -----
[ Poll ]
[ shortest_full = 0 ]
rbwork->full_waiters_pending = true;
if (rbwork->full_waiters_pending &&
[ buffer percent ] > shortest_full) {
rbwork->wakeup_full = true;
[ queue_irqwork ]cpu_buffer->shortest_full = full;
[ IRQ work ]
if (rbwork->wakeup_full) {
cpu_buffer->shortest_full = 0;
wakeup poll waiters;
[woken]
if ([ buffer percent ] > full)
break;
rbwork->full_waiters_pending = true;
if (rbwork->full_waiters_pending &&
[ buffer percent ] > shortest_full) {
rbwork->wakeup_full = true;
[ queue_irqwork ]cpu_buffer->shortest_full = full;
[ IRQ work ]
if (rbwork->wakeup_full) {
cpu_buffer->shortest_full = 0;
wakeup poll waiters;[woken]
[ Wash, rinse, repeat! ]
In the poll, the shortest_full needs to be set before the full_pending_waiters, as once that is set, the writer will compare the current shortest_full (which is incorrect) to decide to call the irq_work, which will reset the shortest_full (expecting the readers to update it).
Also move the setting of full_waiters_pending after the check if the ring buffer has the required percentage filled. There's no reason to tell the writer to wake up waiters if there are no waiters.
--- kernel/trace/ring_buffer.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-)
kernel/trace/ring_buffer.c +20 -7
@@ -1029,16 +1029,32 @@ __poll_t ring_buffer_poll_wait(struct trace_buffer *buffer, int cpu,poll_wait (filp, &rbwork->full_waiters, poll_table);raw_spin_lock_irqsave (&cpu_buffer->reader_lock, flags); - rbwork->full_waiters_pending = true;if (!cpu_buffer->shortest_full || cpu_buffer->shortest_full > full) cpu_buffer->shortest_full = full;raw_spin_unlock_irqrestore (&cpu_buffer->reader_lock, flags); - }else { -poll_wait (filp, &rbwork->waiters, poll_table); - rbwork->waiters_pending = true; +if (full_hit (buffer, cpu, full)) +return EPOLLIN |EPOLLRDNORM ; +/* +* Only allow full_waiters_pending update to be seen after +* the shortest_full is set. If the writer sees the +* full_waiters_pending flag set, it will compare the +* amount in the ring buffer to shortest_full. If the amount +* in the ring buffer is greater than the shortest_full +* percent, it will call the irq_work handler to wake up +* this list. The irq_handler will reset shortest_full +* back to zero. That's done under the reader_lock, but +* the below smp_mb() makes sure that the update to +* full_waiters_pending doesn't leak up into the above. +*/ +smp_mb (); + rbwork->full_waiters_pending = true; +return 0 ; } +poll_wait (filp, &rbwork->waiters, poll_table); + rbwork->waiters_pending = true; +/* * There's a tight race between setting the waiters_pending and * checking if the ring buffer is empty. Once the waiters_pending bit
@@ -1054,9 +1070,6 @@ __poll_t ring_buffer_poll_wait(struct trace_buffer *buffer, int cpu,*/ smp_mb (); -if (full) -return full_hit (buffer, cpu, full) ?EPOLLIN |EPOLLRDNORM :0 ; -if ((cpu ==RING_BUFFER_ALL_CPUS && !ring_buffer_empty (buffer)) || (cpu !=RING_BUFFER_ALL_CPUS && !ring_buffer_empty_cpu (buffer, cpu)))return EPOLLIN |EPOLLRDNORM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/294 soc: fsl: qbman: Always disable interrupts when taking cgr_lock
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit 584c2a9184a33a40fceee838f856de3cffa19be3 ]
smp_call_function_single disables IRQs when executing the callback. To prevent deadlocks, we must disable IRQs when taking cgr_lock elsewhere. This is already done by qman_update_cgr and qman_delete_cgr; fix the other lockers.
--- drivers/soc/fsl/qbman/qman.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/soc/fsl/qbman/qman.c +5 -5
@@ -1456,11 +1456,11 @@ static void qm_congestion_task(struct work_struct *work)union qm_mc_result *mcr;struct qman_cgr *cgr; -spin_lock (&p->cgr_lock); +spin_lock_irq (&p->cgr_lock);qm_mc_start (&p->p);qm_mc_commit (&p->p,QM_MCC_VERB_QUERYCONGESTION );if (!qm_mc_result_timeout (&p->p, &mcr)) { -spin_unlock (&p->cgr_lock); +spin_unlock_irq (&p->cgr_lock);dev_crit (p->config->dev,"QUERYCONGESTION timeout\n" );qman_p_irqsource_add (p,QM_PIRQ_CSCI );return ;
@@ -1476,7 +1476,7 @@ static void qm_congestion_task(struct work_struct *work)list_for_each_entry (cgr, &p->cgr_cbs, node)if (cgr->cb &&qman_cgrs_get (&c, cgr->cgrid)) cgr->cb (p, cgr,qman_cgrs_get (&rr, cgr->cgrid)); -spin_unlock (&p->cgr_lock); +spin_unlock_irq (&p->cgr_lock);qman_p_irqsource_add (p,QM_PIRQ_CSCI ); }
@@ -2440,7 +2440,7 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags,preempt_enable (); cgr->chan = p->config->channel; -spin_lock (&p->cgr_lock); +spin_lock_irq (&p->cgr_lock);if (opts) {struct qm_mcc_initcgr local_opts = *opts;
@@ -2477,7 +2477,7 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags, qman_cgrs_get(&p->cgrs[1], cgr->cgrid)) cgr->cb(p, cgr, 1); out: -spin_unlock (&p->cgr_lock); +spin_unlock_irq (&p->cgr_lock);put_affine_portal ();return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/294 soc: fsl: qbman: Add helper for sanity checking cgr ops
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit d0e17a4653cebc2c8a20251c837dd1fcec5014d9 ]
This breaks out/combines get_affine_portal and the cgr sanity check in preparation for the next commit. No functional change intended.
Stable-dep-of: fbec4e7fed89 ("soc: fsl: qbman: Use raw spinlock for cgr_lock")
--- drivers/soc/fsl/qbman/qman.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-)
drivers/soc/fsl/qbman/qman.c +19 -10
@@ -2483,13 +2483,8 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags, }EXPORT_SYMBOL (qman_create_cgr); -int qman_delete_cgr (struct qman_cgr *cgr) +static struct qman_portal *qman_cgr_get_affine_portal (struct qman_cgr *cgr) { -unsigned long irqflags; -struct qm_mcr_querycgr cgr_state; -struct qm_mcc_initcgr local_opts; -int ret =0 ; -struct qman_cgr *i;struct qman_portal *p =get_affine_portal ();if (cgr->chan != p->config->channel) {
@@ -2497,10 +2492,25 @@ int qman_delete_cgr(struct qman_cgr *cgr)dev_err (p->config->dev,"CGR not owned by current portal" );dev_dbg (p->config->dev," create 0x%x, delete 0x%x\n" , cgr->chan, p->config->channel); - - ret = -EINVAL ; - goto put_portal; +put_affine_portal (); +return NULL ; } + +return p; +} + +int qman_delete_cgr (struct qman_cgr *cgr) +{ +unsigned long irqflags; +struct qm_mcr_querycgr cgr_state; +struct qm_mcc_initcgr local_opts; +int ret =0 ; +struct qman_cgr *i; +struct qman_portal *p =qman_cgr_get_affine_portal (cgr); + +if (!p) +return -EINVAL ; +memset (&local_opts,0 ,sizeof (struct qm_mcc_initcgr ));spin_lock_irqsave (&p->cgr_lock, irqflags);list_del (&cgr->node);
@@ -2528,7 +2538,6 @@ int qman_delete_cgr(struct qman_cgr *cgr)list_add (&cgr->node, &p->cgr_cbs); release_lock:spin_unlock_irqrestore (&p->cgr_lock, irqflags); -put_portal:put_affine_portal ();return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/294 soc: fsl: qbman: Add CGR update function
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit 914f8b228ede709274b8c80514b352248ec9da00 ]
This adds a function to update a CGR with new parameters. qman_create_cgr can almost be used for this (with flags=0), but it's not suitable because it also registers the callback function. The _safe variant was modeled off of qman_cgr_delete_safe. However, we handle multiple arguments and a return value.
Stable-dep-of: fbec4e7fed89 ("soc: fsl: qbman: Use raw spinlock for cgr_lock")
--- drivers/soc/fsl/qbman/qman.c | 48 ++++++++++++++++++++++++++++++++++++ include/soc/fsl/qman.h | 9 +++++++ 2 files changed, 57 insertions(+)
drivers/soc/fsl/qbman/qman.c +48 -0
@@ -2568,6 +2568,54 @@ void qman_delete_cgr_safe(struct qman_cgr *cgr) }EXPORT_SYMBOL (qman_delete_cgr_safe); +static int qman_update_cgr (struct qman_cgr *cgr,struct qm_mcc_initcgr *opts) +{ +int ret; +unsigned long irqflags; +struct qman_portal *p =qman_cgr_get_affine_portal (cgr); + +if (!p) +return -EINVAL ; + +spin_lock_irqsave (&p->cgr_lock, irqflags); + ret =qm_modify_cgr (cgr,0 , opts); +spin_unlock_irqrestore (&p->cgr_lock, irqflags); +put_affine_portal (); +return ret; +} + +struct update_cgr_params { +struct qman_cgr *cgr; +struct qm_mcc_initcgr *opts; +int ret; +}; + +static void qman_update_cgr_smp_call (void *p) +{ +struct update_cgr_params *params = p; + + params->ret =qman_update_cgr (params->cgr, params->opts); +} + +int qman_update_cgr_safe (struct qman_cgr *cgr,struct qm_mcc_initcgr *opts) +{ +struct update_cgr_params params = { + .cgr = cgr, + .opts = opts, + }; + +preempt_disable (); +if (qman_cgr_cpus[cgr->cgrid] !=smp_processor_id ()) +smp_call_function_single (qman_cgr_cpus[cgr->cgrid], + qman_update_cgr_smp_call, ¶ms, + true); +else + params.ret =qman_update_cgr (cgr, opts); +preempt_enable (); +return params.ret; +} +EXPORT_SYMBOL (qman_update_cgr_safe); +/* Cleanup FQs */ static int _qm_mr_consume_and_match_verb (struct qm_portal *p,int v)
include/soc/fsl/qman.h +9 -0
@@ -1170,6 +1170,15 @@ int qman_delete_cgr(struct qman_cgr *cgr);*/ void qman_delete_cgr_safe (struct qman_cgr *cgr); +/** +* qman_update_cgr_safe - Modifies a congestion group object from any CPU +* @cgr: the 'cgr' object to modify +* @opts: state of the CGR settings +* +* This will select the proper CPU and modify the CGR settings. +*/ +int qman_update_cgr_safe (struct qman_cgr *cgr,struct qm_mcc_initcgr *opts); +/** * qman_query_cgr_congested - Queries CGR's congestion status * @cgr: the 'cgr' object to query
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/294 soc: fsl: qbman: Use raw spinlock for cgr_lock
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit fbec4e7fed89b579f2483041fabf9650fb0dd6bc ]
smp_call_function always runs its callback in hard IRQ context, even on PREEMPT_RT, where spinlocks can sleep. So we need to use a raw spinlock for cgr_lock to ensure we aren't waiting on a sleeping task.
Although this bug has existed for a while, it was not apparent until commit ef2a8d5478b9 ("net: dpaa: Adjust queue depth on rate change") which invokes smp_call_function_single via qman_update_cgr_safe every time a link goes up or down.
