5.4.275-rc1 review
Greg Kroah-Hartman
maintainercover 5.4.275-rc1 review
This is the start of the stable review cycle for the 5.4.275 release. There are 107 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 02 May 2024 10:30:27 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.275-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.275-rc1
Randy Dunlap <[email protected]>
serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
Yick Xie <[email protected]>
udp: preserve the connected status if only UDP cmsg
Mikulas Patocka <[email protected]>
dm: limit the number of targets and parameter size area
Matthew Wilcox (Oracle) <[email protected]>
bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS
Nam Cao <[email protected]>
HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
Wolfram Sang <[email protected]>
i2c: smbus: fix NULL function pointer dereference
Andy Shevchenko <[email protected]>
idma64: Don't try to serve interrupts when device is powered off
Arnd Bergmann <[email protected]>
dmaengine: owl: fix register access functions
Eric Dumazet <[email protected]>
tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
Kuniyuki Iwashima <[email protected]>
tcp: Clean up kernel listener's reqsk in inet_twsk_purge()
Arnd Bergmann <[email protected]>
mtd: diskonchip: work around ubsan link failure
Andrey Ryabinin <[email protected]>
stackdepot: respect __GFP_NOLOCKDEP allocation flag
Peter Münster <[email protected]>
net: b44: set pause params only when interface is up
Rahul Rameshbabu <[email protected]>
ethernet: Add helper for assigning packet type when dest address does not match device address
Guanrui Huang <[email protected]>
irqchip/gic-v3-its: Prevent double free on error
Mukul Joshi <[email protected]>
drm/amdgpu: Fix leak when GPU memory allocation fails
Iskander Amara <[email protected]>
arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma
Johannes Thumshirn <[email protected]>
btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
WangYuli <[email protected]>
Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853
Nathan Chancellor <[email protected]>
Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()
Robin H. Johnson <[email protected]>
tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker together
Robin H. Johnson <[email protected]>
tracing: Show size of requested perf buffer
Shifeng Li <[email protected]>
net/mlx5e: Fix a race in command alloc flow
Greg Kroah-Hartman <[email protected]>
Revert "crypto: api - Disallow identical driver names"
xinhui pan <[email protected]>
drm/amdgpu: validate the parameters of bo mapping operations more clearly
Chia-I Wu <[email protected]>
amdgpu: validate offset_in_bo of drm_amdgpu_gem_va
Rajneesh Bhardwaj <[email protected]>
drm/amdgpu: restrict bo mapping within gpu address limits
Emil Kronborg <[email protected]>
serial: mxs-auart: add spinlock around changing cts state
Thomas Gleixner <[email protected]>
serial: core: Provide port lock wrappers
Kuniyuki Iwashima <[email protected]>
af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().
Sudheer Mogilappagari <[email protected]>
iavf: Fix TC config comparison with existing adapter TC config
Sindhu Devale <[email protected]>
i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_tcam: Fix warning during rehash
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_tcam: Rate limit error message
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work
Hyunwoo Kim <[email protected]>
net: openvswitch: Fix Use-After-Free in ovs_ct_exit
Ismael Luceno <[email protected]>
ipvs: Fix checksumming on GSO of SCTP packets
Hyunwoo Kim <[email protected]>
net: gtp: Fix Use-After-Free in gtp_dellink
Eric Dumazet <[email protected]>
net: usb: ax88179_178a: stop lying about skb->truesize
Paul Geurts <[email protected]>
NFC: trf7970a: disable all regulators on removal
Ido Schimmel <[email protected]>
mlxsw: core: Unregister EMAD trap using FORWARD action
David Bauer <[email protected]>
vxlan: drop packets from invalid src-address
Alexey Brodkin <[email protected]>
ARC: [plat-hsdk]: Remove misplaced interrupt-cells property
Rafał Miłecki <[email protected]>
arm64: dts: mediatek: mt2712: fix validation errors
Biao Huang <[email protected]>
arm64: dts: mt2712: add ethernet device node
Rafał Miłecki <[email protected]>
arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block
Rafał Miłecki <[email protected]>
arm64: dts: mediatek: mt7622: fix ethernet controller "compatible"
Rafał Miłecki <[email protected]>
arm64: dts: mediatek: mt7622: fix IR nodename
Ikjoon Jang <[email protected]>
arm64: dts: mediatek: mt8183: Add power-domains properity to mfgcfg
Quentin Schulz <[email protected]>
arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma
Iskander Amara <[email protected]>
arm64: dts: rockchip: fix alphabetical ordering RK3399 puma
Vitaly Kuznetsov <[email protected]>
KVM: async_pf: Cleanup kvm_setup_async_pf()
Jeongjun Park <[email protected]>
nilfs2: fix OOB in nilfs_set_de_type
Dave Airlie <[email protected]>
nouveau: fix instmem race condition around ptr stores
Alan Stern <[email protected]>
fs: sysfs: Fix reference leak in sysfs_break_active_protection()
Samuel Thibault <[email protected]>
speakup: Avoid crash on very long word
Kai-Heng Feng <[email protected]>
usb: Disable USB3 LPM at shutdown
Minas Harutyunyan <[email protected]>
usb: dwc2: host: Fix dereference issue in DDMA completion flow.
Greg Kroah-Hartman <[email protected]>
Revert "usb: cdc-wdm: close race between read and workqueue"
Daniele Palmas <[email protected]>
USB: serial: option: add Telit FN920C04 rmnet compositions
Vanillan Wang <[email protected]>
USB: serial: option: add Rolling RW101-GL and RW135-GL support
Jerry Meng <[email protected]>
USB: serial: option: support Quectel EM060K sub-models
Coia Prant <[email protected]>
USB: serial: option: add Lonsung U8300/U9300 product
Chuanhong Guo <[email protected]>
USB: serial: option: add support for Fibocom FM650/FG650
bolan wang <[email protected]>
USB: serial: option: add Fibocom FM135-GL variants
Finn Thain <[email protected]>
serial/pmac_zilog: Remove flawed mitigation for rx irq flood
Nikita Zhandarovich <[email protected]>
comedi: vmk80xx: fix incomplete endpoint checking
Carlos Llamas <[email protected]>
binder: check offset alignment in binder_get_object()
Eric Biggers <[email protected]>
x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
Stephen Boyd <[email protected]>
clk: Get runtime PM before walking tree during disable_unused
Stephen Boyd <[email protected]>
clk: Initialize struct clk_core kref earlier
Konrad Dybcio <[email protected]>
clk: Print an info line before disabling unused clocks
Claudiu Beznea <[email protected]>
clk: remove extra empty line
Stephen Boyd <[email protected]>
clk: Mark 'all_lists' as const
Stephen Boyd <[email protected]>
clk: Remove prepare_lock hold assertion in __clk_release()
Mikhail Kobuk <[email protected]>
drm: nv04: Fix out of bounds access
Michael Guralnik <[email protected]>
RDMA/mlx5: Fix port number for counter query in multi-port configuration
Yanjun.Zhu <[email protected]>
RDMA/rxe: Fix the problem "mutex_destroy missing"
Lei Chen <[email protected]>
tun: limit printing rate when illegal packet received by tun dev
Ziyang Xuan <[email protected]>
netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
Siddh Raman Pant <[email protected]>
Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"
Zheng Yejian <[email protected]>
kprobes: Fix possible use-after-free issue on kprobe registration
Yuanhe Shu <[email protected]>
selftests/ftrace: Limit length in subsystem-enable tests
Boris Burkov <[email protected]>
btrfs: record delayed inode root in transaction
Adam Dunlap <[email protected]>
x86/apic: Force native_apic_mem_read() to use the MOV instruction
John Stultz <[email protected]>
selftests: timers: Fix abs() warning in posix_timers test
Gavin Shan <[email protected]>
vhost: Add smp_rmb() in vhost_vq_avail_empty()
Ville Syrjälä <[email protected]>
drm/client: Fully protect modes[] with dev->mode_config.mutex
Boris Burkov <[email protected]>
btrfs: qgroup: correctly model root qgroup rsv in convert
David Arinzon <[email protected]>
net: ena: Fix potential sign extension issue
Michal Luczaj <[email protected]>
af_unix: Fix garbage collector racing against connect()
Kuniyuki Iwashima <[email protected]>
af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
Cosmin Ratiu <[email protected]>
net/mlx5: Properly link new fs rules into the tree
Jiri Benc <[email protected]>
ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
Arnd Bergmann <[email protected]>
ipv4/route: avoid unused-but-set-variable warning
Arnd Bergmann <[email protected]>
ipv6: fib: hide unused 'pn' variable
Eric Dumazet <[email protected]>
geneve: fix header validation in geneve[6]_xmit_skb
Petr Tesarik <[email protected]>
u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file
Ilya Maximets <[email protected]>
net: openvswitch: fix unwanted error log on timeout policy probing
Arnd Bergmann <[email protected]>
nouveau: fix function cast warning
Dmitry Antipov <[email protected]>
Bluetooth: Fix memory leak in hci_req_sync_complete()
Sven Eckelmann <[email protected]>
batman-adv: Avoid infinite loop trying to resize local TT
-------------
Diffstat:
Makefile | 4 +- arch/arc/boot/dts/hsdk.dts | 1 - arch/arm64/boot/dts/mediatek/mt2712-evb.dts | 78 ++++++++++- arch/arm64/boot/dts/mediatek/mt2712e.dtsi | 68 ++++++++- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 7 +- arch/arm64/boot/dts/mediatek/mt8183.dtsi | 1 + arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 29 +++- arch/x86/include/asm/apic.h | 3 +- arch/x86/kernel/cpu/cpuid-deps.c | 6 +- crypto/algapi.c | 1 - drivers/android/binder.c | 4 +- drivers/bluetooth/btusb.c | 2 + drivers/clk/clk.c | 154 ++++++++++++++++----- drivers/dma/idma64.c | 4 + drivers/dma/owl-dma.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 70 ++++++---- drivers/gpu/drm/drm_client_modeset.c | 3 +- drivers/gpu/drm/nouveau/nouveau_bios.c | 13 +- .../gpu/drm/nouveau/nvkm/subdev/bios/shadowof.c | 7 +- drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c | 7 +- drivers/hid/i2c-hid/i2c-hid-core.c | 8 -- drivers/i2c/i2c-core-base.c | 12 +- drivers/infiniband/hw/mlx5/mad.c | 3 +- drivers/infiniband/sw/rxe/rxe.c | 2 + drivers/irqchip/irq-gic-v3-its.c | 9 +- drivers/md/dm-core.h | 2 + drivers/md/dm-ioctl.c | 3 +- drivers/md/dm-table.c | 9 +- drivers/mtd/nand/raw/diskonchip.c | 4 +- drivers/net/ethernet/amazon/ena/ena_com.c | 2 +- drivers/net/ethernet/broadcom/b44.c | 14 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 30 +++- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 12 +- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 3 +- drivers/net/ethernet/mellanox/mlxsw/core.c | 2 +- .../ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 54 ++++++-- drivers/net/geneve.c | 4 +- drivers/net/gtp.c | 3 +- drivers/net/tun.c | 18 +-- drivers/net/usb/ax88179_178a.c | 11 +- drivers/net/vxlan.c | 4 + drivers/nfc/trf7970a.c | 42 +++--- drivers/staging/comedi/drivers/vmk80xx.c | 35 ++--- drivers/staging/speakup/main.c | 2 +- drivers/tty/serial/mxs-auart.c | 8 +- drivers/tty/serial/pmac_zilog.c | 14 -- drivers/usb/class/cdc-wdm.c | 6 +- drivers/usb/core/port.c | 4 +- drivers/usb/dwc2/hcd_ddma.c | 4 +- drivers/usb/serial/option.c | 40 ++++++ drivers/vhost/vhost.c | 14 +- fs/btrfs/backref.c | 12 +- fs/btrfs/delayed-inode.c | 3 + fs/btrfs/qgroup.c | 2 + fs/nilfs2/dir.c | 2 +- fs/sysfs/file.c | 2 + include/linux/etherdevice.h | 25 ++++ include/linux/serial_core.h | 79 +++++++++++ include/linux/trace_events.h | 2 +- include/linux/u64_stats_sync.h | 6 +- include/net/addrconf.h | 4 + include/net/af_unix.h | 5 +- include/net/ip_tunnels.h | 33 +++++ kernel/bounds.c | 2 +- kernel/kprobes.c | 18 ++- kernel/trace/trace_event_perf.c | 3 +- kernel/trace/trace_events_trigger.c | 6 +- lib/stackdepot.c | 4 +- net/batman-adv/translation-table.c | 2 +- net/bluetooth/hci_request.c | 4 +- net/bluetooth/l2cap_sock.c | 7 +- net/bluetooth/sco.c | 7 +- net/ethernet/eth.c | 12 +- net/ipv4/inet_timewait_sock.c | 34 +++-- net/ipv4/route.c | 4 +- net/ipv4/udp.c | 5 +- net/ipv6/addrconf.c | 7 +- net/ipv6/ip6_fib.c | 7 +- net/ipv6/udp.c | 5 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 6 +- net/netfilter/nf_tables_api.c | 8 +- net/openvswitch/conntrack.c | 9 +- net/unix/af_unix.c | 4 +- net/unix/garbage.c | 35 +++-- net/unix/scm.c | 8 +- .../ftrace/test.d/event/subsystem-enable.tc | 6 +- tools/testing/selftests/timers/posix_timers.c | 2 +- virt/kvm/async_pf.c | 19 +-- 90 files changed, 906 insertions(+), 340 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/107 batman-adv: Avoid infinite loop trying to resize local TT
5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
commit b1f532a3b1e6d2e5559c7ace49322922637a28aa upstream.
If the MTU of one of an attached interface becomes too small to transmit the local translation table then it must be resized to fit inside all fragments (when enabled) or a single packet.
But if the MTU becomes too low to transmit even the header + the VLAN specific part then the resizing of the local TT will never succeed. This can for example happen when the usable space is 110 bytes and 11 VLANs are on top of batman-adv. In this case, at least 116 byte would be needed. There will just be an endless spam of
batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (110)
in the log but the function will never finish. Problem here is that the timeout will be halved all the time and will then stagnate at 0 and therefore never be able to reduce the table even more.
There are other scenarios possible with a similar result. The number of BATADV_TT_CLIENT_NOPURGE entries in the local TT can for example be too high to fit inside a packet. Such a scenario can therefore happen also with only a single VLAN + 7 non-purgable addresses - requiring at least 120 bytes.
While this should be handled proactively when:
* interface with too low MTU is added
* VLAN is added
* non-purgeable local mac is added
* MTU of an attached interface is reduced
* fragmentation setting gets disabled (which most likely requires dropping attached interfaces)
not all of these scenarios can be prevented because batman-adv is only consuming events without the the possibility to prevent these actions (non-purgable MAC address added, MTU of an attached interface is reduced). It is therefore necessary to also make sure that the code is able to handle also the situations when there were already incompatible system configuration are present.
--- net/batman-adv/translation-table.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/batman-adv/translation-table.c +1 -1
@@ -4190,7 +4190,7 @@ void batadv_tt_local_resize_to_mtu(strucspin_lock_bh (&bat_priv->tt.commit_lock); -while (true) { +while (timeout) { table_size =batadv_tt_local_table_transmit_size (bat_priv);if (packet_size_max >= table_size)break ;
Greg Kroah-Hartman
maintainerPATCH 2/107 Bluetooth: Fix memory leak in hci_req_sync_complete()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
commit 45d355a926ab40f3ae7bc0b0a00cb0e3e8a5a810 upstream.
In 'hci_req_sync_complete()', always free the previous sync request state before assigning reference to a new one.
--- net/bluetooth/hci_request.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/bluetooth/hci_request.c +3 -1
@@ -107,8 +107,10 @@ static void hci_req_sync_complete(structif (hdev->req_status ==HCI_REQ_PEND ) { hdev->req_result = result; hdev->req_status =HCI_REQ_DONE ; -if (skb) +if (skb) { +kfree_skb (hdev->req_skb); hdev->req_skb =skb_get (skb); + }wake_up_interruptible (&hdev->req_wait_q); } }
Greg Kroah-Hartman
maintainerPATCH 3/107 nouveau: fix function cast warning
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 185fdb4697cc9684a02f2fab0530ecdd0c2f15d4 ]
Calling a function through an incompatible pointer type causes breaks kcfi, so clang warns about the assignment:
drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowof.c:73:10: error: cast from 'void (*)(const void *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
73 | .fini = (void(*)(void *))kfree,
Avoid this with a trivial wrapper.
--- drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowof.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowof.c +6 -1
@@ -66,11 +66,16 @@ of_init(struct nvkm_bios *bios, const char *name)return ERR_PTR (-EINVAL ); } +static void of_fini (void *p) +{ +kfree (p); +} +const struct nvbios_source nvbios_of = { .name ="OpenFirmware" , .init = of_init, - .fini = (void (*)(void *))kfree, + .fini = of_fini, .read = of_read, .size = of_size, .rw = false,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/107 net: openvswitch: fix unwanted error log on timeout policy probing
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Maximets <[email protected]>
[ Upstream commit 4539f91f2a801c0c028c252bffae56030cfb2cae ]
On startup, ovs-vswitchd probes different datapath features including support for timeout policies. While probing, it tries to execute certain operations with OVS_PACKET_ATTR_PROBE or OVS_FLOW_ATTR_PROBE attributes set. These attributes tell the openvswitch module to not log any errors when they occur as it is expected that some of the probes will fail.
For some reason, setting the timeout policy ignores the PROBE attribute and logs a failure anyway. This is causing the following kernel log on each re-start of ovs-vswitchd:
kernel: Failed to associated timeout policy `ovs_test_tp'
Fix that by using the same logging macro that all other messages are using. The message will still be printed at info level when needed and will be rate limited, but with a net rate limiter instead of generic printk one.
The nf_ct_set_timeout() itself will still print some info messages, but at least this change makes logging in openvswitch module more consistent.
--- net/openvswitch/conntrack.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/openvswitch/conntrack.c +3 -2
@@ -1687,8 +1687,9 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,if (ct_info.timeout[0 ]) {if (nf_ct_set_timeout (net, ct_info.ct, family, key->ip.proto, ct_info.timeout)) -pr_info_ratelimited ("Failed to associated timeout " -"policy `%s'\n" , ct_info.timeout); +OVS_NLERR (log, +"Failed to associated timeout policy '%s'" , + ct_info.timeout);else ct_info.nf_ct_timeout =rcu_dereference (nf_ct_timeout_find (ct_info.ct)->timeout);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/107 u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Tesarik <[email protected]>
[ Upstream commit 38a15d0a50e0a43778561a5861403851f0b0194c ]
Fix bogus lockdep warnings if multiple u64_stats_sync variables are initialized in the same file.
With CONFIG_LOCKDEP, seqcount_init() is a macro which declares:
static struct lock_class_key __key;
Since u64_stats_init() is a function (albeit an inline one), all calls within the same file end up using the same instance, effectively treating them all as a single lock-class.
--- include/linux/u64_stats_sync.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
include/linux/u64_stats_sync.h +5 -1
@@ -70,7 +70,11 @@ struct u64_stats_sync {#if BITS_PER_LONG ==32 && defined(CONFIG_SMP ) -#define u64_stats_init (syncp) seqcount_init(&(syncp)->seq) +#define u64_stats_init (syncp) \ + do { \ + struct u64_stats_sync *__s = (syncp); \ + seqcount_init(&__s->seq); \ + } while (0)#else static inline void u64_stats_init (struct u64_stats_sync *syncp) {
Greg Kroah-Hartman
maintainerPATCH 6/107 geneve: fix header validation in geneve[6]_xmit_skb
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit d8a6213d70accb403b82924a1c229e733433a5ef ]
syzbot is able to trigger an uninit-value in geneve_xmit() [1]
Problem : While most ip tunnel helpers (like ip_tunnel_get_dsfield()) uses skb_protocol(skb, true), pskb_inet_may_pull() is only using skb->protocol.
If anything else than ETH_P_IPV6 or ETH_P_IP is found in skb->protocol, pskb_inet_may_pull() does nothing at all.
If a vlan tag was provided by the caller (af_packet in the syzbot case), the network header might not point to the correct location, and skb linear part could be smaller than expected.
Add skb_vlan_inet_prepare() to perform a complete mac validation.
Use this in geneve for the moment, I suspect we need to adopt this more broadly.
v4 - Jakub reported v3 broke l2_tos_ttl_inherit.sh selftest
- Only call __vlan_get_protocol() for vlan types.
v2,v3 - Addressed Sabrina comments on v1 and v2
[1]
BUG: KMSAN: uninit-value in geneve_xmit_skb drivers/net/geneve.c:910 [inline] BUG: KMSAN: uninit-value in geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030 geneve_xmit_skb drivers/net/geneve.c:910 [inline] geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030 __netdev_start_xmit include/linux/netdevice.h:4903 [inline] netdev_start_xmit include/linux/netdevice.h:4917 [inline] xmit_one net/core/dev.c:3531 [inline] dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547 __dev_queue_xmit+0x348d/0x52c0 net/core/dev.c:4335 dev_queue_xmit include/linux/netdevice.h:3091 [inline] packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x8bb0/0x9ef0 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3804 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577 __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1318 [inline] alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795 packet_alloc_skb net/packet/af_packet.c:2930 [inline] packet_snd net/packet/af_packet.c:3024 [inline] packet_sendmsg+0x722d/0x9ef0 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 CPU: 0 PID: 5033 Comm: syz-executor346 Not tainted 6.9.0-rc1-syzkaller-00005-g928a87efa423 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
--- drivers/net/geneve.c | 4 ++-- include/net/ip_tunnels.h | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+), 2 deletions(-)
drivers/net/geneve.c +2 -2
@@ -904,7 +904,7 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be16 sport;int err; -if (!pskb_inet_may_pull (skb)) +if (!skb_vlan_inet_prepare (skb))return -EINVAL ; sport =udp_flow_src_port (geneve->net, skb,1 ,USHRT_MAX , true);
@@ -970,7 +970,7 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be16 sport;int err; -if (!pskb_inet_may_pull (skb)) +if (!skb_vlan_inet_prepare (skb))return -EINVAL ; sport =udp_flow_src_port (geneve->net, skb,1 ,USHRT_MAX , true);
include/net/ip_tunnels.h +33 -0
@@ -329,6 +329,39 @@ static inline bool pskb_inet_may_pull(struct sk_buff *skb)return pskb_network_may_pull (skb, nhlen); } +/* Variant of pskb_inet_may_pull(). +*/ +static inline bool skb_vlan_inet_prepare (struct sk_buff *skb) +{ +int nhlen =0 , maclen =ETH_HLEN ; +__be16 type = skb->protocol; + +/* Essentially this is skb_protocol(skb, true) +* And we get MAC len. +*/ +if (eth_type_vlan (type)) + type =__vlan_get_protocol (skb, type, &maclen); + +switch (type) { +#if IS_ENABLED (CONFIG_IPV6 ) +case htons (ETH_P_IPV6 ): + nhlen =sizeof (struct ipv6hdr ); +break ; +#endif +case htons (ETH_P_IP ): + nhlen =sizeof (struct iphdr ); +break ; + } +/* For ETH_P_IPV6/ETH_P_IP we make sure to pull +* a base network header in skb->head. +*/ +if (!pskb_may_pull (skb, maclen + nhlen)) +return false; + +skb_set_network_header (skb, maclen); +return true; +} +static inline int ip_encap_hlen (struct ip_tunnel_encap *e) {const struct ip_tunnel_encap_ops *ops;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/107 ipv6: fib: hide unused pn variable
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 74043489fcb5e5ca4074133582b5b8011b67f9e7 ]
When CONFIG_IPV6_SUBTREES is disabled, the only user is hidden, causing a 'make W=1' warning:
net/ipv6/ip6_fib.c: In function 'fib6_add':net/ipv6/ip6_fib.c:1388:32: error: variable 'pn' set but not used [-Werror=unused-but-set-variable]
Add another #ifdef around the variable declaration, matching the other uses in this file.
--- net/ipv6/ip6_fib.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/ipv6/ip6_fib.c +5 -2
@@ -1307,7 +1307,10 @@ int fib6_add(struct fib6_node *root, struct fib6_info *rt, struct nl_info *info, struct netlink_ext_ack *extack) { struct fib6_table *table = rt->fib6_table; -struct fib6_node *fn, *pn =NULL ; +struct fib6_node *fn; +#ifdef CONFIG_IPV6_SUBTREES +struct fib6_node *pn =NULL ; +#endif int err = -ENOMEM ;int allow_create =1 ;int replace_required =0 ;
@@ -1331,9 +1334,9 @@ int fib6_add(struct fib6_node *root, struct fib6_info *rt, goto out; } +#ifdef CONFIG_IPV6_SUBTREES pn = fn; -#ifdef CONFIG_IPV6_SUBTREES if (rt->fib6_src.plen) {struct fib6_node *sn;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/107 ipv4/route: avoid unused-but-set-variable warning
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit cf1b7201df59fb936f40f4a807433fe3f2ce310a ]
The log_martians variable is only used in an #ifdef, causing a 'make W=1' warning with gcc:
net/ipv4/route.c: In function 'ip_rt_send_redirect':net/ipv4/route.c:880:13: error: variable 'log_martians' set but not used [-Werror=unused-but-set-variable]
Change the #ifdef to an equivalent IS_ENABLED() to let the compiler see where the variable is used.
--- net/ipv4/route.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
net/ipv4/route.c +1 -3
@@ -945,13 +945,11 @@ void ip_rt_send_redirect(struct sk_buff *skb)icmp_send (skb,ICMP_REDIRECT ,ICMP_REDIR_HOST , gw); peer->rate_last = jiffies; ++peer->n_redirects; -#ifdef CONFIG_IP_ROUTE_VERBOSE -if (log_martians && +if (IS_ENABLED (CONFIG_IP_ROUTE_VERBOSE ) && log_martians && peer->n_redirects == ip_rt_redirect_number)net_warn_ratelimited ("host %pI4/if%d ignores redirects for %pI4 to %pI4\n" , &ip_hdr (skb)->saddr,inet_iif (skb), &ip_hdr (skb)->daddr, &gw); -#endif } out_put_peer:inet_putpeer (peer);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/107 ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Benc <[email protected]>
[ Upstream commit 7633c4da919ad51164acbf1aa322cc1a3ead6129 ]
Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an item that got removed from the list. The memory itself of such item is not freed thanks to RCU but nothing guarantees the actual content of the memory is sane.
In particular, the reference count can be zero. This can happen if ipv6_del_addr is called in parallel. ipv6_del_addr removes the entry from inet6_addr_lst (hlist_del_init_rcu(&ifp->addr_lst)) and drops all references (__in6_ifa_put(ifp) + in6_ifa_put(ifp)). With bad enough timing, this can happen:
1. In ipv6_get_ifaddr, hlist_for_each_entry_rcu returns an entry.
2. Then, the whole ipv6_del_addr is executed for the given entry. The reference count drops to zero and kfree_rcu is scheduled.
3. ipv6_get_ifaddr continues and tries to increments the reference count (in6_ifa_hold).
4. The rcu is unlocked and the entry is freed.
5. The freed entry is returned.
Prevent increasing of the reference count in such case. The name in6_ifa_hold_safe is chosen to mimic the existing fib6_info_hold_safe.
[ 41.506330] refcount_t: addition on 0; use-after-free. [ 41.506760] WARNING: CPU: 0 PID: 595 at lib/refcount.c:25 refcount_warn_saturate+0xa5/0x130 [ 41.507413] Modules linked in: veth bridge stp llc [ 41.507821] CPU: 0 PID: 595 Comm: python3 Not tainted 6.9.0-rc2.main-00208-g49563be82afa #14 [ 41.508479] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) [ 41.509163] RIP: 0010:refcount_warn_saturate+0xa5/0x130 [ 41.509586] Code: ad ff 90 0f 0b 90 90 c3 cc cc cc cc 80 3d c0 30 ad 01 00 75 a0 c6 05 b7 30 ad 01 01 90 48 c7 c7 38 cc 7a 8c e8 cc 18 ad ff 90 <0f> 0b 90 90 c3 cc cc cc cc 80 3d 98 30 ad 01 00 0f 85 75 ff ff ff [ 41.510956] RSP: 0018:ffffbda3c026baf0 EFLAGS: 00010282 [ 41.511368] RAX: 0000000000000000 RBX: ffff9e9c46914800 RCX: 0000000000000000 [ 41.511910] RDX: ffff9e9c7ec29c00 RSI: ffff9e9c7ec1c900 RDI: ffff9e9c7ec1c900 [ 41.512445] RBP: ffff9e9c43660c9c R08: 0000000000009ffb R09: 00000000ffffdfff [ 41.512998] R10: 00000000ffffdfff R11: ffffffff8ca58a40 R12: ffff9e9c4339a000 [ 41.513534] R13: 0000000000000001 R14: ffff9e9c438a0000 R15: ffffbda3c026bb48 [ 41.514086] FS: 00007fbc4cda1740(0000) GS:ffff9e9c7ec00000(0000) knlGS:0000000000000000 [ 41.514726] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.515176] CR2: 000056233b337d88 CR3: 000000000376e006 CR4: 0000000000370ef0 [ 41.515713] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.516252] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.516799] Call Trace: [ 41.517037] <TASK> [ 41.517249] ? __warn+0x7b/0x120 [ 41.517535] ? refcount_warn_saturate+0xa5/0x130 [ 41.517923] ? report_bug+0x164/0x190 [ 41.518240] ? handle_bug+0x3d/0x70 [ 41.518541] ? exc_invalid_op+0x17/0x70 [ 41.520972] ? asm_exc_invalid_op+0x1a/0x20 [ 41.521325] ? refcount_warn_saturate+0xa5/0x130 [ 41.521708] ipv6_get_ifaddr+0xda/0xe0 [ 41.522035] inet6_rtm_getaddr+0x342/0x3f0 [ 41.522376] ? __pfx_inet6_rtm_getaddr+0x10/0x10 [ 41.522758] rtnetlink_rcv_msg+0x334/0x3d0 [ 41.523102] ? netlink_unicast+0x30f/0x390 [ 41.523445] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 41.523832] netlink_rcv_skb+0x53/0x100 [ 41.524157] netlink_unicast+0x23b/0x390 [ 41.524484] netlink_sendmsg+0x1f2/0x440 [ 41.524826] __sys_sendto+0x1d8/0x1f0 [ 41.525145] __x64_sys_sendto+0x1f/0x30 [ 41.525467] do_syscall_64+0xa5/0x1b0 [ 41.525794] entry_SYSCALL_64_after_hwframe+0x72/0x7a [ 41.526213] RIP: 0033:0x7fbc4cfcea9a [ 41.526528] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 [ 41.527942] RSP: 002b:00007ffcf54012a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 41.528593] RAX: ffffffffffffffda RBX: 00007ffcf5401368 RCX: 00007fbc4cfcea9a [ 41.529173] RDX: 000000000000002c RSI: 00007fbc4b9d9bd0 RDI: 0000000000000005 [ 41.529786] RBP: 00007fbc4bafb040 R08: 00007ffcf54013e0 R09: 000000000000000c [ 41.530375] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 41.530977] R13: ffffffffc4653600 R14: 0000000000000001 R15: 00007fbc4ca85d1b [ 41.531573] </TASK>
--- include/net/addrconf.h | 4 ++++ net/ipv6/addrconf.c | 7 ++++--- 2 files changed, 8 insertions(+), 3 deletions(-)
include/net/addrconf.h +4 -0
@@ -431,6 +431,10 @@ static inline void in6_ifa_hold(struct inet6_ifaddr *ifp)refcount_inc (&ifp->refcnt); } +static inline bool in6_ifa_hold_safe (struct inet6_ifaddr *ifp) +{ +return refcount_inc_not_zero (&ifp->refcnt); +}/* * compute link-local solicited-node multicast address
net/ipv6/addrconf.c +4 -3
@@ -2026,9 +2026,10 @@ struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *addif (ipv6_addr_equal (&ifp->addr, addr)) {if (!dev || ifp->idev->dev == dev || !(ifp->scope&(IFA_LINK |IFA_HOST ) || strict)) { - result = ifp; -in6_ifa_hold (ifp); -break ; +if (in6_ifa_hold_safe (ifp)) { + result = ifp; +break ; + } } } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/107 net/mlx5: Properly link new fs rules into the tree
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Ratiu <[email protected]>
[ Upstream commit 7c6782ad4911cbee874e85630226ed389ff2e453 ]
Previously, add_rule_fg would only add newly created rules from the handle into the tree when they had a refcount of 1. On the other hand, create_flow_handle tries hard to find and reference already existing identical rules instead of creating new ones.
