5.10.216-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 5.10.216-rc1 review
This is the start of the stable review cycle for the 5.10.216 release. There are 138 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 02 May 2024 10:30:27 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.216-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.216-rc1
Guenter Roeck <[email protected]>
riscv: Disable STACKPROTECTOR_PER_TASK if GCC_PLUGIN_RANDSTRUCT is enabled
Randy Dunlap <[email protected]>
serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
Yick Xie <[email protected]>
udp: preserve the connected status if only UDP cmsg
Matthew Wilcox (Oracle) <[email protected]>
bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS
Nam Cao <[email protected]>
HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
Wolfram Sang <[email protected]>
i2c: smbus: fix NULL function pointer dereference
Samuel Holland <[email protected]>
riscv: Fix TASK_SIZE on 64-bit NOMMU
Baoquan He <[email protected]>
riscv: fix VMALLOC_START definition
Sean Anderson <[email protected]>
dma: xilinx_dpdma: Fix locking
Andy Shevchenko <[email protected]>
idma64: Don't try to serve interrupts when device is powered off
Arnd Bergmann <[email protected]>
dmaengine: owl: fix register access functions
Eric Dumazet <[email protected]>
tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
Kuniyuki Iwashima <[email protected]>
tcp: Clean up kernel listener's reqsk in inet_twsk_purge()
Arnd Bergmann <[email protected]>
mtd: diskonchip: work around ubsan link failure
Andrey Ryabinin <[email protected]>
stackdepot: respect __GFP_NOLOCKDEP allocation flag
Peter Münster <[email protected]>
net: b44: set pause params only when interface is up
Rahul Rameshbabu <[email protected]>
ethernet: Add helper for assigning packet type when dest address does not match device address
Guanrui Huang <[email protected]>
irqchip/gic-v3-its: Prevent double free on error
Mukul Joshi <[email protected]>
drm/amdgpu: Fix leak when GPU memory allocation fails
Alex Deucher <[email protected]>
drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3
Iskander Amara <[email protected]>
arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma
Sean Christopherson <[email protected]>
cpu: Re-enable CPU mitigations by default for !X86 architectures
Johannes Thumshirn <[email protected]>
btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
WangYuli <[email protected]>
Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853
Nathan Chancellor <[email protected]>
Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()
Christian Marangi <[email protected]>
PM / devfreq: Fix buffer overflow in trans_stat_show
Robin H. Johnson <[email protected]>
tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker together
Robin H. Johnson <[email protected]>
tracing: Show size of requested perf buffer
Shifeng Li <[email protected]>
net/mlx5e: Fix a race in command alloc flow
Greg Kroah-Hartman <[email protected]>
Revert "crypto: api - Disallow identical driver names"
Emil Kronborg <[email protected]>
serial: mxs-auart: add spinlock around changing cts state
Thomas Gleixner <[email protected]>
serial: core: Provide port lock wrappers
Kuniyuki Iwashima <[email protected]>
af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().
Jason Reeder <[email protected]>
net: ethernet: ti: am65-cpts: Fix PTPv1 message type on TX packets
Sudheer Mogilappagari <[email protected]>
iavf: Fix TC config comparison with existing adapter TC config
Erwan Velu <[email protected]>
i40e: Report MFS in decimal base instead of hex
Sindhu Devale <[email protected]>
i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: honor table dormant flag from netdev release event path
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_tcam: Fix warning during rehash
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_tcam: Rate limit error message
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work
Hyunwoo Kim <[email protected]>
net: openvswitch: Fix Use-After-Free in ovs_ct_exit
Ismael Luceno <[email protected]>
ipvs: Fix checksumming on GSO of SCTP packets
Hyunwoo Kim <[email protected]>
net: gtp: Fix Use-After-Free in gtp_dellink
Eric Dumazet <[email protected]>
net: usb: ax88179_178a: stop lying about skb->truesize
Eric Dumazet <[email protected]>
ipv4: check for NULL idev in ip_route_use_hint()
Paul Geurts <[email protected]>
NFC: trf7970a: disable all regulators on removal
Ido Schimmel <[email protected]>
mlxsw: core: Unregister EMAD trap using FORWARD action
David Bauer <[email protected]>
vxlan: drop packets from invalid src-address
Avraham Stern <[email protected]>
wifi: iwlwifi: mvm: remove old PASN station when adding a new one
Alexey Brodkin <[email protected]>
ARC: [plat-hsdk]: Remove misplaced interrupt-cells property
Rafał Miłecki <[email protected]>
arm64: dts: mediatek: mt2712: fix validation errors
Rafał Miłecki <[email protected]>
arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block
Rafał Miłecki <[email protected]>
arm64: dts: mediatek: mt7622: fix ethernet controller "compatible"
Rafał Miłecki <[email protected]>
arm64: dts: mediatek: mt7622: fix IR nodename
Rafał Miłecki <[email protected]>
arm64: dts: mediatek: mt7622: fix clock controllers
Felix Fietkau <[email protected]>
arm64: dts: mediatek: mt7622: introduce nodes for Wireless Ethernet Dispatch
Felix Fietkau <[email protected]>
arm64: dts: mediatek: mt7622: add support for coherent DMA
Ikjoon Jang <[email protected]>
arm64: dts: mediatek: mt8183: Add power-domains properity to mfgcfg
Dragan Simic <[email protected]>
arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro dts
Quentin Schulz <[email protected]>
arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma
Iskander Amara <[email protected]>
arm64: dts: rockchip: fix alphabetical ordering RK3399 puma
Jeongjun Park <[email protected]>
nilfs2: fix OOB in nilfs_set_de_type
Dave Airlie <[email protected]>
nouveau: fix instmem race condition around ptr stores
xinhui pan <[email protected]>
drm/amdgpu: validate the parameters of bo mapping operations more clearly
Yuntao Wang <[email protected]>
init/main.c: Fix potential static_command_line memory overflow
Alan Stern <[email protected]>
fs: sysfs: Fix reference leak in sysfs_break_active_protection()
Samuel Thibault <[email protected]>
speakup: Avoid crash on very long word
Alexander Usyskin <[email protected]>
mei: me: disable RPL-S on SPS and IGN firmwares
Kai-Heng Feng <[email protected]>
usb: Disable USB3 LPM at shutdown
Minas Harutyunyan <[email protected]>
usb: dwc2: host: Fix dereference issue in DDMA completion flow.
Greg Kroah-Hartman <[email protected]>
Revert "usb: cdc-wdm: close race between read and workqueue"
Daniele Palmas <[email protected]>
USB: serial: option: add Telit FN920C04 rmnet compositions
Vanillan Wang <[email protected]>
USB: serial: option: add Rolling RW101-GL and RW135-GL support
Jerry Meng <[email protected]>
USB: serial: option: support Quectel EM060K sub-models
Coia Prant <[email protected]>
USB: serial: option: add Lonsung U8300/U9300 product
Chuanhong Guo <[email protected]>
USB: serial: option: add support for Fibocom FM650/FG650
bolan wang <[email protected]>
USB: serial: option: add Fibocom FM135-GL variants
Finn Thain <[email protected]>
serial/pmac_zilog: Remove flawed mitigation for rx irq flood
Nikita Zhandarovich <[email protected]>
comedi: vmk80xx: fix incomplete endpoint checking
Gil Fine <[email protected]>
thunderbolt: Fix wake configurations after device unplug
Gil Fine <[email protected]>
thunderbolt: Avoid notify PM core about runtime PM resume
Carlos Llamas <[email protected]>
binder: check offset alignment in binder_get_object()
Eric Biggers <[email protected]>
x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
Stephen Boyd <[email protected]>
clk: Get runtime PM before walking tree during disable_unused
Stephen Boyd <[email protected]>
clk: Initialize struct clk_core kref earlier
Konrad Dybcio <[email protected]>
clk: Print an info line before disabling unused clocks
Claudiu Beznea <[email protected]>
clk: remove extra empty line
Stephen Boyd <[email protected]>
clk: Mark 'all_lists' as const
Stephen Boyd <[email protected]>
clk: Remove prepare_lock hold assertion in __clk_release()
Dmitry Baryshkov <[email protected]>
drm/panel: visionox-rm69299: don't unregister DSI device
Mikhail Kobuk <[email protected]>
drm: nv04: Fix out of bounds access
Michael Guralnik <[email protected]>
RDMA/mlx5: Fix port number for counter query in multi-port configuration
Mark Zhang <[email protected]>
RDMA/cm: Print the old state when cm_destroy_id gets timeout
Yanjun.Zhu <[email protected]>
RDMA/rxe: Fix the problem "mutex_destroy missing"
Lei Chen <[email protected]>
tun: limit printing rate when illegal packet received by tun dev
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: do not free live element
Ziyang Xuan <[email protected]>
netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
Siddh Raman Pant <[email protected]>
Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"
Zheng Yejian <[email protected]>
kprobes: Fix possible use-after-free issue on kprobe registration
Yuanhe Shu <[email protected]>
selftests/ftrace: Limit length in subsystem-enable tests
Stefan O'Rear <[email protected]>
riscv: process: Fix kernel gp leakage
Guo Ren <[email protected]>
riscv: Enable per-task stack canaries
Boris Burkov <[email protected]>
btrfs: record delayed inode root in transaction
Arnd Bergmann <[email protected]>
irqflags: Explicitly ignore lockdep_hrtimer_exit() argument
Adam Dunlap <[email protected]>
x86/apic: Force native_apic_mem_read() to use the MOV instruction
John Stultz <[email protected]>
selftests: timers: Fix abs() warning in posix_timers test
Sean Christopherson <[email protected]>
x86/cpu: Actually turn off mitigations by default for SPECULATION_MITIGATIONS=n
Gavin Shan <[email protected]>
vhost: Add smp_rmb() in vhost_vq_avail_empty()
Ville Syrjälä <[email protected]>
drm/client: Fully protect modes[] with dev->mode_config.mutex
Boris Burkov <[email protected]>
btrfs: qgroup: correctly model root qgroup rsv in convert
Daisuke Mizobuchi <[email protected]>
mailbox: imx: fix suspend failue
Jacob Pan <[email protected]>
iommu/vt-d: Allocate local memory for page request queue
David Arinzon <[email protected]>
net: ena: Fix incorrect descriptor free behavior
David Arinzon <[email protected]>
net: ena: Wrong missing IO completions check order
David Arinzon <[email protected]>
net: ena: Fix potential sign extension issue
Michal Luczaj <[email protected]>
af_unix: Fix garbage collector racing against connect()
Kuniyuki Iwashima <[email protected]>
af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
Cosmin Ratiu <[email protected]>
net/mlx5: Properly link new fs rules into the tree
Eric Dumazet <[email protected]>
netfilter: complete validation of user input
Luiz Augusto von Dentz <[email protected]>
Bluetooth: SCO: Fix not validating setsockopt user input
Jiri Benc <[email protected]>
ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
Arnd Bergmann <[email protected]>
ipv4/route: avoid unused-but-set-variable warning
Arnd Bergmann <[email protected]>
ipv6: fib: hide unused 'pn' variable
Geetha sowjanya <[email protected]>
octeontx2-af: Fix NIX SQ mode and BP config
Eric Dumazet <[email protected]>
geneve: fix header validation in geneve[6]_xmit_skb
Eric Dumazet <[email protected]>
xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
Petr Tesarik <[email protected]>
u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file
Ilya Maximets <[email protected]>
net: openvswitch: fix unwanted error log on timeout policy probing
Arnd Bergmann <[email protected]>
nouveau: fix function cast warning
Nini Song <[email protected]>
media: cec: core: remove length check of Timer Status
Dmitry Antipov <[email protected]>
Bluetooth: Fix memory leak in hci_req_sync_complete()
Sven Eckelmann <[email protected]>
batman-adv: Avoid infinite loop trying to resize local TT
-------------
Diffstat:
Documentation/ABI/testing/sysfs-class-devfreq | 3 + Makefile | 4 +- arch/Kconfig | 8 ++ arch/arc/boot/dts/hsdk.dts | 1 - arch/arm64/boot/dts/mediatek/mt2712-evb.dts | 8 +- arch/arm64/boot/dts/mediatek/mt2712e.dtsi | 3 +- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 62 ++++++--- arch/arm64/boot/dts/mediatek/mt8183.dtsi | 1 + .../boot/dts/rockchip/rk3399-pinebook-pro.dts | 1 - arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 29 +++- arch/riscv/Kconfig | 8 ++ arch/riscv/Makefile | 10 ++ arch/riscv/include/asm/pgtable.h | 4 +- arch/riscv/include/asm/stackprotector.h | 3 +- arch/riscv/kernel/asm-offsets.c | 3 + arch/riscv/kernel/process.c | 5 +- arch/x86/Kconfig | 11 +- arch/x86/include/asm/apic.h | 3 +- arch/x86/kernel/cpu/cpuid-deps.c | 6 +- crypto/algapi.c | 1 - drivers/accessibility/speakup/main.c | 2 +- drivers/android/binder.c | 4 +- drivers/bluetooth/btusb.c | 2 + drivers/clk/clk.c | 154 ++++++++++++++++----- drivers/devfreq/devfreq.c | 59 +++++--- drivers/dma/idma64.c | 4 + drivers/dma/owl-dma.c | 4 +- drivers/dma/xilinx/xilinx_dpdma.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 72 ++++++---- drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 24 ++-- drivers/gpu/drm/drm_client_modeset.c | 3 +- drivers/gpu/drm/nouveau/nouveau_bios.c | 13 +- .../gpu/drm/nouveau/nvkm/subdev/bios/shadowof.c | 7 +- drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c | 7 +- drivers/gpu/drm/panel/panel-visionox-rm69299.c | 2 - drivers/hid/i2c-hid/i2c-hid-core.c | 8 -- drivers/i2c/i2c-core-base.c | 12 +- drivers/infiniband/core/cm.c | 11 +- drivers/infiniband/hw/mlx5/mad.c | 3 +- drivers/infiniband/sw/rxe/rxe.c | 2 + drivers/iommu/intel/svm.c | 2 +- drivers/irqchip/irq-gic-v3-its.c | 9 +- drivers/mailbox/imx-mailbox.c | 8 +- drivers/media/cec/core/cec-adap.c | 14 -- drivers/misc/mei/pci-me.c | 2 +- drivers/mtd/nand/raw/diskonchip.c | 4 +- drivers/net/ethernet/amazon/ena/ena_com.c | 2 +- drivers/net/ethernet/amazon/ena/ena_netdev.c | 35 +++-- drivers/net/ethernet/broadcom/b44.c | 14 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 6 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 30 +++- .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 22 +-- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 12 +- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 3 +- drivers/net/ethernet/mellanox/mlxsw/core.c | 2 +- .../ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 54 ++++++-- drivers/net/ethernet/ti/am65-cpts.c | 5 + drivers/net/geneve.c | 4 +- drivers/net/gtp.c | 3 +- drivers/net/tun.c | 18 +-- drivers/net/usb/ax88179_178a.c | 11 +- drivers/net/vxlan/vxlan_core.c | 4 + .../net/wireless/intel/iwlwifi/mvm/ftm-initiator.c | 2 + drivers/nfc/trf7970a.c | 42 +++--- drivers/staging/comedi/drivers/vmk80xx.c | 35 ++--- drivers/thunderbolt/switch.c | 50 +++++-- drivers/thunderbolt/tb.c | 4 +- drivers/thunderbolt/tb.h | 3 +- drivers/thunderbolt/usb4.c | 13 +- drivers/tty/serial/mxs-auart.c | 8 +- drivers/tty/serial/pmac_zilog.c | 14 -- drivers/usb/class/cdc-wdm.c | 6 +- drivers/usb/core/port.c | 4 +- drivers/usb/dwc2/hcd_ddma.c | 4 +- drivers/usb/serial/option.c | 40 ++++++ drivers/vhost/vhost.c | 14 +- fs/btrfs/backref.c | 12 +- fs/btrfs/delayed-inode.c | 3 + fs/btrfs/qgroup.c | 2 + fs/nilfs2/dir.c | 2 +- fs/sysfs/file.c | 2 + include/linux/etherdevice.h | 25 ++++ include/linux/irqflags.h | 2 +- include/linux/serial_core.h | 79 +++++++++++ include/linux/trace_events.h | 2 +- include/linux/u64_stats_sync.h | 6 +- include/net/addrconf.h | 4 + include/net/af_unix.h | 5 +- include/net/bluetooth/bluetooth.h | 9 ++ include/net/ip_tunnels.h | 33 +++++ init/main.c | 2 + kernel/bounds.c | 2 +- kernel/cpu.c | 3 +- kernel/kprobes.c | 18 ++- kernel/trace/trace_event_perf.c | 3 +- kernel/trace/trace_events_trigger.c | 6 +- lib/stackdepot.c | 4 +- net/batman-adv/translation-table.c | 2 +- net/bluetooth/hci_request.c | 4 +- net/bluetooth/l2cap_sock.c | 7 +- net/bluetooth/sco.c | 26 ++-- net/ethernet/eth.c | 12 +- net/ipv4/inet_timewait_sock.c | 34 +++-- net/ipv4/netfilter/arp_tables.c | 4 + net/ipv4/netfilter/ip_tables.c | 4 + net/ipv4/route.c | 7 +- net/ipv4/udp.c | 5 +- net/ipv6/addrconf.c | 7 +- net/ipv6/ip6_fib.c | 7 +- net/ipv6/netfilter/ip6_tables.c | 4 + net/ipv6/udp.c | 5 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 6 +- net/netfilter/nf_tables_api.c | 8 +- net/netfilter/nft_chain_filter.c | 4 +- net/netfilter/nft_set_pipapo.c | 14 +- net/openvswitch/conntrack.c | 9 +- net/unix/af_unix.c | 4 +- net/unix/garbage.c | 35 +++-- net/unix/scm.c | 8 +- net/xdp/xsk.c | 2 + .../ftrace/test.d/event/subsystem-enable.tc | 6 +- tools/testing/selftests/timers/posix_timers.c | 2 +- 123 files changed, 1058 insertions(+), 476 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/138 batman-adv: Avoid infinite loop trying to resize local TT
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
commit b1f532a3b1e6d2e5559c7ace49322922637a28aa upstream.
If the MTU of one of an attached interface becomes too small to transmit the local translation table then it must be resized to fit inside all fragments (when enabled) or a single packet.
But if the MTU becomes too low to transmit even the header + the VLAN specific part then the resizing of the local TT will never succeed. This can for example happen when the usable space is 110 bytes and 11 VLANs are on top of batman-adv. In this case, at least 116 byte would be needed. There will just be an endless spam of
batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (110)
in the log but the function will never finish. Problem here is that the timeout will be halved all the time and will then stagnate at 0 and therefore never be able to reduce the table even more.
There are other scenarios possible with a similar result. The number of BATADV_TT_CLIENT_NOPURGE entries in the local TT can for example be too high to fit inside a packet. Such a scenario can therefore happen also with only a single VLAN + 7 non-purgable addresses - requiring at least 120 bytes.
While this should be handled proactively when:
* interface with too low MTU is added
* VLAN is added
* non-purgeable local mac is added
* MTU of an attached interface is reduced
* fragmentation setting gets disabled (which most likely requires dropping attached interfaces)
not all of these scenarios can be prevented because batman-adv is only consuming events without the the possibility to prevent these actions (non-purgable MAC address added, MTU of an attached interface is reduced). It is therefore necessary to also make sure that the code is able to handle also the situations when there were already incompatible system configuration are present.
--- net/batman-adv/translation-table.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/batman-adv/translation-table.c +1 -1
@@ -4188,7 +4188,7 @@ void batadv_tt_local_resize_to_mtu(strucspin_lock_bh (&bat_priv->tt.commit_lock); -while (true) { +while (timeout) { table_size =batadv_tt_local_table_transmit_size (bat_priv);if (packet_size_max >= table_size)break ;
Greg Kroah-Hartman
maintainerPATCH 2/138 Bluetooth: Fix memory leak in hci_req_sync_complete()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
commit 45d355a926ab40f3ae7bc0b0a00cb0e3e8a5a810 upstream.
In 'hci_req_sync_complete()', always free the previous sync request state before assigning reference to a new one.
--- net/bluetooth/hci_request.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/bluetooth/hci_request.c +3 -1
@@ -107,8 +107,10 @@ static void hci_req_sync_complete(structif (hdev->req_status ==HCI_REQ_PEND ) { hdev->req_result = result; hdev->req_status =HCI_REQ_DONE ; -if (skb) +if (skb) { +kfree_skb (hdev->req_skb); hdev->req_skb =skb_get (skb); + }wake_up_interruptible (&hdev->req_wait_q); } }
Greg Kroah-Hartman
maintainerPATCH 3/138 media: cec: core: remove length check of Timer Status
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nini Song <[email protected]>
commit ce5d241c3ad4568c12842168288993234345c0eb upstream.
The valid_la is used to check the length requirements, including special cases of Timer Status. If the length is shorter than 5, that means no Duration Available is returned, the message will be forced to be invalid.
However, the description of Duration Available in the spec is that this parameter may be returned when these cases, or that it can be optionally return when these cases. The key words in the spec description are flexible choices.
Remove the special length check of Timer Status to fit the spec which is not compulsory about that.
--- drivers/media/cec/core/cec-adap.c | 14 -------------- 1 file changed, 14 deletions(-)
drivers/media/cec/core/cec-adap.c +0 -14
@@ -1116,20 +1116,6 @@ void cec_received_msg_ts(struct cec_adapif (valid_la && min_len) {/* These messages have special length requirements */ switch (cmd) { -case CEC_MSG_TIMER_STATUS : -if (msg->msg[2 ] &0x10 ) { -switch (msg->msg[2 ] &0xf ) { -case CEC_OP_PROG_INFO_NOT_ENOUGH_SPACE : -case CEC_OP_PROG_INFO_MIGHT_NOT_BE_ENOUGH_SPACE : -if (msg->len <5 ) - valid_la = false; -break ; - } - }else if ((msg->msg[2 ] &0xf ) ==CEC_OP_PROG_ERROR_DUPLICATE ) { -if (msg->len <5 ) - valid_la = false; - } -break ;case CEC_MSG_RECORD_ON :switch (msg->msg[2 ]) {case CEC_OP_RECORD_SRC_OWN :
Greg Kroah-Hartman
maintainerPATCH 4/138 nouveau: fix function cast warning
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 185fdb4697cc9684a02f2fab0530ecdd0c2f15d4 ]
Calling a function through an incompatible pointer type causes breaks kcfi, so clang warns about the assignment:
drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowof.c:73:10: error: cast from 'void (*)(const void *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
73 | .fini = (void(*)(void *))kfree,
Avoid this with a trivial wrapper.
--- drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowof.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowof.c +6 -1
@@ -66,11 +66,16 @@ of_init(struct nvkm_bios *bios, const char *name)return ERR_PTR (-EINVAL ); } +static void of_fini (void *p) +{ +kfree (p); +} +const struct nvbios_source nvbios_of = { .name ="OpenFirmware" , .init = of_init, - .fini = (void (*)(void *))kfree, + .fini = of_fini, .read = of_read, .size = of_size, .rw = false,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/138 net: openvswitch: fix unwanted error log on timeout policy probing
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Maximets <[email protected]>
[ Upstream commit 4539f91f2a801c0c028c252bffae56030cfb2cae ]
On startup, ovs-vswitchd probes different datapath features including support for timeout policies. While probing, it tries to execute certain operations with OVS_PACKET_ATTR_PROBE or OVS_FLOW_ATTR_PROBE attributes set. These attributes tell the openvswitch module to not log any errors when they occur as it is expected that some of the probes will fail.
For some reason, setting the timeout policy ignores the PROBE attribute and logs a failure anyway. This is causing the following kernel log on each re-start of ovs-vswitchd:
kernel: Failed to associated timeout policy `ovs_test_tp'
Fix that by using the same logging macro that all other messages are using. The message will still be printed at info level when needed and will be rate limited, but with a net rate limiter instead of generic printk one.
The nf_ct_set_timeout() itself will still print some info messages, but at least this change makes logging in openvswitch module more consistent.
--- net/openvswitch/conntrack.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/openvswitch/conntrack.c +3 -2
@@ -1692,8 +1692,9 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,if (ct_info.timeout[0 ]) {if (nf_ct_set_timeout (net, ct_info.ct, family, key->ip.proto, ct_info.timeout)) -pr_info_ratelimited ("Failed to associated timeout " -"policy `%s'\n" , ct_info.timeout); +OVS_NLERR (log, +"Failed to associated timeout policy '%s'" , + ct_info.timeout);else ct_info.nf_ct_timeout =rcu_dereference (nf_ct_timeout_find (ct_info.ct)->timeout);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/138 u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Tesarik <[email protected]>
[ Upstream commit 38a15d0a50e0a43778561a5861403851f0b0194c ]
Fix bogus lockdep warnings if multiple u64_stats_sync variables are initialized in the same file.
With CONFIG_LOCKDEP, seqcount_init() is a macro which declares:
static struct lock_class_key __key;
Since u64_stats_init() is a function (albeit an inline one), all calls within the same file end up using the same instance, effectively treating them all as a single lock-class.
--- include/linux/u64_stats_sync.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
include/linux/u64_stats_sync.h +5 -1
@@ -116,7 +116,11 @@ static inline void u64_stats_inc(u64_sta#endif #if BITS_PER_LONG ==32 && defined(CONFIG_SMP ) -#define u64_stats_init (syncp) seqcount_init(&(syncp)->seq) +#define u64_stats_init (syncp) \ + do { \ + struct u64_stats_sync *__s = (syncp); \ + seqcount_init(&__s->seq); \ + } while (0)#else static inline void u64_stats_init (struct u64_stats_sync *syncp) {
Greg Kroah-Hartman
maintainerPATCH 7/138 xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 237f3cf13b20db183d3706d997eedc3c49eacd44 ]
syzbot reported an illegal copy in xsk_setsockopt() [1]
Make sure to validate setsockopt() @optlen parameter.
[1]
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420 Read of size 4 at addr ffff888028c6cde3 by task syz-executor.0/7549 CPU: 0 PID: 7549 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] copy_from_sockptr include/linux/sockptr.h:55 [inline] xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420 do_sock_setsockopt+0x3af/0x720 net/socket.c:2311 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7fb40587de69 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb40665a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007fb4059abf80 RCX: 00007fb40587de69 RDX: 0000000000000005 RSI: 000000000000011b RDI: 0000000000000006 RBP: 00007fb4058ca47a R08: 0000000000000002 R09: 0000000000000000 R10: 0000000020001980 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fb4059abf80 R15: 00007fff57ee4d08 </TASK> Allocated by task 7549: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:3966 [inline] __kmalloc+0x233/0x4a0 mm/slub.c:3979 kmalloc include/linux/slab.h:632 [inline] __cgroup_bpf_run_filter_setsockopt+0xd2f/0x1040 kernel/bpf/cgroup.c:1869 do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 The buggy address belongs to the object at ffff888028c6cde0 which belongs to the cache kmalloc-8 of size 8
The buggy address is located 1 bytes to the right of
allocated 2-byte region [ffff888028c6cde0, ffff888028c6cde2)
The buggy address belongs to the physical page:
page:ffffea0000a31b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888028c6c9c0 pfn:0x28c6c
anon flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000800 ffff888014c41280 0000000000000000 dead000000000001
raw: ffff888028c6c9c0 0000000080800057 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 6648, tgid 6644 (syz-executor.0), ts 133906047828, free_ts 133859922223
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533
prep_new_page mm/page_alloc.c:1540 [inline]
get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311
__alloc_pages+0x256/0x680 mm/page_alloc.c:4569
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page+0x5f/0x160 mm/slub.c:2175
allocate_slab mm/slub.c:2338 [inline]
new_slab+0x84/0x2f0 mm/slub.c:2391
___slab_alloc+0xc73/0x1260 mm/slub.c:3525
__slab_alloc mm/slub.c:3610 [inline]
__slab_alloc_node mm/slub.c:3663 [inline]
slab_alloc_node mm/slub.c:3835 [inline]
__do_kmalloc_node mm/slub.c:3965 [inline]
__kmalloc_node+0x2db/0x4e0 mm/slub.c:3973
kmalloc_node include/linux/slab.h:648 [inline]
__vmalloc_area_node mm/vmalloc.c:3197 [inline]
__vmalloc_node_range+0x5f9/0x14a0 mm/vmalloc.c:3392
__vmalloc_node mm/vmalloc.c:3457 [inline]
vzalloc+0x79/0x90 mm/vmalloc.c:3530
bpf_check+0x260/0x19010 kernel/bpf/verifier.c:21162
bpf_prog_load+0x1667/0x20f0 kernel/bpf/syscall.c:2895
__sys_bpf+0x4ee/0x810 kernel/bpf/syscall.c:5631
__do_sys_bpf kernel/bpf/syscall.c:5738 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5736 [inline]
__x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736
do_syscall_64+0xfb/0x240
entry_SYSCALL_64_after_hwframe+0x6d/0x75
page last free pid 6650 tgid 6647 stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1140 [inline]
free_unref_page_prepare+0x95d/0xa80 mm/page_alloc.c:2346
free_unref_page_list+0x5a3/0x850 mm/page_alloc.c:2532
release_pages+0x2117/0x2400 mm/swap.c:1042
tlb_batch_pages_flush mm/mmu_gather.c:98 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:293 [inline]
tlb_flush_mmu+0x34d/0x4e0 mm/mmu_gather.c:300
tlb_finish_mmu+0xd4/0x200 mm/mmu_gather.c:392
exit_mmap+0x4b6/0xd40 mm/mmap.c:3300
__mmput+0x115/0x3c0 kernel/fork.c:1345
exit_mm+0x220/0x310 kernel/exit.c:569
do_exit+0x99e/0x27e0 kernel/exit.c:865
do_group_exit+0x207/0x2c0 kernel/exit.c:1027
get_signal+0x176e/0x1850 kernel/signal.c:2907
arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop kernel/entry/common.c:105 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:201 [inline]
syscall_exit_to_user_mode+0xc9/0x360 kernel/entry/common.c:212
do_syscall_64+0x10a/0x240 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x6d/0x75
Memory state around the buggy address:
ffff888028c6cc80: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
ffff888028c6cd00: fa fc fc fc fa fc fc fc 00 fc fc fc 06 fc fc fc
>ffff888028c6cd80: fa fc fc fc fa fc fc fc fa fc fc fc 02 fc fc fc
^
ffff888028c6ce00: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
ffff888028c6ce80: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc--- net/xdp/xsk.c | 2 ++ 1 file changed, 2 insertions(+)
net/xdp/xsk.c +2 -0
@@ -895,6 +895,8 @@ static int xsk_setsockopt(struct socket *sock, int level, int optname,struct xsk_queue **q;int entries; +if (optlen <sizeof (entries)) +return -EINVAL ;if (copy_from_sockptr (&entries, optval,sizeof (entries)))return -EFAULT ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/138 geneve: fix header validation in geneve[6]_xmit_skb
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit d8a6213d70accb403b82924a1c229e733433a5ef ]
syzbot is able to trigger an uninit-value in geneve_xmit() [1]
Problem : While most ip tunnel helpers (like ip_tunnel_get_dsfield()) uses skb_protocol(skb, true), pskb_inet_may_pull() is only using skb->protocol.
If anything else than ETH_P_IPV6 or ETH_P_IP is found in skb->protocol, pskb_inet_may_pull() does nothing at all.
If a vlan tag was provided by the caller (af_packet in the syzbot case), the network header might not point to the correct location, and skb linear part could be smaller than expected.
Add skb_vlan_inet_prepare() to perform a complete mac validation.
Use this in geneve for the moment, I suspect we need to adopt this more broadly.
v4 - Jakub reported v3 broke l2_tos_ttl_inherit.sh selftest
- Only call __vlan_get_protocol() for vlan types.
v2,v3 - Addressed Sabrina comments on v1 and v2
[1]
BUG: KMSAN: uninit-value in geneve_xmit_skb drivers/net/geneve.c:910 [inline] BUG: KMSAN: uninit-value in geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030 geneve_xmit_skb drivers/net/geneve.c:910 [inline] geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030 __netdev_start_xmit include/linux/netdevice.h:4903 [inline] netdev_start_xmit include/linux/netdevice.h:4917 [inline] xmit_one net/core/dev.c:3531 [inline] dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547 __dev_queue_xmit+0x348d/0x52c0 net/core/dev.c:4335 dev_queue_xmit include/linux/netdevice.h:3091 [inline] packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x8bb0/0x9ef0 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3804 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577 __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1318 [inline] alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795 packet_alloc_skb net/packet/af_packet.c:2930 [inline] packet_snd net/packet/af_packet.c:3024 [inline] packet_sendmsg+0x722d/0x9ef0 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 CPU: 0 PID: 5033 Comm: syz-executor346 Not tainted 6.9.0-rc1-syzkaller-00005-g928a87efa423 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
--- drivers/net/geneve.c | 4 ++-- include/net/ip_tunnels.h | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+), 2 deletions(-)
drivers/net/geneve.c +2 -2
@@ -907,7 +907,7 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be16 sport;int err; -if (!pskb_inet_may_pull (skb)) +if (!skb_vlan_inet_prepare (skb))return -EINVAL ; sport =udp_flow_src_port (geneve->net, skb,1 ,USHRT_MAX , true);
@@ -1004,7 +1004,7 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be16 sport;int err; -if (!pskb_inet_may_pull (skb)) +if (!skb_vlan_inet_prepare (skb))return -EINVAL ; sport =udp_flow_src_port (geneve->net, skb,1 ,USHRT_MAX , true);
include/net/ip_tunnels.h +33 -0
@@ -333,6 +333,39 @@ static inline bool pskb_inet_may_pull(struct sk_buff *skb)return pskb_network_may_pull (skb, nhlen); } +/* Variant of pskb_inet_may_pull(). +*/ +static inline bool skb_vlan_inet_prepare (struct sk_buff *skb) +{ +int nhlen =0 , maclen =ETH_HLEN ; +__be16 type = skb->protocol; + +/* Essentially this is skb_protocol(skb, true) +* And we get MAC len. +*/ +if (eth_type_vlan (type)) + type =__vlan_get_protocol (skb, type, &maclen); + +switch (type) { +#if IS_ENABLED (CONFIG_IPV6 ) +case htons (ETH_P_IPV6 ): + nhlen =sizeof (struct ipv6hdr ); +break ; +#endif +case htons (ETH_P_IP ): + nhlen =sizeof (struct iphdr ); +break ; + } +/* For ETH_P_IPV6/ETH_P_IP we make sure to pull +* a base network header in skb->head. +*/ +if (!pskb_may_pull (skb, maclen + nhlen)) +return false; + +skb_set_network_header (skb, maclen); +return true; +} +static inline int ip_encap_hlen (struct ip_tunnel_encap *e) {const struct ip_tunnel_encap_ops *ops;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/138 octeontx2-af: Fix NIX SQ mode and BP config
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geetha sowjanya <[email protected]>
[ Upstream commit faf23006185e777db18912685922c5ddb2df383f ]
NIX SQ mode and link backpressure configuration is required for all platforms. But in current driver this code is wrongly placed under specific platform check. This patch fixes the issue by moving the code out of platform check.
--- .../ethernet/marvell/octeontx2/af/rvu_nix.c | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +10 -10
@@ -3146,18 +3146,18 @@ int rvu_nix_init(struct rvu *rvu)*/ rvu_write64 (rvu, blkaddr,NIX_AF_CFG ,rvu_read64 (rvu, blkaddr,NIX_AF_CFG ) |0x40ULL ); + } -/* Set chan/link to backpressure TL3 instead of TL2 */ -rvu_write64 (rvu, blkaddr,NIX_AF_PSE_CHANNEL_LEVEL ,0x01 ); +/* Set chan/link to backpressure TL3 instead of TL2 */ +rvu_write64 (rvu, blkaddr,NIX_AF_PSE_CHANNEL_LEVEL ,0x01 ); -/* Disable SQ manager's sticky mode operation (set TM6 = 0) -* This sticky mode is known to cause SQ stalls when multiple -* SQs are mapped to same SMQ and transmitting pkts at a time. -*/ - cfg =rvu_read64 (rvu, blkaddr,NIX_AF_SQM_DBG_CTL_STATUS ); - cfg &= ~BIT_ULL (15 ); -rvu_write64 (rvu, blkaddr,NIX_AF_SQM_DBG_CTL_STATUS , cfg); - } +/* Disable SQ manager's sticky mode operation (set TM6 = 0) +* This sticky mode is known to cause SQ stalls when multiple +* SQs are mapped to same SMQ and transmitting pkts at a time. +*/ + cfg =rvu_read64 (rvu, blkaddr,NIX_AF_SQM_DBG_CTL_STATUS ); + cfg &= ~BIT_ULL (15 ); +rvu_write64 (rvu, blkaddr,NIX_AF_SQM_DBG_CTL_STATUS , cfg); ltdefs = rvu->kpu.lt_def;/* Calibrate X2P bus to check if CGX/LBK links are fine */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/138 ipv6: fib: hide unused pn variable
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 74043489fcb5e5ca4074133582b5b8011b67f9e7 ]
When CONFIG_IPV6_SUBTREES is disabled, the only user is hidden, causing a 'make W=1' warning:
net/ipv6/ip6_fib.c: In function 'fib6_add':net/ipv6/ip6_fib.c:1388:32: error: variable 'pn' set but not used [-Werror=unused-but-set-variable]
Add another #ifdef around the variable declaration, matching the other uses in this file.
--- net/ipv6/ip6_fib.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/ipv6/ip6_fib.c +5 -2
@@ -1373,7 +1373,10 @@ int fib6_add(struct fib6_node *root, struct fib6_info *rt, struct nl_info *info, struct netlink_ext_ack *extack) { struct fib6_table *table = rt->fib6_table; -struct fib6_node *fn, *pn =NULL ; +struct fib6_node *fn; +#ifdef CONFIG_IPV6_SUBTREES +struct fib6_node *pn =NULL ; +#endif int err = -ENOMEM ;int allow_create =1 ;int replace_required =0 ;
@@ -1397,9 +1400,9 @@ int fib6_add(struct fib6_node *root, struct fib6_info *rt, goto out; } +#ifdef CONFIG_IPV6_SUBTREES pn = fn; -#ifdef CONFIG_IPV6_SUBTREES if (rt->fib6_src.plen) {struct fib6_node *sn;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/138 ipv4/route: avoid unused-but-set-variable warning
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit cf1b7201df59fb936f40f4a807433fe3f2ce310a ]
The log_martians variable is only used in an #ifdef, causing a 'make W=1' warning with gcc:
net/ipv4/route.c: In function 'ip_rt_send_redirect':net/ipv4/route.c:880:13: error: variable 'log_martians' set but not used [-Werror=unused-but-set-variable]
Change the #ifdef to an equivalent IS_ENABLED() to let the compiler see where the variable is used.
--- net/ipv4/route.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
net/ipv4/route.c +1 -3
@@ -955,13 +955,11 @@ void ip_rt_send_redirect(struct sk_buff *skb)icmp_send (skb,ICMP_REDIRECT ,ICMP_REDIR_HOST , gw); peer->rate_last = jiffies; ++peer->n_redirects; -#ifdef CONFIG_IP_ROUTE_VERBOSE -if (log_martians && +if (IS_ENABLED (CONFIG_IP_ROUTE_VERBOSE ) && log_martians && peer->n_redirects == ip_rt_redirect_number)net_warn_ratelimited ("host %pI4/if%d ignores redirects for %pI4 to %pI4\n" , &ip_hdr (skb)->saddr,inet_iif (skb), &ip_hdr (skb)->daddr, &gw); -#endif } out_put_peer:inet_putpeer (peer);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/138 ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Benc <[email protected]>
[ Upstream commit 7633c4da919ad51164acbf1aa322cc1a3ead6129 ]
Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an item that got removed from the list. The memory itself of such item is not freed thanks to RCU but nothing guarantees the actual content of the memory is sane.