--- drivers/soc/fsl/qbman/qman.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-)
drivers/soc/fsl/qbman/qman.c +14 -11
@@ -991,7 +991,7 @@ struct qman_portal {/* linked-list of CSCN handlers. */ struct list_head cgr_cbs;/* list lock */ -spinlock_t cgr_lock; +raw_spinlock_t cgr_lock;struct work_struct congestion_work;struct work_struct mr_work;char irqname[MAX_IRQNAME ];
@@ -1281,7 +1281,7 @@ static int qman_create_portal(struct qman_portal *portal,/* if the given mask is NULL, assume all CGRs can be seen */ qman_cgrs_fill (&portal->cgrs[0 ]);INIT_LIST_HEAD (&portal->cgr_cbs); -spin_lock_init (&portal->cgr_lock); +raw_spin_lock_init (&portal->cgr_lock);INIT_WORK (&portal->congestion_work, qm_congestion_task);INIT_WORK (&portal->mr_work, qm_mr_process_task); portal->bits =0 ;
@@ -1456,11 +1456,14 @@ static void qm_congestion_task(struct work_struct *work)union qm_mc_result *mcr;struct qman_cgr *cgr; -spin_lock_irq (&p->cgr_lock); +/* +* FIXME: QM_MCR_TIMEOUT is 10ms, which is too long for a raw spinlock! +*/ +raw_spin_lock_irq (&p->cgr_lock);qm_mc_start (&p->p);qm_mc_commit (&p->p,QM_MCC_VERB_QUERYCONGESTION );if (!qm_mc_result_timeout (&p->p, &mcr)) { -spin_unlock_irq (&p->cgr_lock); +raw_spin_unlock_irq (&p->cgr_lock);dev_crit (p->config->dev,"QUERYCONGESTION timeout\n" );qman_p_irqsource_add (p,QM_PIRQ_CSCI );return ;
@@ -1476,7 +1479,7 @@ static void qm_congestion_task(struct work_struct *work)list_for_each_entry (cgr, &p->cgr_cbs, node)if (cgr->cb &&qman_cgrs_get (&c, cgr->cgrid)) cgr->cb (p, cgr,qman_cgrs_get (&rr, cgr->cgrid)); -spin_unlock_irq (&p->cgr_lock); +raw_spin_unlock_irq (&p->cgr_lock);qman_p_irqsource_add (p,QM_PIRQ_CSCI ); }
@@ -2440,7 +2443,7 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags,preempt_enable (); cgr->chan = p->config->channel; -spin_lock_irq (&p->cgr_lock); +raw_spin_lock_irq (&p->cgr_lock);if (opts) {struct qm_mcc_initcgr local_opts = *opts;
@@ -2477,7 +2480,7 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags, qman_cgrs_get(&p->cgrs[1], cgr->cgrid)) cgr->cb(p, cgr, 1); out: -spin_unlock_irq (&p->cgr_lock); +raw_spin_unlock_irq (&p->cgr_lock);put_affine_portal ();return ret; }
@@ -2512,7 +2515,7 @@ int qman_delete_cgr(struct qman_cgr *cgr)return -EINVAL ;memset (&local_opts,0 ,sizeof (struct qm_mcc_initcgr )); -spin_lock_irqsave (&p->cgr_lock, irqflags); +raw_spin_lock_irqsave (&p->cgr_lock, irqflags);list_del (&cgr->node);/* * If there are no other CGR objects for this CGRID in the list,
@@ -2537,7 +2540,7 @@ int qman_delete_cgr(struct qman_cgr *cgr)/* add back to the list */ list_add (&cgr->node, &p->cgr_cbs); release_lock: -spin_unlock_irqrestore (&p->cgr_lock, irqflags); +raw_spin_unlock_irqrestore (&p->cgr_lock, irqflags);put_affine_portal ();return ret; }
@@ -2577,9 +2580,9 @@ static int qman_update_cgr(struct qman_cgr *cgr, struct qm_mcc_initcgr *opts)if (!p)return -EINVAL ; -spin_lock_irqsave (&p->cgr_lock, irqflags); +raw_spin_lock_irqsave (&p->cgr_lock, irqflags); ret =qm_modify_cgr (cgr,0 , opts); -spin_unlock_irqrestore (&p->cgr_lock, irqflags); +raw_spin_unlock_irqrestore (&p->cgr_lock, irqflags);put_affine_portal ();return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/294 s390/zcrypt: fix reference counting on zcrypt card objects
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harald Freudenberger <[email protected]>
[ Upstream commit 50ed48c80fecbe17218afed4f8bed005c802976c ]
Tests with hot-plugging crytpo cards on KVM guests with debug kernel build revealed an use after free for the load field of the struct zcrypt_card. The reason was an incorrect reference handling of the zcrypt card object which could lead to a free of the zcrypt card object while it was still in use.
This is an example of the slab message:
kernel: 0x00000000885a7512-0x00000000885a7513 @offset=1298. First byte 0x68 instead of 0x6b
kernel: Allocated in zcrypt_card_alloc+0x36/0x70 [zcrypt] age=18046 cpu=3 pid=43
kernel: kmalloc_trace+0x3f2/0x470
kernel: zcrypt_card_alloc+0x36/0x70 [zcrypt]
kernel: zcrypt_cex4_card_probe+0x26/0x380 [zcrypt_cex4]
kernel: ap_device_probe+0x15c/0x290
kernel: really_probe+0xd2/0x468
kernel: driver_probe_device+0x40/0xf0
kernel: __device_attach_driver+0xc0/0x140
kernel: bus_for_each_drv+0x8c/0xd0
kernel: __device_attach+0x114/0x198
kernel: bus_probe_device+0xb4/0xc8
kernel: device_add+0x4d2/0x6e0
kernel: ap_scan_adapter+0x3d0/0x7c0
kernel: ap_scan_bus+0x5a/0x3b0
kernel: ap_scan_bus_wq_callback+0x40/0x60
kernel: process_one_work+0x26e/0x620
kernel: worker_thread+0x21c/0x440
kernel: Freed in zcrypt_card_put+0x54/0x80 [zcrypt] age=9024 cpu=3 pid=43
kernel: kfree+0x37e/0x418
kernel: zcrypt_card_put+0x54/0x80 [zcrypt]
kernel: ap_device_remove+0x4c/0xe0
kernel: device_release_driver_internal+0x1c4/0x270
kernel: bus_remove_device+0x100/0x188
kernel: device_del+0x164/0x3c0
kernel: device_unregister+0x30/0x90
kernel: ap_scan_adapter+0xc8/0x7c0
kernel: ap_scan_bus+0x5a/0x3b0
kernel: ap_scan_bus_wq_callback+0x40/0x60
kernel: process_one_work+0x26e/0x620
kernel: worker_thread+0x21c/0x440
kernel: kthread+0x150/0x168
kernel: __ret_from_fork+0x3c/0x58
kernel: ret_from_fork+0xa/0x30
kernel: Slab 0x00000372022169c0 objects=20 used=18 fp=0x00000000885a7c88 flags=0x3ffff00000000a00(workingset|slab|node=0|zone=1|lastcpupid=0x1ffff)
kernel: Object 0x00000000885a74b8 @offset=1208 fp=0x00000000885a7c88
kernel: Redzone 00000000885a74b0: bb bb bb bb bb bb bb bb ........
kernel: Object 00000000885a74b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
kernel: Object 00000000885a74c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
kernel: Object 00000000885a74d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
kernel: Object 00000000885a74e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
kernel: Object 00000000885a74f8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
kernel: Object 00000000885a7508: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 68 4b 6b 6b 6b a5 kkkkkkkkkkhKkkk.
kernel: Redzone 00000000885a7518: bb bb bb bb bb bb bb bb ........
kernel: Padding 00000000885a756c: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ
kernel: CPU: 0 PID: 387 Comm: systemd-udevd Not tainted 6.8.0-HF #2
kernel: Hardware name: IBM 3931 A01 704 (KVM/Linux)
kernel: Call Trace:
kernel: [<00000000ca5ab5b8>] dump_stack_lvl+0x90/0x120
kernel: [<00000000c99d78bc>] check_bytes_and_report+0x114/0x140
kernel: [<00000000c99d53cc>] check_object+0x334/0x3f8
kernel: [<00000000c99d820c>] alloc_debug_processing+0xc4/0x1f8
kernel: [<00000000c99d852e>] get_partial_node.part.0+0x1ee/0x3e0
kernel: [<00000000c99d94ec>] ___slab_alloc+0xaf4/0x13c8
kernel: [<00000000c99d9e38>] __slab_alloc.constprop.0+0x78/0xb8
kernel: [<00000000c99dc8dc>] __kmalloc+0x434/0x590
kernel: [<00000000c9b4c0ce>] ext4_htree_store_dirent+0x4e/0x1c0
kernel: [<00000000c9b908a2>] htree_dirblock_to_tree+0x17a/0x3f0
kernel: [<00000000c9b919dc>] ext4_htree_fill_tree+0x134/0x400
kernel: [<00000000c9b4b3d0>] ext4_dx_readdir+0x160/0x2f0
kernel: [<00000000c9b4bedc>] ext4_readdir+0x5f4/0x760
kernel: [<00000000c9a7efc4>] iterate_dir+0xb4/0x280
kernel: [<00000000c9a7f1ea>] __do_sys_getdents64+0x5a/0x120
kernel: [<00000000ca5d6946>] __do_syscall+0x256/0x310
kernel: [<00000000ca5eea10>] system_call+0x70/0x98
kernel: INFO: lockdep is turned off.
kernel: FIX kmalloc-96: Restoring Poison 0x00000000885a7512-0x00000000885a7513=0x6b
kernel: FIX kmalloc-96: Marking all objects usedThe fix is simple: Before use of the queue not only the queue object but also the card object needs to increase it's reference count with a call to zcrypt_card_get(). Similar after use of the queue not only the queue but also the card object's reference count is decreased with zcrypt_card_put().
--- drivers/s390/crypto/zcrypt_api.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/s390/crypto/zcrypt_api.c +2 -0
@@ -576,6 +576,7 @@ static inline struct zcrypt_queue *zcrypt_pick_queue(struct zcrypt_card *zc, {if (!zq || !try_module_get (zq->queue->ap_dev.drv->driver.owner))return NULL ; +zcrypt_card_get (zc);zcrypt_queue_get (zq);get_device (&zq->queue->ap_dev.device);atomic_add (weight, &zc->load);
@@ -595,6 +596,7 @@ static inline void zcrypt_drop_queue(struct zcrypt_card *zc,atomic_sub (weight, &zq->load);put_device (&zq->queue->ap_dev.device);zcrypt_queue_put (zq); +zcrypt_card_put (zc);module_put (mod); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/294 drm/panel: do not return negative error codes from drm_panel_get_modes()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <[email protected]>
[ Upstream commit fc4e97726530241d96dd7db72eb65979217422c9 ]
None of the callers of drm_panel_get_modes() expect it to return negative error codes. Either they propagate the return value in their struct drm_connector_helper_funcs .get_modes() hook (which is also not supposed to return negative codes), or add it to other counts leading to bogus values.
On the other hand, many of the struct drm_panel_funcs .get_modes() hooks do return negative error codes, so handle them gracefully instead of propagating further.
Return 0 for no modes, whatever the reason.
--- drivers/gpu/drm/drm_panel.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
drivers/gpu/drm/drm_panel.c +11 -6
@@ -207,19 +207,24 @@ EXPORT_SYMBOL(drm_panel_disable);* The modes probed from the panel are automatically added to the connector * that the panel is attached to. * -* Return: The number of modes available from the panel on success or a -* negative error code on failure. +* Return: The number of modes available from the panel on success, or 0 on +* failure (no modes). */ int drm_panel_get_modes (struct drm_panel *panel,struct drm_connector *connector) {if (!panel) -return -EINVAL ; +return 0 ; -if (panel->funcs && panel->funcs->get_modes) -return panel->funcs->get_modes (panel, connector); +if (panel->funcs && panel->funcs->get_modes) { +int num; -return -EOPNOTSUPP ; + num = panel->funcs->get_modes (panel, connector); +if (num >0 ) +return num; + } + +return 0 ; }EXPORT_SYMBOL (drm_panel_get_modes);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/294 drm/exynos: do not return negative values from .get_modes()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <[email protected]>
[ Upstream commit 13d5b040363c7ec0ac29c2de9cf661a24a8aa531 ]
The .get_modes() hooks aren't supposed to return negative error codes. Return 0 for no modes, whatever the reason.
--- drivers/gpu/drm/exynos/exynos_drm_vidi.c | 4 ++-- drivers/gpu/drm/exynos/exynos_hdmi.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/exynos/exynos_drm_vidi.c +2 -2
@@ -315,14 +315,14 @@ static int vidi_get_modes(struct drm_connector *connector)*/ if (!ctx->raw_edid) {DRM_DEV_DEBUG_KMS (ctx->dev,"raw_edid is null.\n" ); -return -EFAULT ; +return 0 ; } edid_len = (1 + ctx->raw_edid->extensions) *EDID_LENGTH ; edid =kmemdup (ctx->raw_edid, edid_len,GFP_KERNEL );if (!edid) {DRM_DEV_DEBUG_KMS (ctx->dev,"failed to allocate edid\n" ); -return -ENOMEM ; +return 0 ; }drm_connector_update_edid_property (connector, edid);
drivers/gpu/drm/exynos/exynos_hdmi.c +2 -2
@@ -878,11 +878,11 @@ static int hdmi_get_modes(struct drm_connector *connector)int ret;if (!hdata->ddc_adpt) -return -ENODEV ; +return 0 ; edid =drm_get_edid (connector, hdata->ddc_adpt);if (!edid) -return -ENODEV ; +return 0 ; hdata->dvi_mode = !drm_detect_hdmi_monitor (edid); DRM_DEV_DEBUG_KMS(hdata->dev, "%s : width[%d] x height[%d]\n",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/294 drm/imx/ipuv3: do not return negative values from .get_modes()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <[email protected]>
[ Upstream commit c2da9ada64962fcd2e6395ed9987b9874ea032d3 ]
The .get_modes() hooks aren't supposed to return negative error codes. Return 0 for no modes, whatever the reason.