These two behaviors can result in a situation where create_flow_handle
1) creates a new rule and references it, then
2) in a subsequent step during the same handle creation references it again,
resulting in a rule with a refcount of 2 that is not linked into the tree, will have a NULL parent and root and will result in a crash when the flow group is deleted because del_sw_hw_rule, invoked on rule deletion, assumes node->parent is != NULL.
This happened in the wild, due to another bug related to incorrect handling of duplicate pkt_reformat ids, which lead to the code in create_flow_handle incorrectly referencing a just-added rule in the same flow handle, resulting in the problem described above. Full details are at [1].
This patch changes add_rule_fg to add new rules without parents into the tree, properly initializing them and avoiding the crash. This makes it more consistent with how rules are added to an FTE in create_flow_handle.
--- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +2 -1
@@ -1549,8 +1549,9 @@ static struct mlx5_flow_handle *add_rule_fg(struct mlx5_flow_group *fg, }trace_mlx5_fs_set_fte (fte, false); +/* Link newly added rules into the tree. */ for (i =0 ; i < handle->num_rules; i++) { -if (refcount_read (&handle->rule[i]->node.refcount) ==1 ) { +if (!handle->rule[i]->node.parent) {tree_add_node (&handle->rule[i]->node, &fte->node);trace_mlx5_fs_add_rule (handle->rule[i]); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/107 af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 97af84a6bba2ab2b9c704c08e67de3b5ea551bb2 ]
When touching unix_sk(sk)->inflight, we are always under spin_lock(&unix_gc_lock).
Let's convert unix_sk(sk)->inflight to the normal unsigned long.
Stable-dep-of: 47d8ac011fe1 ("af_unix: Fix garbage collector racing against connect()")
--- include/net/af_unix.h | 2 +- net/unix/af_unix.c | 4 ++-- net/unix/garbage.c | 17 ++++++++--------- net/unix/scm.c | 8 +++++--- 4 files changed, 16 insertions(+), 15 deletions(-)
include/net/af_unix.h +1 -1
@@ -52,7 +52,7 @@ struct unix_sock {struct mutex iolock, bindlock;struct sock *peer;struct list_head link; -atomic_long_t inflight; +unsigned long inflight;spinlock_t lock;unsigned long gc_flags;#define UNIX_GC_CANDIDATE 0
net/unix/af_unix.c +2 -2
@@ -809,11 +809,11 @@ static struct sock *unix_create1(struct net *net, struct socket *sock, int kern) sk->sk_write_space = unix_write_space; sk->sk_max_ack_backlog = net->unx.sysctl_max_dgram_qlen; sk->sk_destruct = unix_sock_destructor; - u =unix_sk (sk); + u =unix_sk (sk); + u->inflight =0 ; u->path.dentry =NULL ; u->path.mnt =NULL ;spin_lock_init (&u->lock); -atomic_long_set (&u->inflight,0 );INIT_LIST_HEAD (&u->link);mutex_init (&u->iolock);/* single task reading lock */ mutex_init (&u->bindlock);/* single task binding lock */
net/unix/garbage.c +8 -9
@@ -166,17 +166,18 @@ static void scan_children(struct sock *x, void (*func)(struct unix_sock *),static void dec_inflight (struct unix_sock *usk) { -atomic_long_dec (&usk->inflight); + usk->inflight--; }static void inc_inflight (struct unix_sock *usk) { -atomic_long_inc (&usk->inflight); + usk->inflight++; }static void inc_inflight_move_tail (struct unix_sock *u) { -atomic_long_inc (&u->inflight); + u->inflight++; +/* If this still might be part of a cycle, move it to the end * of the list, so that it's checked even if it was already * passed over
@@ -237,14 +238,12 @@ void unix_gc(void)*/ list_for_each_entry_safe (u, next, &gc_inflight_list, link) {long total_refs; -long inflight_refs; total_refs =file_count (u->sk.sk_socket->file); - inflight_refs =atomic_long_read (&u->inflight); -BUG_ON (inflight_refs <1 ); -BUG_ON (total_refs < inflight_refs); -if (total_refs == inflight_refs) { +BUG_ON (!u->inflight); +BUG_ON (total_refs < u->inflight); +if (total_refs == u->inflight) {list_move_tail (&u->link, &gc_candidates);__set_bit (UNIX_GC_CANDIDATE , &u->gc_flags);__set_bit (UNIX_GC_MAYBE_CYCLE , &u->gc_flags);
@@ -271,7 +270,7 @@ void unix_gc(void)/* Move cursor to after the current position. */ list_move (&cursor, &u->link); -if (atomic_long_read (&u->inflight) >0 ) { +if (u->inflight) {list_move_tail (&u->link, ¬_cycle_list);__clear_bit (UNIX_GC_MAYBE_CYCLE , &u->gc_flags);scan_children (&u->sk, inc_inflight_move_tail,NULL );
net/unix/scm.c +5 -3
@@ -51,12 +51,13 @@ void unix_inflight(struct user_struct *user, struct file *fp)if (s) {struct unix_sock *u =unix_sk (s); -if (atomic_long_inc_return (&u->inflight) ==1 ) { +if (!u->inflight) {BUG_ON (!list_empty (&u->link));list_add_tail (&u->link, &gc_inflight_list); }else {BUG_ON (list_empty (&u->link)); } + u->inflight++;/* Paired with READ_ONCE() in wait_for_unix_gc() */ WRITE_ONCE (unix_tot_inflight, unix_tot_inflight +1 ); }
@@ -73,10 +74,11 @@ void unix_notinflight(struct user_struct *user, struct file *fp)if (s) {struct unix_sock *u =unix_sk (s); -BUG_ON (!atomic_long_read (&u->inflight)); +BUG_ON (!u->inflight);BUG_ON (list_empty (&u->link)); -if (atomic_long_dec_and_test (&u->inflight)) + u->inflight--; +if (!u->inflight)list_del_init (&u->link);/* Paired with READ_ONCE() in wait_for_unix_gc() */ WRITE_ONCE (unix_tot_inflight, unix_tot_inflight -1 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/107 af_unix: Fix garbage collector racing against connect()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit 47d8ac011fe1c9251070e1bd64cb10b48193ec51 ]
Garbage collector does not take into account the risk of embryo getting enqueued during the garbage collection. If such embryo has a peer that carries SCM_RIGHTS, two consecutive passes of scan_children() may see a different set of children. Leading to an incorrectly elevated inflight count, and then a dangling pointer within the gc_inflight_list.
sockets are AF_UNIX/SOCK_STREAM
S is an unconnected socket
L is a listening in-flight socket bound to addr, not in fdtable V's fd will be passed via sendmsg(), gets inflight count bumped
connect(S, addr) sendmsg(S, [V]); close(V) __unix_gc()
---------------- ------------------------- -----------
NS = unix_create1()
skb1 = sock_wmalloc(NS)
L = unix_find_other(addr)unix_state_lock(L)unix_peer(S) = NS
// V count=1 inflight=0
NS = unix_peer(S)
skb2 = sock_alloc()
skb_queue_tail(NS, skb2[V])
// V became in-flight
// V count=2 inflight=1
close(V)
// V count=1 inflight=1
// GC candidate condition met
for u in gc_inflight_list:
if (total_refs == inflight_refs)
add u to gc_candidates
// gc_candidates={L, V}
for u in gc_candidates:
scan_children(u, dec_inflight)
// embryo (skb1) was not
// reachable from L yet, so V's
// inflight remains unchanged
__skb_queue_tail(L, skb1)
unix_state_unlock(L)
for u in gc_candidates:
if (u.inflight)
scan_children(u, inc_inflight_move_tail)
// V count=1 inflight=2 (!)If there is a GC-candidate listening socket, lock/unlock its state. This makes GC wait until the end of any ongoing connect() to that socket. After flipping the lock, a possibly SCM-laden embryo is already enqueued. And if there is another embryo coming, it can not possibly carry SCM_RIGHTS. At this point, unix_inflight() can not happen because unix_gc_lock is already taken. Inflight graph remains unaffected.
--- net/unix/garbage.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
net/unix/garbage.c +17 -1
@@ -235,11 +235,22 @@ void unix_gc(void)* receive queues. Other, non candidate sockets _can_ be * added to queue, so we must make sure only to touch * candidates. +* +* Embryos, though never candidates themselves, affect which +* candidates are reachable by the garbage collector. Before +* being added to a listener's queue, an embryo may already +* receive data carrying SCM_RIGHTS, potentially making the +* passed socket a candidate that is not yet reachable by the +* collector. It becomes reachable once the embryo is +* enqueued. Therefore, we must ensure that no SCM-laden +* embryo appears in a (candidate) listener's queue between +* consecutive scan_children() calls. */ list_for_each_entry_safe (u, next, &gc_inflight_list, link) { +struct sock *sk = &u->sk;long total_refs; - total_refs =file_count (u->sk.sk_socket->file); + total_refs =file_count (sk->sk_socket->file);BUG_ON (!u->inflight);BUG_ON (total_refs < u->inflight);
@@ -247,6 +258,11 @@ void unix_gc(void)list_move_tail (&u->link, &gc_candidates);__set_bit (UNIX_GC_CANDIDATE , &u->gc_flags);__set_bit (UNIX_GC_MAYBE_CYCLE , &u->gc_flags); + +if (sk->sk_state ==TCP_LISTEN ) { +unix_state_lock (sk); +unix_state_unlock (sk); + } } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/107 net: ena: Fix potential sign extension issue
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Arinzon <[email protected]>
[ Upstream commit 713a85195aad25d8a26786a37b674e3e5ec09e3c ]
Small unsigned types are promoted to larger signed types in the case of multiplication, the result of which may overflow. In case the result of such a multiplication has its MSB turned on, it will be sign extended with '1's.
This changes the multiplication result.
Code example of the phenomenon:
-------------------------------
u16 x, y;size_t z1, z2;
x = y = 0xffff;printk("x=%x y=%x\n",x,y);
z1 = x*y;
z2 = (size_t)x*y;
printk("z1=%lx z2=%lx\n", z1, z2);
Output:
-------
x=ffff y=ffff
z1=fffffffffffe0001 z2=fffe0001
The expected result of ffff*ffff is fffe0001, and without the explicit casting to avoid the unwanted sign extension we got fffffffffffe0001.
This commit adds an explicit casting to avoid the sign extension issue.
--- drivers/net/ethernet/amazon/ena/ena_com.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/amazon/ena/ena_com.c +1 -1
@@ -374,7 +374,7 @@ static int ena_com_init_io_sq(struct ena_com_dev *ena_dev,ENA_COM_BOUNCE_BUFFER_CNTRL_CNT ; io_sq->bounce_buf_ctrl.next_to_use =0 ; - size = io_sq->bounce_buf_ctrl.buffer_size * + size = (size_t )io_sq->bounce_buf_ctrl.buffer_size * io_sq->bounce_buf_ctrl.buffers_num; dev_node =dev_to_node (ena_dev->dmadev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/107 btrfs: qgroup: correctly model root qgroup rsv in convert
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
commit 141fb8cd206ace23c02cd2791c6da52c1d77d42a upstream.
We use add_root_meta_rsv and sub_root_meta_rsv to track prealloc and pertrans reservations for subvolumes when quotas are enabled. The convert function does not properly increment pertrans after decrementing prealloc, so the count is not accurate.
Note: we check that the fs is not read-only to mirror the logic in qgroup_convert_meta, which checks that before adding to the pertrans rsv.
--- fs/btrfs/qgroup.c | 2 ++ 1 file changed, 2 insertions(+)
fs/btrfs/qgroup.c +2 -0
@@ -4061,6 +4061,8 @@ void btrfs_qgroup_convert_reserved_meta( BTRFS_QGROUP_RSV_META_PREALLOC);trace_qgroup_meta_convert (root, num_bytes);qgroup_convert_meta (fs_info, root->root_key.objectid, num_bytes); +if (!sb_rdonly (fs_info->sb)) +add_root_meta_rsv (root, num_bytes,BTRFS_QGROUP_RSV_META_PERTRANS ); }/*
Greg Kroah-Hartman
maintainerPATCH 15/107 drm/client: Fully protect modes[] with dev->mode_config.mutex
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <[email protected]>
commit 3eadd887dbac1df8f25f701e5d404d1b90fd0fea upstream.
The modes[] array contains pointers to modes on the connectors' mode lists, which are protected by dev->mode_config.mutex. Thus we need to extend modes[] the same protection or by the time we use it the elements may already be pointing to freed/reused memory.
--- drivers/gpu/drm/drm_client_modeset.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/drm_client_modeset.c +2 -1
@@ -700,6 +700,7 @@ int drm_client_modeset_probe(struct drm_unsigned int total_modes_count =0 ;struct drm_client_offset *offsets;unsigned int connector_count =0 ; +/* points to modes protected by mode_config.mutex */ struct drm_display_mode **modes;struct drm_crtc **crtcs;int i, ret =0 ;
@@ -768,7 +769,6 @@ int drm_client_modeset_probe(struct drm_drm_client_pick_crtcs (client, connectors, connector_count, crtcs, modes,0 , width, height); } -mutex_unlock (&dev->mode_config.mutex);drm_client_modeset_release (client);
@@ -798,6 +798,7 @@ int drm_client_modeset_probe(struct drm_ modeset->y = offset->y; } } +mutex_unlock (&dev->mode_config.mutex);mutex_unlock (&client->modeset_mutex); out:
Greg Kroah-Hartman
maintainerPATCH 16/107 vhost: Add smp_rmb() in vhost_vq_avail_empty()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gavin Shan <[email protected]>
commit 22e1992cf7b034db5325660e98c41ca5afa5f519 upstream.
A smp_rmb() has been missed in vhost_vq_avail_empty(), spotted by Will. Otherwise, it's not ensured the available ring entries pushed by guest can be observed by vhost in time, leading to stale available ring entries fetched by vhost in vhost_get_vq_desc(), as reported by Yihuang Yu on NVidia's grace-hopper (ARM64) platform.
/home/gavin/sandbox/qemu.main/build/qemu-system-aarch64 \ -accel kvm -machine virt,gic-version=host -cpu host \ -smp maxcpus=1,cpus=1,sockets=1,clusters=1,cores=1,threads=1 \ -m 4096M,slots=16,maxmem=64G \ -object memory-backend-ram,id=mem0,size=4096M \ : \ -netdev tap,id=vnet0,vhost=true \ -device virtio-net-pci,bus=pcie.8,netdev=vnet0,mac=52:54:00:f1:26:b0 : guest# netperf -H 10.26.1.81 -l 60 -C -c -t UDP_STREAM virtio_net virtio0: output.0:id 100 is not a head!
Add the missed smp_rmb() in vhost_vq_avail_empty(). When tx_can_batch() returns true, it means there's still pending tx buffers. Since it might read indices, so it still can bypass the smp_rmb() in vhost_get_vq_desc(). Note that it should be safe until vq->avail_idx is changed by commit 275bf960ac697 ("vhost: better detection of available buffers").
Message-Id: <[email protected]>
--- drivers/vhost/vhost.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/vhost/vhost.c +11 -1
@@ -2519,9 +2519,19 @@ bool vhost_vq_avail_empty(struct vhost_d r =vhost_get_avail_idx (vq, &avail_idx);if (unlikely (r))return false; + vq->avail_idx =vhost16_to_cpu (vq, avail_idx); +if (vq->avail_idx != vq->last_avail_idx) { +/* Since we have updated avail_idx, the following +* call to vhost_get_vq_desc() will read available +* ring entries. Make sure that read happens after +* the avail_idx read. +*/ +smp_rmb (); +return false; + } -return vq->avail_idx == vq->last_avail_idx; +return true; }EXPORT_SYMBOL_GPL (vhost_vq_avail_empty);
Greg Kroah-Hartman
maintainerPATCH 17/107 selftests: timers: Fix abs() warning in posix_timers test
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Stultz <[email protected]>
commit ed366de8ec89d4f960d66c85fc37d9de22f7bf6d upstream.
Building with clang results in the following warning:
posix_timers.c:69:6: warning: absolute value function 'abs' given an
argument of type 'long long' but has parameter of type 'int' which may cause truncation of value [-Wabsolute-value]
if (abs(diff - DELAY * USECS_PER_SEC) > USECS_PER_SEC / 2) {
^
So switch to using llabs() instead.
--- tools/testing/selftests/timers/posix_timers.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/timers/posix_timers.c +1 -1
@@ -66,7 +66,7 @@ static int check_diff(struct timeval sta diff = end.tv_usec - start.tv_usec; diff += (end.tv_sec - start.tv_sec) *USECS_PER_SEC ; -if (abs (diff -DELAY *USECS_PER_SEC ) >USECS_PER_SEC /2 ) { +if (llabs (diff -DELAY *USECS_PER_SEC ) >USECS_PER_SEC /2 ) {printf ("Diff too high: %lld.." , diff);return -1 ; }
Greg Kroah-Hartman
maintainerPATCH 18/107 x86/apic: Force native_apic_mem_read() to use the MOV instruction
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Dunlap <[email protected]>
commit 5ce344beaca688f4cdea07045e0b8f03dc537e74 upstream.
When done from a virtual machine, instructions that touch APIC memory must be emulated. By convention, MMIO accesses are typically performed via io.h helpers such as readl() or writeq() to simplify instruction emulation/decoding (ex: in KVM hosts and SEV guests) [0].
Currently, native_apic_mem_read() does not follow this convention, allowing the compiler to emit instructions other than the MOV instruction generated by readl(). In particular, when the kernel is compiled with clang and run as a SEV-ES or SEV-SNP guest, the compiler would emit a TESTL instruction which is not supported by the SEV-ES emulator, causing a boot failure in that environment. It is likely the same problem would happen in a TDX guest as that uses the same instruction emulator as SEV-ES.
To make sure all emulators can emulate APIC memory reads via MOV, use the readl() function in native_apic_mem_read(). It is expected that any emulator would support MOV in any addressing mode as it is the most generic and is what is usually emitted currently.
The TESTL instruction is emitted when native_apic_mem_read() is inlined into apic_mem_wait_icr_idle(). The emulator comes from insn_decode_mmio() in arch/x86/lib/insn-eval.c. It's not worth it to extend insn_decode_mmio() to support more instructions since, in theory, the compiler could choose to output nearly any instruction for such reads which would bloat the emulator beyond reason.
[0] https://lore.kernel.org/all/[email protected]/
[ bp: Massage commit message, fix typos. ]
--- arch/x86/include/asm/apic.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/include/asm/apic.h +2 -1
@@ -12,6 +12,7 @@#include <asm/mpspec.h> #include <asm/msr.h> #include <asm/hardirq.h> +#include <asm/io.h> #define ARCH_APICTIMER_STOPS_ON_C3 1
@@ -111,7 +112,7 @@ static inline void native_apic_mem_writestatic inline u32 native_apic_mem_read (u32 reg) { -return *((volatile u32 *)(APIC_BASE + reg)); +return readl ((void __iomem *)(APIC_BASE + reg)); }extern void native_apic_wait_icr_idle (void );
Greg Kroah-Hartman
maintainerPATCH 19/107 btrfs: record delayed inode root in transaction
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
[ Upstream commit 71537e35c324ea6fbd68377a4f26bb93a831ae35 ]
When running delayed inode updates, we do not record the inode's root in the transaction, but we do allocate PREALLOC and thus converted PERTRANS space for it. To be sure we free that PERTRANS meta rsv, we must ensure that we record the root in the transaction.
--- fs/btrfs/delayed-inode.c | 3 +++ 1 file changed, 3 insertions(+)
fs/btrfs/delayed-inode.c +3 -0
@@ -1137,6 +1137,9 @@ __btrfs_commit_inode_delayed_items(struct btrfs_trans_handle *trans,if (ret)return ret; + ret =btrfs_record_root_in_trans (trans, node->root); +if (ret) +return ret; ret =btrfs_update_delayed_inode (trans, node->root, path, node);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/107 selftests/ftrace: Limit length in subsystem-enable tests
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanhe Shu <[email protected]>
commit 1a4ea83a6e67f1415a1f17c1af5e9c814c882bb5 upstream.
While sched* events being traced and sched* events continuously happen, "[xx] event tracing - enable/disable with subsystem level files" would not stop as on some slower systems it seems to take forever. Select the first 100 lines of output would be enough to judge whether there are more than 3 types of sched events.
--- tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc +3 -3
@@ -22,7 +22,7 @@ echo 'sched:*' > set_event yield -count=`cat trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` +count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` if [ $count -lt 3 ]; then fail "at least fork, exec and exit events should be recorded" fi
@@ -33,7 +33,7 @@ echo 1 > events/sched/enable yield -count=`cat trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` +count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` if [ $count -lt 3 ]; then fail "at least fork, exec and exit events should be recorded" fi
@@ -44,7 +44,7 @@ echo 0 > events/sched/enable yield -count=`cat trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` +count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` if [ $count -ne 0 ]; then fail "any of scheduler events should not be recorded" fi
Greg Kroah-Hartman
maintainerPATCH 21/107 kprobes: Fix possible use-after-free issue on kprobe registration
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
commit 325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8 upstream.
When unloading a module, its state is changing MODULE_STATE_LIVE ->
MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take
a time. is_module_text_address() and __module_text_address() works with MODULE_STATE_LIVE and MODULE_STATE_GOING.
If we use is_module_text_address() and __module_text_address() separately, there is a chance that the first one is succeeded but the next one is failed because module->state becomes MODULE_STATE_UNFORMED between those operations.
In check_kprobe_address_safe(), if the second __module_text_address() is failed, that is ignored because it expected a kernel_text address. But it may have failed simply because module->state has been changed to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify non-exist module text address (use-after-free).
To fix this problem, we should not use separated is_module_text_address() and __module_text_address(), but use only __module_text_address() once and do try_module_get(module) which is only available with MODULE_STATE_LIVE.
[Fix conflict due to lack dependency
commit 223a76b268c9 ("kprobes: Fix coding style issues")]
--- kernel/kprobes.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
kernel/kprobes.c +12 -6
@@ -1593,10 +1593,17 @@ static int check_kprobe_address_safe(strjump_label_lock ();preempt_disable (); -/* Ensure it is not in reserved area nor out of text */ -if (!(core_kernel_text ((unsigned long ) p->addr) || -is_module_text_address ((unsigned long ) p->addr)) || -in_gate_area_no_mm ((unsigned long ) p->addr) || +/* Ensure the address is in a text area, and find a module if exists. */ + *probed_mod =NULL ; +if (!core_kernel_text ((unsigned long ) p->addr)) { + *probed_mod =__module_text_address ((unsigned long ) p->addr); +if (!(*probed_mod)) { + ret = -EINVAL ; + goto out; + } + } +/* Ensure it is not in reserved area. */ +if (in_gate_area_no_mm ((unsigned long ) p->addr) ||within_kprobe_blacklist ((unsigned long ) p->addr) ||jump_label_text_reserved (p->addr, p->addr) ||find_bug ((unsigned long )p->addr)) {
@@ -1604,8 +1611,7 @@ static int check_kprobe_address_safe(str goto out; } -/* Check if are we probing a module */ - *probed_mod =__module_text_address ((unsigned long ) p->addr); +/* Get module refcount and reject __init functions for loaded modules. */ if (*probed_mod) {/* * We must hold a refcount of the probed module while updating
Greg Kroah-Hartman
maintainerPATCH 22/107 Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddh Raman Pant <[email protected]>
This reverts commit 8ffd5590f4d6ef5460acbeac7fbdff7025f9b419 which is commit 0958b33ef5a04ed91f61cef4760ac412080c4e08 upstream.
The change has an incorrect assumption about the return value because
in the current stable trees for versions 5.15 and before, the following commit responsible for making 0 a success value is not present:b8cc44a4d3c1 ("tracing: Remove logic for registering multiple event triggers at a time")
The return value should be 0 on failure in the current tree, because in the functions event_trigger_callback() and event_enable_trigger_func(), we have:
ret = cmd_ops->reg(glob, trigger_ops, trigger_data, file);
/*
* The above returns on success the # of functions enabled,
* but if it didn't find any functions it returns zero.
* Consider no functions a failure too.
*/
if (!ret) {
ret = -ENOENT;--- kernel/trace/trace_events_trigger.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
kernel/trace/trace_events_trigger.c +2 -4
@@ -1140,10 +1140,8 @@ register_snapshot_trigger(char *glob, st struct event_trigger_data *data, struct trace_event_file *file) { - int ret = tracing_alloc_snapshot_instance(file->tr); - -if (ret <0 ) -return ret; + if (tracing_alloc_snapshot_instance(file->tr) != 0) + return 0; return register_trigger(glob, ops, data, file); }
Greg Kroah-Hartman
maintainerPATCH 23/107 netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyang Xuan <[email protected]>
[ Upstream commit f969eb84ce482331a991079ab7a5c4dc3b7f89bf ]
nft_unregister_expr() can concurrent with __nft_expr_type_get(), and there is not any protection when iterate over nf_tables_expressions list in __nft_expr_type_get(). Therefore, there is potential data-race of nf_tables_expressions list entry.
Use list_for_each_entry_rcu() to iterate over nf_tables_expressions list in __nft_expr_type_get(), and use rcu_read_lock() in the caller nft_expr_type_get() to protect the entire type query process.
--- net/netfilter/nf_tables_api.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +6 -2
@@ -2239,7 +2239,7 @@ static const struct nft_expr_type *__nft_expr_type_get(u8 family, {const struct nft_expr_type *type, *candidate =NULL ; -list_for_each_entry (type, &nf_tables_expressions, list) { +list_for_each_entry_rcu (type, &nf_tables_expressions, list) {if (!nla_strcmp (nla, type->name)) {if (!type->family && !candidate) candidate = type;
@@ -2271,9 +2271,13 @@ static const struct nft_expr_type *nft_expr_type_get(struct net *net,if (nla ==NULL )return ERR_PTR (-EINVAL ); +rcu_read_lock (); type =__nft_expr_type_get (family, nla); -if (type !=NULL &&try_module_get (type->owner)) +if (type !=NULL &&try_module_get (type->owner)) { +rcu_read_unlock ();return type; + } +rcu_read_unlock ();lockdep_nfnl_nft_mutex_not_held ();#ifdef CONFIG_MODULES
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/107 tun: limit printing rate when illegal packet received by tun dev
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lei Chen <[email protected]>
[ Upstream commit f8bbc07ac535593139c875ffa19af924b1084540 ]
vhost_worker will call tun call backs to receive packets. If too many illegal packets arrives, tun_do_read will keep dumping packet contents. When console is enabled, it will costs much more cpu time to dump packet and soft lockup will be detected.
net_ratelimit mechanism can be used to limit the dumping rate.
PID: 33036 TASK: ffff949da6f20000 CPU: 23 COMMAND: "vhost-32980"
#0 [fffffe00003fce50] crash_nmi_callback at ffffffff89249253 #1 [fffffe00003fce58] nmi_handle at ffffffff89225fa3 #2 [fffffe00003fceb0] default_do_nmi at ffffffff8922642e #3 [fffffe00003fced0] do_nmi at ffffffff8922660d #4 [fffffe00003fcef0] end_repeat_nmi at ffffffff89c01663
[exception RIP: io_serial_in+20]
RIP: ffffffff89792594 RSP: ffffa655314979e8 RFLAGS: 00000002
RAX: ffffffff89792500 RBX: ffffffff8af428a0 RCX: 0000000000000000
RDX: 00000000000003fd RSI: 0000000000000005 RDI: ffffffff8af428a0
RBP: 0000000000002710 R8: 0000000000000004 R9: 000000000000000f
R10: 0000000000000000 R11: ffffffff8acbf64f R12: 0000000000000020
R13: ffffffff8acbf698 R14: 0000000000000058 R15: 0000000000000000
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #5 [ffffa655314979e8] io_serial_in at ffffffff89792594
#6 [ffffa655314979e8] wait_for_xmitr at ffffffff89793470 #7 [ffffa65531497a08] serial8250_console_putchar at ffffffff897934f6 #8 [ffffa65531497a20] uart_console_write at ffffffff8978b605 #9 [ffffa65531497a48] serial8250_console_write at ffffffff89796558 #10 [ffffa65531497ac8] console_unlock at ffffffff89316124 #11 [ffffa65531497b10] vprintk_emit at ffffffff89317c07 #12 [ffffa65531497b68] printk at ffffffff89318306
#13 [ffffa65531497bc8] print_hex_dump at ffffffff89650765 #14 [ffffa65531497ca8] tun_do_read at ffffffffc0b06c27 [tun] #15 [ffffa65531497d38] tun_recvmsg at ffffffffc0b06e34 [tun] #16 [ffffa65531497d68] handle_rx at ffffffffc0c5d682 [vhost_net] #17 [ffffa65531497ed0] vhost_worker at ffffffffc0c644dc [vhost] #18 [ffffa65531497f10] kthread at ffffffff892d2e72
#19 [ffffa65531497f50] ret_from_fork at ffffffff89c0022f
--- drivers/net/tun.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
drivers/net/tun.c +10 -8
@@ -2208,14 +2208,16 @@ static ssize_t tun_put_user(struct tun_struct *tun, tun_is_little_endian(tun), true, vlan_hlen)) {struct skb_shared_info *sinfo =skb_shinfo (skb); -pr_err ("unexpected GSO type: " -"0x%x, gso_size %d, hdr_len %d\n" , - sinfo->gso_type,tun16_to_cpu (tun, gso.gso_size), -tun16_to_cpu (tun, gso.hdr_len)); -print_hex_dump (KERN_ERR ,"tun: " , -DUMP_PREFIX_NONE , -16 ,1 , skb->head, -min ((int )tun16_to_cpu (tun, gso.hdr_len),64 ), true); + +if (net_ratelimit ()) { +netdev_err (tun->dev,"unexpected GSO type: 0x%x, gso_size %d, hdr_len %d\n" , + sinfo->gso_type,tun16_to_cpu (tun, gso.gso_size), +tun16_to_cpu (tun, gso.hdr_len)); +print_hex_dump (KERN_ERR ,"tun: " , +DUMP_PREFIX_NONE , +16 ,1 , skb->head, +min ((int )tun16_to_cpu (tun, gso.hdr_len),64 ), true); + }WARN_ON_ONCE (1 );return -EINVAL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/107 RDMA/rxe: Fix the problem "mutex_destroy missing"
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yanjun.Zhu <[email protected]>
[ Upstream commit 481047d7e8391d3842ae59025806531cdad710d9 ]
When a mutex lock is not used any more, the function mutex_destroy should be called to mark the mutex lock uninitialized.