In particular, the reference count can be zero. This can happen if ipv6_del_addr is called in parallel. ipv6_del_addr removes the entry from inet6_addr_lst (hlist_del_init_rcu(&ifp->addr_lst)) and drops all references (__in6_ifa_put(ifp) + in6_ifa_put(ifp)). With bad enough timing, this can happen:
1. In ipv6_get_ifaddr, hlist_for_each_entry_rcu returns an entry.
2. Then, the whole ipv6_del_addr is executed for the given entry. The reference count drops to zero and kfree_rcu is scheduled.
3. ipv6_get_ifaddr continues and tries to increments the reference count (in6_ifa_hold).
4. The rcu is unlocked and the entry is freed.
5. The freed entry is returned.
Prevent increasing of the reference count in such case. The name in6_ifa_hold_safe is chosen to mimic the existing fib6_info_hold_safe.
[ 41.506330] refcount_t: addition on 0; use-after-free. [ 41.506760] WARNING: CPU: 0 PID: 595 at lib/refcount.c:25 refcount_warn_saturate+0xa5/0x130 [ 41.507413] Modules linked in: veth bridge stp llc [ 41.507821] CPU: 0 PID: 595 Comm: python3 Not tainted 6.9.0-rc2.main-00208-g49563be82afa #14 [ 41.508479] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) [ 41.509163] RIP: 0010:refcount_warn_saturate+0xa5/0x130 [ 41.509586] Code: ad ff 90 0f 0b 90 90 c3 cc cc cc cc 80 3d c0 30 ad 01 00 75 a0 c6 05 b7 30 ad 01 01 90 48 c7 c7 38 cc 7a 8c e8 cc 18 ad ff 90 <0f> 0b 90 90 c3 cc cc cc cc 80 3d 98 30 ad 01 00 0f 85 75 ff ff ff [ 41.510956] RSP: 0018:ffffbda3c026baf0 EFLAGS: 00010282 [ 41.511368] RAX: 0000000000000000 RBX: ffff9e9c46914800 RCX: 0000000000000000 [ 41.511910] RDX: ffff9e9c7ec29c00 RSI: ffff9e9c7ec1c900 RDI: ffff9e9c7ec1c900 [ 41.512445] RBP: ffff9e9c43660c9c R08: 0000000000009ffb R09: 00000000ffffdfff [ 41.512998] R10: 00000000ffffdfff R11: ffffffff8ca58a40 R12: ffff9e9c4339a000 [ 41.513534] R13: 0000000000000001 R14: ffff9e9c438a0000 R15: ffffbda3c026bb48 [ 41.514086] FS: 00007fbc4cda1740(0000) GS:ffff9e9c7ec00000(0000) knlGS:0000000000000000 [ 41.514726] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.515176] CR2: 000056233b337d88 CR3: 000000000376e006 CR4: 0000000000370ef0 [ 41.515713] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.516252] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.516799] Call Trace: [ 41.517037] <TASK> [ 41.517249] ? __warn+0x7b/0x120 [ 41.517535] ? refcount_warn_saturate+0xa5/0x130 [ 41.517923] ? report_bug+0x164/0x190 [ 41.518240] ? handle_bug+0x3d/0x70 [ 41.518541] ? exc_invalid_op+0x17/0x70 [ 41.520972] ? asm_exc_invalid_op+0x1a/0x20 [ 41.521325] ? refcount_warn_saturate+0xa5/0x130 [ 41.521708] ipv6_get_ifaddr+0xda/0xe0 [ 41.522035] inet6_rtm_getaddr+0x342/0x3f0 [ 41.522376] ? __pfx_inet6_rtm_getaddr+0x10/0x10 [ 41.522758] rtnetlink_rcv_msg+0x334/0x3d0 [ 41.523102] ? netlink_unicast+0x30f/0x390 [ 41.523445] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 41.523832] netlink_rcv_skb+0x53/0x100 [ 41.524157] netlink_unicast+0x23b/0x390 [ 41.524484] netlink_sendmsg+0x1f2/0x440 [ 41.524826] __sys_sendto+0x1d8/0x1f0 [ 41.525145] __x64_sys_sendto+0x1f/0x30 [ 41.525467] do_syscall_64+0xa5/0x1b0 [ 41.525794] entry_SYSCALL_64_after_hwframe+0x72/0x7a [ 41.526213] RIP: 0033:0x7fbc4cfcea9a [ 41.526528] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 [ 41.527942] RSP: 002b:00007ffcf54012a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 41.528593] RAX: ffffffffffffffda RBX: 00007ffcf5401368 RCX: 00007fbc4cfcea9a [ 41.529173] RDX: 000000000000002c RSI: 00007fbc4b9d9bd0 RDI: 0000000000000005 [ 41.529786] RBP: 00007fbc4bafb040 R08: 00007ffcf54013e0 R09: 000000000000000c [ 41.530375] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 41.530977] R13: ffffffffc4653600 R14: 0000000000000001 R15: 00007fbc4ca85d1b [ 41.531573] </TASK>
--- include/net/addrconf.h | 4 ++++ net/ipv6/addrconf.c | 7 ++++--- 2 files changed, 8 insertions(+), 3 deletions(-)
include/net/addrconf.h +4 -0
@@ -437,6 +437,10 @@ static inline void in6_ifa_hold(struct inet6_ifaddr *ifp)refcount_inc (&ifp->refcnt); } +static inline bool in6_ifa_hold_safe (struct inet6_ifaddr *ifp) +{ +return refcount_inc_not_zero (&ifp->refcnt); +}/* * compute link-local solicited-node multicast address
net/ipv6/addrconf.c +4 -3
@@ -2044,9 +2044,10 @@ struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *addif (ipv6_addr_equal (&ifp->addr, addr)) {if (!dev || ifp->idev->dev == dev || !(ifp->scope&(IFA_LINK |IFA_HOST ) || strict)) { - result = ifp; -in6_ifa_hold (ifp); -break ; +if (in6_ifa_hold_safe (ifp)) { + result = ifp; +break ; + } } } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/138 Bluetooth: SCO: Fix not validating setsockopt user input
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 51eda36d33e43201e7a4fd35232e069b2c850b01 ]
syzbot reported sco_sock_setsockopt() is copying data without checking user input length.
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90 net/bluetooth/sco.c:893 Read of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578
--- include/net/bluetooth/bluetooth.h | 9 +++++++++ net/bluetooth/sco.c | 19 ++++++++----------- 2 files changed, 17 insertions(+), 11 deletions(-)
include/net/bluetooth/bluetooth.h +9 -0
@@ -487,6 +487,15 @@ static inline struct sk_buff *bt_skb_senreturn skb; } +static inline int bt_copy_from_sockptr (void *dst,size_t dst_size, +sockptr_t src,size_t src_size) +{ +if (dst_size > src_size) +return -EINVAL ; + +return copy_from_sockptr (dst, src, dst_size); +} +int bt_to_errno (u16 code);void hci_sock_set_flag (struct sock *sk,int nr);
net/bluetooth/sco.c +8 -11
@@ -825,7 +825,7 @@ static int sco_sock_setsockopt(struct so sockptr_t optval, unsigned int optlen) {struct sock *sk = sock->sk; -int len, err =0 ; +int err =0 ;struct bt_voice voice;u32 opt;
@@ -841,10 +841,9 @@ static int sco_sock_setsockopt(struct sobreak ; } -if (copy_from_sockptr (&opt, optval,sizeof (u32))) { - err = -EFAULT ; + err =bt_copy_from_sockptr (&opt,sizeof (opt), optval, optlen); +if (err)break ; - }if (opt)set_bit (BT_SK_DEFER_SETUP , &bt_sk (sk)->flags);
@@ -861,11 +860,10 @@ static int sco_sock_setsockopt(struct so voice.setting =sco_pi (sk)->setting; - len = min_t(unsigned int, sizeof(voice), optlen); -if (copy_from_sockptr (&voice, optval, len)) { - err = -EFAULT ; + err =bt_copy_from_sockptr (&voice,sizeof (voice), optval, + optlen); +if (err)break ; - }/* Explicitly check for these values */ if (voice.setting != BT_VOICE_TRANSPARENT &&
@@ -878,10 +876,9 @@ static int sco_sock_setsockopt(struct sobreak ;case BT_PKT_STATUS : -if (copy_from_sockptr (&opt, optval,sizeof (u32))) { - err = -EFAULT ; + err =bt_copy_from_sockptr (&opt,sizeof (opt), optval, optlen); +if (err)break ; - }if (opt)sco_pi (sk)->cmsg_mask |=SCO_CMSG_PKT_STATUS ;
Greg Kroah-Hartman
maintainerPATCH 14/138 netfilter: complete validation of user input
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 65acf6e0501ac8880a4f73980d01b5d27648b956 ]
In my recent commit, I missed that do_replace() handlers use copy_from_sockptr() (which I fixed), followed by unsafe copy_from_sockptr_offset() calls.
In all functions, we can perform the @optlen validation before even calling xt_alloc_table_info() with the following check:
if ((u64)optlen < (u64)tmp.size + sizeof(tmp))
return -EINVAL;
--- net/ipv4/netfilter/arp_tables.c | 4 ++++ net/ipv4/netfilter/ip_tables.c | 4 ++++ net/ipv6/netfilter/ip6_tables.c | 4 ++++ 3 files changed, 12 insertions(+)
net/ipv4/netfilter/arp_tables.c +4 -0
@@ -965,6 +965,8 @@ static int do_replace(struct net *net, sockptr_t arg, unsigned int len)return -ENOMEM ;if (tmp.num_counters ==0 )return -EINVAL ; +if ((u64 )len < (u64 )tmp.size +sizeof (tmp)) +return -EINVAL ; tmp.name[sizeof (tmp.name)-1 ] =0 ;
@@ -1265,6 +1267,8 @@ static int compat_do_replace(struct net *net, sockptr_t arg, unsigned int len)return -ENOMEM ;if (tmp.num_counters ==0 )return -EINVAL ; +if ((u64 )len < (u64 )tmp.size +sizeof (tmp)) +return -EINVAL ; tmp.name[sizeof (tmp.name)-1 ] =0 ;
net/ipv4/netfilter/ip_tables.c +4 -0
@@ -1119,6 +1119,8 @@ do_replace(struct net *net, sockptr_t arg, unsigned int len)return -ENOMEM ;if (tmp.num_counters ==0 )return -EINVAL ; +if ((u64 )len < (u64 )tmp.size +sizeof (tmp)) +return -EINVAL ; tmp.name[sizeof (tmp.name)-1 ] =0 ;
@@ -1505,6 +1507,8 @@ compat_do_replace(struct net *net, sockptr_t arg, unsigned int len)return -ENOMEM ;if (tmp.num_counters ==0 )return -EINVAL ; +if ((u64 )len < (u64 )tmp.size +sizeof (tmp)) +return -EINVAL ; tmp.name[sizeof (tmp.name)-1 ] =0 ;
net/ipv6/netfilter/ip6_tables.c +4 -0
@@ -1137,6 +1137,8 @@ do_replace(struct net *net, sockptr_t arg, unsigned int len)return -ENOMEM ;if (tmp.num_counters ==0 )return -EINVAL ; +if ((u64 )len < (u64 )tmp.size +sizeof (tmp)) +return -EINVAL ; tmp.name[sizeof (tmp.name)-1 ] =0 ;
@@ -1515,6 +1517,8 @@ compat_do_replace(struct net *net, sockptr_t arg, unsigned int len)return -ENOMEM ;if (tmp.num_counters ==0 )return -EINVAL ; +if ((u64 )len < (u64 )tmp.size +sizeof (tmp)) +return -EINVAL ; tmp.name[sizeof (tmp.name)-1 ] =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/138 net/mlx5: Properly link new fs rules into the tree
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Ratiu <[email protected]>
[ Upstream commit 7c6782ad4911cbee874e85630226ed389ff2e453 ]
Previously, add_rule_fg would only add newly created rules from the handle into the tree when they had a refcount of 1. On the other hand, create_flow_handle tries hard to find and reference already existing identical rules instead of creating new ones.
These two behaviors can result in a situation where create_flow_handle
1) creates a new rule and references it, then
2) in a subsequent step during the same handle creation references it again,
resulting in a rule with a refcount of 2 that is not linked into the tree, will have a NULL parent and root and will result in a crash when the flow group is deleted because del_sw_hw_rule, invoked on rule deletion, assumes node->parent is != NULL.
This happened in the wild, due to another bug related to incorrect handling of duplicate pkt_reformat ids, which lead to the code in create_flow_handle incorrectly referencing a just-added rule in the same flow handle, resulting in the problem described above. Full details are at [1].
This patch changes add_rule_fg to add new rules without parents into the tree, properly initializing them and avoiding the crash. This makes it more consistent with how rules are added to an FTE in create_flow_handle.
--- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +2 -1
@@ -1675,8 +1675,9 @@ static struct mlx5_flow_handle *add_rule_fg(struct mlx5_flow_group *fg, }trace_mlx5_fs_set_fte (fte, false); +/* Link newly added rules into the tree. */ for (i =0 ; i < handle->num_rules; i++) { -if (refcount_read (&handle->rule[i]->node.refcount) ==1 ) { +if (!handle->rule[i]->node.parent) {tree_add_node (&handle->rule[i]->node, &fte->node);trace_mlx5_fs_add_rule (handle->rule[i]); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/138 af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 97af84a6bba2ab2b9c704c08e67de3b5ea551bb2 ]
When touching unix_sk(sk)->inflight, we are always under spin_lock(&unix_gc_lock).
Let's convert unix_sk(sk)->inflight to the normal unsigned long.
Stable-dep-of: 47d8ac011fe1 ("af_unix: Fix garbage collector racing against connect()")
--- include/net/af_unix.h | 2 +- net/unix/af_unix.c | 4 ++-- net/unix/garbage.c | 17 ++++++++--------- net/unix/scm.c | 8 +++++--- 4 files changed, 16 insertions(+), 15 deletions(-)
include/net/af_unix.h +1 -1
@@ -56,7 +56,7 @@ struct unix_sock {struct mutex iolock, bindlock;struct sock *peer;struct list_head link; -atomic_long_t inflight; +unsigned long inflight;spinlock_t lock;unsigned long gc_flags;#define UNIX_GC_CANDIDATE 0
net/unix/af_unix.c +2 -2
@@ -817,11 +817,11 @@ static struct sock *unix_create1(struct net *net, struct socket *sock, int kern) sk->sk_write_space = unix_write_space; sk->sk_max_ack_backlog = net->unx.sysctl_max_dgram_qlen; sk->sk_destruct = unix_sock_destructor; - u =unix_sk (sk); + u =unix_sk (sk); + u->inflight =0 ; u->path.dentry =NULL ; u->path.mnt =NULL ;spin_lock_init (&u->lock); -atomic_long_set (&u->inflight,0 );INIT_LIST_HEAD (&u->link);mutex_init (&u->iolock);/* single task reading lock */ mutex_init (&u->bindlock);/* single task binding lock */
net/unix/garbage.c +8 -9
@@ -166,17 +166,18 @@ static void scan_children(struct sock *x, void (*func)(struct unix_sock *),static void dec_inflight (struct unix_sock *usk) { -atomic_long_dec (&usk->inflight); + usk->inflight--; }static void inc_inflight (struct unix_sock *usk) { -atomic_long_inc (&usk->inflight); + usk->inflight++; }static void inc_inflight_move_tail (struct unix_sock *u) { -atomic_long_inc (&u->inflight); + u->inflight++; +/* If this still might be part of a cycle, move it to the end * of the list, so that it's checked even if it was already * passed over
@@ -237,14 +238,12 @@ void unix_gc(void)*/ list_for_each_entry_safe (u, next, &gc_inflight_list, link) {long total_refs; -long inflight_refs; total_refs =file_count (u->sk.sk_socket->file); - inflight_refs =atomic_long_read (&u->inflight); -BUG_ON (inflight_refs <1 ); -BUG_ON (total_refs < inflight_refs); -if (total_refs == inflight_refs) { +BUG_ON (!u->inflight); +BUG_ON (total_refs < u->inflight); +if (total_refs == u->inflight) {list_move_tail (&u->link, &gc_candidates);__set_bit (UNIX_GC_CANDIDATE , &u->gc_flags);__set_bit (UNIX_GC_MAYBE_CYCLE , &u->gc_flags);
@@ -271,7 +270,7 @@ void unix_gc(void)/* Move cursor to after the current position. */ list_move (&cursor, &u->link); -if (atomic_long_read (&u->inflight) >0 ) { +if (u->inflight) {list_move_tail (&u->link, ¬_cycle_list);__clear_bit (UNIX_GC_MAYBE_CYCLE , &u->gc_flags);scan_children (&u->sk, inc_inflight_move_tail,NULL );
net/unix/scm.c +5 -3
@@ -52,12 +52,13 @@ void unix_inflight(struct user_struct *user, struct file *fp)if (s) {struct unix_sock *u =unix_sk (s); -if (atomic_long_inc_return (&u->inflight) ==1 ) { +if (!u->inflight) {BUG_ON (!list_empty (&u->link));list_add_tail (&u->link, &gc_inflight_list); }else {BUG_ON (list_empty (&u->link)); } + u->inflight++;/* Paired with READ_ONCE() in wait_for_unix_gc() */ WRITE_ONCE (unix_tot_inflight, unix_tot_inflight +1 ); }
@@ -74,10 +75,11 @@ void unix_notinflight(struct user_struct *user, struct file *fp)if (s) {struct unix_sock *u =unix_sk (s); -BUG_ON (!atomic_long_read (&u->inflight)); +BUG_ON (!u->inflight);BUG_ON (list_empty (&u->link)); -if (atomic_long_dec_and_test (&u->inflight)) + u->inflight--; +if (!u->inflight)list_del_init (&u->link);/* Paired with READ_ONCE() in wait_for_unix_gc() */ WRITE_ONCE (unix_tot_inflight, unix_tot_inflight -1 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/138 af_unix: Fix garbage collector racing against connect()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit 47d8ac011fe1c9251070e1bd64cb10b48193ec51 ]
Garbage collector does not take into account the risk of embryo getting enqueued during the garbage collection. If such embryo has a peer that carries SCM_RIGHTS, two consecutive passes of scan_children() may see a different set of children. Leading to an incorrectly elevated inflight count, and then a dangling pointer within the gc_inflight_list.
sockets are AF_UNIX/SOCK_STREAM
S is an unconnected socket
L is a listening in-flight socket bound to addr, not in fdtable V's fd will be passed via sendmsg(), gets inflight count bumped
connect(S, addr) sendmsg(S, [V]); close(V) __unix_gc()
---------------- ------------------------- -----------
NS = unix_create1()
skb1 = sock_wmalloc(NS)
L = unix_find_other(addr)unix_state_lock(L)unix_peer(S) = NS
// V count=1 inflight=0
NS = unix_peer(S)
skb2 = sock_alloc()
skb_queue_tail(NS, skb2[V])
// V became in-flight
// V count=2 inflight=1
close(V)
// V count=1 inflight=1
// GC candidate condition met
for u in gc_inflight_list:
if (total_refs == inflight_refs)
add u to gc_candidates
// gc_candidates={L, V}
for u in gc_candidates:
scan_children(u, dec_inflight)
// embryo (skb1) was not
// reachable from L yet, so V's
// inflight remains unchanged
__skb_queue_tail(L, skb1)
unix_state_unlock(L)
for u in gc_candidates:
if (u.inflight)
scan_children(u, inc_inflight_move_tail)
// V count=1 inflight=2 (!)If there is a GC-candidate listening socket, lock/unlock its state. This makes GC wait until the end of any ongoing connect() to that socket. After flipping the lock, a possibly SCM-laden embryo is already enqueued. And if there is another embryo coming, it can not possibly carry SCM_RIGHTS. At this point, unix_inflight() can not happen because unix_gc_lock is already taken. Inflight graph remains unaffected.
--- net/unix/garbage.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
net/unix/garbage.c +17 -1
@@ -235,11 +235,22 @@ void unix_gc(void)* receive queues. Other, non candidate sockets _can_ be * added to queue, so we must make sure only to touch * candidates. +* +* Embryos, though never candidates themselves, affect which +* candidates are reachable by the garbage collector. Before +* being added to a listener's queue, an embryo may already +* receive data carrying SCM_RIGHTS, potentially making the +* passed socket a candidate that is not yet reachable by the +* collector. It becomes reachable once the embryo is +* enqueued. Therefore, we must ensure that no SCM-laden +* embryo appears in a (candidate) listener's queue between +* consecutive scan_children() calls. */ list_for_each_entry_safe (u, next, &gc_inflight_list, link) { +struct sock *sk = &u->sk;long total_refs; - total_refs =file_count (u->sk.sk_socket->file); + total_refs =file_count (sk->sk_socket->file);BUG_ON (!u->inflight);BUG_ON (total_refs < u->inflight);
@@ -247,6 +258,11 @@ void unix_gc(void)list_move_tail (&u->link, &gc_candidates);__set_bit (UNIX_GC_CANDIDATE , &u->gc_flags);__set_bit (UNIX_GC_MAYBE_CYCLE , &u->gc_flags); + +if (sk->sk_state ==TCP_LISTEN ) { +unix_state_lock (sk); +unix_state_unlock (sk); + } } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/138 net: ena: Fix potential sign extension issue
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Arinzon <[email protected]>
[ Upstream commit 713a85195aad25d8a26786a37b674e3e5ec09e3c ]
Small unsigned types are promoted to larger signed types in the case of multiplication, the result of which may overflow. In case the result of such a multiplication has its MSB turned on, it will be sign extended with '1's.
This changes the multiplication result.
Code example of the phenomenon:
-------------------------------
u16 x, y;size_t z1, z2;
x = y = 0xffff;printk("x=%x y=%x\n",x,y);
z1 = x*y;
z2 = (size_t)x*y;
printk("z1=%lx z2=%lx\n", z1, z2);
Output:
-------
x=ffff y=ffff
z1=fffffffffffe0001 z2=fffe0001
The expected result of ffff*ffff is fffe0001, and without the explicit casting to avoid the unwanted sign extension we got fffffffffffe0001.
This commit adds an explicit casting to avoid the sign extension issue.
--- drivers/net/ethernet/amazon/ena/ena_com.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/amazon/ena/ena_com.c +1 -1
@@ -352,7 +352,7 @@ static int ena_com_init_io_sq(struct ena_com_dev *ena_dev,ENA_COM_BOUNCE_BUFFER_CNTRL_CNT ; io_sq->bounce_buf_ctrl.next_to_use =0 ; - size = io_sq->bounce_buf_ctrl.buffer_size * + size = (size_t )io_sq->bounce_buf_ctrl.buffer_size * io_sq->bounce_buf_ctrl.buffers_num; dev_node =dev_to_node (ena_dev->dmadev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/138 net: ena: Wrong missing IO completions check order
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Arinzon <[email protected]>
[ Upstream commit f7e417180665234fdb7af2ebe33d89aaa434d16f ]
Missing IO completions check is called every second (HZ jiffies). This commit fixes several issues with this check:
1. Duplicate queues check:
Max of 4 queues are scanned on each check due to monitor budget. Once reaching the budget, this check exits under the assumption that the next check will continue to scan the remainder of the queues, but in practice, next check will first scan the last already scanned queue which is not necessary and may cause the full queue scan to last a couple of seconds longer.
The fix is to start every check with the next queue to scan. For example, on 8 IO queues:
Bug: [0,1,2,3], [3,4,5,6], [6,7]
Fix: [0,1,2,3], [4,5,6,7]
2. Unbalanced queues check:
In case the number of active IO queues is not a multiple of budget, there will be checks which don't utilize the full budget because the full scan exits when reaching the last queue id. The fix is to run every TX completion check with exact queue budget regardless of the queue id.
For example, on 7 IO queues:
Bug: [0,1,2,3], [4,5,6], [0,1,2,3]
Fix: [0,1,2,3], [4,5,6,0], [1,2,3,4]
The budget may be lowered in case the number of IO queues is less than the budget (4) to make sure there are no duplicate queues on the same check.
For example, on 3 IO queues:
Bug: [0,1,2,0], [1,2,0,1]
Fix: [0,1,2], [0,1,2]
--- drivers/net/ethernet/amazon/ena/ena_netdev.c | 21 +++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)
drivers/net/ethernet/amazon/ena/ena_netdev.c +12 -9
@@ -3672,10 +3672,11 @@ static void check_for_missing_completions(struct ena_adapter *adapter) {struct ena_ring *tx_ring;struct ena_ring *rx_ring; -int i, budget, rc; +int qid, budget, rc;int io_queue_count; io_queue_count = adapter->xdp_num_queues + adapter->num_io_queues; +/* Make sure the driver doesn't turn the device in other process */ smp_rmb ();
@@ -3688,27 +3689,29 @@ static void check_for_missing_completions(struct ena_adapter *adapter)if (adapter->missing_tx_completion_to ==ENA_HW_HINTS_NO_TIMEOUT )return ; - budget =ENA_MONITORED_TX_QUEUES ; + budget =min_t (u32, io_queue_count,ENA_MONITORED_TX_QUEUES ); -for (i = adapter->last_monitored_tx_qid; i < io_queue_count; i++) { - tx_ring = &adapter->tx_ring[i]; - rx_ring = &adapter->rx_ring[i]; + qid = adapter->last_monitored_tx_qid; + +while (budget) { + qid = (qid +1 ) % io_queue_count; + + tx_ring = &adapter->tx_ring[qid]; + rx_ring = &adapter->rx_ring[qid]; rc =check_missing_comp_in_tx_queue (adapter, tx_ring);if (unlikely (rc))return ; - rc = !ENA_IS_XDP_INDEX (adapter, i) ? + rc = !ENA_IS_XDP_INDEX (adapter, qid) ?check_for_rx_interrupt_queue (adapter, rx_ring) :0 ;if (unlikely (rc))return ; budget--; -if (!budget) -break ; } - adapter->last_monitored_tx_qid = i % io_queue_count; + adapter->last_monitored_tx_qid = qid; }/* trigger napi schedule after 2 consecutive detections */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/138 net: ena: Fix incorrect descriptor free behavior
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Arinzon <[email protected]>
[ Upstream commit bf02d9fe00632d22fa91d34749c7aacf397b6cde ]
ENA has two types of TX queues:
- queues which only process TX packets arriving from the network stack
- queues which only process TX packets forwarded to it by XDP_REDIRECT or XDP_TX instructions
The ena_free_tx_bufs() cycles through all descriptors in a TX queue and unmaps + frees every descriptor that hasn't been acknowledged yet by the device (uncompleted TX transactions).
The function assumes that the processed TX queue is necessarily from the first category listed above and ends up using napi_consume_skb() for descriptors belonging to an XDP specific queue.
This patch solves a bug in which, in case of a VF reset, the descriptors aren't freed correctly, leading to crashes.
--- drivers/net/ethernet/amazon/ena/ena_netdev.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/net/ethernet/amazon/ena/ena_netdev.c +11 -3
@@ -1105,8 +1105,11 @@ static void ena_unmap_tx_buff(struct ena_ring *tx_ring,static void ena_free_tx_bufs (struct ena_ring *tx_ring) {bool print_once = true; +bool is_xdp_ring;u32 i; + is_xdp_ring =ENA_IS_XDP_INDEX (tx_ring->adapter, tx_ring->qid); +for (i =0 ; i < tx_ring->ring_size; i++) {struct ena_tx_buffer *tx_info = &tx_ring->tx_buffer_info[i];
@@ -1126,10 +1129,15 @@ static void ena_free_tx_bufs(struct ena_ring *tx_ring)ena_unmap_tx_buff (tx_ring, tx_info); -dev_kfree_skb_any (tx_info->skb); +if (is_xdp_ring) +xdp_return_frame (tx_info->xdpf); +else +dev_kfree_skb_any (tx_info->skb); } -netdev_tx_reset_queue (netdev_get_tx_queue (tx_ring->netdev, - tx_ring->qid)); + +if (!is_xdp_ring) +netdev_tx_reset_queue (netdev_get_tx_queue (tx_ring->netdev, + tx_ring->qid)); }static void ena_free_all_tx_bufs (struct ena_adapter *adapter)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/138 iommu/vt-d: Allocate local memory for page request queue
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Pan <[email protected]>
[ Upstream commit a34f3e20ddff02c4f12df2c0635367394e64c63d ]
The page request queue is per IOMMU, its allocation should be made NUMA-aware for performance reasons.
--- drivers/iommu/intel/svm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/intel/svm.c +1 -1
@@ -33,7 +33,7 @@ int intel_svm_enable_prq(struct intel_iommu *iommu)struct page *pages;int irq, ret; - pages =alloc_pages (GFP_KERNEL | __GFP_ZERO,PRQ_ORDER ); + pages =alloc_pages_node (iommu->node,GFP_KERNEL | __GFP_ZERO,PRQ_ORDER );if (!pages) {pr_warn ("IOMMU: %s: Failed to allocate page request queue\n" , iommu->name);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/138 mailbox: imx: fix suspend failue
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daisuke Mizobuchi <[email protected]>
imx_mu_isr() always calls pm_system_wakeup() even when it should not, making the system unable to enter sleep.
Suspend fails as follows:
armadillo:~# echo mem > /sys/power/state [ 2614.602432] PM: suspend entry (deep) [ 2614.610640] Filesystems sync: 0.004 seconds [ 2614.618016] Freezing user space processes ... (elapsed 0.001 seconds) done. [ 2614.626555] OOM killer disabled. [ 2614.629792] Freezing remaining freezable tasks ... (elapsed 0.001 seconds) done. [ 2614.638456] printk: Suspending console(s) (use no_console_suspend to debug) [ 2614.649504] PM: Some devices failed to suspend, or early wake event detected [ 2614.730103] PM: resume devices took 0.080 seconds [ 2614.741924] OOM killer enabled. [ 2614.745073] Restarting tasks ... done. [ 2614.754532] PM: suspend exit ash: write error: Resource busy armadillo:~#
Upstream commit 892cb524ae8a is correct, so this seems to be a mistake during cherry-pick.
--- drivers/mailbox/imx-mailbox.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/mailbox/imx-mailbox.c +4 -4
@@ -331,8 +331,6 @@ static int imx_mu_startup(struct mbox_chbreak ; } - priv->suspend = true; -return 0 ; }
@@ -550,8 +548,6 @@ static int imx_mu_probe(struct platform_clk_disable_unprepare (priv->clk); - priv->suspend = false; -return 0 ; disable_runtime_pm:
@@ -614,6 +610,8 @@ static int __maybe_unused imx_mu_suspendif (!priv->clk) priv->xcr =imx_mu_read (priv, priv->dcfg->xCR); + priv->suspend = true; +return 0 ; }
@@ -632,6 +630,8 @@ static int __maybe_unused imx_mu_resume_if (!imx_mu_read (priv, priv->dcfg->xCR) && !priv->clk)imx_mu_write (priv, priv->xcr, priv->dcfg->xCR); + priv->suspend = false; +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 23/138 btrfs: qgroup: correctly model root qgroup rsv in convert
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
commit 141fb8cd206ace23c02cd2791c6da52c1d77d42a upstream.
We use add_root_meta_rsv and sub_root_meta_rsv to track prealloc and pertrans reservations for subvolumes when quotas are enabled. The convert function does not properly increment pertrans after decrementing prealloc, so the count is not accurate.
Note: we check that the fs is not read-only to mirror the logic in qgroup_convert_meta, which checks that before adding to the pertrans rsv.
--- fs/btrfs/qgroup.c | 2 ++ 1 file changed, 2 insertions(+)
fs/btrfs/qgroup.c +2 -0
@@ -4114,6 +4114,8 @@ void btrfs_qgroup_convert_reserved_meta( BTRFS_QGROUP_RSV_META_PREALLOC);trace_qgroup_meta_convert (root, num_bytes);qgroup_convert_meta (fs_info, root->root_key.objectid, num_bytes); +if (!sb_rdonly (fs_info->sb)) +add_root_meta_rsv (root, num_bytes,BTRFS_QGROUP_RSV_META_PERTRANS ); }/*
Greg Kroah-Hartman
maintainerPATCH 24/138 drm/client: Fully protect modes[] with dev->mode_config.mutex
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <[email protected]>
commit 3eadd887dbac1df8f25f701e5d404d1b90fd0fea upstream.
The modes[] array contains pointers to modes on the connectors' mode lists, which are protected by dev->mode_config.mutex. Thus we need to extend modes[] the same protection or by the time we use it the elements may already be pointing to freed/reused memory.
--- drivers/gpu/drm/drm_client_modeset.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/drm_client_modeset.c +2 -1
@@ -774,6 +774,7 @@ int drm_client_modeset_probe(struct drm_unsigned int total_modes_count =0 ;struct drm_client_offset *offsets;unsigned int connector_count =0 ; +/* points to modes protected by mode_config.mutex */ struct drm_display_mode **modes;struct drm_crtc **crtcs;int i, ret =0 ;
@@ -842,7 +843,6 @@ int drm_client_modeset_probe(struct drm_drm_client_pick_crtcs (client, connectors, connector_count, crtcs, modes,0 , width, height); } -mutex_unlock (&dev->mode_config.mutex);drm_client_modeset_release (client);
@@ -872,6 +872,7 @@ int drm_client_modeset_probe(struct drm_ modeset->y = offset->y; } } +mutex_unlock (&dev->mode_config.mutex);mutex_unlock (&client->modeset_mutex); out:
Greg Kroah-Hartman
maintainerPATCH 25/138 vhost: Add smp_rmb() in vhost_vq_avail_empty()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gavin Shan <[email protected]>
commit 22e1992cf7b034db5325660e98c41ca5afa5f519 upstream.
A smp_rmb() has been missed in vhost_vq_avail_empty(), spotted by Will. Otherwise, it's not ensured the available ring entries pushed by guest can be observed by vhost in time, leading to stale available ring entries fetched by vhost in vhost_get_vq_desc(), as reported by Yihuang Yu on NVidia's grace-hopper (ARM64) platform.
/home/gavin/sandbox/qemu.main/build/qemu-system-aarch64 \ -accel kvm -machine virt,gic-version=host -cpu host \ -smp maxcpus=1,cpus=1,sockets=1,clusters=1,cores=1,threads=1 \ -m 4096M,slots=16,maxmem=64G \ -object memory-backend-ram,id=mem0,size=4096M \ : \ -netdev tap,id=vnet0,vhost=true \ -device virtio-net-pci,bus=pcie.8,netdev=vnet0,mac=52:54:00:f1:26:b0 : guest# netperf -H 10.26.1.81 -l 60 -C -c -t UDP_STREAM virtio_net virtio0: output.0:id 100 is not a head!
Add the missed smp_rmb() in vhost_vq_avail_empty(). When tx_can_batch() returns true, it means there's still pending tx buffers. Since it might read indices, so it still can bypass the smp_rmb() in vhost_get_vq_desc(). Note that it should be safe until vq->avail_idx is changed by commit 275bf960ac697 ("vhost: better detection of available buffers").
Message-Id: <[email protected]>
--- drivers/vhost/vhost.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/vhost/vhost.c +11 -1
@@ -2513,9 +2513,19 @@ bool vhost_vq_avail_empty(struct vhost_d r =vhost_get_avail_idx (vq, &avail_idx);if (unlikely (r))return false; + vq->avail_idx =vhost16_to_cpu (vq, avail_idx); +if (vq->avail_idx != vq->last_avail_idx) { +/* Since we have updated avail_idx, the following +* call to vhost_get_vq_desc() will read available +* ring entries. Make sure that read happens after +* the avail_idx read. +*/ +smp_rmb (); +return false; + } -return vq->avail_idx == vq->last_avail_idx; +return true; }EXPORT_SYMBOL_GPL (vhost_vq_avail_empty);
Greg Kroah-Hartman
maintainerPATCH 26/138 x86/cpu: Actually turn off mitigations by default for SPECULATION_MITIGATIONS=n
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit f337a6a21e2fd67eadea471e93d05dd37baaa9be upstream.
Initialize cpu_mitigations to CPU_MITIGATIONS_OFF if the kernel is built with CONFIG_SPECULATION_MITIGATIONS=n, as the help text quite clearly states that disabling SPECULATION_MITIGATIONS is supposed to turn off all mitigations by default.
│ If you say N, all mitigations will be disabled. You really │ should know what you are doing to say so.
As is, the kernel still defaults to CPU_MITIGATIONS_AUTO, which results in some mitigations being enabled in spite of SPECULATION_MITIGATIONS=n.
--- kernel/cpu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/cpu.c +2 -1
@@ -2600,7 +2600,8 @@ enum cpu_mitigations { };static enum cpu_mitigations cpu_mitigations__ro_after_init = -CPU_MITIGATIONS_AUTO ; +IS_ENABLED (CONFIG_SPECULATION_MITIGATIONS ) ?CPU_MITIGATIONS_AUTO : +CPU_MITIGATIONS_OFF ;static int __init mitigations_parse_cmdline (char *arg) {
Greg Kroah-Hartman
maintainerPATCH 27/138 selftests: timers: Fix abs() warning in posix_timers test
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Stultz <[email protected]>
commit ed366de8ec89d4f960d66c85fc37d9de22f7bf6d upstream.
Building with clang results in the following warning:
posix_timers.c:69:6: warning: absolute value function 'abs' given an
argument of type 'long long' but has parameter of type 'int' which may cause truncation of value [-Wabsolute-value]
if (abs(diff - DELAY * USECS_PER_SEC) > USECS_PER_SEC / 2) {
^
So switch to using llabs() instead.
--- tools/testing/selftests/timers/posix_timers.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/timers/posix_timers.c +1 -1
@@ -66,7 +66,7 @@ static int check_diff(struct timeval sta diff = end.tv_usec - start.tv_usec; diff += (end.tv_sec - start.tv_sec) *USECS_PER_SEC ; -if (abs (diff -DELAY *USECS_PER_SEC ) >USECS_PER_SEC /2 ) { +if (llabs (diff -DELAY *USECS_PER_SEC ) >USECS_PER_SEC /2 ) {printf ("Diff too high: %lld.." , diff);return -1 ; }
Greg Kroah-Hartman
maintainerPATCH 28/138 x86/apic: Force native_apic_mem_read() to use the MOV instruction
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Dunlap <[email protected]>
commit 5ce344beaca688f4cdea07045e0b8f03dc537e74 upstream.
When done from a virtual machine, instructions that touch APIC memory must be emulated. By convention, MMIO accesses are typically performed via io.h helpers such as readl() or writeq() to simplify instruction emulation/decoding (ex: in KVM hosts and SEV guests) [0].
Currently, native_apic_mem_read() does not follow this convention, allowing the compiler to emit instructions other than the MOV instruction generated by readl(). In particular, when the kernel is compiled with clang and run as a SEV-ES or SEV-SNP guest, the compiler would emit a TESTL instruction which is not supported by the SEV-ES emulator, causing a boot failure in that environment. It is likely the same problem would happen in a TDX guest as that uses the same instruction emulator as SEV-ES.
To make sure all emulators can emulate APIC memory reads via MOV, use the readl() function in native_apic_mem_read(). It is expected that any emulator would support MOV in any addressing mode as it is the most generic and is what is usually emitted currently.
The TESTL instruction is emitted when native_apic_mem_read() is inlined into apic_mem_wait_icr_idle(). The emulator comes from insn_decode_mmio() in arch/x86/lib/insn-eval.c. It's not worth it to extend insn_decode_mmio() to support more instructions since, in theory, the compiler could choose to output nearly any instruction for such reads which would bloat the emulator beyond reason.