--- drivers/gpu/drm/imx/parallel-display.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/imx/parallel-display.c +2 -2
@@ -65,14 +65,14 @@ static int imx_pd_connector_get_modes(struct drm_connector *connector)int ret;if (!mode) -return -EINVAL ; +return 0 ; ret =of_get_drm_display_mode (np, &imxpd->mode, &imxpd->bus_flags,OF_USE_NATIVE_MODE );if (ret) {drm_mode_destroy (connector->dev, mode); -return ret; +return 0 ; }drm_mode_copy (mode, &imxpd->mode);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/294 drm/vc4: hdmi: do not return negative values from .get_modes()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <[email protected]>
[ Upstream commit abf493988e380f25242c1023275c68bd3579c9ce ]
The .get_modes() hooks aren't supposed to return negative error codes. Return 0 for no modes, whatever the reason.
--- drivers/gpu/drm/vc4/vc4_hdmi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/vc4/vc4_hdmi.c +1 -1
@@ -197,7 +197,7 @@ static int vc4_hdmi_connector_get_modes(struct drm_connector *connector) edid =drm_get_edid (connector, vc4_hdmi->ddc);cec_s_phys_addr_from_edid (vc4_hdmi->cec_adap, edid);if (!edid) -return -ENODEV ; +return 0 ; vc4_encoder->hdmi_monitor =drm_detect_hdmi_monitor (edid);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/294 memtest: use {READ,WRITE}_ONCE in memory scanning
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiang Zhang <[email protected]>
[ Upstream commit 82634d7e24271698e50a3ec811e5f50de790a65f ]
memtest failed to find bad memory when compiled with clang. So use {WRITE,READ}_ONCE to access memory to avoid compiler over optimization.
--- mm/memtest.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
mm/memtest.c +2 -2
@@ -46,10 +46,10 @@ static void __init memtest(u64 pattern, phys_addr_t start_phys, phys_addr_t size last_bad =0 ;for (p = start; p < end; p++) - *p = pattern; +WRITE_ONCE (*p, pattern);for (p = start; p < end; p++, start_phys_aligned += incr) { -if (*p == pattern) +if (READ_ONCE (*p) == pattern)continue ;if (start_phys_aligned == last_bad + incr) { last_bad += incr;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/294 nilfs2: fix failure to detect DAT corruption in btree and direct mappings
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
[ Upstream commit f2f26b4a84a0ef41791bd2d70861c8eac748f4ba ]
Patch series "nilfs2: fix kernel bug at submit_bh_wbc()".
This resolves a kernel BUG reported by syzbot. Since there are two flaws involved, I've made each one a separate patch.
The first patch alone resolves the syzbot-reported bug, but I think both fixes should be sent to stable, so I've tagged them as such.
This patch (of 2):
Syzbot has reported a kernel bug in submit_bh_wbc() when writing file data to a nilfs2 file system whose metadata is corrupted.
There are two flaws involved in this issue.
The first flaw is that when nilfs_get_block() locates a data block using btree or direct mapping, if the disk address translation routine nilfs_dat_translate() fails with internal code -ENOENT due to DAT metadata corruption, it can be passed back to nilfs_get_block(). This causes nilfs_get_block() to misidentify an existing block as non-existent, causing both data block lookup and insertion to fail inconsistently.
The second flaw is that nilfs_get_block() returns a successful status in this inconsistent state. This causes the caller __block_write_begin_int() or others to request a read even though the buffer is not mapped, resulting in a BUG_ON check for the BH_Mapped flag in submit_bh_wbc() failing.
This fixes the first issue by changing the return value to code -EINVAL when a conversion using DAT fails with code -ENOENT, avoiding the conflicting condition that leads to the kernel bug described above. Here, code -EINVAL indicates that metadata corruption was detected during the block lookup, which will be properly handled as a file system error and converted to -EIO when passing through the nilfs2 bmap layer.
--- fs/nilfs2/btree.c | 9 +++++++-- fs/nilfs2/direct.c | 9 +++++++-- 2 files changed, 14 insertions(+), 4 deletions(-)
fs/nilfs2/btree.c +7 -2
@@ -724,7 +724,7 @@ static int nilfs_btree_lookup_contig(const struct nilfs_bmap *btree, dat =nilfs_bmap_get_dat (btree); ret =nilfs_dat_translate (dat, ptr, &blocknr);if (ret <0 ) - goto out; + goto dat_error; ptr = blocknr; } cnt =1 ;
@@ -743,7 +743,7 @@ static int nilfs_btree_lookup_contig(const struct nilfs_bmap *btree,if (dat) { ret =nilfs_dat_translate (dat, ptr2, &blocknr);if (ret <0 ) - goto out; + goto dat_error; ptr2 = blocknr; }if (ptr2 != ptr + cnt || ++cnt == maxblocks)
@@ -782,6 +782,11 @@ static int nilfs_btree_lookup_contig(const struct nilfs_bmap *btree, out:nilfs_btree_free_path (path);return ret; + + dat_error: +if (ret == -ENOENT ) + ret = -EINVAL ;/* Notify bmap layer of metadata corruption */ + goto out; } static void nilfs_btree_promote_key(struct nilfs_bmap *btree,
fs/nilfs2/direct.c +7 -2
@@ -66,7 +66,7 @@ static int nilfs_direct_lookup_contig(const struct nilfs_bmap *direct, dat =nilfs_bmap_get_dat (direct); ret =nilfs_dat_translate (dat, ptr, &blocknr);if (ret <0 ) -return ret; + goto dat_error; ptr = blocknr; }
@@ -79,7 +79,7 @@ static int nilfs_direct_lookup_contig(const struct nilfs_bmap *direct,if (dat) { ret =nilfs_dat_translate (dat, ptr2, &blocknr);if (ret <0 ) -return ret; + goto dat_error; ptr2 = blocknr; }if (ptr2 != ptr + cnt)
@@ -87,6 +87,11 @@ static int nilfs_direct_lookup_contig(const struct nilfs_bmap *direct, } *ptrp = ptr;return cnt; + + dat_error: +if (ret == -ENOENT ) + ret = -EINVAL ;/* Notify bmap layer of metadata corruption */ +return ret; } static __u64
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/294 nilfs2: prevent kernel bug at submit_bh_wbc()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
[ Upstream commit 269cdf353b5bdd15f1a079671b0f889113865f20 ]
Fix a bug where nilfs_get_block() returns a successful status when searching and inserting the specified block both fail inconsistently. If this inconsistent behavior is not due to a previously fixed bug, then an unexpected race is occurring, so return a temporary error -EAGAIN instead.
This prevents callers such as __block_write_begin_int() from requesting a read into a buffer that is not mapped, which would cause the BUG_ON check for the BH_Mapped flag in submit_bh_wbc() to fail.
--- fs/nilfs2/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nilfs2/inode.c +1 -1
@@ -112,7 +112,7 @@ int nilfs_get_block(struct inode *inode, sector_t blkoff,"%s (ino=%lu): a race condition while inserting a data block at offset=%llu" , __func__, inode->i_ino, (unsigned long long)blkoff); - err =0 ; + err = -EAGAIN ; }nilfs_transaction_abort (inode->i_sb); goto out;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/294 cpufreq: dt: always allocate zeroed cpumask
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
[ Upstream commit d2399501c2c081eac703ca9597ceb83c7875a537 ]
Commit 0499a78369ad ("ARM64: Dynamically allocate cpumasks and increase supported CPUs to 512") changed the handling of cpumasks on ARM 64bit, what resulted in the strange issues and warnings during cpufreq-dt initialization on some big.LITTLE platforms.
This was caused by mixing OPPs between big and LITTLE cores, because OPP-sharing information between big and LITTLE cores is computed on cpumask, which in turn was not zeroed on allocation. Fix this by switching to zalloc_cpumask_var() call.
--- drivers/cpufreq/cpufreq-dt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cpufreq/cpufreq-dt.c +1 -1
@@ -251,7 +251,7 @@ static int dt_cpufreq_early_init(struct device *dev, int cpu)if (!priv)return -ENOMEM ; -if (!alloc_cpumask_var (&priv->cpus,GFP_KERNEL )) +if (!zalloc_cpumask_var (&priv->cpus,GFP_KERNEL ))return -ENOMEM ; priv->cpu_dev = cpu_dev;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/294 x86/CPU/AMD: Update the Zenbleed microcode revisions
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
[ Upstream commit 5c84b051bd4e777cf37aaff983277e58c99618d5 ]
Update them to the correct revision numbers.
--- arch/x86/kernel/cpu/amd.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/x86/kernel/cpu/amd.c +5 -5
@@ -1049,11 +1049,11 @@ static bool cpu_has_zenbleed_microcode(void)u32 good_rev =0 ;switch (boot_cpu_data.x86_model) { - case 0x30 ... 0x3f: good_rev = 0x0830107a; break; - case 0x60 ... 0x67: good_rev = 0x0860010b; break; - case 0x68 ... 0x6f: good_rev = 0x08608105; break; - case 0x70 ... 0x7f: good_rev = 0x08701032; break; - case 0xa0 ... 0xaf: good_rev = 0x08a00008; break; + case 0x30 ... 0x3f: good_rev = 0x0830107b; break; + case 0x60 ... 0x67: good_rev = 0x0860010c; break; + case 0x68 ... 0x6f: good_rev = 0x08608107; break; + case 0x70 ... 0x7f: good_rev = 0x08701033; break; + case 0xa0 ... 0xaf: good_rev = 0x08a00009; break;default :return false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/294 net: hns3: tracing: fix hclgevf trace event strings
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
[ Upstream commit 3f9952e8d80cca2da3b47ecd5ad9ec16cfd1a649 ]
The __string() and __assign_str() helper macros of the TRACE_EVENT() macro are going through some optimizations where only the source string of __string() will be used and the __assign_str() source will be ignored and later removed.
To make sure that there's no issues, a new check is added between the __string() src argument and the __assign_str() src argument that does a strcmp() to make sure they are the same string.
The hclgevf trace events have:
__assign_str(devname, &hdev->nic.kinfo.netdev->name);
Which triggers the warning:
hclgevf_trace.h:34:39: error: passing argument 1 of ‘strcmp’ from incompatible pointer type [-Werror=incompatible-pointer-types]
34 | __assign_str(devname, &hdev->nic.kinfo.netdev->name);
[..]arch/x86/include/asm/string_64.h:75:24: note: expected ‘const char *’ but argument is of type ‘char (*)[16]’
75 | int strcmp(const char *cs, const char *ct);
| ~~~~~~~~~~~~^~Because __assign_str() now has:
WARN_ON_ONCE(__builtin_constant_p(src) ? \ strcmp((src), __data_offsets.dst##_ptr_) : \ (src) != __data_offsets.dst##_ptr_); \
The problem is the '&' on hdev->nic.kinfo.netdev->name. That's because that name is:
char name[IFNAMSIZ]
Where passing an address '&' of a char array is not compatible with strcmp().