--- drivers/infiniband/sw/rxe/rxe.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/infiniband/sw/rxe/rxe.c +2 -0
@@ -72,6 +72,8 @@ void rxe_dealloc(struct ib_device *ib_dev)if (rxe->tfm)crypto_free_shash (rxe->tfm); + +mutex_destroy (&rxe->usdev_lock); }/* initialize rxe device parameters */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/107 RDMA/mlx5: Fix port number for counter query in multi-port configuration
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Guralnik <[email protected]>
[ Upstream commit be121ffb384f53e966ee7299ffccc6eeb61bc73d ]
Set the correct port when querying PPCNT in multi-port configuration. Distinguish between cases where switchdev mode was enabled to multi-port configuration and don't overwrite the queried port to 1 in multi-port case.
--- drivers/infiniband/hw/mlx5/mad.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/hw/mlx5/mad.c +2 -1
@@ -219,7 +219,8 @@ static int process_pma_cmd(struct mlx5_ib_dev *dev, u8 port_num, mdev = dev->mdev; mdev_port_num =1 ; } -if (MLX5_CAP_GEN (dev->mdev, num_ports) ==1 ) { +if (MLX5_CAP_GEN (dev->mdev, num_ports) ==1 && + !mlx5_core_mp_enabled (mdev)) {/* set local port to one for Function-Per-Port HCA. */ mdev = dev->mdev; mdev_port_num =1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/107 drm: nv04: Fix out of bounds access
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Kobuk <[email protected]>
[ Upstream commit cf92bb778eda7830e79452c6917efa8474a30c1e ]
When Output Resource (dcb->or) value is assigned in fabricate_dcb_output(), there may be out of bounds access to dac_users array in case dcb->or is zero because ffs(dcb->or) is used as index there.
The 'or' argument of fabricate_dcb_output() must be interpreted as a number of bit to set, not value.
Utilize macros from 'enum nouveau_or' in calls instead of hardcoding.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/gpu/drm/nouveau/nouveau_bios.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/gpu/drm/nouveau/nouveau_bios.c +7 -6
@@ -23,6 +23,7 @@*/ #include "nouveau_drv.h" +#include "nouveau_bios.h" #include "nouveau_reg.h" #include "dispnv04/hw.h" #include "nouveau_encoder.h"
@@ -1672,7 +1673,7 @@ apply_dcb_encoder_quirks(struct drm_device *dev, int idx, u32 *conn, u32 *conf)*/ if (nv_match_device (dev,0x0201 ,0x1462 ,0x8851 )) {if (*conn ==0xf2005014 && *conf ==0xffffffff ) { -fabricate_dcb_output (dcb,DCB_OUTPUT_TMDS ,1 ,1 ,1 ); +fabricate_dcb_output (dcb,DCB_OUTPUT_TMDS ,1 ,1 ,DCB_OUTPUT_B );return false; } }
@@ -1758,26 +1759,26 @@ fabricate_dcb_encoder_table(struct drm_device *dev, struct nvbios *bios)#ifdef __powerpc__/* Apple iMac G4 NV17 */ if (of_machine_is_compatible ("PowerMac4,5" )) { -fabricate_dcb_output (dcb,DCB_OUTPUT_TMDS ,0 , all_heads,1 ); -fabricate_dcb_output (dcb,DCB_OUTPUT_ANALOG ,1 , all_heads,2 ); +fabricate_dcb_output (dcb,DCB_OUTPUT_TMDS ,0 , all_heads,DCB_OUTPUT_B ); +fabricate_dcb_output (dcb,DCB_OUTPUT_ANALOG ,1 , all_heads,DCB_OUTPUT_C );return ; }#endif /* Make up some sane defaults */ fabricate_dcb_output (dcb,DCB_OUTPUT_ANALOG , - bios->legacy.i2c_indices.crt,1 ,1 ); + bios->legacy.i2c_indices.crt,1 ,DCB_OUTPUT_B );if (nv04_tv_identify (dev, bios->legacy.i2c_indices.tv) >=0 )fabricate_dcb_output (dcb,DCB_OUTPUT_TV , bios->legacy.i2c_indices.tv, - all_heads,0 ); + all_heads,DCB_OUTPUT_A );else if (bios->tmds.output0_script_ptr || bios->tmds.output1_script_ptr)fabricate_dcb_output (dcb,DCB_OUTPUT_TMDS , bios->legacy.i2c_indices.panel, - all_heads,1 ); + all_heads,DCB_OUTPUT_B ); } static int
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/107 clk: Remove prepare_lock hold assertion in __clk_release()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit 8358a76cfb47c9a5af627a0c4e7168aa14fa25f6 ]
Removing this assertion lets us move the kref_put() call outside the prepare_lock section. We don't need to hold the prepare_lock here to free memory and destroy the clk_core structure. We've already unlinked the clk from the clk tree and by the time the release function runs nothing holds a reference to the clk_core anymore so anything with the pointer can't access the memory that's being freed anyway. Way back in commit 496eadf821c2 ("clk: Use lockdep asserts to find missing hold of prepare_lock") we didn't need to have this assertion either.
--- drivers/clk/clk.c | 2 -- 1 file changed, 2 deletions(-)
drivers/clk/clk.c +0 -2
@@ -3883,8 +3883,6 @@ static void __clk_release(struct kref *ref) { struct clk_core *core = container_of(ref, struct clk_core, ref); -lockdep_assert_held (&prepare_lock); -clk_core_free_parent_map (core);kfree_const (core->name);kfree (core);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/107 clk: Mark all_lists as const
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit 75061a6ff49ba3482c6319ded0c26e6a526b0967 ]
This list array doesn't change at runtime. Mark it const to move to RO memory.
Stable-dep-of: e581cf5d2162 ("clk: Get runtime PM before walking tree during disable_unused")
--- drivers/clk/clk.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/clk.c +2 -2
@@ -37,7 +37,7 @@ static HLIST_HEAD(clk_root_list);static HLIST_HEAD (clk_orphan_list);static LIST_HEAD (clk_notifier_list); -static struct hlist_head *all_lists[] = { +static const struct hlist_head *all_lists[] = { &clk_root_list, &clk_orphan_list,NULL ,
@@ -3940,7 +3940,7 @@ static void clk_core_evict_parent_cache_subtree(struct clk_core *root,/* Remove this clk from all parent caches */ static void clk_core_evict_parent_cache (struct clk_core *core) { -struct hlist_head **lists; +const struct hlist_head **lists;struct clk_core *root;lockdep_assert_held (&prepare_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/107 clk: remove extra empty line
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
[ Upstream commit 79806d338829b2bf903480428d8ce5aab8e2d24b ]
Remove extra empty line.
Stable-dep-of: e581cf5d2162 ("clk: Get runtime PM before walking tree during disable_unused")
--- drivers/clk/clk.c | 1 - 1 file changed, 1 deletion(-)
drivers/clk/clk.c +0 -1
@@ -3508,7 +3508,6 @@ static int __clk_core_init(struct clk_core *core)clk_core_reparent_orphans_nolock (); -kref_init (&core->ref); out:clk_pm_runtime_put (core);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/107 clk: Print an info line before disabling unused clocks
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 12ca59b91d04df32e41be5a52f0cabba912c11de ]
Currently, the regulator framework informs us before calling into their unused cleanup paths, which eases at least some debugging. The same could be beneficial for clocks, so that random shutdowns shortly after most initcalls are done can be less of a guess.
Add a pr_info before disabling unused clocks to do so.
Stable-dep-of: e581cf5d2162 ("clk: Get runtime PM before walking tree during disable_unused")
--- drivers/clk/clk.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/clk/clk.c +2 -0
@@ -1315,6 +1315,8 @@ static int clk_disable_unused(void)return 0 ; } +pr_info ("clk: Disabling unused clocks\n" ); +clk_prepare_lock ();hlist_for_each_entry (core, &clk_root_list, child_node)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/107 clk: Initialize struct clk_core kref earlier
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit 9d05ae531c2cff20d5d527f04e28d28e04379929 ]
Initialize this kref once we allocate memory for the struct clk_core so that we can reuse the release function to free any memory associated with the structure. This mostly consolidates code, but also clarifies that the kref lifetime exists once the container structure (struct clk_core) is allocated instead of leaving it in a half-baked state for most of __clk_core_init().
Stable-dep-of: e581cf5d2162 ("clk: Get runtime PM before walking tree during disable_unused")
--- drivers/clk/clk.c | 28 +++++++++++++--------------- 1 file changed, 13 insertions(+), 15 deletions(-)
drivers/clk/clk.c +13 -15
@@ -3509,8 +3509,6 @@ static int __clk_core_init(struct clk_core *core) }clk_core_reparent_orphans_nolock (); - -kref_init (&core->ref); out:clk_pm_runtime_put (core); unlock:
@@ -3720,6 +3718,16 @@ static void clk_core_free_parent_map(struct clk_core *core)kfree (core->parents); } +/* Free memory allocated for a struct clk_core */ +static void __clk_release (struct kref *ref) +{ + struct clk_core *core = container_of(ref, struct clk_core, ref); + +clk_core_free_parent_map (core); +kfree_const (core->name); +kfree (core); +} +static struct clk *__clk_register (struct device *dev,struct device_node *np,struct clk_hw *hw) {
@@ -3740,6 +3748,8 @@ __clk_register(struct device *dev, struct device_node *np, struct clk_hw *hw) goto fail_out; } +kref_init (&core->ref); + core->name =kstrdup_const (init->name,GFP_KERNEL );if (!core->name) { ret = -ENOMEM ;
@@ -3794,12 +3804,10 @@ __clk_register(struct device *dev, struct device_node *np, struct clk_hw *hw) hw->clk =NULL ; fail_create_clk: -clk_core_free_parent_map (core); fail_parents: fail_ops: -kfree_const (core->name); fail_name: -kfree (core); +kref_put (&core->ref, __clk_release); fail_out:return ERR_PTR (ret); }
@@ -3879,16 +3887,6 @@ int of_clk_hw_register(struct device_node *node, struct clk_hw *hw) }EXPORT_SYMBOL_GPL (of_clk_hw_register); -/* Free memory allocated for a clock. */ -static void __clk_release (struct kref *ref) -{ - struct clk_core *core = container_of(ref, struct clk_core, ref); - -clk_core_free_parent_map (core); -kfree_const (core->name); -kfree (core); -} -/* * Empty clk_ops for unregistered clocks. These are used temporarily * after clk_unregister() was called on a clock and until last clock
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/107 clk: Get runtime PM before walking tree during disable_unused
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit e581cf5d216289ef292d1a4036d53ce90e122469 ]
Doug reported [1] the following hung task:
INFO: task swapper/0:1 blocked for more than 122 seconds.
Not tainted 5.15.149-21875-gf795ebc40eb8 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:swapper/0 state:D stack: 0 pid: 1 ppid: 0 flags:0x00000008
Call trace:
__switch_to+0xf4/0x1f4
__schedule+0x418/0xb80
schedule+0x5c/0x10c
rpm_resume+0xe0/0x52c
rpm_resume+0x178/0x52c
__pm_runtime_resume+0x58/0x98
clk_pm_runtime_get+0x30/0xb0
clk_disable_unused_subtree+0x58/0x208
clk_disable_unused_subtree+0x38/0x208
clk_disable_unused_subtree+0x38/0x208
clk_disable_unused_subtree+0x38/0x208
clk_disable_unused_subtree+0x38/0x208
clk_disable_unused+0x4c/0xe4
do_one_initcall+0xcc/0x2d8
do_initcall_level+0xa4/0x148
do_initcalls+0x5c/0x9c
do_basic_setup+0x24/0x30
kernel_init_freeable+0xec/0x164
kernel_init+0x28/0x120
ret_from_fork+0x10/0x20
INFO: task kworker/u16:0:9 blocked for more than 122 seconds.
Not tainted 5.15.149-21875-gf795ebc40eb8 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u16:0 state:D stack: 0 pid: 9 ppid: 2 flags:0x00000008
Workqueue: events_unbound deferred_probe_work_func
Call trace:
__switch_to+0xf4/0x1f4
__schedule+0x418/0xb80
schedule+0x5c/0x10c
schedule_preempt_disabled+0x2c/0x48
__mutex_lock+0x238/0x488
__mutex_lock_slowpath+0x1c/0x28
mutex_lock+0x50/0x74
clk_prepare_lock+0x7c/0x9c
clk_core_prepare_lock+0x20/0x44
clk_prepare+0x24/0x30
clk_bulk_prepare+0x40/0xb0
mdss_runtime_resume+0x54/0x1c8
pm_generic_runtime_resume+0x30/0x44
__genpd_runtime_resume+0x68/0x7c
genpd_runtime_resume+0x108/0x1f4
__rpm_callback+0x84/0x144
rpm_callback+0x30/0x88
rpm_resume+0x1f4/0x52c
rpm_resume+0x178/0x52c
__pm_runtime_resume+0x58/0x98
__device_attach+0xe0/0x170
device_initial_probe+0x1c/0x28
bus_probe_device+0x3c/0x9c
device_add+0x644/0x814
mipi_dsi_device_register_full+0xe4/0x170
devm_mipi_dsi_device_register_full+0x28/0x70
ti_sn_bridge_probe+0x1dc/0x2c0
auxiliary_bus_probe+0x4c/0x94
really_probe+0xcc/0x2c8
__driver_probe_device+0xa8/0x130
driver_probe_device+0x48/0x110
__device_attach_driver+0xa4/0xcc
bus_for_each_drv+0x8c/0xd8
__device_attach+0xf8/0x170
device_initial_probe+0x1c/0x28
bus_probe_device+0x3c/0x9c
deferred_probe_work_func+0x9c/0xd8
process_one_work+0x148/0x518
worker_thread+0x138/0x350
kthread+0x138/0x1e0
ret_from_fork+0x10/0x20The first thread is walking the clk tree and calling clk_pm_runtime_get() to power on devices required to read the clk hardware via struct clk_ops::is_enabled(). This thread holds the clk prepare_lock, and is trying to runtime PM resume a device, when it finds that the device is in the process of resuming so the thread schedule()s away waiting for the device to finish resuming before continuing. The second thread is runtime PM resuming the same device, but the runtime resume callback is calling clk_prepare(), trying to grab the prepare_lock waiting on the first thread.
This is a classic ABBA deadlock. To properly fix the deadlock, we must never runtime PM resume or suspend a device with the clk prepare_lock held. Actually doing that is near impossible today because the global prepare_lock would have to be dropped in the middle of the tree, the device runtime PM resumed/suspended, and then the prepare_lock grabbed again to ensure consistency of the clk tree topology. If anything changes with the clk tree in the meantime, we've lost and will need to start the operation all over again.
Luckily, most of the time we're simply incrementing or decrementing the runtime PM count on an active device, so we don't have the chance to schedule away with the prepare_lock held. Let's fix this immediate problem that can be triggered more easily by simply booting on Qualcomm sc7180.
Introduce a list of clk_core structures that have been registered, or are in the process of being registered, that require runtime PM to operate. Iterate this list and call clk_pm_runtime_get() on each of them without holding the prepare_lock during clk_disable_unused(). This way we can be certain that the runtime PM state of the devices will be active and resumed so we can't schedule away while walking the clk tree with the prepare_lock held. Similarly, call clk_pm_runtime_put() without the prepare_lock held to properly drop the runtime PM reference. We remove the calls to clk_pm_runtime_{get,put}() in this path because they're superfluous now that we know the devices are runtime resumed.
--- drivers/clk/clk.c | 117 +++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 105 insertions(+), 12 deletions(-)
drivers/clk/clk.c +105 -12
@@ -37,6 +37,10 @@ static HLIST_HEAD(clk_root_list);static HLIST_HEAD (clk_orphan_list);static LIST_HEAD (clk_notifier_list); +/* List of registered clks that use runtime PM */ +static HLIST_HEAD (clk_rpm_list); +static DEFINE_MUTEX (clk_rpm_list_lock); +static const struct hlist_head *all_lists[] = { &clk_root_list, &clk_orphan_list,
@@ -59,6 +63,7 @@ struct clk_core {struct clk_hw *hw;struct module *owner;struct device *dev; +struct hlist_node rpm_node;struct device_node *of_node;struct clk_core *parent;struct clk_parent_map *parents;
@@ -129,6 +134,89 @@ static void clk_pm_runtime_put(struct clk_core *core)pm_runtime_put_sync (core->dev); } +/** +* clk_pm_runtime_get_all() - Runtime "get" all clk provider devices +* +* Call clk_pm_runtime_get() on all runtime PM enabled clks in the clk tree so +* that disabling unused clks avoids a deadlock where a device is runtime PM +* resuming/suspending and the runtime PM callback is trying to grab the +* prepare_lock for something like clk_prepare_enable() while +* clk_disable_unused_subtree() holds the prepare_lock and is trying to runtime +* PM resume/suspend the device as well. +* +* Context: Acquires the 'clk_rpm_list_lock' and returns with the lock held on +* success. Otherwise the lock is released on failure. +* +* Return: 0 on success, negative errno otherwise. +*/ +static int clk_pm_runtime_get_all (void ) +{ +int ret; +struct clk_core *core, *failed; + +/* +* Grab the list lock to prevent any new clks from being registered +* or unregistered until clk_pm_runtime_put_all(). +*/ +mutex_lock (&clk_rpm_list_lock); + +/* +* Runtime PM "get" all the devices that are needed for the clks +* currently registered. Do this without holding the prepare_lock, to +* avoid the deadlock. +*/ +hlist_for_each_entry (core, &clk_rpm_list, rpm_node) { + ret =clk_pm_runtime_get (core); +if (ret) { + failed = core; +pr_err ("clk: Failed to runtime PM get '%s' for clk '%s'\n" , +dev_name (failed->dev), failed->name); + goto err; + } + } + +return 0 ; + +err: +hlist_for_each_entry (core, &clk_rpm_list, rpm_node) { +if (core == failed) +break ; + +clk_pm_runtime_put (core); + } +mutex_unlock (&clk_rpm_list_lock); + +return ret; +} + +/** +* clk_pm_runtime_put_all() - Runtime "put" all clk provider devices +* +* Put the runtime PM references taken in clk_pm_runtime_get_all() and release +* the 'clk_rpm_list_lock'. +*/ +static void clk_pm_runtime_put_all (void ) +{ +struct clk_core *core; + +hlist_for_each_entry (core, &clk_rpm_list, rpm_node) +clk_pm_runtime_put (core); +mutex_unlock (&clk_rpm_list_lock); +} + +static void clk_pm_runtime_init (struct clk_core *core) +{ +struct device *dev = core->dev; + +if (dev &&pm_runtime_enabled (dev)) { + core->rpm_enabled = true; + +mutex_lock (&clk_rpm_list_lock); +hlist_add_head (&core->rpm_node, &clk_rpm_list); +mutex_unlock (&clk_rpm_list_lock); + } +} +/*** locking ***/ static void clk_prepare_lock (void ) {
@@ -1237,9 +1325,6 @@ static void clk_unprepare_unused_subtree(struct clk_core *core)if (core->flags &CLK_IGNORE_UNUSED )return ; -if (clk_pm_runtime_get (core)) -return ; -if (clk_core_is_prepared (core)) {trace_clk_unprepare (core);if (core->ops->unprepare_unused)
@@ -1248,8 +1333,6 @@ static void clk_unprepare_unused_subtree(struct clk_core *core) core->ops->unprepare (core->hw);trace_clk_unprepare_complete (core); } - -clk_pm_runtime_put (core); }static void clk_disable_unused_subtree (struct clk_core *core)
@@ -1265,9 +1348,6 @@ static void clk_disable_unused_subtree(struct clk_core *core)if (core->flags &CLK_OPS_PARENT_ENABLE )clk_core_prepare_enable (core->parent); -if (clk_pm_runtime_get (core)) - goto unprepare_out; - flags =clk_enable_lock ();if (core->enable_count)
@@ -1292,8 +1372,6 @@ static void clk_disable_unused_subtree(struct clk_core *core) unlock_out:clk_enable_unlock (flags); -clk_pm_runtime_put (core); -unprepare_out:if (core->flags &CLK_OPS_PARENT_ENABLE )clk_core_disable_unprepare (core->parent); }
@@ -1309,6 +1387,7 @@ __setup("clk_ignore_unused", clk_ignore_unused_setup);static int clk_disable_unused (void ) {struct clk_core *core; +int ret;if (clk_ignore_unused) {pr_warn ("clk: Not disabling unused clocks\n" );
@@ -1317,6 +1396,13 @@ static int clk_disable_unused(void)pr_info ("clk: Disabling unused clocks\n" ); + ret =clk_pm_runtime_get_all (); +if (ret) +return ret; +/* +* Grab the prepare lock to keep the clk topology stable while iterating +* over clks. +*/ clk_prepare_lock ();hlist_for_each_entry (core, &clk_root_list, child_node)
@@ -1333,6 +1419,8 @@ static int clk_disable_unused(void)clk_prepare_unlock (); +clk_pm_runtime_put_all (); +return 0 ; }late_initcall_sync (clk_disable_unused);
@@ -3723,6 +3811,12 @@ static void __clk_release(struct kref *ref) { struct clk_core *core = container_of(ref, struct clk_core, ref); +if (core->rpm_enabled) { +mutex_lock (&clk_rpm_list_lock); +hlist_del (&core->rpm_node); +mutex_unlock (&clk_rpm_list_lock); + } +clk_core_free_parent_map (core);kfree_const (core->name);kfree (core);
@@ -3762,9 +3856,8 @@ __clk_register(struct device *dev, struct device_node *np, struct clk_hw *hw) } core->ops = init->ops; -if (dev &&pm_runtime_enabled (dev)) - core->rpm_enabled = true; core->dev = dev; +clk_pm_runtime_init (core); core->of_node = np;if (dev && dev->driver) core->owner = dev->driver->owner;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/107 x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
[ Upstream commit 9543f6e26634537997b6e909c20911b7bf4876de ]
Fix cpuid_deps[] to list the correct dependencies for GFNI, VAES, and VPCLMULQDQ. These features don't depend on AVX512, and there exist CPUs that support these features but not AVX512. GFNI actually doesn't even depend on AVX.
This prevents GFNI from being unnecessarily disabled if AVX is disabled to mitigate the GDS vulnerability.
This also prevents all three features from being unnecessarily disabled if AVX512VL (or its dependency AVX512F) were to be disabled, but it looks like there isn't any case where this happens anyway.
--- arch/x86/kernel/cpu/cpuid-deps.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/x86/kernel/cpu/cpuid-deps.c +3 -3
@@ -44,7 +44,10 @@ static const struct cpuid_dep cpuid_deps[] = { { X86_FEATURE_F16C, X86_FEATURE_XMM2, }, { X86_FEATURE_AES, X86_FEATURE_XMM2 }, { X86_FEATURE_SHA_NI, X86_FEATURE_XMM2 }, + { X86_FEATURE_GFNI, X86_FEATURE_XMM2 }, { X86_FEATURE_FMA, X86_FEATURE_AVX }, + { X86_FEATURE_VAES, X86_FEATURE_AVX }, + { X86_FEATURE_VPCLMULQDQ, X86_FEATURE_AVX }, { X86_FEATURE_AVX2, X86_FEATURE_AVX, }, { X86_FEATURE_AVX512F, X86_FEATURE_AVX, }, { X86_FEATURE_AVX512IFMA, X86_FEATURE_AVX512F },
@@ -56,9 +59,6 @@ static const struct cpuid_dep cpuid_deps[] = { { X86_FEATURE_AVX512VL, X86_FEATURE_AVX512F }, { X86_FEATURE_AVX512VBMI, X86_FEATURE_AVX512F }, { X86_FEATURE_AVX512_VBMI2, X86_FEATURE_AVX512VL }, - { X86_FEATURE_GFNI, X86_FEATURE_AVX512VL }, - { X86_FEATURE_VAES, X86_FEATURE_AVX512VL }, - { X86_FEATURE_VPCLMULQDQ, X86_FEATURE_AVX512VL }, { X86_FEATURE_AVX512_VNNI, X86_FEATURE_AVX512VL }, { X86_FEATURE_AVX512_BITALG, X86_FEATURE_AVX512VL }, { X86_FEATURE_AVX512_4VNNIW, X86_FEATURE_AVX512F },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/107 binder: check offset alignment in binder_get_object()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit aaef73821a3b0194a01bd23ca77774f704a04d40 upstream.
Commit 6d98eb95b450 ("binder: avoid potential data leakage when copying txn") introduced changes to how binder objects are copied. In doing so, it unintentionally removed an offset alignment check done through calls to binder_alloc_copy_from_buffer() -> check_buffer().
These calls were replaced in binder_get_object() with copy_from_user(), so now an explicit offset alignment check is needed here. This avoids later complications when unwinding the objects gets harder.
It is worth noting this check existed prior to commit 7a67a39320df ("binder: add function to copy binder object from buffer"), likely removed due to redundancy at the time.
--- drivers/android/binder.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/android/binder.c +3 -1
@@ -2047,8 +2047,10 @@ static size_t binder_get_object(struct bsize_t object_size =0 ; read_size =min_t (size_t,sizeof (*object), buffer->data_size - offset); -if (offset > buffer->data_size || read_size <sizeof (*hdr)) +if (offset > buffer->data_size || read_size <sizeof (*hdr) || + !IS_ALIGNED (offset,sizeof (u32)))return 0 ; +if (u) {if (copy_from_user (object, u + offset, read_size))return 0 ;
Greg Kroah-Hartman
maintainerPATCH 36/107 comedi: vmk80xx: fix incomplete endpoint checking
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit d1718530e3f640b7d5f0050e725216eab57a85d8 upstream.
While vmk80xx does have endpoint checking implemented, some things can fall through the cracks. Depending on the hardware model, URBs can have either bulk or interrupt type, and current version of vmk80xx_find_usb_endpoints() function does not take that fully into account. While this warning does not seem to be too harmful, at the very least it will crash systems with 'panic_on_warn' set on them.
Fix the issue found by Syzkaller [1] by somewhat simplifying the endpoint checking process with usb_find_common_endpoints() and ensuring that only expected endpoint types are present.
This patch has not been tested on real hardware.
[1] Syzkaller report:
usb 1-1: BOGUS urb xfer, pipe 1 != type 3
WARNING: CPU: 0 PID: 781 at drivers/usb/core/urb.c:504 usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... Call Trace: <TASK> usb_start_wait_urb+0x113/0x520 drivers/usb/core/message.c:59 vmk80xx_reset_device drivers/comedi/drivers/vmk80xx.c:227 [inline] vmk80xx_auto_attach+0xa1c/0x1a40 drivers/comedi/drivers/vmk80xx.c:818 comedi_auto_config+0x238/0x380 drivers/comedi/drivers.c:1067 usb_probe_interface+0x5cd/0xb00 drivers/usb/core/driver.c:399
...
Similar issue also found by Syzkaller:
--- drivers/staging/comedi/drivers/vmk80xx.c | 35 ++++++++++--------------------- 1 file changed, 12 insertions(+), 23 deletions(-)
drivers/staging/comedi/drivers/vmk80xx.c +12 -23
@@ -642,33 +642,22 @@ static int vmk80xx_find_usb_endpoints(ststruct vmk80xx_private *devpriv = dev->private;struct usb_interface *intf =comedi_to_usb_interface (dev);struct usb_host_interface *iface_desc = intf->cur_altsetting; -struct usb_endpoint_descriptor *ep_desc; -int i; +struct usb_endpoint_descriptor *ep_rx_desc, *ep_tx_desc; +int ret; -if (iface_desc->desc.bNumEndpoints !=2 ) -return -ENODEV ; - -for (i =0 ; i < iface_desc->desc.bNumEndpoints; i++) { - ep_desc = &iface_desc->endpoint[i].desc; - -if (usb_endpoint_is_int_in (ep_desc) || -usb_endpoint_is_bulk_in (ep_desc)) { -if (!devpriv->ep_rx) - devpriv->ep_rx = ep_desc; -continue ; - } +if (devpriv->model ==VMK8061_MODEL ) + ret =usb_find_common_endpoints (iface_desc, &ep_rx_desc, + &ep_tx_desc,NULL ,NULL ); +else + ret =usb_find_common_endpoints (iface_desc,NULL ,NULL , + &ep_rx_desc, &ep_tx_desc); -if (usb_endpoint_is_int_out (ep_desc) || -usb_endpoint_is_bulk_out (ep_desc)) { -if (!devpriv->ep_tx) - devpriv->ep_tx = ep_desc; -continue ; - } - } - -if (!devpriv->ep_rx || !devpriv->ep_tx) +if (ret)return -ENODEV ; + devpriv->ep_rx = ep_rx_desc; + devpriv->ep_tx = ep_tx_desc; +if (!usb_endpoint_maxp (devpriv->ep_rx) || !usb_endpoint_maxp (devpriv->ep_tx))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 37/107 serial/pmac_zilog: Remove flawed mitigation for rx irq flood
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
commit 1be3226445362bfbf461c92a5bcdb1723f2e4907 upstream.
The mitigation was intended to stop the irq completely. That may be better than a hard lock-up but it turns out that you get a crash anyway if you're using pmac_zilog as a serial console:
ttyPZ0: pmz: rx irq flood !
BUG: spinlock recursion on CPU#0, swapper/0
That's because the pr_err() call in pmz_receive_chars() results in pmz_console_write() attempting to lock a spinlock already locked in pmz_interrupt(). With CONFIG_DEBUG_SPINLOCK=y, this produces a fatal BUG splat. The spinlock in question is the one in struct uart_port.
Even when it's not fatal, the serial port rx function ceases to work. Also, the iteration limit doesn't play nicely with QEMU, as can be seen in the bug report linked below.
A web search for other reports of the error message "pmz: rx irq flood" didn't produce anything. So I don't think this code is needed any more. Remove it.
--- drivers/tty/serial/pmac_zilog.c | 14 -------------- 1 file changed, 14 deletions(-)
drivers/tty/serial/pmac_zilog.c +0 -14
@@ -220,7 +220,6 @@ static bool pmz_receive_chars(struct uar {struct tty_port *port;unsigned char ch, r1, drop, flag; -int loops =0 ;/* Sanity check, make sure the old bug is no longer happening */ if (uap->port.state ==NULL ) {
@@ -301,25 +300,12 @@ static bool pmz_receive_chars(struct uarif (r1 & Rx_OVR)tty_insert_flip_char (port,0 ,TTY_OVERRUN ); next_char: -/* We can get stuck in an infinite loop getting char 0 when the -* line is in a wrong HW state, we break that here. -* When that happens, I disable the receive side of the driver. -* Note that what I've been experiencing is a real irq loop where -* I'm getting flooded regardless of the actual port speed. -* Something strange is going on with the HW -*/ -if ((++loops) >1000 ) - goto flood; ch =read_zsreg (uap,R0 );if (!(ch & Rx_CH_AV))break ; }return true; - flood: -pmz_interrupt_control (uap,0 ); -pmz_error ("pmz: rx irq flood !\n" ); -return true; }static void pmz_status_handle (struct uart_pmac_port *uap)
Greg Kroah-Hartman
maintainerPATCH 38/107 USB: serial: option: add Fibocom FM135-GL variants
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: bolan wang <[email protected]>
commit 356952b13af5b2c338df1e06889fd1b5e12cbbf4 upstream.