[0] https://lore.kernel.org/all/[email protected]/
[ bp: Massage commit message, fix typos. ]
--- arch/x86/include/asm/apic.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/include/asm/apic.h +2 -1
@@ -12,6 +12,7 @@#include <asm/mpspec.h> #include <asm/msr.h> #include <asm/hardirq.h> +#include <asm/io.h> #define ARCH_APICTIMER_STOPS_ON_C3 1
@@ -111,7 +112,7 @@ static inline void native_apic_mem_writestatic inline u32 native_apic_mem_read (u32 reg) { -return *((volatile u32 *)(APIC_BASE + reg)); +return readl ((void __iomem *)(APIC_BASE + reg)); }extern void native_apic_wait_icr_idle (void );
Greg Kroah-Hartman
maintainerPATCH 29/138 irqflags: Explicitly ignore lockdep_hrtimer_exit() argument
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit c1d11fc2c8320871b40730991071dd0a0b405bc8 upstream.
When building with 'make W=1' but CONFIG_TRACE_IRQFLAGS=n, the unused argument to lockdep_hrtimer_exit() causes a warning:
kernel/time/hrtimer.c:1655:14: error: variable 'expires_in_hardirq' set but not used [-Werror=unused-but-set-variable]
This is intentional behavior, so add a cast to void to shut up the warning.
--- include/linux/irqflags.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/irqflags.h +1 -1
@@ -133,7 +133,7 @@ do { \# define lockdep_softirq_enter () do { } while (0)# define lockdep_softirq_exit () do { } while (0)# define lockdep_hrtimer_enter (__hrtimer) false -# define lockdep_hrtimer_exit (__context) do { } while (0) +# define lockdep_hrtimer_exit (__context) do { (void)(__context); } while (0)# define lockdep_posixtimer_enter () do { } while (0)# define lockdep_posixtimer_exit () do { } while (0)# define lockdep_irq_work_enter (__work) do { } while (0)
Greg Kroah-Hartman
maintainerPATCH 30/138 btrfs: record delayed inode root in transaction
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
[ Upstream commit 71537e35c324ea6fbd68377a4f26bb93a831ae35 ]
When running delayed inode updates, we do not record the inode's root in the transaction, but we do allocate PREALLOC and thus converted PERTRANS space for it. To be sure we free that PERTRANS meta rsv, we must ensure that we record the root in the transaction.
--- fs/btrfs/delayed-inode.c | 3 +++ 1 file changed, 3 insertions(+)
fs/btrfs/delayed-inode.c +3 -0
@@ -1135,6 +1135,9 @@ __btrfs_commit_inode_delayed_items(struct btrfs_trans_handle *trans,if (ret)return ret; + ret =btrfs_record_root_in_trans (trans, node->root); +if (ret) +return ret; ret =btrfs_update_delayed_inode (trans, node->root, path, node);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/138 riscv: Enable per-task stack canaries
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guo Ren <[email protected]>
[ Upstream commit fea2fed201ee5647699018a56fbb6a5e8cc053a5 ]
This enables the use of per-task stack canary values if GCC has support for emitting the stack canary reference relative to the value of tp, which holds the task struct pointer in the riscv kernel.
After compare arm64 and x86 implementations, seems arm64's is more flexible and readable. The key point is how gcc get the offset of stack_canary from gs/el0_sp.
x86: Use a fix offset from gs, not flexible.
struct fixed_percpu_data {
/*
* GCC hardcodes the stack canary as %gs:40. Since the
* irq_stack is the object at %gs:0, we reserve the bottom
* 48 bytes of the irq stack for the canary.
*/
char gs_base[40]; // :(
unsigned long stack_canary;
};arm64: Use -mstack-protector-guard-offset & guard-reg
gcc options:
-mstack-protector-guard=sysreg -mstack-protector-guard-reg=sp_el0 -mstack-protector-guard-offset=xxx
riscv: Use -mstack-protector-guard-offset & guard-reg
gcc options:
-mstack-protector-guard=tls -mstack-protector-guard-reg=tp -mstack-protector-guard-offset=xxx
GCC's implementation has been merged:
commit c931e8d5a96463427040b0d11f9c4352ac22b2b0
Author: Cooper Qu <[email protected]>
Date: Mon Jul 13 16:15:08 2020 +0800
RISC-V: Add support for TLS stack protector canary access
In the end, these codes are inserted by gcc before return:
* 0xffffffe00020b396 <+120>: ld a5,1008(tp) # 0x3f0 * 0xffffffe00020b39a <+124>: xor a5,a5,a4 * 0xffffffe00020b39c <+126>: mv a0,s5 * 0xffffffe00020b39e <+128>: bnez a5,0xffffffe00020b61c <_do_fork+766> 0xffffffe00020b3a2 <+132>: ld ra,136(sp) 0xffffffe00020b3a4 <+134>: ld s0,128(sp) 0xffffffe00020b3a6 <+136>: ld s1,120(sp) 0xffffffe00020b3a8 <+138>: ld s2,112(sp) 0xffffffe00020b3aa <+140>: ld s3,104(sp) 0xffffffe00020b3ac <+142>: ld s4,96(sp) 0xffffffe00020b3ae <+144>: ld s5,88(sp) 0xffffffe00020b3b0 <+146>: ld s6,80(sp) 0xffffffe00020b3b2 <+148>: ld s7,72(sp) 0xffffffe00020b3b4 <+150>: addi sp,sp,144 0xffffffe00020b3b6 <+152>: ret ... * 0xffffffe00020b61c <+766>: auipc ra,0x7f8 * 0xffffffe00020b620 <+770>: jalr -1764(ra) # 0xffffffe000a02f38 <__stack_chk_fail>
Stable-dep-of: d14fa1fcf69d ("riscv: process: Fix kernel gp leakage")
--- arch/riscv/Kconfig | 7 +++++++ arch/riscv/Makefile | 10 ++++++++++ arch/riscv/include/asm/stackprotector.h | 3 ++- arch/riscv/kernel/asm-offsets.c | 3 +++ arch/riscv/kernel/process.c | 2 +- 5 files changed, 23 insertions(+), 2 deletions(-)
arch/riscv/Kconfig +7 -0
@@ -445,6 +445,13 @@ config EFI allow the kernel to be booted as an EFI application. This is only useful on systems that have UEFI firmware. +config CC_HAVE_STACKPROTECTOR_TLS + def_bool $(cc-option,-mstack-protector-guard=tls -mstack-protector-guard-reg=tp -mstack-protector-guard-offset=0) + +config STACKPROTECTOR_PER_TASK + def_bool y + depends on STACKPROTECTOR && CC_HAVE_STACKPROTECTOR_TLS + endmenu config BUILTIN_DTB
arch/riscv/Makefile +10 -0
@@ -88,6 +88,16 @@ KBUILD_AFLAGS_MODULE += $(call as-option,-Wa$(comma)-mno-relax) # architectures. It's faster to have GCC emit only aligned accesses. KBUILD_CFLAGS += $(call cc-option,-mstrict-align) +ifeq ($(CONFIG_STACKPROTECTOR_PER_TASK),y) +prepare: stack_protector_prepare +stack_protector_prepare: prepare0 + $(eval KBUILD_CFLAGS += -mstack-protector-guard=tls \ + -mstack-protector-guard-reg=tp \ + -mstack-protector-guard-offset=$(shell \ + awk '{if ($$2 == "TSK_STACK_CANARY") print $$3;}' \ + include/generated/asm-offsets.h)) +endif + # arch specific predefines for sparse CHECKFLAGS += -D__riscv -D__riscv_xlen=$(BITS)
arch/riscv/include/asm/stackprotector.h +2 -1
@@ -24,6 +24,7 @@ static __always_inline void boot_init_stack_canary(void) canary &=CANARY_MASK ; current->stack_canary = canary; - __stack_chk_guard = current->stack_canary; +if (!IS_ENABLED (CONFIG_STACKPROTECTOR_PER_TASK )) + __stack_chk_guard = current->stack_canary; }#endif /* _ASM_RISCV_STACKPROTECTOR_H */
arch/riscv/kernel/asm-offsets.c +3 -0
@@ -66,6 +66,9 @@ void asm_offsets(void)OFFSET (TASK_THREAD_F30 , task_struct, thread.fstate.f[30 ]);OFFSET (TASK_THREAD_F31 , task_struct, thread.fstate.f[31 ]);OFFSET (TASK_THREAD_FCSR , task_struct, thread.fstate.fcsr); +#ifdef CONFIG_STACKPROTECTOR +OFFSET (TSK_STACK_CANARY , task_struct, stack_canary); +#endif DEFINE (PT_SIZE ,sizeof (struct pt_regs ));OFFSET (PT_EPC , pt_regs, epc);
arch/riscv/kernel/process.c +1 -1
@@ -24,7 +24,7 @@ registerunsigned long gp_in_global __asm__("gp" ); -#ifdef CONFIG_STACKPROTECTOR +#if defined(CONFIG_STACKPROTECTOR ) && !defined(CONFIG_STACKPROTECTOR_PER_TASK )#include <linux/stackprotector.h> unsigned long __stack_chk_guard__read_mostly ;EXPORT_SYMBOL (__stack_chk_guard);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/138 riscv: process: Fix kernel gp leakage
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan O'Rear <[email protected]>
[ Upstream commit d14fa1fcf69db9d070e75f1c4425211fa619dfc8 ]
childregs represents the registers which are active for the new thread in user context. For a kernel thread, childregs->gp is never used since the kernel gp is not touched by switch_to. For a user mode helper, the gp value can be observed in user space after execve or possibly by other means.
[From the email thread]
The /* Kernel thread */ comment is somewhat inaccurate in that it is also used for user_mode_helper threads, which exec a user process, e.g. /sbin/init or when /proc/sys/kernel/core_pattern is a pipe. Such threads do not have PF_KTHREAD set and are valid targets for ptrace etc. even before they exec.
childregs is the *user* context during syscall execution and it is observable from userspace in at least five ways:
1. kernel_execve does not currently clear integer registers, so the starting register state for PID 1 and other user processes started by the kernel has sp = user stack, gp = kernel __global_pointer$, all other integer registers zeroed by the memset in the patch comment.
This is a bug in its own right, but I'm unwilling to bet that it is the only way to exploit the issue addressed by this patch.
2. ptrace(PTRACE_GETREGSET): you can PTRACE_ATTACH to a user_mode_helper thread before it execs, but ptrace requires SIGSTOP to be delivered which can only happen at user/kernel boundaries.
3. /proc/*/task/*/syscall: this is perfectly happy to read pt_regs for user_mode_helpers before the exec completes, but gp is not one of the registers it returns.
4. PERF_SAMPLE_REGS_USER: LOCKDOWN_PERF normally prevents access to kernel addresses via PERF_SAMPLE_REGS_INTR, but due to this bug kernel addresses are also exposed via PERF_SAMPLE_REGS_USER which is permitted under LOCKDOWN_PERF. I have not attempted to write exploit code.
5. Much of the tracing infrastructure allows access to user registers. I have not attempted to determine which forms of tracing allow access to user registers without already allowing access to kernel registers.
--- arch/riscv/kernel/process.c | 3 --- 1 file changed, 3 deletions(-)
arch/riscv/kernel/process.c +0 -3
@@ -22,8 +22,6 @@#include <asm/switch_to.h> #include <asm/thread_info.h> -registerunsigned long gp_in_global __asm__("gp" ); -#if defined(CONFIG_STACKPROTECTOR ) && !defined(CONFIG_STACKPROTECTOR_PER_TASK )#include <linux/stackprotector.h> unsigned long __stack_chk_guard__read_mostly ;
@@ -117,7 +115,6 @@ int copy_thread(unsigned long clone_flags, unsigned long usp, unsigned long arg,if (unlikely (p->flags & (PF_KTHREAD |PF_IO_WORKER ))) {/* Kernel thread */ memset (childregs,0 ,sizeof (struct pt_regs )); - childregs->gp = gp_in_global;/* Supervisor/Machine, irqs on: */ childregs->status =SR_PP |SR_PIE ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/138 selftests/ftrace: Limit length in subsystem-enable tests
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanhe Shu <[email protected]>
commit 1a4ea83a6e67f1415a1f17c1af5e9c814c882bb5 upstream.
While sched* events being traced and sched* events continuously happen, "[xx] event tracing - enable/disable with subsystem level files" would not stop as on some slower systems it seems to take forever. Select the first 100 lines of output would be enough to judge whether there are more than 3 types of sched events.
--- tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc +3 -3
@@ -18,7 +18,7 @@ echo 'sched:*' > set_event yield -count=`cat trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` +count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` if [ $count -lt 3 ]; then fail "at least fork, exec and exit events should be recorded" fi
@@ -29,7 +29,7 @@ echo 1 > events/sched/enable yield -count=`cat trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` +count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` if [ $count -lt 3 ]; then fail "at least fork, exec and exit events should be recorded" fi
@@ -40,7 +40,7 @@ echo 0 > events/sched/enable yield -count=`cat trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` +count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` if [ $count -ne 0 ]; then fail "any of scheduler events should not be recorded" fi
Greg Kroah-Hartman
maintainerPATCH 34/138 kprobes: Fix possible use-after-free issue on kprobe registration
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
commit 325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8 upstream.
When unloading a module, its state is changing MODULE_STATE_LIVE ->
MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take
a time. is_module_text_address() and __module_text_address() works with MODULE_STATE_LIVE and MODULE_STATE_GOING.
If we use is_module_text_address() and __module_text_address() separately, there is a chance that the first one is succeeded but the next one is failed because module->state becomes MODULE_STATE_UNFORMED between those operations.
In check_kprobe_address_safe(), if the second __module_text_address() is failed, that is ignored because it expected a kernel_text address. But it may have failed simply because module->state has been changed to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify non-exist module text address (use-after-free).
To fix this problem, we should not use separated is_module_text_address() and __module_text_address(), but use only __module_text_address() once and do try_module_get(module) which is only available with MODULE_STATE_LIVE.
[Fix conflict due to lack dependency
commit 223a76b268c9 ("kprobes: Fix coding style issues")]
--- kernel/kprobes.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
kernel/kprobes.c +12 -6
@@ -1647,10 +1647,17 @@ static int check_kprobe_address_safe(strjump_label_lock ();preempt_disable (); -/* Ensure it is not in reserved area nor out of text */ - if (!(core_kernel_text((unsigned long) p->addr) || - is_module_text_address((unsigned long) p->addr)) || - in_gate_area_no_mm((unsigned long) p->addr) || +/* Ensure the address is in a text area, and find a module if exists. */ + *probed_mod =NULL ; +if (!core_kernel_text ((unsigned long ) p->addr)) { + *probed_mod =__module_text_address ((unsigned long ) p->addr); +if (!(*probed_mod)) { + ret = -EINVAL ; + goto out; + } + } +/* Ensure it is not in reserved area. */ + if (in_gate_area_no_mm((unsigned long) p->addr) || within_kprobe_blacklist((unsigned long) p->addr) || jump_label_text_reserved(p->addr, p->addr) || static_call_text_reserved(p->addr, p->addr) ||
@@ -1660,8 +1667,7 @@ static int check_kprobe_address_safe(str goto out; } -/* Check if are we probing a module */ - *probed_mod =__module_text_address ((unsigned long ) p->addr); +/* Get module refcount and reject __init functions for loaded modules. */ if (*probed_mod) {/* * We must hold a refcount of the probed module while updating
Greg Kroah-Hartman
maintainerPATCH 35/138 Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddh Raman Pant <[email protected]>
This reverts commit 56cfbe60710772916a5ba092c99542332b48e870 which is commit 0958b33ef5a04ed91f61cef4760ac412080c4e08 upstream.
The change has an incorrect assumption about the return value because
in the current stable trees for versions 5.15 and before, the following commit responsible for making 0 a success value is not present:b8cc44a4d3c1 ("tracing: Remove logic for registering multiple event triggers at a time")
The return value should be 0 on failure in the current tree, because in the functions event_trigger_callback() and event_enable_trigger_func(), we have:
ret = cmd_ops->reg(glob, trigger_ops, trigger_data, file);
/*
* The above returns on success the # of functions enabled,
* but if it didn't find any functions it returns zero.
* Consider no functions a failure too.
*/
if (!ret) {
ret = -ENOENT;--- kernel/trace/trace_events_trigger.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
kernel/trace/trace_events_trigger.c +2 -4
@@ -1140,10 +1140,8 @@ register_snapshot_trigger(char *glob, st struct event_trigger_data *data, struct trace_event_file *file) { - int ret = tracing_alloc_snapshot_instance(file->tr); - -if (ret <0 ) -return ret; + if (tracing_alloc_snapshot_instance(file->tr) != 0) + return 0; return register_trigger(glob, ops, data, file); }
Greg Kroah-Hartman
maintainerPATCH 36/138 netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyang Xuan <[email protected]>
[ Upstream commit f969eb84ce482331a991079ab7a5c4dc3b7f89bf ]
nft_unregister_expr() can concurrent with __nft_expr_type_get(), and there is not any protection when iterate over nf_tables_expressions list in __nft_expr_type_get(). Therefore, there is potential data-race of nf_tables_expressions list entry.
Use list_for_each_entry_rcu() to iterate over nf_tables_expressions list in __nft_expr_type_get(), and use rcu_read_lock() in the caller nft_expr_type_get() to protect the entire type query process.
--- net/netfilter/nf_tables_api.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +6 -2
@@ -2739,7 +2739,7 @@ static const struct nft_expr_type *__nft_expr_type_get(u8 family, {const struct nft_expr_type *type, *candidate =NULL ; -list_for_each_entry (type, &nf_tables_expressions, list) { +list_for_each_entry_rcu (type, &nf_tables_expressions, list) {if (!nla_strcmp (nla, type->name)) {if (!type->family && !candidate) candidate = type;
@@ -2771,9 +2771,13 @@ static const struct nft_expr_type *nft_expr_type_get(struct net *net,if (nla ==NULL )return ERR_PTR (-EINVAL ); +rcu_read_lock (); type =__nft_expr_type_get (family, nla); -if (type !=NULL &&try_module_get (type->owner)) +if (type !=NULL &&try_module_get (type->owner)) { +rcu_read_unlock ();return type; + } +rcu_read_unlock ();lockdep_nfnl_nft_mutex_not_held ();#ifdef CONFIG_MODULES
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/138 netfilter: nft_set_pipapo: do not free live element
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 3cfc9ec039af60dbd8965ae085b2c2ccdcfbe1cc ]
Pablo reports a crash with large batches of elements with a back-to-back add/remove pattern. Quoting Pablo:
add_elem("00000000") timeout 100 ms
...
add_elem("0000000X") timeout 100 ms
del_elem("0000000X") <---------------- delete one that was just added
...
add_elem("00005000") timeout 100 ms
1) nft_pipapo_remove() removes element 0000000X
Then, KASAN shows a splat.
Looking at the remove function there is a chance that we will drop a rule that maps to a non-deactivated element.
Removal happens in two steps, first we do a lookup for key k and return the to-be-removed element and mark it as inactive in the next generation. Then, in a second step, the element gets removed from the set/map.
The _remove function does not work correctly if we have more than one element that share the same key.
This can happen if we insert an element into a set when the set already holds an element with same key, but the element mapping to the existing key has timed out or is not active in the next generation.
In such case its possible that removal will unmap the wrong element. If this happens, we will leak the non-deactivated element, it becomes unreachable.
The element that got deactivated (and will be freed later) will remain reachable in the set data structure, this can result in a crash when such an element is retrieved during lookup (stale pointer).
Add a check that the fully matching key does in fact map to the element that we have marked as inactive in the deactivation step.
If not, we need to continue searching.
Add a bug/warn trap at the end of the function as well, the remove function must not ever be called with an invisible/unreachable/non-existent element.
v2: avoid uneeded temporary variable (Stefano)
--- net/netfilter/nft_set_pipapo.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
net/netfilter/nft_set_pipapo.c +9 -5
@@ -1980,6 +1980,8 @@ static void nft_pipapo_remove(const struct net *net, const struct nft_set *set, rules_fx = rules_f0;nft_pipapo_for_each_field (f, i, m) { +bool last = i == m->field_count -1 ; +if (!pipapo_match_field (f, start, rules_fx, match_start, match_end))break ;
@@ -1992,16 +1994,18 @@ static void nft_pipapo_remove(const struct net *net, const struct nft_set *set, match_start +=NFT_PIPAPO_GROUPS_PADDED_SIZE (f); match_end +=NFT_PIPAPO_GROUPS_PADDED_SIZE (f); - } -if (i == m->field_count) { - priv->dirty = true; -pipapo_drop (m, rulemap); -return ; +if (last && f->mt[rulemap[i].to].e == e) { + priv->dirty = true; +pipapo_drop (m, rulemap); +return ; + } } first_rule += rules_f0; } + +WARN_ON_ONCE (1 );/* elem_priv not found */ }/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/138 tun: limit printing rate when illegal packet received by tun dev
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lei Chen <[email protected]>
[ Upstream commit f8bbc07ac535593139c875ffa19af924b1084540 ]
vhost_worker will call tun call backs to receive packets. If too many illegal packets arrives, tun_do_read will keep dumping packet contents. When console is enabled, it will costs much more cpu time to dump packet and soft lockup will be detected.
net_ratelimit mechanism can be used to limit the dumping rate.
PID: 33036 TASK: ffff949da6f20000 CPU: 23 COMMAND: "vhost-32980"
#0 [fffffe00003fce50] crash_nmi_callback at ffffffff89249253 #1 [fffffe00003fce58] nmi_handle at ffffffff89225fa3 #2 [fffffe00003fceb0] default_do_nmi at ffffffff8922642e #3 [fffffe00003fced0] do_nmi at ffffffff8922660d #4 [fffffe00003fcef0] end_repeat_nmi at ffffffff89c01663
[exception RIP: io_serial_in+20]
RIP: ffffffff89792594 RSP: ffffa655314979e8 RFLAGS: 00000002
RAX: ffffffff89792500 RBX: ffffffff8af428a0 RCX: 0000000000000000
RDX: 00000000000003fd RSI: 0000000000000005 RDI: ffffffff8af428a0
RBP: 0000000000002710 R8: 0000000000000004 R9: 000000000000000f
R10: 0000000000000000 R11: ffffffff8acbf64f R12: 0000000000000020
R13: ffffffff8acbf698 R14: 0000000000000058 R15: 0000000000000000
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #5 [ffffa655314979e8] io_serial_in at ffffffff89792594
#6 [ffffa655314979e8] wait_for_xmitr at ffffffff89793470 #7 [ffffa65531497a08] serial8250_console_putchar at ffffffff897934f6 #8 [ffffa65531497a20] uart_console_write at ffffffff8978b605 #9 [ffffa65531497a48] serial8250_console_write at ffffffff89796558 #10 [ffffa65531497ac8] console_unlock at ffffffff89316124 #11 [ffffa65531497b10] vprintk_emit at ffffffff89317c07 #12 [ffffa65531497b68] printk at ffffffff89318306
#13 [ffffa65531497bc8] print_hex_dump at ffffffff89650765 #14 [ffffa65531497ca8] tun_do_read at ffffffffc0b06c27 [tun] #15 [ffffa65531497d38] tun_recvmsg at ffffffffc0b06e34 [tun] #16 [ffffa65531497d68] handle_rx at ffffffffc0c5d682 [vhost_net] #17 [ffffa65531497ed0] vhost_worker at ffffffffc0c644dc [vhost] #18 [ffffa65531497f10] kthread at ffffffff892d2e72
#19 [ffffa65531497f50] ret_from_fork at ffffffff89c0022f
--- drivers/net/tun.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
drivers/net/tun.c +10 -8
@@ -2141,14 +2141,16 @@ static ssize_t tun_put_user(struct tun_struct *tun, tun_is_little_endian(tun), true, vlan_hlen)) {struct skb_shared_info *sinfo =skb_shinfo (skb); -pr_err ("unexpected GSO type: " -"0x%x, gso_size %d, hdr_len %d\n" , - sinfo->gso_type,tun16_to_cpu (tun, gso.gso_size), -tun16_to_cpu (tun, gso.hdr_len)); -print_hex_dump (KERN_ERR ,"tun: " , -DUMP_PREFIX_NONE , -16 ,1 , skb->head, -min ((int )tun16_to_cpu (tun, gso.hdr_len),64 ), true); + +if (net_ratelimit ()) { +netdev_err (tun->dev,"unexpected GSO type: 0x%x, gso_size %d, hdr_len %d\n" , + sinfo->gso_type,tun16_to_cpu (tun, gso.gso_size), +tun16_to_cpu (tun, gso.hdr_len)); +print_hex_dump (KERN_ERR ,"tun: " , +DUMP_PREFIX_NONE , +16 ,1 , skb->head, +min ((int )tun16_to_cpu (tun, gso.hdr_len),64 ), true); + }WARN_ON_ONCE (1 );return -EINVAL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/138 RDMA/rxe: Fix the problem "mutex_destroy missing"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yanjun.Zhu <[email protected]>
[ Upstream commit 481047d7e8391d3842ae59025806531cdad710d9 ]
When a mutex lock is not used any more, the function mutex_destroy should be called to mark the mutex lock uninitialized.
--- drivers/infiniband/sw/rxe/rxe.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/infiniband/sw/rxe/rxe.c +2 -0
@@ -35,6 +35,8 @@ void rxe_dealloc(struct ib_device *ib_dev)if (rxe->tfm)crypto_free_shash (rxe->tfm); + +mutex_destroy (&rxe->usdev_lock); }/* initialize rxe device parameters */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/138 RDMA/cm: Print the old state when cm_destroy_id gets timeout
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Zhang <[email protected]>
[ Upstream commit b68e1acb5834ed1a2ad42d9d002815a8bae7c0b6 ]
The old state is helpful for debugging, as the current state is always IB_CM_IDLE when timeout happens.
--- drivers/infiniband/core/cm.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/infiniband/core/cm.c +7 -4
@@ -1057,23 +1057,26 @@ static void cm_reset_to_idle(struct cm_id_private *cm_id_priv) } } -static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id) +static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id, +enum ib_cm_state old_state) {struct cm_id_private *cm_id_priv; cm_id_priv = container_of(cm_id, struct cm_id_private, id); -pr_err ("%s: cm_id=%p timed out. state=%d refcnt=%d\n" , __func__, - cm_id, cm_id->state,refcount_read (&cm_id_priv->refcount)); +pr_err ("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n" , __func__, + cm_id, old_state, cm_id->state,refcount_read (&cm_id_priv->refcount)); }static void cm_destroy_id (struct ib_cm_id *cm_id,int err) {struct cm_id_private *cm_id_priv; +enum ib_cm_state old_state;struct cm_work *work;int ret; cm_id_priv = container_of(cm_id, struct cm_id_private, id);spin_lock_irq (&cm_id_priv->lock); + old_state = cm_id->state; retest:switch (cm_id->state) {case IB_CM_LISTEN :
@@ -1187,7 +1190,7 @@ static void cm_destroy_id(struct ib_cm_id *cm_id, int err)msecs_to_jiffies ( CM_DESTROY_ID_WAIT_TIMEOUT));if (!ret)/* timeout happened */ -cm_destroy_id_wait_timeout (cm_id); +cm_destroy_id_wait_timeout (cm_id, old_state); }while (!ret);while ((work =cm_dequeue_work (cm_id_priv)) !=NULL )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/138 RDMA/mlx5: Fix port number for counter query in multi-port configuration
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Guralnik <[email protected]>
[ Upstream commit be121ffb384f53e966ee7299ffccc6eeb61bc73d ]
Set the correct port when querying PPCNT in multi-port configuration. Distinguish between cases where switchdev mode was enabled to multi-port configuration and don't overwrite the queried port to 1 in multi-port case.
--- drivers/infiniband/hw/mlx5/mad.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/hw/mlx5/mad.c +2 -1
@@ -166,7 +166,8 @@ static int process_pma_cmd(struct mlx5_ib_dev *dev, u8 port_num, mdev = dev->mdev; mdev_port_num =1 ; } -if (MLX5_CAP_GEN (dev->mdev, num_ports) ==1 ) { +if (MLX5_CAP_GEN (dev->mdev, num_ports) ==1 && + !mlx5_core_mp_enabled (mdev)) {/* set local port to one for Function-Per-Port HCA. */ mdev = dev->mdev; mdev_port_num =1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/138 drm: nv04: Fix out of bounds access
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Kobuk <[email protected]>
[ Upstream commit cf92bb778eda7830e79452c6917efa8474a30c1e ]
When Output Resource (dcb->or) value is assigned in fabricate_dcb_output(), there may be out of bounds access to dac_users array in case dcb->or is zero because ffs(dcb->or) is used as index there.
The 'or' argument of fabricate_dcb_output() must be interpreted as a number of bit to set, not value.
Utilize macros from 'enum nouveau_or' in calls instead of hardcoding.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/gpu/drm/nouveau/nouveau_bios.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/gpu/drm/nouveau/nouveau_bios.c +7 -6
@@ -23,6 +23,7 @@*/ #include "nouveau_drv.h" +#include "nouveau_bios.h" #include "nouveau_reg.h" #include "dispnv04/hw.h" #include "nouveau_encoder.h"
@@ -1672,7 +1673,7 @@ apply_dcb_encoder_quirks(struct drm_device *dev, int idx, u32 *conn, u32 *conf)*/ if (nv_match_device (dev,0x0201 ,0x1462 ,0x8851 )) {if (*conn ==0xf2005014 && *conf ==0xffffffff ) { -fabricate_dcb_output (dcb,DCB_OUTPUT_TMDS ,1 ,1 ,1 ); +fabricate_dcb_output (dcb,DCB_OUTPUT_TMDS ,1 ,1 ,DCB_OUTPUT_B );return false; } }
@@ -1758,26 +1759,26 @@ fabricate_dcb_encoder_table(struct drm_device *dev, struct nvbios *bios)#ifdef __powerpc__/* Apple iMac G4 NV17 */ if (of_machine_is_compatible ("PowerMac4,5" )) { -fabricate_dcb_output (dcb,DCB_OUTPUT_TMDS ,0 , all_heads,1 ); -fabricate_dcb_output (dcb,DCB_OUTPUT_ANALOG ,1 , all_heads,2 ); +fabricate_dcb_output (dcb,DCB_OUTPUT_TMDS ,0 , all_heads,DCB_OUTPUT_B ); +fabricate_dcb_output (dcb,DCB_OUTPUT_ANALOG ,1 , all_heads,DCB_OUTPUT_C );return ; }#endif /* Make up some sane defaults */ fabricate_dcb_output (dcb,DCB_OUTPUT_ANALOG , - bios->legacy.i2c_indices.crt,1 ,1 ); + bios->legacy.i2c_indices.crt,1 ,DCB_OUTPUT_B );if (nv04_tv_identify (dev, bios->legacy.i2c_indices.tv) >=0 )fabricate_dcb_output (dcb,DCB_OUTPUT_TV , bios->legacy.i2c_indices.tv, - all_heads,0 ); + all_heads,DCB_OUTPUT_A );else if (bios->tmds.output0_script_ptr || bios->tmds.output1_script_ptr)fabricate_dcb_output (dcb,DCB_OUTPUT_TMDS , bios->legacy.i2c_indices.panel, - all_heads,1 ); + all_heads,DCB_OUTPUT_B ); } static int
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/138 drm/panel: visionox-rm69299: dont unregister DSI device
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 9e4d3f4f34455abbaa9930bf6b7575a5cd081496 ]
The DSI device for the panel was registered by the DSI host, so it is an error to unregister it from the panel driver. Drop the call to mipi_dsi_device_unregister().
--- drivers/gpu/drm/panel/panel-visionox-rm69299.c | 2 -- 1 file changed, 2 deletions(-)
drivers/gpu/drm/panel/panel-visionox-rm69299.c +0 -2
@@ -261,8 +261,6 @@ static int visionox_rm69299_remove(struct mipi_dsi_device *dsi)struct visionox_rm69299 *ctx =mipi_dsi_get_drvdata (dsi);mipi_dsi_detach (ctx->dsi); -mipi_dsi_device_unregister (ctx->dsi); -drm_panel_remove (&ctx->panel);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/138 clk: Remove prepare_lock hold assertion in __clk_release()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit 8358a76cfb47c9a5af627a0c4e7168aa14fa25f6 ]
Removing this assertion lets us move the kref_put() call outside the prepare_lock section. We don't need to hold the prepare_lock here to free memory and destroy the clk_core structure. We've already unlinked the clk from the clk tree and by the time the release function runs nothing holds a reference to the clk_core anymore so anything with the pointer can't access the memory that's being freed anyway. Way back in commit 496eadf821c2 ("clk: Use lockdep asserts to find missing hold of prepare_lock") we didn't need to have this assertion either.
--- drivers/clk/clk.c | 2 -- 1 file changed, 2 deletions(-)
drivers/clk/clk.c +0 -2
@@ -4006,8 +4006,6 @@ static void __clk_release(struct kref *ref) { struct clk_core *core = container_of(ref, struct clk_core, ref); -lockdep_assert_held (&prepare_lock); -clk_core_free_parent_map (core);kfree_const (core->name);kfree (core);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/138 clk: Mark all_lists as const
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit 75061a6ff49ba3482c6319ded0c26e6a526b0967 ]
This list array doesn't change at runtime. Mark it const to move to RO memory.
Stable-dep-of: e581cf5d2162 ("clk: Get runtime PM before walking tree during disable_unused")
--- drivers/clk/clk.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/clk.c +2 -2
@@ -37,7 +37,7 @@ static HLIST_HEAD(clk_root_list);static HLIST_HEAD (clk_orphan_list);static LIST_HEAD (clk_notifier_list); -static struct hlist_head *all_lists[] = { +static const struct hlist_head *all_lists[] = { &clk_root_list, &clk_orphan_list,NULL ,
@@ -4063,7 +4063,7 @@ static void clk_core_evict_parent_cache_subtree(struct clk_core *root,/* Remove this clk from all parent caches */ static void clk_core_evict_parent_cache (struct clk_core *core) { -struct hlist_head **lists; +const struct hlist_head **lists;struct clk_core *root;lockdep_assert_held (&prepare_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/138 clk: remove extra empty line
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
[ Upstream commit 79806d338829b2bf903480428d8ce5aab8e2d24b ]
Remove extra empty line.
Stable-dep-of: e581cf5d2162 ("clk: Get runtime PM before walking tree during disable_unused")
--- drivers/clk/clk.c | 1 - 1 file changed, 1 deletion(-)
drivers/clk/clk.c +0 -1
@@ -3631,7 +3631,6 @@ static int __clk_core_init(struct clk_core *core)clk_core_reparent_orphans_nolock (); -kref_init (&core->ref); out:clk_pm_runtime_put (core);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/138 clk: Print an info line before disabling unused clocks
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 12ca59b91d04df32e41be5a52f0cabba912c11de ]
Currently, the regulator framework informs us before calling into their unused cleanup paths, which eases at least some debugging. The same could be beneficial for clocks, so that random shutdowns shortly after most initcalls are done can be less of a guess.
Add a pr_info before disabling unused clocks to do so.
Stable-dep-of: e581cf5d2162 ("clk: Get runtime PM before walking tree during disable_unused")
--- drivers/clk/clk.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/clk/clk.c +2 -0
@@ -1309,6 +1309,8 @@ static int __init clk_disable_unused(void)return 0 ; } +pr_info ("clk: Disabling unused clocks\n" ); +clk_prepare_lock ();hlist_for_each_entry (core, &clk_root_list, child_node)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/138 clk: Initialize struct clk_core kref earlier
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit 9d05ae531c2cff20d5d527f04e28d28e04379929 ]
Initialize this kref once we allocate memory for the struct clk_core so that we can reuse the release function to free any memory associated with the structure. This mostly consolidates code, but also clarifies that the kref lifetime exists once the container structure (struct clk_core) is allocated instead of leaving it in a half-baked state for most of __clk_core_init().
Stable-dep-of: e581cf5d2162 ("clk: Get runtime PM before walking tree during disable_unused")
--- drivers/clk/clk.c | 28 +++++++++++++--------------- 1 file changed, 13 insertions(+), 15 deletions(-)
drivers/clk/clk.c +13 -15
@@ -3632,8 +3632,6 @@ static int __clk_core_init(struct clk_core *core) }clk_core_reparent_orphans_nolock (); - -kref_init (&core->ref); out:clk_pm_runtime_put (core); unlock:
@@ -3843,6 +3841,16 @@ static void clk_core_free_parent_map(struct clk_core *core)kfree (core->parents); } +/* Free memory allocated for a struct clk_core */ +static void __clk_release (struct kref *ref) +{ + struct clk_core *core = container_of(ref, struct clk_core, ref); + +clk_core_free_parent_map (core); +kfree_const (core->name); +kfree (core); +} +static struct clk *__clk_register (struct device *dev,struct device_node *np,struct clk_hw *hw) {
@@ -3863,6 +3871,8 @@ __clk_register(struct device *dev, struct device_node *np, struct clk_hw *hw) goto fail_out; } +kref_init (&core->ref); + core->name =kstrdup_const (init->name,GFP_KERNEL );if (!core->name) { ret = -ENOMEM ;
@@ -3917,12 +3927,10 @@ __clk_register(struct device *dev, struct device_node *np, struct clk_hw *hw) hw->clk =NULL ; fail_create_clk: -clk_core_free_parent_map (core); fail_parents: fail_ops: -kfree_const (core->name); fail_name: -kfree (core); +kref_put (&core->ref, __clk_release); fail_out:return ERR_PTR (ret); }
@@ -4002,16 +4010,6 @@ int of_clk_hw_register(struct device_node *node, struct clk_hw *hw) }EXPORT_SYMBOL_GPL (of_clk_hw_register); -/* Free memory allocated for a clock. */ -static void __clk_release (struct kref *ref) -{ - struct clk_core *core = container_of(ref, struct clk_core, ref); - -clk_core_free_parent_map (core); -kfree_const (core->name); -kfree (core); -} -/* * Empty clk_ops for unregistered clocks. These are used temporarily * after clk_unregister() was called on a clock and until last clock
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/138 clk: Get runtime PM before walking tree during disable_unused
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit e581cf5d216289ef292d1a4036d53ce90e122469 ]
Doug reported [1] the following hung task:
INFO: task swapper/0:1 blocked for more than 122 seconds.
Not tainted 5.15.149-21875-gf795ebc40eb8 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:swapper/0 state:D stack: 0 pid: 1 ppid: 0 flags:0x00000008
Call trace:
__switch_to+0xf4/0x1f4
__schedule+0x418/0xb80
schedule+0x5c/0x10c
rpm_resume+0xe0/0x52c
rpm_resume+0x178/0x52c
__pm_runtime_resume+0x58/0x98
clk_pm_runtime_get+0x30/0xb0
clk_disable_unused_subtree+0x58/0x208
clk_disable_unused_subtree+0x38/0x208
clk_disable_unused_subtree+0x38/0x208
clk_disable_unused_subtree+0x38/0x208
clk_disable_unused_subtree+0x38/0x208
clk_disable_unused+0x4c/0xe4
do_one_initcall+0xcc/0x2d8
do_initcall_level+0xa4/0x148
do_initcalls+0x5c/0x9c
do_basic_setup+0x24/0x30
kernel_init_freeable+0xec/0x164
kernel_init+0x28/0x120
ret_from_fork+0x10/0x20
INFO: task kworker/u16:0:9 blocked for more than 122 seconds.