The '&' is not necessary, remove it.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_trace.h | 8 ++++---- .../net/ethernet/hisilicon/hns3/hns3vf/hclgevf_trace.h | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_trace.h +4 -4
@@ -24,7 +24,7 @@ TRACE_EVENT(hclge_pf_mbx_get, __field(u8, code) __field(u8, subcode) __string(pciname, pci_name(hdev->pdev)) - __string(devname, &hdev->vport[0].nic.kinfo.netdev->name) + __string(devname, hdev->vport[0].nic.kinfo.netdev->name)__array (u32, mbx_data,PF_GET_MBX_LEN ) ),
@@ -33,7 +33,7 @@ TRACE_EVENT(hclge_pf_mbx_get, __entry->code = req->msg.code; __entry->subcode = req->msg.subcode;__assign_str (pciname,pci_name (hdev->pdev)); -__assign_str (devname, &hdev->vport[0 ].nic.kinfo.netdev->name); +__assign_str (devname, hdev->vport[0 ].nic.kinfo.netdev->name);memcpy (__entry->mbx_data, req,sizeof (struct hclge_mbx_vf_to_pf_cmd )); ),
@@ -56,7 +56,7 @@ TRACE_EVENT(hclge_pf_mbx_send, __field(u8, vfid) __field(u16, code) __string(pciname, pci_name(hdev->pdev)) - __string(devname, &hdev->vport[0].nic.kinfo.netdev->name) + __string(devname, hdev->vport[0].nic.kinfo.netdev->name)__array (u32, mbx_data,PF_SEND_MBX_LEN ) ),
@@ -64,7 +64,7 @@ TRACE_EVENT(hclge_pf_mbx_send, __entry->vfid = req->dest_vfid; __entry->code = req->msg.code;__assign_str (pciname,pci_name (hdev->pdev)); -__assign_str (devname, &hdev->vport[0 ].nic.kinfo.netdev->name); +__assign_str (devname, hdev->vport[0 ].nic.kinfo.netdev->name);memcpy (__entry->mbx_data, req,sizeof (struct hclge_mbx_pf_to_vf_cmd )); ),
drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_trace.h +4 -4
@@ -23,7 +23,7 @@ TRACE_EVENT(hclge_vf_mbx_get, __field(u8, vfid) __field(u16, code) __string(pciname, pci_name(hdev->pdev)) - __string(devname, &hdev->nic.kinfo.netdev->name) + __string(devname, hdev->nic.kinfo.netdev->name)__array (u32, mbx_data,VF_GET_MBX_LEN ) ),
@@ -31,7 +31,7 @@ TRACE_EVENT(hclge_vf_mbx_get, __entry->vfid = req->dest_vfid; __entry->code = req->msg.code;__assign_str (pciname,pci_name (hdev->pdev)); -__assign_str (devname, &hdev->nic.kinfo.netdev->name); +__assign_str (devname, hdev->nic.kinfo.netdev->name);memcpy (__entry->mbx_data, req,sizeof (struct hclge_mbx_pf_to_vf_cmd )); ),
@@ -55,7 +55,7 @@ TRACE_EVENT(hclge_vf_mbx_send, __field(u8, code) __field(u8, subcode) __string(pciname, pci_name(hdev->pdev)) - __string(devname, &hdev->nic.kinfo.netdev->name) + __string(devname, hdev->nic.kinfo.netdev->name)__array (u32, mbx_data,VF_SEND_MBX_LEN ) ),
@@ -64,7 +64,7 @@ TRACE_EVENT(hclge_vf_mbx_send, __entry->code = req->msg.code; __entry->subcode = req->msg.subcode;__assign_str (pciname,pci_name (hdev->pdev)); -__assign_str (devname, &hdev->nic.kinfo.netdev->name); +__assign_str (devname, hdev->nic.kinfo.netdev->name);memcpy (__entry->mbx_data, req,sizeof (struct hclge_mbx_vf_to_pf_cmd )); ),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/294 wireguard: netlink: check for dangling peer via is_dead instead of empty list
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason A. Donenfeld <[email protected]>
[ Upstream commit 55b6c738673871c9b0edae05d0c97995c1ff08c4 ]
If all peers are removed via wg_peer_remove_all(), rather than setting peer_list to empty, the peer is added to a temporary list with a head on the stack of wg_peer_remove_all(). If a netlink dump is resumed and the cursored peer is one that has been removed via wg_peer_remove_all(), it will iterate from that peer and then attempt to dump freed peers.
Fix this by instead checking peer->is_dead, which was explictly created for this purpose. Also move up the device_update_lock lockdep assertion, since reading is_dead relies on that.
It can be reproduced by a small script like:
echo "Setting config..."
ip link add dev wg0 type wireguard
wg setconf wg0 /big-config
(
while true; do
echo "Showing config..."
wg showconf wg0 > /dev/null
done
) &
sleep 4
wg setconf wg0 <(printf "[Peer]\nPublicKey=$(wg genkey)\n")
Resulting in:
BUG: KASAN: slab-use-after-free in __lock_acquire+0x182a/0x1b20
Read of size 8 at addr ffff88811956ec70 by task wg/59
CPU: 2 PID: 59 Comm: wg Not tainted 6.8.0-rc2-debug+ #5
Call Trace:
<TASK>
dump_stack_lvl+0x47/0x70
print_address_description.constprop.0+0x2c/0x380
print_report+0xab/0x250
kasan_report+0xba/0xf0
__lock_acquire+0x182a/0x1b20
lock_acquire+0x191/0x4b0
down_read+0x80/0x440
get_peer+0x140/0xcb0
wg_get_device_dump+0x471/0x1130--- drivers/net/wireguard/netlink.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireguard/netlink.c +3 -3
@@ -255,17 +255,17 @@ static int wg_get_device_dump(struct sk_buff *skb, struct netlink_callback *cb)if (!peers_nest) goto out; ret =0 ; -/* If the last cursor was removed via list_del_init in peer_remove, then +lockdep_assert_held (&wg->device_update_lock); +/* If the last cursor was removed in peer_remove or peer_remove_all, then * we just treat this the same as there being no more peers left. The * reason is that seq_nr should indicate to userspace that this isn't a * coherent dump anyway, so they'll try again. */ if (list_empty (&wg->peer_list) || - (ctx->next_peer &&list_empty (&ctx->next_peer->peer_list))) { + (ctx->next_peer && ctx->next_peer->is_dead)) {nla_nest_cancel (skb, peers_nest); goto out; } -lockdep_assert_held (&wg->device_update_lock); peer =list_prepare_entry (ctx->next_peer, &wg->peer_list, peer_list);list_for_each_entry_continue (peer, &wg->peer_list, peer_list) {if (get_peer (peer, skb, ctx)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/294 wireguard: netlink: access device through ctx instead of peer
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason A. Donenfeld <[email protected]>
[ Upstream commit 71cbd32e3db82ea4a74e3ef9aeeaa6971969c86f ]
The previous commit fixed a bug that led to a NULL peer->device being dereferenced. It's actually easier and faster performance-wise to instead get the device from ctx->wg. This semantically makes more sense too, since ctx->wg->peer_allowedips.seq is compared with ctx->allowedips_seq, basing them both in ctx. This also acts as a defence in depth provision against freed peers.
--- drivers/net/wireguard/netlink.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireguard/netlink.c +2 -2
@@ -164,8 +164,8 @@ get_peer(struct wg_peer *peer, struct sk_buff *skb, struct dump_ctx *ctx)if (!allowedips_node) goto no_allowedips;if (!ctx->allowedips_seq) - ctx->allowedips_seq = peer->device->peer_allowedips.seq; -else if (ctx->allowedips_seq != peer->device->peer_allowedips.seq) + ctx->allowedips_seq = ctx->wg->peer_allowedips.seq; +else if (ctx->allowedips_seq != ctx->wg->peer_allowedips.seq) goto no_allowedips; allowedips_nest =nla_nest_start (skb,WGPEER_A_ALLOWEDIPS );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/294 ahci: asm1064: correct count of reported ports
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Jr. Melnikov <[email protected]>
[ Upstream commit 9815e39617541ef52d0dfac4be274ad378c6dc09 ]
The ASM1064 SATA host controller always reports wrongly, that it has 24 ports. But in reality, it only has four ports.
before:
ahci 0000:04:00.0: SSS flag set, parallel bus scan disabled
ahci 0000:04:00.0: AHCI 0001.0301 32 slots 24 ports 6 Gbps 0xffff0f impl SATA mode ahci 0000:04:00.0: flags: 64bit ncq sntf stag pm led only pio sxs deso sadm sds apst
after:
ahci 0000:04:00.0: ASM1064 has only four ports
ahci 0000:04:00.0: forcing port_map 0xffff0f -> 0xf
ahci 0000:04:00.0: SSS flag set, parallel bus scan disabled
ahci 0000:04:00.0: AHCI 0001.0301 32 slots 24 ports 6 Gbps 0xf impl SATA mode ahci 0000:04:00.0: flags: 64bit ncq sntf stag pm led only pio sxs deso sadm sds apst
Stable-dep-of: 6cd8adc3e189 ("ahci: asm1064: asm1166: don't limit reported ports")
--- drivers/ata/ahci.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/ata/ahci.c +11 -3
@@ -662,9 +662,17 @@ MODULE_PARM_DESC(mobile_lpm_policy, "Default LPM policy for mobile chipsets");static void ahci_pci_save_initial_config (struct pci_dev *pdev,struct ahci_host_priv *hpriv) { -if (pdev->vendor ==PCI_VENDOR_ID_ASMEDIA && pdev->device ==0x1166 ) { -dev_info (&pdev->dev,"ASM1166 has only six ports\n" ); - hpriv->saved_port_map =0x3f ; +if (pdev->vendor ==PCI_VENDOR_ID_ASMEDIA ) { +switch (pdev->device) { +case 0x1166 : +dev_info (&pdev->dev,"ASM1166 has only six ports\n" ); + hpriv->saved_port_map =0x3f ; +break ; +case 0x1064 : +dev_info (&pdev->dev,"ASM1064 has only four ports\n" ); + hpriv->saved_port_map =0xf ; +break ; + } }if (pdev->vendor ==PCI_VENDOR_ID_JMICRON && pdev->device ==0x2361 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/294 ahci: asm1064: asm1166: dont limit reported ports
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Conrad Kostecki <[email protected]>
[ Upstream commit 6cd8adc3e18960f6e59d797285ed34ef473cc896 ]
Previously, patches have been added to limit the reported count of SATA ports for asm1064 and asm1166 SATA controllers, as those controllers do report more ports than physically having.
While it is allowed to report more ports than physically having in CAP.NP, it is not allowed to report more ports than physically having in the PI (Ports Implemented) register, which is what these HBAs do. (This is a AHCI spec violation.)
Unfortunately, it seems that the PMP implementation in these ASMedia HBAs is also violating the AHCI and SATA-IO PMP specification.
What these HBAs do is that they do not report that they support PMP (CAP.SPM (Supports Port Multiplier) is not set).
Instead, they have decided to add extra "virtual" ports in the PI register that is used if a port multiplier is connected to any of the physical ports of the HBA.
Enumerating the devices behind the PMP as specified in the AHCI and SATA-IO specifications, by using PMP READ and PMP WRITE commands to the physical ports of the HBA is not possible, you have to use the "virtual" ports.
This is of course bad, because this gives us no way to detect the device and vendor ID of the PMP actually connected to the HBA, which means that we can not apply the proper PMP quirks for the PMP that is connected to the HBA.
Limiting the port map will thus stop these controllers from working with SATA Port Multipliers.
This patch reverts both patches for asm1064 and asm1166, so old behavior is restored and SATA PMP will work again, but it will also reintroduce the (minutes long) extra boot time for the ASMedia controllers that do not have a PMP connected (either on the PCIe card itself, or an external PMP).
However, a longer boot time for some, is the lesser evil compared to some other users not being able to detect their drives at all.
--- drivers/ata/ahci.c | 13 ------------- 1 file changed, 13 deletions(-)
drivers/ata/ahci.c +0 -13
@@ -662,19 +662,6 @@ MODULE_PARM_DESC(mobile_lpm_policy, "Default LPM policy for mobile chipsets");static void ahci_pci_save_initial_config (struct pci_dev *pdev,struct ahci_host_priv *hpriv) { -if (pdev->vendor ==PCI_VENDOR_ID_ASMEDIA ) { -switch (pdev->device) { -case 0x1166 : -dev_info (&pdev->dev,"ASM1166 has only six ports\n" ); - hpriv->saved_port_map =0x3f ; -break ; -case 0x1064 : -dev_info (&pdev->dev,"ASM1064 has only four ports\n" ); - hpriv->saved_port_map =0xf ; -break ; - } - } -if (pdev->vendor ==PCI_VENDOR_ID_JMICRON && pdev->device ==0x2361 ) {dev_info (&pdev->dev,"JMB361 has only one port\n" ); hpriv->force_port_map =1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/294 drm/amd/display: Return the correct HDCP error code
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rodrigo Siqueira <[email protected]>
[ Upstream commit e64b3f55e458ce7e2087a0051f47edabf74545e7 ]
[WHY & HOW]
If the display is null when creating an HDCP session, return a proper error code.
--- drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c +3 -0
@@ -405,6 +405,9 @@ enum mod_hdcp_status mod_hdcp_hdcp2_create_session(struct mod_hdcp *hdcp) hdcp_cmd = (struct ta_hdcp_shared_memory *)psp->hdcp_context.hdcp_shared_buf;memset (hdcp_cmd,0 ,sizeof (struct ta_hdcp_shared_memory )); +if (!display) +return MOD_HDCP_STATUS_DISPLAY_NOT_FOUND ; + hdcp_cmd->in_msg.hdcp2_create_session_v2.display_handle = display->index;if (hdcp->connection.link.adjust.hdcp2.force_type ==MOD_HDCP_FORCE_TYPE_0 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/294 drm/amd/display: Fix noise issue on HDMI AV mute
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Ma <[email protected]>
[ Upstream commit 69e3be6893a7e668660b05a966bead82bbddb01d ]
[Why]
When mode switching is triggered there is momentary noise visible on some HDMI TV or displays.
[How]
Wait for 2 frames to make sure we have enough time to send out AV mute and sink receives a full frame.
--- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c +11 -1
@@ -641,10 +641,20 @@ void dcn30_set_avmute(struct pipe_ctx *pipe_ctx, bool enable)if (pipe_ctx ==NULL )return ; -if (dc_is_hdmi_tmds_signal (pipe_ctx->stream->signal) && pipe_ctx->stream_res.stream_enc !=NULL ) +if (dc_is_hdmi_tmds_signal (pipe_ctx->stream->signal) && pipe_ctx->stream_res.stream_enc !=NULL ) { pipe_ctx->stream_res.stream_enc->funcs->set_avmute ( pipe_ctx->stream_res.stream_enc, enable); + +/* Wait for two frame to make sure AV mute is sent out */ +if (enable) { + pipe_ctx->stream_res.tg->funcs->wait_for_state (pipe_ctx->stream_res.tg,CRTC_STATE_VACTIVE ); + pipe_ctx->stream_res.tg->funcs->wait_for_state (pipe_ctx->stream_res.tg,CRTC_STATE_VBLANK ); + pipe_ctx->stream_res.tg->funcs->wait_for_state (pipe_ctx->stream_res.tg,CRTC_STATE_VACTIVE ); + pipe_ctx->stream_res.tg->funcs->wait_for_state (pipe_ctx->stream_res.tg,CRTC_STATE_VBLANK ); + pipe_ctx->stream_res.tg->funcs->wait_for_state (pipe_ctx->stream_res.tg,CRTC_STATE_VACTIVE ); + } + } }void dcn30_update_info_frame (struct pipe_ctx *pipe_ctx)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/294 dm snapshot: fix lockup in dm_exception_table_exit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
[ Upstream commit 6e7132ed3c07bd8a6ce3db4bb307ef2852b322dc ]
There was reported lockup when we exit a snapshot with many exceptions. Fix this by adding "cond_resched" to the loop that frees the exceptions.
--- drivers/md/dm-snap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/md/dm-snap.c +3 -1
@@ -685,8 +685,10 @@ static void dm_exception_table_exit(struct dm_exception_table *et,for (i =0 ; i < size; i++) { slot = et->table + i; -hlist_bl_for_each_entry_safe (ex, pos, n, slot, hash_list) +hlist_bl_for_each_entry_safe (ex, pos, n, slot, hash_list) {kmem_cache_free (mem, ex); +cond_resched (); + } }vfree (et->table);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/294 vxge: remove unnecessary cast in kfree()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Wang <[email protected]>
[ Upstream commit b6bf4776d9e2ed4b2552d1c252fff8de3786309a ]
Remove unnecessary cast in the argument to kfree.
Stable-dep-of: e3f269ed0acc ("x86/pm: Work around false positive kmemleak report in msr_build_context()")
--- drivers/net/ethernet/neterion/vxge/vxge-config.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/neterion/vxge/vxge-config.c +1 -1
@@ -1121,7 +1121,7 @@ static void __vxge_hw_blockpool_destroy(struct __vxge_hw_blockpool *blockpool)list_for_each_safe (p, n, &blockpool->free_entry_list) {list_del (&((struct __vxge_hw_blockpool_entry *)p)->item); -kfree ((void *)p); +kfree (p); }return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/294 x86/stackprotector/32: Make the canary into a regular percpu variable
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <[email protected]>
[ Upstream commit 3fb0fdb3bbe7aed495109b3296b06c2409734023 ]
On 32-bit kernels, the stackprotector canary is quite nasty -- it is stored at %gs:(20), which is nasty because 32-bit kernels use %fs for percpu storage. It's even nastier because it means that whether %gs contains userspace state or kernel state while running kernel code depends on whether stackprotector is enabled (this is CONFIG_X86_32_LAZY_GS), and this setting radically changes the way that segment selectors work. Supporting both variants is a maintenance and testing mess.
Merely rearranging so that percpu and the stack canary share the same segment would be messy as the 32-bit percpu address layout isn't currently compatible with putting a variable at a fixed offset.
Fortunately, GCC 8.1 added options that allow the stack canary to be accessed as %fs:__stack_chk_guard, effectively turning it into an ordinary percpu variable. This lets us get rid of all of the code to manage the stack canary GDT descriptor and the CONFIG_X86_32_LAZY_GS mess.
(That name is special. We could use any symbol we want for the
%fs-relative mode, but for CONFIG_SMP=n, gcc refuses to let us use any name other than __stack_chk_guard.)
Forcibly disable stackprotector on older compilers that don't support the new options and turn the stack canary into a percpu variable. The "lazy GS" approach is now used for all 32-bit configurations.
Also makes load_gs_index() work on 32-bit kernels. On 64-bit kernels, it loads the GS selector and updates the user GSBASE accordingly. (This is unchanged.) On 32-bit kernels, it loads the GS selector and updates GSBASE, which is now always the user base. This means that the overall effect is the same on 32-bit and 64-bit, which avoids some ifdeffery.
[ bp: Massage commit message. ]
Stable-dep-of: e3f269ed0acc ("x86/pm: Work around false positive kmemleak report in msr_build_context()")
--- arch/x86/Kconfig | 7 +- arch/x86/Makefile | 8 +++ arch/x86/entry/entry_32.S | 56 ++-------------- arch/x86/include/asm/processor.h | 15 ++--- arch/x86/include/asm/ptrace.h | 5 +- arch/x86/include/asm/segment.h | 30 +++------ arch/x86/include/asm/stackprotector.h | 79 +++++------------------ arch/x86/include/asm/suspend_32.h | 6 +- arch/x86/kernel/asm-offsets_32.c | 5 -- arch/x86/kernel/cpu/common.c | 5 +- arch/x86/kernel/doublefault_32.c | 4 +- arch/x86/kernel/head_32.S | 18 +----- arch/x86/kernel/setup_percpu.c | 1 - arch/x86/kernel/tls.c | 8 +-- arch/x86/lib/insn-eval.c | 4 -- arch/x86/platform/pvh/head.S | 14 ---- arch/x86/power/cpu.c | 6 +- arch/x86/xen/enlighten_pv.c | 1 - scripts/gcc-x86_32-has-stack-protector.sh | 6 +- 19 files changed, 60 insertions(+), 218 deletions(-)
arch/x86/Kconfig +2 -5
@@ -352,10 +352,6 @@ config X86_64_SMP def_bool y depends on X86_64 && SMP -config X86_32_LAZY_GS - def_bool y - depends on X86_32 && !STACKPROTECTOR - config ARCH_SUPPORTS_UPROBES def_bool y
@@ -378,7 +374,8 @@ config CC_HAS_SANE_STACKPROTECTOR default $(success,$(srctree)/scripts/gcc-x86_32-has-stack-protector.sh $(CC)) help We have to make sure stack protector is unconditionally disabled if - the compiler produces broken code. + the compiler produces broken code or if it does not let us control + the segment on 32-bit kernels. menu "Processor type and features"
arch/x86/Makefile +8 -0
@@ -87,6 +87,14 @@ ifeq ($(CONFIG_X86_32),y) # temporary until string.h is fixed KBUILD_CFLAGS += -ffreestanding + + ifeq ($(CONFIG_STACKPROTECTOR),y) + ifeq ($(CONFIG_SMP),y) + KBUILD_CFLAGS += -mstack-protector-guard-reg=fs -mstack-protector-guard-symbol=__stack_chk_guard + else + KBUILD_CFLAGS += -mstack-protector-guard=global + endif + endif else BITS := 64 UTS_MACHINE := x86_64
arch/x86/entry/entry_32.S +4 -52
81 lines not on this page · raw message
arch/x86/include/asm/processor.h +4 -11
@@ -441,6 +441,9 @@ struct fixed_percpu_data {* GCC hardcodes the stack canary as %gs:40. Since the * irq_stack is the object at %gs:0, we reserve the bottom * 48 bytes of the irq stack for the canary. +* +* Once we are willing to require -mstack-protector-guard-symbol= +* support for x86_64 stackprotector, we can get rid of this. */ char gs_base[40 ];unsigned long stack_canary;
@@ -461,17 +464,7 @@ extern asmlinkage void ignore_sysret(void);void current_save_fsgs (void );#else /* X86_64 */ #ifdef CONFIG_STACKPROTECTOR -/* -* Make sure stack canary segment base is cached-aligned: -* "For Intel Atom processors, avoid non zero segment base address -* that is not aligned to cache line boundary at all cost." -* (Optim Ref Manual Assembly/Compiler Coding Rule 15.) -*/ -struct stack_canary { -char __pad[20 ];/* canary at %gs:20 */ -unsigned long canary; -}; -DECLARE_PER_CPU_ALIGNED(struct stack_canary, stack_canary); +DECLARE_PER_CPU(unsigned long, __stack_chk_guard);#endif /* Per CPU softirq stack pointer */ DECLARE_PER_CPU(struct irq_stack *, softirq_stack_ptr);
arch/x86/include/asm/ptrace.h +4 -1
@@ -37,7 +37,10 @@ struct pt_regs {unsigned short __esh;unsigned short fs;unsigned short __fsh; -/* On interrupt, gs and __gsh store the vector number. */ +/* +* On interrupt, gs and __gsh store the vector number. They never +* store gs any more. +*/ unsigned short gs;unsigned short __gsh;/* On interrupt, this is the error code. */
arch/x86/include/asm/segment.h +8 -22
@@ -95,7 +95,7 @@* * 26 - ESPFIX small SS * 27 - per-cpu [ offset to per-cpu data area ] -* 28 - stack_canary-20 [ for stack protector ] <=== cacheline #8 +* 28 - unused * 29 - unused * 30 - unused * 31 - TSS for double fault handler
@@ -118,7 +118,6 @@#define GDT_ENTRY_ESPFIX_SS 26#define GDT_ENTRY_PERCPU 27 -#define GDT_ENTRY_STACK_CANARY 28#define GDT_ENTRY_DOUBLEFAULT_TSS 31
@@ -158,12 +157,6 @@# define __KERNEL_PERCPU 0#endif -#ifdef CONFIG_STACKPROTECTOR -# define __KERNEL_STACK_CANARY (GDT_ENTRY_STACK_CANARY*8) -#else -# define __KERNEL_STACK_CANARY 0 -#endif -#else /* 64-bit: */ #include <asm/cache.h>
@@ -364,22 +357,15 @@ static inline void __loadsegment_fs(unsigned short value) asm("mov %%" #seg ",%0":"=r" (value) : : "memory")/* -* x86-32 user GS accessors: +* x86-32 user GS accessors. This is ugly and could do with some cleaning up. */#ifdef CONFIG_X86_32 -# ifdef CONFIG_X86_32_LAZY_GS -# define get_user_gs (regs) (u16)({ unsigned long v; savesegment(gs, v); v; }) -# define set_user_gs (regs, v) loadsegment(gs, (unsigned long)(v)) -# define task_user_gs (tsk) ((tsk)->thread.gs) -# define lazy_save_gs (v) savesegment(gs, (v)) -# define lazy_load_gs (v) loadsegment(gs, (v)) -# else /* X86_32_LAZY_GS */ -# define get_user_gs (regs) (u16)((regs)->gs) -# define set_user_gs (regs, v) do { (regs)->gs = (v); } while (0) -# define task_user_gs (tsk) (task_pt_regs(tsk)->gs) -# define lazy_save_gs (v) do { } while (0) -# define lazy_load_gs (v) do { } while (0) -# endif /* X86_32_LAZY_GS */ +# define get_user_gs (regs) (u16)({ unsigned long v; savesegment(gs, v); v; }) +# define set_user_gs (regs, v) loadsegment(gs, (unsigned long)(v)) +# define task_user_gs (tsk) ((tsk)->thread.gs) +# define lazy_save_gs (v) savesegment(gs, (v)) +# define lazy_load_gs (v) loadsegment(gs, (v)) +# define load_gs_index (v) loadsegment(gs, (v))#endif /* X86_32 */ #endif /* !__ASSEMBLY__ */
arch/x86/include/asm/stackprotector.h +16 -63
115 lines not on this page · raw message
arch/x86/include/asm/suspend_32.h +2 -4
@@ -13,12 +13,10 @@/* image of the saved processor state */ struct saved_context {/* -* On x86_32, all segment registers, with the possible exception of -* gs, are saved at kernel entry in pt_regs. +* On x86_32, all segment registers except gs are saved at kernel +* entry in pt_regs. */ -#ifdef CONFIG_X86_32_LAZY_GS u16 gs; -#endif unsigned long cr0, cr2, cr3, cr4;u64 misc_enable;struct saved_msrs saved_msrs;
arch/x86/kernel/asm-offsets_32.c +0 -5
@@ -53,11 +53,6 @@ void foo(void) offsetof(struct cpu_entry_area, tss.x86_tss.sp1) - offsetofend(struct cpu_entry_area, entry_stack_page.stack)); -#ifdef CONFIG_STACKPROTECTOR -BLANK (); -OFFSET (stack_canary_offset, stack_canary, canary); -#endif -BLANK ();DEFINE (EFI_svam, offsetof(efi_runtime_services_t , set_virtual_address_map)); }
arch/x86/kernel/cpu/common.c +2 -3