Update the USB serial option driver support for the Fibocom FM135-GL LTE modules.
- VID:PID 2cb7:0115, FM135-GL for laptop debug M.2 cards(with MBIM interface for /Linux/Chrome OS)
0x0115: mbim, diag, at, pipe
Here are the outputs of usb-devices:
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2cb7 ProdID=0115 Rev=05.15 S: Manufacturer=Fibocom Wireless Inc. S: Product=Fibocom Module S: SerialNumber=12345678 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -2272,6 +2272,8 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0111, 0xff) }, /* Fibocom FM160 (MBIM mode) */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0115, 0xff), /* Fibocom FM135 (laptop MBIM) */ + .driver_info = RSVD(5) }, { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a2, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a3, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */
Greg Kroah-Hartman
maintainerPATCH 39/107 USB: serial: option: add support for Fibocom FM650/FG650
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuanhong Guo <[email protected]>
commit fb1f4584b1215e8c209f6b3a4028ed8351a0e961 upstream.
Fibocom FM650/FG650 are 5G modems with ECM/NCM/RNDIS/MBIM modes. This patch adds support to all 4 modes.
In all 4 modes, the first serial port is the AT console while the other 3 appear to be diagnostic interfaces for dumping modem logs.
usb-devices output for all modes:
ECM:
T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 5 Spd=5000 MxCh= 0 D: Ver= 3.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=2cb7 ProdID=0a04 Rev=04.04 S: Manufacturer=Fibocom Wireless Inc. S: Product=FG650 Module S: SerialNumber=0123456789ABCDEF C: #Ifs= 5 Cfg#= 1 Atr=c0 MxPwr=504mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
NCM:
T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=5000 MxCh= 0 D: Ver= 3.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=2cb7 ProdID=0a05 Rev=04.04 S: Manufacturer=Fibocom Wireless Inc. S: Product=FG650 Module S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=c0 MxPwr=504mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0d Prot=00 Driver=cdc_ncm E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=01 Driver=cdc_ncm E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
RNDIS:
T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 4 Spd=5000 MxCh= 0 D: Ver= 3.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=2cb7 ProdID=0a06 Rev=04.04 S: Manufacturer=Fibocom Wireless Inc. S: Product=FG650 Module S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=c0 MxPwr=504mA I: If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
MBIM:
T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 7 Spd=5000 MxCh= 0 D: Ver= 3.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=2cb7 ProdID=0a07 Rev=04.04 S: Manufacturer=Fibocom Wireless Inc. S: Product=FG650 Module S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=c0 MxPwr=504mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
--- drivers/usb/serial/option.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/serial/option.c +4 -0
@@ -2279,6 +2279,10 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a3, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a4, 0xff), /* Fibocom FM101-GL (laptop MBIM) */ .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a04, 0xff) }, /* Fibocom FM650-CN (ECM mode) */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a05, 0xff) }, /* Fibocom FM650-CN (NCM mode) */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a06, 0xff) }, /* Fibocom FM650-CN (RNDIS mode) */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a07, 0xff) }, /* Fibocom FM650-CN (MBIM mode) */ { USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */
Greg Kroah-Hartman
maintainerPATCH 40/107 USB: serial: option: add Lonsung U8300/U9300 product
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Coia Prant <[email protected]>
commit cf16ffa17c398434a77b8a373e69287c95b60de2 upstream.
Update the USB serial option driver to support Longsung U8300/U9300.
For U8300
Interface 4 is used by for QMI interface in stock firmware of U8300, the router which uses U8300 modem.
Interface 5 is used by for ADB interface in stock firmware of U8300, the router which uses U8300 modem.
Interface mapping is:
0: unknown (Debug), 1: AT (Modem), 2: AT, 3: PPP (NDIS / Pipe), 4: QMI, 5: ADB
T: Bus=05 Lev=01 Prnt=03 Port=02 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1c9e ProdID=9b05 Rev=03.18 S: Manufacturer=Android S: Product=Android C: #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
For U9300
Interface 1 is used by for ADB interface in stock firmware of U9300, the router which uses U9300 modem.
Interface 4 is used by for QMI interface in stock firmware of U9300, the router which uses U9300 modem.
Interface mapping is:
0: ADB, 1: AT (Modem), 2: AT, 3: PPP (NDIS / Pipe), 4: QMI
Note: Interface 3 of some models of the U9300 series can send AT commands.
T: Bus=05 Lev=01 Prnt=05 Port=04 Cnt=01 Dev#= 6 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1c9e ProdID=9b3c Rev=03.18 S: Manufacturer=Android S: Product=Android C: #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
Tested successfully using Modem Manager on U9300.
Tested successfully AT commands using If=1, If=2 and If=3 on U9300.
--- drivers/usb/serial/option.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/serial/option.c +4 -0
@@ -2052,6 +2052,10 @@ static const struct usb_device_id option .driver_info = RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, 0x9803, 0xff), .driver_info = RSVD(4) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, 0x9b05), /* Longsung U8300 */ + .driver_info = RSVD(4) | RSVD(5) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, 0x9b3c), /* Longsung U9300 */ + .driver_info = RSVD(0) | RSVD(4) }, { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
Greg Kroah-Hartman
maintainerPATCH 41/107 USB: serial: option: support Quectel EM060K sub-models
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerry Meng <[email protected]>
commit c840244aba7ad2b83ed904378b36bd6aef25511c upstream.
EM060K_129, EM060K_12a, EM060K_12b and EM0060K_12c are EM060K's sub-models, having the same name "Quectel EM060K-GL" and the same interface layout.
MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL
T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0129 Rev= 5.04 S: Manufacturer=Quectel S: Product=Quectel EM060K-GL S: SerialNumber=f6fa08b6 C:* #Ifs= 8 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E: Ad=8f(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/usb/serial/option.c +16 -0
@@ -255,6 +255,10 @@ static void option_instat_callback(struc#define QUECTEL_PRODUCT_EM061K_LMS 0x0124#define QUECTEL_PRODUCT_EC25 0x0125#define QUECTEL_PRODUCT_EM060K_128 0x0128 +#define QUECTEL_PRODUCT_EM060K_129 0x0129 +#define QUECTEL_PRODUCT_EM060K_12a 0x012a +#define QUECTEL_PRODUCT_EM060K_12b 0x012b +#define QUECTEL_PRODUCT_EM060K_12c 0x012c#define QUECTEL_PRODUCT_EG91 0x0191#define QUECTEL_PRODUCT_EG95 0x0195#define QUECTEL_PRODUCT_BG96 0x0296
@@ -1218,6 +1222,18 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0x00, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_129, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_129, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_129, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12a, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12a, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12a, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12b, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12b, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12b, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12c, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12c, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12c, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0x00, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 42/107 USB: serial: option: add Rolling RW101-GL and RW135-GL support
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vanillan Wang <[email protected]>
commit 311f97a4c7c22a01f8897bddf00428dfd0668e79 upstream.
Update the USB serial option driver support for the Rolling LTE modules.
- VID:PID 33f8:01a2, RW101-GL for laptop debug M.2 cards(with MBIM interface for /Linux/Chrome OS)0x01a2: mbim, diag, at, pipe
- VID:PID 33f8:01a3, RW101-GL for laptop debug M.2 cards(with MBIM interface for /Linux/Chrome OS)0x01a3: mbim, pipe
- VID:PID 33f8:01a4, RW101-GL for laptop debug M.2 cards(with MBIM interface for /Linux/Chrome OS)0x01a4: mbim, diag, at, pipe
- VID:PID 33f8:0104, RW101-GL for laptop debug M.2 cards(with RMNET interface for /Linux/Chrome OS)0x0104: RMNET, diag, at, pipe
- VID:PID 33f8:0115, RW135-GL for laptop debug M.2 cards(with MBIM interface for /Linux/Chrome OS)0x0115: MBIM, diag, at, pipe
Here are the outputs of usb-devices:
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=01a2 Rev=05.15 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling Module S: SerialNumber=12345678 C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=01a3 Rev=05.15 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling Module S: SerialNumber=12345678 C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 17 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=01a4 Rev=05.15 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling Module S: SerialNumber=12345678 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=33f8 ProdID=0104 Rev=05.04 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling Module S: SerialNumber=ba2eb033 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=0115 Rev=05.15 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling Module S: SerialNumber=12345678 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/usb/serial/option.c +8 -0
@@ -2307,6 +2307,14 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */ + { USB_DEVICE(0x33f8, 0x0104), /* Rolling RW101-GL (laptop RMNET) */ + .driver_info = RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a2, 0xff) }, /* Rolling RW101-GL (laptop MBIM) */ + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a3, 0xff) }, /* Rolling RW101-GL (laptop MBIM) */ + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a4, 0xff), /* Rolling RW101-GL (laptop MBIM) */ + .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */ + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 43/107 USB: serial: option: add Telit FN920C04 rmnet compositions
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Palmas <[email protected]>
commit 582ee2f9d268d302595db3e36b985e5cbb93284d upstream.
Add the following Telit FN920C04 compositions:
0x10a0: rmnet + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=03 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a0 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=92c4c4d8 C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10a4: rmnet + tty (AT) + tty (AT) + tty (diag)
T: Bus=03 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a4 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=92c4c4d8 C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10a9: rmnet + tty (AT) + tty (diag) + DPL (data packet logging) + adb
T: Bus=03 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a9 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=92c4c4d8 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/serial/option.c +6 -0
@@ -1376,6 +1376,12 @@ static const struct usb_device_id option .driver_info = NCTRL(2) | RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1083, 0xff), /* Telit FE990 (ECM) */ .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a0, 0xff), /* Telit FN20C04 (rmnet) */ + .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a4, 0xff), /* Telit FN20C04 (rmnet) */ + .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a9, 0xff), /* Telit FN20C04 (rmnet) */ + .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
Greg Kroah-Hartman
maintainerPATCH 44/107 Revert "usb: cdc-wdm: close race between read and workqueue"
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 1607830dadeefc407e4956336d9fcd9e9defd810 upstream.
This reverts commit 339f83612f3a569b194680768b22bf113c26a29d.
It has been found to cause problems in a number of Chromebook devices, so revert the change until it can be brought back in a safe way.
--- drivers/usb/class/cdc-wdm.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/usb/class/cdc-wdm.c +1 -5
@@ -471,7 +471,6 @@ out_free_mem:static int service_outstanding_interrupt (struct wdm_device *desc) {int rv =0 ; -int used;/* submit read urb only if the device is waiting for it */ if (!desc->resp_count || !--desc->resp_count)
@@ -486,10 +485,7 @@ static int service_outstanding_interrupt goto out; } - used =test_and_set_bit (WDM_RESPONDING , &desc->flags); -if (used) - goto out; - +set_bit (WDM_RESPONDING , &desc->flags);spin_unlock_irq (&desc->iuspin); rv =usb_submit_urb (desc->response,GFP_KERNEL );spin_lock_irq (&desc->iuspin);
Greg Kroah-Hartman
maintainerPATCH 45/107 usb: dwc2: host: Fix dereference issue in DDMA completion flow.
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minas Harutyunyan <[email protected]>
commit eed04fa96c48790c1cce73c8a248e9d460b088f8 upstream.
Fixed variable dereference issue in DDMA completion flow.
--- drivers/usb/dwc2/hcd_ddma.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/dwc2/hcd_ddma.c +3 -1
@@ -897,13 +897,15 @@ static int dwc2_cmpl_host_isoc_dma_desc(struct dwc2_dma_desc *dma_desc;struct dwc2_hcd_iso_packet_desc *frame_desc;u16 frame_desc_idx; -struct urb *usb_urb = qtd->urb->priv; +struct urb *usb_urb;u16 remain =0 ;int rc =0 ;if (!qtd->urb)return -EINVAL ; + usb_urb = qtd->urb->priv; + dma_sync_single_for_cpu(hsotg->dev, qh->desc_list_dma + (idx * sizeof(struct dwc2_dma_desc)), sizeof(struct dwc2_dma_desc),
Greg Kroah-Hartman
maintainerPATCH 46/107 usb: Disable USB3 LPM at shutdown
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai-Heng Feng <[email protected]>
commit d920a2ed8620be04a3301e1a9c2b7cc1de65f19d upstream.
SanDisks USB3 storage may disapper after system reboot:
usb usb2-port3: link state changexhci_hcd 0000:00:14.0: clear port3 link state change, portsc: 0x2c0 usb usb2-port3: do warm reset, port onlyxhci_hcd 0000:00:14.0: xhci_hub_status_data: stopping usb2 port polling xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x2b0, return 0x2b0 usb usb2-port3: not warm reset yet, waiting 50msxhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x2f0, return 0x2f0 usb usb2-port3: not warm reset yet, waiting 200ms
...xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x6802c0, return 0x7002c0 usb usb2-port3: not warm reset yet, waiting 200msxhci_hcd 0000:00:14.0: clear port3 reset change, portsc: 0x4802c0 xhci_hcd 0000:00:14.0: clear port3 warm(BH) reset change, portsc: 0x4002c0 xhci_hcd 0000:00:14.0: clear port3 link state change, portsc: 0x2c0 xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x2c0, return 0x2c0 usb usb2-port3: not enabled, trying warm reset again...
This is due to the USB device still cause port change event after xHCI is shuted down:
xhci_hcd 0000:38:00.0: // Setting command ring address to 0xffffe001 xhci_hcd 0000:38:00.0: xhci_resume: starting usb3 port polling. xhci_hcd 0000:38:00.0: xhci_hub_status_data: stopping usb4 port polling xhci_hcd 0000:38:00.0: xhci_hub_status_data: stopping usb3 port polling xhci_hcd 0000:38:00.0: hcd_pci_runtime_resume: 0xhci_hcd 0000:38:00.0: xhci_shutdown: stopping usb3 port polling. xhci_hcd 0000:38:00.0: // Halt the HCxhci_hcd 0000:38:00.0: xhci_shutdown completed - status = 1 xhci_hcd 0000:00:14.0: xhci_shutdown: stopping usb1 port polling. xhci_hcd 0000:00:14.0: // Halt the HCxhci_hcd 0000:00:14.0: xhci_shutdown completed - status = 1 xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x1203, return 0x203 xhci_hcd 0000:00:14.0: set port reset, actual port 2-3 status = 0x1311 xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x201203, return 0x100203 xhci_hcd 0000:00:14.0: clear port3 reset change, portsc: 0x1203 xhci_hcd 0000:00:14.0: clear port3 warm(BH) reset change, portsc: 0x1203 xhci_hcd 0000:00:14.0: clear port3 link state change, portsc: 0x1203 xhci_hcd 0000:00:14.0: clear port3 connect change, portsc: 0x1203 xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x1203, return 0x203 usb 2-3: device not accepting address 2, error -108xhci_hcd 0000:00:14.0: xHCI dying or halted, can't queue_command xhci_hcd 0000:00:14.0: Set port 2-3 link state, portsc: 0x1203, write 0x11261 xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x1263, return 0x263 xhci_hcd 0000:00:14.0: set port reset, actual port 2-3 status = 0x1271 xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x12b1, return 0x2b1 usb usb2-port3: not reset yet, waiting 60ms
ACPI: PM: Preparing to enter system sleep state S5xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x12f1, return 0x2f1 usb usb2-port3: not reset yet, waiting 200ms
reboot: Restarting system
The port change event is caused by LPM transition, so disabling LPM at shutdown to make sure the device is in U0 for warmboot.
--- drivers/usb/core/port.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/core/port.c +3 -1
@@ -295,8 +295,10 @@ static void usb_port_shutdown(struct dev {struct usb_port *port_dev =to_usb_port (dev); -if (port_dev->child) +if (port_dev->child) {usb_disable_usb2_hardware_lpm (port_dev->child); +usb_unlocked_disable_lpm (port_dev->child); + } }static const struct dev_pm_ops usb_port_pm_ops = {
Greg Kroah-Hartman
maintainerPATCH 47/107 speakup: Avoid crash on very long word
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Thibault <[email protected]>
commit c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1 upstream.
In case a console is set up really large and contains a really long word (> 256 characters), we have to stop before the length of the word buffer.
--- drivers/staging/speakup/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/speakup/main.c +1 -1
@@ -577,7 +577,7 @@ static u_long get_word(struct vc_data *v } attr_ch =get_char (vc, (u_short *)tmp_pos, &spk_attr); buf[cnt++] = attr_ch; -while (tmpx < vc->vc_cols -1 ) { +while (tmpx < vc->vc_cols -1 && cnt <sizeof (buf) -1 ) { tmp_pos +=2 ; tmpx++; ch =get_char (vc, (u_short *)tmp_pos, &temp);
Greg Kroah-Hartman
maintainerPATCH 48/107 fs: sysfs: Fix reference leak in sysfs_break_active_protection()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit a90bca2228c0646fc29a72689d308e5fe03e6d78 upstream.
The sysfs_break_active_protection() routine has an obvious reference leak in its error path. If the call to kernfs_find_and_get() fails then kn will be NULL, so the companion sysfs_unbreak_active_protection() routine won't get called (and would only cause an access violation by trying to dereference kn->parent if it was called). As a result, the reference to kobj acquired at the start of the function will never be released.
Fix the leak by adding an explicit kobject_put() call when kn is NULL.
--- fs/sysfs/file.c | 2 ++ 1 file changed, 2 insertions(+)
fs/sysfs/file.c +2 -0
@@ -429,6 +429,8 @@ struct kernfs_node *sysfs_break_active_p kn =kernfs_find_and_get (kobj->sd, attr->name);if (kn)kernfs_break_active_protection (kn); +else +kobject_put (kobj);return kn; }EXPORT_SYMBOL_GPL (sysfs_break_active_protection);
Greg Kroah-Hartman
maintainerPATCH 49/107 nouveau: fix instmem race condition around ptr stores
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Airlie <[email protected]>
commit fff1386cc889d8fb4089d285f883f8cba62d82ce upstream.
Running a lot of VK CTS in parallel against nouveau, once every few hours you might see something like this crash.
BUG: kernel NULL pointer dereference, address: 0000000000000008 PGD 8000000114e6e067 P4D 8000000114e6e067 PUD 109046067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 7 PID: 53891 Comm: deqp-vk Not tainted 6.8.0-rc6+ #27 Hardware name: Gigabyte Technology Co., Ltd. Z390 I AORUS PRO WIFI/Z390 I AORUS PRO WIFI-CF, BIOS F8 11/05/2021 RIP: 0010:gp100_vmm_pgt_mem+0xe3/0x180 [nouveau] Code: c7 48 01 c8 49 89 45 58 85 d2 0f 84 95 00 00 00 41 0f b7 46 12 49 8b 7e 08 89 da 42 8d 2c f8 48 8b 47 08 41 83 c7 01 48 89 ee <48> 8b 40 08 ff d0 0f 1f 00 49 8b 7e 08 48 89 d9 48 8d 75 04 48 c1 RSP: 0000:ffffac20c5857838 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 00000000004d8001 RCX: 0000000000000001 RDX: 00000000004d8001 RSI: 00000000000006d8 RDI: ffffa07afe332180 RBP: 00000000000006d8 R08: ffffac20c5857ad0 R09: 0000000000ffff10 R10: 0000000000000001 R11: ffffa07af27e2de0 R12: 000000000000001c R13: ffffac20c5857ad0 R14: ffffa07a96fe9040 R15: 000000000000001c FS: 00007fe395eed7c0(0000) GS:ffffa07e2c980000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 000000011febe001 CR4: 00000000003706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace:
...
? gp100_vmm_pgt_mem+0xe3/0x180 [nouveau] ? gp100_vmm_pgt_mem+0x37/0x180 [nouveau] nvkm_vmm_iter+0x351/0xa20 [nouveau] ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] ? __lock_acquire+0x3ed/0x2170 ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] nvkm_vmm_ptes_get_map+0xc2/0x100 [nouveau] ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] nvkm_vmm_map_locked+0x224/0x3a0 [nouveau]
Adding any sort of useful debug usually makes it go away, so I hand wrote the function in a line, and debugged the asm.
Every so often pt->memory->ptrs is NULL. This ptrs ptr is set in the nv50_instobj_acquire called from nvkm_kmap.
If Thread A and Thread B both get to nv50_instobj_acquire around the same time, and Thread A hits the refcount_set line, and in lockstep thread B succeeds at refcount_inc_not_zero, there is a chance the ptrs value won't have been stored since refcount_set is unordered. Force a memory barrier here, I picked smp_mb, since we want it on all CPUs and it's write followed by a read.
v2: use paired smp_rmb/smp_wmb.
--- drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c +6 -1
@@ -221,8 +221,11 @@ nv50_instobj_acquire(struct nvkm_memoryvoid __iomem *map =NULL ;/* Already mapped? */ -if (refcount_inc_not_zero (&iobj->maps)) +if (refcount_inc_not_zero (&iobj->maps)) { +/* read barrier match the wmb on refcount set */ +smp_rmb ();return iobj->map; + }/* Take the lock, and re-check that another thread hasn't * already mapped the object in the meantime.
@@ -249,6 +252,8 @@ nv50_instobj_acquire(struct nvkm_memory iobj->base.memory.ptrs = &nv50_instobj_fast; else iobj->base.memory.ptrs = &nv50_instobj_slow; +/* barrier to ensure the ptrs are written before refcount is set */ +smp_wmb ();refcount_set (&iobj->maps,1 ); }
Greg Kroah-Hartman
maintainerPATCH 50/107 nilfs2: fix OOB in nilfs_set_de_type
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
commit c4a7dc9523b59b3e73fd522c73e95e072f876b16 upstream.
The size of the nilfs_type_by_mode array in the fs/nilfs2/dir.c file is defined as "S_IFMT >> S_SHIFT", but the nilfs_set_de_type() function, which uses this array, specifies the index to read from the array in the same way as "(mode & S_IFMT) >> S_SHIFT".
static void nilfs_set_de_type(struct nilfs_dir_entry *de, struct inode
*inode)
{
umode_t mode = inode->i_mode;
de->file_type = nilfs_type_by_mode[(mode & S_IFMT)>>S_SHIFT]; // oob
}However, when the index is determined this way, an out-of-bounds (OOB) error occurs by referring to an index that is 1 larger than the array size when the condition "mode & S_IFMT == S_IFMT" is satisfied. Therefore, a patch to resize the nilfs_type_by_mode array should be applied to prevent OOB errors.
--- fs/nilfs2/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nilfs2/dir.c +1 -1
@@ -243,7 +243,7 @@ nilfs_filetype_table[NILFS_FT_MAX] = {#define S_SHIFT 12static unsigned char -nilfs_type_by_mode[S_IFMT >>S_SHIFT ] = { +nilfs_type_by_mode[(S_IFMT >>S_SHIFT ) +1 ] = { [S_IFREG >>S_SHIFT ] =NILFS_FT_REG_FILE , [S_IFDIR >>S_SHIFT ] =NILFS_FT_DIR , [S_IFCHR >>S_SHIFT ] =NILFS_FT_CHRDEV ,
Greg Kroah-Hartman
maintainerPATCH 51/107 KVM: async_pf: Cleanup kvm_setup_async_pf()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Kuznetsov <[email protected]>
commit 7863e346e1089b40cac1c7d9098314c405e2e1e3 upstream.
schedule_work() returns 'false' only when the work is already on the queue and this can't happen as kvm_setup_async_pf() always allocates a new one. Also, to avoid potential race, it makes sense to to schedule_work() at the very end after we've added it to the queue.
While on it, do some minor cleanup. gfn_to_pfn_async() mentioned in a comment does not currently exist and, moreover, we can check kvm_is_error_hva() at the very beginning, before we try to allocate work so 'retry_sync' label can go away completely.
Message-Id: <[email protected]>
--- virt/kvm/async_pf.c | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-)
virt/kvm/async_pf.c +6 -13
@@ -195,7 +195,9 @@ int kvm_setup_async_pf(struct kvm_vcpu *if (vcpu->async_pf.queued >=ASYNC_PF_PER_VCPU )return 0 ; -/* setup delayed work */ +/* Arch specific code should not do async PF in this case */ +if (unlikely (kvm_is_error_hva (hva))) +return 0 ;/* * do alloc nowait since if we are going to sleep anyway we
@@ -213,24 +215,15 @@ int kvm_setup_async_pf(struct kvm_vcpu * work->mm = current->mm;mmget (work->mm); -/* this can't really happen otherwise gfn_to_pfn_async -would succeed */ -if (unlikely (kvm_is_error_hva (work->addr))) - goto retry_sync; -INIT_WORK (&work->work, async_pf_execute); -if (!schedule_work (&work->work)) - goto retry_sync;list_add_tail (&work->queue, &vcpu->async_pf.queue); vcpu->async_pf.queued++;kvm_arch_async_page_not_present (vcpu, work); + +schedule_work (&work->work); +return 1 ; -retry_sync: -kvm_put_kvm (work->vcpu->kvm); -mmput (work->mm); -kmem_cache_free (async_pf_cache, work); -return 0 ; }int kvm_async_pf_wakeup_all (struct kvm_vcpu *vcpu)
Greg Kroah-Hartman
maintainerPATCH 52/107 arm64: dts: rockchip: fix alphabetical ordering RK3399 puma
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Iskander Amara <[email protected]>
[ Upstream commit f0abb4b2c7acf3c3e4130dc3f54cd90cf2ae62bc ]
Nodes overridden by their reference should be ordered alphabetically to make it easier to read the DTS. pinctrl node is defined in the wrong location so let's reorder it.
Stable-dep-of: 945a7c857091 ("arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma")
--- arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +9 -9
@@ -425,15 +425,6 @@ gpio1830-supply = <&vcc_1v8>; }; -&pmu_io_domains { - status = "okay"; - pmu1830-supply = <&vcc_1v8>; -}; - -&pwm2 { - status = "okay"; -}; - &pinctrl { i2c8 { i2c8_xfer_a: i2c8-xfer {
@@ -465,6 +456,15 @@ }; }; +&pmu_io_domains { + status = "okay"; + pmu1830-supply = <&vcc_1v8>; +}; + +&pwm2 { + status = "okay"; +}; + &sdhci { /* * Signal integrity isn't great at 200MHz but 100MHz has proven stable
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/107 arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quentin Schulz <[email protected]>
[ Upstream commit 945a7c8570916650a415757d15d83e0fa856a686 ]
The PCIE_WAKE# has a diode used as a level-shifter, and is used as an input pin. While the SoC default is to enable the pull-up, the core rk3399 pinconf for this pin opted for pull-none. So as to not disturb the behaviour of other boards which may rely on pull-none instead of pull-up, set the needed pull-up only for RK3399 Puma.
--- arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 5 +++++ 1 file changed, 5 insertions(+)
arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +5 -0
@@ -425,6 +425,11 @@ gpio1830-supply = <&vcc_1v8>; }; +&pcie_clkreqn_cpm { + rockchip,pins = + <2 RK_PD2 RK_FUNC_GPIO &pcfg_pull_up>; +}; + &pinctrl { i2c8 { i2c8_xfer_a: i2c8-xfer {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/107 arm64: dts: mediatek: mt8183: Add power-domains properity to mfgcfg
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ikjoon Jang <[email protected]>
[ Upstream commit 1781f2c461804c0123f59afc7350e520a88edffb ]
mfgcfg clock is under MFG_ASYNC power domain.
--- arch/arm64/boot/dts/mediatek/mt8183.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/mediatek/mt8183.dtsi +1 -0
@@ -577,6 +577,7 @@ compatible = "mediatek,mt8183-mfgcfg", "syscon"; reg = <0 0x13000000 0 0x1000>; #clock-cells = <1>; + power-domains = <&spm MT8183_POWER_DOMAIN_MFG_ASYNC>; }; mmsys: syscon@14000000 {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/107 arm64: dts: mediatek: mt7622: fix IR nodename
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit 800dc93c3941e372c94278bf4059e6e82f60bd66 ]
Fix following validation error:arch/arm64/boot/dts/mediatek/mt7622-rfb1.dtb: cir@10009000: $nodename:0: 'cir@10009000' does not match '^ir(-receiver)?(@[a-f0-9]+)?$'
from schema $id: http://devicetree.org/schemas/media/mediatek,mt7622-cir.yaml#
--- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt7622.dtsi +1 -1
@@ -244,7 +244,7 @@ clock-names = "hif_sel"; }; - cir: cir@10009000 { + cir: ir-receiver@10009000 { compatible = "mediatek,mt7622-cir"; reg = <0 0x10009000 0 0x1000>; interrupts = <GIC_SPI 175 IRQ_TYPE_LEVEL_LOW>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/107 arm64: dts: mediatek: mt7622: fix ethernet controller "compatible"
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit 208add29ce5b7291f6c466e4dfd9cbf61c72888e ]
Fix following validation error:arch/arm64/boot/dts/mediatek/mt7622-rfb1.dtb: ethernet@1b100000: compatible: ['mediatek,mt7622-eth', 'mediatek,mt2701-eth', 'syscon'] is too long
from schema $id: http://devicetree.org/schemas/net/mediatek,net.yaml#
(and other complains about wrong clocks).
--- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
arch/arm64/boot/dts/mediatek/mt7622.dtsi +1 -3
@@ -901,9 +901,7 @@ }; eth: ethernet@1b100000 { - compatible = "mediatek,mt7622-eth", - "mediatek,mt2701-eth", - "syscon"; + compatible = "mediatek,mt7622-eth"; reg = <0 0x1b100000 0 0x20000>; interrupts = <GIC_SPI 223 IRQ_TYPE_LEVEL_LOW>, <GIC_SPI 224 IRQ_TYPE_LEVEL_LOW>,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/107 arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit ecb5b0034f5bcc35003b4b965cf50c6e98316e79 ]
Binding doesn't specify "reset-names" property and Linux driver also doesn't use it.
Fix following validation error:arch/arm64/boot/dts/mediatek/mt7622-rfb1.dtb: thermal@1100b000: Unevaluated properties are not allowed ('reset-names' was unexpected)
from schema $id: http://devicetree.org/schemas/thermal/mediatek,thermal.yaml#
--- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 1 - 1 file changed, 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt7622.dtsi +0 -1
@@ -507,7 +507,6 @@ <&pericfg CLK_PERI_AUXADC_PD>; clock-names = "therm", "auxadc"; resets = <&pericfg MT7622_PERI_THERM_SW_RST>; - reset-names = "therm"; mediatek,auxadc = <&auxadc>; mediatek,apmixedsys = <&apmixedsys>; nvmem-cells = <&thermal_calibration>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/107 arm64: dts: mt2712: add ethernet device node
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biao Huang <[email protected]>
[ Upstream commit e9cabfd046d55d05f11d05fccc4019aa4bad29c6 ]
This patch add device node for mt2712 ethernet.