Not tainted 5.15.149-21875-gf795ebc40eb8 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u16:0 state:D stack: 0 pid: 9 ppid: 2 flags:0x00000008
Workqueue: events_unbound deferred_probe_work_func
Call trace:
__switch_to+0xf4/0x1f4
__schedule+0x418/0xb80
schedule+0x5c/0x10c
schedule_preempt_disabled+0x2c/0x48
__mutex_lock+0x238/0x488
__mutex_lock_slowpath+0x1c/0x28
mutex_lock+0x50/0x74
clk_prepare_lock+0x7c/0x9c
clk_core_prepare_lock+0x20/0x44
clk_prepare+0x24/0x30
clk_bulk_prepare+0x40/0xb0
mdss_runtime_resume+0x54/0x1c8
pm_generic_runtime_resume+0x30/0x44
__genpd_runtime_resume+0x68/0x7c
genpd_runtime_resume+0x108/0x1f4
__rpm_callback+0x84/0x144
rpm_callback+0x30/0x88
rpm_resume+0x1f4/0x52c
rpm_resume+0x178/0x52c
__pm_runtime_resume+0x58/0x98
__device_attach+0xe0/0x170
device_initial_probe+0x1c/0x28
bus_probe_device+0x3c/0x9c
device_add+0x644/0x814
mipi_dsi_device_register_full+0xe4/0x170
devm_mipi_dsi_device_register_full+0x28/0x70
ti_sn_bridge_probe+0x1dc/0x2c0
auxiliary_bus_probe+0x4c/0x94
really_probe+0xcc/0x2c8
__driver_probe_device+0xa8/0x130
driver_probe_device+0x48/0x110
__device_attach_driver+0xa4/0xcc
bus_for_each_drv+0x8c/0xd8
__device_attach+0xf8/0x170
device_initial_probe+0x1c/0x28
bus_probe_device+0x3c/0x9c
deferred_probe_work_func+0x9c/0xd8
process_one_work+0x148/0x518
worker_thread+0x138/0x350
kthread+0x138/0x1e0
ret_from_fork+0x10/0x20The first thread is walking the clk tree and calling clk_pm_runtime_get() to power on devices required to read the clk hardware via struct clk_ops::is_enabled(). This thread holds the clk prepare_lock, and is trying to runtime PM resume a device, when it finds that the device is in the process of resuming so the thread schedule()s away waiting for the device to finish resuming before continuing. The second thread is runtime PM resuming the same device, but the runtime resume callback is calling clk_prepare(), trying to grab the prepare_lock waiting on the first thread.
This is a classic ABBA deadlock. To properly fix the deadlock, we must never runtime PM resume or suspend a device with the clk prepare_lock held. Actually doing that is near impossible today because the global prepare_lock would have to be dropped in the middle of the tree, the device runtime PM resumed/suspended, and then the prepare_lock grabbed again to ensure consistency of the clk tree topology. If anything changes with the clk tree in the meantime, we've lost and will need to start the operation all over again.
Luckily, most of the time we're simply incrementing or decrementing the runtime PM count on an active device, so we don't have the chance to schedule away with the prepare_lock held. Let's fix this immediate problem that can be triggered more easily by simply booting on Qualcomm sc7180.
Introduce a list of clk_core structures that have been registered, or are in the process of being registered, that require runtime PM to operate. Iterate this list and call clk_pm_runtime_get() on each of them without holding the prepare_lock during clk_disable_unused(). This way we can be certain that the runtime PM state of the devices will be active and resumed so we can't schedule away while walking the clk tree with the prepare_lock held. Similarly, call clk_pm_runtime_put() without the prepare_lock held to properly drop the runtime PM reference. We remove the calls to clk_pm_runtime_{get,put}() in this path because they're superfluous now that we know the devices are runtime resumed.
--- drivers/clk/clk.c | 117 +++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 105 insertions(+), 12 deletions(-)
drivers/clk/clk.c +105 -12
@@ -37,6 +37,10 @@ static HLIST_HEAD(clk_root_list);static HLIST_HEAD (clk_orphan_list);static LIST_HEAD (clk_notifier_list); +/* List of registered clks that use runtime PM */ +static HLIST_HEAD (clk_rpm_list); +static DEFINE_MUTEX (clk_rpm_list_lock); +static const struct hlist_head *all_lists[] = { &clk_root_list, &clk_orphan_list,
@@ -59,6 +63,7 @@ struct clk_core {struct clk_hw *hw;struct module *owner;struct device *dev; +struct hlist_node rpm_node;struct device_node *of_node;struct clk_core *parent;struct clk_parent_map *parents;
@@ -129,6 +134,89 @@ static void clk_pm_runtime_put(struct clk_core *core)pm_runtime_put_sync (core->dev); } +/** +* clk_pm_runtime_get_all() - Runtime "get" all clk provider devices +* +* Call clk_pm_runtime_get() on all runtime PM enabled clks in the clk tree so +* that disabling unused clks avoids a deadlock where a device is runtime PM +* resuming/suspending and the runtime PM callback is trying to grab the +* prepare_lock for something like clk_prepare_enable() while +* clk_disable_unused_subtree() holds the prepare_lock and is trying to runtime +* PM resume/suspend the device as well. +* +* Context: Acquires the 'clk_rpm_list_lock' and returns with the lock held on +* success. Otherwise the lock is released on failure. +* +* Return: 0 on success, negative errno otherwise. +*/ +static int clk_pm_runtime_get_all (void ) +{ +int ret; +struct clk_core *core, *failed; + +/* +* Grab the list lock to prevent any new clks from being registered +* or unregistered until clk_pm_runtime_put_all(). +*/ +mutex_lock (&clk_rpm_list_lock); + +/* +* Runtime PM "get" all the devices that are needed for the clks +* currently registered. Do this without holding the prepare_lock, to +* avoid the deadlock. +*/ +hlist_for_each_entry (core, &clk_rpm_list, rpm_node) { + ret =clk_pm_runtime_get (core); +if (ret) { + failed = core; +pr_err ("clk: Failed to runtime PM get '%s' for clk '%s'\n" , +dev_name (failed->dev), failed->name); + goto err; + } + } + +return 0 ; + +err: +hlist_for_each_entry (core, &clk_rpm_list, rpm_node) { +if (core == failed) +break ; + +clk_pm_runtime_put (core); + } +mutex_unlock (&clk_rpm_list_lock); + +return ret; +} + +/** +* clk_pm_runtime_put_all() - Runtime "put" all clk provider devices +* +* Put the runtime PM references taken in clk_pm_runtime_get_all() and release +* the 'clk_rpm_list_lock'. +*/ +static void clk_pm_runtime_put_all (void ) +{ +struct clk_core *core; + +hlist_for_each_entry (core, &clk_rpm_list, rpm_node) +clk_pm_runtime_put (core); +mutex_unlock (&clk_rpm_list_lock); +} + +static void clk_pm_runtime_init (struct clk_core *core) +{ +struct device *dev = core->dev; + +if (dev &&pm_runtime_enabled (dev)) { + core->rpm_enabled = true; + +mutex_lock (&clk_rpm_list_lock); +hlist_add_head (&core->rpm_node, &clk_rpm_list); +mutex_unlock (&clk_rpm_list_lock); + } +} +/*** locking ***/ static void clk_prepare_lock (void ) {
@@ -1231,9 +1319,6 @@ static void __init clk_unprepare_unused_subtree(struct clk_core *core)if (core->flags &CLK_IGNORE_UNUSED )return ; -if (clk_pm_runtime_get (core)) -return ; -if (clk_core_is_prepared (core)) {trace_clk_unprepare (core);if (core->ops->unprepare_unused)
@@ -1242,8 +1327,6 @@ static void __init clk_unprepare_unused_subtree(struct clk_core *core) core->ops->unprepare (core->hw);trace_clk_unprepare_complete (core); } - -clk_pm_runtime_put (core); }static void __init clk_disable_unused_subtree (struct clk_core *core)
@@ -1259,9 +1342,6 @@ static void __init clk_disable_unused_subtree(struct clk_core *core)if (core->flags &CLK_OPS_PARENT_ENABLE )clk_core_prepare_enable (core->parent); -if (clk_pm_runtime_get (core)) - goto unprepare_out; - flags =clk_enable_lock ();if (core->enable_count)
@@ -1286,8 +1366,6 @@ static void __init clk_disable_unused_subtree(struct clk_core *core) unlock_out:clk_enable_unlock (flags); -clk_pm_runtime_put (core); -unprepare_out:if (core->flags &CLK_OPS_PARENT_ENABLE )clk_core_disable_unprepare (core->parent); }
@@ -1303,6 +1381,7 @@ __setup("clk_ignore_unused", clk_ignore_unused_setup);static int __init clk_disable_unused (void ) {struct clk_core *core; +int ret;if (clk_ignore_unused) {pr_warn ("clk: Not disabling unused clocks\n" );
@@ -1311,6 +1390,13 @@ static int __init clk_disable_unused(void)pr_info ("clk: Disabling unused clocks\n" ); + ret =clk_pm_runtime_get_all (); +if (ret) +return ret; +/* +* Grab the prepare lock to keep the clk topology stable while iterating +* over clks. +*/ clk_prepare_lock ();hlist_for_each_entry (core, &clk_root_list, child_node)
@@ -1327,6 +1413,8 @@ static int __init clk_disable_unused(void)clk_prepare_unlock (); +clk_pm_runtime_put_all (); +return 0 ; }late_initcall_sync (clk_disable_unused);
@@ -3846,6 +3934,12 @@ static void __clk_release(struct kref *ref) { struct clk_core *core = container_of(ref, struct clk_core, ref); +if (core->rpm_enabled) { +mutex_lock (&clk_rpm_list_lock); +hlist_del (&core->rpm_node); +mutex_unlock (&clk_rpm_list_lock); + } +clk_core_free_parent_map (core);kfree_const (core->name);kfree (core);
@@ -3885,9 +3979,8 @@ __clk_register(struct device *dev, struct device_node *np, struct clk_hw *hw) } core->ops = init->ops; -if (dev &&pm_runtime_enabled (dev)) - core->rpm_enabled = true; core->dev = dev; +clk_pm_runtime_init (core); core->of_node = np;if (dev && dev->driver) core->owner = dev->driver->owner;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/138 x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
[ Upstream commit 9543f6e26634537997b6e909c20911b7bf4876de ]
Fix cpuid_deps[] to list the correct dependencies for GFNI, VAES, and VPCLMULQDQ. These features don't depend on AVX512, and there exist CPUs that support these features but not AVX512. GFNI actually doesn't even depend on AVX.
This prevents GFNI from being unnecessarily disabled if AVX is disabled to mitigate the GDS vulnerability.
This also prevents all three features from being unnecessarily disabled if AVX512VL (or its dependency AVX512F) were to be disabled, but it looks like there isn't any case where this happens anyway.
--- arch/x86/kernel/cpu/cpuid-deps.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/x86/kernel/cpu/cpuid-deps.c +3 -3
@@ -44,7 +44,10 @@ static const struct cpuid_dep cpuid_deps[] = { { X86_FEATURE_F16C, X86_FEATURE_XMM2, }, { X86_FEATURE_AES, X86_FEATURE_XMM2 }, { X86_FEATURE_SHA_NI, X86_FEATURE_XMM2 }, + { X86_FEATURE_GFNI, X86_FEATURE_XMM2 }, { X86_FEATURE_FMA, X86_FEATURE_AVX }, + { X86_FEATURE_VAES, X86_FEATURE_AVX }, + { X86_FEATURE_VPCLMULQDQ, X86_FEATURE_AVX }, { X86_FEATURE_AVX2, X86_FEATURE_AVX, }, { X86_FEATURE_AVX512F, X86_FEATURE_AVX, }, { X86_FEATURE_AVX512IFMA, X86_FEATURE_AVX512F },
@@ -56,9 +59,6 @@ static const struct cpuid_dep cpuid_deps[] = { { X86_FEATURE_AVX512VL, X86_FEATURE_AVX512F }, { X86_FEATURE_AVX512VBMI, X86_FEATURE_AVX512F }, { X86_FEATURE_AVX512_VBMI2, X86_FEATURE_AVX512VL }, - { X86_FEATURE_GFNI, X86_FEATURE_AVX512VL }, - { X86_FEATURE_VAES, X86_FEATURE_AVX512VL }, - { X86_FEATURE_VPCLMULQDQ, X86_FEATURE_AVX512VL }, { X86_FEATURE_AVX512_VNNI, X86_FEATURE_AVX512VL }, { X86_FEATURE_AVX512_BITALG, X86_FEATURE_AVX512VL }, { X86_FEATURE_AVX512_4VNNIW, X86_FEATURE_AVX512F },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/138 binder: check offset alignment in binder_get_object()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit aaef73821a3b0194a01bd23ca77774f704a04d40 upstream.
Commit 6d98eb95b450 ("binder: avoid potential data leakage when copying txn") introduced changes to how binder objects are copied. In doing so, it unintentionally removed an offset alignment check done through calls to binder_alloc_copy_from_buffer() -> check_buffer().
These calls were replaced in binder_get_object() with copy_from_user(), so now an explicit offset alignment check is needed here. This avoids later complications when unwinding the objects gets harder.
It is worth noting this check existed prior to commit 7a67a39320df ("binder: add function to copy binder object from buffer"), likely removed due to redundancy at the time.
--- drivers/android/binder.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/android/binder.c +3 -1
@@ -2042,8 +2042,10 @@ static size_t binder_get_object(struct bsize_t object_size =0 ; read_size =min_t (size_t,sizeof (*object), buffer->data_size - offset); -if (offset > buffer->data_size || read_size <sizeof (*hdr)) +if (offset > buffer->data_size || read_size <sizeof (*hdr) || + !IS_ALIGNED (offset,sizeof (u32)))return 0 ; +if (u) {if (copy_from_user (object, u + offset, read_size))return 0 ;
Greg Kroah-Hartman
maintainerPATCH 52/138 thunderbolt: Avoid notify PM core about runtime PM resume
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gil Fine <[email protected]>
commit dcd12acaf384c30437fa5a9a1f71df06fc9835fd upstream.
Currently we notify PM core about occurred wakes after any resume. This is not actually needed after resume from runtime suspend. Hence, notify PM core about occurred wakes only after resume from system sleep. Also, if the wake occurred in USB4 router upstream port, we don't notify the PM core about it since it is not actually needed and can cause unexpected autowake (e.g. if /sys/power/wakeup_count is used).
While there add the missing kernel-doc for tb_switch_resume().
--- drivers/thunderbolt/switch.c | 27 +++++++++++++++++++++++++-- drivers/thunderbolt/tb.c | 4 ++-- drivers/thunderbolt/tb.h | 3 ++- drivers/thunderbolt/usb4.c | 13 +++++++------ 4 files changed, 36 insertions(+), 11 deletions(-)
drivers/thunderbolt/switch.c +25 -2
@@ -2631,7 +2631,26 @@ static int tb_switch_set_wake(struct tb_return tb_lc_set_wake (sw, flags); } -int tb_switch_resume (struct tb_switch *sw) +static void tb_switch_check_wakes (struct tb_switch *sw) +{ +if (device_may_wakeup (&sw->dev)) { +if (tb_switch_is_usb4 (sw)) +usb4_switch_check_wakes (sw); + } +} + +/** +* tb_switch_resume() - Resume a switch after sleep +* @sw: Switch to resume +* @runtime: Is this resume from runtime suspend or system sleep +* +* Resumes and re-enumerates router (and all its children), if still plugged +* after suspend. Don't enumerate device router whose UID was changed during +* suspend. If this is resume from system sleep, notifies PM core about the +* wakes occurred during suspend. Disables all wakes, except USB4 wake of +* upstream port for USB4 routers that shall be always enabled. +*/ +int tb_switch_resume (struct tb_switch *sw,bool runtime) {struct tb_port *port;int err;
@@ -2676,6 +2695,9 @@ int tb_switch_resume(struct tb_switch *sif (err)return err; +if (!runtime) +tb_switch_check_wakes (sw); +/* Disable wakes */ tb_switch_set_wake (sw,0 );
@@ -2702,7 +2724,8 @@ int tb_switch_resume(struct tb_switch *s*/ if (tb_port_unlock (port))tb_port_warn (port,"failed to unlock port\n" ); -if (port->remote &&tb_switch_resume (port->remote->sw)) { +if (port->remote && +tb_switch_resume (port->remote->sw, runtime)) {tb_port_warn (port,"lost during suspend, disconnecting\n" );tb_sw_set_unplugged (port->remote->sw);
drivers/thunderbolt/tb.c +2 -2
@@ -1385,7 +1385,7 @@ static int tb_resume_noirq(struct tb *tb/* remove any pci devices the firmware might have setup */ tb_switch_reset (tb->root_switch); -tb_switch_resume (tb->root_switch); +tb_switch_resume (tb->root_switch, false);tb_free_invalid_tunnels (tb);tb_free_unplugged_children (tb->root_switch);tb_restore_children (tb->root_switch);
@@ -1488,7 +1488,7 @@ static int tb_runtime_resume(struct tb *struct tb_tunnel *tunnel, *n;mutex_lock (&tb->lock); -tb_switch_resume (tb->root_switch); +tb_switch_resume (tb->root_switch, true);tb_free_invalid_tunnels (tb);tb_restore_children (tb->root_switch);list_for_each_entry_safe (tunnel, n, &tcm->tunnel_list, list)
drivers/thunderbolt/tb.h +2 -1
@@ -653,7 +653,7 @@ int tb_switch_configure(struct tb_switchint tb_switch_add (struct tb_switch *sw);void tb_switch_remove (struct tb_switch *sw);void tb_switch_suspend (struct tb_switch *sw,bool runtime); -int tb_switch_resume (struct tb_switch *sw); +int tb_switch_resume (struct tb_switch *sw,bool runtime);int tb_switch_reset (struct tb_switch *sw);void tb_sw_set_unplugged (struct tb_switch *sw); struct tb_port *tb_switch_find_port(struct tb_switch *sw,
@@ -957,6 +957,7 @@ static inline struct tb_retimer *tb_to_rreturn NULL ; } +void usb4_switch_check_wakes (struct tb_switch *sw);int usb4_switch_setup (struct tb_switch *sw);int usb4_switch_read_uid (struct tb_switch *sw,u64 *uid); int usb4_switch_drom_read(struct tb_switch *sw, unsigned int address, void *buf,
drivers/thunderbolt/usb4.c +7 -6
@@ -197,15 +197,18 @@ static int usb4_switch_op(struct tb_switreturn 0 ; } -static void usb4_switch_check_wakes (struct tb_switch *sw) +/** +* usb4_switch_check_wakes() - Check for wakes and notify PM core about them +* @sw: Router whose wakes to check +* +* Checks wakes occurred during suspend and notify the PM core about them. +*/ +void usb4_switch_check_wakes (struct tb_switch *sw) {struct tb_port *port;bool wakeup = false;u32 val; -if (!device_may_wakeup (&sw->dev)) -return ; -if (tb_route (sw)) {if (tb_sw_read (sw, &val,TB_CFG_SWITCH ,ROUTER_CS_6 ,1 ))return ;
@@ -270,8 +273,6 @@ int usb4_switch_setup(struct tb_switch *u32 val =0 ;int ret; -usb4_switch_check_wakes (sw); -if (!tb_route (sw))return 0 ;
Greg Kroah-Hartman
maintainerPATCH 53/138 thunderbolt: Fix wake configurations after device unplug
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gil Fine <[email protected]>
commit c38fa07dc69f0b9e6f43ecab96dc7861a70c827c upstream.
Currently we don't configure correctly the wake events after unplug of device router. What can happen is that the downstream ports of host router will be configured to wake on: USB4-wake and wake-on-disconnect, but not on wake-on-connect. This may cause the later plugged device not to wake the domain and fail in enumeration. Fix this by clearing downstream port's "USB4 Port is Configured" bit, after unplug of a device router.
--- drivers/thunderbolt/switch.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
drivers/thunderbolt/switch.c +14 -7
@@ -2402,22 +2402,29 @@ void tb_switch_unconfigure_link(struct t {struct tb_port *up, *down; -if (sw->is_unplugged) -return ;if (!tb_route (sw) ||tb_switch_is_icm (sw))return ; +/* +* Unconfigure downstream port so that wake-on-connect can be +* configured after router unplug. No need to unconfigure upstream port +* since its router is unplugged. +*/ up =tb_upstream_port (sw); -if (tb_switch_is_usb4 (up->sw)) -usb4_port_unconfigure (up); -else -tb_lc_unconfigure_port (up); - down = up->remote;if (tb_switch_is_usb4 (down->sw))usb4_port_unconfigure (down);else tb_lc_unconfigure_port (down); + +if (sw->is_unplugged) +return ; + + up =tb_upstream_port (sw); +if (tb_switch_is_usb4 (up->sw)) +usb4_port_unconfigure (up); +else +tb_lc_unconfigure_port (up); }static int tb_switch_port_hotplug_enable (struct tb_switch *sw)
Greg Kroah-Hartman
maintainerPATCH 54/138 comedi: vmk80xx: fix incomplete endpoint checking
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit d1718530e3f640b7d5f0050e725216eab57a85d8 upstream.
While vmk80xx does have endpoint checking implemented, some things can fall through the cracks. Depending on the hardware model, URBs can have either bulk or interrupt type, and current version of vmk80xx_find_usb_endpoints() function does not take that fully into account. While this warning does not seem to be too harmful, at the very least it will crash systems with 'panic_on_warn' set on them.
Fix the issue found by Syzkaller [1] by somewhat simplifying the endpoint checking process with usb_find_common_endpoints() and ensuring that only expected endpoint types are present.
This patch has not been tested on real hardware.
[1] Syzkaller report:
usb 1-1: BOGUS urb xfer, pipe 1 != type 3
WARNING: CPU: 0 PID: 781 at drivers/usb/core/urb.c:504 usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... Call Trace: <TASK> usb_start_wait_urb+0x113/0x520 drivers/usb/core/message.c:59 vmk80xx_reset_device drivers/comedi/drivers/vmk80xx.c:227 [inline] vmk80xx_auto_attach+0xa1c/0x1a40 drivers/comedi/drivers/vmk80xx.c:818 comedi_auto_config+0x238/0x380 drivers/comedi/drivers.c:1067 usb_probe_interface+0x5cd/0xb00 drivers/usb/core/driver.c:399
...
Similar issue also found by Syzkaller:
--- drivers/staging/comedi/drivers/vmk80xx.c | 35 ++++++++++--------------------- 1 file changed, 12 insertions(+), 23 deletions(-)
drivers/staging/comedi/drivers/vmk80xx.c +12 -23
@@ -642,33 +642,22 @@ static int vmk80xx_find_usb_endpoints(ststruct vmk80xx_private *devpriv = dev->private;struct usb_interface *intf =comedi_to_usb_interface (dev);struct usb_host_interface *iface_desc = intf->cur_altsetting; -struct usb_endpoint_descriptor *ep_desc; -int i; +struct usb_endpoint_descriptor *ep_rx_desc, *ep_tx_desc; +int ret; -if (iface_desc->desc.bNumEndpoints !=2 ) -return -ENODEV ; - -for (i =0 ; i < iface_desc->desc.bNumEndpoints; i++) { - ep_desc = &iface_desc->endpoint[i].desc; - -if (usb_endpoint_is_int_in (ep_desc) || -usb_endpoint_is_bulk_in (ep_desc)) { -if (!devpriv->ep_rx) - devpriv->ep_rx = ep_desc; -continue ; - } +if (devpriv->model ==VMK8061_MODEL ) + ret =usb_find_common_endpoints (iface_desc, &ep_rx_desc, + &ep_tx_desc,NULL ,NULL ); +else + ret =usb_find_common_endpoints (iface_desc,NULL ,NULL , + &ep_rx_desc, &ep_tx_desc); -if (usb_endpoint_is_int_out (ep_desc) || -usb_endpoint_is_bulk_out (ep_desc)) { -if (!devpriv->ep_tx) - devpriv->ep_tx = ep_desc; -continue ; - } - } - -if (!devpriv->ep_rx || !devpriv->ep_tx) +if (ret)return -ENODEV ; + devpriv->ep_rx = ep_rx_desc; + devpriv->ep_tx = ep_tx_desc; +if (!usb_endpoint_maxp (devpriv->ep_rx) || !usb_endpoint_maxp (devpriv->ep_tx))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 55/138 serial/pmac_zilog: Remove flawed mitigation for rx irq flood
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
commit 1be3226445362bfbf461c92a5bcdb1723f2e4907 upstream.
The mitigation was intended to stop the irq completely. That may be better than a hard lock-up but it turns out that you get a crash anyway if you're using pmac_zilog as a serial console:
ttyPZ0: pmz: rx irq flood !
BUG: spinlock recursion on CPU#0, swapper/0
That's because the pr_err() call in pmz_receive_chars() results in pmz_console_write() attempting to lock a spinlock already locked in pmz_interrupt(). With CONFIG_DEBUG_SPINLOCK=y, this produces a fatal BUG splat. The spinlock in question is the one in struct uart_port.
Even when it's not fatal, the serial port rx function ceases to work. Also, the iteration limit doesn't play nicely with QEMU, as can be seen in the bug report linked below.
A web search for other reports of the error message "pmz: rx irq flood" didn't produce anything. So I don't think this code is needed any more. Remove it.
--- drivers/tty/serial/pmac_zilog.c | 14 -------------- 1 file changed, 14 deletions(-)
drivers/tty/serial/pmac_zilog.c +0 -14
@@ -217,7 +217,6 @@ static bool pmz_receive_chars(struct uar {struct tty_port *port;unsigned char ch, r1, drop, flag; -int loops =0 ;/* Sanity check, make sure the old bug is no longer happening */ if (uap->port.state ==NULL ) {
@@ -298,25 +297,12 @@ static bool pmz_receive_chars(struct uarif (r1 & Rx_OVR)tty_insert_flip_char (port,0 ,TTY_OVERRUN ); next_char: -/* We can get stuck in an infinite loop getting char 0 when the -* line is in a wrong HW state, we break that here. -* When that happens, I disable the receive side of the driver. -* Note that what I've been experiencing is a real irq loop where -* I'm getting flooded regardless of the actual port speed. -* Something strange is going on with the HW -*/ -if ((++loops) >1000 ) - goto flood; ch =read_zsreg (uap,R0 );if (!(ch & Rx_CH_AV))break ; }return true; - flood: -pmz_interrupt_control (uap,0 ); -pmz_error ("pmz: rx irq flood !\n" ); -return true; }static void pmz_status_handle (struct uart_pmac_port *uap)
Greg Kroah-Hartman
maintainerPATCH 56/138 USB: serial: option: add Fibocom FM135-GL variants
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: bolan wang <[email protected]>
commit 356952b13af5b2c338df1e06889fd1b5e12cbbf4 upstream.
Update the USB serial option driver support for the Fibocom FM135-GL LTE modules.
- VID:PID 2cb7:0115, FM135-GL for laptop debug M.2 cards(with MBIM interface for /Linux/Chrome OS)
0x0115: mbim, diag, at, pipe
Here are the outputs of usb-devices:
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2cb7 ProdID=0115 Rev=05.15 S: Manufacturer=Fibocom Wireless Inc. S: Product=Fibocom Module S: SerialNumber=12345678 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -2272,6 +2272,8 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0111, 0xff) }, /* Fibocom FM160 (MBIM mode) */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0115, 0xff), /* Fibocom FM135 (laptop MBIM) */ + .driver_info = RSVD(5) }, { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a2, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a3, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */
Greg Kroah-Hartman
maintainerPATCH 57/138 USB: serial: option: add support for Fibocom FM650/FG650
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuanhong Guo <[email protected]>
commit fb1f4584b1215e8c209f6b3a4028ed8351a0e961 upstream.
Fibocom FM650/FG650 are 5G modems with ECM/NCM/RNDIS/MBIM modes. This patch adds support to all 4 modes.
In all 4 modes, the first serial port is the AT console while the other 3 appear to be diagnostic interfaces for dumping modem logs.
usb-devices output for all modes:
ECM:
T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 5 Spd=5000 MxCh= 0 D: Ver= 3.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=2cb7 ProdID=0a04 Rev=04.04 S: Manufacturer=Fibocom Wireless Inc. S: Product=FG650 Module S: SerialNumber=0123456789ABCDEF C: #Ifs= 5 Cfg#= 1 Atr=c0 MxPwr=504mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
NCM:
T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=5000 MxCh= 0 D: Ver= 3.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=2cb7 ProdID=0a05 Rev=04.04 S: Manufacturer=Fibocom Wireless Inc. S: Product=FG650 Module S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=c0 MxPwr=504mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0d Prot=00 Driver=cdc_ncm E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=01 Driver=cdc_ncm E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
RNDIS:
T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 4 Spd=5000 MxCh= 0 D: Ver= 3.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=2cb7 ProdID=0a06 Rev=04.04 S: Manufacturer=Fibocom Wireless Inc. S: Product=FG650 Module S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=c0 MxPwr=504mA I: If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
MBIM:
T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 7 Spd=5000 MxCh= 0 D: Ver= 3.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=2cb7 ProdID=0a07 Rev=04.04 S: Manufacturer=Fibocom Wireless Inc. S: Product=FG650 Module S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=c0 MxPwr=504mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
--- drivers/usb/serial/option.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/serial/option.c +4 -0
@@ -2279,6 +2279,10 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a3, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a4, 0xff), /* Fibocom FM101-GL (laptop MBIM) */ .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a04, 0xff) }, /* Fibocom FM650-CN (ECM mode) */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a05, 0xff) }, /* Fibocom FM650-CN (NCM mode) */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a06, 0xff) }, /* Fibocom FM650-CN (RNDIS mode) */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a07, 0xff) }, /* Fibocom FM650-CN (MBIM mode) */ { USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */
Greg Kroah-Hartman
maintainerPATCH 58/138 USB: serial: option: add Lonsung U8300/U9300 product
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Coia Prant <[email protected]>
commit cf16ffa17c398434a77b8a373e69287c95b60de2 upstream.
Update the USB serial option driver to support Longsung U8300/U9300.
For U8300
Interface 4 is used by for QMI interface in stock firmware of U8300, the router which uses U8300 modem.
Interface 5 is used by for ADB interface in stock firmware of U8300, the router which uses U8300 modem.
Interface mapping is:
0: unknown (Debug), 1: AT (Modem), 2: AT, 3: PPP (NDIS / Pipe), 4: QMI, 5: ADB
T: Bus=05 Lev=01 Prnt=03 Port=02 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1c9e ProdID=9b05 Rev=03.18 S: Manufacturer=Android S: Product=Android C: #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
For U9300
Interface 1 is used by for ADB interface in stock firmware of U9300, the router which uses U9300 modem.
Interface 4 is used by for QMI interface in stock firmware of U9300, the router which uses U9300 modem.
Interface mapping is:
0: ADB, 1: AT (Modem), 2: AT, 3: PPP (NDIS / Pipe), 4: QMI
Note: Interface 3 of some models of the U9300 series can send AT commands.
T: Bus=05 Lev=01 Prnt=05 Port=04 Cnt=01 Dev#= 6 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1c9e ProdID=9b3c Rev=03.18 S: Manufacturer=Android S: Product=Android C: #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
Tested successfully using Modem Manager on U9300.
Tested successfully AT commands using If=1, If=2 and If=3 on U9300.
--- drivers/usb/serial/option.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/serial/option.c +4 -0
@@ -2052,6 +2052,10 @@ static const struct usb_device_id option .driver_info = RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, 0x9803, 0xff), .driver_info = RSVD(4) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, 0x9b05), /* Longsung U8300 */ + .driver_info = RSVD(4) | RSVD(5) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, 0x9b3c), /* Longsung U9300 */ + .driver_info = RSVD(0) | RSVD(4) }, { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
Greg Kroah-Hartman
maintainerPATCH 59/138 USB: serial: option: support Quectel EM060K sub-models
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerry Meng <[email protected]>
commit c840244aba7ad2b83ed904378b36bd6aef25511c upstream.
EM060K_129, EM060K_12a, EM060K_12b and EM0060K_12c are EM060K's sub-models, having the same name "Quectel EM060K-GL" and the same interface layout.
MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL
T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0129 Rev= 5.04 S: Manufacturer=Quectel S: Product=Quectel EM060K-GL S: SerialNumber=f6fa08b6 C:* #Ifs= 8 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E: Ad=8f(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/usb/serial/option.c +16 -0
@@ -255,6 +255,10 @@ static void option_instat_callback(struc#define QUECTEL_PRODUCT_EM061K_LMS 0x0124#define QUECTEL_PRODUCT_EC25 0x0125#define QUECTEL_PRODUCT_EM060K_128 0x0128 +#define QUECTEL_PRODUCT_EM060K_129 0x0129 +#define QUECTEL_PRODUCT_EM060K_12a 0x012a +#define QUECTEL_PRODUCT_EM060K_12b 0x012b +#define QUECTEL_PRODUCT_EM060K_12c 0x012c#define QUECTEL_PRODUCT_EG91 0x0191#define QUECTEL_PRODUCT_EG95 0x0195#define QUECTEL_PRODUCT_BG96 0x0296
@@ -1218,6 +1222,18 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0x00, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_129, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_129, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_129, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12a, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12a, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12a, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12b, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12b, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12b, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12c, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12c, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12c, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0x00, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 60/138 USB: serial: option: add Rolling RW101-GL and RW135-GL support
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vanillan Wang <[email protected]>
commit 311f97a4c7c22a01f8897bddf00428dfd0668e79 upstream.
Update the USB serial option driver support for the Rolling LTE modules.
- VID:PID 33f8:01a2, RW101-GL for laptop debug M.2 cards(with MBIM interface for /Linux/Chrome OS)0x01a2: mbim, diag, at, pipe
- VID:PID 33f8:01a3, RW101-GL for laptop debug M.2 cards(with MBIM interface for /Linux/Chrome OS)0x01a3: mbim, pipe
- VID:PID 33f8:01a4, RW101-GL for laptop debug M.2 cards(with MBIM interface for /Linux/Chrome OS)0x01a4: mbim, diag, at, pipe
- VID:PID 33f8:0104, RW101-GL for laptop debug M.2 cards(with RMNET interface for /Linux/Chrome OS)0x0104: RMNET, diag, at, pipe
- VID:PID 33f8:0115, RW135-GL for laptop debug M.2 cards(with MBIM interface for /Linux/Chrome OS)0x0115: MBIM, diag, at, pipe
Here are the outputs of usb-devices:
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=01a2 Rev=05.15 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling Module S: SerialNumber=12345678 C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=01a3 Rev=05.15 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling Module S: SerialNumber=12345678 C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 17 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=01a4 Rev=05.15 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling Module S: SerialNumber=12345678 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=33f8 ProdID=0104 Rev=05.04 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling Module S: SerialNumber=ba2eb033 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=0115 Rev=05.15 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling Module S: SerialNumber=12345678 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/usb/serial/option.c +8 -0
@@ -2307,6 +2307,14 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */ + { USB_DEVICE(0x33f8, 0x0104), /* Rolling RW101-GL (laptop RMNET) */ + .driver_info = RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a2, 0xff) }, /* Rolling RW101-GL (laptop MBIM) */ + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a3, 0xff) }, /* Rolling RW101-GL (laptop MBIM) */ + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a4, 0xff), /* Rolling RW101-GL (laptop MBIM) */ + .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */ + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 61/138 USB: serial: option: add Telit FN920C04 rmnet compositions
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Palmas <[email protected]>
commit 582ee2f9d268d302595db3e36b985e5cbb93284d upstream.
Add the following Telit FN920C04 compositions:
0x10a0: rmnet + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=03 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a0 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=92c4c4d8 C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10a4: rmnet + tty (AT) + tty (AT) + tty (diag)
T: Bus=03 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a4 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=92c4c4d8 C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10a9: rmnet + tty (AT) + tty (diag) + DPL (data packet logging) + adb
T: Bus=03 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a9 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=92c4c4d8 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/serial/option.c +6 -0
@@ -1376,6 +1376,12 @@ static const struct usb_device_id option .driver_info = NCTRL(2) | RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1083, 0xff), /* Telit FE990 (ECM) */ .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a0, 0xff), /* Telit FN20C04 (rmnet) */ + .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a4, 0xff), /* Telit FN20C04 (rmnet) */ + .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a9, 0xff), /* Telit FN20C04 (rmnet) */ + .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
Greg Kroah-Hartman
maintainerPATCH 62/138 Revert "usb: cdc-wdm: close race between read and workqueue"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 1607830dadeefc407e4956336d9fcd9e9defd810 upstream.
This reverts commit 339f83612f3a569b194680768b22bf113c26a29d.
It has been found to cause problems in a number of Chromebook devices, so revert the change until it can be brought back in a safe way.
--- drivers/usb/class/cdc-wdm.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/usb/class/cdc-wdm.c +1 -5
@@ -471,7 +471,6 @@ out_free_mem:static int service_outstanding_interrupt (struct wdm_device *desc) {int rv =0 ; -int used;/* submit read urb only if the device is waiting for it */ if (!desc->resp_count || !--desc->resp_count)
@@ -486,10 +485,7 @@ static int service_outstanding_interrupt goto out; } - used =test_and_set_bit (WDM_RESPONDING , &desc->flags); -if (used) - goto out; - +set_bit (WDM_RESPONDING , &desc->flags);spin_unlock_irq (&desc->iuspin); rv =usb_submit_urb (desc->response,GFP_KERNEL );spin_lock_irq (&desc->iuspin);
Greg Kroah-Hartman
maintainerPATCH 63/138 usb: dwc2: host: Fix dereference issue in DDMA completion flow.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minas Harutyunyan <[email protected]>
commit eed04fa96c48790c1cce73c8a248e9d460b088f8 upstream.
Fixed variable dereference issue in DDMA completion flow.
--- drivers/usb/dwc2/hcd_ddma.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/dwc2/hcd_ddma.c +3 -1
@@ -897,13 +897,15 @@ static int dwc2_cmpl_host_isoc_dma_desc(struct dwc2_dma_desc *dma_desc;struct dwc2_hcd_iso_packet_desc *frame_desc;u16 frame_desc_idx; -struct urb *usb_urb = qtd->urb->priv; +struct urb *usb_urb;u16 remain =0 ;int rc =0 ;if (!qtd->urb)return -EINVAL ; + usb_urb = qtd->urb->priv; + dma_sync_single_for_cpu(hsotg->dev, qh->desc_list_dma + (idx * sizeof(struct dwc2_dma_desc)), sizeof(struct dwc2_dma_desc),
Greg Kroah-Hartman
maintainerPATCH 64/138 usb: Disable USB3 LPM at shutdown
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai-Heng Feng <[email protected]>
commit d920a2ed8620be04a3301e1a9c2b7cc1de65f19d upstream.
SanDisks USB3 storage may disapper after system reboot:
usb usb2-port3: link state changexhci_hcd 0000:00:14.0: clear port3 link state change, portsc: 0x2c0 usb usb2-port3: do warm reset, port onlyxhci_hcd 0000:00:14.0: xhci_hub_status_data: stopping usb2 port polling xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x2b0, return 0x2b0 usb usb2-port3: not warm reset yet, waiting 50msxhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x2f0, return 0x2f0 usb usb2-port3: not warm reset yet, waiting 200ms
...xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x6802c0, return 0x7002c0 usb usb2-port3: not warm reset yet, waiting 200msxhci_hcd 0000:00:14.0: clear port3 reset change, portsc: 0x4802c0 xhci_hcd 0000:00:14.0: clear port3 warm(BH) reset change, portsc: 0x4002c0 xhci_hcd 0000:00:14.0: clear port3 link state change, portsc: 0x2c0 xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x2c0, return 0x2c0 usb usb2-port3: not enabled, trying warm reset again...