@@ -166,7 +166,6 @@ DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = { [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff), [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff), - GDT_STACK_CANARY_INIT#endif } };EXPORT_PER_CPU_SYMBOL_GPL (gdt_page);
@@ -600,7 +599,6 @@ void load_percpu_segment(int cpu)__loadsegment_simple (gs,0 );wrmsrl (MSR_GS_BASE ,cpu_kernelmode_gs_base (cpu));#endif -load_stack_canary_segment (); }#ifdef CONFIG_X86_32
@@ -1940,7 +1938,8 @@ DEFINE_PER_CPU(unsigned long, cpu_current_top_of_stack) =EXPORT_PER_CPU_SYMBOL (cpu_current_top_of_stack);#ifdef CONFIG_STACKPROTECTOR -DEFINE_PER_CPU_ALIGNED(struct stack_canary, stack_canary); +DEFINE_PER_CPU(unsigned long, __stack_chk_guard); +EXPORT_PER_CPU_SYMBOL (__stack_chk_guard);#endif #endif /* CONFIG_X86_64 */
arch/x86/kernel/doublefault_32.c +1 -3
@@ -100,9 +100,7 @@ DEFINE_PER_CPU_PAGE_ALIGNED(struct doublefault_stack, doublefault_stack) = { .ss = __KERNEL_DS, .ds = __USER_DS, .fs = __KERNEL_PERCPU, -#ifndef CONFIG_X86_32_LAZY_GS - .gs = __KERNEL_STACK_CANARY, -#endif + .gs = 0, .__cr3 = __pa_nodebug(swapper_pg_dir), },
arch/x86/kernel/head_32.S +2 -16
@@ -319,8 +319,8 @@ SYM_FUNC_START(startup_32_smp) movl $(__KERNEL_PERCPU), %eax movl %eax,%fs # set this cpu's percpu - movl $(__KERNEL_STACK_CANARY),%eax - movl %eax,%gs + xorl %eax,%eax + movl %eax,%gs # clear possible garbage in %gs xorl %eax,%eax # Clear LDT lldt %ax
@@ -340,20 +340,6 @@ SYM_FUNC_END(startup_32_smp) */ __INIT setup_once: -#ifdef CONFIG_STACKPROTECTOR - /* - * Configure the stack canary. The linker can't handle this by - * relocation. Manually set base address in stack canary - * segment descriptor. - */ - movl $gdt_page,%eax - movl $stack_canary,%ecx - movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax) - shrl $16, %ecx - movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax) - movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax) -#endif - andl $0,setup_once_ref /* Once is enough, thanks */ RET
arch/x86/kernel/setup_percpu.c +0 -1
@@ -224,7 +224,6 @@ void __init setup_per_cpu_areas(void)per_cpu (this_cpu_off, cpu) =per_cpu_offset (cpu);per_cpu (cpu_number, cpu) = cpu;setup_percpu_segment (cpu); -setup_stack_canary_segment (cpu);/* * Copy data used in early init routines from the * initial arrays to the per cpu data areas. These
arch/x86/kernel/tls.c +1 -7
@@ -164,17 +164,11 @@ int do_set_thread_area(struct task_struct *p, int idx,savesegment (fs, sel);if (sel == modified_sel)loadsegment (fs, sel); - -savesegment (gs, sel); -if (sel == modified_sel) -load_gs_index (sel);#endif -#ifdef CONFIG_X86_32_LAZY_GS savesegment (gs, sel);if (sel == modified_sel) -loadsegment (gs, sel); -#endif +load_gs_index (sel); }else {#ifdef CONFIG_X86_64 if (p->thread.fsindex == modified_sel)
arch/x86/lib/insn-eval.c +0 -4
@@ -404,10 +404,6 @@ static short get_segment_selector(struct pt_regs *regs, int seg_reg_idx)case INAT_SEG_REG_FS :return (unsigned short )(regs->fs &0xffff );case INAT_SEG_REG_GS : -/* -* GS may or may not be in regs as per CONFIG_X86_32_LAZY_GS. -* The macro below takes care of both cases. -*/ return get_user_gs (regs);case INAT_SEG_REG_IGNORE :default :
arch/x86/platform/pvh/head.S +0 -14
@@ -45,10 +45,8 @@ #define PVH_GDT_ENTRY_CS 1 #define PVH_GDT_ENTRY_DS 2 -#define PVH_GDT_ENTRY_CANARY 3 #define PVH_CS_SEL (PVH_GDT_ENTRY_CS * 8) #define PVH_DS_SEL (PVH_GDT_ENTRY_DS * 8) -#define PVH_CANARY_SEL (PVH_GDT_ENTRY_CANARY * 8) SYM_CODE_START_LOCAL(pvh_start_xen) cld
@@ -109,17 +107,6 @@ SYM_CODE_START_LOCAL(pvh_start_xen) #else /* CONFIG_X86_64 */ - /* Set base address in stack canary descriptor. */ - movl $_pa(gdt_start),%eax - movl $_pa(canary),%ecx - movw %cx, (PVH_GDT_ENTRY_CANARY * 8) + 2(%eax) - shrl $16, %ecx - movb %cl, (PVH_GDT_ENTRY_CANARY * 8) + 4(%eax) - movb %ch, (PVH_GDT_ENTRY_CANARY * 8) + 7(%eax) - - mov $PVH_CANARY_SEL,%eax - mov %eax,%gs - call mk_early_pgtbl_32 mov $_pa(initial_page_table), %eax
@@ -163,7 +150,6 @@ SYM_DATA_START_LOCAL(gdt_start) .quad GDT_ENTRY(0xc09a, 0, 0xfffff) /* PVH_CS_SEL */ #endif .quad GDT_ENTRY(0xc092, 0, 0xfffff) /* PVH_DS_SEL */ - .quad GDT_ENTRY(0x4090, 0, 0x18) /* PVH_CANARY_SEL */ SYM_DATA_END_LABEL(gdt_start, SYM_L_LOCAL, gdt_end) .balign 16
arch/x86/power/cpu.c +1 -5
@@ -101,11 +101,8 @@ static void __save_processor_state(struct saved_context *ctxt)/* * segment registers */ -#ifdef CONFIG_X86_32_LAZY_GS savesegment (gs, ctxt->gs); -#endif #ifdef CONFIG_X86_64 -savesegment (gs, ctxt->gs);savesegment (fs, ctxt->fs);savesegment (ds, ctxt->ds);savesegment (es, ctxt->es);
@@ -234,7 +231,6 @@ static void notrace __restore_processor_state(struct saved_context *ctxt)wrmsrl (MSR_GS_BASE , ctxt->kernelmode_gs_base);#else loadsegment (fs, __KERNEL_PERCPU); -loadsegment (gs, __KERNEL_STACK_CANARY);#endif /* Restore the TSS, RO GDT, LDT, and usermode-relevant MSRs. */
@@ -257,7 +253,7 @@ static void notrace __restore_processor_state(struct saved_context *ctxt)*/ wrmsrl (MSR_FS_BASE , ctxt->fs_base);wrmsrl (MSR_KERNEL_GS_BASE , ctxt->usermode_gs_base); -#elif defined(CONFIG_X86_32_LAZY_GS ) +#else loadsegment (gs, ctxt->gs);#endif
arch/x86/xen/enlighten_pv.c +0 -1
@@ -1193,7 +1193,6 @@ static void __init xen_setup_gdt(int cpu) pv_ops.cpu.write_gdt_entry = xen_write_gdt_entry_boot; pv_ops.cpu.load_gdt = xen_load_gdt_boot; -setup_stack_canary_segment (cpu);switch_to_new_gdt (cpu); pv_ops.cpu.write_gdt_entry = xen_write_gdt_entry;
scripts/gcc-x86_32-has-stack-protector.sh +5 -1
@@ -1,4 +1,8 @@ #!/bin/sh # SPDX-License-Identifier: GPL-2.0 -echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -m32 -O0 -fstack-protector - -o - 2> /dev/null | grep -q "%gs" +# This requires GCC 8.1 or better. Specifically, we require +# -mstack-protector-guard-reg, added by +# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81708 + +echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -m32 -O0 -fstack-protector -mstack-protector-guard-reg=fs -mstack-protector-guard-symbol=__stack_chk_guard - -o - 2> /dev/null | grep -q "%fs"
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/294 x86/pm: Work around false positive kmemleak report in msr_build_context()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Altaparmakov <[email protected]>
[ Upstream commit e3f269ed0accbb22aa8f25d2daffa23c3fccd407 ]
Since:
7ee18d677989 ("x86/power: Make restore_processor_context() sane")
kmemleak reports this issue:
unreferenced object 0xf68241e0 (size 32):
comm "swapper/0", pid 1, jiffies 4294668610 (age 68.432s)
hex dump (first 32 bytes):
00 cc cc cc 29 10 01 c0 00 00 00 00 00 00 00 00 ....)...........
00 42 82 f6 cc cc cc cc cc cc cc cc cc cc cc cc .B..............
backtrace:
[<461c1d50>] __kmem_cache_alloc_node+0x106/0x260
[<ea65e13b>] __kmalloc+0x54/0x160
[<c3858cd2>] msr_build_context.constprop.0+0x35/0x100
[<46635aff>] pm_check_save_msr+0x63/0x80
[<6b6bb938>] do_one_initcall+0x41/0x1f0
[<3f3add60>] kernel_init_freeable+0x199/0x1e8
[<3b538fde>] kernel_init+0x1a/0x110
[<938ae2b2>] ret_from_fork+0x1c/0x28Which is a false positive.
Reproducer:
- Run rsync of whole kernel tree (multiple times if needed).
- start a kmemleak scan
- Note this is just an example: a lot of our internal tests hit these.
The root cause is similar to the fix in:
b0b592cf0836 x86/pm: Fix false positive kmemleak report in msr_build_context()
ie. the alignment within the packed struct saved_context which has everything unaligned as there is only "u16 gs;" at start of struct where in the past there were four u16 there thus aligning everything afterwards. The issue is with the fact that Kmemleak only searches for pointers that are aligned (see how pointers are scanned in kmemleak.c) so when the struct members are not aligned it doesn't see them.
Testing:
We run a lot of tests with our CI, and after applying this fix we do not see any kmemleak issues any more whilst without it we see hundreds of the above report. From a single, simple test run consisting of 416 individual test cases on kernel 5.10 x86 with kmemleak enabled we got 20 failures due to this, which is quite a lot. With this fix applied we get zero kmemleak related failures.
--- arch/x86/include/asm/suspend_32.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/x86/include/asm/suspend_32.h +5 -5
@@ -12,11 +12,6 @@/* image of the saved processor state */ struct saved_context { -/* -* On x86_32, all segment registers except gs are saved at kernel -* entry in pt_regs. -*/ -u16 gs;unsigned long cr0, cr2, cr3, cr4;u64 misc_enable;struct saved_msrs saved_msrs;
@@ -27,6 +22,11 @@ struct saved_context {unsigned long tr;unsigned long safety;unsigned long return_address; +/* +* On x86_32, all segment registers except gs are saved at kernel +* entry in pt_regs. +*/ +u16 gs;bool misc_enable_saved; } __attribute__((packed));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/294 scripts: kernel-doc: Fix syntax error due to undeclared args variable
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Salvatore Bonaccorso <[email protected]>
The backport of commit 3080ea5553cc ("stddef: Introduce DECLARE_FLEX_ARRAY() helper") to 5.10.y (as a prerequisite of another fix) modified scripts/kernel-doc and introduced a syntax error:
Global symbol "$args" requires explicit package name (did you forget to declare "my $args"?) at ./scripts/kernel-doc line 1236. Global symbol "$args" requires explicit package name (did you forget to declare "my $args"?) at ./scripts/kernel-doc line 1236. Execution of ./scripts/kernel-doc aborted due to compilation errors.
Note: The issue could be fixed in the 5.10.y series as well by backporting e86bdb24375a ("scripts: kernel-doc: reduce repeated regex expressions into variables") but just replacing the undeclared args back to ([^,)]+) was the most straightforward approach. The issue is specific to the backport to the 5.10.y series. Thus there is as well no upstream commit for this change.
--- scripts/kernel-doc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/kernel-doc +1 -1
@@ -1233,7 +1233,7 @@ sub dump_struct($$) { # replace DECLARE_KFIFO_PTR $members =~ s/DECLARE_KFIFO_PTR\s*\(([^,)]+),\s*([^,)]+)\)/$2 \*$1/gos; # replace DECLARE_FLEX_ARRAY - $members =~ s/(?:__)?DECLARE_FLEX_ARRAY\s*\($args,\s*$args\)/$1 $2\[\]/gos; + $members =~ s/(?:__)?DECLARE_FLEX_ARRAY\s*\(([^,)]+),\s*([^,)]+)\)/$1 $2\[\]/gos; my $declaration = $members; # Split nested struct/union elements as newer ones
Greg Kroah-Hartman
maintainerPATCH 117/294 comedi: comedi_test: Prevent timers rescheduling during deletion
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit f53641a6e849034a44bf80f50245a75d7a376025 upstream.
The comedi_test devices have a couple of timers (ai_timer and ao_timer) that can be started to simulate hardware interrupts. Their expiry functions normally reschedule the timer. The driver code calls either del_timer_sync() or del_timer() to delete the timers from the queue, but does not currently prevent the timers from rescheduling themselves so synchronized deletion may be ineffective.