Stable-dep-of: 3baac7291eff ("arm64: dts: mediatek: mt2712: fix validation errors")
--- arch/arm64/boot/dts/mediatek/mt2712-evb.dts | 74 +++++++++++++++++++++ arch/arm64/boot/dts/mediatek/mt2712e.dtsi | 65 ++++++++++++++++++ 2 files changed, 139 insertions(+)
arch/arm64/boot/dts/mediatek/mt2712-evb.dts +74 -0
@@ -105,7 +105,81 @@ proc-supply = <&cpus_fixed_vproc1>; }; +ð { + phy-mode ="rgmii-rxid"; + phy-handle = <ðernet_phy0>; + mediatek,tx-delay-ps = <1530>; + snps,reset-gpio = <&pio 87 GPIO_ACTIVE_LOW>; + pinctrl-names = "default", "sleep"; + pinctrl-0 = <ð_default>; + pinctrl-1 = <ð_sleep>; + status = "okay"; + + mdio { + compatible = "snps,dwmac-mdio"; + #address-cells = <1>; + #size-cells = <0>; + ethernet_phy0: ethernet-phy@5 { + compatible = "ethernet-phy-id0243.0d90"; + reg = <0x5>; + }; + }; +}; + &pio { + eth_default: eth_default { + tx_pins { + pinmux = <MT2712_PIN_71_GBE_TXD3__FUNC_GBE_TXD3>, + <MT2712_PIN_72_GBE_TXD2__FUNC_GBE_TXD2>, + <MT2712_PIN_73_GBE_TXD1__FUNC_GBE_TXD1>, + <MT2712_PIN_74_GBE_TXD0__FUNC_GBE_TXD0>, + <MT2712_PIN_75_GBE_TXC__FUNC_GBE_TXC>, + <MT2712_PIN_76_GBE_TXEN__FUNC_GBE_TXEN>; + drive-strength = <MTK_DRIVE_8mA>; + }; + rx_pins { + pinmux = <MT2712_PIN_78_GBE_RXD3__FUNC_GBE_RXD3>, + <MT2712_PIN_79_GBE_RXD2__FUNC_GBE_RXD2>, + <MT2712_PIN_80_GBE_RXD1__FUNC_GBE_RXD1>, + <MT2712_PIN_81_GBE_RXD0__FUNC_GBE_RXD0>, + <MT2712_PIN_82_GBE_RXDV__FUNC_GBE_RXDV>, + <MT2712_PIN_84_GBE_RXC__FUNC_GBE_RXC>; + input-enable; + }; + mdio_pins { + pinmux = <MT2712_PIN_85_GBE_MDC__FUNC_GBE_MDC>, + <MT2712_PIN_86_GBE_MDIO__FUNC_GBE_MDIO>; + drive-strength = <MTK_DRIVE_8mA>; + input-enable; + }; + }; + + eth_sleep: eth_sleep { + tx_pins { + pinmux = <MT2712_PIN_71_GBE_TXD3__FUNC_GPIO71>, + <MT2712_PIN_72_GBE_TXD2__FUNC_GPIO72>, + <MT2712_PIN_73_GBE_TXD1__FUNC_GPIO73>, + <MT2712_PIN_74_GBE_TXD0__FUNC_GPIO74>, + <MT2712_PIN_75_GBE_TXC__FUNC_GPIO75>, + <MT2712_PIN_76_GBE_TXEN__FUNC_GPIO76>; + }; + rx_pins { + pinmux = <MT2712_PIN_78_GBE_RXD3__FUNC_GPIO78>, + <MT2712_PIN_79_GBE_RXD2__FUNC_GPIO79>, + <MT2712_PIN_80_GBE_RXD1__FUNC_GPIO80>, + <MT2712_PIN_81_GBE_RXD0__FUNC_GPIO81>, + <MT2712_PIN_82_GBE_RXDV__FUNC_GPIO82>, + <MT2712_PIN_84_GBE_RXC__FUNC_GPIO84>; + input-disable; + }; + mdio_pins { + pinmux = <MT2712_PIN_85_GBE_MDC__FUNC_GPIO85>, + <MT2712_PIN_86_GBE_MDIO__FUNC_GPIO86>; + input-disable; + bias-disable; + }; + }; + usb0_id_pins_float: usb0_iddig { pins_iddig { pinmux = <MT2712_PIN_12_IDDIG_P0__FUNC_IDDIG_A>;
arch/arm64/boot/dts/mediatek/mt2712e.dtsi +65 -0
71 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/107 arm64: dts: mediatek: mt2712: fix validation errors
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit 3baac7291effb501c4d52df7019ebf52011e5772 ]
1. Fixup infracfg clock controller binding
It also acts as reset controller so #reset-cells is required.
2. Use -pins suffix for pinctrl
This fixes:arch/arm64/boot/dts/mediatek/mt2712-evb.dtb: syscon@10001000: '#reset-cells' is a required property
from schema $id: http://devicetree.org/schemas/arm/mediatek/mediatek,infracfg.yaml#arch/arm64/boot/dts/mediatek/mt2712-evb.dtb: pinctrl@1000b000: 'eth_default', 'eth_sleep', 'usb0_iddig', 'usb1_iddig' do not match any of the regexes: 'pinctrl-[0-9]+', 'pins$'
from schema $id: http://devicetree.org/schemas/pinctrl/mediatek,mt65xx-pinctrl.yaml#
--- arch/arm64/boot/dts/mediatek/mt2712-evb.dts | 8 ++++---- arch/arm64/boot/dts/mediatek/mt2712e.dtsi | 3 ++- 2 files changed, 6 insertions(+), 5 deletions(-)
arch/arm64/boot/dts/mediatek/mt2712-evb.dts +4 -4
@@ -127,7 +127,7 @@ }; &pio { - eth_default: eth_default { + eth_default: eth-default-pins { tx_pins { pinmux = <MT2712_PIN_71_GBE_TXD3__FUNC_GBE_TXD3>, <MT2712_PIN_72_GBE_TXD2__FUNC_GBE_TXD2>,
@@ -154,7 +154,7 @@ }; }; - eth_sleep: eth_sleep { + eth_sleep: eth-sleep-pins { tx_pins { pinmux = <MT2712_PIN_71_GBE_TXD3__FUNC_GPIO71>, <MT2712_PIN_72_GBE_TXD2__FUNC_GPIO72>,
@@ -180,14 +180,14 @@ }; }; - usb0_id_pins_float: usb0_iddig { + usb0_id_pins_float: usb0-iddig-pins { pins_iddig { pinmux = <MT2712_PIN_12_IDDIG_P0__FUNC_IDDIG_A>; bias-pull-up; }; }; - usb1_id_pins_float: usb1_iddig { + usb1_id_pins_float: usb1-iddig-pins { pins_iddig { pinmux = <MT2712_PIN_14_IDDIG_P1__FUNC_IDDIG_B>; bias-pull-up;
arch/arm64/boot/dts/mediatek/mt2712e.dtsi +2 -1
@@ -249,10 +249,11 @@ #clock-cells = <1>; }; - infracfg: syscon@10001000 { + infracfg: clock-controller@10001000 { compatible = "mediatek,mt2712-infracfg", "syscon"; reg = <0 0x10001000 0 0x1000>; #clock-cells = <1>; + #reset-cells = <1>; }; pericfg: syscon@10003000 {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/107 ARC: [plat-hsdk]: Remove misplaced interrupt-cells property
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Brodkin <[email protected]>
[ Upstream commit 61231eb8113ce47991f35024f9c20810b37996bf ]
"gmac" node stands for just an ordinary Ethernet controller, which is by no means a provider of interrupts, i.e. it doesn't serve as an interrupt controller, thus "#interrupt-cells" property doesn't belong to it and so we remove it.
Fixes:
------------>8------------
DTC arch/arc/boot/dts/hsdk.dtb
arch/arc/boot/dts/hsdk.dts:207.23-235.5: Warning (interrupt_provider): /soc/ethernet@8000: '#interrupt-cells' found, but node is not an interrupt provider arch/arc/boot/dts/hsdk.dtb: Warning (interrupt_map): Failed prerequisite 'interrupt_provider'
------------>8------------
--- arch/arc/boot/dts/hsdk.dts | 1 - 1 file changed, 1 deletion(-)
arch/arc/boot/dts/hsdk.dts +0 -1
@@ -205,7 +205,6 @@ }; gmac: ethernet@8000 { - #interrupt-cells = <1>; compatible = "snps,dwmac"; reg = <0x8000 0x2000>; interrupts = <10>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/107 vxlan: drop packets from invalid src-address
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Bauer <[email protected]>
[ Upstream commit f58f45c1e5b92975e91754f5407250085a6ae7cf ]
The VXLAN driver currently does not check if the inner layer2 source-address is valid.
In case source-address snooping/learning is enabled, a entry in the FDB for the invalid address is created with the layer3 address of the tunnel endpoint.
If the frame happens to have a non-unicast address set, all this non-unicast traffic is subsequently not flooded to the tunnel network but sent to the learnt host in the FDB. To make matters worse, this FDB entry does not expire.
Apply the same filtering for packets as it is done for bridges. This not only drops these invalid packets but avoids them from being learnt into the FDB.
--- drivers/net/vxlan.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/vxlan.c +4 -0
@@ -1605,6 +1605,10 @@ static bool vxlan_set_mac(struct vxlan_dev *vxlan,if (ether_addr_equal (eth_hdr (skb)->h_source, vxlan->dev->dev_addr))return false; +/* Ignore packets from invalid src-address */ +if (!is_valid_ether_addr (eth_hdr (skb)->h_source)) +return false; +/* Get address from the outer IP header */ if (vxlan_get_sk_family (vs) ==AF_INET ) { saddr.sin.sin_addr.s_addr =ip_hdr (skb)->saddr;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/107 mlxsw: core: Unregister EMAD trap using FORWARD action
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 976c44af48141cd8595601c0af2a19a43c5b228b ]
The device's manual (PRM - Programmer's Reference Manual) classifies the trap that is used to deliver EMAD responses as an "event trap". Among other things, it means that the only actions that can be associated with the trap are TRAP and FORWARD (NOP).
Currently, during driver de-initialization the driver unregisters the trap by setting its action to DISCARD, which violates the above guideline. Future firmware versions will prevent such misuses by returning an error. This does not prevent the driver from working, but an error will be printed to the kernel log during module removal / devlink reload:
mlxsw_spectrum 0000:03:00.0: Reg cmd access status failed (status=7(bad parameter)) mlxsw_spectrum 0000:03:00.0: Reg cmd access failed (reg_id=7003(hpkt),type=write)
Suppress the error message by aligning the driver to the manual and use a FORWARD (NOP) action when unregistering the trap.
--- drivers/net/ethernet/mellanox/mlxsw/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlxsw/core.c +1 -1
@@ -566,7 +566,7 @@ static void mlxsw_emad_rx_listener_func(struct sk_buff *skb, u8 local_port,static const struct mlxsw_listener mlxsw_emad_rx_listener =MLXSW_RXL (mlxsw_emad_rx_listener_func,ETHEMAD ,TRAP_TO_CPU , false, -EMAD ,DISCARD ); +EMAD ,FORWARD );static int mlxsw_emad_init (struct mlxsw_core *mlxsw_core) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/107 NFC: trf7970a: disable all regulators on removal
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Geurts <[email protected]>
[ Upstream commit 6bea4f03c6a4e973ef369e15aac88f37981db49e ]
During module probe, regulator 'vin' and 'vdd-io' are used and enabled, but the vdd-io regulator overwrites the 'vin' regulator pointer. During remove, only the vdd-io is disabled, as the vin regulator pointer is not available anymore. When regulator_put() is called during resource cleanup a kernel warning is given, as the regulator is still enabled.
Store the two regulators in separate pointers and disable both the regulators on module remove.
--- drivers/nfc/trf7970a.c | 42 +++++++++++++++++++++++------------------- 1 file changed, 23 insertions(+), 19 deletions(-)
drivers/nfc/trf7970a.c +23 -19
@@ -424,7 +424,8 @@ struct trf7970a {enum trf7970a_state state;struct device *dev;struct spi_device *spi; -struct regulator *regulator; +struct regulator *vin_regulator; +struct regulator *vddio_regulator;struct nfc_digital_dev *ddev;u32 quirks;bool is_initiator;
@@ -1883,7 +1884,7 @@ static int trf7970a_power_up(struct trf7970a *trf)if (trf->state !=TRF7970A_ST_PWR_OFF )return 0 ; - ret =regulator_enable (trf->regulator); + ret =regulator_enable (trf->vin_regulator);if (ret) {dev_err (trf->dev,"%s - Can't enable VIN: %d\n" , __func__, ret);return ret;
@@ -1926,7 +1927,7 @@ static int trf7970a_power_down(struct trf7970a *trf)if (trf->en2_gpiod && !(trf->quirks &TRF7970A_QUIRK_EN2_MUST_STAY_LOW ))gpiod_set_value_cansleep (trf->en2_gpiod,0 ); - ret =regulator_disable (trf->regulator); + ret =regulator_disable (trf->vin_regulator);if (ret)dev_err (trf->dev,"%s - Can't disable VIN: %d\n" , __func__, ret);
@@ -2065,37 +2066,37 @@ static int trf7970a_probe(struct spi_device *spi)mutex_init (&trf->lock);INIT_DELAYED_WORK (&trf->timeout_work, trf7970a_timeout_work_handler); - trf->regulator =devm_regulator_get (&spi->dev,"vin" ); -if (IS_ERR (trf->regulator)) { - ret =PTR_ERR (trf->regulator); + trf->vin_regulator =devm_regulator_get (&spi->dev,"vin" ); +if (IS_ERR (trf->vin_regulator)) { + ret =PTR_ERR (trf->vin_regulator);dev_err (trf->dev,"Can't get VIN regulator: %d\n" , ret); goto err_destroy_lock; } - ret =regulator_enable (trf->regulator); + ret =regulator_enable (trf->vin_regulator);if (ret) {dev_err (trf->dev,"Can't enable VIN: %d\n" , ret); goto err_destroy_lock; } - uvolts =regulator_get_voltage (trf->regulator); + uvolts =regulator_get_voltage (trf->vin_regulator);if (uvolts >4000000 ) trf->chip_status_ctrl =TRF7970A_CHIP_STATUS_VRS5_3 ; - trf->regulator =devm_regulator_get (&spi->dev,"vdd-io" ); -if (IS_ERR (trf->regulator)) { - ret =PTR_ERR (trf->regulator); + trf->vddio_regulator =devm_regulator_get (&spi->dev,"vdd-io" ); +if (IS_ERR (trf->vddio_regulator)) { + ret =PTR_ERR (trf->vddio_regulator);dev_err (trf->dev,"Can't get VDD_IO regulator: %d\n" , ret); - goto err_destroy_lock; + goto err_disable_vin_regulator; } - ret =regulator_enable (trf->regulator); + ret =regulator_enable (trf->vddio_regulator);if (ret) {dev_err (trf->dev,"Can't enable VDD_IO: %d\n" , ret); - goto err_destroy_lock; + goto err_disable_vin_regulator; } -if (regulator_get_voltage (trf->regulator) ==1800000 ) { +if (regulator_get_voltage (trf->vddio_regulator) ==1800000 ) { trf->io_ctrl =TRF7970A_REG_IO_CTRL_IO_LOW ;dev_dbg (trf->dev,"trf7970a config vdd_io to 1.8V\n" ); }
@@ -2108,7 +2109,7 @@ static int trf7970a_probe(struct spi_device *spi)if (!trf->ddev) {dev_err (trf->dev,"Can't allocate NFC digital device\n" ); ret = -ENOMEM ; - goto err_disable_regulator; + goto err_disable_vddio_regulator; }nfc_digital_set_parent_dev (trf->ddev, trf->dev);
@@ -2137,8 +2138,10 @@ static int trf7970a_probe(struct spi_device *spi)trf7970a_shutdown (trf); err_free_ddev:nfc_digital_free_device (trf->ddev); -err_disable_regulator: -regulator_disable (trf->regulator); +err_disable_vddio_regulator: +regulator_disable (trf->vddio_regulator); +err_disable_vin_regulator: +regulator_disable (trf->vin_regulator); err_destroy_lock:mutex_destroy (&trf->lock);return ret;
@@ -2157,7 +2160,8 @@ static int trf7970a_remove(struct spi_device *spi)nfc_digital_unregister_device (trf->ddev);nfc_digital_free_device (trf->ddev); -regulator_disable (trf->regulator); +regulator_disable (trf->vddio_regulator); +regulator_disable (trf->vin_regulator);mutex_destroy (&trf->lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/107 net: usb: ax88179_178a: stop lying about skb->truesize
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 4ce62d5b2f7aecd4900e7d6115588ad7f9acccca ]
Some usb drivers try to set small skb->truesize and break core networking stacks.
In this patch, I removed one of the skb->truesize overide.
I also replaced one skb_clone() by an allocation of a fresh and small skb, to get minimally sized skbs, like we did in commit 1e2c61172342 ("net: cdc_ncm: reduce skb truesize in rx path")
--- drivers/net/usb/ax88179_178a.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-)
drivers/net/usb/ax88179_178a.c +3 -8
@@ -1452,21 +1452,16 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb)/* Skip IP alignment pseudo header */ skb_pull (skb,2 ); - skb->truesize =SKB_TRUESIZE (pkt_len_plus_padd);ax88179_rx_checksum (skb, pkt_hdr);return 1 ; } - ax_skb =skb_clone (skb,GFP_ATOMIC ); + ax_skb =netdev_alloc_skb_ip_align (dev->net, pkt_len);if (!ax_skb)return 0 ; -skb_trim (ax_skb, pkt_len); +skb_put (ax_skb, pkt_len); +memcpy (ax_skb->data, skb->data +2 , pkt_len); -/* Skip IP alignment pseudo header */ -skb_pull (ax_skb,2 ); - - skb->truesize = pkt_len_plus_padd + -SKB_DATA_ALIGN (sizeof (struct sk_buff ));ax88179_rx_checksum (ax_skb, pkt_hdr);usbnet_skb_return (dev, ax_skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/107 net: gtp: Fix Use-After-Free in gtp_dellink
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
[ Upstream commit f2a904107ee2b647bb7794a1a82b67740d7c8a64 ]
Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal of gtp_dellink, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free.
To prevent this, it should be changed to hlist_for_each_entry_safe.
--- drivers/net/gtp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/gtp.c +2 -1
@@ -706,11 +706,12 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,static void gtp_dellink (struct net_device *dev,struct list_head *head) {struct gtp_dev *gtp =netdev_priv (dev); +struct hlist_node *next;struct pdp_ctx *pctx;int i;for (i =0 ; i < gtp->hash_size; i++) -hlist_for_each_entry_rcu (pctx, >p->tid_hash[i], hlist_tid) +hlist_for_each_entry_safe (pctx, next, >p->tid_hash[i], hlist_tid)pdp_context_delete (pctx);list_del_rcu (>p->list);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/107 ipvs: Fix checksumming on GSO of SCTP packets
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ismael Luceno <[email protected]>
[ Upstream commit e10d3ba4d434ed172914617ed8d74bd411421193 ]
It was observed in the wild that pairs of consecutive packets would leave the IPVS with the same wrong checksum, and the issue only went away when disabling GSO.
IPVS needs to avoid computing the SCTP checksum when using GSO.
--- net/netfilter/ipvs/ip_vs_proto_sctp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/netfilter/ipvs/ip_vs_proto_sctp.c +4 -2
@@ -126,7 +126,8 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,if (sctph->source != cp->vport || payload_csum || skb->ip_summed ==CHECKSUM_PARTIAL ) { sctph->source = cp->vport; -sctp_nat_csum (skb, sctph, sctphoff); +if (!skb_is_gso (skb) || !skb_is_gso_sctp (skb)) +sctp_nat_csum (skb, sctph, sctphoff); }else { skb->ip_summed =CHECKSUM_UNNECESSARY ; }
@@ -174,7 +175,8 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, (skb->ip_summed == CHECKSUM_PARTIAL && !(skb_dst(skb)->dev->features & NETIF_F_SCTP_CRC))) { sctph->dest = cp->dport; -sctp_nat_csum (skb, sctph, sctphoff); +if (!skb_is_gso (skb) || !skb_is_gso_sctp (skb)) +sctp_nat_csum (skb, sctph, sctphoff); } else if (skb->ip_summed != CHECKSUM_PARTIAL) { skb->ip_summed =CHECKSUM_UNNECESSARY ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/107 net: openvswitch: Fix Use-After-Free in ovs_ct_exit
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
[ Upstream commit 5ea7b72d4fac2fdbc0425cd8f2ea33abe95235b2 ]
Since kfree_rcu, which is called in the hlist_for_each_entry_rcu traversal of ovs_ct_limit_exit, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free.
To prevent this, it should be changed to hlist_for_each_entry_safe.
--- net/openvswitch/conntrack.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/openvswitch/conntrack.c +2 -2
@@ -1897,9 +1897,9 @@ static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net)for (i =0 ; i <CT_LIMIT_HASH_BUCKETS ; ++i) {struct hlist_head *head = &info->limits[i];struct ovs_ct_limit *ct_limit; +struct hlist_node *next; -hlist_for_each_entry_rcu (ct_limit, head, hlist_node, -lockdep_ovsl_is_held ()) +hlist_for_each_entry_safe (ct_limit, next, head, hlist_node)kfree_rcu (ct_limit, rcu); }kfree (ovs_net->ct_limit_info->limits);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/107 mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit d90cfe20562407d9f080d24123078d666d730707 ]
The purpose of the rehash delayed work is to reduce the number of masks (eRPs) used by an ACL region as the eRP bank is a global and limited resource.
This is done in three steps:
1. Creating a new set of masks and a new ACL region which will use the new masks and to which the existing filters will be migrated to. The new region is assigned to 'vregion->region' and the region from which the filters are migrated from is assigned to 'vregion->region2'.
2. Migrating all the filters from the old region to the new region.
3. Destroying the old region and setting 'vregion->region2' to NULL.
Only the second steps is performed under the 'vregion->lock' mutex although its comments says that among other things it "Protects consistency of region, region2 pointers".
This is problematic as the first step can race with filter insertion from user space that uses 'vregion->region', but under the mutex.
Fix by holding the mutex across the entirety of the delayed work and not only during the second step.
--- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +2 -2
@@ -756,7 +756,9 @@ static void mlxsw_sp_acl_tcam_vregion_rehash_work(struct work_struct *work) rehash.dw.work);int credits =MLXSW_SP_ACL_TCAM_VREGION_REHASH_CREDITS ; +mutex_lock (&vregion->lock);mlxsw_sp_acl_tcam_vregion_rehash (vregion->mlxsw_sp, vregion, &credits); +mutex_unlock (&vregion->lock);if (credits <0 )/* Rehash gone out of credits so it was interrupted. * Schedule the work as soon as possible to continue.
@@ -1394,7 +1396,6 @@ mlxsw_sp_acl_tcam_vregion_migrate(struct mlxsw_sp *mlxsw_sp,int err, err2;trace_mlxsw_sp_acl_tcam_vregion_migrate (mlxsw_sp, vregion); -mutex_lock (&vregion->lock); err =mlxsw_sp_acl_tcam_vchunk_migrate_all (mlxsw_sp, vregion, ctx, credits);if (err) {
@@ -1414,7 +1415,6 @@ mlxsw_sp_acl_tcam_vregion_migrate(struct mlxsw_sp *mlxsw_sp,/* Let the rollback to be continued later on. */ } } -mutex_unlock (&vregion->lock);trace_mlxsw_sp_acl_tcam_vregion_migrate_end (mlxsw_sp, vregion);return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/107 mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 79b5b4b18bc85b19d3a518483f9abbbe6d7b3ba4 ]
The rule activity update delayed work periodically traverses the list of configured rules and queries their activity from the device.
As part of this task it accesses the entry pointed by 'ventry->entry', but this entry can be changed concurrently by the rehash delayed work, leading to a use-after-free [1].
Fix by closing the race and perform the activity query under the 'vregion->lock' mutex.
[1]
BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140 Read of size 8 at addr ffff8881054ed808 by task kworker/0:18/181 CPU: 0 PID: 181 Comm: kworker/0:18 Not tainted 6.9.0-rc2-custom-00781-gd5ab772d32f7 #2 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_rule_activity_update_work Call Trace: <TASK> dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140 mlxsw_sp_acl_rule_activity_update_work+0x219/0x400 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 1039: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc+0x19c/0x360 mlxsw_sp_acl_tcam_entry_create+0x7b/0x1f0 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x30d/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 Freed by task 1039: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x102/0x170 __kasan_slab_free+0x14/0x30 kfree+0xc1/0x290 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3d7/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30
--- .../net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +8 -2
@@ -1230,8 +1230,14 @@ mlxsw_sp_acl_tcam_ventry_activity_get(struct mlxsw_sp *mlxsw_sp,struct mlxsw_sp_acl_tcam_ventry *ventry, bool *activity) { - return mlxsw_sp_acl_tcam_entry_activity_get(mlxsw_sp, - ventry->entry, activity); + struct mlxsw_sp_acl_tcam_vregion *vregion = ventry->vchunk->vregion; +int err; + +mutex_lock (&vregion->lock); + err =mlxsw_sp_acl_tcam_entry_activity_get (mlxsw_sp, ventry->entry, + activity); +mutex_unlock (&vregion->lock); +return err; } static int
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/107 mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 54225988889931467a9b55fdbef534079b665519 ]
The rehash delayed work migrates filters from one region to another according to the number of available credits.
The migrated from region is destroyed at the end of the work if the number of credits is non-negative as the assumption is that this is indicative of migration being complete. This assumption is incorrect as a non-negative number of credits can also be the result of a failed migration.
The destruction of a region that still has filters referencing it can result in a use-after-free [1].
Fix by not destroying the region if migration failed.
[1]
BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 Read of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858 CPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G W 6.9.0-rc2-custom-00782-gf2275c2157d8 #5 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work Call Trace: <TASK> dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70 mlxsw_sp_acl_atcam_entry_del+0x81/0x210 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 174: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc+0x19c/0x360 mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0 mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 Freed by task 7: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x102/0x170 __kasan_slab_free+0x14/0x30 kfree+0xc1/0x290 mlxsw_sp_acl_tcam_region_destroy+0x272/0x310 mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30
--- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +1 -0
@@ -1522,6 +1522,7 @@ mlxsw_sp_acl_tcam_vregion_rehash(struct mlxsw_sp *mlxsw_sp, ctx, credits);if (err) {dev_err (mlxsw_sp->bus_info->dev,"Failed to migrate vregion\n" ); +return ; }if (*credits >=0 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/107 mlxsw: spectrum_acl_tcam: Rate limit error message
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 5bcf925587e9b5d36420d572a0b4d131c90fb306 ]
In the rare cases when the device resources are exhausted it is likely that the rehash delayed work will fail. An error message will be printed whenever this happens which can be overwhelming considering the fact that the work is per-region and that there can be hundreds of regions.
Fix by rate limiting the error message.
--- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +1 -1
@@ -1521,7 +1521,7 @@ mlxsw_sp_acl_tcam_vregion_rehash(struct mlxsw_sp *mlxsw_sp, err =mlxsw_sp_acl_tcam_vregion_migrate (mlxsw_sp, vregion, ctx, credits);if (err) { -dev_err (mlxsw_sp->bus_info->dev,"Failed to migrate vregion\n" ); +dev_err_ratelimited (mlxsw_sp->bus_info->dev,"Failed to migrate vregion\n" );return ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/107 mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 8ca3f7a7b61393804c46f170743c3b839df13977 ]
The rehash delayed work migrates filters from one region to another. This is done by iterating over all chunks (all the filters with the same priority) in the region and in each chunk iterating over all the filters.
If the migration fails, the code tries to migrate the filters back to the old region. However, the rollback itself can also fail in which case another migration will be erroneously performed. Besides the fact that this ping pong is not a very good idea, it also creates a problem.
Each virtual chunk references two chunks: The currently used one ('vchunk->chunk') and a backup ('vchunk->chunk2'). During migration the first holds the chunk we want to migrate filters to and the second holds the chunk we are migrating filters from.
The code currently assumes - but does not verify - that the backup chunk does not exist (NULL) if the currently used chunk does not reference the target region. This assumption breaks when we are trying to rollback a rollback, resulting in the backup chunk being overwritten and leaked [1].
Fix by not rolling back a failed rollback and add a warning to avoid future cases.
[1]
WARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20 Modules linked in: CPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G W 6.9.0-rc2-custom-00784-gc6a05c468a0b #14 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:parman_destroy+0x17/0x20 [...] Call Trace: <TASK> mlxsw_sp_acl_atcam_region_fini+0x19/0x60 mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0 mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK>
--- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +4 -0
@@ -1271,6 +1271,8 @@ mlxsw_sp_acl_tcam_vchunk_migrate_start(struct mlxsw_sp *mlxsw_sp, {struct mlxsw_sp_acl_tcam_chunk *new_chunk; +WARN_ON (vchunk->chunk2); + new_chunk =mlxsw_sp_acl_tcam_chunk_create (mlxsw_sp, vchunk, region);if (IS_ERR (new_chunk))return PTR_ERR (new_chunk);
@@ -1405,6 +1407,8 @@ mlxsw_sp_acl_tcam_vregion_migrate(struct mlxsw_sp *mlxsw_sp, err =mlxsw_sp_acl_tcam_vchunk_migrate_all (mlxsw_sp, vregion, ctx, credits);if (err) { +if (ctx->this_is_rollback) +return err;/* In case migration was not successful, we need to swap * so the original region pointer is assigned again * to vregion->region.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/107 mlxsw: spectrum_acl_tcam: Fix warning during rehash
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 743edc8547a92b6192aa1f1b6bb78233fa21dc9b ]
As previously explained, the rehash delayed work migrates filters from one region to another. This is done by iterating over all chunks (all the filters with the same priority) in the region and in each chunk iterating over all the filters.
When the work runs out of credits it stores the current chunk and entry as markers in the per-work context so that it would know where to resume the migration from the next time the work is scheduled.
Upon error, the chunk marker is reset to NULL, but without resetting the entry markers despite being relative to it. This can result in migration being resumed from an entry that does not belong to the chunk being migrated. In turn, this will eventually lead to a chunk being iterated over as if it is an entry. Because of how the two structures happen to be defined, this does not lead to KASAN splats, but to warnings such as [1].
Fix by creating a helper that resets all the markers and call it from all the places the currently only reset the chunk marker. For good measures also call it when starting a completely new rehash. Add a warning to avoid future cases.