This is due to the USB device still cause port change event after xHCI is shuted down:
xhci_hcd 0000:38:00.0: // Setting command ring address to 0xffffe001 xhci_hcd 0000:38:00.0: xhci_resume: starting usb3 port polling. xhci_hcd 0000:38:00.0: xhci_hub_status_data: stopping usb4 port polling xhci_hcd 0000:38:00.0: xhci_hub_status_data: stopping usb3 port polling xhci_hcd 0000:38:00.0: hcd_pci_runtime_resume: 0xhci_hcd 0000:38:00.0: xhci_shutdown: stopping usb3 port polling. xhci_hcd 0000:38:00.0: // Halt the HCxhci_hcd 0000:38:00.0: xhci_shutdown completed - status = 1 xhci_hcd 0000:00:14.0: xhci_shutdown: stopping usb1 port polling. xhci_hcd 0000:00:14.0: // Halt the HCxhci_hcd 0000:00:14.0: xhci_shutdown completed - status = 1 xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x1203, return 0x203 xhci_hcd 0000:00:14.0: set port reset, actual port 2-3 status = 0x1311 xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x201203, return 0x100203 xhci_hcd 0000:00:14.0: clear port3 reset change, portsc: 0x1203 xhci_hcd 0000:00:14.0: clear port3 warm(BH) reset change, portsc: 0x1203 xhci_hcd 0000:00:14.0: clear port3 link state change, portsc: 0x1203 xhci_hcd 0000:00:14.0: clear port3 connect change, portsc: 0x1203 xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x1203, return 0x203 usb 2-3: device not accepting address 2, error -108xhci_hcd 0000:00:14.0: xHCI dying or halted, can't queue_command xhci_hcd 0000:00:14.0: Set port 2-3 link state, portsc: 0x1203, write 0x11261 xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x1263, return 0x263 xhci_hcd 0000:00:14.0: set port reset, actual port 2-3 status = 0x1271 xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x12b1, return 0x2b1 usb usb2-port3: not reset yet, waiting 60ms
ACPI: PM: Preparing to enter system sleep state S5xhci_hcd 0000:00:14.0: Get port status 2-3 read: 0x12f1, return 0x2f1 usb usb2-port3: not reset yet, waiting 200ms
reboot: Restarting system
The port change event is caused by LPM transition, so disabling LPM at shutdown to make sure the device is in U0 for warmboot.
--- drivers/usb/core/port.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/core/port.c +3 -1
@@ -295,8 +295,10 @@ static void usb_port_shutdown(struct dev {struct usb_port *port_dev =to_usb_port (dev); -if (port_dev->child) +if (port_dev->child) {usb_disable_usb2_hardware_lpm (port_dev->child); +usb_unlocked_disable_lpm (port_dev->child); + } }static const struct dev_pm_ops usb_port_pm_ops = {
Greg Kroah-Hartman
maintainerPATCH 65/138 mei: me: disable RPL-S on SPS and IGN firmwares
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Usyskin <[email protected]>
commit 0dc04112bee6fdd6eb847ccb32214703022c0269 upstream.
Extend the quirk to disable MEI interface on Intel PCH Ignition (IGN) and SPS firmwares for RPL-S devices. These firmwares do not support the MEI protocol.
--- drivers/misc/mei/pci-me.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/mei/pci-me.c +1 -1
@@ -115,7 +115,7 @@ static const struct pci_device_id mei_me {MEI_PCI_DEVICE(MEI_DEV_ID_ADP_P, MEI_ME_PCH15_CFG)}, {MEI_PCI_DEVICE(MEI_DEV_ID_ADP_N, MEI_ME_PCH15_CFG)}, - {MEI_PCI_DEVICE(MEI_DEV_ID_RPL_S, MEI_ME_PCH15_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_RPL_S, MEI_ME_PCH15_SPS_CFG)}, {MEI_PCI_DEVICE(MEI_DEV_ID_MTL_M, MEI_ME_PCH15_CFG)}, {MEI_PCI_DEVICE(MEI_DEV_ID_ARL_S, MEI_ME_PCH15_CFG)},
Greg Kroah-Hartman
maintainerPATCH 66/138 speakup: Avoid crash on very long word
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Thibault <[email protected]>
commit c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1 upstream.
In case a console is set up really large and contains a really long word (> 256 characters), we have to stop before the length of the word buffer.
--- drivers/accessibility/speakup/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/accessibility/speakup/main.c +1 -1
@@ -576,7 +576,7 @@ static u_long get_word(struct vc_data *v } attr_ch =get_char (vc, (u_short *)tmp_pos, &spk_attr); buf[cnt++] = attr_ch; -while (tmpx < vc->vc_cols -1 ) { +while (tmpx < vc->vc_cols -1 && cnt <sizeof (buf) -1 ) { tmp_pos +=2 ; tmpx++; ch =get_char (vc, (u_short *)tmp_pos, &temp);
Greg Kroah-Hartman
maintainerPATCH 67/138 fs: sysfs: Fix reference leak in sysfs_break_active_protection()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit a90bca2228c0646fc29a72689d308e5fe03e6d78 upstream.
The sysfs_break_active_protection() routine has an obvious reference leak in its error path. If the call to kernfs_find_and_get() fails then kn will be NULL, so the companion sysfs_unbreak_active_protection() routine won't get called (and would only cause an access violation by trying to dereference kn->parent if it was called). As a result, the reference to kobj acquired at the start of the function will never be released.
Fix the leak by adding an explicit kobject_put() call when kn is NULL.
--- fs/sysfs/file.c | 2 ++ 1 file changed, 2 insertions(+)
fs/sysfs/file.c +2 -0
@@ -429,6 +429,8 @@ struct kernfs_node *sysfs_break_active_p kn =kernfs_find_and_get (kobj->sd, attr->name);if (kn)kernfs_break_active_protection (kn); +else +kobject_put (kobj);return kn; }EXPORT_SYMBOL_GPL (sysfs_break_active_protection);
Greg Kroah-Hartman
maintainerPATCH 68/138 init/main.c: Fix potential static_command_line memory overflow
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Wang <[email protected]>
commit 46dad3c1e57897ab9228332f03e1c14798d2d3b9 upstream.
We allocate memory of size 'xlen + strlen(boot_command_line) + 1' for static_command_line, but the strings copied into static_command_line are extra_command_line and command_line, rather than extra_command_line and boot_command_line.
When strlen(command_line) > strlen(boot_command_line), static_command_line will overflow.
This patch just recovers strlen(command_line) which was miss-consolidated with strlen(boot_command_line) in the commit f5c7310ac73e ("init/main: add checks for the return value of memblock_alloc*()")
--- init/main.c | 2 ++ 1 file changed, 2 insertions(+)
init/main.c +2 -0
@@ -627,6 +627,8 @@ static void __init setup_command_line(chif (!saved_command_line)panic ("%s: Failed to allocate %zu bytes\n" , __func__, len + ilen); + len = xlen +strlen (command_line) +1 ; + static_command_line =memblock_alloc (len,SMP_CACHE_BYTES );if (!static_command_line)panic ("%s: Failed to allocate %zu bytes\n" , __func__, len);
Greg Kroah-Hartman
maintainerPATCH 69/138 drm/amdgpu: validate the parameters of bo mapping operations more clearly
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: xinhui pan <[email protected]>
commit 6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75 upstream.
Verify the parameters of amdgpu_vm_bo_(map/replace_map/clearing_mappings) in one common place.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 72 +++++++++++++++++++++------------ 1 file changed, 46 insertions(+), 26 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +46 -26
@@ -2201,6 +2201,37 @@ static void amdgpu_vm_bo_insert_map(strutrace_amdgpu_vm_bo_map (bo_va, mapping); } +/* Validate operation parameters to prevent potential abuse */ +static int amdgpu_vm_verify_parameters (struct amdgpu_device *adev, +struct amdgpu_bo *bo, +uint64_t saddr, +uint64_t offset, +uint64_t size) +{ +uint64_t tmp, lpfn; + +if (saddr &AMDGPU_GPU_PAGE_MASK + || offset &AMDGPU_GPU_PAGE_MASK + || size &AMDGPU_GPU_PAGE_MASK ) +return -EINVAL ; + +if (check_add_overflow (saddr, size, &tmp) + ||check_add_overflow (offset, size, &tmp) + || size ==0 /* which also leads to end < begin */ ) +return -EINVAL ; + +/* make sure object fit at this offset */ +if (bo && offset + size >amdgpu_bo_size (bo)) +return -EINVAL ; + +/* Ensure last pfn not exceed max_pfn */ + lpfn = (saddr + size -1 ) >>AMDGPU_GPU_PAGE_SHIFT ; +if (lpfn >= adev->vm_manager.max_pfn) +return -EINVAL ; + +return 0 ; +} +/** * amdgpu_vm_bo_map - map bo inside a vm *
@@ -2227,21 +2258,14 @@ int amdgpu_vm_bo_map(struct amdgpu_devicstruct amdgpu_bo *bo = bo_va->base.bo;struct amdgpu_vm *vm = bo_va->base.vm;uint64_t eaddr; +int r; -/* validate the parameters */ -if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || size & ~PAGE_MASK ) -return -EINVAL ; -if (saddr + size <= saddr || offset + size <= offset) -return -EINVAL ; - -/* make sure object fit at this offset */ - eaddr = saddr + size -1 ; -if ((bo && offset + size >amdgpu_bo_size (bo)) || - (eaddr >= adev->vm_manager.max_pfn <<AMDGPU_GPU_PAGE_SHIFT )) -return -EINVAL ; + r =amdgpu_vm_verify_parameters (adev, bo, saddr, offset, size); +if (r) +return r; saddr /=AMDGPU_GPU_PAGE_SIZE ; - eaddr /=AMDGPU_GPU_PAGE_SIZE ; + eaddr = saddr + (size -1 ) /AMDGPU_GPU_PAGE_SIZE ; tmp =amdgpu_vm_it_iter_first (&vm->va, saddr, eaddr);if (tmp) {
@@ -2294,17 +2318,9 @@ int amdgpu_vm_bo_replace_map(struct amdguint64_t eaddr;int r; -/* validate the parameters */ -if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || size & ~PAGE_MASK ) -return -EINVAL ; -if (saddr + size <= saddr || offset + size <= offset) -return -EINVAL ; - -/* make sure object fit at this offset */ - eaddr = saddr + size -1 ; -if ((bo && offset + size >amdgpu_bo_size (bo)) || - (eaddr >= adev->vm_manager.max_pfn <<AMDGPU_GPU_PAGE_SHIFT )) -return -EINVAL ; + r =amdgpu_vm_verify_parameters (adev, bo, saddr, offset, size); +if (r) +return r;/* Allocate all the needed memory */ mapping =kmalloc (sizeof (*mapping),GFP_KERNEL );
@@ -2318,7 +2334,7 @@ int amdgpu_vm_bo_replace_map(struct amdg } saddr /=AMDGPU_GPU_PAGE_SIZE ; - eaddr /=AMDGPU_GPU_PAGE_SIZE ; + eaddr = saddr + (size -1 ) /AMDGPU_GPU_PAGE_SIZE ; mapping->start = saddr; mapping->last = eaddr;
@@ -2405,10 +2421,14 @@ int amdgpu_vm_bo_clear_mappings(struct astruct amdgpu_bo_va_mapping *before, *after, *tmp, *next;LIST_HEAD (removed);uint64_t eaddr; +int r; + + r =amdgpu_vm_verify_parameters (adev,NULL , saddr,0 , size); +if (r) +return r; - eaddr = saddr + size -1 ; saddr /=AMDGPU_GPU_PAGE_SIZE ; - eaddr /=AMDGPU_GPU_PAGE_SIZE ; + eaddr = saddr + (size -1 ) /AMDGPU_GPU_PAGE_SIZE ;/* Allocate all the needed memory */ before =kzalloc (sizeof (*before),GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 70/138 nouveau: fix instmem race condition around ptr stores
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Airlie <[email protected]>
commit fff1386cc889d8fb4089d285f883f8cba62d82ce upstream.
Running a lot of VK CTS in parallel against nouveau, once every few hours you might see something like this crash.
BUG: kernel NULL pointer dereference, address: 0000000000000008 PGD 8000000114e6e067 P4D 8000000114e6e067 PUD 109046067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 7 PID: 53891 Comm: deqp-vk Not tainted 6.8.0-rc6+ #27 Hardware name: Gigabyte Technology Co., Ltd. Z390 I AORUS PRO WIFI/Z390 I AORUS PRO WIFI-CF, BIOS F8 11/05/2021 RIP: 0010:gp100_vmm_pgt_mem+0xe3/0x180 [nouveau] Code: c7 48 01 c8 49 89 45 58 85 d2 0f 84 95 00 00 00 41 0f b7 46 12 49 8b 7e 08 89 da 42 8d 2c f8 48 8b 47 08 41 83 c7 01 48 89 ee <48> 8b 40 08 ff d0 0f 1f 00 49 8b 7e 08 48 89 d9 48 8d 75 04 48 c1 RSP: 0000:ffffac20c5857838 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 00000000004d8001 RCX: 0000000000000001 RDX: 00000000004d8001 RSI: 00000000000006d8 RDI: ffffa07afe332180 RBP: 00000000000006d8 R08: ffffac20c5857ad0 R09: 0000000000ffff10 R10: 0000000000000001 R11: ffffa07af27e2de0 R12: 000000000000001c R13: ffffac20c5857ad0 R14: ffffa07a96fe9040 R15: 000000000000001c FS: 00007fe395eed7c0(0000) GS:ffffa07e2c980000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 000000011febe001 CR4: 00000000003706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace:
...
? gp100_vmm_pgt_mem+0xe3/0x180 [nouveau] ? gp100_vmm_pgt_mem+0x37/0x180 [nouveau] nvkm_vmm_iter+0x351/0xa20 [nouveau] ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] ? __lock_acquire+0x3ed/0x2170 ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] nvkm_vmm_ptes_get_map+0xc2/0x100 [nouveau] ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] nvkm_vmm_map_locked+0x224/0x3a0 [nouveau]
Adding any sort of useful debug usually makes it go away, so I hand wrote the function in a line, and debugged the asm.
Every so often pt->memory->ptrs is NULL. This ptrs ptr is set in the nv50_instobj_acquire called from nvkm_kmap.
If Thread A and Thread B both get to nv50_instobj_acquire around the same time, and Thread A hits the refcount_set line, and in lockstep thread B succeeds at refcount_inc_not_zero, there is a chance the ptrs value won't have been stored since refcount_set is unordered. Force a memory barrier here, I picked smp_mb, since we want it on all CPUs and it's write followed by a read.
v2: use paired smp_rmb/smp_wmb.
--- drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c +6 -1
@@ -221,8 +221,11 @@ nv50_instobj_acquire(struct nvkm_memoryvoid __iomem *map =NULL ;/* Already mapped? */ -if (refcount_inc_not_zero (&iobj->maps)) +if (refcount_inc_not_zero (&iobj->maps)) { +/* read barrier match the wmb on refcount set */ +smp_rmb ();return iobj->map; + }/* Take the lock, and re-check that another thread hasn't * already mapped the object in the meantime.
@@ -249,6 +252,8 @@ nv50_instobj_acquire(struct nvkm_memory iobj->base.memory.ptrs = &nv50_instobj_fast; else iobj->base.memory.ptrs = &nv50_instobj_slow; +/* barrier to ensure the ptrs are written before refcount is set */ +smp_wmb ();refcount_set (&iobj->maps,1 ); }
Greg Kroah-Hartman
maintainerPATCH 71/138 nilfs2: fix OOB in nilfs_set_de_type
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
commit c4a7dc9523b59b3e73fd522c73e95e072f876b16 upstream.
The size of the nilfs_type_by_mode array in the fs/nilfs2/dir.c file is defined as "S_IFMT >> S_SHIFT", but the nilfs_set_de_type() function, which uses this array, specifies the index to read from the array in the same way as "(mode & S_IFMT) >> S_SHIFT".
static void nilfs_set_de_type(struct nilfs_dir_entry *de, struct inode
*inode)
{
umode_t mode = inode->i_mode;
de->file_type = nilfs_type_by_mode[(mode & S_IFMT)>>S_SHIFT]; // oob
}However, when the index is determined this way, an out-of-bounds (OOB) error occurs by referring to an index that is 1 larger than the array size when the condition "mode & S_IFMT == S_IFMT" is satisfied. Therefore, a patch to resize the nilfs_type_by_mode array should be applied to prevent OOB errors.
--- fs/nilfs2/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nilfs2/dir.c +1 -1
@@ -243,7 +243,7 @@ nilfs_filetype_table[NILFS_FT_MAX] = {#define S_SHIFT 12static unsigned char -nilfs_type_by_mode[S_IFMT >>S_SHIFT ] = { +nilfs_type_by_mode[(S_IFMT >>S_SHIFT ) +1 ] = { [S_IFREG >>S_SHIFT ] =NILFS_FT_REG_FILE , [S_IFDIR >>S_SHIFT ] =NILFS_FT_DIR , [S_IFCHR >>S_SHIFT ] =NILFS_FT_CHRDEV ,
Greg Kroah-Hartman
maintainerPATCH 72/138 arm64: dts: rockchip: fix alphabetical ordering RK3399 puma
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Iskander Amara <[email protected]>
[ Upstream commit f0abb4b2c7acf3c3e4130dc3f54cd90cf2ae62bc ]
Nodes overridden by their reference should be ordered alphabetically to make it easier to read the DTS. pinctrl node is defined in the wrong location so let's reorder it.
Stable-dep-of: 945a7c857091 ("arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma")
--- arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +9 -9
@@ -430,15 +430,6 @@ gpio1830-supply = <&vcc_1v8>; }; -&pmu_io_domains { - status = "okay"; - pmu1830-supply = <&vcc_1v8>; -}; - -&pwm2 { - status = "okay"; -}; - &pinctrl { i2c8 { i2c8_xfer_a: i2c8-xfer {
@@ -470,6 +461,15 @@ }; }; +&pmu_io_domains { + status = "okay"; + pmu1830-supply = <&vcc_1v8>; +}; + +&pwm2 { + status = "okay"; +}; + &sdhci { /* * Signal integrity isn't great at 200MHz but 100MHz has proven stable
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/138 arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quentin Schulz <[email protected]>
[ Upstream commit 945a7c8570916650a415757d15d83e0fa856a686 ]
The PCIE_WAKE# has a diode used as a level-shifter, and is used as an input pin. While the SoC default is to enable the pull-up, the core rk3399 pinconf for this pin opted for pull-none. So as to not disturb the behaviour of other boards which may rely on pull-none instead of pull-up, set the needed pull-up only for RK3399 Puma.
--- arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 5 +++++ 1 file changed, 5 insertions(+)
arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +5 -0
@@ -430,6 +430,11 @@ gpio1830-supply = <&vcc_1v8>; }; +&pcie_clkreqn_cpm { + rockchip,pins = + <2 RK_PD2 RK_FUNC_GPIO &pcfg_pull_up>; +}; + &pinctrl { i2c8 { i2c8_xfer_a: i2c8-xfer {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/138 arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro dts
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragan Simic <[email protected]>
[ Upstream commit 43853e843aa6c3d47ff2b0cce898318839483d05 ]
Remove a redundant node from the Pine64 Pinebook Pro dts, which is intended to provide a value for the delay in PCI Express enumeration, but that isn't supported without additional out-of-tree kernel patches.
There were already efforts to upstream those kernel patches, because they reportedly make some PCI Express cards (such as LSI SAS HBAs) usable in Pine64 RockPro64 (which is also based on the RK3399); otherwise, those PCI Express cards fail to enumerate. However, providing the required background and explanations proved to be a tough nut to crack, which is the reason why those patches remain outside of the kernel mainline for now.
If those out-of-tree patches eventually become upstreamed, the resulting device-tree changes will almost surely belong to the RK3399 SoC dtsi. Also, the above-mentioned unusable-without-out-of-tree-patches PCI Express devices are in all fairness not usable in a Pinebook Pro without some extensive hardware modifications, which is another reason to delete this redundant node. When it comes to the Pinebook Pro, only M.2 NVMe SSDs can be installed out of the box (using an additional passive adapter PCB sold separately by Pine64), which reportedly works fine with no additional patches.
--- arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts | 1 - 1 file changed, 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +0 -1
@@ -784,7 +784,6 @@ }; &pcie0 { - bus-scan-delay-ms = <1000>; ep-gpios = <&gpio2 RK_PD4 GPIO_ACTIVE_HIGH>; num-lanes = <4>; pinctrl-names = "default";
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/138 arm64: dts: mediatek: mt8183: Add power-domains properity to mfgcfg
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ikjoon Jang <[email protected]>
[ Upstream commit 1781f2c461804c0123f59afc7350e520a88edffb ]
mfgcfg clock is under MFG_ASYNC power domain.
--- arch/arm64/boot/dts/mediatek/mt8183.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/mediatek/mt8183.dtsi +1 -0
@@ -765,6 +765,7 @@ compatible = "mediatek,mt8183-mfgcfg", "syscon"; reg = <0 0x13000000 0 0x1000>; #clock-cells = <1>; + power-domains = <&spm MT8183_POWER_DOMAIN_MFG_ASYNC>; }; mmsys: syscon@14000000 {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/138 arm64: dts: mediatek: mt7622: add support for coherent DMA
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 3abd063019b6a01762f9fccc39505f29d029360a ]
It improves performance by eliminating the need for a cache flush on rx and tx
Stable-dep-of: 3ba5a6159434 ("arm64: dts: mediatek: mt7622: fix clock controllers")
--- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt7622.dtsi +3 -1
@@ -357,7 +357,7 @@ }; cci_control2: slave-if@5000 { - compatible = "arm,cci-400-ctrl-if"; + compatible = "arm,cci-400-ctrl-if", "syscon"; interface-type = "ace"; reg = <0x5000 0x1000>; };
@@ -937,6 +937,8 @@ power-domains = <&scpsys MT7622_POWER_DOMAIN_ETHSYS>; mediatek,ethsys = <ðsys>; mediatek,sgmiisys = <&sgmiisys>; + mediatek,cci-control = <&cci_control2>; + dma-coherent; #address-cells = <1>; #size-cells = <0>; status = "disabled";
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/138 arm64: dts: mediatek: mt7622: introduce nodes for Wireless Ethernet Dispatch
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit e9b65ecb7c3050dd34ee22ce17f1cf95e8405b15 ]
Introduce wed0 and wed1 nodes in order to enable offloading forwarding between ethernet and wireless devices on the mt7622 chipset.
Stable-dep-of: 3ba5a6159434 ("arm64: dts: mediatek: mt7622: fix clock controllers")
--- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 28 ++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
arch/arm64/boot/dts/mediatek/mt7622.dtsi +28 -0
@@ -893,6 +893,11 @@ }; }; + hifsys: syscon@1af00000 { + compatible = "mediatek,mt7622-hifsys", "syscon"; + reg = <0 0x1af00000 0 0x70>; + }; + ethsys: syscon@1b000000 { compatible = "mediatek,mt7622-ethsys", "syscon";
@@ -911,6 +916,26 @@ #dma-cells = <1>; }; + pcie_mirror: pcie-mirror@10000400 { + compatible = "mediatek,mt7622-pcie-mirror", + "syscon"; + reg = <0 0x10000400 0 0x10>; + }; + + wed0: wed@1020a000 { + compatible = "mediatek,mt7622-wed", + "syscon"; + reg = <0 0x1020a000 0 0x1000>; + interrupts = <GIC_SPI 214 IRQ_TYPE_LEVEL_LOW>; + }; + + wed1: wed@1020b000 { + compatible = "mediatek,mt7622-wed", + "syscon"; + reg = <0 0x1020b000 0 0x1000>; + interrupts = <GIC_SPI 215 IRQ_TYPE_LEVEL_LOW>; + }; + eth: ethernet@1b100000 { compatible = "mediatek,mt7622-eth", "mediatek,mt2701-eth",
@@ -938,6 +963,9 @@ mediatek,ethsys = <ðsys>; mediatek,sgmiisys = <&sgmiisys>; mediatek,cci-control = <&cci_control2>; + mediatek,wed = <&wed0>, <&wed1>; + mediatek,pcie-mirror = <&pcie_mirror>; + mediatek,hifsys = <&hifsys>; dma-coherent; #address-cells = <1>; #size-cells = <0>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/138 arm64: dts: mediatek: mt7622: fix clock controllers
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit 3ba5a61594347ab46e7c2cff6cd63ea0f1282efb ]
1. Drop unneeded "syscon"s (bindings were updated recently)
2. Use "clock-controller" in nodenames
3. Add missing "#clock-cells"
--- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 27 +++++++++++------------- 1 file changed, 12 insertions(+), 15 deletions(-)
arch/arm64/boot/dts/mediatek/mt7622.dtsi +12 -15
@@ -275,16 +275,14 @@ }; }; - apmixedsys: apmixedsys@10209000 { - compatible = "mediatek,mt7622-apmixedsys", - "syscon"; + apmixedsys: clock-controller@10209000 { + compatible = "mediatek,mt7622-apmixedsys"; reg = <0 0x10209000 0 0x1000>; #clock-cells = <1>; }; - topckgen: topckgen@10210000 { - compatible = "mediatek,mt7622-topckgen", - "syscon"; + topckgen: clock-controller@10210000 { + compatible = "mediatek,mt7622-topckgen"; reg = <0 0x10210000 0 0x1000>; #clock-cells = <1>; };
@@ -715,9 +713,8 @@ power-domains = <&scpsys MT7622_POWER_DOMAIN_WB>; }; - ssusbsys: ssusbsys@1a000000 { - compatible = "mediatek,mt7622-ssusbsys", - "syscon"; + ssusbsys: clock-controller@1a000000 { + compatible = "mediatek,mt7622-ssusbsys"; reg = <0 0x1a000000 0 0x1000>; #clock-cells = <1>; #reset-cells = <1>;
@@ -774,9 +771,8 @@ }; }; - pciesys: pciesys@1a100800 { - compatible = "mediatek,mt7622-pciesys", - "syscon"; + pciesys: clock-controller@1a100800 { + compatible = "mediatek,mt7622-pciesys"; reg = <0 0x1a100800 0 0x1000>; #clock-cells = <1>; #reset-cells = <1>;
@@ -893,12 +889,13 @@ }; }; - hifsys: syscon@1af00000 { - compatible = "mediatek,mt7622-hifsys", "syscon"; + hifsys: clock-controller@1af00000 { + compatible = "mediatek,mt7622-hifsys"; reg = <0 0x1af00000 0 0x70>; + #clock-cells = <1>; }; - ethsys: syscon@1b000000 { + ethsys: clock-controller@1b000000 { compatible = "mediatek,mt7622-ethsys", "syscon"; reg = <0 0x1b000000 0 0x1000>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/138 arm64: dts: mediatek: mt7622: fix IR nodename
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit 800dc93c3941e372c94278bf4059e6e82f60bd66 ]
Fix following validation error:arch/arm64/boot/dts/mediatek/mt7622-rfb1.dtb: cir@10009000: $nodename:0: 'cir@10009000' does not match '^ir(-receiver)?(@[a-f0-9]+)?$'
from schema $id: http://devicetree.org/schemas/media/mediatek,mt7622-cir.yaml#
--- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt7622.dtsi +1 -1
@@ -244,7 +244,7 @@ clock-names = "hif_sel"; }; - cir: cir@10009000 { + cir: ir-receiver@10009000 { compatible = "mediatek,mt7622-cir"; reg = <0 0x10009000 0 0x1000>; interrupts = <GIC_SPI 175 IRQ_TYPE_LEVEL_LOW>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/138 arm64: dts: mediatek: mt7622: fix ethernet controller "compatible"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit 208add29ce5b7291f6c466e4dfd9cbf61c72888e ]
Fix following validation error:arch/arm64/boot/dts/mediatek/mt7622-rfb1.dtb: ethernet@1b100000: compatible: ['mediatek,mt7622-eth', 'mediatek,mt2701-eth', 'syscon'] is too long
from schema $id: http://devicetree.org/schemas/net/mediatek,net.yaml#
(and other complains about wrong clocks).
--- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
arch/arm64/boot/dts/mediatek/mt7622.dtsi +1 -3
@@ -934,9 +934,7 @@ }; eth: ethernet@1b100000 { - compatible = "mediatek,mt7622-eth", - "mediatek,mt2701-eth", - "syscon"; + compatible = "mediatek,mt7622-eth"; reg = <0 0x1b100000 0 0x20000>; interrupts = <GIC_SPI 223 IRQ_TYPE_LEVEL_LOW>, <GIC_SPI 224 IRQ_TYPE_LEVEL_LOW>,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/138 arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit ecb5b0034f5bcc35003b4b965cf50c6e98316e79 ]
Binding doesn't specify "reset-names" property and Linux driver also doesn't use it.
Fix following validation error:arch/arm64/boot/dts/mediatek/mt7622-rfb1.dtb: thermal@1100b000: Unevaluated properties are not allowed ('reset-names' was unexpected)
from schema $id: http://devicetree.org/schemas/thermal/mediatek,thermal.yaml#
--- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 1 - 1 file changed, 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt7622.dtsi +0 -1
@@ -505,7 +505,6 @@ <&pericfg CLK_PERI_AUXADC_PD>; clock-names = "therm", "auxadc"; resets = <&pericfg MT7622_PERI_THERM_SW_RST>; - reset-names = "therm"; mediatek,auxadc = <&auxadc>; mediatek,apmixedsys = <&apmixedsys>; nvmem-cells = <&thermal_calibration>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/138 arm64: dts: mediatek: mt2712: fix validation errors
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit 3baac7291effb501c4d52df7019ebf52011e5772 ]
1. Fixup infracfg clock controller binding
It also acts as reset controller so #reset-cells is required.
2. Use -pins suffix for pinctrl
This fixes:arch/arm64/boot/dts/mediatek/mt2712-evb.dtb: syscon@10001000: '#reset-cells' is a required property
from schema $id: http://devicetree.org/schemas/arm/mediatek/mediatek,infracfg.yaml#arch/arm64/boot/dts/mediatek/mt2712-evb.dtb: pinctrl@1000b000: 'eth_default', 'eth_sleep', 'usb0_iddig', 'usb1_iddig' do not match any of the regexes: 'pinctrl-[0-9]+', 'pins$'
from schema $id: http://devicetree.org/schemas/pinctrl/mediatek,mt65xx-pinctrl.yaml#
--- arch/arm64/boot/dts/mediatek/mt2712-evb.dts | 8 ++++---- arch/arm64/boot/dts/mediatek/mt2712e.dtsi | 3 ++- 2 files changed, 6 insertions(+), 5 deletions(-)
arch/arm64/boot/dts/mediatek/mt2712-evb.dts +4 -4
@@ -127,7 +127,7 @@ }; &pio { - eth_default: eth_default { + eth_default: eth-default-pins { tx_pins { pinmux = <MT2712_PIN_71_GBE_TXD3__FUNC_GBE_TXD3>, <MT2712_PIN_72_GBE_TXD2__FUNC_GBE_TXD2>,
@@ -154,7 +154,7 @@ }; }; - eth_sleep: eth_sleep { + eth_sleep: eth-sleep-pins { tx_pins { pinmux = <MT2712_PIN_71_GBE_TXD3__FUNC_GPIO71>, <MT2712_PIN_72_GBE_TXD2__FUNC_GPIO72>,
@@ -180,14 +180,14 @@ }; }; - usb0_id_pins_float: usb0_iddig { + usb0_id_pins_float: usb0-iddig-pins { pins_iddig { pinmux = <MT2712_PIN_12_IDDIG_P0__FUNC_IDDIG_A>; bias-pull-up; }; }; - usb1_id_pins_float: usb1_iddig { + usb1_id_pins_float: usb1-iddig-pins { pins_iddig { pinmux = <MT2712_PIN_14_IDDIG_P1__FUNC_IDDIG_B>; bias-pull-up;
arch/arm64/boot/dts/mediatek/mt2712e.dtsi +2 -1
@@ -249,10 +249,11 @@ #clock-cells = <1>; }; - infracfg: syscon@10001000 { + infracfg: clock-controller@10001000 { compatible = "mediatek,mt2712-infracfg", "syscon"; reg = <0 0x10001000 0 0x1000>; #clock-cells = <1>; + #reset-cells = <1>; }; pericfg: syscon@10003000 {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/138 ARC: [plat-hsdk]: Remove misplaced interrupt-cells property
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Brodkin <[email protected]>
[ Upstream commit 61231eb8113ce47991f35024f9c20810b37996bf ]
"gmac" node stands for just an ordinary Ethernet controller, which is by no means a provider of interrupts, i.e. it doesn't serve as an interrupt controller, thus "#interrupt-cells" property doesn't belong to it and so we remove it.
Fixes:
------------>8------------
DTC arch/arc/boot/dts/hsdk.dtb
arch/arc/boot/dts/hsdk.dts:207.23-235.5: Warning (interrupt_provider): /soc/ethernet@8000: '#interrupt-cells' found, but node is not an interrupt provider arch/arc/boot/dts/hsdk.dtb: Warning (interrupt_map): Failed prerequisite 'interrupt_provider'
------------>8------------
--- arch/arc/boot/dts/hsdk.dts | 1 - 1 file changed, 1 deletion(-)
arch/arc/boot/dts/hsdk.dts +0 -1
@@ -205,7 +205,6 @@ }; gmac: ethernet@8000 { - #interrupt-cells = <1>; compatible = "snps,dwmac"; reg = <0x8000 0x2000>; interrupts = <10>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/138 wifi: iwlwifi: mvm: remove old PASN station when adding a new one
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avraham Stern <[email protected]>
[ Upstream commit dbfff5bf9292714f02ace002fea8ce6599ea1145 ]
If a PASN station is added, and an old PASN station already exists for the same mac address, remove the old station before adding the new one. Keeping the old station caueses old security context to be used in measurements.
--- drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c +2 -0
@@ -106,6 +106,8 @@ int iwl_mvm_ftm_add_pasn_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif,if (!pasn)return -ENOBUFS ; +iwl_mvm_ftm_remove_pasn_sta (mvm, addr); + pasn->cipher =iwl_mvm_cipher_to_location_cipher (cipher);switch (pasn->cipher) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/138 vxlan: drop packets from invalid src-address
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Bauer <[email protected]>
[ Upstream commit f58f45c1e5b92975e91754f5407250085a6ae7cf ]
The VXLAN driver currently does not check if the inner layer2 source-address is valid.
In case source-address snooping/learning is enabled, a entry in the FDB for the invalid address is created with the layer3 address of the tunnel endpoint.
If the frame happens to have a non-unicast address set, all this non-unicast traffic is subsequently not flooded to the tunnel network but sent to the learnt host in the FDB. To make matters worse, this FDB entry does not expire.
Apply the same filtering for packets as it is done for bridges. This not only drops these invalid packets but avoids them from being learnt into the FDB.
--- drivers/net/vxlan/vxlan_core.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/vxlan/vxlan_core.c +4 -0
@@ -1778,6 +1778,10 @@ static bool vxlan_set_mac(struct vxlan_dev *vxlan,if (ether_addr_equal (eth_hdr (skb)->h_source, vxlan->dev->dev_addr))return false; +/* Ignore packets from invalid src-address */ +if (!is_valid_ether_addr (eth_hdr (skb)->h_source)) +return false; +/* Get address from the outer IP header */ if (vxlan_get_sk_family (vs) ==AF_INET ) { saddr.sin.sin_addr.s_addr =ip_hdr (skb)->saddr;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/138 mlxsw: core: Unregister EMAD trap using FORWARD action
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 976c44af48141cd8595601c0af2a19a43c5b228b ]
The device's manual (PRM - Programmer's Reference Manual) classifies the trap that is used to deliver EMAD responses as an "event trap". Among other things, it means that the only actions that can be associated with the trap are TRAP and FORWARD (NOP).
Currently, during driver de-initialization the driver unregisters the trap by setting its action to DISCARD, which violates the above guideline. Future firmware versions will prevent such misuses by returning an error. This does not prevent the driver from working, but an error will be printed to the kernel log during module removal / devlink reload:
mlxsw_spectrum 0000:03:00.0: Reg cmd access status failed (status=7(bad parameter)) mlxsw_spectrum 0000:03:00.0: Reg cmd access failed (reg_id=7003(hpkt),type=write)
Suppress the error message by aligning the driver to the manual and use a FORWARD (NOP) action when unregistering the trap.
--- drivers/net/ethernet/mellanox/mlxsw/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlxsw/core.c +1 -1
@@ -697,7 +697,7 @@ static void mlxsw_emad_rx_listener_func(struct sk_buff *skb, u8 local_port,static const struct mlxsw_listener mlxsw_emad_rx_listener =MLXSW_RXL (mlxsw_emad_rx_listener_func,ETHEMAD ,TRAP_TO_CPU , false, -EMAD ,DISCARD ); +EMAD ,FORWARD );static int mlxsw_emad_init (struct mlxsw_core *mlxsw_core) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/138 NFC: trf7970a: disable all regulators on removal
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Geurts <[email protected]>
[ Upstream commit 6bea4f03c6a4e973ef369e15aac88f37981db49e ]
During module probe, regulator 'vin' and 'vdd-io' are used and enabled, but the vdd-io regulator overwrites the 'vin' regulator pointer. During remove, only the vdd-io is disabled, as the vin regulator pointer is not available anymore. When regulator_put() is called during resource cleanup a kernel warning is given, as the regulator is still enabled.
Store the two regulators in separate pointers and disable both the regulators on module remove.
--- drivers/nfc/trf7970a.c | 42 +++++++++++++++++++++++------------------- 1 file changed, 23 insertions(+), 19 deletions(-)
drivers/nfc/trf7970a.c +23 -19
@@ -424,7 +424,8 @@ struct trf7970a {enum trf7970a_state state;struct device *dev;struct spi_device *spi; -struct regulator *regulator; +struct regulator *vin_regulator; +struct regulator *vddio_regulator;struct nfc_digital_dev *ddev;u32 quirks;bool is_initiator;
@@ -1882,7 +1883,7 @@ static int trf7970a_power_up(struct trf7970a *trf)if (trf->state !=TRF7970A_ST_PWR_OFF )return 0 ; - ret =regulator_enable (trf->regulator); + ret =regulator_enable (trf->vin_regulator);if (ret) {dev_err (trf->dev,"%s - Can't enable VIN: %d\n" , __func__, ret);return ret;
@@ -1925,7 +1926,7 @@ static int trf7970a_power_down(struct trf7970a *trf)if (trf->en2_gpiod && !(trf->quirks &TRF7970A_QUIRK_EN2_MUST_STAY_LOW ))gpiod_set_value_cansleep (trf->en2_gpiod,0 ); - ret =regulator_disable (trf->regulator); + ret =regulator_disable (trf->vin_regulator);if (ret)dev_err (trf->dev,"%s - Can't disable VIN: %d\n" , __func__, ret);
@@ -2064,37 +2065,37 @@ static int trf7970a_probe(struct spi_device *spi)mutex_init (&trf->lock);INIT_DELAYED_WORK (&trf->timeout_work, trf7970a_timeout_work_handler); - trf->regulator =devm_regulator_get (&spi->dev,"vin" ); -if (IS_ERR (trf->regulator)) { - ret =PTR_ERR (trf->regulator); + trf->vin_regulator =devm_regulator_get (&spi->dev,"vin" ); +if (IS_ERR (trf->vin_regulator)) { + ret =PTR_ERR (trf->vin_regulator);dev_err (trf->dev,"Can't get VIN regulator: %d\n" , ret); goto err_destroy_lock; } - ret =regulator_enable (trf->regulator); + ret =regulator_enable (trf->vin_regulator);if (ret) {dev_err (trf->dev,"Can't enable VIN: %d\n" , ret); goto err_destroy_lock; } - uvolts =regulator_get_voltage (trf->regulator); + uvolts =regulator_get_voltage (trf->vin_regulator);if (uvolts >4000000 ) trf->chip_status_ctrl =TRF7970A_CHIP_STATUS_VRS5_3 ; - trf->regulator =devm_regulator_get (&spi->dev,"vdd-io" ); -if (IS_ERR (trf->regulator)) { - ret =PTR_ERR (trf->regulator); + trf->vddio_regulator =devm_regulator_get (&spi->dev,"vdd-io" ); +if (IS_ERR (trf->vddio_regulator)) { + ret =PTR_ERR (trf->vddio_regulator);dev_err (trf->dev,"Can't get VDD_IO regulator: %d\n" , ret); - goto err_destroy_lock; + goto err_disable_vin_regulator; } - ret =regulator_enable (trf->regulator); + ret =regulator_enable (trf->vddio_regulator);if (ret) {dev_err (trf->dev,"Can't enable VDD_IO: %d\n" , ret); - goto err_destroy_lock; + goto err_disable_vin_regulator; } -if (regulator_get_voltage (trf->regulator) ==1800000 ) { +if (regulator_get_voltage (trf->vddio_regulator) ==1800000 ) { trf->io_ctrl =TRF7970A_REG_IO_CTRL_IO_LOW ;dev_dbg (trf->dev,"trf7970a config vdd_io to 1.8V\n" ); }
@@ -2107,7 +2108,7 @@ static int trf7970a_probe(struct spi_device *spi)if (!trf->ddev) {dev_err (trf->dev,"Can't allocate NFC digital device\n" ); ret = -ENOMEM ; - goto err_disable_regulator; + goto err_disable_vddio_regulator; }nfc_digital_set_parent_dev (trf->ddev, trf->dev);
@@ -2136,8 +2137,10 @@ static int trf7970a_probe(struct spi_device *spi)trf7970a_shutdown (trf); err_free_ddev:nfc_digital_free_device (trf->ddev); -err_disable_regulator: -regulator_disable (trf->regulator); +err_disable_vddio_regulator: +regulator_disable (trf->vddio_regulator); +err_disable_vin_regulator: +regulator_disable (trf->vin_regulator); err_destroy_lock:mutex_destroy (&trf->lock);return ret;
@@ -2156,7 +2159,8 @@ static int trf7970a_remove(struct spi_device *spi)nfc_digital_unregister_device (trf->ddev);nfc_digital_free_device (trf->ddev); -regulator_disable (trf->regulator); +regulator_disable (trf->vddio_regulator); +regulator_disable (trf->vin_regulator);mutex_destroy (&trf->lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/138 ipv4: check for NULL idev in ip_route_use_hint()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 58a4c9b1e5a3e53c9148e80b90e1e43897ce77d1 ]
syzbot was able to trigger a NULL deref in fib_validate_source() in an old tree [1].