Add a couple of boolean members (one for each timer: ai_timer_enable and ao_timer_enable) to the device private data structure to indicate whether the timers are allowed to reschedule themselves. Set the member to true when adding the timer to the queue, and to false when deleting the timer from the queue in the waveform_ai_cancel() and waveform_ao_cancel() functions.
The del_timer_sync() function is also called from the waveform_detach() function, but the timer enable members will already be set to false when that function is called, so no change is needed there.
--- drivers/staging/comedi/drivers/comedi_test.c | 30 +++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-)
drivers/staging/comedi/drivers/comedi_test.c +26 -4
@@ -87,6 +87,8 @@ struct waveform_private {struct comedi_device *dev;/* parent comedi device */ u64 ao_last_scan_time;/* time of previous AO scan in usec */ unsigned int ao_scan_period;/* AO scan period in usec */ + bool ai_timer_enable:1; /* should AI timer be running? */ + bool ao_timer_enable:1; /* should AO timer be running? */unsigned short ao_loopbacks[N_CHANS ]; };
@@ -236,8 +238,12 @@ static void waveform_ai_timer(struct tim time_increment = devpriv->ai_convert_time - now; else time_increment =1 ; -mod_timer (&devpriv->ai_timer, - jiffies +usecs_to_jiffies (time_increment)); +spin_lock (&dev->spinlock); +if (devpriv->ai_timer_enable) { +mod_timer (&devpriv->ai_timer, + jiffies +usecs_to_jiffies (time_increment)); + } +spin_unlock (&dev->spinlock); } overrun:
@@ -393,9 +399,12 @@ static int waveform_ai_cmd(struct comedi* Seem to need an extra jiffy here, otherwise timer expires slightly * early! */ +spin_lock_bh (&dev->spinlock); + devpriv->ai_timer_enable = true; devpriv->ai_timer.expires = jiffies +usecs_to_jiffies (devpriv->ai_convert_period) +1 ;add_timer (&devpriv->ai_timer); +spin_unlock_bh (&dev->spinlock);return 0 ; }
@@ -404,6 +413,9 @@ static int waveform_ai_cancel(struct com {struct waveform_private *devpriv = dev->private; +spin_lock_bh (&dev->spinlock); + devpriv->ai_timer_enable = false; +spin_unlock_bh (&dev->spinlock);if (in_softirq ()) {/* Assume we were called from the timer routine itself. */ del_timer (&devpriv->ai_timer);
@@ -495,8 +507,12 @@ static void waveform_ao_timer(struct timunsigned int time_inc = devpriv->ao_last_scan_time + devpriv->ao_scan_period - now; -mod_timer (&devpriv->ao_timer, - jiffies +usecs_to_jiffies (time_inc)); +spin_lock (&dev->spinlock); +if (devpriv->ao_timer_enable) { +mod_timer (&devpriv->ao_timer, + jiffies +usecs_to_jiffies (time_inc)); + } +spin_unlock (&dev->spinlock); } underrun:
@@ -517,9 +533,12 @@ static int waveform_ao_inttrig_start(str async->inttrig =NULL ; devpriv->ao_last_scan_time =ktime_to_us (ktime_get ()); +spin_lock_bh (&dev->spinlock); + devpriv->ao_timer_enable = true; devpriv->ao_timer.expires = jiffies +usecs_to_jiffies (devpriv->ao_scan_period);add_timer (&devpriv->ao_timer); +spin_unlock_bh (&dev->spinlock);return 1 ; }
@@ -604,6 +623,9 @@ static int waveform_ao_cancel(struct comstruct waveform_private *devpriv = dev->private; s->async->inttrig =NULL ; +spin_lock_bh (&dev->spinlock); + devpriv->ao_timer_enable = false; +spin_unlock_bh (&dev->spinlock);if (in_softirq ()) {/* Assume we were called from the timer routine itself. */ del_timer (&devpriv->ao_timer);
Greg Kroah-Hartman
maintainerPATCH 118/294 cpufreq: brcmstb-avs-cpufreq: fix up "add check for cpufreq_cpu_gets return value"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
In commit 9127599c075c ("cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value"), build warnings occur because a variable is created after some logic, resulting in:
drivers/cpufreq/brcmstb-avs-cpufreq.c: In function 'brcm_avs_cpufreq_get':drivers/cpufreq/brcmstb-avs-cpufreq.c:486:9: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
486 | struct private_data *priv = policy->driver_data;
| ^~~~~~cc1: all warnings being treated as errors
make[2]: *** [scripts/Makefile.build:289:drivers/cpufreq/brcmstb-avs-cpufreq.o] Error 1
make[1]: *** [scripts/Makefile.build:552: drivers/cpufreq] Error 2 make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:1907: drivers] Error 2
Fix this up.
--- drivers/cpufreq/brcmstb-avs-cpufreq.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/cpufreq/brcmstb-avs-cpufreq.c +3 -2
@@ -481,10 +481,11 @@ static bool brcm_avs_is_firmware_loaded(static unsigned int brcm_avs_cpufreq_get (unsigned int cpu) {struct cpufreq_policy *policy =cpufreq_cpu_get (cpu); +struct private_data *priv; +if (!policy)return 0 ; -struct private_data *priv = policy->driver_data; - + priv = policy->driver_data;cpufreq_cpu_put (policy);return brcm_avs_get_frequency (priv->base);
Greg Kroah-Hartman
maintainerPATCH 119/294 netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 552705a3650bbf46a22b1adedc1b04181490fc36 upstream.
While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path.
Mingi Cho originally reported this issue in a different path in 6.1.x with a pipapo set with low timeouts which is not possible upstream since 7395dfacfff6 ("netfilter: nf_tables: use timestamp to check for set element timeout").
Fix this by setting on the dead flag for anonymous sets to skip async gc in this case.
According to 08e4c8c5919f ("netfilter: nf_tables: mark newset as dead on transaction abort"), Florian plans to accelerate abort path by releasing objects via workqueue, therefore, this sets on the dead flag for abort path too.
--- net/netfilter/nf_tables_api.c | 1 + 1 file changed, 1 insertion(+)
net/netfilter/nf_tables_api.c +1 -0
@@ -4754,6 +4754,7 @@ static void nf_tables_unbind_set(const sif (list_empty (&set->bindings) &&nft_set_is_anonymous (set)) {list_del_rcu (&set->list); + set->dead =1 ;if (event)nf_tables_set_notify (ctx, set,NFT_MSG_DELSET ,GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 120/294 netfilter: nf_tables: disallow anonymous set with timeout flag
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 16603605b667b70da974bea8216c93e7db043bf1 upstream.
Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work.
--- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nf_tables_api.c +3 -0
@@ -4410,6 +4410,9 @@ static int nf_tables_newset(struct net *if ((flags & (NFT_SET_EVAL |NFT_SET_OBJECT )) == (NFT_SET_EVAL |NFT_SET_OBJECT ))return -EOPNOTSUPP ; +if ((flags & (NFT_SET_ANONYMOUS |NFT_SET_TIMEOUT |NFT_SET_EVAL )) == + (NFT_SET_ANONYMOUS |NFT_SET_TIMEOUT )) +return -EOPNOTSUPP ; } dtype =0 ;
Greg Kroah-Hartman
maintainerPATCH 121/294 netfilter: nf_tables: reject constant set with timeout
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 5f4fc4bd5cddb4770ab120ce44f02695c4505562 upstream.
This set combination is weird: it allows for elements to be added/deleted, but once bound to the rule it cannot be updated anymore. Eventually, all elements expire, leading to an empty set which cannot be updated anymore. Reject this flags combination.
--- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nf_tables_api.c +3 -0
@@ -4413,6 +4413,9 @@ static int nf_tables_newset(struct net *if ((flags & (NFT_SET_ANONYMOUS |NFT_SET_TIMEOUT |NFT_SET_EVAL )) == (NFT_SET_ANONYMOUS |NFT_SET_TIMEOUT ))return -EOPNOTSUPP ; +if ((flags & (NFT_SET_CONSTANT |NFT_SET_TIMEOUT )) == + (NFT_SET_CONSTANT |NFT_SET_TIMEOUT )) +return -EOPNOTSUPP ; } dtype =0 ;
Greg Kroah-Hartman
maintainerPATCH 122/294 Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of memory
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
commit b8209544296edbd1af186e2ea9c648642c37b18c upstream.
The VMBUS_RING_SIZE macro adds space for a ring buffer header to the requested ring buffer size. The header size is always 1 page, and so its size varies based on the PAGE_SIZE for which the kernel is built. If the requested ring buffer size is a large power-of-2 size and the header size is small, the resulting size is inefficient in its use of memory. For example, a 512 Kbyte ring buffer with a 4 Kbyte page size results in a 516 Kbyte allocation, which is rounded to up 1 Mbyte by the memory allocator, and wastes 508 Kbytes of memory.
In such situations, the exact size of the ring buffer isn't that important, and it's OK to allocate the 4 Kbyte header at the beginning of the 512 Kbytes, leaving the ring buffer itself with just 508 Kbytes. The memory allocation can be 512 Kbytes instead of 1 Mbyte and nothing is wasted.
Update VMBUS_RING_SIZE to implement this approach for "large" ring buffer sizes. "Large" is somewhat arbitrarily defined as 8 times the size of the ring buffer header (which is of size PAGE_SIZE). For example, for 4 Kbyte PAGE_SIZE, ring buffers of 32 Kbytes and larger use the first 4 Kbytes as the ring buffer header. For 64 Kbyte PAGE_SIZE, ring buffers of 512 Kbytes and larger use the first 64 Kbytes as the ring buffer header. In both cases, smaller sizes add space for the header so the ring size isn't reduced too much by using part of the space for the header. For example, with a 64 Kbyte page size, we don't want a 128 Kbyte ring buffer to be reduced to 64 Kbytes by allocating half of the space for the header. In such a case, the memory allocation is less efficient, but it's the best that can be done.
While the new algorithm slightly changes the amount of space allocated for ring buffers by drivers that use VMBUS_RING_SIZE, the devices aren't known to be sensitive to small changes in ring buffer size, so there shouldn't be any effect.
Message-ID: <[email protected]>
--- include/linux/hyperv.h | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-)
include/linux/hyperv.h +21 -1
@@ -164,8 +164,28 @@ struct hv_ring_buffer {u8 buffer[]; } __packed; + +/* +* If the requested ring buffer size is at least 8 times the size of the +* header, steal space from the ring buffer for the header. Otherwise, add +* space for the header so that is doesn't take too much of the ring buffer +* space. +* +* The factor of 8 is somewhat arbitrary. The goal is to prevent adding a +* relatively small header (4 Kbytes on x86) to a large-ish power-of-2 ring +* buffer size (such as 128 Kbytes) and so end up making a nearly twice as +* large allocation that will be almost half wasted. As a contrasting example, +* on ARM64 with 64 Kbyte page size, we don't want to take 64 Kbytes for the +* header from a 128 Kbyte allocation, leaving only 64 Kbytes for the ring. +* In this latter case, we must add 64 Kbytes for the header and not worry +* about what's wasted. +*/ +#define VMBUS_HEADER_ADJ (payload_sz) \ + ((payload_sz) >= 8 * sizeof(struct hv_ring_buffer) ? \ + 0 : sizeof(struct hv_ring_buffer)) +/* Calculate the proper size of a ringbuffer, it must be page-aligned */ -#define VMBUS_RING_SIZE (payload_sz) PAGE_ALIGN(sizeof(struct hv_ring_buffer) + \ +#define VMBUS_RING_SIZE (payload_sz) PAGE_ALIGN(VMBUS_HEADER_ADJ(payload_sz) + \ (payload_sz))struct hv_ring_buffer_info {
Greg Kroah-Hartman
maintainerPATCH 123/294 xfrm: Avoid clang fortify warning in copy_to_user_tmpl()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit 1a807e46aa93ebad1dfbed4f82dc3bf779423a6e upstream.
After a couple recent changes in LLVM, there is a warning (or error with CONFIG_WERROR=y or W=e) from the compile time fortify source routines, specifically the memset() in copy_to_user_tmpl().
In file included from net/xfrm/xfrm_user.c:14:
...
include/linux/fortify-string.h:438:4: error: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror,-Wattribute-warning]
438 | __write_overflow_field(p_size_field, size);
| ^1 error generated.
While ->xfrm_nr has been validated against XFRM_MAX_DEPTH when its value is first assigned in copy_templates() by calling validate_tmpl() first (so there should not be any issue in practice), LLVM/clang cannot really deduce that across the boundaries of these functions. Without that knowledge, it cannot assume that the loop stops before i is greater than XFRM_MAX_DEPTH, which would indeed result a stack buffer overflow in the memset().
To make the bounds of ->xfrm_nr clear to the compiler and add additional defense in case copy_to_user_tmpl() is ever used in a path where ->xfrm_nr has not been properly validated against XFRM_MAX_DEPTH first, add an explicit bound check and early return, which clears up the warning.
--- net/xfrm/xfrm_user.c | 3 +++ 1 file changed, 3 insertions(+)
net/xfrm/xfrm_user.c +3 -0
@@ -1753,6 +1753,9 @@ static int copy_to_user_tmpl(struct xfrmif (xp->xfrm_nr ==0 )return 0 ; +if (xp->xfrm_nr >XFRM_MAX_DEPTH ) +return -ENOBUFS ; +for (i =0 ; i < xp->xfrm_nr; i++) {struct xfrm_user_tmpl *up = &vec[i];struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
Greg Kroah-Hartman
maintainerPATCH 124/294 KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807 upstream.
Do the cache flush of converted pages in svm_register_enc_region() before dropping kvm->lock to fix use-after-free issues where region and/or its array of pages could be freed by a different task, e.g. if userspace has __unregister_enc_region_locked() already queued up for the region.
Note, the "obvious" alternative of using local variables doesn't fully resolve the bug, as region->pages is also dynamically allocated. I.e. the region structure itself would be fine, but region->pages could be freed.
Flushing multiple pages under kvm->lock is unfortunate, but the entire flow is a rare slow path, and the manual flush is only needed on CPUs that lack coherency for encrypted memory.
Message-Id: <[email protected]>
--- arch/x86/kvm/svm/sev.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
arch/x86/kvm/svm/sev.c +9 -7
@@ -1024,20 +1024,22 @@ int svm_register_enc_region(struct kvm * goto e_free; } - region->uaddr = range->addr; - region->size = range->size; - -list_add_tail (®ion->list, &sev->regions_list); -mutex_unlock (&kvm->lock); -/* * The guest may change the memory encryption attribute from C=0 -> C=1 * or vice versa for this memory range. Lets make sure caches are * flushed to ensure that guest data gets written into memory with -* correct C-bit. +* correct C-bit. Note, this must be done before dropping kvm->lock, +* as region and its array of pages can be freed by a different task +* once kvm->lock is released. */ sev_clflush_pages (region->pages, region->npages); + region->uaddr = range->addr; + region->size = range->size; + +list_add_tail (®ion->list, &sev->regions_list); +mutex_unlock (&kvm->lock); +return ret; e_free:
Greg Kroah-Hartman
maintainerPATCH 125/294 ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
commit d397b6e56151099cf3b1f7bfccb204a6a8591720 upstream.
Headset Mic will no show at resume back.
This patch will fix this issue.
--- sound/pci/hda/patch_realtek.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
sound/pci/hda/patch_realtek.c +5 -2
@@ -10692,8 +10692,7 @@ static void alc897_hp_automute_hook(strusnd_hda_gen_hp_automute (codec, jack); vref = spec->gen.hp_jack_present ? (PIN_HP |AC_PINCTL_VREF_100 ) :PIN_HP ; -snd_hda_codec_write (codec,0x1b ,0 ,AC_VERB_SET_PIN_WIDGET_CONTROL , - vref); +snd_hda_set_pin_ctl (codec,0x1b , vref); } static void alc897_fixup_lenovo_headset_mic(struct hda_codec *codec,
@@ -10702,6 +10701,10 @@ static void alc897_fixup_lenovo_headset_struct alc_spec *spec = codec->spec;if (action ==HDA_FIXUP_ACT_PRE_PROBE ) { spec->gen.hp_automute_hook = alc897_hp_automute_hook; + spec->no_shutup_pins =1 ; + } +if (action ==HDA_FIXUP_ACT_PROBE ) { +snd_hda_set_pin_ctl_cache (codec,0x1a ,PIN_IN |AC_PINCTL_VREF_100 ); } }
Greg Kroah-Hartman
maintainerPATCH 126/294 USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 014bcf41d946b36a8f0b8e9b5d9529efbb822f49 upstream.
The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values in the ATA ID information to calculate cylinder and head values when creating a CDB for READ or WRITE commands. The calculation involves division and modulus operations, which will cause a crash if either of these values is 0. While this never happens with a genuine device, it could happen with a flawed or subversive emulation, as reported by the syzbot fuzzer.
Protect against this possibility by refusing to bind to the device if either the ATA_ID_HEADS or ATA_ID_SECTORS value in the device's ID information is 0. This requires isd200_Initialization() to return a negative error code when initialization fails; currently it always returns 0 (even when there is an error).
--- drivers/usb/storage/isd200.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-)
drivers/usb/storage/isd200.c +18 -5
@@ -1105,7 +1105,7 @@ static void isd200_dump_driveid(struct ustatic int isd200_get_inquiry_data (struct us_data *us ) {struct isd200_info *info = (struct isd200_info *)us->extra; -int retStatus =ISD200_GOOD ; +int retStatus;u16 *id = info->id;usb_stor_dbg (us,"Entering isd200_get_inquiry_data\n" );
@@ -1137,6 +1137,13 @@ static int isd200_get_inquiry_data( struisd200_fix_driveid (id);isd200_dump_driveid (us, id); +/* Prevent division by 0 in isd200_scsi_to_ata() */ +if (id[ATA_ID_HEADS ] ==0 || id[ATA_ID_SECTORS ] ==0 ) { +usb_stor_dbg (us," Invalid ATA Identify data\n" ); + retStatus =ISD200_ERROR ; + goto Done; + } +memset (&info->InquiryData,0 ,sizeof (info->InquiryData));/* Standard IDE interface only supports disks */
@@ -1202,6 +1209,7 @@ static int isd200_get_inquiry_data( stru } } + Done:usb_stor_dbg (us,"Leaving isd200_get_inquiry_data %08X\n" , retStatus);return (retStatus);
@@ -1481,22 +1489,27 @@ static int isd200_init_info(struct us_dastatic int isd200_Initialization (struct us_data *us) { +int rc =0 ; +usb_stor_dbg (us,"ISD200 Initialization...\n" );/* Initialize ISD200 info struct */ -if (isd200_init_info (us) ==ISD200_ERROR ) { +if (isd200_init_info (us) <0 ) {usb_stor_dbg (us,"ERROR Initializing ISD200 Info struct\n" ); + rc = -ENOMEM ; }else {/* Get device specific data */ -if (isd200_get_inquiry_data (us) !=ISD200_GOOD ) +if (isd200_get_inquiry_data (us) !=ISD200_GOOD ) {usb_stor_dbg (us,"ISD200 Initialization Failure\n" ); -else + rc = -EINVAL ; + }else {usb_stor_dbg (us,"ISD200 Initialization complete\n" ); + } } -return 0 ; +return rc; }
Greg Kroah-Hartman
maintainerPATCH 127/294 usb: gadget: ncm: Fix handling of zero block length packets
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Kurapati <[email protected]>
commit f90ce1e04cbcc76639d6cba0fdbd820cd80b3c70 upstream.
While connecting to a Linux host with CDC_NCM_NTB_DEF_SIZE_TX set to 65536, it has been observed that we receive short packets, which come at interval of 5-10 seconds sometimes and have block length zero but still contain 1-2 valid datagrams present.
According to the NCM spec:
"If wBlockLength = 0x0000, the block is terminated by a short packet. In this case, the USB transfer must still be shorter than dwNtbInMaxSize or dwNtbOutMaxSize. If exactly dwNtbInMaxSize or dwNtbOutMaxSize bytes are sent, and the size is a multiple of wMaxPacketSize for the given pipe, then no ZLP shall be sent.
wBlockLength= 0x0000 must be used with extreme care, because of the possibility that the host and device may get out of sync, and because of test issues.
wBlockLength = 0x0000 allows the sender to reduce latency by starting to send a very large NTB, and then shortening it when the sender discovers that there’s not sufficient data to justify sending a large NTB"
However, there is a potential issue with the current implementation, as it checks for the occurrence of multiple NTBs in a single giveback by verifying if the leftover bytes to be processed is zero or not. If the block length reads zero, we would process the same NTB infintely because the leftover bytes is never zero and it leads to a crash. Fix this by bailing out if block length reads zero.
--- drivers/usb/gadget/function/f_ncm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/function/f_ncm.c +1 -1
@@ -1357,7 +1357,7 @@ parse_ntb:if (to_process ==1 && (*(unsigned char *)(ntb_ptr + block_len) ==0x00 )) { to_process--; - }else if (to_process >0 ) { + }else if ((to_process >0 ) && (block_len !=0 )) { ntb_ptr = (unsigned char *)(ntb_ptr + block_len); goto parse_ntb; }
Greg Kroah-Hartman
maintainerPATCH 128/294 usb: port: Dont try to peer unused USB ports based on location
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit 69c63350e573367f9c8594162288cffa8a26d0d1 upstream.
Unused USB ports may have bogus location data in ACPI PLD tables. This causes port peering failures as these unused USB2 and USB3 ports location may match.
Due to these failures the driver prints a
"usb: port power management may be unreliable" warning, and unnecessarily blocks port power off during runtime suspend.
This was debugged on a couple DELL systems where the unused ports all returned zeroes in their location data.
Similar bugreports exist for other systems.
Don't try to peer or match ports that have connect type set to USB_PORT_NOT_USED.
--- drivers/usb/core/port.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/core/port.c +3 -2
@@ -450,7 +450,7 @@ static int match_location(struct usb_devstruct usb_hub *peer_hub =usb_hub_to_struct_hub (peer_hdev);struct usb_device *hdev =to_usb_device (port_dev->dev.parent->parent); -if (!peer_hub) +if (!peer_hub || port_dev->connect_type ==USB_PORT_NOT_USED )return 0 ; hcd =bus_to_hcd (hdev->bus);
@@ -461,7 +461,8 @@ static int match_location(struct usb_devfor (port1 =1 ; port1 <= peer_hdev->maxchild; port1++) { peer = peer_hub->ports[port1 -1 ]; -if (peer && peer->location == port_dev->location) { +if (peer && peer->connect_type !=USB_PORT_NOT_USED && + peer->location == port_dev->location) {link_peers_report (port_dev, peer);return 1 ;/* done */ }
Greg Kroah-Hartman
maintainerPATCH 129/294 tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sherry Sun <[email protected]>
commit 74cb7e0355fae9641f825afa389d3fba3b617714 upstream.
If the remote uart device is not connected or not enabled after booting up, the CTS line is high by default. At this time, if we enable the flow control when opening the device(for example, using “stty -F /dev/ttyLP4 crtscts” command), there will be a pending idle preamble(first writing 0 and then writing 1 to UARTCTRL_TE will queue an idle preamble) that cannot be sent out, resulting in the uart port fail to close(waiting for TX empty), so the user space stty will have to wait for a long time or forever.
This is an LPUART IP bug(idle preamble has higher priority than CTS), here add a workaround patch to enable TX CTS after enabling UARTCTRL_TE, so that the idle preamble does not get stuck due to CTS is deasserted.
--- drivers/tty/serial/fsl_lpuart.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/tty/serial/fsl_lpuart.c +5 -2
@@ -2178,9 +2178,12 @@ lpuart32_set_termios(struct uart_port *p UARTCTRL);lpuart32_serial_setbrg (sport, baud); -lpuart32_write (&sport->port, modem,UARTMODIR ); -lpuart32_write (&sport->port, ctrl,UARTCTRL ); +/* disable CTS before enabling UARTCTRL_TE to avoid pending idle preamble */ +lpuart32_write (&sport->port, modem & ~UARTMODIR_TXCTSE ,UARTMODIR );/* restore control register */ +lpuart32_write (&sport->port, ctrl,UARTCTRL ); +/* re-enable the CTS if needed */ +lpuart32_write (&sport->port, modem,UARTMODIR );if (old && sport->lpuart_dma_rx_use) {if (!lpuart_start_rx_dma (sport))
Greg Kroah-Hartman
maintainerPATCH 130/294 mei: me: add arrow lake point S DID
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Usyskin <[email protected]>
commit 7a9b9012043e126f6d6f4683e67409312d1b707b upstream.
Add Arrow Lake S device id.
--- drivers/misc/mei/hw-me-regs.h | 1 + drivers/misc/mei/pci-me.c | 1 + 2 files changed, 2 insertions(+)
drivers/misc/mei/hw-me-regs.h +1 -0
@@ -112,6 +112,7 @@#define MEI_DEV_ID_RPL_S 0x7A68/* Raptor Lake Point S */ #define MEI_DEV_ID_MTL_M 0x7E70/* Meteor Lake Point M */ +#define MEI_DEV_ID_ARL_S 0x7F68/* Arrow Lake Point S */ /* * MEI HW Section
drivers/misc/mei/pci-me.c +1 -0
@@ -118,6 +118,7 @@ static const struct pci_device_id mei_me {MEI_PCI_DEVICE(MEI_DEV_ID_RPL_S, MEI_ME_PCH15_CFG)}, {MEI_PCI_DEVICE(MEI_DEV_ID_MTL_M, MEI_ME_PCH15_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_ARL_S, MEI_ME_PCH15_CFG)},/* required last entry */ {0, }