[1]
WARNING: CPU: 7 PID: 1076 at drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.c:407 mlxsw_afk_encode+0x242/0x2f0 Modules linked in: CPU: 7 PID: 1076 Comm: kworker/7:24 Tainted: G W 6.9.0-rc3-custom-00880-g29e61d91b77b #29 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:mlxsw_afk_encode+0x242/0x2f0 [...] Call Trace: <TASK> mlxsw_sp_acl_atcam_entry_add+0xd9/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x109/0x290 mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x470 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 </TASK>
--- .../mellanox/mlxsw/spectrum_acl_tcam.c | 20 ++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +17 -3
@@ -768,6 +768,17 @@ static void mlxsw_sp_acl_tcam_vregion_rehash_work(struct work_struct *work)mlxsw_sp_acl_tcam_vregion_rehash_work_schedule (vregion); } +static void +mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset (struct mlxsw_sp_acl_tcam_rehash_ctx *ctx) +{ +/* The entry markers are relative to the current chunk and therefore +* needs to be reset together with the chunk marker. +*/ + ctx->current_vchunk =NULL ; + ctx->start_ventry =NULL ; + ctx->stop_ventry =NULL ; +} +static void mlxsw_sp_acl_tcam_rehash_ctx_vchunk_changed (struct mlxsw_sp_acl_tcam_vchunk *vchunk) {
@@ -790,7 +801,7 @@ mlxsw_sp_acl_tcam_rehash_ctx_vregion_changed(struct mlxsw_sp_acl_tcam_vregion *v* the current chunk pointer to make sure all chunks * are properly migrated. */ - vregion->rehash.ctx.current_vchunk =NULL ; +mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset (&vregion->rehash.ctx); } static struct mlxsw_sp_acl_tcam_vregion *
@@ -1291,7 +1302,7 @@ mlxsw_sp_acl_tcam_vchunk_migrate_end(struct mlxsw_sp *mlxsw_sp, {mlxsw_sp_acl_tcam_chunk_destroy (mlxsw_sp, vchunk->chunk2); vchunk->chunk2 =NULL ; - ctx->current_vchunk =NULL ; +mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset (ctx); } static int
@@ -1323,6 +1334,8 @@ mlxsw_sp_acl_tcam_vchunk_migrate_one(struct mlxsw_sp *mlxsw_sp, ventry =list_first_entry (&vchunk->ventry_list,typeof (*ventry), list); +WARN_ON (ventry->vchunk != vchunk); +list_for_each_entry_from (ventry, &vchunk->ventry_list, list) {/* During rollback, once we reach the ventry that failed * to migrate, we are done.
@@ -1414,7 +1427,7 @@ mlxsw_sp_acl_tcam_vregion_migrate(struct mlxsw_sp *mlxsw_sp,* to vregion->region. */ swap (vregion->region, vregion->region2); - ctx->current_vchunk =NULL ; +mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset (ctx); ctx->this_is_rollback = true; err2 =mlxsw_sp_acl_tcam_vchunk_migrate_all (mlxsw_sp, vregion, ctx, credits);
@@ -1473,6 +1486,7 @@ mlxsw_sp_acl_tcam_vregion_rehash_start(struct mlxsw_sp *mlxsw_sp, ctx->hints_priv = hints_priv; ctx->this_is_rollback = false; +mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset (ctx);return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/107 mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit b377add0f0117409c418ddd6504bd682ebe0bf79 ]
Both the function that migrates all the chunks within a region and the function that migrates all the entries within a chunk call list_first_entry() on the respective lists without checking that the lists are not empty. This is incorrect usage of the API, which leads to the following warning [1].
Fix by returning if the lists are empty as there is nothing to migrate in this case.
[1]
WARNING: CPU: 0 PID: 6437 at drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c:1266 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0> Modules linked in: CPU: 0 PID: 6437 Comm: kworker/0:37 Not tainted 6.9.0-rc3-custom-00883-g94a65f079ef6 #39 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0x2c0 [...] Call Trace: <TASK> mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x4a0 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK>
--- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +7 -0
@@ -1325,6 +1325,9 @@ mlxsw_sp_acl_tcam_vchunk_migrate_one(struct mlxsw_sp *mlxsw_sp,return 0 ; } +if (list_empty (&vchunk->ventry_list)) + goto out; +/* If the migration got interrupted, we have the ventry to start from * stored in context. */
@@ -1376,6 +1379,7 @@ mlxsw_sp_acl_tcam_vchunk_migrate_one(struct mlxsw_sp *mlxsw_sp, } } +out:mlxsw_sp_acl_tcam_vchunk_migrate_end (mlxsw_sp, vchunk, ctx);return 0 ; }
@@ -1389,6 +1393,9 @@ mlxsw_sp_acl_tcam_vchunk_migrate_all(struct mlxsw_sp *mlxsw_sp,struct mlxsw_sp_acl_tcam_vchunk *vchunk;int err; +if (list_empty (&vregion->vchunk_list)) +return 0 ; +/* If the migration got interrupted, we have the vchunk * we are working on stored in context. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/107 mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit fb4e2b70a7194b209fc7320bbf33b375f7114bd5 ]
The rehash delayed work is rescheduled with a delay if the number of credits at end of the work is not negative as supposedly it means that the migration ended. Otherwise, it is rescheduled immediately.
After "mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash" the above is no longer accurate as a non-negative number of credits is no longer indicative of the migration being done. It can also happen if the work encountered an error in which case the migration will resume the next time the work is scheduled.
The significance of the above is that it is possible for the work to be pending and associated with hints that were allocated when the migration started. This leads to the hints being leaked [1] when the work is canceled while pending as part of ACL region dismantle.
Fix by freeing the hints if hints are associated with a work that was canceled while pending.
Blame the original commit since the reliance on not having a pending work associated with hints is fragile.
[1]
unreferenced object 0xffff88810e7c3000 (size 256):
comm "kworker/0:16", pid 176, jiffies 4295460353 hex dump (first 32 bytes):
00 30 95 11 81 88 ff ff 61 00 00 00 00 00 00 80 .0......a.......
00 00 61 00 40 00 00 00 00 00 00 00 04 00 00 00 ..a.@...........
backtrace (crc 2544ddb9):
[<00000000cf8cfab3>] kmalloc_trace+0x23f/0x2a0
[<000000004d9a1ad9>] objagg_hints_get+0x42/0x390
[<000000000b143cf3>] mlxsw_sp_acl_erp_rehash_hints_get+0xca/0x400
[<0000000059bdb60a>] mlxsw_sp_acl_tcam_vregion_rehash_work+0x868/0x1160
[<00000000e81fd734>] process_one_work+0x59c/0xf20
[<00000000ceee9e81>] worker_thread+0x799/0x12c0
[<00000000bda6fe39>] kthread+0x246/0x300
[<0000000070056d23>] ret_from_fork+0x34/0x70
[<00000000dea2b93e>] ret_from_fork_asm+0x1a/0x30--- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +5 -1
@@ -874,10 +874,14 @@ mlxsw_sp_acl_tcam_vregion_destroy(struct mlxsw_sp *mlxsw_sp,struct mlxsw_sp_acl_tcam *tcam = vregion->tcam;if (vgroup->vregion_rehash_enabled && ops->region_rehash_hints_get) { +struct mlxsw_sp_acl_tcam_rehash_ctx *ctx = &vregion->rehash.ctx; +mutex_lock (&tcam->lock);list_del (&vregion->tlist);mutex_unlock (&tcam->lock); -cancel_delayed_work_sync (&vregion->rehash.dw); +if (cancel_delayed_work_sync (&vregion->rehash.dw) && + ctx->hints_priv) + ops->region_rehash_hints_put (ctx->hints_priv); }mlxsw_sp_acl_tcam_vgroup_vregion_detach (mlxsw_sp, vregion);if (vregion->region2)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/107 i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sindhu Devale <[email protected]>
[ Upstream commit 2cc7d150550cc981aceedf008f5459193282425c ]
Issue reported by customer during SRIOV testing, call trace:
When both i40e and the i40iw driver are loaded, a warning in check_flush_dependency is being triggered. This seems to be because of the i40e driver workqueue is allocated with the WQ_MEM_RECLAIM flag, and the i40iw one is not.
Similar error was encountered on ice too and it was fixed by removing the flag. Do the same for i40e too.
[Feb 9 09:08] ------------[ cut here ]------------
[ +0.000004] workqueue: WQ_MEM_RECLAIM i40e:i40e_service_task [i40e] is flushing !WQ_MEM_RECLAIM infiniband:0x0
[ +0.000060] WARNING: CPU: 0 PID: 937 at kernel/workqueue.c:2966 check_flush_dependency+0x10b/0x120
[ +0.000007] Modules linked in: snd_seq_dummy snd_hrtimer snd_seq snd_timer snd_seq_device snd soundcore nls_utf8 cifs cifs_arc4 nls_ucs2_utils rdma_cm iw_cm ib_cm cifs_md4 dns_resolver netfs qrtr rfkill sunrpc vfat fat intel_rapl_msr intel_rapl_common irdma intel_uncore_frequency intel_uncore_frequency_common ice ipmi_ssif isst_if_common skx_edac nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp gnss coretemp ib_uverbs rapl intel_cstate ib_core iTCO_wdt iTCO_vendor_support acpi_ipmi mei_me ipmi_si intel_uncore ioatdma i2c_i801 joydev pcspkr mei ipmi_devintf lpc_ich intel_pch_thermal i2c_smbus ipmi_msghandler acpi_power_meter acpi_pad xfs libcrc32c ast sd_mod drm_shmem_helper t10_pi drm_kms_helper sg ixgbe drm i40e ahci crct10dif_pclmul libahci crc32_pclmul igb crc32c_intel libata ghash_clmulni_intel i2c_algo_bit mdio dca wmi dm_mirror dm_region_hash dm_log dm_mod fuse
[ +0.000050] CPU: 0 PID: 937 Comm: kworker/0:3 Kdump: loaded Not tainted 6.8.0-rc2-Feb-net_dev-Qiueue-00279-gbd43c5687e05 #1 [ +0.000003] Hardware name: Intel Corporation S2600BPB/S2600BPB, BIOS SE5C620.86B.02.01.0013.121520200651 12/15/2020
[ +0.000001] Workqueue: i40e i40e_service_task [i40e] [ +0.000024] RIP: 0010:check_flush_dependency+0x10b/0x120 [ +0.000003] Code: ff 49 8b 54 24 18 48 8d 8b b0 00 00 00 49 89 e8 48
81 c6 b0 00 00 00 48 c7 c7 b0 97 fa 9f c6 05 8a cc 1f 02 01 e8 35 b3 fd ff <0f> 0b e9 10 ff ff ff 80 3d 78 cc 1f 02 00 75 94 e9 46 ff ff ff 90 [ +0.000002] RSP: 0018:ffffbd294976bcf8 EFLAGS: 00010282
[ +0.000002] RAX: 0000000000000000 RBX: ffff94d4c483c000 RCX:
0000000000000027
[ +0.000001] RDX: ffff94d47f620bc8 RSI: 0000000000000001 RDI:ffff94d47f620bc0
[ +0.000001] RBP: 0000000000000000 R08: 0000000000000000 R09:00000000ffff7fff
[ +0.000001] R10: ffffbd294976bb98 R11: ffffffffa0be65e8 R12:ffff94c5451ea180
[ +0.000001] R13: ffff94c5ab5e8000 R14: ffff94c5c20b6e05 R15:ffff94c5f1330ab0
[ +0.000001] FS: 0000000000000000(0000) GS:ffff94d47f600000(0000) knlGS:0000000000000000
[ +0.000002] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000001] CR2: 00007f9e6f1fca70 CR3: 0000000038e20004 CR4:00000000007706f0
[ +0.000000] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[ +0.000001] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400
[ +0.000001] PKRU: 55555554 [ +0.000001] Call Trace: [ +0.000001] <TASK> [ +0.000002] ? __warn+0x80/0x130 [ +0.000003] ? check_flush_dependency+0x10b/0x120 [ +0.000002] ? report_bug+0x195/0x1a0 [ +0.000005] ? handle_bug+0x3c/0x70 [ +0.000003] ? exc_invalid_op+0x14/0x70 [ +0.000002] ? asm_exc_invalid_op+0x16/0x20 [ +0.000006] ? check_flush_dependency+0x10b/0x120 [ +0.000002] ? check_flush_dependency+0x10b/0x120 [ +0.000002] __flush_workqueue+0x126/0x3f0 [ +0.000015] ib_cache_cleanup_one+0x1c/0xe0 [ib_core] [ +0.000056] __ib_unregister_device+0x6a/0xb0 [ib_core] [ +0.000023] ib_unregister_device_and_put+0x34/0x50 [ib_core] [ +0.000020] i40iw_close+0x4b/0x90 [irdma] [ +0.000022] i40e_notify_client_of_netdev_close+0x54/0xc0 [i40e] [ +0.000035] i40e_service_task+0x126/0x190 [i40e] [ +0.000024] process_one_work+0x174/0x340 [ +0.000003] worker_thread+0x27e/0x390 [ +0.000001] ? __pfx_worker_thread+0x10/0x10 [ +0.000002] kthread+0xdf/0x110 [ +0.000002] ? __pfx_kthread+0x10/0x10 [ +0.000002] ret_from_fork+0x2d/0x50 [ +0.000003] ? __pfx_kthread+0x10/0x10 [ +0.000001] ret_from_fork_asm+0x1b/0x30 [ +0.000004] </TASK> [ +0.000001] ---[ end trace 0000000000000000 ]---
--- drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/i40e/i40e_main.c +1 -1
@@ -15971,7 +15971,7 @@ static int __init i40e_init_module(void)* since we need to be able to guarantee forward progress even under * memory pressure. */ - i40e_wq =alloc_workqueue ("%s" ,WQ_MEM_RECLAIM ,0 , i40e_driver_name); + i40e_wq =alloc_workqueue ("%s" ,0 ,0 , i40e_driver_name);if (!i40e_wq) {pr_err ("%s: Failed to create workqueue\n" , i40e_driver_name);return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/107 iavf: Fix TC config comparison with existing adapter TC config
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudheer Mogilappagari <[email protected]>
[ Upstream commit 54976cf58d6168b8d15cebb395069f23b2f34b31 ]
Same number of TCs doesn't imply that underlying TC configs are same. The config could be different due to difference in number of queues in each TC. Add utility function to determine if TC configs are same.
--- drivers/net/ethernet/intel/iavf/iavf_main.c | 30 ++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/iavf/iavf_main.c +29 -1
@@ -2647,6 +2647,34 @@ static void iavf_del_all_cloud_filters(struct iavf_adapter *adapter)spin_unlock_bh (&adapter->cloud_filter_list_lock); } +/** +* iavf_is_tc_config_same - Compare the mqprio TC config with the +* TC config already configured on this adapter. +* @adapter: board private structure +* @mqprio_qopt: TC config received from kernel. +* +* This function compares the TC config received from the kernel +* with the config already configured on the adapter. +* +* Return: True if configuration is same, false otherwise. +**/ +static bool iavf_is_tc_config_same (struct iavf_adapter *adapter, +struct tc_mqprio_qopt *mqprio_qopt) +{ +struct virtchnl_channel_info *ch = &adapter->ch_config.ch_info[0 ]; +int i; + +if (adapter->num_tc != mqprio_qopt->num_tc) +return false; + +for (i =0 ; i < adapter->num_tc; i++) { +if (ch[i].count != mqprio_qopt->count[i] || + ch[i].offset != mqprio_qopt->offset[i]) +return false; + } +return true; +} +/** * __iavf_setup_tc - configure multiple traffic classes * @netdev: network interface device structure
@@ -2703,7 +2731,7 @@ static int __iavf_setup_tc(struct net_device *netdev, void *type_data)if (ret)return ret;/* Return if same TC config is requested */ -if (adapter->num_tc == num_tc) +if (iavf_is_tc_config_same (adapter, &mqprio_qopt->qopt))return 0 ; adapter->num_tc = num_tc;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/107 af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 1971d13ffa84a551d29a81fdf5b5ec5be166ac83 ]
syzbot reported a lockdep splat regarding unix_gc_lock and unix_state_lock().
One is called from recvmsg() for a connected socket, and another is called from GC for TCP_LISTEN socket.
So, the splat is false-positive.
Let's add a dedicated lock class for the latter to suppress the splat.
Note that this change is not necessary for net-next.git as the issue is only applied to the old GC impl.
[0]:
WARNING: possible circular locking dependency detected 6.9.0-rc5-syzkaller-00007-g4d2008430ce8 #0 Not tainted
-----------------------------------------------------
kworker/u8:1/11 is trying to acquire lock:ffff88807cea4e70 (&u->lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff88807cea4e70 (&u->lock){+.+.}-{2:2}, at: __unix_gc+0x40e/0xf70 net/unix/garbage.c:302
but task is already holding lock:ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: __unix_gc+0x117/0xf70 net/unix/garbage.c:261
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (unix_gc_lock){+.+.}-{2:2}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
unix_notinflight+0x13d/0x390 net/unix/garbage.c:140
unix_detach_fds net/unix/af_unix.c:1819 [inline]
unix_destruct_scm+0x221/0x350 net/unix/af_unix.c:1876
skb_release_head_state+0x100/0x250 net/core/skbuff.c:1188
skb_release_all net/core/skbuff.c:1200 [inline]
__kfree_skb net/core/skbuff.c:1216 [inline]
kfree_skb_reason+0x16d/0x3b0 net/core/skbuff.c:1252
kfree_skb include/linux/skbuff.h:1262 [inline]
manage_oob net/unix/af_unix.c:2672 [inline]
unix_stream_read_generic+0x1125/0x2700 net/unix/af_unix.c:2749
unix_stream_splice_read+0x239/0x320 net/unix/af_unix.c:2981
do_splice_read fs/splice.c:985 [inline]
splice_file_to_pipe+0x299/0x500 fs/splice.c:1295
do_splice+0xf2d/0x1880 fs/splice.c:1379
__do_splice fs/splice.c:1436 [inline]
__do_sys_splice fs/splice.c:1652 [inline]
__se_sys_splice+0x331/0x4a0 fs/splice.c:1634
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f-> #0 (&u->lock){+.+.}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869
__lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
__unix_gc+0x40e/0xf70 net/unix/garbage.c:302
process_one_work kernel/workqueue.c:3254 [inline]
process_scheduled_works+0xa10/0x17c0 kernel/workqueue.c:3335
worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
kthread+0x2f0/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(unix_gc_lock);
lock(&u->lock);
lock(unix_gc_lock); lock(&u->lock);
*** DEADLOCK ***
3 locks held by kworker/u8:1/11:
#0: ffff888015089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3229 [inline] #0: ffff888015089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x8e0/0x17c0 kernel/workqueue.c:3335 #1: ffffc90000107d00 (unix_gc_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3230 [inline]
#1: ffffc90000107d00 (unix_gc_work){+.+.}-{0:0}, at: process_scheduled_works+0x91b/0x17c0 kernel/workqueue.c:3335 #2: ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#2: ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: __unix_gc+0x117/0xf70 net/unix/garbage.c:261
stack backtrace: CPU: 0 PID: 11 Comm: kworker/u8:1 Not tainted 6.9.0-rc5-syzkaller-00007-g4d2008430ce8 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: events_unbound __unix_gc Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2187 check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] __unix_gc+0x40e/0xf70 net/unix/garbage.c:302 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0xa10/0x17c0 kernel/workqueue.c:3335 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>
--- include/net/af_unix.h | 3 +++ net/unix/garbage.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-)
include/net/af_unix.h +3 -0
@@ -72,6 +72,9 @@ enum unix_socket_lock_class {U_LOCK_NORMAL ,U_LOCK_SECOND ,/* for double locking, see unix_state_double_lock(). */ U_LOCK_DIAG ,/* used while dumping icons, see sk_diag_dump_icons(). */ + U_LOCK_GC_LISTENER, /* used for listening socket while determining gc + * candidates to close a small race window. + */ }; static inline void unix_state_lock_nested(struct sock *sk,
net/unix/garbage.c +1 -1
@@ -260,7 +260,7 @@ void unix_gc(void)__set_bit (UNIX_GC_MAYBE_CYCLE , &u->gc_flags);if (sk->sk_state ==TCP_LISTEN ) { -unix_state_lock (sk); +unix_state_lock_nested (sk,U_LOCK_GC_LISTENER );unix_state_unlock (sk); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/107 serial: core: Provide port lock wrappers
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit b0af4bcb49464c221ad5f95d40f2b1b252ceedcc ]
When a serial port is used for kernel console output, then all modifications to the UART registers which are done from other contexts, e.g. getty, termios, are interference points for the kernel console.
So far this has been ignored and the printk output is based on the principle of hope. The rework of the console infrastructure which aims to support threaded and atomic consoles, requires to mark sections which modify the UART registers as unsafe. This allows the atomic write function to make informed decisions and eventually to restore operational state. It also allows to prevent the regular UART code from modifying UART registers while printk output is in progress.
All modifications of UART registers are guarded by the UART port lock, which provides an obvious synchronization point with the console infrastructure.
Provide wrapper functions for spin_[un]lock*(port->lock) invocations so that the console mechanics can be applied later on at a single place and does not require to copy the same logic all over the drivers.
Stable-dep-of: 54c4ec5f8c47 ("serial: mxs-auart: add spinlock around changing cts state")
--- include/linux/serial_core.h | 79 +++++++++++++++++++++++++++++++++++++ 1 file changed, 79 insertions(+)
include/linux/serial_core.h +79 -0
@@ -255,6 +255,85 @@ struct uart_port {void *private_data;/* generic platform data pointer */ }; +/** +* uart_port_lock - Lock the UART port +* @up: Pointer to UART port structure +*/ +static inline void uart_port_lock (struct uart_port *up) +{ +spin_lock (&up->lock); +} + +/** +* uart_port_lock_irq - Lock the UART port and disable interrupts +* @up: Pointer to UART port structure +*/ +static inline void uart_port_lock_irq (struct uart_port *up) +{ +spin_lock_irq (&up->lock); +} + +/** +* uart_port_lock_irqsave - Lock the UART port, save and disable interrupts +* @up: Pointer to UART port structure +* @flags: Pointer to interrupt flags storage +*/ +static inline void uart_port_lock_irqsave (struct uart_port *up,unsigned long *flags) +{ +spin_lock_irqsave (&up->lock, *flags); +} + +/** +* uart_port_trylock - Try to lock the UART port +* @up: Pointer to UART port structure +* +* Returns: True if lock was acquired, false otherwise +*/ +static inline bool uart_port_trylock (struct uart_port *up) +{ +return spin_trylock (&up->lock); +} + +/** +* uart_port_trylock_irqsave - Try to lock the UART port, save and disable interrupts +* @up: Pointer to UART port structure +* @flags: Pointer to interrupt flags storage +* +* Returns: True if lock was acquired, false otherwise +*/ +static inline bool uart_port_trylock_irqsave (struct uart_port *up,unsigned long *flags) +{ +return spin_trylock_irqsave (&up->lock, *flags); +} + +/** +* uart_port_unlock - Unlock the UART port +* @up: Pointer to UART port structure +*/ +static inline void uart_port_unlock (struct uart_port *up) +{ +spin_unlock (&up->lock); +} + +/** +* uart_port_unlock_irq - Unlock the UART port and re-enable interrupts +* @up: Pointer to UART port structure +*/ +static inline void uart_port_unlock_irq (struct uart_port *up) +{ +spin_unlock_irq (&up->lock); +} + +/** +* uart_port_lock_irqrestore - Unlock the UART port, restore interrupts +* @up: Pointer to UART port structure +* @flags: The saved interrupt flags for restore +*/ +static inline void uart_port_unlock_irqrestore (struct uart_port *up,unsigned long flags) +{ +spin_unlock_irqrestore (&up->lock, flags); +} +static inline int serial_port_in (struct uart_port *up,int offset) {return up->serial_in (up, offset);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/107 serial: mxs-auart: add spinlock around changing cts state
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emil Kronborg <[email protected]>
[ Upstream commit 54c4ec5f8c471b7c1137a1f769648549c423c026 ]
The uart_handle_cts_change() function in serial_core expects the caller to hold uport->lock. For example, I have seen the below kernel splat, when the Bluetooth driver is loaded on an i.MX28 board.
[ 85.119255] ------------[ cut here ]------------
[ 85.124413] WARNING: CPU: 0 PID: 27 at /drivers/tty/serial/serial_core.c:3453 uart_handle_cts_change+0xb4/0xec
[ 85.134694] Modules linked in: hci_uart bluetooth ecdh_generic ecc wlcore_sdio configfs
[ 85.143314] CPU: 0 PID: 27 Comm: kworker/u3:0 Not tainted 6.6.3-00021-gd62a2f068f92 #1
[ 85.151396] Hardware name: Freescale MXS (Device Tree)
[ 85.156679] Workqueue: hci0 hci_power_on [bluetooth]
(...)
[ 85.191765] uart_handle_cts_change from mxs_auart_irq_handle+0x380/0x3f4
[ 85.198787] mxs_auart_irq_handle from __handle_irq_event_percpu+0x88/0x210
(...)--- drivers/tty/serial/mxs-auart.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/tty/serial/mxs-auart.c +6 -2
@@ -1126,11 +1126,13 @@ static void mxs_auart_set_ldisc(struct uart_port *port,static irqreturn_t mxs_auart_irq_handle (int irq,void *context) { -u32 istat; +u32 istat, stat;struct mxs_auart_port *s = context;u32 mctrl_temp = s->mctrl_prev; -u32 stat =mxs_read (s,REG_STAT ); +uart_port_lock (&s->port); + + stat =mxs_read (s,REG_STAT ); istat =mxs_read (s,REG_INTR );/* ack irq */
@@ -1166,6 +1168,8 @@ static irqreturn_t mxs_auart_irq_handle(int irq, void *context) istat &= ~AUART_INTR_TXIS ; } +uart_port_unlock (&s->port); +return IRQ_HANDLED ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/107 drm/amdgpu: restrict bo mapping within gpu address limits
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajneesh Bhardwaj <[email protected]>
[ Upstream commit 8b80d74bdb2285d3022b349c8451eb16535f7906 ]
Have strict check on bo mapping since on some systems, such as A+A or hybrid, the cpu might support 5 level paging or can address memory above 48 bits but gpu might be limited by hardware to just use 48 bits. In general, this applies to all asics where this limitation can be checked against their max_pfn range. This restricts the range to map bo within pratical limits of cpu and gpu for shared virtual memory access.
Stable-dep-of: 6fef2d4c00b5 ("drm/amdgpu: validate the parameters of bo mapping operations more clearly")
--- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +4 -2
@@ -2130,7 +2130,8 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,/* make sure object fit at this offset */ eaddr = saddr + size -1 ;if (saddr >= eaddr || - (bo && offset + size >amdgpu_bo_size (bo))) + (bo && offset + size >amdgpu_bo_size (bo)) || + (eaddr >= adev->vm_manager.max_pfn <<AMDGPU_GPU_PAGE_SHIFT ))return -EINVAL ; saddr /=AMDGPU_GPU_PAGE_SIZE ;
@@ -2195,7 +2196,8 @@ int amdgpu_vm_bo_replace_map(struct amdgpu_device *adev,/* make sure object fit at this offset */ eaddr = saddr + size -1 ;if (saddr >= eaddr || - (bo && offset + size >amdgpu_bo_size (bo))) + (bo && offset + size >amdgpu_bo_size (bo)) || + (eaddr >= adev->vm_manager.max_pfn <<AMDGPU_GPU_PAGE_SHIFT ))return -EINVAL ;/* Allocate all the needed memory */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/107 amdgpu: validate offset_in_bo of drm_amdgpu_gem_va
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chia-I Wu <[email protected]>
[ Upstream commit 9f0bcf49e9895cb005d78b33a5eebfa11711b425 ]
This is motivated by OOB access in amdgpu_vm_update_range when offset_in_bo+map_size overflows.
v2: keep the validations in amdgpu_vm_bo_map
v3: add the validations to amdgpu_vm_bo_map/amdgpu_vm_bo_replace_map
rather than to amdgpu_gem_va_ioctl
Stable-dep-of: 6fef2d4c00b5 ("drm/amdgpu: validate the parameters of bo mapping operations more clearly")
--- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +8 -8
@@ -2123,14 +2123,14 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,uint64_t eaddr;/* validate the parameters */ -if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || - size ==0 || size & ~PAGE_MASK ) +if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || size & ~PAGE_MASK ) +return -EINVAL ; +if (saddr + size <= saddr || offset + size <= offset)return -EINVAL ;/* make sure object fit at this offset */ eaddr = saddr + size -1 ; -if (saddr >= eaddr || - (bo && offset + size >amdgpu_bo_size (bo)) || +if ((bo && offset + size >amdgpu_bo_size (bo)) || (eaddr >= adev->vm_manager.max_pfn <<AMDGPU_GPU_PAGE_SHIFT ))return -EINVAL ;
@@ -2189,14 +2189,14 @@ int amdgpu_vm_bo_replace_map(struct amdgpu_device *adev,int r;/* validate the parameters */ -if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || - size ==0 || size & ~PAGE_MASK ) +if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || size & ~PAGE_MASK ) +return -EINVAL ; +if (saddr + size <= saddr || offset + size <= offset)return -EINVAL ;/* make sure object fit at this offset */ eaddr = saddr + size -1 ; -if (saddr >= eaddr || - (bo && offset + size >amdgpu_bo_size (bo)) || +if ((bo && offset + size >amdgpu_bo_size (bo)) || (eaddr >= adev->vm_manager.max_pfn <<AMDGPU_GPU_PAGE_SHIFT ))return -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/107 drm/amdgpu: validate the parameters of bo mapping operations more clearly
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: xinhui pan <[email protected]>
[ Upstream commit 6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75 ]
Verify the parameters of amdgpu_vm_bo_(map/replace_map/clearing_mappings) in one common place.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 72 ++++++++++++++++---------- 1 file changed, 46 insertions(+), 26 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +46 -26
@@ -2095,6 +2095,37 @@ static void amdgpu_vm_bo_insert_map(struct amdgpu_device *adev,trace_amdgpu_vm_bo_map (bo_va, mapping); } +/* Validate operation parameters to prevent potential abuse */ +static int amdgpu_vm_verify_parameters (struct amdgpu_device *adev, +struct amdgpu_bo *bo, +uint64_t saddr, +uint64_t offset, +uint64_t size) +{ +uint64_t tmp, lpfn; + +if (saddr &AMDGPU_GPU_PAGE_MASK + || offset &AMDGPU_GPU_PAGE_MASK + || size &AMDGPU_GPU_PAGE_MASK ) +return -EINVAL ; + +if (check_add_overflow (saddr, size, &tmp) + ||check_add_overflow (offset, size, &tmp) + || size ==0 /* which also leads to end < begin */ ) +return -EINVAL ; + +/* make sure object fit at this offset */ +if (bo && offset + size >amdgpu_bo_size (bo)) +return -EINVAL ; + +/* Ensure last pfn not exceed max_pfn */ + lpfn = (saddr + size -1 ) >>AMDGPU_GPU_PAGE_SHIFT ; +if (lpfn >= adev->vm_manager.max_pfn) +return -EINVAL ; + +return 0 ; +} +/** * amdgpu_vm_bo_map - map bo inside a vm *
@@ -2121,21 +2152,14 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,struct amdgpu_bo *bo = bo_va->base.bo;struct amdgpu_vm *vm = bo_va->base.vm;uint64_t eaddr; +int r; -/* validate the parameters */ -if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || size & ~PAGE_MASK ) -return -EINVAL ; -if (saddr + size <= saddr || offset + size <= offset) -return -EINVAL ; - -/* make sure object fit at this offset */ - eaddr = saddr + size -1 ; -if ((bo && offset + size >amdgpu_bo_size (bo)) || - (eaddr >= adev->vm_manager.max_pfn <<AMDGPU_GPU_PAGE_SHIFT )) -return -EINVAL ; + r =amdgpu_vm_verify_parameters (adev, bo, saddr, offset, size); +if (r) +return r; saddr /=AMDGPU_GPU_PAGE_SIZE ; - eaddr /=AMDGPU_GPU_PAGE_SIZE ; + eaddr = saddr + (size -1 ) /AMDGPU_GPU_PAGE_SIZE ; tmp =amdgpu_vm_it_iter_first (&vm->va, saddr, eaddr);if (tmp) {
@@ -2188,17 +2212,9 @@ int amdgpu_vm_bo_replace_map(struct amdgpu_device *adev,uint64_t eaddr;int r; -/* validate the parameters */ -if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || size & ~PAGE_MASK ) -return -EINVAL ; -if (saddr + size <= saddr || offset + size <= offset) -return -EINVAL ; - -/* make sure object fit at this offset */ - eaddr = saddr + size -1 ; -if ((bo && offset + size >amdgpu_bo_size (bo)) || - (eaddr >= adev->vm_manager.max_pfn <<AMDGPU_GPU_PAGE_SHIFT )) -return -EINVAL ; + r =amdgpu_vm_verify_parameters (adev, bo, saddr, offset, size); +if (r) +return r;/* Allocate all the needed memory */ mapping =kmalloc (sizeof (*mapping),GFP_KERNEL );
@@ -2212,7 +2228,7 @@ int amdgpu_vm_bo_replace_map(struct amdgpu_device *adev, } saddr /=AMDGPU_GPU_PAGE_SIZE ; - eaddr /=AMDGPU_GPU_PAGE_SIZE ; + eaddr = saddr + (size -1 ) /AMDGPU_GPU_PAGE_SIZE ; mapping->start = saddr; mapping->last = eaddr;
@@ -2299,10 +2315,14 @@ int amdgpu_vm_bo_clear_mappings(struct amdgpu_device *adev,struct amdgpu_bo_va_mapping *before, *after, *tmp, *next;LIST_HEAD (removed);uint64_t eaddr; +int r; + + r =amdgpu_vm_verify_parameters (adev,NULL , saddr,0 , size); +if (r) +return r; - eaddr = saddr + size -1 ; saddr /=AMDGPU_GPU_PAGE_SIZE ; - eaddr /=AMDGPU_GPU_PAGE_SIZE ; + eaddr = saddr + (size -1 ) /AMDGPU_GPU_PAGE_SIZE ;/* Allocate all the needed memory */ before =kzalloc (sizeof (*before),GFP_KERNEL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/107 Revert "crypto: api - Disallow identical driver names"
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
This reverts commit cf6889bb8b56d15f15d9b8e47ccab7b3b4c74bd6 which is commit 27016f75f5ed47e2d8e0ca75a8ff1f40bc1a5e27 upstream.