It appears the bug exists in latest trees.
All calls to __in_dev_get_rcu() must be checked for a NULL result.
[1]
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 2 PID: 3257 Comm: syz-executor.3 Not tainted 5.10.0-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:fib_validate_source+0xbf/0x15a0 net/ipv4/fib_frontend.c:425 Code: 18 f2 f2 f2 f2 42 c7 44 20 23 f3 f3 f3 f3 48 89 44 24 78 42 c6 44 20 27 f3 e8 5d 88 48 fc 4c 89 e8 48 c1 e8 03 48 89 44 24 18 <42> 80 3c 20 00 74 08 4c 89 ef e8 d2 15 98 fc 48 89 5c 24 10 41 bf RSP: 0018:ffffc900015fee40 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88800f7a4000 RCX: ffff88800f4f90c0 RDX: 0000000000000000 RSI: 0000000004001eac RDI: ffff8880160c64c0 RBP: ffffc900015ff060 R08: 0000000000000000 R09: ffff88800f7a4000 R10: 0000000000000002 R11: ffff88800f4f90c0 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88800f7a4000 FS: 00007f938acfe6c0(0000) GS:ffff888058c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f938acddd58 CR3: 000000001248e000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ip_route_use_hint+0x410/0x9b0 net/ipv4/route.c:2231 ip_rcv_finish_core+0x2c4/0x1a30 net/ipv4/ip_input.c:327 ip_list_rcv_finish net/ipv4/ip_input.c:612 [inline] ip_sublist_rcv+0x3ed/0xe50 net/ipv4/ip_input.c:638 ip_list_rcv+0x422/0x470 net/ipv4/ip_input.c:673 __netif_receive_skb_list_ptype net/core/dev.c:5572 [inline] __netif_receive_skb_list_core+0x6b1/0x890 net/core/dev.c:5620 __netif_receive_skb_list net/core/dev.c:5672 [inline] netif_receive_skb_list_internal+0x9f9/0xdc0 net/core/dev.c:5764 netif_receive_skb_list+0x55/0x3e0 net/core/dev.c:5816 xdp_recv_frames net/bpf/test_run.c:257 [inline] xdp_test_run_batch net/bpf/test_run.c:335 [inline] bpf_test_run_xdp_live+0x1818/0x1d00 net/bpf/test_run.c:363 bpf_prog_test_run_xdp+0x81f/0x1170 net/bpf/test_run.c:1376 bpf_prog_test_run+0x349/0x3c0 kernel/bpf/syscall.c:3736 __sys_bpf+0x45c/0x710 kernel/bpf/syscall.c:5115 __do_sys_bpf kernel/bpf/syscall.c:5201 [inline] __se_sys_bpf kernel/bpf/syscall.c:5199 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5199
--- net/ipv4/route.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv4/route.c +3 -0
@@ -2088,6 +2088,9 @@ int ip_route_use_hint(struct sk_buff *skb, __be32 daddr, __be32 saddr,int err = -EINVAL ;u32 tag =0 ; +if (!in_dev) +return -EINVAL ; +if (ipv4_is_multicast (saddr) ||ipv4_is_lbcast (saddr)) goto martian_source;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/138 net: usb: ax88179_178a: stop lying about skb->truesize
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 4ce62d5b2f7aecd4900e7d6115588ad7f9acccca ]
Some usb drivers try to set small skb->truesize and break core networking stacks.
In this patch, I removed one of the skb->truesize overide.
I also replaced one skb_clone() by an allocation of a fresh and small skb, to get minimally sized skbs, like we did in commit 1e2c61172342 ("net: cdc_ncm: reduce skb truesize in rx path")
--- drivers/net/usb/ax88179_178a.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-)
drivers/net/usb/ax88179_178a.c +3 -8
@@ -1558,21 +1558,16 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb)/* Skip IP alignment pseudo header */ skb_pull (skb,2 ); - skb->truesize =SKB_TRUESIZE (pkt_len_plus_padd);ax88179_rx_checksum (skb, pkt_hdr);return 1 ; } - ax_skb =skb_clone (skb,GFP_ATOMIC ); + ax_skb =netdev_alloc_skb_ip_align (dev->net, pkt_len);if (!ax_skb)return 0 ; -skb_trim (ax_skb, pkt_len); +skb_put (ax_skb, pkt_len); +memcpy (ax_skb->data, skb->data +2 , pkt_len); -/* Skip IP alignment pseudo header */ -skb_pull (ax_skb,2 ); - - skb->truesize = pkt_len_plus_padd + -SKB_DATA_ALIGN (sizeof (struct sk_buff ));ax88179_rx_checksum (ax_skb, pkt_hdr);usbnet_skb_return (dev, ax_skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/138 net: gtp: Fix Use-After-Free in gtp_dellink
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
[ Upstream commit f2a904107ee2b647bb7794a1a82b67740d7c8a64 ]
Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal of gtp_dellink, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free.
To prevent this, it should be changed to hlist_for_each_entry_safe.
--- drivers/net/gtp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/gtp.c +2 -1
@@ -700,11 +700,12 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,static void gtp_dellink (struct net_device *dev,struct list_head *head) {struct gtp_dev *gtp =netdev_priv (dev); +struct hlist_node *next;struct pdp_ctx *pctx;int i;for (i =0 ; i < gtp->hash_size; i++) -hlist_for_each_entry_rcu (pctx, >p->tid_hash[i], hlist_tid) +hlist_for_each_entry_safe (pctx, next, >p->tid_hash[i], hlist_tid)pdp_context_delete (pctx);list_del_rcu (>p->list);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/138 ipvs: Fix checksumming on GSO of SCTP packets
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ismael Luceno <[email protected]>
[ Upstream commit e10d3ba4d434ed172914617ed8d74bd411421193 ]
It was observed in the wild that pairs of consecutive packets would leave the IPVS with the same wrong checksum, and the issue only went away when disabling GSO.
IPVS needs to avoid computing the SCTP checksum when using GSO.
--- net/netfilter/ipvs/ip_vs_proto_sctp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/netfilter/ipvs/ip_vs_proto_sctp.c +4 -2
@@ -126,7 +126,8 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,if (sctph->source != cp->vport || payload_csum || skb->ip_summed ==CHECKSUM_PARTIAL ) { sctph->source = cp->vport; -sctp_nat_csum (skb, sctph, sctphoff); +if (!skb_is_gso (skb) || !skb_is_gso_sctp (skb)) +sctp_nat_csum (skb, sctph, sctphoff); }else { skb->ip_summed =CHECKSUM_UNNECESSARY ; }
@@ -174,7 +175,8 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, (skb->ip_summed == CHECKSUM_PARTIAL && !(skb_dst(skb)->dev->features & NETIF_F_SCTP_CRC))) { sctph->dest = cp->dport; -sctp_nat_csum (skb, sctph, sctphoff); +if (!skb_is_gso (skb) || !skb_is_gso_sctp (skb)) +sctp_nat_csum (skb, sctph, sctphoff); } else if (skb->ip_summed != CHECKSUM_PARTIAL) { skb->ip_summed =CHECKSUM_UNNECESSARY ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/138 net: openvswitch: Fix Use-After-Free in ovs_ct_exit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
[ Upstream commit 5ea7b72d4fac2fdbc0425cd8f2ea33abe95235b2 ]
Since kfree_rcu, which is called in the hlist_for_each_entry_rcu traversal of ovs_ct_limit_exit, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free.
To prevent this, it should be changed to hlist_for_each_entry_safe.
--- net/openvswitch/conntrack.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/openvswitch/conntrack.c +2 -2
@@ -1902,9 +1902,9 @@ static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net)for (i =0 ; i <CT_LIMIT_HASH_BUCKETS ; ++i) {struct hlist_head *head = &info->limits[i];struct ovs_ct_limit *ct_limit; +struct hlist_node *next; -hlist_for_each_entry_rcu (ct_limit, head, hlist_node, -lockdep_ovsl_is_held ()) +hlist_for_each_entry_safe (ct_limit, next, head, hlist_node)kfree_rcu (ct_limit, rcu); }kfree (info->limits);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/138 mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit d90cfe20562407d9f080d24123078d666d730707 ]
The purpose of the rehash delayed work is to reduce the number of masks (eRPs) used by an ACL region as the eRP bank is a global and limited resource.
This is done in three steps:
1. Creating a new set of masks and a new ACL region which will use the new masks and to which the existing filters will be migrated to. The new region is assigned to 'vregion->region' and the region from which the filters are migrated from is assigned to 'vregion->region2'.
2. Migrating all the filters from the old region to the new region.
3. Destroying the old region and setting 'vregion->region2' to NULL.
Only the second steps is performed under the 'vregion->lock' mutex although its comments says that among other things it "Protects consistency of region, region2 pointers".
This is problematic as the first step can race with filter insertion from user space that uses 'vregion->region', but under the mutex.
Fix by holding the mutex across the entirety of the delayed work and not only during the second step.
--- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +2 -2
@@ -713,7 +713,9 @@ static void mlxsw_sp_acl_tcam_vregion_rehash_work(struct work_struct *work) rehash.dw.work);int credits =MLXSW_SP_ACL_TCAM_VREGION_REHASH_CREDITS ; +mutex_lock (&vregion->lock);mlxsw_sp_acl_tcam_vregion_rehash (vregion->mlxsw_sp, vregion, &credits); +mutex_unlock (&vregion->lock);if (credits <0 )/* Rehash gone out of credits so it was interrupted. * Schedule the work as soon as possible to continue.
@@ -1353,7 +1355,6 @@ mlxsw_sp_acl_tcam_vregion_migrate(struct mlxsw_sp *mlxsw_sp,int err, err2;trace_mlxsw_sp_acl_tcam_vregion_migrate (mlxsw_sp, vregion); -mutex_lock (&vregion->lock); err =mlxsw_sp_acl_tcam_vchunk_migrate_all (mlxsw_sp, vregion, ctx, credits);if (err) {
@@ -1373,7 +1374,6 @@ mlxsw_sp_acl_tcam_vregion_migrate(struct mlxsw_sp *mlxsw_sp,/* Let the rollback to be continued later on. */ } } -mutex_unlock (&vregion->lock);trace_mlxsw_sp_acl_tcam_vregion_migrate_end (mlxsw_sp, vregion);return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/138 mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 79b5b4b18bc85b19d3a518483f9abbbe6d7b3ba4 ]
The rule activity update delayed work periodically traverses the list of configured rules and queries their activity from the device.
As part of this task it accesses the entry pointed by 'ventry->entry', but this entry can be changed concurrently by the rehash delayed work, leading to a use-after-free [1].
Fix by closing the race and perform the activity query under the 'vregion->lock' mutex.
[1]
BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140 Read of size 8 at addr ffff8881054ed808 by task kworker/0:18/181 CPU: 0 PID: 181 Comm: kworker/0:18 Not tainted 6.9.0-rc2-custom-00781-gd5ab772d32f7 #2 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_rule_activity_update_work Call Trace: <TASK> dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140 mlxsw_sp_acl_rule_activity_update_work+0x219/0x400 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 1039: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc+0x19c/0x360 mlxsw_sp_acl_tcam_entry_create+0x7b/0x1f0 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x30d/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 Freed by task 1039: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x102/0x170 __kasan_slab_free+0x14/0x30 kfree+0xc1/0x290 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3d7/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30
--- .../net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +8 -2
@@ -1189,8 +1189,14 @@ mlxsw_sp_acl_tcam_ventry_activity_get(struct mlxsw_sp *mlxsw_sp,struct mlxsw_sp_acl_tcam_ventry *ventry, bool *activity) { - return mlxsw_sp_acl_tcam_entry_activity_get(mlxsw_sp, - ventry->entry, activity); + struct mlxsw_sp_acl_tcam_vregion *vregion = ventry->vchunk->vregion; +int err; + +mutex_lock (&vregion->lock); + err =mlxsw_sp_acl_tcam_entry_activity_get (mlxsw_sp, ventry->entry, + activity); +mutex_unlock (&vregion->lock); +return err; } static int
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/138 mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 54225988889931467a9b55fdbef534079b665519 ]
The rehash delayed work migrates filters from one region to another according to the number of available credits.
The migrated from region is destroyed at the end of the work if the number of credits is non-negative as the assumption is that this is indicative of migration being complete. This assumption is incorrect as a non-negative number of credits can also be the result of a failed migration.
The destruction of a region that still has filters referencing it can result in a use-after-free [1].
Fix by not destroying the region if migration failed.
[1]
BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 Read of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858 CPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G W 6.9.0-rc2-custom-00782-gf2275c2157d8 #5 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work Call Trace: <TASK> dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70 mlxsw_sp_acl_atcam_entry_del+0x81/0x210 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 174: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc+0x19c/0x360 mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0 mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 Freed by task 7: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x102/0x170 __kasan_slab_free+0x14/0x30 kfree+0xc1/0x290 mlxsw_sp_acl_tcam_region_destroy+0x272/0x310 mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30
--- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +1 -0
@@ -1481,6 +1481,7 @@ mlxsw_sp_acl_tcam_vregion_rehash(struct mlxsw_sp *mlxsw_sp, ctx, credits);if (err) {dev_err (mlxsw_sp->bus_info->dev,"Failed to migrate vregion\n" ); +return ; }if (*credits >=0 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/138 mlxsw: spectrum_acl_tcam: Rate limit error message
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 5bcf925587e9b5d36420d572a0b4d131c90fb306 ]
In the rare cases when the device resources are exhausted it is likely that the rehash delayed work will fail. An error message will be printed whenever this happens which can be overwhelming considering the fact that the work is per-region and that there can be hundreds of regions.
Fix by rate limiting the error message.
--- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +1 -1
@@ -1480,7 +1480,7 @@ mlxsw_sp_acl_tcam_vregion_rehash(struct mlxsw_sp *mlxsw_sp, err =mlxsw_sp_acl_tcam_vregion_migrate (mlxsw_sp, vregion, ctx, credits);if (err) { -dev_err (mlxsw_sp->bus_info->dev,"Failed to migrate vregion\n" ); +dev_err_ratelimited (mlxsw_sp->bus_info->dev,"Failed to migrate vregion\n" );return ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/138 mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 8ca3f7a7b61393804c46f170743c3b839df13977 ]
The rehash delayed work migrates filters from one region to another. This is done by iterating over all chunks (all the filters with the same priority) in the region and in each chunk iterating over all the filters.
If the migration fails, the code tries to migrate the filters back to the old region. However, the rollback itself can also fail in which case another migration will be erroneously performed. Besides the fact that this ping pong is not a very good idea, it also creates a problem.
Each virtual chunk references two chunks: The currently used one ('vchunk->chunk') and a backup ('vchunk->chunk2'). During migration the first holds the chunk we want to migrate filters to and the second holds the chunk we are migrating filters from.
The code currently assumes - but does not verify - that the backup chunk does not exist (NULL) if the currently used chunk does not reference the target region. This assumption breaks when we are trying to rollback a rollback, resulting in the backup chunk being overwritten and leaked [1].
Fix by not rolling back a failed rollback and add a warning to avoid future cases.
[1]
WARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20 Modules linked in: CPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G W 6.9.0-rc2-custom-00784-gc6a05c468a0b #14 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:parman_destroy+0x17/0x20 [...] Call Trace: <TASK> mlxsw_sp_acl_atcam_region_fini+0x19/0x60 mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0 mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK>
--- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +4 -0
@@ -1230,6 +1230,8 @@ mlxsw_sp_acl_tcam_vchunk_migrate_start(struct mlxsw_sp *mlxsw_sp, {struct mlxsw_sp_acl_tcam_chunk *new_chunk; +WARN_ON (vchunk->chunk2); + new_chunk =mlxsw_sp_acl_tcam_chunk_create (mlxsw_sp, vchunk, region);if (IS_ERR (new_chunk))return PTR_ERR (new_chunk);
@@ -1364,6 +1366,8 @@ mlxsw_sp_acl_tcam_vregion_migrate(struct mlxsw_sp *mlxsw_sp, err =mlxsw_sp_acl_tcam_vchunk_migrate_all (mlxsw_sp, vregion, ctx, credits);if (err) { +if (ctx->this_is_rollback) +return err;/* In case migration was not successful, we need to swap * so the original region pointer is assigned again * to vregion->region.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/138 mlxsw: spectrum_acl_tcam: Fix warning during rehash
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 743edc8547a92b6192aa1f1b6bb78233fa21dc9b ]
As previously explained, the rehash delayed work migrates filters from one region to another. This is done by iterating over all chunks (all the filters with the same priority) in the region and in each chunk iterating over all the filters.
When the work runs out of credits it stores the current chunk and entry as markers in the per-work context so that it would know where to resume the migration from the next time the work is scheduled.
Upon error, the chunk marker is reset to NULL, but without resetting the entry markers despite being relative to it. This can result in migration being resumed from an entry that does not belong to the chunk being migrated. In turn, this will eventually lead to a chunk being iterated over as if it is an entry. Because of how the two structures happen to be defined, this does not lead to KASAN splats, but to warnings such as [1].
Fix by creating a helper that resets all the markers and call it from all the places the currently only reset the chunk marker. For good measures also call it when starting a completely new rehash. Add a warning to avoid future cases.
[1]
WARNING: CPU: 7 PID: 1076 at drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.c:407 mlxsw_afk_encode+0x242/0x2f0 Modules linked in: CPU: 7 PID: 1076 Comm: kworker/7:24 Tainted: G W 6.9.0-rc3-custom-00880-g29e61d91b77b #29 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:mlxsw_afk_encode+0x242/0x2f0 [...] Call Trace: <TASK> mlxsw_sp_acl_atcam_entry_add+0xd9/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x109/0x290 mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x470 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 </TASK>
--- .../mellanox/mlxsw/spectrum_acl_tcam.c | 20 ++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +17 -3
@@ -725,6 +725,17 @@ static void mlxsw_sp_acl_tcam_vregion_rehash_work(struct work_struct *work)mlxsw_sp_acl_tcam_vregion_rehash_work_schedule (vregion); } +static void +mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset (struct mlxsw_sp_acl_tcam_rehash_ctx *ctx) +{ +/* The entry markers are relative to the current chunk and therefore +* needs to be reset together with the chunk marker. +*/ + ctx->current_vchunk =NULL ; + ctx->start_ventry =NULL ; + ctx->stop_ventry =NULL ; +} +static void mlxsw_sp_acl_tcam_rehash_ctx_vchunk_changed (struct mlxsw_sp_acl_tcam_vchunk *vchunk) {
@@ -747,7 +758,7 @@ mlxsw_sp_acl_tcam_rehash_ctx_vregion_changed(struct mlxsw_sp_acl_tcam_vregion *v* the current chunk pointer to make sure all chunks * are properly migrated. */ - vregion->rehash.ctx.current_vchunk =NULL ; +mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset (&vregion->rehash.ctx); } static struct mlxsw_sp_acl_tcam_vregion *
@@ -1250,7 +1261,7 @@ mlxsw_sp_acl_tcam_vchunk_migrate_end(struct mlxsw_sp *mlxsw_sp, {mlxsw_sp_acl_tcam_chunk_destroy (mlxsw_sp, vchunk->chunk2); vchunk->chunk2 =NULL ; - ctx->current_vchunk =NULL ; +mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset (ctx); } static int
@@ -1282,6 +1293,8 @@ mlxsw_sp_acl_tcam_vchunk_migrate_one(struct mlxsw_sp *mlxsw_sp, ventry =list_first_entry (&vchunk->ventry_list,typeof (*ventry), list); +WARN_ON (ventry->vchunk != vchunk); +list_for_each_entry_from (ventry, &vchunk->ventry_list, list) {/* During rollback, once we reach the ventry that failed * to migrate, we are done.
@@ -1373,7 +1386,7 @@ mlxsw_sp_acl_tcam_vregion_migrate(struct mlxsw_sp *mlxsw_sp,* to vregion->region. */ swap (vregion->region, vregion->region2); - ctx->current_vchunk =NULL ; +mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset (ctx); ctx->this_is_rollback = true; err2 =mlxsw_sp_acl_tcam_vchunk_migrate_all (mlxsw_sp, vregion, ctx, credits);
@@ -1432,6 +1445,7 @@ mlxsw_sp_acl_tcam_vregion_rehash_start(struct mlxsw_sp *mlxsw_sp, ctx->hints_priv = hints_priv; ctx->this_is_rollback = false; +mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset (ctx);return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/138 mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit b377add0f0117409c418ddd6504bd682ebe0bf79 ]
Both the function that migrates all the chunks within a region and the function that migrates all the entries within a chunk call list_first_entry() on the respective lists without checking that the lists are not empty. This is incorrect usage of the API, which leads to the following warning [1].
Fix by returning if the lists are empty as there is nothing to migrate in this case.
[1]
WARNING: CPU: 0 PID: 6437 at drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c:1266 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0> Modules linked in: CPU: 0 PID: 6437 Comm: kworker/0:37 Not tainted 6.9.0-rc3-custom-00883-g94a65f079ef6 #39 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0x2c0 [...] Call Trace: <TASK> mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x4a0 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK>
--- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +7 -0
@@ -1284,6 +1284,9 @@ mlxsw_sp_acl_tcam_vchunk_migrate_one(struct mlxsw_sp *mlxsw_sp,return 0 ; } +if (list_empty (&vchunk->ventry_list)) + goto out; +/* If the migration got interrupted, we have the ventry to start from * stored in context. */
@@ -1335,6 +1338,7 @@ mlxsw_sp_acl_tcam_vchunk_migrate_one(struct mlxsw_sp *mlxsw_sp, } } +out:mlxsw_sp_acl_tcam_vchunk_migrate_end (mlxsw_sp, vchunk, ctx);return 0 ; }
@@ -1348,6 +1352,9 @@ mlxsw_sp_acl_tcam_vchunk_migrate_all(struct mlxsw_sp *mlxsw_sp,struct mlxsw_sp_acl_tcam_vchunk *vchunk;int err; +if (list_empty (&vregion->vchunk_list)) +return 0 ; +/* If the migration got interrupted, we have the vchunk * we are working on stored in context. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/138 mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit fb4e2b70a7194b209fc7320bbf33b375f7114bd5 ]
The rehash delayed work is rescheduled with a delay if the number of credits at end of the work is not negative as supposedly it means that the migration ended. Otherwise, it is rescheduled immediately.
After "mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash" the above is no longer accurate as a non-negative number of credits is no longer indicative of the migration being done. It can also happen if the work encountered an error in which case the migration will resume the next time the work is scheduled.
The significance of the above is that it is possible for the work to be pending and associated with hints that were allocated when the migration started. This leads to the hints being leaked [1] when the work is canceled while pending as part of ACL region dismantle.
Fix by freeing the hints if hints are associated with a work that was canceled while pending.
Blame the original commit since the reliance on not having a pending work associated with hints is fragile.
[1]
unreferenced object 0xffff88810e7c3000 (size 256):
comm "kworker/0:16", pid 176, jiffies 4295460353 hex dump (first 32 bytes):
00 30 95 11 81 88 ff ff 61 00 00 00 00 00 00 80 .0......a.......
00 00 61 00 40 00 00 00 00 00 00 00 04 00 00 00 ..a.@...........
backtrace (crc 2544ddb9):
[<00000000cf8cfab3>] kmalloc_trace+0x23f/0x2a0
[<000000004d9a1ad9>] objagg_hints_get+0x42/0x390
[<000000000b143cf3>] mlxsw_sp_acl_erp_rehash_hints_get+0xca/0x400
[<0000000059bdb60a>] mlxsw_sp_acl_tcam_vregion_rehash_work+0x868/0x1160
[<00000000e81fd734>] process_one_work+0x59c/0xf20
[<00000000ceee9e81>] worker_thread+0x799/0x12c0
[<00000000bda6fe39>] kthread+0x246/0x300
[<0000000070056d23>] ret_from_fork+0x34/0x70
[<00000000dea2b93e>] ret_from_fork_asm+0x1a/0x30--- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +5 -1
@@ -831,10 +831,14 @@ mlxsw_sp_acl_tcam_vregion_destroy(struct mlxsw_sp *mlxsw_sp,struct mlxsw_sp_acl_tcam *tcam = vregion->tcam;if (vgroup->vregion_rehash_enabled && ops->region_rehash_hints_get) { +struct mlxsw_sp_acl_tcam_rehash_ctx *ctx = &vregion->rehash.ctx; +mutex_lock (&tcam->lock);list_del (&vregion->tlist);mutex_unlock (&tcam->lock); -cancel_delayed_work_sync (&vregion->rehash.dw); +if (cancel_delayed_work_sync (&vregion->rehash.dw) && + ctx->hints_priv) + ops->region_rehash_hints_put (ctx->hints_priv); }mlxsw_sp_acl_tcam_vgroup_vregion_detach (mlxsw_sp, vregion);if (vregion->region2)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/138 netfilter: nf_tables: honor table dormant flag from netdev release event path
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 8e30abc9ace4f0add4cd761dfdbfaebae5632dd2 ]
Check for table dormant flag otherwise netdev release event path tries to unregister an already unregistered hook.
[524854.857999] ------------[ cut here ]------------ [524854.858010] WARNING: CPU: 0 PID: 3386599 at net/netfilter/core.c:501 __nf_unregister_net_hook+0x21a/0x260 [...] [524854.858848] CPU: 0 PID: 3386599 Comm: kworker/u32:2 Not tainted 6.9.0-rc3+ #365 [524854.858869] Workqueue: netns cleanup_net [524854.858886] RIP: 0010:__nf_unregister_net_hook+0x21a/0x260 [524854.858903] Code: 24 e8 aa 73 83 ff 48 63 43 1c 83 f8 01 0f 85 3d ff ff ff e8 98 d1 f0 ff 48 8b 3c 24 e8 8f 73 83 ff 48 63 43 1c e9 26 ff ff ff <0f> 0b 48 83 c4 18 48 c7 c7 00 68 e9 82 5b 5d 41 5c 41 5d 41 5e 41 [524854.858914] RSP: 0018:ffff8881e36d79e0 EFLAGS: 00010246 [524854.858926] RAX: 0000000000000000 RBX: ffff8881339ae790 RCX: ffffffff81ba524a [524854.858936] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff8881c8a16438 [524854.858945] RBP: ffff8881c8a16438 R08: 0000000000000001 R09: ffffed103c6daf34 [524854.858954] R10: ffff8881e36d79a7 R11: 0000000000000000 R12: 0000000000000005 [524854.858962] R13: ffff8881c8a16000 R14: 0000000000000000 R15: ffff8881351b5a00 [524854.858971] FS: 0000000000000000(0000) GS:ffff888390800000(0000) knlGS:0000000000000000 [524854.858982] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [524854.858991] CR2: 00007fc9be0f16f4 CR3: 00000001437cc004 CR4: 00000000001706f0 [524854.859000] Call Trace: [524854.859006] <TASK> [524854.859013] ? __warn+0x9f/0x1a0 [524854.859027] ? __nf_unregister_net_hook+0x21a/0x260 [524854.859044] ? report_bug+0x1b1/0x1e0 [524854.859060] ? handle_bug+0x3c/0x70 [524854.859071] ? exc_invalid_op+0x17/0x40 [524854.859083] ? asm_exc_invalid_op+0x1a/0x20 [524854.859100] ? __nf_unregister_net_hook+0x6a/0x260 [524854.859116] ? __nf_unregister_net_hook+0x21a/0x260 [524854.859135] nf_tables_netdev_event+0x337/0x390 [nf_tables] [524854.859304] ? __pfx_nf_tables_netdev_event+0x10/0x10 [nf_tables] [524854.859461] ? packet_notifier+0xb3/0x360 [524854.859476] ? _raw_spin_unlock_irqrestore+0x11/0x40 [524854.859489] ? dcbnl_netdevice_event+0x35/0x140 [524854.859507] ? __pfx_nf_tables_netdev_event+0x10/0x10 [nf_tables] [524854.859661] notifier_call_chain+0x7d/0x140 [524854.859677] unregister_netdevice_many_notify+0x5e1/0xae0
--- net/netfilter/nft_chain_filter.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/netfilter/nft_chain_filter.c +3 -1
@@ -339,7 +339,9 @@ static void nft_netdev_event(unsigned long event, struct net_device *dev,return ;if (n >1 ) { -nf_unregister_net_hook (ctx->net, &found->ops); +if (!(ctx->chain->table->flags &NFT_TABLE_F_DORMANT )) +nf_unregister_net_hook (ctx->net, &found->ops); +list_del_rcu (&found->list);kfree_rcu (found, rcu);return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/138 i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sindhu Devale <[email protected]>
[ Upstream commit 2cc7d150550cc981aceedf008f5459193282425c ]
Issue reported by customer during SRIOV testing, call trace:
When both i40e and the i40iw driver are loaded, a warning in check_flush_dependency is being triggered. This seems to be because of the i40e driver workqueue is allocated with the WQ_MEM_RECLAIM flag, and the i40iw one is not.
Similar error was encountered on ice too and it was fixed by removing the flag. Do the same for i40e too.
[Feb 9 09:08] ------------[ cut here ]------------
[ +0.000004] workqueue: WQ_MEM_RECLAIM i40e:i40e_service_task [i40e] is flushing !WQ_MEM_RECLAIM infiniband:0x0
[ +0.000060] WARNING: CPU: 0 PID: 937 at kernel/workqueue.c:2966 check_flush_dependency+0x10b/0x120
[ +0.000007] Modules linked in: snd_seq_dummy snd_hrtimer snd_seq snd_timer snd_seq_device snd soundcore nls_utf8 cifs cifs_arc4 nls_ucs2_utils rdma_cm iw_cm ib_cm cifs_md4 dns_resolver netfs qrtr rfkill sunrpc vfat fat intel_rapl_msr intel_rapl_common irdma intel_uncore_frequency intel_uncore_frequency_common ice ipmi_ssif isst_if_common skx_edac nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp gnss coretemp ib_uverbs rapl intel_cstate ib_core iTCO_wdt iTCO_vendor_support acpi_ipmi mei_me ipmi_si intel_uncore ioatdma i2c_i801 joydev pcspkr mei ipmi_devintf lpc_ich intel_pch_thermal i2c_smbus ipmi_msghandler acpi_power_meter acpi_pad xfs libcrc32c ast sd_mod drm_shmem_helper t10_pi drm_kms_helper sg ixgbe drm i40e ahci crct10dif_pclmul libahci crc32_pclmul igb crc32c_intel libata ghash_clmulni_intel i2c_algo_bit mdio dca wmi dm_mirror dm_region_hash dm_log dm_mod fuse
[ +0.000050] CPU: 0 PID: 937 Comm: kworker/0:3 Kdump: loaded Not tainted 6.8.0-rc2-Feb-net_dev-Qiueue-00279-gbd43c5687e05 #1 [ +0.000003] Hardware name: Intel Corporation S2600BPB/S2600BPB, BIOS SE5C620.86B.02.01.0013.121520200651 12/15/2020
[ +0.000001] Workqueue: i40e i40e_service_task [i40e] [ +0.000024] RIP: 0010:check_flush_dependency+0x10b/0x120 [ +0.000003] Code: ff 49 8b 54 24 18 48 8d 8b b0 00 00 00 49 89 e8 48
81 c6 b0 00 00 00 48 c7 c7 b0 97 fa 9f c6 05 8a cc 1f 02 01 e8 35 b3 fd ff <0f> 0b e9 10 ff ff ff 80 3d 78 cc 1f 02 00 75 94 e9 46 ff ff ff 90 [ +0.000002] RSP: 0018:ffffbd294976bcf8 EFLAGS: 00010282
[ +0.000002] RAX: 0000000000000000 RBX: ffff94d4c483c000 RCX:
0000000000000027
[ +0.000001] RDX: ffff94d47f620bc8 RSI: 0000000000000001 RDI:ffff94d47f620bc0
[ +0.000001] RBP: 0000000000000000 R08: 0000000000000000 R09:00000000ffff7fff
[ +0.000001] R10: ffffbd294976bb98 R11: ffffffffa0be65e8 R12:ffff94c5451ea180
[ +0.000001] R13: ffff94c5ab5e8000 R14: ffff94c5c20b6e05 R15:ffff94c5f1330ab0
[ +0.000001] FS: 0000000000000000(0000) GS:ffff94d47f600000(0000) knlGS:0000000000000000
[ +0.000002] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000001] CR2: 00007f9e6f1fca70 CR3: 0000000038e20004 CR4:00000000007706f0
[ +0.000000] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[ +0.000001] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400
[ +0.000001] PKRU: 55555554 [ +0.000001] Call Trace: [ +0.000001] <TASK> [ +0.000002] ? __warn+0x80/0x130 [ +0.000003] ? check_flush_dependency+0x10b/0x120 [ +0.000002] ? report_bug+0x195/0x1a0 [ +0.000005] ? handle_bug+0x3c/0x70 [ +0.000003] ? exc_invalid_op+0x14/0x70 [ +0.000002] ? asm_exc_invalid_op+0x16/0x20 [ +0.000006] ? check_flush_dependency+0x10b/0x120 [ +0.000002] ? check_flush_dependency+0x10b/0x120 [ +0.000002] __flush_workqueue+0x126/0x3f0 [ +0.000015] ib_cache_cleanup_one+0x1c/0xe0 [ib_core] [ +0.000056] __ib_unregister_device+0x6a/0xb0 [ib_core] [ +0.000023] ib_unregister_device_and_put+0x34/0x50 [ib_core] [ +0.000020] i40iw_close+0x4b/0x90 [irdma] [ +0.000022] i40e_notify_client_of_netdev_close+0x54/0xc0 [i40e] [ +0.000035] i40e_service_task+0x126/0x190 [i40e] [ +0.000024] process_one_work+0x174/0x340 [ +0.000003] worker_thread+0x27e/0x390 [ +0.000001] ? __pfx_worker_thread+0x10/0x10 [ +0.000002] kthread+0xdf/0x110 [ +0.000002] ? __pfx_kthread+0x10/0x10 [ +0.000002] ret_from_fork+0x2d/0x50 [ +0.000003] ? __pfx_kthread+0x10/0x10 [ +0.000001] ret_from_fork_asm+0x1b/0x30 [ +0.000004] </TASK> [ +0.000001] ---[ end trace 0000000000000000 ]---
--- drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/i40e/i40e_main.c +1 -1
@@ -16023,7 +16023,7 @@ static int __init i40e_init_module(void)* since we need to be able to guarantee forward progress even under * memory pressure. */ - i40e_wq =alloc_workqueue ("%s" ,WQ_MEM_RECLAIM ,0 , i40e_driver_name); + i40e_wq =alloc_workqueue ("%s" ,0 ,0 , i40e_driver_name);if (!i40e_wq) {pr_err ("%s: Failed to create workqueue\n" , i40e_driver_name);return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/138 i40e: Report MFS in decimal base instead of hex
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erwan Velu <[email protected]>
[ Upstream commit ef3c313119ea448c22da10366faa26b5b4b1a18e ]
If the MFS is set below the default (0x2600), a warning message is reported like the following :
MFS for port 1 has been set below the default: 600
This message is a bit confusing as the number shown here (600) is in fact an hexa number: 0x600 = 1536
Without any explicit "0x" prefix, this message is read like the MFS is set to 600 bytes.
MFS, as per MTUs, are usually expressed in decimal base.
This commit reports both current and default MFS values in decimal so it's less confusing for end-users.
A typical warning message looks like the following :
MFS for port 1 (1536) has been set below the default (9728)
--- drivers/net/ethernet/intel/i40e/i40e_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_main.c +2 -2
@@ -15488,8 +15488,8 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent) val = (rd32 (&pf->hw,I40E_PRTGL_SAH ) &I40E_PRTGL_SAH_MFS_MASK ) >>I40E_PRTGL_SAH_MFS_SHIFT ;if (val <MAX_FRAME_SIZE_DEFAULT ) -dev_warn (&pdev->dev,"MFS for port %x has been set below the default: %x\n" , - pf->hw.port, val); +dev_warn (&pdev->dev,"MFS for port %x (%d) has been set below the default (%d)\n" , + pf->hw.port, val,MAX_FRAME_SIZE_DEFAULT );/* Add a filter to drop all Flow control frames from any VSI from being * transmitted. By doing so we stop a malicious VF from sending out
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/138 iavf: Fix TC config comparison with existing adapter TC config
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudheer Mogilappagari <[email protected]>
[ Upstream commit 54976cf58d6168b8d15cebb395069f23b2f34b31 ]
Same number of TCs doesn't imply that underlying TC configs are same. The config could be different due to difference in number of queues in each TC. Add utility function to determine if TC configs are same.
--- drivers/net/ethernet/intel/iavf/iavf_main.c | 30 ++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/iavf/iavf_main.c +29 -1
@@ -2642,6 +2642,34 @@ static void iavf_del_all_cloud_filters(struct iavf_adapter *adapter)spin_unlock_bh (&adapter->cloud_filter_list_lock); } +/** +* iavf_is_tc_config_same - Compare the mqprio TC config with the +* TC config already configured on this adapter. +* @adapter: board private structure +* @mqprio_qopt: TC config received from kernel. +* +* This function compares the TC config received from the kernel +* with the config already configured on the adapter. +* +* Return: True if configuration is same, false otherwise. +**/ +static bool iavf_is_tc_config_same (struct iavf_adapter *adapter, +struct tc_mqprio_qopt *mqprio_qopt) +{ +struct virtchnl_channel_info *ch = &adapter->ch_config.ch_info[0 ]; +int i; + +if (adapter->num_tc != mqprio_qopt->num_tc) +return false; + +for (i =0 ; i < adapter->num_tc; i++) { +if (ch[i].count != mqprio_qopt->count[i] || + ch[i].offset != mqprio_qopt->offset[i]) +return false; + } +return true; +} +/** * __iavf_setup_tc - configure multiple traffic classes * @netdev: network interface device structure
@@ -2698,7 +2726,7 @@ static int __iavf_setup_tc(struct net_device *netdev, void *type_data)if (ret)return ret;/* Return if same TC config is requested */ -if (adapter->num_tc == num_tc) +if (iavf_is_tc_config_same (adapter, &mqprio_qopt->qopt))return 0 ; adapter->num_tc = num_tc;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/138 net: ethernet: ti: am65-cpts: Fix PTPv1 message type on TX packets
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Reeder <[email protected]>
[ Upstream commit 1b9e743e923b256e353a9a644195372285e5a6c0 ]
The CPTS, by design, captures the messageType (Sync, Delay_Req, etc.) field from the second nibble of the PTP header which is defined in the PTPv2 (1588-2008) specification. In the PTPv1 (1588-2002) specification the first two bytes of the PTP header are defined as the versionType which is always 0x0001. This means that any PTPv1 packets that are tagged for TX timestamping by the CPTS will have their messageType set to 0x0 which corresponds to a Sync message type. This causes issues when a PTPv1 stack is expecting a Delay_Req (messageType: 0x1) timestamp that never appears.
Fix this by checking if the ptp_class of the timestamped TX packet is PTP_CLASS_V1 and then matching the PTP sequence ID to the stored sequence ID in the skb->cb data structure. If the sequence IDs match and the packet is of type PTPv1 then there is a chance that the messageType has been incorrectly stored by the CPTS so overwrite the messageType stored by the CPTS with the messageType from the skb->cb data structure. This allows the PTPv1 stack to receive TX timestamps for Delay_Req packets which are necessary to lock onto a PTP Leader.
--- drivers/net/ethernet/ti/am65-cpts.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/ti/am65-cpts.c +5 -0
@@ -649,6 +649,11 @@ static bool am65_cpts_match_tx_ts(struct am65_cpts *cpts,struct am65_cpts_skb_cb_data *skb_cb = (struct am65_cpts_skb_cb_data *)skb->cb; +if ((ptp_classify_raw (skb) &PTP_CLASS_V1 ) && + ((mtype_seqid &AM65_CPTS_EVENT_1_SEQUENCE_ID_MASK ) == + (skb_cb->skb_mtype_seqid &AM65_CPTS_EVENT_1_SEQUENCE_ID_MASK ))) + mtype_seqid = skb_cb->skb_mtype_seqid; +if (mtype_seqid == skb_cb->skb_mtype_seqid) {u64 ns = event->timestamp;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/138 af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 1971d13ffa84a551d29a81fdf5b5ec5be166ac83 ]
syzbot reported a lockdep splat regarding unix_gc_lock and unix_state_lock().
One is called from recvmsg() for a connected socket, and another is called from GC for TCP_LISTEN socket.
So, the splat is false-positive.
Let's add a dedicated lock class for the latter to suppress the splat.
Note that this change is not necessary for net-next.git as the issue is only applied to the old GC impl.
[0]:
WARNING: possible circular locking dependency detected 6.9.0-rc5-syzkaller-00007-g4d2008430ce8 #0 Not tainted
-----------------------------------------------------
kworker/u8:1/11 is trying to acquire lock:ffff88807cea4e70 (&u->lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff88807cea4e70 (&u->lock){+.+.}-{2:2}, at: __unix_gc+0x40e/0xf70 net/unix/garbage.c:302
but task is already holding lock:ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: __unix_gc+0x117/0xf70 net/unix/garbage.c:261
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (unix_gc_lock){+.+.}-{2:2}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
unix_notinflight+0x13d/0x390 net/unix/garbage.c:140
unix_detach_fds net/unix/af_unix.c:1819 [inline]
unix_destruct_scm+0x221/0x350 net/unix/af_unix.c:1876
skb_release_head_state+0x100/0x250 net/core/skbuff.c:1188
skb_release_all net/core/skbuff.c:1200 [inline]
__kfree_skb net/core/skbuff.c:1216 [inline]
kfree_skb_reason+0x16d/0x3b0 net/core/skbuff.c:1252
kfree_skb include/linux/skbuff.h:1262 [inline]
manage_oob net/unix/af_unix.c:2672 [inline]
unix_stream_read_generic+0x1125/0x2700 net/unix/af_unix.c:2749
unix_stream_splice_read+0x239/0x320 net/unix/af_unix.c:2981
do_splice_read fs/splice.c:985 [inline]
splice_file_to_pipe+0x299/0x500 fs/splice.c:1295
do_splice+0xf2d/0x1880 fs/splice.c:1379
__do_splice fs/splice.c:1436 [inline]
__do_sys_splice fs/splice.c:1652 [inline]
__se_sys_splice+0x331/0x4a0 fs/splice.c:1634
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f-> #0 (&u->lock){+.+.}-{2:2}:
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869
__lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
__unix_gc+0x40e/0xf70 net/unix/garbage.c:302
process_one_work kernel/workqueue.c:3254 [inline]
process_scheduled_works+0xa10/0x17c0 kernel/workqueue.c:3335
worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
kthread+0x2f0/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(unix_gc_lock);
lock(&u->lock);
lock(unix_gc_lock); lock(&u->lock);
*** DEADLOCK ***
3 locks held by kworker/u8:1/11:
#0: ffff888015089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3229 [inline] #0: ffff888015089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x8e0/0x17c0 kernel/workqueue.c:3335 #1: ffffc90000107d00 (unix_gc_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3230 [inline]
#1: ffffc90000107d00 (unix_gc_work){+.+.}-{0:0}, at: process_scheduled_works+0x91b/0x17c0 kernel/workqueue.c:3335 #2: ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#2: ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: __unix_gc+0x117/0xf70 net/unix/garbage.c:261
stack backtrace: CPU: 0 PID: 11 Comm: kworker/u8:1 Not tainted 6.9.0-rc5-syzkaller-00007-g4d2008430ce8 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: events_unbound __unix_gc Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2187 check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] __unix_gc+0x40e/0xf70 net/unix/garbage.c:302 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0xa10/0x17c0 kernel/workqueue.c:3335 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>
--- include/net/af_unix.h | 3 +++ net/unix/garbage.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-)
include/net/af_unix.h +3 -0
@@ -77,6 +77,9 @@ enum unix_socket_lock_class {U_LOCK_NORMAL ,U_LOCK_SECOND ,/* for double locking, see unix_state_double_lock(). */ U_LOCK_DIAG ,/* used while dumping icons, see sk_diag_dump_icons(). */ + U_LOCK_GC_LISTENER, /* used for listening socket while determining gc + * candidates to close a small race window. + */ }; static inline void unix_state_lock_nested(struct sock *sk,
net/unix/garbage.c +1 -1
@@ -260,7 +260,7 @@ void unix_gc(void)__set_bit (UNIX_GC_MAYBE_CYCLE , &u->gc_flags);if (sk->sk_state ==TCP_LISTEN ) { -unix_state_lock (sk); +unix_state_lock_nested (sk,U_LOCK_GC_LISTENER );unix_state_unlock (sk); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/138 serial: core: Provide port lock wrappers
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit b0af4bcb49464c221ad5f95d40f2b1b252ceedcc ]
When a serial port is used for kernel console output, then all modifications to the UART registers which are done from other contexts, e.g. getty, termios, are interference points for the kernel console.
So far this has been ignored and the printk output is based on the principle of hope. The rework of the console infrastructure which aims to support threaded and atomic consoles, requires to mark sections which modify the UART registers as unsafe. This allows the atomic write function to make informed decisions and eventually to restore operational state. It also allows to prevent the regular UART code from modifying UART registers while printk output is in progress.
All modifications of UART registers are guarded by the UART port lock, which provides an obvious synchronization point with the console infrastructure.
Provide wrapper functions for spin_[un]lock*(port->lock) invocations so that the console mechanics can be applied later on at a single place and does not require to copy the same logic all over the drivers.
Stable-dep-of: 54c4ec5f8c47 ("serial: mxs-auart: add spinlock around changing cts state")
--- include/linux/serial_core.h | 79 +++++++++++++++++++++++++++++++++++++ 1 file changed, 79 insertions(+)
include/linux/serial_core.h +79 -0
@@ -260,6 +260,85 @@ struct uart_port {void *private_data;/* generic platform data pointer */ }; +/** +* uart_port_lock - Lock the UART port +* @up: Pointer to UART port structure +*/ +static inline void uart_port_lock (struct uart_port *up) +{ +spin_lock (&up->lock); +} + +/** +* uart_port_lock_irq - Lock the UART port and disable interrupts +* @up: Pointer to UART port structure +*/ +static inline void uart_port_lock_irq (struct uart_port *up) +{ +spin_lock_irq (&up->lock); +} + +/** +* uart_port_lock_irqsave - Lock the UART port, save and disable interrupts +* @up: Pointer to UART port structure +* @flags: Pointer to interrupt flags storage +*/ +static inline void uart_port_lock_irqsave (struct uart_port *up,unsigned long *flags) +{ +spin_lock_irqsave (&up->lock, *flags); +} + +/** +* uart_port_trylock - Try to lock the UART port +* @up: Pointer to UART port structure +* +* Returns: True if lock was acquired, false otherwise +*/ +static inline bool uart_port_trylock (struct uart_port *up) +{ +return spin_trylock (&up->lock); +} + +/** +* uart_port_trylock_irqsave - Try to lock the UART port, save and disable interrupts +* @up: Pointer to UART port structure +* @flags: Pointer to interrupt flags storage +* +* Returns: True if lock was acquired, false otherwise +*/ +static inline bool uart_port_trylock_irqsave (struct uart_port *up,unsigned long *flags) +{ +return spin_trylock_irqsave (&up->lock, *flags); +} + +/** +* uart_port_unlock - Unlock the UART port +* @up: Pointer to UART port structure +*/ +static inline void uart_port_unlock (struct uart_port *up) +{ +spin_unlock (&up->lock); +} + +/** +* uart_port_unlock_irq - Unlock the UART port and re-enable interrupts +* @up: Pointer to UART port structure +*/ +static inline void uart_port_unlock_irq (struct uart_port *up) +{ +spin_unlock_irq (&up->lock); +} + +/** +* uart_port_lock_irqrestore - Unlock the UART port, restore interrupts +* @up: Pointer to UART port structure +* @flags: The saved interrupt flags for restore +*/ +static inline void uart_port_unlock_irqrestore (struct uart_port *up,unsigned long flags) +{ +spin_unlock_irqrestore (&up->lock, flags); +} +static inline int serial_port_in (struct uart_port *up,int offset) {return up->serial_in (up, offset);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/138 serial: mxs-auart: add spinlock around changing cts state
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emil Kronborg <[email protected]>
[ Upstream commit 54c4ec5f8c471b7c1137a1f769648549c423c026 ]
The uart_handle_cts_change() function in serial_core expects the caller to hold uport->lock. For example, I have seen the below kernel splat, when the Bluetooth driver is loaded on an i.MX28 board.
[ 85.119255] ------------[ cut here ]------------
[ 85.124413] WARNING: CPU: 0 PID: 27 at /drivers/tty/serial/serial_core.c:3453 uart_handle_cts_change+0xb4/0xec
[ 85.134694] Modules linked in: hci_uart bluetooth ecdh_generic ecc wlcore_sdio configfs
[ 85.143314] CPU: 0 PID: 27 Comm: kworker/u3:0 Not tainted 6.6.3-00021-gd62a2f068f92 #1
[ 85.151396] Hardware name: Freescale MXS (Device Tree)
[ 85.156679] Workqueue: hci0 hci_power_on [bluetooth]
(...)
[ 85.191765] uart_handle_cts_change from mxs_auart_irq_handle+0x380/0x3f4
[ 85.198787] mxs_auart_irq_handle from __handle_irq_event_percpu+0x88/0x210
(...)--- drivers/tty/serial/mxs-auart.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/tty/serial/mxs-auart.c +6 -2
@@ -1122,11 +1122,13 @@ static void mxs_auart_set_ldisc(struct uart_port *port,static irqreturn_t mxs_auart_irq_handle (int irq,void *context) { -u32 istat; +u32 istat, stat;struct mxs_auart_port *s = context;u32 mctrl_temp = s->mctrl_prev; -u32 stat =mxs_read (s,REG_STAT ); +uart_port_lock (&s->port); + + stat =mxs_read (s,REG_STAT ); istat =mxs_read (s,REG_INTR );/* ack irq */
@@ -1162,6 +1164,8 @@ static irqreturn_t mxs_auart_irq_handle(int irq, void *context) istat &= ~AUART_INTR_TXIS ; } +uart_port_unlock (&s->port); +return IRQ_HANDLED ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/138 Revert "crypto: api - Disallow identical driver names"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
This reverts commit 462c383e732fa99c60aff711c43ec9d6eb27921e which is commit 27016f75f5ed47e2d8e0ca75a8ff1f40bc1a5e27 upstream.
It is reported to cause problems in older kernels due to some crypto drivers having the same name, so revert it here to fix the problems.
--- crypto/algapi.c | 1 - 1 file changed, 1 deletion(-)
crypto/algapi.c +0 -1
@@ -258,7 +258,6 @@ static struct crypto_larval *__crypto_re }if (!strcmp (q->cra_driver_name, alg->cra_name) || - !strcmp (q->cra_driver_name, alg->cra_driver_name) || !strcmp (q->cra_name, alg->cra_driver_name)) goto err; }
Greg Kroah-Hartman
maintainerPATCH 110/138 net/mlx5e: Fix a race in command alloc flow
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shifeng Li <[email protected]>
commit 8f5100da56b3980276234e812ce98d8f075194cd upstream.
Fix a cmd->ent use after free due to a race on command entry. Such race occurs when one of the commands releases its last refcount and frees its index and entry while another process running command flush flow takes refcount to this command entry. The process which handles commands flush may see this command as needed to be flushed if the other process allocated a ent->idx but didn't set ent to cmd->ent_arr in cmd_work_handler(). Fix it by moving the assignment of cmd->ent_arr into the spin lock.
[70013.081955] BUG: KASAN: use-after-free in mlx5_cmd_trigger_completions+0x1e2/0x4c0 [mlx5_core] [70013.081967] Write of size 4 at addr ffff88880b1510b4 by task kworker/26:1/1433361 [70013.081968] [70013.082028] Workqueue: events aer_isr [70013.082053] Call Trace: [70013.082067] dump_stack+0x8b/0xbb [70013.082086] print_address_description+0x6a/0x270 [70013.082102] kasan_report+0x179/0x2c0 [70013.082173] mlx5_cmd_trigger_completions+0x1e2/0x4c0 [mlx5_core] [70013.082267] mlx5_cmd_flush+0x80/0x180 [mlx5_core] [70013.082304] mlx5_enter_error_state+0x106/0x1d0 [mlx5_core] [70013.082338] mlx5_try_fast_unload+0x2ea/0x4d0 [mlx5_core] [70013.082377] remove_one+0x200/0x2b0 [mlx5_core] [70013.082409] pci_device_remove+0xf3/0x280 [70013.082439] device_release_driver_internal+0x1c3/0x470 [70013.082453] pci_stop_bus_device+0x109/0x160 [70013.082468] pci_stop_and_remove_bus_device+0xe/0x20 [70013.082485] pcie_do_fatal_recovery+0x167/0x550 [70013.082493] aer_isr+0x7d2/0x960 [70013.082543] process_one_work+0x65f/0x12d0 [70013.082556] worker_thread+0x87/0xb50 [70013.082571] kthread+0x2e9/0x3a0 [70013.082592] ret_from_fork+0x1f/0x40
The logical relationship of this error is as follows:
aer_recover_work | ent->work
-------------------------------------------+------------------------------
aer_recover_work_func |
|- pcie_do_recovery |
|- report_error_detected |
|- mlx5_pci_err_detected |cmd_work_handler
|- mlx5_enter_error_state | |- cmd_alloc_index
|- enter_error_state | |- lock cmd->alloc_lock
|- mlx5_cmd_flush | |- clear_bit
|- mlx5_cmd_trigger_completions| |- unlock cmd->alloc_lock
|- lock cmd->alloc_lock |
|- vector = ~dev->cmd.vars.bitmask
|- for_each_set_bit |
|- cmd_ent_get(cmd->ent_arr[i]) (UAF)
|- unlock cmd->alloc_lock | |- cmd->ent_arr[ent->idx]=entThe cmd->ent_arr[ent->idx] assignment and the bit clearing are not protected by the cmd->alloc_lock in cmd_work_handler().
--- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/cmd.c +7 -5
@@ -114,15 +114,18 @@ static u8 alloc_token(struct mlx5_cmd *creturn token; } -static int cmd_alloc_index (struct mlx5_cmd *cmd) +static int cmd_alloc_index (struct mlx5_cmd *cmd,struct mlx5_cmd_work_ent *ent) {unsigned long flags;int ret;spin_lock_irqsave (&cmd->alloc_lock, flags); ret =find_first_bit (&cmd->bitmask, cmd->max_reg_cmds); -if (ret < cmd->max_reg_cmds) +if (ret < cmd->max_reg_cmds) {clear_bit (ret, &cmd->bitmask); + ent->idx = ret; + cmd->ent_arr[ent->idx] = ent; + }spin_unlock_irqrestore (&cmd->alloc_lock, flags);return ret < cmd->max_reg_cmds ? ret : -ENOMEM ;
@@ -912,7 +915,7 @@ static void cmd_work_handler(struct work sem = ent->page_queue ? &cmd->pages_sem : &cmd->sem;down (sem);if (!ent->page_queue) { - alloc_ret =cmd_alloc_index (cmd); + alloc_ret =cmd_alloc_index (cmd, ent);if (alloc_ret <0 ) {mlx5_core_err_rl (dev,"failed to allocate command entry\n" );if (ent->callback) {
@@ -927,15 +930,14 @@ static void cmd_work_handler(struct workup (sem);return ; } - ent->idx = alloc_ret; }else { ent->idx = cmd->max_reg_cmds;spin_lock_irqsave (&cmd->alloc_lock, flags);clear_bit (ent->idx, &cmd->bitmask); + cmd->ent_arr[ent->idx] = ent;spin_unlock_irqrestore (&cmd->alloc_lock, flags); } - cmd->ent_arr[ent->idx] = ent; lay =get_inst (cmd, ent->idx); ent->lay = lay;memset (lay,0 ,sizeof (*lay));
Greg Kroah-Hartman
maintainerPATCH 111/138 tracing: Show size of requested perf buffer
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin H. Johnson <[email protected]>
commit a90afe8d020da9298c98fddb19b7a6372e2feb45 upstream.
If the perf buffer isn't large enough, provide a hint about how large it needs to be for whatever is running.
--- kernel/trace/trace_event_perf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/trace/trace_event_perf.c +2 -1
@@ -400,7 +400,8 @@ void *perf_trace_buf_alloc(int size, strBUILD_BUG_ON (PERF_MAX_TRACE_SIZE %sizeof (unsigned long ));if (WARN_ONCE (size >PERF_MAX_TRACE_SIZE , -"perf buffer not large enough" )) +"perf buffer not large enough, wanted %d, have %d" , + size,PERF_MAX_TRACE_SIZE ))return NULL ; *rctxp = rctx =perf_swevent_get_recursion_context ();
Greg Kroah-Hartman
maintainerPATCH 112/138 tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker together
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin H. Johnson <[email protected]>
commit e531e90b5ab0f7ce5ff298e165214c1aec6ed187 upstream.
Running endpoint security solutions like Sentinel1 that use perf-based tracing heavily lead to this repeated dump complaining about dockerd. The default value of 2048 is nowhere near not large enough.
Using the prior patch "tracing: show size of requested buffer", we get "perf buffer not large enough, wanted 6644, have 6144", after repeated up-sizing (I did 2/4/6/8K). With 8K, the problem doesn't occur at all, so below is the trace for 6K.
I'm wondering if this value should be selectable at boot time, but this is a good starting point.
``` ------------[ cut here ]------------ perf buffer not large enough, wanted 6644, have 6144 WARNING: CPU: 1 PID: 4997 at kernel/trace/trace_event_perf.c:402 perf_trace_buf_alloc+0x8c/0xa0 Modules linked in: [..] CPU: 1 PID: 4997 Comm: sh Tainted: G T 5.13.13-x86_64-00039-gb3959163488e #63 Hardware name: LENOVO 20KH002JUS/20KH002JUS, BIOS N23ET66W (1.41 ) 09/02/2019 RIP: 0010:perf_trace_buf_alloc+0x8c/0xa0 Code: 80 3d 43 97 d0 01 00 74 07 31 c0 5b 5d 41 5c c3 ba 00 18 00 00 89 ee 48 c7 c7 00 82 7d 91 c6 05 25 97 d0 01 01 e8 22 ee bc 00 <0f> 0b 31 c0 eb db 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 55 89 RSP: 0018:ffffb922026b7d58 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9da5ee012000 RCX: 0000000000000027 RDX: ffff9da881657828 RSI: 0000000000000001 RDI: ffff9da881657820 RBP: 00000000000019f4 R08: 0000000000000000 R09: ffffb922026b7b80 R10: ffffb922026b7b78 R11: ffffffff91dda688 R12: 000000000000000f R13: ffff9da5ee012108 R14: ffff9da8816570a0 R15: ffffb922026b7e30 FS: 00007f420db1a080(0000) GS:ffff9da881640000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000060 CR3: 00000002504a8006 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kprobe_perf_func+0x11e/0x270 ? do_execveat_common.isra.0+0x1/0x1c0 ? do_execveat_common.isra.0+0x5/0x1c0 kprobe_ftrace_handler+0x10e/0x1d0 0xffffffffc03aa0c8 ? do_execveat_common.isra.0+0x1/0x1c0 do_execveat_common.isra.0+0x5/0x1c0 __x64_sys_execve+0x33/0x40 do_syscall_64+0x6b/0xc0 ? do_syscall_64+0x11/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f420dc1db37 Code: ff ff 76 e7 f7 d8 64 41 89 00 eb df 0f 1f 80 00 00 00 00 f7 d8 64 41 89 00 eb dc 0f 1f 84 00 00 00 00 00 b8 3b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 01 43 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffd4e8b4e38 EFLAGS: 00000246 ORIG_RAX: 000000000000003b RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f420dc1db37 RDX: 0000564338d1e740 RSI: 0000564338d32d50 RDI: 0000564338d28f00 RBP: 0000564338d28f00 R08: 0000564338d32d50 R09: 0000000000000020 R10: 00000000000001b6 R11: 0000000000000246 R12: 0000564338d28f00 R13: 0000564338d32d50 R14: 0000564338d1e740 R15: 0000564338d28c60 ---[ end trace 83ab3e8e16275e49 ]--- ```
--- include/linux/trace_events.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/trace_events.h +1 -1
@@ -577,7 +577,7 @@ struct trace_event_file { } \ early_initcall(trace_init_perf_perm_##name); -#define PERF_MAX_TRACE_SIZE 2048 +#define PERF_MAX_TRACE_SIZE 8192#define MAX_FILTER_STR_VAL 256U/* Should handle KSYM_SYMBOL_LEN */
Greg Kroah-Hartman
maintainerPATCH 113/138 PM / devfreq: Fix buffer overflow in trans_stat_show
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Marangi <[email protected]>
commit 08e23d05fa6dc4fc13da0ccf09defdd4bbc92ff4 upstream.
Fix buffer overflow in trans_stat_show().
Convert simple snprintf to the more secure scnprintf with size of PAGE_SIZE.
Add condition checking if we are exceeding PAGE_SIZE and exit early from loop. Also add at the end a warning that we exceeded PAGE_SIZE and that stats is disabled.
Return -EFBIG in the case where we don't have enough space to write the full transition table.
Also document in the ABI that this function can return -EFBIG error.
--- Documentation/ABI/testing/sysfs-class-devfreq | 3 + drivers/devfreq/devfreq.c | 59 +++++++++++++++++--------- 2 files changed, 43 insertions(+), 19 deletions(-)
Documentation/ABI/testing/sysfs-class-devfreq +3 -0
@@ -66,6 +66,9 @@ Description: echo 0 > /sys/class/devfreq/.../trans_stat + If the transition table is bigger than PAGE_SIZE, reading + this will return an -EFBIG error. + What: /sys/class/devfreq/.../userspace/set_freq Date: September 2011 Contact: MyungJoo Ham <[email protected]>
drivers/devfreq/devfreq.c +40 -19
87 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 114/138 Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit 9bf4e919ccad613b3596eebf1ff37b05b6405307 upstream.
After an innocuous optimization change in LLVM main (19.0.0), x86_64 allmodconfig (which enables CONFIG_KCSAN / -fsanitize=thread) fails to build due to the checks in check_copy_size():
In file included from net/bluetooth/sco.c:27:
In file included from include/linux/module.h:13:
In file included from include/linux/stat.h:19:
In file included from include/linux/time.h:60:
In file included from include/linux/time32.h:13:
In file included from include/linux/timex.h:67:
In file included from arch/x86/include/asm/timex.h:6:
In file included from arch/x86/include/asm/tsc.h:10:
In file included from arch/x86/include/asm/msr.h:15:
In file included from include/linux/percpu.h:7:
In file included from include/linux/smp.h:118:
include/linux/thread_info.h:244:4: error: call to '__bad_copy_from' declared with 'error' attribute: copy source size is too small
244 | __bad_copy_from();
| ^The same exact error occurs in l2cap_sock.c. The copy_to_user() statements that are failing come from l2cap_sock_getsockopt_old() and sco_sock_getsockopt_old(). This does not occur with GCC with or without KCSAN or Clang without KCSAN enabled.
len is defined as an 'int' because it is assigned from '__user int *optlen'. However, it is clamped against the result of sizeof(), which has a type of 'size_t' ('unsigned long' for 64-bit platforms). This is done with min_t() because min() requires compatible types, which results in both len and the result of sizeof() being casted to 'unsigned int', meaning len changes signs and the result of sizeof() is truncated. From there, len is passed to copy_to_user(), which has a third parameter type of 'unsigned long', so it is widened and changes signs again. This excessive casting in combination with the KCSAN instrumentation causes LLVM to fail to eliminate the __bad_copy_from() call, failing the build.
The official recommendation from LLVM developers is to consistently use long types for all size variables to avoid the unnecessary casting in the first place. Change the type of len to size_t in both l2cap_sock_getsockopt_old() and sco_sock_getsockopt_old(). This clears up the error while allowing min_t() to be replaced with min(), resulting in simpler code with no casts and fewer implicit conversions. While len is a different type than optlen now, it should result in no functional change because the result of sizeof() will clamp all values of optlen in the same manner as before.
--- net/bluetooth/l2cap_sock.c | 7 ++++--- net/bluetooth/sco.c | 7 ++++--- 2 files changed, 8 insertions(+), 6 deletions(-)
net/bluetooth/l2cap_sock.c +4 -3
@@ -456,7 +456,8 @@ static int l2cap_sock_getsockopt_old(strstruct l2cap_chan *chan =l2cap_pi (sk)->chan;struct l2cap_options opts;struct l2cap_conninfo cinfo; -int len, err =0 ; +int err =0 ; +size_t len;u32 opt;BT_DBG ("sk %p" , sk);
@@ -503,7 +504,7 @@ static int l2cap_sock_getsockopt_old(strBT_DBG ("mode 0x%2.2x" , chan->mode); - len = min_t(unsigned int, len, sizeof(opts)); + len =min (len,sizeof (opts));if (copy_to_user (optval, (char *) &opts, len)) err = -EFAULT ;
@@ -553,7 +554,7 @@ static int l2cap_sock_getsockopt_old(str cinfo.hci_handle = chan->conn->hcon->handle;memcpy (cinfo.dev_class, chan->conn->hcon->dev_class,3 ); - len = min_t(unsigned int, len, sizeof(cinfo)); + len =min (len,sizeof (cinfo));if (copy_to_user (optval, (char *) &cinfo, len)) err = -EFAULT ;
net/bluetooth/sco.c +4 -3
@@ -901,7 +901,8 @@ static int sco_sock_getsockopt_old(strucstruct sock *sk = sock->sk;struct sco_options opts;struct sco_conninfo cinfo; -int len, err =0 ; +int err =0 ; +size_t len;BT_DBG ("sk %p" , sk);
@@ -923,7 +924,7 @@ static int sco_sock_getsockopt_old(strucBT_DBG ("mtu %d" , opts.mtu); - len = min_t(unsigned int, len, sizeof(opts)); + len =min (len,sizeof (opts));if (copy_to_user (optval, (char *)&opts, len)) err = -EFAULT ;
@@ -941,7 +942,7 @@ static int sco_sock_getsockopt_old(struc cinfo.hci_handle =sco_pi (sk)->conn->hcon->handle;memcpy (cinfo.dev_class,sco_pi (sk)->conn->hcon->dev_class,3 ); - len = min_t(unsigned int, len, sizeof(cinfo)); + len =min (len,sizeof (cinfo));if (copy_to_user (optval, (char *)&cinfo, len)) err = -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 115/138 Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: WangYuli <[email protected]>
commit d1a5a7eede2977da3d2002d5ea3b519019cc1a98 upstream.
Add the support ID(0x0bda, 0x4853) to usb_device_id table for Realtek RTL8852BE.
Without this change the device utilizes an obsolete version of the firmware that is encoded in it rather than the updated Realtek firmware and config files from the firmware directory. The latter files implement many new features.
The device table is as follows:
T: Bus=03 Lev=01 Prnt=01 Port=09 Cnt=03 Dev#= 4 Spd=12 MxCh= 0
D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0bda ProdID=4853 Rev= 0.00
S: Manufacturer=Realtek
S: Product=Bluetooth Radio
S: SerialNumber=00e04c000001
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
--- drivers/bluetooth/btusb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bluetooth/btusb.c +2 -0
@@ -418,6 +418,8 @@ static const struct usb_device_id blackl/* Realtek 8852BE Bluetooth devices */ { USB_DEVICE(0x0cb8, 0xc559), .driver_info = BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0bda, 0x4853), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x0bda, 0x887b), .driver_info = BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x0bda, 0xb85b), .driver_info = BTUSB_REALTEK |
Greg Kroah-Hartman
maintainerPATCH 116/138 btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Thumshirn <[email protected]>
commit 2f7ef5bb4a2f3e481ef05fab946edb97c84f67cf upstream.
Syzbot reported the following information leak for in btrfs_ioctl_logical_to_ino():
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x110 lib/usercopy.c:40 instrument_copy_to_user include/linux/instrumented.h:114 [inline] _copy_to_user+0xbc/0x110 lib/usercopy.c:40 copy_to_user include/linux/uaccess.h:191 [inline] btrfs_ioctl_logical_to_ino+0x440/0x750 fs/btrfs/ioctl.c:3499 btrfs_ioctl+0x714/0x1260 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890 __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890 x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was created at:
__kmalloc_large_node+0x231/0x370 mm/slub.c:3921 __do_kmalloc_node mm/slub.c:3954 [inline] __kmalloc_node+0xb07/0x1060 mm/slub.c:3973 kmalloc_node include/linux/slab.h:648 [inline] kvmalloc_node+0xc0/0x2d0 mm/util.c:634 kvmalloc include/linux/slab.h:766 [inline] init_data_container+0x49/0x1e0 fs/btrfs/backref.c:2779 btrfs_ioctl_logical_to_ino+0x17c/0x750 fs/btrfs/ioctl.c:3480 btrfs_ioctl+0x714/0x1260 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890 __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890 x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Bytes 40-65535 of 65536 are uninitialized Memory access of size 65536 starts at ffff888045a40000
This happens, because we're copying a 'struct btrfs_data_container' back to user-space. This btrfs_data_container is allocated in 'init_data_container()' via kvmalloc(), which does not zero-fill the memory.
Fix this by using kvzalloc() which zeroes out the memory on allocation.
--- fs/btrfs/backref.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-)
fs/btrfs/backref.c +3 -9
@@ -2315,20 +2315,14 @@ struct btrfs_data_container *init_data_csize_t alloc_bytes; alloc_bytes =max_t (size_t, total_bytes,sizeof (*data)); - data =kvmalloc (alloc_bytes,GFP_KERNEL ); + data =kvzalloc (alloc_bytes,GFP_KERNEL );if (!data)return ERR_PTR (-ENOMEM ); -if (total_bytes >=sizeof (*data)) { +if (total_bytes >=sizeof (*data)) data->bytes_left = total_bytes -sizeof (*data); - data->bytes_missing =0 ; - }else { +else data->bytes_missing =sizeof (*data) - total_bytes; - data->bytes_left =0 ; - } - - data->elem_cnt =0 ; - data->elem_missed =0 ;return data; }
Greg Kroah-Hartman
maintainerPATCH 117/138 cpu: Re-enable CPU mitigations by default for !X86 architectures
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit fe42754b94a42d08cf9501790afc25c4f6a5f631 upstream.
Rename x86's to CPU_MITIGATIONS, define it in generic code, and force it on for all architectures exception x86. A recent commit to turn mitigations off by default if SPECULATION_MITIGATIONS=n kinda sorta missed that "cpu_mitigations" is completely generic, whereas SPECULATION_MITIGATIONS is x86-specific.
Rename x86's SPECULATIVE_MITIGATIONS instead of keeping both and have it select CPU_MITIGATIONS, as having two configs for the same thing is unnecessary and confusing. This will also allow x86 to use the knob to manage mitigations that aren't strictly related to speculative execution.
Use another Kconfig to communicate to common code that CPU_MITIGATIONS is already defined instead of having x86's menu depend on the common CPU_MITIGATIONS. This allows keeping a single point of contact for all of x86's mitigations, and it's not clear that other architectures *want* to allow disabling mitigations at compile-time.
--- arch/Kconfig | 8 ++++++++ arch/x86/Kconfig | 11 ++++++----- kernel/cpu.c | 4 ++-- 3 files changed, 16 insertions(+), 7 deletions(-)
arch/Kconfig +8 -0
@@ -9,6 +9,14 @@ # source "arch/$(SRCARCH)/Kconfig" +config ARCH_CONFIGURES_CPU_MITIGATIONS + bool + +if !ARCH_CONFIGURES_CPU_MITIGATIONS +config CPU_MITIGATIONS + def_bool y +endif + menu "General architecture-dependent options" config CRASH_CORE
arch/x86/Kconfig +6 -5
@@ -57,6 +57,7 @@ config X86 select ACPI_LEGACY_TABLES_LOOKUP if ACPI select ACPI_SYSTEM_POWER_STATES_SUPPORT if ACPI select ARCH_32BIT_OFF_T if X86_32 + select ARCH_CONFIGURES_CPU_MITIGATIONS select ARCH_CLOCKSOURCE_INIT select ARCH_HAS_ACPI_TABLE_UPGRADE if ACPI select ARCH_HAS_CPU_FINALIZE_INIT
@@ -2408,17 +2409,17 @@ config CC_HAS_SLS config CC_HAS_RETURN_THUNK def_bool $(cc-option,-mfunction-return=thunk-extern) -menuconfig SPECULATION_MITIGATIONS - bool "Mitigations for speculative execution vulnerabilities" +menuconfig CPU_MITIGATIONS + bool "Mitigations for CPU vulnerabilities" default y help - Say Y here to enable options which enable mitigations for - speculative execution hardware vulnerabilities. + Say Y here to enable options which enable mitigations for hardware + vulnerabilities (usually related to speculative execution). If you say N, all mitigations will be disabled. You really should know what you are doing to say so. -if SPECULATION_MITIGATIONS +if CPU_MITIGATIONS config PAGE_TABLE_ISOLATION bool "Remove the kernel mapping in user mode"
kernel/cpu.c +2 -2
@@ -2600,8 +2600,8 @@ enum cpu_mitigations { };static enum cpu_mitigations cpu_mitigations__ro_after_init = -IS_ENABLED (CONFIG_SPECULATION_MITIGATIONS ) ?CPU_MITIGATIONS_AUTO : -CPU_MITIGATIONS_OFF ; +IS_ENABLED (CONFIG_CPU_MITIGATIONS ) ?CPU_MITIGATIONS_AUTO : +CPU_MITIGATIONS_OFF ;static int __init mitigations_parse_cmdline (char *arg) {
Greg Kroah-Hartman
maintainerPATCH 118/138 arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Iskander Amara <[email protected]>
commit 0ac417b8f124427c90ec8c2ef4f632b821d924cc upstream.
Q7_THRM# pin is connected to a diode on the module which is used as a level shifter, and the pin have a pull-down enabled by default. We need to configure it to internal pull-up, other- wise whenever the pin is configured as INPUT and we try to control it externally the value will always remain zero.
--- arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 10 ++++++++++ 1 file changed, 10 insertions(+)
arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +10 -0
@@ -436,6 +436,16 @@ }; &pinctrl { + pinctrl-names = "default"; + pinctrl-0 = <&q7_thermal_pin>; + + gpios { + q7_thermal_pin: q7-thermal-pin { + rockchip,pins = + <0 RK_PA3 RK_FUNC_GPIO &pcfg_pull_up>; + }; + }; + i2c8 { i2c8_xfer_a: i2c8-xfer { rockchip,pins =
Greg Kroah-Hartman
maintainerPATCH 119/138 drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 9792b7cc18aaa0c2acae6af5d0acf249bcb1ab0d upstream.
This avoids a potential conflict with firmwares with the newer HDP flush mechanism.
--- drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-)
drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c +14 -10
@@ -390,17 +390,21 @@ static void sdma_v5_2_ring_emit_hdp_flusu32 ref_and_mask =0 ;const struct nbio_hdp_flush_reg *nbio_hf_reg = adev->nbio.hdp_flush_reg; - ref_and_mask = nbio_hf_reg->ref_and_mask_sdma0 << ring->me; +if (ring->me >1 ) { +amdgpu_asic_flush_hdp (adev, ring); + }else { + ref_and_mask = nbio_hf_reg->ref_and_mask_sdma0 << ring->me; -amdgpu_ring_write (ring,SDMA_PKT_HEADER_OP (SDMA_OP_POLL_REGMEM ) | -SDMA_PKT_POLL_REGMEM_HEADER_HDP_FLUSH (1 ) | -SDMA_PKT_POLL_REGMEM_HEADER_FUNC (3 ));/* == */ -amdgpu_ring_write (ring, (adev->nbio.funcs->get_hdp_flush_done_offset (adev)) <<2 ); -amdgpu_ring_write (ring, (adev->nbio.funcs->get_hdp_flush_req_offset (adev)) <<2 ); -amdgpu_ring_write (ring, ref_and_mask);/* reference */ -amdgpu_ring_write (ring, ref_and_mask);/* mask */ -amdgpu_ring_write (ring,SDMA_PKT_POLL_REGMEM_DW5_RETRY_COUNT (0xfff ) | -SDMA_PKT_POLL_REGMEM_DW5_INTERVAL (10 ));/* retry count, poll interval */ +amdgpu_ring_write (ring,SDMA_PKT_HEADER_OP (SDMA_OP_POLL_REGMEM ) | +SDMA_PKT_POLL_REGMEM_HEADER_HDP_FLUSH (1 ) | +SDMA_PKT_POLL_REGMEM_HEADER_FUNC (3 ));/* == */ +amdgpu_ring_write (ring, (adev->nbio.funcs->get_hdp_flush_done_offset (adev)) <<2 ); +amdgpu_ring_write (ring, (adev->nbio.funcs->get_hdp_flush_req_offset (adev)) <<2 ); +amdgpu_ring_write (ring, ref_and_mask);/* reference */ +amdgpu_ring_write (ring, ref_and_mask);/* mask */ +amdgpu_ring_write (ring,SDMA_PKT_POLL_REGMEM_DW5_RETRY_COUNT (0xfff ) | +SDMA_PKT_POLL_REGMEM_DW5_INTERVAL (10 ));/* retry count, poll interval */ + } }/**
Greg Kroah-Hartman
maintainerPATCH 120/138 drm/amdgpu: Fix leak when GPU memory allocation fails
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukul Joshi <[email protected]>
commit 25e9227c6afd200bed6774c866980b8e36d033af upstream.