It is reported to cause problems in older kernels due to some crypto drivers having the same name, so revert it here to fix the problems.
--- crypto/algapi.c | 1 - 1 file changed, 1 deletion(-)
crypto/algapi.c +0 -1
@@ -217,7 +217,6 @@ static struct crypto_larval *__crypto_re }if (!strcmp (q->cra_driver_name, alg->cra_name) || - !strcmp (q->cra_driver_name, alg->cra_driver_name) || !strcmp (q->cra_name, alg->cra_driver_name)) goto err; }
Greg Kroah-Hartman
maintainerPATCH 85/107 net/mlx5e: Fix a race in command alloc flow
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shifeng Li <[email protected]>
commit 8f5100da56b3980276234e812ce98d8f075194cd upstream.
Fix a cmd->ent use after free due to a race on command entry. Such race occurs when one of the commands releases its last refcount and frees its index and entry while another process running command flush flow takes refcount to this command entry. The process which handles commands flush may see this command as needed to be flushed if the other process allocated a ent->idx but didn't set ent to cmd->ent_arr in cmd_work_handler(). Fix it by moving the assignment of cmd->ent_arr into the spin lock.
[70013.081955] BUG: KASAN: use-after-free in mlx5_cmd_trigger_completions+0x1e2/0x4c0 [mlx5_core] [70013.081967] Write of size 4 at addr ffff88880b1510b4 by task kworker/26:1/1433361 [70013.081968] [70013.082028] Workqueue: events aer_isr [70013.082053] Call Trace: [70013.082067] dump_stack+0x8b/0xbb [70013.082086] print_address_description+0x6a/0x270 [70013.082102] kasan_report+0x179/0x2c0 [70013.082173] mlx5_cmd_trigger_completions+0x1e2/0x4c0 [mlx5_core] [70013.082267] mlx5_cmd_flush+0x80/0x180 [mlx5_core] [70013.082304] mlx5_enter_error_state+0x106/0x1d0 [mlx5_core] [70013.082338] mlx5_try_fast_unload+0x2ea/0x4d0 [mlx5_core] [70013.082377] remove_one+0x200/0x2b0 [mlx5_core] [70013.082409] pci_device_remove+0xf3/0x280 [70013.082439] device_release_driver_internal+0x1c3/0x470 [70013.082453] pci_stop_bus_device+0x109/0x160 [70013.082468] pci_stop_and_remove_bus_device+0xe/0x20 [70013.082485] pcie_do_fatal_recovery+0x167/0x550 [70013.082493] aer_isr+0x7d2/0x960 [70013.082543] process_one_work+0x65f/0x12d0 [70013.082556] worker_thread+0x87/0xb50 [70013.082571] kthread+0x2e9/0x3a0 [70013.082592] ret_from_fork+0x1f/0x40
The logical relationship of this error is as follows:
aer_recover_work | ent->work
-------------------------------------------+------------------------------
aer_recover_work_func |
|- pcie_do_recovery |
|- report_error_detected |
|- mlx5_pci_err_detected |cmd_work_handler
|- mlx5_enter_error_state | |- cmd_alloc_index
|- enter_error_state | |- lock cmd->alloc_lock
|- mlx5_cmd_flush | |- clear_bit
|- mlx5_cmd_trigger_completions| |- unlock cmd->alloc_lock
|- lock cmd->alloc_lock |
|- vector = ~dev->cmd.vars.bitmask
|- for_each_set_bit |
|- cmd_ent_get(cmd->ent_arr[i]) (UAF)
|- unlock cmd->alloc_lock | |- cmd->ent_arr[ent->idx]=entThe cmd->ent_arr[ent->idx] assignment and the bit clearing are not protected by the cmd->alloc_lock in cmd_work_handler().
--- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/cmd.c +7 -5
@@ -114,15 +114,18 @@ static u8 alloc_token(struct mlx5_cmd *creturn token; } -static int cmd_alloc_index (struct mlx5_cmd *cmd) +static int cmd_alloc_index (struct mlx5_cmd *cmd,struct mlx5_cmd_work_ent *ent) {unsigned long flags;int ret;spin_lock_irqsave (&cmd->alloc_lock, flags); ret =find_first_bit (&cmd->bitmask, cmd->max_reg_cmds); -if (ret < cmd->max_reg_cmds) +if (ret < cmd->max_reg_cmds) {clear_bit (ret, &cmd->bitmask); + ent->idx = ret; + cmd->ent_arr[ent->idx] = ent; + }spin_unlock_irqrestore (&cmd->alloc_lock, flags);return ret < cmd->max_reg_cmds ? ret : -ENOMEM ;
@@ -905,7 +908,7 @@ static void cmd_work_handler(struct work sem = ent->page_queue ? &cmd->pages_sem : &cmd->sem;down (sem);if (!ent->page_queue) { - alloc_ret =cmd_alloc_index (cmd); + alloc_ret =cmd_alloc_index (cmd, ent);if (alloc_ret <0 ) {mlx5_core_err (dev,"failed to allocate command entry\n" );if (ent->callback) {
@@ -920,15 +923,14 @@ static void cmd_work_handler(struct workup (sem);return ; } - ent->idx = alloc_ret; }else { ent->idx = cmd->max_reg_cmds;spin_lock_irqsave (&cmd->alloc_lock, flags);clear_bit (ent->idx, &cmd->bitmask); + cmd->ent_arr[ent->idx] = ent;spin_unlock_irqrestore (&cmd->alloc_lock, flags); } - cmd->ent_arr[ent->idx] = ent; lay =get_inst (cmd, ent->idx); ent->lay = lay;memset (lay,0 ,sizeof (*lay));
Greg Kroah-Hartman
maintainerPATCH 86/107 tracing: Show size of requested perf buffer
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin H. Johnson <[email protected]>
commit a90afe8d020da9298c98fddb19b7a6372e2feb45 upstream.
If the perf buffer isn't large enough, provide a hint about how large it needs to be for whatever is running.
--- kernel/trace/trace_event_perf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/trace/trace_event_perf.c +2 -1
@@ -395,7 +395,8 @@ void *perf_trace_buf_alloc(int size, strBUILD_BUG_ON (PERF_MAX_TRACE_SIZE %sizeof (unsigned long ));if (WARN_ONCE (size >PERF_MAX_TRACE_SIZE , -"perf buffer not large enough" )) +"perf buffer not large enough, wanted %d, have %d" , + size,PERF_MAX_TRACE_SIZE ))return NULL ; *rctxp = rctx =perf_swevent_get_recursion_context ();
Greg Kroah-Hartman
maintainerPATCH 87/107 tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker together
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin H. Johnson <[email protected]>
commit e531e90b5ab0f7ce5ff298e165214c1aec6ed187 upstream.
Running endpoint security solutions like Sentinel1 that use perf-based tracing heavily lead to this repeated dump complaining about dockerd. The default value of 2048 is nowhere near not large enough.
Using the prior patch "tracing: show size of requested buffer", we get "perf buffer not large enough, wanted 6644, have 6144", after repeated up-sizing (I did 2/4/6/8K). With 8K, the problem doesn't occur at all, so below is the trace for 6K.
I'm wondering if this value should be selectable at boot time, but this is a good starting point.
``` ------------[ cut here ]------------ perf buffer not large enough, wanted 6644, have 6144 WARNING: CPU: 1 PID: 4997 at kernel/trace/trace_event_perf.c:402 perf_trace_buf_alloc+0x8c/0xa0 Modules linked in: [..] CPU: 1 PID: 4997 Comm: sh Tainted: G T 5.13.13-x86_64-00039-gb3959163488e #63 Hardware name: LENOVO 20KH002JUS/20KH002JUS, BIOS N23ET66W (1.41 ) 09/02/2019 RIP: 0010:perf_trace_buf_alloc+0x8c/0xa0 Code: 80 3d 43 97 d0 01 00 74 07 31 c0 5b 5d 41 5c c3 ba 00 18 00 00 89 ee 48 c7 c7 00 82 7d 91 c6 05 25 97 d0 01 01 e8 22 ee bc 00 <0f> 0b 31 c0 eb db 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 55 89 RSP: 0018:ffffb922026b7d58 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9da5ee012000 RCX: 0000000000000027 RDX: ffff9da881657828 RSI: 0000000000000001 RDI: ffff9da881657820 RBP: 00000000000019f4 R08: 0000000000000000 R09: ffffb922026b7b80 R10: ffffb922026b7b78 R11: ffffffff91dda688 R12: 000000000000000f R13: ffff9da5ee012108 R14: ffff9da8816570a0 R15: ffffb922026b7e30 FS: 00007f420db1a080(0000) GS:ffff9da881640000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000060 CR3: 00000002504a8006 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kprobe_perf_func+0x11e/0x270 ? do_execveat_common.isra.0+0x1/0x1c0 ? do_execveat_common.isra.0+0x5/0x1c0 kprobe_ftrace_handler+0x10e/0x1d0 0xffffffffc03aa0c8 ? do_execveat_common.isra.0+0x1/0x1c0 do_execveat_common.isra.0+0x5/0x1c0 __x64_sys_execve+0x33/0x40 do_syscall_64+0x6b/0xc0 ? do_syscall_64+0x11/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f420dc1db37 Code: ff ff 76 e7 f7 d8 64 41 89 00 eb df 0f 1f 80 00 00 00 00 f7 d8 64 41 89 00 eb dc 0f 1f 84 00 00 00 00 00 b8 3b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 01 43 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffd4e8b4e38 EFLAGS: 00000246 ORIG_RAX: 000000000000003b RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f420dc1db37 RDX: 0000564338d1e740 RSI: 0000564338d32d50 RDI: 0000564338d28f00 RBP: 0000564338d28f00 R08: 0000564338d32d50 R09: 0000000000000020 R10: 00000000000001b6 R11: 0000000000000246 R12: 0000564338d28f00 R13: 0000564338d32d50 R14: 0000564338d1e740 R15: 0000564338d28c60 ---[ end trace 83ab3e8e16275e49 ]--- ```
--- include/linux/trace_events.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/trace_events.h +1 -1
@@ -427,7 +427,7 @@ struct trace_event_file { } \ early_initcall(trace_init_perf_perm_##name); -#define PERF_MAX_TRACE_SIZE 2048 +#define PERF_MAX_TRACE_SIZE 8192#define MAX_FILTER_STR_VAL 256/* Should handle KSYM_SYMBOL_LEN */
Greg Kroah-Hartman
maintainerPATCH 88/107 Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit 9bf4e919ccad613b3596eebf1ff37b05b6405307 upstream.
After an innocuous optimization change in LLVM main (19.0.0), x86_64 allmodconfig (which enables CONFIG_KCSAN / -fsanitize=thread) fails to build due to the checks in check_copy_size():
In file included from net/bluetooth/sco.c:27:
In file included from include/linux/module.h:13:
In file included from include/linux/stat.h:19:
In file included from include/linux/time.h:60:
In file included from include/linux/time32.h:13:
In file included from include/linux/timex.h:67:
In file included from arch/x86/include/asm/timex.h:6:
In file included from arch/x86/include/asm/tsc.h:10:
In file included from arch/x86/include/asm/msr.h:15:
In file included from include/linux/percpu.h:7:
In file included from include/linux/smp.h:118:
include/linux/thread_info.h:244:4: error: call to '__bad_copy_from' declared with 'error' attribute: copy source size is too small
244 | __bad_copy_from();
| ^The same exact error occurs in l2cap_sock.c. The copy_to_user() statements that are failing come from l2cap_sock_getsockopt_old() and sco_sock_getsockopt_old(). This does not occur with GCC with or without KCSAN or Clang without KCSAN enabled.
len is defined as an 'int' because it is assigned from '__user int *optlen'. However, it is clamped against the result of sizeof(), which has a type of 'size_t' ('unsigned long' for 64-bit platforms). This is done with min_t() because min() requires compatible types, which results in both len and the result of sizeof() being casted to 'unsigned int', meaning len changes signs and the result of sizeof() is truncated. From there, len is passed to copy_to_user(), which has a third parameter type of 'unsigned long', so it is widened and changes signs again. This excessive casting in combination with the KCSAN instrumentation causes LLVM to fail to eliminate the __bad_copy_from() call, failing the build.
The official recommendation from LLVM developers is to consistently use long types for all size variables to avoid the unnecessary casting in the first place. Change the type of len to size_t in both l2cap_sock_getsockopt_old() and sco_sock_getsockopt_old(). This clears up the error while allowing min_t() to be replaced with min(), resulting in simpler code with no casts and fewer implicit conversions. While len is a different type than optlen now, it should result in no functional change because the result of sizeof() will clamp all values of optlen in the same manner as before.
--- net/bluetooth/l2cap_sock.c | 7 ++++--- net/bluetooth/sco.c | 7 ++++--- 2 files changed, 8 insertions(+), 6 deletions(-)
net/bluetooth/l2cap_sock.c +4 -3
@@ -405,7 +405,8 @@ static int l2cap_sock_getsockopt_old(strstruct l2cap_chan *chan =l2cap_pi (sk)->chan;struct l2cap_options opts;struct l2cap_conninfo cinfo; -int len, err =0 ; +int err =0 ; +size_t len;u32 opt;BT_DBG ("sk %p" , sk);
@@ -450,7 +451,7 @@ static int l2cap_sock_getsockopt_old(str opts.max_tx = chan->max_tx; opts.txwin_size = chan->tx_win; - len = min_t(unsigned int, len, sizeof(opts)); + len =min (len,sizeof (opts));if (copy_to_user (optval, (char *) &opts, len)) err = -EFAULT ;
@@ -500,7 +501,7 @@ static int l2cap_sock_getsockopt_old(str cinfo.hci_handle = chan->conn->hcon->handle;memcpy (cinfo.dev_class, chan->conn->hcon->dev_class,3 ); - len = min_t(unsigned int, len, sizeof(cinfo)); + len =min (len,sizeof (cinfo));if (copy_to_user (optval, (char *) &cinfo, len)) err = -EFAULT ;
net/bluetooth/sco.c +4 -3
@@ -880,7 +880,8 @@ static int sco_sock_getsockopt_old(strucstruct sock *sk = sock->sk;struct sco_options opts;struct sco_conninfo cinfo; -int len, err =0 ; +int err =0 ; +size_t len;BT_DBG ("sk %p" , sk);
@@ -902,7 +903,7 @@ static int sco_sock_getsockopt_old(strucBT_DBG ("mtu %d" , opts.mtu); - len = min_t(unsigned int, len, sizeof(opts)); + len =min (len,sizeof (opts));if (copy_to_user (optval, (char *)&opts, len)) err = -EFAULT ;
@@ -920,7 +921,7 @@ static int sco_sock_getsockopt_old(struc cinfo.hci_handle =sco_pi (sk)->conn->hcon->handle;memcpy (cinfo.dev_class,sco_pi (sk)->conn->hcon->dev_class,3 ); - len = min_t(unsigned int, len, sizeof(cinfo)); + len =min (len,sizeof (cinfo));if (copy_to_user (optval, (char *)&cinfo, len)) err = -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 89/107 Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: WangYuli <[email protected]>
commit d1a5a7eede2977da3d2002d5ea3b519019cc1a98 upstream.
Add the support ID(0x0bda, 0x4853) to usb_device_id table for Realtek RTL8852BE.
Without this change the device utilizes an obsolete version of the firmware that is encoded in it rather than the updated Realtek firmware and config files from the firmware directory. The latter files implement many new features.
The device table is as follows:
T: Bus=03 Lev=01 Prnt=01 Port=09 Cnt=03 Dev#= 4 Spd=12 MxCh= 0
D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0bda ProdID=4853 Rev= 0.00
S: Manufacturer=Realtek
S: Product=Bluetooth Radio
S: SerialNumber=00e04c000001
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
--- drivers/bluetooth/btusb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bluetooth/btusb.c +2 -0
@@ -360,6 +360,8 @@ static const struct usb_device_id blackl/* Realtek 8852BE Bluetooth devices */ { USB_DEVICE(0x0cb8, 0xc559), .driver_info = BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0bda, 0x4853), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x0bda, 0x887b), .driver_info = BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x0bda, 0xb85b), .driver_info = BTUSB_REALTEK |
Greg Kroah-Hartman
maintainerPATCH 90/107 btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Thumshirn <[email protected]>
commit 2f7ef5bb4a2f3e481ef05fab946edb97c84f67cf upstream.
Syzbot reported the following information leak for in btrfs_ioctl_logical_to_ino():
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x110 lib/usercopy.c:40 instrument_copy_to_user include/linux/instrumented.h:114 [inline] _copy_to_user+0xbc/0x110 lib/usercopy.c:40 copy_to_user include/linux/uaccess.h:191 [inline] btrfs_ioctl_logical_to_ino+0x440/0x750 fs/btrfs/ioctl.c:3499 btrfs_ioctl+0x714/0x1260 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890 __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890 x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was created at:
__kmalloc_large_node+0x231/0x370 mm/slub.c:3921 __do_kmalloc_node mm/slub.c:3954 [inline] __kmalloc_node+0xb07/0x1060 mm/slub.c:3973 kmalloc_node include/linux/slab.h:648 [inline] kvmalloc_node+0xc0/0x2d0 mm/util.c:634 kvmalloc include/linux/slab.h:766 [inline] init_data_container+0x49/0x1e0 fs/btrfs/backref.c:2779 btrfs_ioctl_logical_to_ino+0x17c/0x750 fs/btrfs/ioctl.c:3480 btrfs_ioctl+0x714/0x1260 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890 __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890 x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Bytes 40-65535 of 65536 are uninitialized Memory access of size 65536 starts at ffff888045a40000
This happens, because we're copying a 'struct btrfs_data_container' back to user-space. This btrfs_data_container is allocated in 'init_data_container()' via kvmalloc(), which does not zero-fill the memory.
Fix this by using kvzalloc() which zeroes out the memory on allocation.
--- fs/btrfs/backref.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-)
fs/btrfs/backref.c +3 -9
@@ -2291,20 +2291,14 @@ struct btrfs_data_container *init_data_csize_t alloc_bytes; alloc_bytes =max_t (size_t, total_bytes,sizeof (*data)); - data =kvmalloc (alloc_bytes,GFP_KERNEL ); + data =kvzalloc (alloc_bytes,GFP_KERNEL );if (!data)return ERR_PTR (-ENOMEM ); -if (total_bytes >=sizeof (*data)) { +if (total_bytes >=sizeof (*data)) data->bytes_left = total_bytes -sizeof (*data); - data->bytes_missing =0 ; - }else { +else data->bytes_missing =sizeof (*data) - total_bytes; - data->bytes_left =0 ; - } - - data->elem_cnt =0 ; - data->elem_missed =0 ;return data; }
Greg Kroah-Hartman
maintainerPATCH 91/107 arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Iskander Amara <[email protected]>
commit 0ac417b8f124427c90ec8c2ef4f632b821d924cc upstream.
Q7_THRM# pin is connected to a diode on the module which is used as a level shifter, and the pin have a pull-down enabled by default. We need to configure it to internal pull-up, other- wise whenever the pin is configured as INPUT and we try to control it externally the value will always remain zero.
--- arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 10 ++++++++++ 1 file changed, 10 insertions(+)
arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +10 -0
@@ -431,6 +431,16 @@ }; &pinctrl { + pinctrl-names = "default"; + pinctrl-0 = <&q7_thermal_pin>; + + gpios { + q7_thermal_pin: q7-thermal-pin { + rockchip,pins = + <0 RK_PA3 RK_FUNC_GPIO &pcfg_pull_up>; + }; + }; + i2c8 { i2c8_xfer_a: i2c8-xfer { rockchip,pins =
Greg Kroah-Hartman
maintainerPATCH 92/107 drm/amdgpu: Fix leak when GPU memory allocation fails
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukul Joshi <[email protected]>
commit 25e9227c6afd200bed6774c866980b8e36d033af upstream.
Free the sync object if the memory allocation fails for any reason.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +1 -0
@@ -1204,6 +1204,7 @@ allocate_init_user_pages_failed: err_bo_create:unreserve_mem_limit (adev, size, alloc_domain, !!sg); err_reserve_limit: +amdgpu_sync_free (&(*mem)->sync);mutex_destroy (&(*mem)->lock);kfree (*mem); err:
Greg Kroah-Hartman
maintainerPATCH 93/107 irqchip/gic-v3-its: Prevent double free on error
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guanrui Huang <[email protected]>
commit c26591afd33adce296c022e3480dea4282b7ef91 upstream.
The error handling path in its_vpe_irq_domain_alloc() causes a double free when its_vpe_init() fails after successfully allocating at least one interrupt. This happens because its_vpe_irq_domain_free() frees the interrupts along with the area bitmap and the vprop_page and its_vpe_irq_domain_alloc() subsequently frees the area bitmap and the vprop_page again.
Fix this by unconditionally invoking its_vpe_irq_domain_free() which handles all cases correctly and by removing the bitmap/vprop_page freeing from its_vpe_irq_domain_alloc().
[ tglx: Massaged change log ]
--- drivers/irqchip/irq-gic-v3-its.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
drivers/irqchip/irq-gic-v3-its.c +2 -7
@@ -3121,13 +3121,8 @@ static int its_vpe_irq_domain_alloc(struset_bit (i, bitmap); } -if (err) { -if (i >0 ) -its_vpe_irq_domain_free (domain, virq, i); - -its_lpi_free (bitmap, base, nr_ids); -its_free_prop_table (vprop_page); - } +if (err) +its_vpe_irq_domain_free (domain, virq, i);return err; }
Greg Kroah-Hartman
maintainerPATCH 94/107 ethernet: Add helper for assigning packet type when dest address does not match device address
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rahul Rameshbabu <[email protected]>
commit 6e159fd653d7ebf6290358e0330a0cb8a75cf73b upstream.
Enable reuse of logic in eth_type_trans for determining packet type.
--- include/linux/etherdevice.h | 25 +++++++++++++++++++++++++ net/ethernet/eth.c | 12 +----------- 2 files changed, 26 insertions(+), 11 deletions(-)
include/linux/etherdevice.h +25 -0
@@ -532,6 +532,31 @@ static inline unsigned long compare_ethe }/** +* eth_skb_pkt_type - Assign packet type if destination address does not match +* @skb: Assigned a packet type if address does not match @dev address +* @dev: Network device used to compare packet address against +* +* If the destination MAC address of the packet does not match the network +* device address, assign an appropriate packet type. +*/ +static inline void eth_skb_pkt_type (struct sk_buff *skb, +const struct net_device *dev) +{ +const struct ethhdr *eth =eth_hdr (skb); + +if (unlikely (!ether_addr_equal_64bits (eth->h_dest, dev->dev_addr))) { +if (unlikely (is_multicast_ether_addr_64bits (eth->h_dest))) { +if (ether_addr_equal_64bits (eth->h_dest, dev->broadcast)) + skb->pkt_type =PACKET_BROADCAST ; +else + skb->pkt_type =PACKET_MULTICAST ; + }else { + skb->pkt_type =PACKET_OTHERHOST ; + } + } +} + +/** * eth_skb_pad - Pad buffer to mininum number of octets for Ethernet frame * @skb: Buffer to pad *
net/ethernet/eth.c +1 -11
@@ -164,17 +164,7 @@ __be16 eth_type_trans(struct sk_buff *sk eth = (struct ethhdr *)skb->data;skb_pull_inline (skb,ETH_HLEN ); -if (unlikely (!ether_addr_equal_64bits (eth->h_dest, - dev->dev_addr))) { -if (unlikely (is_multicast_ether_addr_64bits (eth->h_dest))) { -if (ether_addr_equal_64bits (eth->h_dest, dev->broadcast)) - skb->pkt_type =PACKET_BROADCAST ; -else - skb->pkt_type =PACKET_MULTICAST ; - }else { - skb->pkt_type =PACKET_OTHERHOST ; - } - } +eth_skb_pkt_type (skb, dev);/* * Some variants of DSA tagging don't have an ethertype field
Greg Kroah-Hartman
maintainerPATCH 95/107 net: b44: set pause params only when interface is up
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Münster <[email protected]>
commit e3eb7dd47bd4806f00e104eb6da092c435f9fb21 upstream.
b44_free_rings() accesses b44::rx_buffers (and ::tx_buffers) unconditionally, but b44::rx_buffers is only valid when the device is up (they get allocated in b44_open(), and deallocated again in b44_close()), any other time these are just a NULL pointers.
So if you try to change the pause params while the network interface is disabled/administratively down, everything explodes (which likely netifd tries to do).
--- drivers/net/ethernet/broadcom/b44.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/net/ethernet/broadcom/b44.c +8 -6
@@ -2033,12 +2033,14 @@ static int b44_set_pauseparam(struct net bp->flags |=B44_FLAG_TX_PAUSE ; else bp->flags &= ~B44_FLAG_TX_PAUSE; -if (bp->flags &B44_FLAG_PAUSE_AUTO ) { -b44_halt (bp); -b44_init_rings (bp); -b44_init_hw (bp,B44_FULL_RESET ); - }else { -__b44_set_flow_ctrl (bp, bp->flags); +if (netif_running (dev)) { +if (bp->flags &B44_FLAG_PAUSE_AUTO ) { +b44_halt (bp); +b44_init_rings (bp); +b44_init_hw (bp,B44_FULL_RESET ); + }else { +__b44_set_flow_ctrl (bp, bp->flags); + } }spin_unlock_irq (&bp->lock);
Greg Kroah-Hartman
maintainerPATCH 96/107 stackdepot: respect __GFP_NOLOCKDEP allocation flag
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Ryabinin <[email protected]>
commit 6fe60465e1d53ea321ee909be26d97529e8f746c upstream.
If stack_depot_save_flags() allocates memory it always drops __GFP_NOLOCKDEP flag. So when KASAN tries to track __GFP_NOLOCKDEP allocation we may end up with lockdep splat like bellow:
======================================================
WARNING: possible circular locking dependency detected 6.9.0-rc3+ #49 Not tainted
------------------------------------------------------
kswapd0/149 is trying to acquire lock:
ffff88811346a920
(&xfs_nondir_ilock_class){++++}-{4:4}, at: xfs_reclaim_inode+0x3ac/0x590 [xfs]
but task is already holding lock:
ffffffff8bb33100 (fs_reclaim){+.+.}-{0:0}, at:balance_pgdat+0x5d9/0xad0
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (fs_reclaim){+.+.}-{0:0}:
__lock_acquire+0x7da/0x1030
lock_acquire+0x15d/0x400
fs_reclaim_acquire+0xb5/0x100
prepare_alloc_pages.constprop.0+0xc5/0x230
__alloc_pages+0x12a/0x3f0
alloc_pages_mpol+0x175/0x340
stack_depot_save_flags+0x4c5/0x510
kasan_save_stack+0x30/0x40
kasan_save_track+0x10/0x30
__kasan_slab_alloc+0x83/0x90
kmem_cache_alloc+0x15e/0x4a0
__alloc_object+0x35/0x370
__create_object+0x22/0x90
__kmalloc_node_track_caller+0x477/0x5b0
krealloc+0x5f/0x110
xfs_iext_insert_raw+0x4b2/0x6e0 [xfs]
xfs_iext_insert+0x2e/0x130 [xfs]
xfs_iread_bmbt_block+0x1a9/0x4d0 [xfs]
xfs_btree_visit_block+0xfb/0x290 [xfs]
xfs_btree_visit_blocks+0x215/0x2c0 [xfs]
xfs_iread_extents+0x1a2/0x2e0 [xfs]
xfs_buffered_write_iomap_begin+0x376/0x10a0 [xfs]
iomap_iter+0x1d1/0x2d0
iomap_file_buffered_write+0x120/0x1a0
xfs_file_buffered_write+0x128/0x4b0 [xfs]
vfs_write+0x675/0x890
ksys_write+0xc3/0x160
do_syscall_64+0x94/0x170
entry_SYSCALL_64_after_hwframe+0x71/0x79Always preserve __GFP_NOLOCKDEP to fix this.
--- lib/stackdepot.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
lib/stackdepot.c +2 -2
@@ -259,10 +259,10 @@ depot_stack_handle_t stack_depot_save(un/* * Zero out zone modifiers, as we don't have specific zone * requirements. Keep the flags related to allocation in atomic -* contexts and I/O. +* contexts, I/O, nolockdep. */ alloc_flags &= ~GFP_ZONEMASK ; - alloc_flags &= (GFP_ATOMIC |GFP_KERNEL ); + alloc_flags &= (GFP_ATOMIC |GFP_KERNEL | __GFP_NOLOCKDEP); alloc_flags |= __GFP_NOWARN; page =alloc_pages (alloc_flags,STACK_ALLOC_ORDER );if (page)
Greg Kroah-Hartman
maintainerPATCH 97/107 mtd: diskonchip: work around ubsan link failure
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 21c9fb611c25d5cd038f6fe485232e7884bb0b3d upstream.