Free the sync object if the memory allocation fails for any reason.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +1 -0
@@ -1259,6 +1259,7 @@ allocate_init_user_pages_failed: err_bo_create:unreserve_mem_limit (adev, size, alloc_domain, !!sg); err_reserve_limit: +amdgpu_sync_free (&(*mem)->sync);mutex_destroy (&(*mem)->lock);kfree (*mem); err:
Greg Kroah-Hartman
maintainerPATCH 121/138 irqchip/gic-v3-its: Prevent double free on error
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guanrui Huang <[email protected]>
commit c26591afd33adce296c022e3480dea4282b7ef91 upstream.
The error handling path in its_vpe_irq_domain_alloc() causes a double free when its_vpe_init() fails after successfully allocating at least one interrupt. This happens because its_vpe_irq_domain_free() frees the interrupts along with the area bitmap and the vprop_page and its_vpe_irq_domain_alloc() subsequently frees the area bitmap and the vprop_page again.
Fix this by unconditionally invoking its_vpe_irq_domain_free() which handles all cases correctly and by removing the bitmap/vprop_page freeing from its_vpe_irq_domain_alloc().
[ tglx: Massaged change log ]
--- drivers/irqchip/irq-gic-v3-its.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
drivers/irqchip/irq-gic-v3-its.c +2 -7
@@ -4508,13 +4508,8 @@ static int its_vpe_irq_domain_alloc(struset_bit (i, bitmap); } -if (err) { -if (i >0 ) -its_vpe_irq_domain_free (domain, virq, i); - -its_lpi_free (bitmap, base, nr_ids); -its_free_prop_table (vprop_page); - } +if (err) +its_vpe_irq_domain_free (domain, virq, i);return err; }
Greg Kroah-Hartman
maintainerPATCH 122/138 ethernet: Add helper for assigning packet type when dest address does not match device address
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rahul Rameshbabu <[email protected]>
commit 6e159fd653d7ebf6290358e0330a0cb8a75cf73b upstream.
Enable reuse of logic in eth_type_trans for determining packet type.
--- include/linux/etherdevice.h | 25 +++++++++++++++++++++++++ net/ethernet/eth.c | 12 +----------- 2 files changed, 26 insertions(+), 11 deletions(-)
include/linux/etherdevice.h +25 -0
@@ -543,6 +543,31 @@ static inline unsigned long compare_ethe }/** +* eth_skb_pkt_type - Assign packet type if destination address does not match +* @skb: Assigned a packet type if address does not match @dev address +* @dev: Network device used to compare packet address against +* +* If the destination MAC address of the packet does not match the network +* device address, assign an appropriate packet type. +*/ +static inline void eth_skb_pkt_type (struct sk_buff *skb, +const struct net_device *dev) +{ +const struct ethhdr *eth =eth_hdr (skb); + +if (unlikely (!ether_addr_equal_64bits (eth->h_dest, dev->dev_addr))) { +if (unlikely (is_multicast_ether_addr_64bits (eth->h_dest))) { +if (ether_addr_equal_64bits (eth->h_dest, dev->broadcast)) + skb->pkt_type =PACKET_BROADCAST ; +else + skb->pkt_type =PACKET_MULTICAST ; + }else { + skb->pkt_type =PACKET_OTHERHOST ; + } + } +} + +/** * eth_skb_pad - Pad buffer to mininum number of octets for Ethernet frame * @skb: Buffer to pad *
net/ethernet/eth.c +1 -11
@@ -164,17 +164,7 @@ __be16 eth_type_trans(struct sk_buff *sk eth = (struct ethhdr *)skb->data;skb_pull_inline (skb,ETH_HLEN ); -if (unlikely (!ether_addr_equal_64bits (eth->h_dest, - dev->dev_addr))) { -if (unlikely (is_multicast_ether_addr_64bits (eth->h_dest))) { -if (ether_addr_equal_64bits (eth->h_dest, dev->broadcast)) - skb->pkt_type =PACKET_BROADCAST ; -else - skb->pkt_type =PACKET_MULTICAST ; - }else { - skb->pkt_type =PACKET_OTHERHOST ; - } - } +eth_skb_pkt_type (skb, dev);/* * Some variants of DSA tagging don't have an ethertype field
Greg Kroah-Hartman
maintainerPATCH 123/138 net: b44: set pause params only when interface is up
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Münster <[email protected]>
commit e3eb7dd47bd4806f00e104eb6da092c435f9fb21 upstream.
b44_free_rings() accesses b44::rx_buffers (and ::tx_buffers) unconditionally, but b44::rx_buffers is only valid when the device is up (they get allocated in b44_open(), and deallocated again in b44_close()), any other time these are just a NULL pointers.
So if you try to change the pause params while the network interface is disabled/administratively down, everything explodes (which likely netifd tries to do).
--- drivers/net/ethernet/broadcom/b44.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/net/ethernet/broadcom/b44.c +8 -6
@@ -2027,12 +2027,14 @@ static int b44_set_pauseparam(struct net bp->flags |=B44_FLAG_TX_PAUSE ; else bp->flags &= ~B44_FLAG_TX_PAUSE; -if (bp->flags &B44_FLAG_PAUSE_AUTO ) { -b44_halt (bp); -b44_init_rings (bp); -b44_init_hw (bp,B44_FULL_RESET ); - }else { -__b44_set_flow_ctrl (bp, bp->flags); +if (netif_running (dev)) { +if (bp->flags &B44_FLAG_PAUSE_AUTO ) { +b44_halt (bp); +b44_init_rings (bp); +b44_init_hw (bp,B44_FULL_RESET ); + }else { +__b44_set_flow_ctrl (bp, bp->flags); + } }spin_unlock_irq (&bp->lock);
Greg Kroah-Hartman
maintainerPATCH 124/138 stackdepot: respect __GFP_NOLOCKDEP allocation flag
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Ryabinin <[email protected]>
commit 6fe60465e1d53ea321ee909be26d97529e8f746c upstream.
If stack_depot_save_flags() allocates memory it always drops __GFP_NOLOCKDEP flag. So when KASAN tries to track __GFP_NOLOCKDEP allocation we may end up with lockdep splat like bellow:
======================================================
WARNING: possible circular locking dependency detected 6.9.0-rc3+ #49 Not tainted
------------------------------------------------------
kswapd0/149 is trying to acquire lock:
ffff88811346a920
(&xfs_nondir_ilock_class){++++}-{4:4}, at: xfs_reclaim_inode+0x3ac/0x590 [xfs]
but task is already holding lock:
ffffffff8bb33100 (fs_reclaim){+.+.}-{0:0}, at:balance_pgdat+0x5d9/0xad0
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (fs_reclaim){+.+.}-{0:0}:
__lock_acquire+0x7da/0x1030
lock_acquire+0x15d/0x400
fs_reclaim_acquire+0xb5/0x100
prepare_alloc_pages.constprop.0+0xc5/0x230
__alloc_pages+0x12a/0x3f0
alloc_pages_mpol+0x175/0x340
stack_depot_save_flags+0x4c5/0x510
kasan_save_stack+0x30/0x40
kasan_save_track+0x10/0x30
__kasan_slab_alloc+0x83/0x90
kmem_cache_alloc+0x15e/0x4a0
__alloc_object+0x35/0x370
__create_object+0x22/0x90
__kmalloc_node_track_caller+0x477/0x5b0
krealloc+0x5f/0x110
xfs_iext_insert_raw+0x4b2/0x6e0 [xfs]
xfs_iext_insert+0x2e/0x130 [xfs]
xfs_iread_bmbt_block+0x1a9/0x4d0 [xfs]
xfs_btree_visit_block+0xfb/0x290 [xfs]
xfs_btree_visit_blocks+0x215/0x2c0 [xfs]
xfs_iread_extents+0x1a2/0x2e0 [xfs]
xfs_buffered_write_iomap_begin+0x376/0x10a0 [xfs]
iomap_iter+0x1d1/0x2d0
iomap_file_buffered_write+0x120/0x1a0
xfs_file_buffered_write+0x128/0x4b0 [xfs]
vfs_write+0x675/0x890
ksys_write+0xc3/0x160
do_syscall_64+0x94/0x170
entry_SYSCALL_64_after_hwframe+0x71/0x79Always preserve __GFP_NOLOCKDEP to fix this.
--- lib/stackdepot.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
lib/stackdepot.c +2 -2
@@ -271,10 +271,10 @@ depot_stack_handle_t stack_depot_save(un/* * Zero out zone modifiers, as we don't have specific zone * requirements. Keep the flags related to allocation in atomic -* contexts and I/O. +* contexts, I/O, nolockdep. */ alloc_flags &= ~GFP_ZONEMASK ; - alloc_flags &= (GFP_ATOMIC |GFP_KERNEL ); + alloc_flags &= (GFP_ATOMIC |GFP_KERNEL | __GFP_NOLOCKDEP); alloc_flags |= __GFP_NOWARN; page =alloc_pages (alloc_flags,STACK_ALLOC_ORDER );if (page)
Greg Kroah-Hartman
maintainerPATCH 125/138 mtd: diskonchip: work around ubsan link failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 21c9fb611c25d5cd038f6fe485232e7884bb0b3d upstream.
I ran into a randconfig build failure with UBSAN using gcc-13.2:
arm-linux-gnueabi-ld: error: unplaced orphan section .bss..Lubsan_data31' from drivers/mtd/nand/raw/diskonchip.o'
I'm not entirely sure what is going on here, but I suspect this has something to do with the check for the end of the doc_locations[] array that contains an (unsigned long)0xffffffff element, which is compared against the signed (int)0xffffffff. If this is the case, we should get a runtime check for undefined behavior, but we instead get an unexpected build-time error.
I would have expected this to work fine on 32-bit architectures despite the signed integer overflow, though on 64-bit architectures this likely won't ever work.
Changing the contition to instead check for the size of the array makes the code safe everywhere and avoids the ubsan check that leads to the link error. The loop code goes back to before 2.6.12.
--- drivers/mtd/nand/raw/diskonchip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mtd/nand/raw/diskonchip.c +2 -2
@@ -53,7 +53,7 @@ static unsigned long doc_locations[] __i 0xe8000, 0xea000, 0xec000, 0xee000, #endif #endif - 0xffffffff }; +}; static struct mtd_info *doclist = NULL;
@@ -1552,7 +1552,7 @@ static int __init init_nanddoc(void)if (ret <0 )return ret; }else { -for (i =0 ; (doc_locations[i] !=0xffffffff ); i++) { +for (i =0 ; i <ARRAY_SIZE (doc_locations); i++) {doc_probe (doc_locations[i]); } }
Greg Kroah-Hartman
maintainerPATCH 126/138 tcp: Clean up kernel listeners reqsk in inet_twsk_purge()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
commit 740ea3c4a0b2e326b23d7cdf05472a0e92aa39bc upstream.
Eric Dumazet reported a use-after-free related to the per-netns ehash series. [0]
When we create a TCP socket from userspace, the socket always holds a refcnt of the netns. This guarantees that a reqsk timer is always fired before netns dismantle. Each reqsk has a refcnt of its listener, so the listener is not freed before the reqsk, and the net is not freed before the listener as well.
OTOH, when in-kernel users create a TCP socket, it might not hold a refcnt of its netns. Thus, a reqsk timer can be fired after the netns dismantle and access freed per-netns ehash.
To avoid the use-after-free, we need to clean up TCP_NEW_SYN_RECV sockets in inet_twsk_purge() if the netns uses a per-netns ehash.
[0]: https://lore.kernel.org/netdev/CANn89iLXMup0dRD_Ov79Xt8N9FM0XdhCHEN05sf3eLwxKweM6w@mail.gmail.com/
BUG: KASAN: use-after-free in tcp_or_dccp_get_hashinfo include/net/inet_hashtables.h:181 [inline] BUG: KASAN: use-after-free in reqsk_queue_unlink+0x320/0x350 net/ipv4/inet_connection_sock.c:913 Read of size 8 at addr ffff88807545bd80 by task syz-executor.2/8301 CPU: 1 PID: 8301 Comm: syz-executor.2 Not tainted 6.0.0-syzkaller-02757-gaf7d23f9d96a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x719 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 tcp_or_dccp_get_hashinfo include/net/inet_hashtables.h:181 [inline] reqsk_queue_unlink+0x320/0x350 net/ipv4/inet_connection_sock.c:913 inet_csk_reqsk_queue_drop net/ipv4/inet_connection_sock.c:927 [inline] inet_csk_reqsk_queue_drop_and_put net/ipv4/inet_connection_sock.c:939 [inline] reqsk_timer_handler+0x724/0x1160 net/ipv4/inet_connection_sock.c:1053 call_timer_fn+0x1a0/0x6b0 kernel/time/timer.c:1474 expire_timers kernel/time/timer.c:1519 [inline] __run_timers.part.0+0x674/0xa80 kernel/time/timer.c:1790 __run_timers kernel/time/timer.c:1768 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803 __do_softirq+0x1d0/0x9c8 kernel/softirq.c:571 invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1107 </IRQ>
--- net/ipv4/inet_timewait_sock.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
net/ipv4/inet_timewait_sock.c +14 -1
@@ -268,8 +268,21 @@ restart_rcu:rcu_read_lock (); restart:sk_nulls_for_each_rcu (sk, node, &head->chain) { -if (sk->sk_state !=TCP_TIME_WAIT ) +if (sk->sk_state !=TCP_TIME_WAIT ) { +/* A kernel listener socket might not hold refcnt for net, +* so reqsk_timer_handler() could be fired after net is +* freed. Userspace listener and reqsk never exist here. +*/ +if (unlikely (sk->sk_state ==TCP_NEW_SYN_RECV && + hashinfo->pernet)) { +struct request_sock *req =inet_reqsk (sk); + +inet_csk_reqsk_queue_drop_and_put (req->rsk_listener, req); + } +continue ; + } + tw =inet_twsk (sk);if ((tw->tw_family != family) ||refcount_read (&twsk_net (tw)->count))
Greg Kroah-Hartman
maintainerPATCH 127/138 tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 1c4e97dd2d3c9a3e84f7e26346aa39bc426d3249 upstream.
inet_twsk_purge() uses rcu to find TIME_WAIT and NEW_SYN_RECV objects to purge.
These objects use SLAB_TYPESAFE_BY_RCU semantic and need special care. We need to use refcount_inc_not_zero(&sk->sk_refcnt).
Reuse the existing correct logic I wrote for TIME_WAIT, because both structures have common locations for sk_state, sk_family, and netns pointer.
If after the refcount_inc_not_zero() the object fields longer match the keys, use sock_gen_put(sk) to release the refcount.
Then we can call inet_twsk_deschedule_put() for TIME_WAIT, inet_csk_reqsk_queue_drop_and_put() for NEW_SYN_RECV sockets, with BH disabled.
Then we need to restart the loop because we had drop rcu_read_lock().
--- net/ipv4/inet_timewait_sock.c | 41 +++++++++++++++++++---------------------- 1 file changed, 19 insertions(+), 22 deletions(-)
net/ipv4/inet_timewait_sock.c +19 -22
@@ -254,12 +254,12 @@ void __inet_twsk_schedule(struct inet_ti }EXPORT_SYMBOL_GPL (__inet_twsk_schedule); +/* Remove all non full sockets (TIME_WAIT and NEW_SYN_RECV) for dead netns */ void inet_twsk_purge (struct inet_hashinfo *hashinfo,int family) { -struct inet_timewait_sock *tw; -struct sock *sk;struct hlist_nulls_node *node;unsigned int slot; +struct sock *sk;for (slot =0 ; slot <= hashinfo->ehash_mask; slot++) {struct inet_ehash_bucket *head = &hashinfo->ehash[slot];
@@ -268,38 +268,35 @@ restart_rcu:rcu_read_lock (); restart:sk_nulls_for_each_rcu (sk, node, &head->chain) { -if (sk->sk_state !=TCP_TIME_WAIT ) { -/* A kernel listener socket might not hold refcnt for net, -* so reqsk_timer_handler() could be fired after net is -* freed. Userspace listener and reqsk never exist here. -*/ -if (unlikely (sk->sk_state ==TCP_NEW_SYN_RECV && - hashinfo->pernet)) { -struct request_sock *req =inet_reqsk (sk); - -inet_csk_reqsk_queue_drop_and_put (req->rsk_listener, req); - } +int state =inet_sk_state_load (sk); +if ((1 << state) & ~(TCPF_TIME_WAIT | +TCPF_NEW_SYN_RECV ))continue ; - } - tw =inet_twsk (sk); -if ((tw->tw_family != family) || -refcount_read (&twsk_net (tw)->count)) +if (sk->sk_family != family || +refcount_read (&sock_net (sk)->count))continue ; -if (unlikely (!refcount_inc_not_zero (&tw->tw_refcnt))) +if (unlikely (!refcount_inc_not_zero (&sk->sk_refcnt)))continue ; -if (unlikely ((tw->tw_family != family) || -refcount_read (&twsk_net (tw)->count))) { -inet_twsk_put (tw); +if (unlikely (sk->sk_family != family || +refcount_read (&sock_net (sk)->count))) { +sock_gen_put (sk); goto restart; }rcu_read_unlock ();local_bh_disable (); -inet_twsk_deschedule_put (tw); +if (state ==TCP_TIME_WAIT ) { +inet_twsk_deschedule_put (inet_twsk (sk)); + }else { +struct request_sock *req =inet_reqsk (sk); + +inet_csk_reqsk_queue_drop_and_put (req->rsk_listener, + req); + }local_bh_enable (); goto restart_rcu; }
Greg Kroah-Hartman
maintainerPATCH 128/138 dmaengine: owl: fix register access functions
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 43c633ef93a5d293c96ebcedb40130df13128428 ]
When building with 'make W=1', clang notices that the computed register values are never actually written back but instead the wrong variable is set:
drivers/dma/owl-dma.c:244:6: error: variable 'regval' set but not used [-Werror,-Wunused-but-set-variable]
244 | u32 regval;
| ^drivers/dma/owl-dma.c:268:6: error: variable 'regval' set but not used [-Werror,-Wunused-but-set-variable]
268 | u32 regval;
| ^
Change these to what was most likely intended.
--- drivers/dma/owl-dma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/dma/owl-dma.c +2 -2
@@ -249,7 +249,7 @@ static void pchan_update(struct owl_dma_pchan *pchan, u32 reg,else regval &= ~val; -writel (val, pchan->base + reg); +writel (regval, pchan->base + reg); }static void pchan_writel (struct owl_dma_pchan *pchan,u32 reg,u32 data)
@@ -273,7 +273,7 @@ static void dma_update(struct owl_dma *od, u32 reg, u32 val, bool state)else regval &= ~val; -writel (val, od->base + reg); +writel (regval, od->base + reg); }static void dma_writel (struct owl_dma *od,u32 reg,u32 data)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/138 idma64: Dont try to serve interrupts when device is powered off
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 9140ce47872bfd89fca888c2f992faa51d20c2bc ]
When iDMA 64-bit device is powered off, the IRQ status register is all 1:s. This is never happen in real case and signalling that the device is simply powered off. Don't try to serve interrupts that are not ours.
--- drivers/dma/idma64.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/dma/idma64.c +4 -0
@@ -167,6 +167,10 @@ static irqreturn_t idma64_irq(int irq, void *dev)u32 status_err;unsigned short i; +/* Since IRQ may be shared, check if DMA controller is powered on */ +if (status ==GENMASK (31 ,0 )) +return IRQ_NONE ; +dev_vdbg (idma64->dma.dev,"%s: status=%#x\n" , __func__, status);/* Check if we have any interrupt from the DMA controller */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/138 dma: xilinx_dpdma: Fix locking
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit 244296cc3a155199a8b080d19e645d7d49081a38 ]
There are several places where either chan->lock or chan->vchan.lock was not held. Add appropriate locking. This fixes lockdep warnings like
[ 31.077578] ------------[ cut here ]------------ [ 31.077831] WARNING: CPU: 2 PID: 40 at drivers/dma/xilinx/xilinx_dpdma.c:834 xilinx_dpdma_chan_queue_transfer+0x274/0x5e0 [ 31.077953] Modules linked in: [ 31.078019] CPU: 2 PID: 40 Comm: kworker/u12:1 Not tainted 6.6.20+ #98 [ 31.078102] Hardware name: xlnx,zynqmp (DT) [ 31.078169] Workqueue: events_unbound deferred_probe_work_func [ 31.078272] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 31.078377] pc : xilinx_dpdma_chan_queue_transfer+0x274/0x5e0 [ 31.078473] lr : xilinx_dpdma_chan_queue_transfer+0x270/0x5e0 [ 31.078550] sp : ffffffc083bb2e10 [ 31.078590] x29: ffffffc083bb2e10 x28: 0000000000000000 x27: ffffff880165a168 [ 31.078754] x26: ffffff880164e920 x25: ffffff880164eab8 x24: ffffff880164d480 [ 31.078920] x23: ffffff880165a148 x22: ffffff880164e988 x21: 0000000000000000 [ 31.079132] x20: ffffffc082aa3000 x19: ffffff880164e880 x18: 0000000000000000 [ 31.079295] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 31.079453] x14: 0000000000000000 x13: ffffff8802263dc0 x12: 0000000000000001 [ 31.079613] x11: 0001ffc083bb2e34 x10: 0001ff880164e98f x9 : 0001ffc082aa3def [ 31.079824] x8 : 0001ffc082aa3dec x7 : 0000000000000000 x6 : 0000000000000516 [ 31.079982] x5 : ffffffc7f8d43000 x4 : ffffff88003c9c40 x3 : ffffffffffffffff [ 31.080147] x2 : ffffffc7f8d43000 x1 : 00000000000000c0 x0 : 0000000000000000 [ 31.080307] Call trace: [ 31.080340] xilinx_dpdma_chan_queue_transfer+0x274/0x5e0 [ 31.080518] xilinx_dpdma_issue_pending+0x11c/0x120 [ 31.080595] zynqmp_disp_layer_update+0x180/0x3ac [ 31.080712] zynqmp_dpsub_plane_atomic_update+0x11c/0x21c [ 31.080825] drm_atomic_helper_commit_planes+0x20c/0x684 [ 31.080951] drm_atomic_helper_commit_tail+0x5c/0xb0 [ 31.081139] commit_tail+0x234/0x294 [ 31.081246] drm_atomic_helper_commit+0x1f8/0x210 [ 31.081363] drm_atomic_commit+0x100/0x140 [ 31.081477] drm_client_modeset_commit_atomic+0x318/0x384 [ 31.081634] drm_client_modeset_commit_locked+0x8c/0x24c [ 31.081725] drm_client_modeset_commit+0x34/0x5c [ 31.081812] __drm_fb_helper_restore_fbdev_mode_unlocked+0x104/0x168 [ 31.081899] drm_fb_helper_set_par+0x50/0x70 [ 31.081971] fbcon_init+0x538/0xc48 [ 31.082047] visual_init+0x16c/0x23c [ 31.082207] do_bind_con_driver.isra.0+0x2d0/0x634 [ 31.082320] do_take_over_console+0x24c/0x33c [ 31.082429] do_fbcon_takeover+0xbc/0x1b0 [ 31.082503] fbcon_fb_registered+0x2d0/0x34c [ 31.082663] register_framebuffer+0x27c/0x38c [ 31.082767] __drm_fb_helper_initial_config_and_unlock+0x5c0/0x91c [ 31.082939] drm_fb_helper_initial_config+0x50/0x74 [ 31.083012] drm_fbdev_dma_client_hotplug+0xb8/0x108 [ 31.083115] drm_client_register+0xa0/0xf4 [ 31.083195] drm_fbdev_dma_setup+0xb0/0x1cc [ 31.083293] zynqmp_dpsub_drm_init+0x45c/0x4e0 [ 31.083431] zynqmp_dpsub_probe+0x444/0x5e0 [ 31.083616] platform_probe+0x8c/0x13c [ 31.083713] really_probe+0x258/0x59c [ 31.083793] __driver_probe_device+0xc4/0x224 [ 31.083878] driver_probe_device+0x70/0x1c0 [ 31.083961] __device_attach_driver+0x108/0x1e0 [ 31.084052] bus_for_each_drv+0x9c/0x100 [ 31.084125] __device_attach+0x100/0x298 [ 31.084207] device_initial_probe+0x14/0x20 [ 31.084292] bus_probe_device+0xd8/0xdc [ 31.084368] deferred_probe_work_func+0x11c/0x180 [ 31.084451] process_one_work+0x3ac/0x988 [ 31.084643] worker_thread+0x398/0x694 [ 31.084752] kthread+0x1bc/0x1c0 [ 31.084848] ret_from_fork+0x10/0x20 [ 31.084932] irq event stamp: 64549 [ 31.084970] hardirqs last enabled at (64548): [<ffffffc081adf35c>] _raw_spin_unlock_irqrestore+0x80/0x90 [ 31.085157] hardirqs last disabled at (64549): [<ffffffc081adf010>] _raw_spin_lock_irqsave+0xc0/0xdc [ 31.085277] softirqs last enabled at (64503): [<ffffffc08001071c>] __do_softirq+0x47c/0x500 [ 31.085390] softirqs last disabled at (64498): [<ffffffc080017134>] ____do_softirq+0x10/0x1c [ 31.085501] ---[ end trace 0000000000000000 ]---
--- drivers/dma/xilinx/xilinx_dpdma.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/dma/xilinx/xilinx_dpdma.c +10 -3
@@ -213,7 +213,8 @@ struct xilinx_dpdma_tx_desc {* @running: true if the channel is running * @first_frame: flag for the first frame of stream * @video_group: flag if multi-channel operation is needed for video channels -* @lock: lock to access struct xilinx_dpdma_chan +* @lock: lock to access struct xilinx_dpdma_chan. Must be taken before +* @vchan.lock, if both are to be held. * @desc_pool: descriptor allocation pool * @err_task: error IRQ bottom half handler * @desc: References to descriptors being processed
@@ -1101,12 +1102,14 @@ static void xilinx_dpdma_chan_vsync_irq(struct xilinx_dpdma_chan *chan)* Complete the active descriptor, if any, promote the pending * descriptor to active, and queue the next transfer, if any. */ +spin_lock (&chan->vchan.lock);if (chan->desc.active)vchan_cookie_complete (&chan->desc.active->vdesc); chan->desc.active = pending; chan->desc.pending =NULL ;xilinx_dpdma_chan_queue_transfer (chan); +spin_unlock (&chan->vchan.lock); out:spin_unlock_irqrestore (&chan->lock, flags);
@@ -1264,10 +1267,12 @@ static void xilinx_dpdma_issue_pending(struct dma_chan *dchan)struct xilinx_dpdma_chan *chan =to_xilinx_chan (dchan);unsigned long flags; -spin_lock_irqsave (&chan->vchan.lock, flags); +spin_lock_irqsave (&chan->lock, flags); +spin_lock (&chan->vchan.lock);if (vchan_issue_pending (&chan->vchan))xilinx_dpdma_chan_queue_transfer (chan); -spin_unlock_irqrestore (&chan->vchan.lock, flags); +spin_unlock (&chan->vchan.lock); +spin_unlock_irqrestore (&chan->lock, flags); } static int xilinx_dpdma_config(struct dma_chan *dchan,
@@ -1491,7 +1496,9 @@ static void xilinx_dpdma_chan_err_task(struct tasklet_struct *t) XILINX_DPDMA_EINTR_CHAN_ERR_MASK << chan->id);spin_lock_irqsave (&chan->lock, flags); +spin_lock (&chan->vchan.lock);xilinx_dpdma_chan_queue_transfer (chan); +spin_unlock (&chan->vchan.lock);spin_unlock_irqrestore (&chan->lock, flags); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/138 riscv: fix VMALLOC_START definition
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baoquan He <[email protected]>
[ Upstream commit ac88ff6b9d7dea9f0907c86bdae204dde7d5c0e6 ]
When below config items are set, compiler complained:
--------------------CONFIG_CRASH_CORE=yCONFIG_KEXEC_CORE=yCONFIG_CRASH_DUMP=y
......
-----------------------
-------------------------------------------------------------------arch/riscv/kernel/crash_core.c: In function 'arch_crash_save_vmcoreinfo':arch/riscv/kernel/crash_core.c:11:58: warning: format '%lx' expects argument of type 'long unsigned int', but argument 2 has type 'int' [-Wformat=]
11 | vmcoreinfo_append_str("NUMBER(VMALLOC_START)=0x%lx\n", VMALLOC_START);
| ~~^
| |
| long unsigned int
| %x----------------------------------------------------------------------
This is because on riscv macro VMALLOC_START has different type when CONFIG_MMU is set or unset.
arch/riscv/include/asm/pgtable.h:
--------------------------------------------------
Changing it to _AC(0, UL) in case CONFIG_MMU=n can fix the warning.
Stable-dep-of: 6065e736f82c ("riscv: Fix TASK_SIZE on 64-bit NOMMU")
--- arch/riscv/include/asm/pgtable.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/include/asm/pgtable.h +1 -1
@@ -457,7 +457,7 @@ static inline int ptep_clear_flush_young(struct vm_area_struct *vma,#define PAGE_KERNEL __pgprot(0)#define swapper_pg_dir NULL#define TASK_SIZE 0xffffffffUL -#define VMALLOC_START 0 +#define VMALLOC_START _AC(0, UL)#define VMALLOC_END TASK_SIZEstatic inline void __kernel_map_pages (struct page *page,int numpages,int enable) {}
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/138 riscv: Fix TASK_SIZE on 64-bit NOMMU
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Holland <[email protected]>
[ Upstream commit 6065e736f82c817c9a597a31ee67f0ce4628e948 ]
On NOMMU, userspace memory can come from anywhere in physical RAM. The current definition of TASK_SIZE is wrong if any RAM exists above 4G, causing spurious failures in the userspace access routines.
--- arch/riscv/include/asm/pgtable.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/include/asm/pgtable.h +1 -1
@@ -456,7 +456,7 @@ static inline int ptep_clear_flush_young(struct vm_area_struct *vma,#define PAGE_SHARED __pgprot(0)#define PAGE_KERNEL __pgprot(0)#define swapper_pg_dir NULL -#define TASK_SIZE 0xffffffffUL +#define TASK_SIZE _AC(-1, UL)#define VMALLOC_START _AC(0, UL)#define VMALLOC_END TASK_SIZE
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/138 i2c: smbus: fix NULL function pointer dereference
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit 91811a31b68d3765b3065f4bb6d7d6d84a7cfc9f ]
Baruch reported an OOPS when using the designware controller as target only. Target-only modes break the assumption of one transfer function always being available. Fix this by always checking the pointer in __i2c_transfer.
--- drivers/i2c/i2c-core-base.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/i2c/i2c-core-base.c +6 -6
@@ -2013,13 +2013,18 @@ static int i2c_check_for_quirks(struct i2c_adapter *adap, struct i2c_msg *msgs,* Returns negative errno, else the number of messages executed. * * Adapter lock must be held when calling this function. No debug logging -* takes place. adap->algo->master_xfer existence isn't checked. +* takes place. */ int __i2c_transfer (struct i2c_adapter *adap,struct i2c_msg *msgs,int num) {unsigned long orig_jiffies;int ret, try; +if (!adap->algo->master_xfer) { +dev_dbg (&adap->dev,"I2C level transfers not supported\n" ); +return -EOPNOTSUPP ; + } +if (WARN_ON (!msgs || num <1 ))return -EINVAL ;
@@ -2086,11 +2091,6 @@ int i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) {int ret; -if (!adap->algo->master_xfer) { -dev_dbg (&adap->dev,"I2C level transfers not supported\n" ); -return -EOPNOTSUPP ; - } -/* REVISIT the fault reporting model here is weak: * * - When we get an error after receiving N bytes from a slave,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 134/138 HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <[email protected]>
commit 9c0f59e47a90c54d0153f8ddc0f80d7a36207d0e upstream.
The flag I2C_HID_READ_PENDING is used to serialize I2C operations. However, this is not necessary, because I2C core already has its own locking for that.
More importantly, this flag can cause a lock-up: if the flag is set in i2c_hid_xfer() and an interrupt happens, the interrupt handler (i2c_hid_irq) will check this flag and return immediately without doing anything, then the interrupt handler will be invoked again in an infinite loop.
Since interrupt handler is an RT task, it takes over the CPU and the flag-clearing task never gets scheduled, thus we have a lock-up.
Delete this unnecessary flag.
--- drivers/hid/i2c-hid/i2c-hid-core.c | 8 -------- 1 file changed, 8 deletions(-)
drivers/hid/i2c-hid/i2c-hid-core.c +0 -8
@@ -56,7 +56,6 @@/* flags */ #define I2C_HID_STARTED 0#define I2C_HID_RESET_PENDING 1 -#define I2C_HID_READ_PENDING 2#define I2C_HID_PWR_ON 0x00#define I2C_HID_PWR_SLEEP 0x01
@@ -256,7 +255,6 @@ static int __i2c_hid_command(struct i2c_ msg[1 ].len = data_len; msg[1 ].buf = buf_recv; msg_num =2 ; -set_bit (I2C_HID_READ_PENDING , &ihid->flags); }if (wait)
@@ -264,9 +262,6 @@ static int __i2c_hid_command(struct i2c_ ret =i2c_transfer (client->adapter, msg, msg_num); -if (data_len >0 ) -clear_bit (I2C_HID_READ_PENDING , &ihid->flags); -if (ret != msg_num)return ret <0 ? ret : -EIO ;
@@ -538,9 +533,6 @@ static irqreturn_t i2c_hid_irq(int irq, {struct i2c_hid *ihid = dev_id; -if (test_bit (I2C_HID_READ_PENDING , &ihid->flags)) -return IRQ_HANDLED ; -i2c_hid_get_input (ihid);return IRQ_HANDLED ;
Greg Kroah-Hartman
maintainerPATCH 135/138 bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
commit 5af385f5f4cddf908f663974847a4083b2ff2c79 upstream.
bits_per() rounds up to the next power of two when passed a power of two. This causes crashes on some machines and configurations.
--- kernel/bounds.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/bounds.c +1 -1
@@ -19,7 +19,7 @@ int main(void)DEFINE (NR_PAGEFLAGS , __NR_PAGEFLAGS);DEFINE (MAX_NR_ZONES , __MAX_NR_ZONES);#ifdef CONFIG_SMP -DEFINE (NR_CPUS_BITS ,bits_per (CONFIG_NR_CPUS )); +DEFINE (NR_CPUS_BITS ,order_base_2 (CONFIG_NR_CPUS ));#endif DEFINE (SPINLOCK_SIZE ,sizeof (spinlock_t));/* End of constants */
Greg Kroah-Hartman
maintainerPATCH 136/138 udp: preserve the connected status if only UDP cmsg
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yick Xie <[email protected]>
commit 680d11f6e5427b6af1321932286722d24a8b16c1 upstream.
If "udp_cmsg_send()" returned 0 (i.e. only UDP cmsg), "connected" should not be set to 0. Otherwise it stops the connected socket from using the cached route.
--- net/ipv4/udp.c | 5 +++-- net/ipv6/udp.c | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-)
net/ipv4/udp.c +3 -2
@@ -1125,16 +1125,17 @@ int udp_sendmsg(struct sock *sk, structif (msg->msg_controllen) { err =udp_cmsg_send (sk, msg, &ipc.gso_size); -if (err >0 ) +if (err >0 ) { err =ip_cmsg_send (sk, msg, &ipc, sk->sk_family ==AF_INET6 ); + connected =0 ; + }if (unlikely (err <0 )) {kfree (ipc.opt);return err; }if (ipc.opt) free =1 ; - connected =0 ; }if (!ipc.opt) {struct ip_options_rcu *inet_opt;
net/ipv6/udp.c +3 -2
@@ -1453,9 +1453,11 @@ do_udp_sendmsg: ipc6.opt = opt; err =udp_cmsg_send (sk, msg, &ipc6.gso_size); -if (err >0 ) +if (err >0 ) { err =ip6_datagram_send_ctl (sock_net (sk), sk, msg, &fl6, &ipc6); + connected = false; + }if (err <0 ) {fl6_sock_release (flowlabel);return err;
@@ -1467,7 +1469,6 @@ do_udp_sendmsg: }if (!(opt->opt_nflen|opt->opt_flen)) opt =NULL ; - connected = false; }if (!opt) { opt =txopt_get (np);
Greg Kroah-Hartman
maintainerPATCH 137/138 serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
commit 29bff582b74ed0bdb7e6986482ad9e6799ea4d2f upstream.
Fix the function name to avoid a kernel-doc warning:
include/linux/serial_core.h:666: warning: expecting prototype for uart_port_lock_irqrestore(). Prototype was for uart_port_unlock_irqrestore() instead
--- include/linux/serial_core.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/serial_core.h +1 -1
@@ -330,7 +330,7 @@ static inline void uart_port_unlock_irq( }/** -* uart_port_lock_irqrestore - Unlock the UART port, restore interrupts +* uart_port_unlock_irqrestore - Unlock the UART port, restore interrupts * @up: Pointer to UART port structure * @flags: The saved interrupt flags for restore */
Greg Kroah-Hartman
maintainerPATCH 138/138 riscv: Disable STACKPROTECTOR_PER_TASK if GCC_PLUGIN_RANDSTRUCT is enabled
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
commit a18b14d8886614b3c7d290c4cfc33389822b0535 upstream.
riscv uses the value of TSK_STACK_CANARY to set stack-protector-guard-offset. With GCC_PLUGIN_RANDSTRUCT enabled, that value is non-deterministic, and with riscv:allmodconfig often results in build errors such as
cc1: error: '8120' is not a valid offset in '-mstack-protector-guard-offset='
Enable STACKPROTECTOR_PER_TASK only if GCC_PLUGIN_RANDSTRUCT is disabled to fix the problem.
--- arch/riscv/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/riscv/Kconfig +1 -0
@@ -450,6 +450,7 @@ config CC_HAVE_STACKPROTECTOR_TLS config STACKPROTECTOR_PER_TASK def_bool y + depends on !GCC_PLUGIN_RANDSTRUCT depends on STACKPROTECTOR && CC_HAVE_STACKPROTECTOR_TLS endmenu
Hi Greg,
Quoted 20 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.216 release. There are 138 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 02 May 2024 10:30:27 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.216-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
...
Quoted 2 lines
Ikjoon Jang <[email protected]>
arm64: dts: mediatek: mt8183: Add power-domains properity to mfgcfg
The above commit is breaking the build for ARM64 ...
DTC arch/arm64/boot/dts/mediatek/mt8183-evb.dtb
Error: arch/arm64/boot/dts/mediatek/mt8183.dtsi:768.26-27 syntax error
FATAL ERROR: Unable to parse input tree
make[2]: *** [scripts/Makefile.lib:326: arch/arm64/boot/dts/mediatek/mt8183-evb.dtb] Error 1 make[1]: *** [scripts/Makefile.build:503: arch/arm64/boot/dts/mediatek] Error 2
After reverting this, the dtbs build fine again.
Jon
Signature · 1 line
nvpublic
Greg Kroah-Hartman
maintainerQuoted 32 lines · Jon Hunter
Hi Greg,
Quoted 20 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.216 release. There are 138 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 02 May 2024 10:30:27 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.216-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:...
Quoted 2 lines
Ikjoon Jang <[email protected]>
arm64: dts: mediatek: mt8183: Add power-domains properity to mfgcfgThe above commit is breaking the build for ARM64 ...
Quoted 7 lines
DTC
arch/arm64/boot/dts/mediatek/mt8183-evb.dtb
Error: arch/arm64/boot/dts/mediatek/mt8183.dtsi:768.26-27 syntax error
FATAL ERROR: Unable to parse input tree
make[2]: *** [scripts/Makefile.lib:326:arch/arm64/boot/dts/mediatek/mt8183-evb.dtb] Error 1 make[1]: *** [scripts/Makefile.build:503:arch/arm64/boot/dts/mediatek] Error 2After reverting this, the dtbs build fine again.
Thanks, will drop it from here and push out a -rc2.
greg k-h