I ran into a randconfig build failure with UBSAN using gcc-13.2:
arm-linux-gnueabi-ld: error: unplaced orphan section .bss..Lubsan_data31' from drivers/mtd/nand/raw/diskonchip.o'
I'm not entirely sure what is going on here, but I suspect this has something to do with the check for the end of the doc_locations[] array that contains an (unsigned long)0xffffffff element, which is compared against the signed (int)0xffffffff. If this is the case, we should get a runtime check for undefined behavior, but we instead get an unexpected build-time error.
I would have expected this to work fine on 32-bit architectures despite the signed integer overflow, though on 64-bit architectures this likely won't ever work.
Changing the contition to instead check for the size of the array makes the code safe everywhere and avoids the ubsan check that leads to the link error. The loop code goes back to before 2.6.12.
--- drivers/mtd/nand/raw/diskonchip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mtd/nand/raw/diskonchip.c +2 -2
@@ -53,7 +53,7 @@ static unsigned long doc_locations[] __i 0xe8000, 0xea000, 0xec000, 0xee000, #endif #endif - 0xffffffff }; +}; static struct mtd_info *doclist = NULL;
@@ -1666,7 +1666,7 @@ static int __init init_nanddoc(void)if (ret <0 )return ret; }else { -for (i =0 ; (doc_locations[i] !=0xffffffff ); i++) { +for (i =0 ; i <ARRAY_SIZE (doc_locations); i++) {doc_probe (doc_locations[i]); } }
Greg Kroah-Hartman
maintainerPATCH 98/107 tcp: Clean up kernel listeners reqsk in inet_twsk_purge()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
commit 740ea3c4a0b2e326b23d7cdf05472a0e92aa39bc upstream.
Eric Dumazet reported a use-after-free related to the per-netns ehash series. [0]
When we create a TCP socket from userspace, the socket always holds a refcnt of the netns. This guarantees that a reqsk timer is always fired before netns dismantle. Each reqsk has a refcnt of its listener, so the listener is not freed before the reqsk, and the net is not freed before the listener as well.
OTOH, when in-kernel users create a TCP socket, it might not hold a refcnt of its netns. Thus, a reqsk timer can be fired after the netns dismantle and access freed per-netns ehash.
To avoid the use-after-free, we need to clean up TCP_NEW_SYN_RECV sockets in inet_twsk_purge() if the netns uses a per-netns ehash.
[0]: https://lore.kernel.org/netdev/CANn89iLXMup0dRD_Ov79Xt8N9FM0XdhCHEN05sf3eLwxKweM6w@mail.gmail.com/
BUG: KASAN: use-after-free in tcp_or_dccp_get_hashinfo include/net/inet_hashtables.h:181 [inline] BUG: KASAN: use-after-free in reqsk_queue_unlink+0x320/0x350 net/ipv4/inet_connection_sock.c:913 Read of size 8 at addr ffff88807545bd80 by task syz-executor.2/8301 CPU: 1 PID: 8301 Comm: syz-executor.2 Not tainted 6.0.0-syzkaller-02757-gaf7d23f9d96a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x719 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 tcp_or_dccp_get_hashinfo include/net/inet_hashtables.h:181 [inline] reqsk_queue_unlink+0x320/0x350 net/ipv4/inet_connection_sock.c:913 inet_csk_reqsk_queue_drop net/ipv4/inet_connection_sock.c:927 [inline] inet_csk_reqsk_queue_drop_and_put net/ipv4/inet_connection_sock.c:939 [inline] reqsk_timer_handler+0x724/0x1160 net/ipv4/inet_connection_sock.c:1053 call_timer_fn+0x1a0/0x6b0 kernel/time/timer.c:1474 expire_timers kernel/time/timer.c:1519 [inline] __run_timers.part.0+0x674/0xa80 kernel/time/timer.c:1790 __run_timers kernel/time/timer.c:1768 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803 __do_softirq+0x1d0/0x9c8 kernel/softirq.c:571 invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1107 </IRQ>
--- net/ipv4/inet_timewait_sock.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
net/ipv4/inet_timewait_sock.c +14 -1
@@ -268,8 +268,21 @@ restart_rcu:rcu_read_lock (); restart:sk_nulls_for_each_rcu (sk, node, &head->chain) { -if (sk->sk_state !=TCP_TIME_WAIT ) +if (sk->sk_state !=TCP_TIME_WAIT ) { +/* A kernel listener socket might not hold refcnt for net, +* so reqsk_timer_handler() could be fired after net is +* freed. Userspace listener and reqsk never exist here. +*/ +if (unlikely (sk->sk_state ==TCP_NEW_SYN_RECV && + hashinfo->pernet)) { +struct request_sock *req =inet_reqsk (sk); + +inet_csk_reqsk_queue_drop_and_put (req->rsk_listener, req); + } +continue ; + } + tw =inet_twsk (sk);if ((tw->tw_family != family) ||refcount_read (&twsk_net (tw)->count))
Re: [PATCH 5.4 098/107] tcp: Clean up kernel listeners reqsk in inet_twsk_purge()
Quoted 79 lines · Greg Kroah-Hartman
5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
commit
740ea3c4a0b2e326b23d7cdf05472a0e92aa39bcupstream.Eric Dumazet reported a use-after-free related to the per-netns ehash series. [0]
When we create a TCP socket from userspace, the socket always holds a refcnt of the netns. This guarantees that a reqsk timer is always fired before netns dismantle. Each reqsk has a refcnt of its listener, so the listener is not freed before the reqsk, and the net is not freed before the listener as well.
OTOH, when in-kernel users create a TCP socket, it might not hold a refcnt of its netns. Thus, a reqsk timer can be fired after the netns dismantle and access freed per-netns ehash.
To avoid the use-after-free, we need to clean up
TCP_NEW_SYN_RECVsockets ininet_twsk_purge()if the netns uses a per-netns ehash.[0]: https://lore.kernel.org/netdev/CANn89iLXMup0dRD_Ov79Xt8N9FM0XdhCHEN05sf3eLwxKweM6w@mail.gmail.com/
BUG: KASAN: use-after-free in tcp_or_dccp_get_hashinfo include/net/inet_hashtables.h:181 [inline] BUG: KASAN: use-after-free in reqsk_queue_unlink+0x320/0x350 net/ipv4/inet_connection_sock.c:913 Read of size 8 at addr ffff88807545bd80 by task syz-executor.2/8301 CPU: 1 PID: 8301 Comm: syz-executor.2 Not tainted 6.0.0-syzkaller-02757-gaf7d23f9d96a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x719 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 tcp_or_dccp_get_hashinfo include/net/inet_hashtables.h:181 [inline] reqsk_queue_unlink+0x320/0x350 net/ipv4/inet_connection_sock.c:913 inet_csk_reqsk_queue_drop net/ipv4/inet_connection_sock.c:927 [inline] inet_csk_reqsk_queue_drop_and_put net/ipv4/inet_connection_sock.c:939 [inline] reqsk_timer_handler+0x724/0x1160 net/ipv4/inet_connection_sock.c:1053 call_timer_fn+0x1a0/0x6b0 kernel/time/timer.c:1474 expire_timers kernel/time/timer.c:1519 [inline] __run_timers.part.0+0x674/0xa80 kernel/time/timer.c:1790 __run_timers kernel/time/timer.c:1768 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803 __do_softirq+0x1d0/0x9c8 kernel/softirq.c:571 invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1107 </IRQ>Fixes d1e5e6408b30 ("tcp: Introduce optional per-netns ehash.")Reported-by syzbot <[email protected]>Reported-by Eric Dumazet <[email protected]>Suggested-by Eric Dumazet <[email protected]>Signed-off-by Kuniyuki Iwashima <[email protected]>Reviewed-by Eric Dumazet <[email protected]>Signed-off-by Jakub Kicinski <[email protected]>[shaozhengchao: resolved conflicts in 5.10]Signed-off-by Zhengchao Shao <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- net/ipv4/inet_timewait_sock.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)net/ipv4/inet_timewait_sock.c +0
-0@@ -268,8 +268,21 @@ restart_rcu:rcu_read_lock ();
net/ipv4/inet_timewait_sock.c restart_rcu: · line 277
Quoted 10 lines
net/ipv4/inet_timewait_sock.c +7
-1restart:sk_nulls_for_each_rcu (sk, node, &head->chain) { -if (sk->sk_state !=TCP_TIME_WAIT ) +if (sk->sk_state !=TCP_TIME_WAIT ) { +/* A kernel listener socket might not hold refcnt for net, +* so reqsk_timer_handler() could be fired after net is +* freed. Userspace listener and reqsk never exist here. +*/ +if (unlikely (sk->sk_state ==TCP_NEW_SYN_RECV && + hashinfo->pernet)) {
Hi Greg:
I'm very very sorry, there's no pernet variable in the struct
hashinfo. The pernet variable is introduced from v6.1-rc1. This patch has a problem and cannot be merged.
Zhengchao Shao
Quoted 13 lines
net/ipv4/inet_timewait_sock.c +7
-0+struct request_sock *req =inet_reqsk (sk); + +inet_csk_reqsk_queue_drop_and_put (req->rsk_listener, req); + } +continue ; + } + tw =inet_twsk (sk);if ((tw->tw_family != family) ||refcount_read (&twsk_net (tw)->count))
Re: [PATCH 5.4 098/107] tcp: Clean up kernel listeners reqsk in inet_twsk_purge()
Quoted 101 lines · shaozhengchao
Quoted 83 lines · Greg Kroah-Hartman
5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
commit
740ea3c4a0b2e326b23d7cdf05472a0e92aa39bcupstream.Eric Dumazet reported a use-after-free related to the per-netns ehash series. [0]
When we create a TCP socket from userspace, the socket always holds a refcnt of the netns. This guarantees that a reqsk timer is always fired before netns dismantle. Each reqsk has a refcnt of its listener, so the listener is not freed before the reqsk, and the net is not freed before the listener as well.
OTOH, when in-kernel users create a TCP socket, it might not hold a refcnt of its netns. Thus, a reqsk timer can be fired after the netns dismantle and access freed per-netns ehash.
To avoid the use-after-free, we need to clean up
TCP_NEW_SYN_RECVsockets ininet_twsk_purge()if the netns uses a per-netns ehash.[0]: https://lore.kernel.org/netdev/CANn89iLXMup0dRD_Ov79Xt8N9FM0XdhCHEN05sf3eLwxKweM6w@mail.gmail.com/
BUG: KASAN: use-after-free in tcp_or_dccp_get_hashinfo include/net/inet_hashtables.h:181 [inline] BUG: KASAN: use-after-free in reqsk_queue_unlink+0x320/0x350 net/ipv4/inet_connection_sock.c:913 Read of size 8 at addr ffff88807545bd80 by task syz-executor.2/8301 CPU: 1 PID: 8301 Comm: syz-executor.2 Not tainted 6.0.0-syzkaller-02757-gaf7d23f9d96a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x719 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 tcp_or_dccp_get_hashinfo include/net/inet_hashtables.h:181 [inline] reqsk_queue_unlink+0x320/0x350 net/ipv4/inet_connection_sock.c:913 inet_csk_reqsk_queue_drop net/ipv4/inet_connection_sock.c:927 [inline] inet_csk_reqsk_queue_drop_and_put net/ipv4/inet_connection_sock.c:939 [inline] reqsk_timer_handler+0x724/0x1160 net/ipv4/inet_connection_sock.c:1053 call_timer_fn+0x1a0/0x6b0 kernel/time/timer.c:1474 expire_timers kernel/time/timer.c:1519 [inline] __run_timers.part.0+0x674/0xa80 kernel/time/timer.c:1790 __run_timers kernel/time/timer.c:1768 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803 __do_softirq+0x1d0/0x9c8 kernel/softirq.c:571 invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1107 </IRQ>Fixes d1e5e6408b30 ("tcp: Introduce optional per-netns ehash.")Reported-by syzbot <[email protected]>Reported-by Eric Dumazet <[email protected]>Suggested-by Eric Dumazet <[email protected]>Signed-off-by Kuniyuki Iwashima <[email protected]>Reviewed-by Eric Dumazet <[email protected]>Signed-off-by Jakub Kicinski <[email protected]>[shaozhengchao: resolved conflicts in 5.10]Signed-off-by Zhengchao Shao <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>---
net/ipv4/inet_timewait_sock.c| 15 ++++++++++++++-1 file changed, 14 insertions(+), 1 deletion(-)net/ipv4/inet_timewait_sock.c +0
-0@@ -268,8 +268,21 @@ restart_rcu: rcu_read_lock();restart:
sk_nulls_for_each_rcu(sk, node, &head->chain){ - if (sk->sk_state!=TCP_TIME_WAIT) + if (sk->sk_state!=TCP_TIME_WAIT) {Quoted 8 lines
+ /* A kernel listener socket might not hold refcnt for net,
+ * soreqsk_timer_handler()could be fired after net is + * freed. Userspace listener and reqsk never exist here.
+ */
+ if (unlikely(sk->sk_state ==TCP_NEW_SYN_RECV&& +hashinfo->pernet)) {Hi Greg:
I'm very very sorry, there's no pernet variable in the struct
hashinfo. The pernet variable is introduced from v6.1-rc1. This patch has a problem and cannot be merged.Zhengchao Shao
Quoted 14 lines
Quoted 4 lines
+ struct
request_sock*req =inet_reqsk(sk);net/ipv4/inet_timewait_sock.c +2
-0+ +
inet_csk_reqsk_queue_drop_and_put(req->rsk_listener, req);Quoted 10 lines
+ }
+
continue;
+ }
+
tw =inet_twsk(sk);
if ((tw->tw_family!= family) || refcount_read(&twsk_net(tw)->count))
Hi Greg:
I'm sorry to bother you. Revert two patches, because when the ("tcp:
Clean up kernel listeners reqsk in inet_twsk_purge()") patch is incorporated separately, which will cause compilation failure. To fix CVE-2024-26865, should the two patches be combined into one?
Zhengchao Shao
Greg Kroah-Hartman
maintainerPATCH 99/107 tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 1c4e97dd2d3c9a3e84f7e26346aa39bc426d3249 upstream.
inet_twsk_purge() uses rcu to find TIME_WAIT and NEW_SYN_RECV objects to purge.
These objects use SLAB_TYPESAFE_BY_RCU semantic and need special care. We need to use refcount_inc_not_zero(&sk->sk_refcnt).
Reuse the existing correct logic I wrote for TIME_WAIT, because both structures have common locations for sk_state, sk_family, and netns pointer.
If after the refcount_inc_not_zero() the object fields longer match the keys, use sock_gen_put(sk) to release the refcount.
Then we can call inet_twsk_deschedule_put() for TIME_WAIT, inet_csk_reqsk_queue_drop_and_put() for NEW_SYN_RECV sockets, with BH disabled.
Then we need to restart the loop because we had drop rcu_read_lock().
--- net/ipv4/inet_timewait_sock.c | 41 +++++++++++++++++++---------------------- 1 file changed, 19 insertions(+), 22 deletions(-)
net/ipv4/inet_timewait_sock.c +19 -22
@@ -254,12 +254,12 @@ void __inet_twsk_schedule(struct inet_ti }EXPORT_SYMBOL_GPL (__inet_twsk_schedule); +/* Remove all non full sockets (TIME_WAIT and NEW_SYN_RECV) for dead netns */ void inet_twsk_purge (struct inet_hashinfo *hashinfo,int family) { -struct inet_timewait_sock *tw; -struct sock *sk;struct hlist_nulls_node *node;unsigned int slot; +struct sock *sk;for (slot =0 ; slot <= hashinfo->ehash_mask; slot++) {struct inet_ehash_bucket *head = &hashinfo->ehash[slot];
@@ -268,38 +268,35 @@ restart_rcu:rcu_read_lock (); restart:sk_nulls_for_each_rcu (sk, node, &head->chain) { -if (sk->sk_state !=TCP_TIME_WAIT ) { -/* A kernel listener socket might not hold refcnt for net, -* so reqsk_timer_handler() could be fired after net is -* freed. Userspace listener and reqsk never exist here. -*/ -if (unlikely (sk->sk_state ==TCP_NEW_SYN_RECV && - hashinfo->pernet)) { -struct request_sock *req =inet_reqsk (sk); - -inet_csk_reqsk_queue_drop_and_put (req->rsk_listener, req); - } +int state =inet_sk_state_load (sk); +if ((1 << state) & ~(TCPF_TIME_WAIT | +TCPF_NEW_SYN_RECV ))continue ; - } - tw =inet_twsk (sk); -if ((tw->tw_family != family) || -refcount_read (&twsk_net (tw)->count)) +if (sk->sk_family != family || +refcount_read (&sock_net (sk)->count))continue ; -if (unlikely (!refcount_inc_not_zero (&tw->tw_refcnt))) +if (unlikely (!refcount_inc_not_zero (&sk->sk_refcnt)))continue ; -if (unlikely ((tw->tw_family != family) || -refcount_read (&twsk_net (tw)->count))) { -inet_twsk_put (tw); +if (unlikely (sk->sk_family != family || +refcount_read (&sock_net (sk)->count))) { +sock_gen_put (sk); goto restart; }rcu_read_unlock ();local_bh_disable (); -inet_twsk_deschedule_put (tw); +if (state ==TCP_TIME_WAIT ) { +inet_twsk_deschedule_put (inet_twsk (sk)); + }else { +struct request_sock *req =inet_reqsk (sk); + +inet_csk_reqsk_queue_drop_and_put (req->rsk_listener, + req); + }local_bh_enable (); goto restart_rcu; }
Greg Kroah-Hartman
maintainerPATCH 100/107 dmaengine: owl: fix register access functions
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 43c633ef93a5d293c96ebcedb40130df13128428 ]
When building with 'make W=1', clang notices that the computed register values are never actually written back but instead the wrong variable is set:
drivers/dma/owl-dma.c:244:6: error: variable 'regval' set but not used [-Werror,-Wunused-but-set-variable]
244 | u32 regval;
| ^drivers/dma/owl-dma.c:268:6: error: variable 'regval' set but not used [-Werror,-Wunused-but-set-variable]
268 | u32 regval;
| ^
Change these to what was most likely intended.
--- drivers/dma/owl-dma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/dma/owl-dma.c +2 -2
@@ -238,7 +238,7 @@ static void pchan_update(struct owl_dma_pchan *pchan, u32 reg,else regval &= ~val; -writel (val, pchan->base + reg); +writel (regval, pchan->base + reg); }static void pchan_writel (struct owl_dma_pchan *pchan,u32 reg,u32 data)
@@ -262,7 +262,7 @@ static void dma_update(struct owl_dma *od, u32 reg, u32 val, bool state)else regval &= ~val; -writel (val, od->base + reg); +writel (regval, od->base + reg); }static void dma_writel (struct owl_dma *od,u32 reg,u32 data)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/107 idma64: Dont try to serve interrupts when device is powered off
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 9140ce47872bfd89fca888c2f992faa51d20c2bc ]
When iDMA 64-bit device is powered off, the IRQ status register is all 1:s. This is never happen in real case and signalling that the device is simply powered off. Don't try to serve interrupts that are not ours.
--- drivers/dma/idma64.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/dma/idma64.c +4 -0
@@ -167,6 +167,10 @@ static irqreturn_t idma64_irq(int irq, void *dev)u32 status_err;unsigned short i; +/* Since IRQ may be shared, check if DMA controller is powered on */ +if (status ==GENMASK (31 ,0 )) +return IRQ_NONE ; +dev_vdbg (idma64->dma.dev,"%s: status=%#x\n" , __func__, status);/* Check if we have any interrupt from the DMA controller */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/107 i2c: smbus: fix NULL function pointer dereference
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit 91811a31b68d3765b3065f4bb6d7d6d84a7cfc9f ]
Baruch reported an OOPS when using the designware controller as target only. Target-only modes break the assumption of one transfer function always being available. Fix this by always checking the pointer in __i2c_transfer.
--- drivers/i2c/i2c-core-base.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/i2c/i2c-core-base.c +6 -6
@@ -1965,13 +1965,18 @@ static int i2c_check_for_quirks(struct i2c_adapter *adap, struct i2c_msg *msgs,* Returns negative errno, else the number of messages executed. * * Adapter lock must be held when calling this function. No debug logging -* takes place. adap->algo->master_xfer existence isn't checked. +* takes place. */ int __i2c_transfer (struct i2c_adapter *adap,struct i2c_msg *msgs,int num) {unsigned long orig_jiffies;int ret, try; +if (!adap->algo->master_xfer) { +dev_dbg (&adap->dev,"I2C level transfers not supported\n" ); +return -EOPNOTSUPP ; + } +if (WARN_ON (!msgs || num <1 ))return -EINVAL ;
@@ -2038,11 +2043,6 @@ int i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) {int ret; -if (!adap->algo->master_xfer) { -dev_dbg (&adap->dev,"I2C level transfers not supported\n" ); -return -EOPNOTSUPP ; - } -/* REVISIT the fault reporting model here is weak: * * - When we get an error after receiving N bytes from a slave,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/107 HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <[email protected]>
commit 9c0f59e47a90c54d0153f8ddc0f80d7a36207d0e upstream.
The flag I2C_HID_READ_PENDING is used to serialize I2C operations. However, this is not necessary, because I2C core already has its own locking for that.
More importantly, this flag can cause a lock-up: if the flag is set in i2c_hid_xfer() and an interrupt happens, the interrupt handler (i2c_hid_irq) will check this flag and return immediately without doing anything, then the interrupt handler will be invoked again in an infinite loop.
Since interrupt handler is an RT task, it takes over the CPU and the flag-clearing task never gets scheduled, thus we have a lock-up.
Delete this unnecessary flag.
--- drivers/hid/i2c-hid/i2c-hid-core.c | 8 -------- 1 file changed, 8 deletions(-)
drivers/hid/i2c-hid/i2c-hid-core.c +0 -8
@@ -56,7 +56,6 @@/* flags */ #define I2C_HID_STARTED 0#define I2C_HID_RESET_PENDING 1 -#define I2C_HID_READ_PENDING 2#define I2C_HID_PWR_ON 0x00#define I2C_HID_PWR_SLEEP 0x01
@@ -258,7 +257,6 @@ static int __i2c_hid_command(struct i2c_ msg[1 ].len = data_len; msg[1 ].buf = buf_recv; msg_num =2 ; -set_bit (I2C_HID_READ_PENDING , &ihid->flags); }if (wait)
@@ -266,9 +264,6 @@ static int __i2c_hid_command(struct i2c_ ret =i2c_transfer (client->adapter, msg, msg_num); -if (data_len >0 ) -clear_bit (I2C_HID_READ_PENDING , &ihid->flags); -if (ret != msg_num)return ret <0 ? ret : -EIO ;
@@ -540,9 +535,6 @@ static irqreturn_t i2c_hid_irq(int irq, {struct i2c_hid *ihid = dev_id; -if (test_bit (I2C_HID_READ_PENDING , &ihid->flags)) -return IRQ_HANDLED ; -i2c_hid_get_input (ihid);return IRQ_HANDLED ;
Greg Kroah-Hartman
maintainerPATCH 104/107 bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
commit 5af385f5f4cddf908f663974847a4083b2ff2c79 upstream.
bits_per() rounds up to the next power of two when passed a power of two. This causes crashes on some machines and configurations.
--- kernel/bounds.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/bounds.c +1 -1
@@ -19,7 +19,7 @@ int main(void)DEFINE (NR_PAGEFLAGS , __NR_PAGEFLAGS);DEFINE (MAX_NR_ZONES , __MAX_NR_ZONES);#ifdef CONFIG_SMP -DEFINE (NR_CPUS_BITS ,bits_per (CONFIG_NR_CPUS )); +DEFINE (NR_CPUS_BITS ,order_base_2 (CONFIG_NR_CPUS ));#endif DEFINE (SPINLOCK_SIZE ,sizeof (spinlock_t));/* End of constants */
Greg Kroah-Hartman
maintainerPATCH 105/107 dm: limit the number of targets and parameter size area
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit bd504bcfec41a503b32054da5472904b404341a4 upstream.
The kvmalloc function fails with a warning if the size is larger than INT_MAX. The warning was triggered by a syscall testing robot.
In order to avoid the warning, this commit limits the number of targets to 1048576 and the size of the parameter area to 1073741824.
--- drivers/md/dm-core.h | 2 ++ drivers/md/dm-ioctl.c | 3 ++- drivers/md/dm-table.c | 9 +++++++-- 3 files changed, 11 insertions(+), 3 deletions(-)
drivers/md/dm-core.h +2 -0
@@ -18,6 +18,8 @@#include "dm.h" #define DM_RESERVED_MAX_IOS 1024 +#define DM_MAX_TARGETS 1048576 +#define DM_MAX_TARGET_PARAMS 1024struct dm_kobject_holder {struct kobject kobj;
drivers/md/dm-ioctl.c +2 -1
@@ -1760,7 +1760,8 @@ static int copy_params(struct dm_ioctl _if (copy_from_user (param_kernel, user, minimum_data_size))return -EFAULT ; -if (param_kernel->data_size < minimum_data_size) +if (unlikely (param_kernel->data_size < minimum_data_size) || +unlikely (param_kernel->data_size >DM_MAX_TARGETS *DM_MAX_TARGET_PARAMS ))return -EINVAL ; secure_data = param_kernel->flags &DM_SECURE_DATA_FLAG ;
drivers/md/dm-table.c +7 -2
@@ -184,7 +184,12 @@ static int alloc_targets(struct dm_tableint dm_table_create (struct dm_table **result,fmode_t mode,unsigned num_targets,struct mapped_device *md) { -struct dm_table *t =kzalloc (sizeof (*t),GFP_KERNEL ); +struct dm_table *t; + +if (num_targets >DM_MAX_TARGETS ) +return -EOVERFLOW ; + + t =kzalloc (sizeof (*t),GFP_KERNEL );if (!t)return -ENOMEM ;
@@ -199,7 +204,7 @@ int dm_table_create(struct dm_table **reif (!num_targets) {kfree (t); -return -ENOMEM ; +return -EOVERFLOW ; }if (alloc_targets (t, num_targets)) {
Greg Kroah-Hartman
maintainerPATCH 106/107 udp: preserve the connected status if only UDP cmsg
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yick Xie <[email protected]>
commit 680d11f6e5427b6af1321932286722d24a8b16c1 upstream.
If "udp_cmsg_send()" returned 0 (i.e. only UDP cmsg), "connected" should not be set to 0. Otherwise it stops the connected socket from using the cached route.
--- net/ipv4/udp.c | 5 +++-- net/ipv6/udp.c | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-)
net/ipv4/udp.c +3 -2
@@ -1054,16 +1054,17 @@ int udp_sendmsg(struct sock *sk, structif (msg->msg_controllen) { err =udp_cmsg_send (sk, msg, &ipc.gso_size); -if (err >0 ) +if (err >0 ) { err =ip_cmsg_send (sk, msg, &ipc, sk->sk_family ==AF_INET6 ); + connected =0 ; + }if (unlikely (err <0 )) {kfree (ipc.opt);return err; }if (ipc.opt) free =1 ; - connected =0 ; }if (!ipc.opt) {struct ip_options_rcu *inet_opt;
net/ipv6/udp.c +3 -2
@@ -1387,9 +1387,11 @@ do_udp_sendmsg: ipc6.opt = opt; err =udp_cmsg_send (sk, msg, &ipc6.gso_size); -if (err >0 ) +if (err >0 ) { err =ip6_datagram_send_ctl (sock_net (sk), sk, msg, &fl6, &ipc6); + connected = false; + }if (err <0 ) {fl6_sock_release (flowlabel);return err;
@@ -1401,7 +1403,6 @@ do_udp_sendmsg: }if (!(opt->opt_nflen|opt->opt_flen)) opt =NULL ; - connected = false; }if (!opt) { opt =txopt_get (np);
Greg Kroah-Hartman
maintainerPATCH 107/107 serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
commit 29bff582b74ed0bdb7e6986482ad9e6799ea4d2f upstream.
Fix the function name to avoid a kernel-doc warning:
include/linux/serial_core.h:666: warning: expecting prototype for uart_port_lock_irqrestore(). Prototype was for uart_port_unlock_irqrestore() instead
--- include/linux/serial_core.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/serial_core.h +1 -1
@@ -325,7 +325,7 @@ static inline void uart_port_unlock_irq( }/** -* uart_port_lock_irqrestore - Unlock the UART port, restore interrupts +* uart_port_unlock_irqrestore - Unlock the UART port, restore interrupts * @up: Pointer to UART port structure * @flags: The saved interrupt flags for restore */
Jon Hunter
maintainerHi Greg,
Quoted 20 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.275 release. There are 107 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 02 May 2024 10:30:27 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.275-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
...
Quoted 2 lines
Ikjoon Jang <[email protected]>
arm64: dts: mediatek: mt8183: Add power-domains properity to mfgcfg
Same build break for ARM64 as linux-5.10.y due the to above commit.
Jon
Signature · 1 line
nvpublic
Hi Greg,
Quoted 9 lines
Responses should be made by Thu, 02 May 2024 10:30:27 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.275-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.
...
Quoted 3 lines
Ikjoon Jang <[email protected]>
arm64: dts: mediatek: mt8183: Add power-domains properity to mfgcfg
BUILDSTDERR: Error: arch/arm64/boot/dts/mediatek/mt8183.dtsi:580.26-27 syntax error
BUILDSTDERR: FATAL ERROR: Unable to parse input tree
BUILDSTDERR: make[2]: *** [scripts/Makefile.lib:285: arch/arm64/boot/dts/mediatek/mt8183-evb.dtb] Error 1
BUILDSTDERR: make[1]: *** [scripts/Makefile.build:497: arch/arm64/boot/dts/mediatek] Error 2
BUILDSTDERR: make: *** [Makefile:1290: dtbs] Error 2
aarch64 builds are failing with the above error
Thanks,
Harshit
Greg Kroah-Hartman
maintainerQuoted 26 lines · Harshit Mogalapalli
Hi Greg,
Quoted 9 lines
Responses should be made by Thu, 02 May 2024 10:30:27 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.275-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below....
Quoted 3 lines
Ikjoon Jang <[email protected]>
arm64: dts: mediatek: mt8183: Add power-domains properity to mfgcfgBUILDSTDERR: Error: arch/arm64/boot/dts/mediatek/mt8183.dtsi:580.26-27 syntax error
BUILDSTDERR: FATAL ERROR: Unable to parse input tree
BUILDSTDERR: make[2]: *** [scripts/Makefile.lib:285:arch/arm64/boot/dts/mediatek/mt8183-evb.dtb] Error 1
BUILDSTDERR: make[1]: *** [scripts/Makefile.build:497:arch/arm64/boot/dts/mediatek] Error 2
BUILDSTDERR: make: *** [Makefile:1290: dtbs] Error 2
Quoted 1 line
aarch64 builds are failing with the above error
Thanks, will go drop it from 5.10 and 5.4 queues and push out a -rc2.
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.275 release. There are 107 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 02 May 2024 10:30:27 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.275-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah