5.10.219-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainerPATCH 149/317 serial: sc16is7xx: add proper sched.h include for sched_set_fifo()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <[email protected]>
[ Upstream commit 2a8e4ab0c93fad30769479f86849e22d63cd0e12 ]
Replace incorrect include with the proper one for sched_set_fifo() declaration.
--- drivers/tty/serial/sc16is7xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/sc16is7xx.c +1 -1
@@ -18,6 +18,7 @@#include <linux/module.h> #include <linux/property.h> #include <linux/regmap.h> +#include <linux/sched.h> #include <linux/serial_core.h> #include <linux/serial.h> #include <linux/tty.h>
@@ -25,7 +26,6 @@#include <linux/spi/spi.h> #include <linux/uaccess.h> #include <linux/units.h> -#include <uapi/linux/sched/types.h> #define SC16IS7XX_NAME "sc16is7xx"#define SC16IS7XX_MAX_DEVS 8
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 150/317 f2fs: compress: support chksum
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit b28f047b28c51d0b9864c34b097bb0b221ea7247 ]
This patch supports to store chksum value with compressed data, and verify the integrality of compressed data while reading the data.
The feature can be enabled through specifying mount option 'compress_chksum'.
Stable-dep-of: 7c5dffb3d90c ("f2fs: compress: fix to relocate check condition in f2fs_{release,reserve}_compress_blocks()")
--- Documentation/filesystems/f2fs.rst | 1 + fs/f2fs/compress.c | 23 +++++++++++++++++++++++ fs/f2fs/f2fs.h | 16 ++++++++++++++-- fs/f2fs/inode.c | 3 +++ fs/f2fs/super.c | 9 +++++++++ include/linux/f2fs_fs.h | 2 +- 6 files changed, 51 insertions(+), 3 deletions(-)
Documentation/filesystems/f2fs.rst +1 -0
@@ -260,6 +260,7 @@ compress_extension=%s Support adding specified extension, so that f2fs can enab For other files, we can still enable compression via ioctl. Note that, there is one reserved special extension '*', it can be set to enable compression for all files. +compress_chksum Support verifying chksum of raw data in compressed cluster. inlinecrypt When possible, encrypt/decrypt the contents of encrypted files using the blk-crypto framework rather than filesystem-layer encryption. This allows the use of
fs/f2fs/compress.c +23 -0
@@ -589,6 +589,7 @@ static int f2fs_compress_pages(struct compress_ctx *cc) f2fs_cops[fi->i_compress_algorithm];unsigned int max_len, new_nr_cpages;struct page **new_cpages; +u32 chksum =0 ;int i, ret; trace_f2fs_compress_pages_start(cc->inode, cc->cluster_idx,
@@ -642,6 +643,11 @@ static int f2fs_compress_pages(struct compress_ctx *cc) cc->cbuf->clen =cpu_to_le32 (cc->clen); +if (fi->i_compress_flag &1 <<COMPRESS_CHKSUM ) + chksum =f2fs_crc32 (F2FS_I_SB (cc->inode), + cc->cbuf->cdata, cc->clen); + cc->cbuf->chksum =cpu_to_le32 (chksum); +for (i =0 ; i <COMPRESS_DATA_RESERVED_SIZE ; i++) cc->cbuf->reserved[i] =cpu_to_le32 (0 );
@@ -777,6 +783,23 @@ void f2fs_decompress_pages(struct bio *bio, struct page *page, bool verity) ret = cops->decompress_pages (dic); +if (!ret && fi->i_compress_flag &1 <<COMPRESS_CHKSUM ) { +u32 provided =le32_to_cpu (dic->cbuf->chksum); +u32 calculated =f2fs_crc32 (sbi, dic->cbuf->cdata, dic->clen); + +if (provided != calculated) { +if (!is_inode_flag_set (dic->inode,FI_COMPRESS_CORRUPT )) { +set_inode_flag (dic->inode,FI_COMPRESS_CORRUPT ); +printk_ratelimited ( +"%sF2FS-fs (%s): checksum invalid, nid = %lu, %x vs %x" , +KERN_INFO , sbi->sb->s_id, dic->inode->i_ino, + provided, calculated); + } +set_sbi_flag (sbi,SBI_NEED_FSCK ); +WARN_ON_ONCE (1 ); + } + } + out_vunmap_cbuf:vm_unmap_ram (dic->cbuf, dic->nr_cpages); out_vunmap_rbuf:
fs/f2fs/f2fs.h +14 -2
@@ -147,7 +147,8 @@ struct f2fs_mount_info {/* For compression */ unsigned char compress_algorithm;/* algorithm type */ -unsigned compress_log_size;/* cluster log size */ +unsigned char compress_log_size;/* cluster log size */ +bool compress_chksum;/* compressed data chksum */ unsigned char compress_ext_cnt;/* extension count */ unsigned char extensions[COMPRESS_EXT_NUM ][F2FS_EXTENSION_LEN ];/* extensions */ };
@@ -678,6 +679,7 @@ enum {FI_ATOMIC_REVOKE_REQUEST ,/* request to drop atomic data */ FI_VERITY_IN_PROGRESS ,/* building fs-verity Merkle tree */ FI_COMPRESSED_FILE ,/* indicate file's data can be compressed */ +FI_COMPRESS_CORRUPT ,/* indicate compressed cluster is corrupted */ FI_MMAP_FILE ,/* indicate file was mmapped */ FI_MAX, /* max flag, never be used */ };
@@ -736,6 +738,7 @@ struct f2fs_inode_info {atomic_t i_compr_blocks;/* # of compressed blocks */ unsigned char i_compress_algorithm;/* algorithm type */ unsigned char i_log_cluster_size;/* log of cluster size */ +unsigned short i_compress_flag;/* compress flag */ unsigned int i_cluster_size;/* cluster size */ };
@@ -1281,9 +1284,15 @@ enum compress_algorithm_type { COMPRESS_MAX, }; -#define COMPRESS_DATA_RESERVED_SIZE 5 +enum compress_flag { +COMPRESS_CHKSUM , +COMPRESS_MAX_FLAG , +}; + +#define COMPRESS_DATA_RESERVED_SIZE 4struct compress_data {__le32 clen;/* compressed data size */ +__le32 chksum;/* compressed data chksum */ __le32 reserved[COMPRESS_DATA_RESERVED_SIZE ];/* reserved */ u8 cdata[];/* compressed data */ };
@@ -3925,6 +3934,9 @@ static inline void set_compress_context(struct inode *inode)F2FS_OPTION (sbi).compress_algorithm;F2FS_I (inode)->i_log_cluster_size =F2FS_OPTION (sbi).compress_log_size; +F2FS_I (inode)->i_compress_flag = +F2FS_OPTION (sbi).compress_chksum ? +1 <<COMPRESS_CHKSUM :0 ;F2FS_I (inode)->i_cluster_size =1 <<F2FS_I (inode)->i_log_cluster_size;F2FS_I (inode)->i_flags |=F2FS_COMPR_FL ;
fs/f2fs/inode.c +3 -0
@@ -455,6 +455,7 @@ static int do_read_inode(struct inode *inode) le64_to_cpu(ri->i_compr_blocks)); fi->i_compress_algorithm = ri->i_compress_algorithm; fi->i_log_cluster_size = ri->i_log_cluster_size; + fi->i_compress_flag =le16_to_cpu (ri->i_compress_flag); fi->i_cluster_size =1 << fi->i_log_cluster_size;set_inode_flag (inode,FI_COMPRESSED_FILE ); }
@@ -633,6 +634,8 @@ void f2fs_update_inode(struct inode *inode, struct page *node_page) &F2FS_I(inode)->i_compr_blocks)); ri->i_compress_algorithm =F2FS_I (inode)->i_compress_algorithm; + ri->i_compress_flag = +cpu_to_le16 (F2FS_I (inode)->i_compress_flag); ri->i_log_cluster_size =F2FS_I (inode)->i_log_cluster_size; }
fs/f2fs/super.c +9 -0
@@ -146,6 +146,7 @@ enum { Opt_compress_algorithm, Opt_compress_log_size, Opt_compress_extension, + Opt_compress_chksum, Opt_atgc, Opt_err, };
@@ -214,6 +215,7 @@ static match_table_t f2fs_tokens = { {Opt_compress_algorithm, "compress_algorithm=%s"}, {Opt_compress_log_size, "compress_log_size=%u"}, {Opt_compress_extension, "compress_extension=%s"}, + {Opt_compress_chksum, "compress_chksum"}, {Opt_atgc, "atgc"}, {Opt_err, NULL}, };
@@ -974,10 +976,14 @@ static int parse_options(struct super_block *sb, char *options, bool is_remount)F2FS_OPTION (sbi).compress_ext_cnt++;kfree (name);break ; +case Opt_compress_chksum: +F2FS_OPTION (sbi).compress_chksum = true; +break ;#else case Opt_compress_algorithm:case Opt_compress_log_size:case Opt_compress_extension: +case Opt_compress_chksum:f2fs_info (sbi,"compression options not supported" );break ;#endif
@@ -1562,6 +1568,9 @@ static inline void f2fs_show_compress_options(struct seq_file *seq,seq_printf (seq,",compress_extension=%s" ,F2FS_OPTION (sbi).extensions[i]); } + +if (F2FS_OPTION (sbi).compress_chksum) +seq_puts (seq,",compress_chksum" ); }static int f2fs_show_options (struct seq_file *seq,struct dentry *root)
include/linux/f2fs_fs.h +1 -1
@@ -273,7 +273,7 @@ struct f2fs_inode {__le64 i_compr_blocks;/* # of compressed blocks */ __u8 i_compress_algorithm;/* compress algorithm */ __u8 i_log_cluster_size;/* log of cluster size */ -__le16 i_padding;/* padding */ +__le16 i_compress_flag;/* compress flag */ __le32 i_extra_end[0 ];/* for attribute size calculation */ } __packed;__le32 i_addr[DEF_ADDRS_PER_INODE ];/* Pointers to data blocks */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 151/317 f2fs: add compress_mode mount option
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daeho Jeong <[email protected]>
[ Upstream commit 602a16d58e9aab3c423bcf051033ea6c9e8a6d37 ]
We will add a new "compress_mode" mount option to control file compression mode. This supports "fs" and "user". In "fs" mode (default), f2fs does automatic compression on the compression enabled files. In "user" mode, f2fs disables the automaic compression and gives the user discretion of choosing the target file and the timing. It means the user can do manual compression/decompression on the compression enabled files using ioctls.
Stable-dep-of: 7c5dffb3d90c ("f2fs: compress: fix to relocate check condition in f2fs_{release,reserve}_compress_blocks()")
--- Documentation/filesystems/f2fs.rst | 35 ++++++++++++++++++++++++++++++ fs/f2fs/compress.c | 2 +- fs/f2fs/data.c | 2 +- fs/f2fs/f2fs.h | 30 +++++++++++++++++++++++++ fs/f2fs/segment.c | 2 +- fs/f2fs/super.c | 23 ++++++++++++++++++++ 6 files changed, 91 insertions(+), 3 deletions(-)
Documentation/filesystems/f2fs.rst +35 -0
@@ -261,6 +261,13 @@ compress_extension=%s Support adding specified extension, so that f2fs can enab Note that, there is one reserved special extension '*', it can be set to enable compression for all files. compress_chksum Support verifying chksum of raw data in compressed cluster. +compress_mode=%s Control file compression mode. This supports "fs" and "user" + modes. In "fs" mode (default), f2fs does automatic compression + on the compression enabled files. In "user" mode, f2fs disables + the automaic compression and gives the user discretion of + choosing the target file and the timing. The user can do manual + compression/decompression on the compression enabled files using + ioctls. inlinecrypt When possible, encrypt/decrypt the contents of encrypted files using the blk-crypto framework rather than filesystem-layer encryption. This allows the use of
@@ -811,6 +818,34 @@ Compress metadata layout:: | data length | data chksum | reserved | compressed data | +-------------+-------------+----------+----------------------------+ +Compression mode +-------------------------- + +f2fs supports "fs" and "user" compression modes with "compression_mode" mount option. +With this option, f2fs provides a choice to select the way how to compress the +compression enabled files (refer to "Compression implementation" section for how to +enable compression on a regular inode). + +1) compress_mode=fs +This is the default option. f2fs does automatic compression in the writeback of the +compression enabled files. + +2) compress_mode=user +This disables the automaic compression and gives the user discretion of choosing the +target file and the timing. The user can do manual compression/decompression on the +compression enabled files using F2FS_IOC_DECOMPRESS_FILE and F2FS_IOC_COMPRESS_FILE +ioctls like the below. + +To decompress a file, + +fd = open(filename, O_WRONLY, 0); +ret = ioctl(fd, F2FS_IOC_DECOMPRESS_FILE); + +To compress a file, + +fd = open(filename, O_WRONLY, 0); +ret = ioctl(fd, F2FS_IOC_COMPRESS_FILE); + NVMe Zoned Namespace devices ----------------------------
fs/f2fs/compress.c +1 -1
@@ -929,7 +929,7 @@ int f2fs_is_compressed_cluster(struct inode *inode, pgoff_t index)static bool cluster_may_compress (struct compress_ctx *cc) { -if (!f2fs_compressed_file (cc->inode)) +if (!f2fs_need_compress_data (cc->inode))return false;if (f2fs_is_atomic_file (cc->inode))return false;
fs/f2fs/data.c +1 -1
@@ -3222,7 +3222,7 @@ static inline bool __should_serialize_io(struct inode *inode,if (IS_NOQUOTA (inode))return false; -if (f2fs_compressed_file (inode)) +if (f2fs_need_compress_data (inode))return true;if (wbc->sync_mode !=WB_SYNC_ALL )return true;
fs/f2fs/f2fs.h +30 -0
@@ -150,6 +150,7 @@ struct f2fs_mount_info {unsigned char compress_log_size;/* cluster log size */ bool compress_chksum;/* compressed data chksum */ unsigned char compress_ext_cnt;/* extension count */ +int compress_mode;/* compression mode */ unsigned char extensions[COMPRESS_EXT_NUM ][F2FS_EXTENSION_LEN ];/* extensions */ };
@@ -681,6 +682,7 @@ enum {FI_COMPRESSED_FILE ,/* indicate file's data can be compressed */ FI_COMPRESS_CORRUPT ,/* indicate compressed cluster is corrupted */ FI_MMAP_FILE ,/* indicate file was mmapped */ +FI_ENABLE_COMPRESS ,/* enable compression in "user" compression mode */ FI_MAX, /* max flag, never be used */ };
@@ -1255,6 +1257,18 @@ enum fsync_mode { FSYNC_MODE_NOBARRIER, /* fsync behaves nobarrier based on posix */ }; +enum { +COMPR_MODE_FS ,/* +* automatically compress compression +* enabled files +*/ +COMPR_MODE_USER ,/* +* automatical compression is disabled. +* user can control the file compression +* using ioctls +*/ +}; +/* * this value is set in page as a private data which indicate that * the page is atomically written, and it is in inmem_pages list.
@@ -2795,6 +2809,22 @@ static inline int f2fs_compressed_file(struct inode *inode)is_inode_flag_set (inode,FI_COMPRESSED_FILE ); } +static inline bool f2fs_need_compress_data (struct inode *inode) +{ +int compress_mode =F2FS_OPTION (F2FS_I_SB (inode)).compress_mode; + +if (!f2fs_compressed_file (inode)) +return false; + +if (compress_mode ==COMPR_MODE_FS ) +return true; +else if (compress_mode ==COMPR_MODE_USER && +is_inode_flag_set (inode,FI_ENABLE_COMPRESS )) +return true; + +return false; +} +static inline unsigned int addrs_per_inode (struct inode *inode) { unsigned int addrs = CUR_ADDRS_PER_INODE(inode) -
fs/f2fs/segment.c +1 -1
@@ -3296,7 +3296,7 @@ static int __get_segment_type_6(struct f2fs_io_info *fio)else return CURSEG_COLD_DATA ; } -if (file_is_cold (inode) ||f2fs_compressed_file (inode)) +if (file_is_cold (inode) ||f2fs_need_compress_data (inode))return CURSEG_COLD_DATA ; if (file_is_hot(inode) || is_inode_flag_set(inode, FI_HOT_DATA) ||
fs/f2fs/super.c +23 -0
@@ -147,6 +147,7 @@ enum { Opt_compress_log_size, Opt_compress_extension, Opt_compress_chksum, + Opt_compress_mode, Opt_atgc, Opt_err, };
@@ -216,6 +217,7 @@ static match_table_t f2fs_tokens = { {Opt_compress_log_size, "compress_log_size=%u"}, {Opt_compress_extension, "compress_extension=%s"}, {Opt_compress_chksum, "compress_chksum"}, + {Opt_compress_mode, "compress_mode=%s"}, {Opt_atgc, "atgc"}, {Opt_err, NULL}, };
@@ -979,11 +981,26 @@ static int parse_options(struct super_block *sb, char *options, bool is_remount)case Opt_compress_chksum:F2FS_OPTION (sbi).compress_chksum = true;break ; +case Opt_compress_mode: + name =match_strdup (&args[0 ]); +if (!name) +return -ENOMEM ; +if (!strcmp (name,"fs" )) { +F2FS_OPTION (sbi).compress_mode =COMPR_MODE_FS ; + }else if (!strcmp (name,"user" )) { +F2FS_OPTION (sbi).compress_mode =COMPR_MODE_USER ; + }else { +kfree (name); +return -EINVAL ; + } +kfree (name); +break ;#else case Opt_compress_algorithm:case Opt_compress_log_size:case Opt_compress_extension:case Opt_compress_chksum: +case Opt_compress_mode:f2fs_info (sbi,"compression options not supported" );break ;#endif
@@ -1571,6 +1588,11 @@ static inline void f2fs_show_compress_options(struct seq_file *seq,if (F2FS_OPTION (sbi).compress_chksum)seq_puts (seq,",compress_chksum" ); + +if (F2FS_OPTION (sbi).compress_mode ==COMPR_MODE_FS ) +seq_printf (seq,",compress_mode=%s" ,"fs" ); +else if (F2FS_OPTION (sbi).compress_mode ==COMPR_MODE_USER ) +seq_printf (seq,",compress_mode=%s" ,"user" ); }static int f2fs_show_options (struct seq_file *seq,struct dentry *root)
@@ -1720,6 +1742,7 @@ static void default_options(struct f2fs_sb_info *sbi)F2FS_OPTION (sbi).compress_algorithm =COMPRESS_LZ4 ;F2FS_OPTION (sbi).compress_log_size =MIN_COMPRESS_LOG_SIZE ;F2FS_OPTION (sbi).compress_ext_cnt =0 ; +F2FS_OPTION (sbi).compress_mode =COMPR_MODE_FS ;F2FS_OPTION (sbi).bggc_mode =BGGC_MODE_ON ; sbi->sb->s_flags &= ~SB_INLINECRYPT ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 152/317 f2fs: compress: clean up parameter of __f2fs_cluster_blocks()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 91f0fb6903ed30370135381f10c02a10c7872cdc ]
Previously, in order to reuse __f2fs_cluster_blocks(), f2fs_is_compressed_cluster() assigned a compress_ctx type variable, which is used to pass few parameters (cc.inode, cc.cluster_size, cc.cluster_idx), it's wasteful to allocate such large space in stack.
Let's clean up parameters of __f2fs_cluster_blocks() to avoid that.
Stable-dep-of: 7c5dffb3d90c ("f2fs: compress: fix to relocate check condition in f2fs_{release,reserve}_compress_blocks()")
--- fs/f2fs/compress.c | 33 +++++++++++++-------------------- 1 file changed, 13 insertions(+), 20 deletions(-)
fs/f2fs/compress.c +13 -20
@@ -866,14 +866,17 @@ static bool __cluster_may_compress(struct compress_ctx *cc)return true; } -static int __f2fs_cluster_blocks (struct compress_ctx *cc,bool compr) +static int __f2fs_cluster_blocks (struct inode *inode, +unsigned int cluster_idx,bool compr) {struct dnode_of_data dn; +unsigned int cluster_size =F2FS_I (inode)->i_cluster_size; +unsigned int start_idx = cluster_idx << +F2FS_I (inode)->i_log_cluster_size;int ret; -set_new_dnode (&dn, cc->inode,NULL ,NULL ,0 ); - ret =f2fs_get_dnode_of_data (&dn,start_idx_of_cluster (cc), -LOOKUP_NODE ); +set_new_dnode (&dn, inode,NULL ,NULL ,0 ); + ret =f2fs_get_dnode_of_data (&dn, start_idx,LOOKUP_NODE );if (ret) {if (ret == -ENOENT ) ret =0 ;
@@ -884,7 +887,7 @@ static int __f2fs_cluster_blocks(struct compress_ctx *cc, bool compr)int i; ret =1 ; -for (i =1 ; i < cc->cluster_size; i++) { +for (i =1 ; i < cluster_size; i++) {block_t blkaddr; blkaddr = data_blkaddr(dn.inode,
@@ -906,25 +909,15 @@ static int __f2fs_cluster_blocks(struct compress_ctx *cc, bool compr)/* return # of compressed blocks in compressed cluster */ static int f2fs_compressed_blocks (struct compress_ctx *cc) { -return __f2fs_cluster_blocks (cc, true); +return __f2fs_cluster_blocks (cc->inode, cc->cluster_idx, true); }/* return # of valid blocks in compressed cluster */ -static int f2fs_cluster_blocks (struct compress_ctx *cc) -{ -return __f2fs_cluster_blocks (cc, false); -} -int f2fs_is_compressed_cluster (struct inode *inode,pgoff_t index) { -struct compress_ctx cc = { - .inode = inode, - .log_cluster_size =F2FS_I (inode)->i_log_cluster_size, - .cluster_size =F2FS_I (inode)->i_cluster_size, - .cluster_idx = index >>F2FS_I (inode)->i_log_cluster_size, - }; - -return f2fs_cluster_blocks (&cc); +return __f2fs_cluster_blocks (inode, + index >>F2FS_I (inode)->i_log_cluster_size, + false); }static bool cluster_may_compress (struct compress_ctx *cc)
@@ -975,7 +968,7 @@ static int prepare_compress_overwrite(struct compress_ctx *cc,bool prealloc; retry: - ret =f2fs_cluster_blocks (cc); + ret =f2fs_is_compressed_cluster (cc->inode, start_idx);if (ret <=0 )return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 153/317 f2fs: compress: remove unneeded preallocation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 8f1d49832636d514e949b29ce64370ebebf6d6d2 ]
We will reserve iblocks for compression saved, so during compressed cluster overwrite, we don't need to preallocate blocks for later write.
In addition, it adds a bug_on to detect wrong reserved iblock number in __f2fs_cluster_blocks().
Bug fix in the original patch by Jaegeuk:
If we released compressed blocks having an immutable bit, we can see less number of compressed block addresses. Let's fix wrong BUG_ON.
Stable-dep-of: 7c5dffb3d90c ("f2fs: compress: fix to relocate check condition in f2fs_{release,reserve}_compress_blocks()")
--- fs/f2fs/compress.c | 27 +++------------------------ fs/f2fs/file.c | 4 ---- 2 files changed, 3 insertions(+), 28 deletions(-)
fs/f2fs/compress.c +3 -24
@@ -900,6 +900,9 @@ static int __f2fs_cluster_blocks(struct inode *inode, ret++; } } + +f2fs_bug_on (F2FS_I_SB (inode), + !compr && ret != cluster_size && !IS_IMMUTABLE (inode)); } fail:f2fs_put_dnode (&dn);
@@ -960,21 +963,16 @@ static int prepare_compress_overwrite(struct compress_ctx *cc,struct f2fs_sb_info *sbi =F2FS_I_SB (cc->inode);struct address_space *mapping = cc->inode->i_mapping;struct page *page; -struct dnode_of_data dn;sector_t last_block_in_bio;unsigned fgp_flag =FGP_LOCK |FGP_WRITE |FGP_CREAT ;pgoff_t start_idx =start_idx_of_cluster (cc);int i, ret; -bool prealloc; retry: ret =f2fs_is_compressed_cluster (cc->inode, start_idx);if (ret <=0 )return ret; -/* compressed case */ - prealloc = (ret < cc->cluster_size); - ret =f2fs_init_compress_ctx (cc);if (ret)return ret;
@@ -1032,25 +1030,6 @@ static int prepare_compress_overwrite(struct compress_ctx *cc, } } -if (prealloc) { -f2fs_do_map_lock (sbi,F2FS_GET_BLOCK_PRE_AIO , true); - -set_new_dnode (&dn, cc->inode,NULL ,NULL ,0 ); - -for (i = cc->cluster_size -1 ; i >0 ; i--) { - ret =f2fs_get_block (&dn, start_idx + i); -if (ret) { - i = cc->cluster_size; -break ; - } - -if (dn.data_blkaddr !=NEW_ADDR ) -break ; - } - -f2fs_do_map_lock (sbi,F2FS_GET_BLOCK_PRE_AIO , false); - } -if (likely (!ret)) { *fsdata = cc->rpages; *pagep = cc->rpages[offset_in_cluster (cc, index)];
fs/f2fs/file.c +0 -4
@@ -81,10 +81,6 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf) err = ret; goto err; }else if (ret) { -if (ret <F2FS_I (inode)->i_cluster_size) { - err = -EAGAIN ; - goto err; - } need_alloc = false; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 154/317 f2fs: introduce FI_COMPRESS_RELEASED instead of using IMMUTABLE bit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
[ Upstream commit c61404153eb683da9c35aad133131554861ed561 ]
Once we release compressed blocks, we used to set IMMUTABLE bit. But it turned out it disallows every fs operations which we don't need for compression.
Let's just prevent writing data only.
Stable-dep-of: 7c5dffb3d90c ("f2fs: compress: fix to relocate check condition in f2fs_{release,reserve}_compress_blocks()")
--- fs/f2fs/compress.c | 3 ++- fs/f2fs/f2fs.h | 6 ++++++ fs/f2fs/file.c | 18 ++++++++++++------ include/linux/f2fs_fs.h | 1 + 4 files changed, 21 insertions(+), 7 deletions(-)
fs/f2fs/compress.c +2 -1
@@ -902,7 +902,8 @@ static int __f2fs_cluster_blocks(struct inode *inode, }f2fs_bug_on (F2FS_I_SB (inode), - !compr && ret != cluster_size && !IS_IMMUTABLE (inode)); + !compr && ret != cluster_size && + !is_inode_flag_set (inode,FI_COMPRESS_RELEASED )); } fail:f2fs_put_dnode (&dn);
fs/f2fs/f2fs.h +6 -0
@@ -683,6 +683,7 @@ enum {FI_COMPRESS_CORRUPT ,/* indicate compressed cluster is corrupted */ FI_MMAP_FILE ,/* indicate file was mmapped */ FI_ENABLE_COMPRESS ,/* enable compression in "user" compression mode */ +FI_COMPRESS_RELEASED ,/* compressed blocks were released */ FI_MAX, /* max flag, never be used */ };
@@ -2650,6 +2651,7 @@ static inline void __mark_inode_dirty_flag(struct inode *inode,case FI_DATA_EXIST :case FI_INLINE_DOTS :case FI_PIN_FILE : +case FI_COMPRESS_RELEASED :f2fs_mark_inode_dirty_sync (inode, true); } }
@@ -2771,6 +2773,8 @@ static inline void get_inline_info(struct inode *inode, struct f2fs_inode *ri)set_bit (FI_EXTRA_ATTR , fi->flags);if (ri->i_inline &F2FS_PIN_FILE )set_bit (FI_PIN_FILE , fi->flags); +if (ri->i_inline &F2FS_COMPRESS_RELEASED ) +set_bit (FI_COMPRESS_RELEASED , fi->flags); }static inline void set_raw_inline (struct inode *inode,struct f2fs_inode *ri)
@@ -2791,6 +2795,8 @@ static inline void set_raw_inline(struct inode *inode, struct f2fs_inode *ri) ri->i_inline |=F2FS_EXTRA_ATTR ;if (is_inode_flag_set (inode,FI_PIN_FILE )) ri->i_inline |=F2FS_PIN_FILE ; +if (is_inode_flag_set (inode,FI_COMPRESS_RELEASED )) + ri->i_inline |=F2FS_COMPRESS_RELEASED ; }static inline int f2fs_has_extra_attr (struct inode *inode)
fs/f2fs/file.c +12 -6
@@ -63,6 +63,9 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)if (unlikely (IS_IMMUTABLE (inode)))return VM_FAULT_SIGBUS ; +if (is_inode_flag_set (inode,FI_COMPRESS_RELEASED )) +return VM_FAULT_SIGBUS ; +if (unlikely (f2fs_cp_error (sbi))) { err = -EIO ; goto err;
@@ -3551,7 +3554,7 @@ static int f2fs_release_compress_blocks(struct file *filp, unsigned long arg) goto out; } -if (IS_IMMUTABLE (inode)) { +if (is_inode_flag_set (inode,FI_COMPRESS_RELEASED )) { ret = -EINVAL ; goto out; }
@@ -3560,8 +3563,7 @@ static int f2fs_release_compress_blocks(struct file *filp, unsigned long arg)if (ret) goto out; -F2FS_I (inode)->i_flags |=F2FS_IMMUTABLE_FL ; -f2fs_set_inode_flags (inode); +set_inode_flag (inode,FI_COMPRESS_RELEASED ); inode->i_ctime =current_time (inode);f2fs_mark_inode_dirty_sync (inode, true);
@@ -3727,7 +3729,7 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg)inode_lock (inode); -if (!IS_IMMUTABLE (inode)) { +if (!is_inode_flag_set (inode,FI_COMPRESS_RELEASED )) { ret = -EINVAL ; goto unlock_inode; }
@@ -3772,8 +3774,7 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg)up_write (&F2FS_I (inode)->i_mmap_sem);if (ret >=0 ) { -F2FS_I (inode)->i_flags &= ~F2FS_IMMUTABLE_FL ; -f2fs_set_inode_flags (inode); +clear_inode_flag (inode,FI_COMPRESS_RELEASED ); inode->i_ctime =current_time (inode);f2fs_mark_inode_dirty_sync (inode, true); }
@@ -4130,6 +4131,11 @@ static ssize_t f2fs_file_write_iter(struct kiocb *iocb, struct iov_iter *from) goto unlock; } +if (is_inode_flag_set (inode,FI_COMPRESS_RELEASED )) { + ret = -EPERM ; + goto unlock; + } + ret =generic_write_checks (iocb, from);if (ret >0 ) {bool preallocated = false;
include/linux/f2fs_fs.h +1 -0
@@ -229,6 +229,7 @@ struct f2fs_extent {#define F2FS_INLINE_DOTS 0x10/* file having implicit dot dentries */ #define F2FS_EXTRA_ATTR 0x20/* file having extra attribute */ #define F2FS_PIN_FILE 0x40/* file should not be gced */ +#define F2FS_COMPRESS_RELEASED 0x80/* file released compressed blocks */ struct f2fs_inode {__le16 i_mode;/* file mode */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 155/317 f2fs: compress: fix to relocate check condition in f2fs_{release,reserve}_compress_blocks()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 7c5dffb3d90c5921b91981cc663e02757d90526e ]
Compress flag should be checked after inode lock held to avoid racing w/ f2fs_setflags_common(), fix it.
--- fs/f2fs/file.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
fs/f2fs/file.c +4 -8
@@ -3533,9 +3533,6 @@ static int f2fs_release_compress_blocks(struct file *filp, unsigned long arg)if (!f2fs_sb_has_compression (F2FS_I_SB (inode)))return -EOPNOTSUPP ; -if (!f2fs_compressed_file (inode)) -return -EINVAL ; -if (f2fs_readonly (sbi->sb))return -EROFS ;
@@ -3554,7 +3551,8 @@ static int f2fs_release_compress_blocks(struct file *filp, unsigned long arg) goto out; } -if (is_inode_flag_set (inode,FI_COMPRESS_RELEASED )) { +if (!f2fs_compressed_file (inode) || +is_inode_flag_set (inode,FI_COMPRESS_RELEASED )) { ret = -EINVAL ; goto out; }
@@ -3712,9 +3710,6 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg)if (!f2fs_sb_has_compression (F2FS_I_SB (inode)))return -EOPNOTSUPP ; -if (!f2fs_compressed_file (inode)) -return -EINVAL ; -if (f2fs_readonly (sbi->sb))return -EROFS ;
@@ -3729,7 +3724,8 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg)inode_lock (inode); -if (!is_inode_flag_set (inode,FI_COMPRESS_RELEASED )) { +if (!f2fs_compressed_file (inode) || + !is_inode_flag_set (inode,FI_COMPRESS_RELEASED )) { ret = -EINVAL ; goto unlock_inode; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 156/317 f2fs: add cp_error check in f2fs_write_compressed_pages
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit ee68d27181f060fab29e60d1d31aab6a42703dd4 ]
This patch adds cp_error check in f2fs_write_compressed_pages() like we did in f2fs_write_single_data_page()
Stable-dep-of: 278a6253a673 ("f2fs: fix to relocate check condition in f2fs_fallocate()")
--- fs/f2fs/compress.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/f2fs/compress.c +6 -0
@@ -1161,6 +1161,12 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,loff_t psize;int i, err; +/* we should bypass data pages to proceed the kworkder jobs */ +if (unlikely (f2fs_cp_error (sbi))) { +mapping_set_error (cc->rpages[0 ]->mapping, -EIO ); + goto out_free; + } +if (IS_NOQUOTA (inode)) {/* * We need to wait for node_write to avoid block allocation during
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 157/317 f2fs: fix to force keeping write barrier for strict fsync mode
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 2787991516468bfafafb9bf2b45a848e6b202e7c ]
[1] https://www.mail-archive.com/[email protected]/msg15126.html
As [1] reported, if lower device doesn't support write barrier, in below case:
- write page #0; persist
- overwrite page #0
- fsync
- write data page #0 OPU into device's cache
- write inode page into device's cache
- issue flush
If SPO is triggered during flush command, inode page can be persisted before data page #0, so that after recovery, inode page can be recovered with new physical block address of data page #0, however there may contains dummy data in new physical block address.
Then what user will see is: after overwrite & fsync + SPO, old data in file was corrupted, if any user do care about such case, we can suggest user to use STRICT fsync mode, in this mode, we will force to use atomic write sematics to keep write order in between data/node and last node, so that it avoids potential data corruption during fsync().
Stable-dep-of: 278a6253a673 ("f2fs: fix to relocate check condition in f2fs_fallocate()")
--- fs/f2fs/file.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
fs/f2fs/file.c +12 -0
@@ -297,6 +297,18 @@ static int f2fs_do_sync_file(struct file *file, loff_t start, loff_t end, f2fs_exist_written_data(sbi, ino, UPDATE_INO)) goto flush_out; goto out; + }else { +/* +* for OPU case, during fsync(), node can be persisted before +* data when lower device doesn't support write barrier, result +* in data corruption after SPO. +* So for strict fsync mode, force to use atomic write sematics +* to keep write order in between data/node and last node to +* avoid potential data corruption. +*/ +if (F2FS_OPTION (sbi).fsync_mode == +FSYNC_MODE_STRICT && !atomic) + atomic = true; } go_write:/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 158/317 f2fs: do not allow partial truncation on pinned file
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
[ Upstream commit 5fed0be8583f08c1548b4dcd9e5ee0d1133d0730 ]
If the pinned file has a hole by partial truncation, application that has the block map will be broken.
Stable-dep-of: 278a6253a673 ("f2fs: fix to relocate check condition in f2fs_fallocate()")
--- fs/f2fs/file.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/f2fs/file.c +5 -1
@@ -1745,7 +1745,11 @@ static long f2fs_fallocate(struct file *file, int mode, (mode & (FALLOC_FL_COLLAPSE_RANGE | FALLOC_FL_INSERT_RANGE)))return -EOPNOTSUPP ; -if (f2fs_compressed_file (inode) && +/* +* Pinned file should not support partial trucation since the block +* can be used by applications. +*/ +if ((f2fs_compressed_file (inode) ||f2fs_is_pinned_file (inode)) && (mode & (FALLOC_FL_PUNCH_HOLE |FALLOC_FL_COLLAPSE_RANGE |FALLOC_FL_ZERO_RANGE |FALLOC_FL_INSERT_RANGE )))return -EOPNOTSUPP ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 159/317 f2fs: fix typos in comments
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinyoung CHOI <[email protected]>
[ Upstream commit 146949defda868378992171b9e42318b06fcd482 ]
This patch is to fix typos in f2fs files.
Stable-dep-of: 278a6253a673 ("f2fs: fix to relocate check condition in f2fs_fallocate()")
--- fs/f2fs/checkpoint.c | 4 ++-- fs/f2fs/compress.c | 2 +- fs/f2fs/data.c | 8 ++++---- fs/f2fs/extent_cache.c | 4 ++-- fs/f2fs/file.c | 6 +++--- fs/f2fs/namei.c | 2 +- fs/f2fs/segment.c | 2 +- 7 files changed, 14 insertions(+), 14 deletions(-)
fs/f2fs/checkpoint.c +2 -2
@@ -776,7 +776,7 @@ static void write_orphan_inodes(struct f2fs_sb_info *sbi, block_t start_blk)*/ head = &im->ino_list; -/* loop for each orphan inode entry and write them in Jornal block */ +/* loop for each orphan inode entry and write them in journal block */ list_for_each_entry (orphan, head, list) {if (!page) { page =f2fs_grab_meta_page (sbi, start_blk++);
@@ -1109,7 +1109,7 @@ int f2fs_sync_dirty_inodes(struct f2fs_sb_info *sbi, enum inode_type type, }else {/* * We should submit bio, since it exists several -* wribacking dentry pages in the freeing inode. +* writebacking dentry pages in the freeing inode. */ f2fs_submit_merged_write (sbi,DATA );cond_resched ();
fs/f2fs/compress.c +1 -1
@@ -1161,7 +1161,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,loff_t psize;int i, err; -/* we should bypass data pages to proceed the kworkder jobs */ +/* we should bypass data pages to proceed the kworker jobs */ if (unlikely (f2fs_cp_error (sbi))) {mapping_set_error (cc->rpages[0 ]->mapping, -EIO ); goto out_free;
fs/f2fs/data.c +4 -4
@@ -2431,7 +2431,7 @@ static int f2fs_mpage_readpages(struct inode *inode,#ifdef CONFIG_F2FS_FS_COMPRESSION if (f2fs_compressed_file (inode)) { -/* there are remained comressed pages, submit them */ +/* there are remained compressed pages, submit them */ if (!f2fs_cluster_can_merge_page (&cc, page->index)) { ret = f2fs_read_multi_pages(&cc, &bio, max_nr_pages,
@@ -2807,7 +2807,7 @@ int f2fs_write_single_data_page(struct page *page, int *submitted,trace_f2fs_writepage (page,DATA ); -/* we should bypass data pages to proceed the kworkder jobs */ +/* we should bypass data pages to proceed the kworker jobs */ if (unlikely (f2fs_cp_error (sbi))) {mapping_set_error (page->mapping, -EIO );/*
@@ -2933,7 +2933,7 @@ int f2fs_write_single_data_page(struct page *page, int *submitted, redirty_out:redirty_page_for_writepage (wbc, page);/* -* pageout() in MM traslates EAGAIN, so calls handle_write_error() +* pageout() in MM translates EAGAIN, so calls handle_write_error() * -> mapping_set_error() -> set_bit(AS_EIO, ...). * file_write_and_wait_range() will see EIO error, which is critical * to return value of fsync() followed by atomic_write failure to user.
@@ -2967,7 +2967,7 @@ static int f2fs_write_data_page(struct page *page, }/* -* This function was copied from write_cche_pages from mm/page-writeback.c. +* This function was copied from write_cache_pages from mm/page-writeback.c. * The major change is making write step of cold data page separately from * warm/hot data page. */
fs/f2fs/extent_cache.c +2 -2
@@ -112,7 +112,7 @@ struct rb_node **f2fs_lookup_rb_tree_for_insert(struct f2fs_sb_info *sbi,* @prev_ex: extent before ofs * @next_ex: extent after ofs * @insert_p: insert point for new extent at ofs -* in order to simpfy the insertion after. +* in order to simplify the insertion after. * tree must stay unchanged between lookup and insertion. */ struct rb_entry *f2fs_lookup_rb_tree_ret(struct rb_root_cached *root,
@@ -572,7 +572,7 @@ static void f2fs_update_extent_tree_range(struct inode *inode,if (!en) en = next_en; -/* 2. invlidate all extent nodes in range [fofs, fofs + len - 1] */ +/* 2. invalidate all extent nodes in range [fofs, fofs + len - 1] */ while (en && en->ei.fofs < end) {unsigned int org_end;int parts =0 ;/* # of parts current extent split into */
fs/f2fs/file.c +3 -3
@@ -302,7 +302,7 @@ static int f2fs_do_sync_file(struct file *file, loff_t start, loff_t end,* for OPU case, during fsync(), node can be persisted before * data when lower device doesn't support write barrier, result * in data corruption after SPO. -* So for strict fsync mode, force to use atomic write sematics +* So for strict fsync mode, force to use atomic write semantics * to keep write order in between data/node and last node to * avoid potential data corruption. */
@@ -1746,7 +1746,7 @@ static long f2fs_fallocate(struct file *file, int mode,return -EOPNOTSUPP ;/* -* Pinned file should not support partial trucation since the block +* Pinned file should not support partial truncation since the block * can be used by applications. */ if ((f2fs_compressed_file(inode) || f2fs_is_pinned_file(inode)) &&
@@ -1796,7 +1796,7 @@ static long f2fs_fallocate(struct file *file, int mode,static int f2fs_release_file (struct inode *inode,struct file *filp) {/* -* f2fs_relase_file is called at every close calls. So we should +* f2fs_release_file is called at every close calls. So we should * not drop any inmemory pages by close called by other process. */ if (!(filp->f_mode & FMODE_WRITE) ||
fs/f2fs/namei.c +1 -1
@@ -937,7 +937,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,/* * If new_inode is null, the below renaming flow will -* add a link in old_dir which can conver inline_dir. +* add a link in old_dir which can convert inline_dir. * After then, if we failed to get the entry due to other * reasons like ENOMEM, we had to remove the new entry. * Instead of adding such the error handling routine, let's
fs/f2fs/segment.c +1 -1
@@ -3688,7 +3688,7 @@ void f2fs_wait_on_page_writeback(struct page *page,/* submit cached LFS IO */ f2fs_submit_merged_write_cond (sbi,NULL , page,0 , type); -/* sbumit cached IPU IO */ +/* submit cached IPU IO */ f2fs_submit_merged_ipu_write (sbi,NULL , page);if (ordered) {wait_on_page_writeback (page);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 160/317 f2fs: fix to relocate check condition in f2fs_fallocate()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 278a6253a673611dbc8ab72a3b34b151a8e75822 ]
compress and pinfile flag should be checked after inode lock held to avoid race condition, fix it.
--- fs/f2fs/file.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
fs/f2fs/file.c +11 -9
@@ -1745,15 +1745,6 @@ static long f2fs_fallocate(struct file *file, int mode, (mode & (FALLOC_FL_COLLAPSE_RANGE | FALLOC_FL_INSERT_RANGE)))return -EOPNOTSUPP ; -/* -* Pinned file should not support partial truncation since the block -* can be used by applications. -*/ -if ((f2fs_compressed_file (inode) ||f2fs_is_pinned_file (inode)) && - (mode & (FALLOC_FL_PUNCH_HOLE |FALLOC_FL_COLLAPSE_RANGE | -FALLOC_FL_ZERO_RANGE |FALLOC_FL_INSERT_RANGE ))) -return -EOPNOTSUPP ; -if (mode & ~(FALLOC_FL_KEEP_SIZE |FALLOC_FL_PUNCH_HOLE |FALLOC_FL_COLLAPSE_RANGE |FALLOC_FL_ZERO_RANGE |FALLOC_FL_INSERT_RANGE ))
@@ -1761,6 +1752,17 @@ static long f2fs_fallocate(struct file *file, int mode,inode_lock (inode); +/* +* Pinned file should not support partial truncation since the block +* can be used by applications. +*/ +if ((f2fs_compressed_file (inode) ||f2fs_is_pinned_file (inode)) && + (mode & (FALLOC_FL_PUNCH_HOLE |FALLOC_FL_COLLAPSE_RANGE | +FALLOC_FL_ZERO_RANGE |FALLOC_FL_INSERT_RANGE ))) { + ret = -EOPNOTSUPP ; + goto out; + } + ret =file_modified (file);if (ret) goto out;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 161/317 f2fs: fix to check pinfile flag in f2fs_move_file_range()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit e07230da0500e0919a765037c5e81583b519be2c ]
ioctl(F2FS_IOC_MOVE_RANGE) can truncate or punch hole on pinned file, fix to disallow it.
--- fs/f2fs/file.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/f2fs/file.c +2 -1
@@ -2835,7 +2835,8 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in, goto out; } -if (f2fs_compressed_file (src) ||f2fs_compressed_file (dst)) { +if (f2fs_compressed_file (src) ||f2fs_compressed_file (dst) || +f2fs_is_pinned_file (src) ||f2fs_is_pinned_file (dst)) { ret = -EOPNOTSUPP ; goto out_unlock; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 162/317 iio: pressure: dps310: support negative temperature values
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Haemmerle <[email protected]>
[ Upstream commit 9dd6b32e76ff714308964cd9ec91466a343dcb8b ]
The current implementation interprets negative values returned from dps310_calculate_temp as error codes.
This has a side effect that when negative temperature values are calculated, they are interpreted as error.
Fix this by using the return value only for error handling and passing a pointer for the value.
--- drivers/iio/pressure/dps310.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/iio/pressure/dps310.c +6 -5
@@ -730,7 +730,7 @@ static int dps310_read_pressure(struct dps310_data *data, int *val, int *val2, } } -static int dps310_calculate_temp (struct dps310_data *data) +static int dps310_calculate_temp (struct dps310_data *data,int *val) {s64 c0;s64 t;
@@ -746,7 +746,9 @@ static int dps310_calculate_temp(struct dps310_data *data) t = c0 + ((s64 )data->temp_raw * (s64 )data->c1);/* Convert to milliCelsius and scale the temperature */ -return (int )div_s64 (t *1000LL , kt); + *val = (int )div_s64 (t *1000LL , kt); + +return 0 ; } static int dps310_read_temp(struct dps310_data *data, int *val, int *val2,
@@ -768,11 +770,10 @@ static int dps310_read_temp(struct dps310_data *data, int *val, int *val2,if (rc)return rc; - rc =dps310_calculate_temp (data); -if (rc <0 ) + rc =dps310_calculate_temp (data, val); +if (rc)return rc; - *val = rc;return IIO_VAL_INT ;case IIO_CHAN_INFO_OVERSAMPLING_RATIO :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 163/317 fpga: region: change FPGA indirect article to an
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Rix <[email protected]>
[ Upstream commit 011c49e3703854e52c0fb88f22cf38aca1d4d514 ]
Change use of 'a fpga' to 'an fpga'
Stable-dep-of: b7c0e1ecee40 ("fpga: region: add owner module and take its refcount")
--- drivers/fpga/fpga-region.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/fpga/fpga-region.c +7 -7
@@ -33,14 +33,14 @@ struct fpga_region *fpga_region_class_find(EXPORT_SYMBOL_GPL (fpga_region_class_find);/** -* fpga_region_get - get an exclusive reference to a fpga region +* fpga_region_get - get an exclusive reference to an fpga region * @region: FPGA Region struct * * Caller should call fpga_region_put() when done with region. * * Return fpga_region struct if successful. * Return -EBUSY if someone already has a reference to the region. -* Return -ENODEV if @np is not a FPGA Region. +* Return -ENODEV if @np is not an FPGA Region. */ static struct fpga_region *fpga_region_get (struct fpga_region *region) {
@@ -234,7 +234,7 @@ struct fpga_regionEXPORT_SYMBOL_GPL (fpga_region_create);/** -* fpga_region_free - free a FPGA region created by fpga_region_create() +* fpga_region_free - free an FPGA region created by fpga_region_create() * @region: FPGA region */ void fpga_region_free (struct fpga_region *region)
@@ -257,7 +257,7 @@ static void devm_fpga_region_release(struct device *dev, void *res)* @mgr: manager that programs this region * @get_bridges: optional function to get bridges to a list * -* This function is intended for use in a FPGA region driver's probe function. +* This function is intended for use in an FPGA region driver's probe function. * After the region driver creates the region struct with * devm_fpga_region_create(), it should register it with fpga_region_register(). * The region driver's remove function should call fpga_region_unregister().
@@ -291,7 +291,7 @@ struct fpga_regionEXPORT_SYMBOL_GPL (devm_fpga_region_create);/** -* fpga_region_register - register a FPGA region +* fpga_region_register - register an FPGA region * @region: FPGA region * * Return: 0 or -errno
@@ -303,10 +303,10 @@ int fpga_region_register(struct fpga_region *region)EXPORT_SYMBOL_GPL (fpga_region_register);/** -* fpga_region_unregister - unregister a FPGA region +* fpga_region_unregister - unregister an FPGA region * @region: FPGA region * -* This function is intended for use in a FPGA region driver's remove function. +* This function is intended for use in an FPGA region driver's remove function. */ void fpga_region_unregister (struct fpga_region *region) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 164/317 fpga: region: Rename dev to parent for parent device
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russ Weight <[email protected]>
[ Upstream commit 5e77886d0aa9a882424f6a4ccb3eca4dca43b4a0 ]
Rename variable "dev" to "parent" in cases where it represents the parent device.
Stable-dep-of: b7c0e1ecee40 ("fpga: region: add owner module and take its refcount")
--- drivers/fpga/fpga-region.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/fpga/fpga-region.c +8 -8
@@ -181,7 +181,7 @@ ATTRIBUTE_GROUPS(fpga_region);/** * fpga_region_create - alloc and init a struct fpga_region -* @dev: device parent +* @parent: device parent * @mgr: manager that programs this region * @get_bridges: optional function to get bridges to a list *
@@ -192,7 +192,7 @@ ATTRIBUTE_GROUPS(fpga_region);* Return: struct fpga_region or NULL */ struct fpga_region -*fpga_region_create (struct device *dev, +*fpga_region_create (struct device *parent,struct fpga_manager *mgr,int (*get_bridges)(struct fpga_region *)) {
@@ -214,8 +214,8 @@ struct fpga_regiondevice_initialize (®ion->dev); region->dev.class = fpga_region_class; - region->dev.parent = dev; - region->dev.of_node = dev->of_node; + region->dev.parent = parent; + region->dev.of_node = parent->of_node; region->dev.id = id; ret =dev_set_name (®ion->dev,"region%d" , id);
@@ -253,7 +253,7 @@ static void devm_fpga_region_release(struct device *dev, void *res)/** * devm_fpga_region_create - create and initialize a managed FPGA region struct -* @dev: device parent +* @parent: device parent * @mgr: manager that programs this region * @get_bridges: optional function to get bridges to a list *
@@ -268,7 +268,7 @@ static void devm_fpga_region_release(struct device *dev, void *res)* Return: struct fpga_region or NULL */ struct fpga_region -*devm_fpga_region_create (struct device *dev, +*devm_fpga_region_create (struct device *parent,struct fpga_manager *mgr,int (*get_bridges)(struct fpga_region *)) {
@@ -278,12 +278,12 @@ struct fpga_regionif (!ptr)return NULL ; - region =fpga_region_create (dev, mgr, get_bridges); + region =fpga_region_create (parent, mgr, get_bridges);if (!region) {devres_free (ptr); }else { *ptr = region; -devres_add (dev, ptr); +devres_add (parent, ptr); }return region;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 165/317 docs: driver-api: fpga: avoid using UTF-8 chars
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
[ Upstream commit 758f74674bcb82e1ed1a0b5a56980f295183b546 ]
While UTF-8 characters can be used at the Linux documentation, the best is to use them only when ASCII doesn't offer a good replacement. So, replace the occurences of the following UTF-8 characters:
- U+2014 ('—'): EM DASH
Stable-dep-of: b7c0e1ecee40 ("fpga: region: add owner module and take its refcount")
--- Documentation/driver-api/fpga/fpga-bridge.rst | 10 +++++----- Documentation/driver-api/fpga/fpga-mgr.rst | 12 +++++------ .../driver-api/fpga/fpga-programming.rst | 8 ++++---- Documentation/driver-api/fpga/fpga-region.rst | 20 +++++++++---------- 4 files changed, 25 insertions(+), 25 deletions(-)
Documentation/driver-api/fpga/fpga-bridge.rst +5 -5
@@ -4,11 +4,11 @@ FPGA Bridge API to implement a new FPGA bridge ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -* struct fpga_bridge — The FPGA Bridge structure -* struct fpga_bridge_ops — Low level Bridge driver ops -* devm_fpga_bridge_create() — Allocate and init a bridge struct -* fpga_bridge_register() — Register a bridge -* fpga_bridge_unregister() — Unregister a bridge +* struct fpga_bridge - The FPGA Bridge structure +* struct fpga_bridge_ops - Low level Bridge driver ops +* devm_fpga_bridge_create() - Allocate and init a bridge struct +* fpga_bridge_register() - Register a bridge +* fpga_bridge_unregister() - Unregister a bridge .. kernel-doc:: include/linux/fpga/fpga-bridge.h :functions: fpga_bridge
Documentation/driver-api/fpga/fpga-mgr.rst +6 -6
@@ -101,12 +101,12 @@ in state. API for implementing a new FPGA Manager driver ---------------------------------------------- -* ``fpga_mgr_states`` — Values for :c:expr:`fpga_manager->state`. -* struct fpga_manager — the FPGA manager struct -* struct fpga_manager_ops — Low level FPGA manager driver ops -* devm_fpga_mgr_create() — Allocate and init a manager struct -* fpga_mgr_register() — Register an FPGA manager -* fpga_mgr_unregister() — Unregister an FPGA manager +* ``fpga_mgr_states`` - Values for :c:expr:`fpga_manager->state`. +* struct fpga_manager - the FPGA manager struct +* struct fpga_manager_ops - Low level FPGA manager driver ops +* devm_fpga_mgr_create() - Allocate and init a manager struct +* fpga_mgr_register() - Register an FPGA manager +* fpga_mgr_unregister() - Unregister an FPGA manager .. kernel-doc:: include/linux/fpga/fpga-mgr.h :functions: fpga_mgr_states
Documentation/driver-api/fpga/fpga-programming.rst +4 -4
@@ -84,10 +84,10 @@ will generate that list. Here's some sample code of what to do next:: API for programming an FPGA --------------------------- -* fpga_region_program_fpga() — Program an FPGA -* fpga_image_info() — Specifies what FPGA image to program -* fpga_image_info_alloc() — Allocate an FPGA image info struct -* fpga_image_info_free() — Free an FPGA image info struct +* fpga_region_program_fpga() - Program an FPGA +* fpga_image_info() - Specifies what FPGA image to program +* fpga_image_info_alloc() - Allocate an FPGA image info struct +* fpga_image_info_free() - Free an FPGA image info struct .. kernel-doc:: drivers/fpga/fpga-region.c :functions: fpga_region_program_fpga
Documentation/driver-api/fpga/fpga-region.rst +10 -10
@@ -45,19 +45,19 @@ An example of usage can be seen in the probe function of [#f2]_. API to add a new FPGA region ---------------------------- -* struct fpga_region — The FPGA region struct -* devm_fpga_region_create() — Allocate and init a region struct -* fpga_region_register() — Register an FPGA region -* fpga_region_unregister() — Unregister an FPGA region +* struct fpga_region - The FPGA region struct +* devm_fpga_region_create() - Allocate and init a region struct +* fpga_region_register() - Register an FPGA region +* fpga_region_unregister() - Unregister an FPGA region The FPGA region's probe function will need to get a reference to the FPGA Manager it will be using to do the programming. This usually would happen during the region's probe function. -* fpga_mgr_get() — Get a reference to an FPGA manager, raise ref count -* of_fpga_mgr_get() — Get a reference to an FPGA manager, raise ref count, +* fpga_mgr_get() - Get a reference to an FPGA manager, raise ref count +* of_fpga_mgr_get() - Get a reference to an FPGA manager, raise ref count, given a device node. -* fpga_mgr_put() — Put an FPGA manager +* fpga_mgr_put() - Put an FPGA manager The FPGA region will need to specify which bridges to control while programming the FPGA. The region driver can build a list of bridges during probe time
@@ -66,11 +66,11 @@ the list of bridges to program just before programming (:c:expr:`fpga_region->get_bridges`). The FPGA bridge framework supplies the following APIs to handle building or tearing down that list. -* fpga_bridge_get_to_list() — Get a ref of an FPGA bridge, add it to a +* fpga_bridge_get_to_list() - Get a ref of an FPGA bridge, add it to a list -* of_fpga_bridge_get_to_list() — Get a ref of an FPGA bridge, add it to a +* of_fpga_bridge_get_to_list() - Get a ref of an FPGA bridge, add it to a list, given a device node -* fpga_bridges_put() — Given a list of bridges, put them +* fpga_bridges_put() - Given a list of bridges, put them .. kernel-doc:: include/linux/fpga/fpga-region.h :functions: fpga_region
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 166/317 fpga: region: Use standard dev_release for class driver
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russ Weight <[email protected]>
[ Upstream commit 8886a579744fbfa53e69aa453ed10ae3b1f9abac ]
The FPGA region class driver data structure is being treated as a managed resource instead of using the standard dev_release call-back function to release the class data structure. This change removes the managed resource code and combines the create() and register() functions into a single register() or register_full() function.
The register_full() function accepts an info data structure to provide flexibility in passing optional parameters. The register() function supports the current parameter list for users that don't require the use of optional parameters.
Stable-dep-of: b7c0e1ecee40 ("fpga: region: add owner module and take its refcount")
--- Documentation/driver-api/fpga/fpga-region.rst | 12 +- drivers/fpga/dfl-fme-region.c | 17 ++- drivers/fpga/dfl.c | 12 +- drivers/fpga/fpga-region.c | 119 +++++++----------- drivers/fpga/of-fpga-region.c | 10 +- include/linux/fpga/fpga-region.h | 36 ++++-- 6 files changed, 95 insertions(+), 111 deletions(-)
Documentation/driver-api/fpga/fpga-region.rst +9 -3
@@ -46,8 +46,11 @@ API to add a new FPGA region ---------------------------- * struct fpga_region - The FPGA region struct -* devm_fpga_region_create() - Allocate and init a region struct -* fpga_region_register() - Register an FPGA region +* struct fpga_region_info - Parameter structure for fpga_region_register_full() +* fpga_region_register_full() - Create and register an FPGA region using the + fpga_region_info structure to provide the full flexibility of options +* fpga_region_register() - Create and register an FPGA region using standard + arguments * fpga_region_unregister() - Unregister an FPGA region The FPGA region's probe function will need to get a reference to the FPGA
@@ -75,8 +78,11 @@ following APIs to handle building or tearing down that list. .. kernel-doc:: include/linux/fpga/fpga-region.h :functions: fpga_region +.. kernel-doc:: include/linux/fpga/fpga-region.h + :functions: fpga_region_info + .. kernel-doc:: drivers/fpga/fpga-region.c - :functions: devm_fpga_region_create + :functions: fpga_region_register_full .. kernel-doc:: drivers/fpga/fpga-region.c :functions: fpga_region_register
drivers/fpga/dfl-fme-region.c +8 -9
@@ -30,6 +30,7 @@ static int fme_region_get_bridges(struct fpga_region *region)static int fme_region_probe (struct platform_device *pdev) {struct dfl_fme_region_pdata *pdata =dev_get_platdata (&pdev->dev); +struct fpga_region_info info = {0 };struct device *dev = &pdev->dev;struct fpga_region *region;struct fpga_manager *mgr;
@@ -39,20 +40,18 @@ static int fme_region_probe(struct platform_device *pdev)if (IS_ERR (mgr))return -EPROBE_DEFER ; - region =devm_fpga_region_create (dev, mgr, fme_region_get_bridges); -if (!region) { - ret = -ENOMEM ; + info.mgr = mgr; + info.compat_id = mgr->compat_id; + info.get_bridges = fme_region_get_bridges; + info.priv = pdata; + region =fpga_region_register_full (dev, &info); +if (IS_ERR (region)) { + ret =PTR_ERR (region); goto eprobe_mgr_put; } - region->priv = pdata; - region->compat_id = mgr->compat_id;platform_set_drvdata (pdev, region); - ret =fpga_region_register (region); -if (ret) - goto eprobe_mgr_put; -dev_dbg (dev,"DFL FME FPGA Region probed\n" );return 0 ;
drivers/fpga/dfl.c +4 -8
@@ -1400,19 +1400,15 @@ dfl_fpga_feature_devs_enumerate(struct dfl_fpga_enum_info *info)if (!cdev)return ERR_PTR (-ENOMEM ); - cdev->region =devm_fpga_region_create (info->dev,NULL ,NULL ); -if (!cdev->region) { - ret = -ENOMEM ; - goto free_cdev_exit; - } - cdev->parent = info->dev;mutex_init (&cdev->lock);INIT_LIST_HEAD (&cdev->port_dev_list); - ret =fpga_region_register (cdev->region); -if (ret) + cdev->region =fpga_region_register (info->dev,NULL ,NULL ); +if (IS_ERR (cdev->region)) { + ret =PTR_ERR (cdev->region); goto free_cdev_exit; + }/* create and init build info for enumeration */ binfo =devm_kzalloc (info->dev,sizeof (*binfo),GFP_KERNEL );
drivers/fpga/fpga-region.c +44 -75
171 lines not on this page · raw message
drivers/fpga/of-fpga-region.c +3 -7
@@ -405,16 +405,12 @@ static int of_fpga_region_probe(struct platform_device *pdev)if (IS_ERR (mgr))return -EPROBE_DEFER ; - region =devm_fpga_region_create (dev, mgr, of_fpga_region_get_bridges); -if (!region) { - ret = -ENOMEM ; + region =fpga_region_register (dev, mgr, of_fpga_region_get_bridges); +if (IS_ERR (region)) { + ret =PTR_ERR (region); goto eprobe_mgr_put; } - ret =fpga_region_register (region); -if (ret) - goto eprobe_mgr_put; -of_platform_populate (np, fpga_region_of_match,NULL , ®ion->dev);platform_set_drvdata (pdev, region);
include/linux/fpga/fpga-region.h +27 -9
@@ -7,6 +7,27 @@#include <linux/fpga/fpga-mgr.h> #include <linux/fpga/fpga-bridge.h> +struct fpga_region ; + +/** +* struct fpga_region_info - collection of parameters an FPGA Region +* @mgr: fpga region manager +* @compat_id: FPGA region id for compatibility check. +* @priv: fpga region private data +* @get_bridges: optional function to get bridges to a list +* +* fpga_region_info contains parameters for the register_full function. +* These are separated into an info structure because they some are optional +* others could be added to in the future. The info structure facilitates +* maintaining a stable API. +*/ +struct fpga_region_info { +struct fpga_manager *mgr; +struct fpga_compat_id *compat_id; +void *priv; +int (*get_bridges)(struct fpga_region *region); +}; +/** * struct fpga_region - FPGA Region structure * @dev: FPGA Region device
@@ -37,15 +58,12 @@ struct fpga_region *fpga_region_class_find(int fpga_region_program_fpga (struct fpga_region *region); -struct fpga_region -*fpga_region_create (struct device *dev,struct fpga_manager *mgr, -int (*get_bridges)(struct fpga_region *)); -void fpga_region_free (struct fpga_region *region); -int fpga_region_register (struct fpga_region *region); -void fpga_region_unregister (struct fpga_region *region); +struct fpga_region * +fpga_region_register_full (struct device *parent,const struct fpga_region_info *info); -struct fpga_region -*devm_fpga_region_create (struct device *dev,struct fpga_manager *mgr, -int (*get_bridges)(struct fpga_region *)); +struct fpga_region * +fpga_region_register (struct device *parent,struct fpga_manager *mgr, +int (*get_bridges)(struct fpga_region *)); +void fpga_region_unregister (struct fpga_region *region);#endif /* _FPGA_REGION_H */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 167/317 fpga: region: add owner module and take its refcount
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Pagani <[email protected]>
[ Upstream commit b7c0e1ecee403a43abc89eb3e75672b01ff2ece9 ]
The current implementation of the fpga region assumes that the low-level module registers a driver for the parent device and uses its owner pointer to take the module's refcount. This approach is problematic since it can lead to a null pointer dereference while attempting to get the region during programming if the parent device does not have a driver.
To address this problem, add a module owner pointer to the fpga_region struct and use it to take the module's refcount. Modify the functions for registering a region to take an additional owner module parameter and rename them to avoid conflicts. Use the old function names for helper macros that automatically set the module that registers the region as the owner. This ensures compatibility with existing low-level control modules and reduces the chances of registering a region without setting the owner.
Also, update the documentation to keep it consistent with the new interface for registering an fpga region.
--- Documentation/driver-api/fpga/fpga-region.rst | 13 ++++++---- drivers/fpga/fpga-region.c | 24 +++++++++++-------- include/linux/fpga/fpga-region.h | 13 +++++++--- 3 files changed, 32 insertions(+), 18 deletions(-)
Documentation/driver-api/fpga/fpga-region.rst +8 -5
@@ -46,13 +46,16 @@ API to add a new FPGA region ---------------------------- * struct fpga_region - The FPGA region struct -* struct fpga_region_info - Parameter structure for fpga_region_register_full() -* fpga_region_register_full() - Create and register an FPGA region using the +* struct fpga_region_info - Parameter structure for __fpga_region_register_full() +* __fpga_region_register_full() - Create and register an FPGA region using the fpga_region_info structure to provide the full flexibility of options -* fpga_region_register() - Create and register an FPGA region using standard +* __fpga_region_register() - Create and register an FPGA region using standard arguments * fpga_region_unregister() - Unregister an FPGA region +Helper macros ``fpga_region_register()`` and ``fpga_region_register_full()`` +automatically set the module that registers the FPGA region as the owner. + The FPGA region's probe function will need to get a reference to the FPGA Manager it will be using to do the programming. This usually would happen during the region's probe function.
@@ -82,10 +85,10 @@ following APIs to handle building or tearing down that list. :functions: fpga_region_info .. kernel-doc:: drivers/fpga/fpga-region.c - :functions: fpga_region_register_full + :functions: __fpga_region_register_full .. kernel-doc:: drivers/fpga/fpga-region.c - :functions: fpga_region_register + :functions: __fpga_region_register .. kernel-doc:: drivers/fpga/fpga-region.c :functions: fpga_region_unregister
drivers/fpga/fpga-region.c +14 -10
@@ -52,7 +52,7 @@ static struct fpga_region *fpga_region_get(struct fpga_region *region) }get_device (dev); -if (!try_module_get (dev->parent->driver->owner)) { +if (!try_module_get (region->ops_owner)) {put_device (dev);mutex_unlock (®ion->mutex);return ERR_PTR (-ENODEV );
@@ -74,7 +74,7 @@ static void fpga_region_put(struct fpga_region *region)dev_dbg (dev,"put\n" ); -module_put (dev->parent->driver->owner); +module_put (region->ops_owner);put_device (dev);mutex_unlock (®ion->mutex); }
@@ -180,14 +180,16 @@ static struct attribute *fpga_region_attrs[] = {ATTRIBUTE_GROUPS (fpga_region);/** -* fpga_region_register_full - create and register an FPGA Region device +* __fpga_region_register_full - create and register an FPGA Region device * @parent: device parent * @info: parameters for FPGA Region +* @owner: module containing the get_bridges function * * Return: struct fpga_region or ERR_PTR() */ struct fpga_region * -fpga_region_register_full (struct device *parent,const struct fpga_region_info *info) +__fpga_region_register_full (struct device *parent,const struct fpga_region_info *info, +struct module *owner) {struct fpga_region *region;int id, ret =0 ;
@@ -212,6 +214,7 @@ fpga_region_register_full(struct device *parent, const struct fpga_region_info * region->compat_id = info->compat_id; region->priv = info->priv; region->get_bridges = info->get_bridges; + region->ops_owner = owner;mutex_init (®ion->mutex);INIT_LIST_HEAD (®ion->bridge_list);
@@ -240,13 +243,14 @@ fpga_region_register_full(struct device *parent, const struct fpga_region_info *return ERR_PTR (ret); } -EXPORT_SYMBOL_GPL (fpga_region_register_full); +EXPORT_SYMBOL_GPL (__fpga_region_register_full);/** -* fpga_region_register - create and register an FPGA Region device +* __fpga_region_register - create and register an FPGA Region device * @parent: device parent * @mgr: manager that programs this region * @get_bridges: optional function to get bridges to a list +* @owner: module containing the get_bridges function * * This simple version of the register function should be sufficient for most users. * The fpga_region_register_full() function is available for users that need to
@@ -255,17 +259,17 @@ EXPORT_SYMBOL_GPL(fpga_region_register_full);* Return: struct fpga_region or ERR_PTR() */ struct fpga_region * -fpga_region_register (struct device *parent,struct fpga_manager *mgr, -int (*get_bridges)(struct fpga_region *)) +__fpga_region_register (struct device *parent,struct fpga_manager *mgr, +int (*get_bridges)(struct fpga_region *),struct module *owner) {struct fpga_region_info info = {0 }; info.mgr = mgr; info.get_bridges = get_bridges; -return fpga_region_register_full (parent, &info); +return __fpga_region_register_full (parent, &info, owner); } -EXPORT_SYMBOL_GPL (fpga_region_register); +EXPORT_SYMBOL_GPL (__fpga_region_register);/** * fpga_region_unregister - unregister an FPGA region
include/linux/fpga/fpga-region.h +10 -3
@@ -36,6 +36,7 @@ struct fpga_region_info {* @mgr: FPGA manager * @info: FPGA image info * @compat_id: FPGA region id for compatibility check. +* @ops_owner: module containing the get_bridges function * @priv: private data * @get_bridges: optional function to get bridges to a list */
@@ -46,6 +47,7 @@ struct fpga_region {struct fpga_manager *mgr;struct fpga_image_info *info;struct fpga_compat_id *compat_id; +struct module *ops_owner;void *priv;int (*get_bridges)(struct fpga_region *region); };
@@ -58,12 +60,17 @@ struct fpga_region *fpga_region_class_find(int fpga_region_program_fpga (struct fpga_region *region); +#define fpga_region_register_full (parent, info) \ + __fpga_region_register_full(parent, info, THIS_MODULE)struct fpga_region * -fpga_region_register_full (struct device *parent,const struct fpga_region_info *info); +__fpga_region_register_full (struct device *parent,const struct fpga_region_info *info, +struct module *owner); +#define fpga_region_register (parent, mgr, get_bridges) \ + __fpga_region_register(parent, mgr, get_bridges, THIS_MODULE)struct fpga_region * -fpga_region_register (struct device *parent,struct fpga_manager *mgr, -int (*get_bridges)(struct fpga_region *)); +__fpga_region_register (struct device *parent,struct fpga_manager *mgr, +int (*get_bridges)(struct fpga_region *),struct module *owner);void fpga_region_unregister (struct fpga_region *region);#endif /* _FPGA_REGION_H */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 168/317 microblaze: Remove gcc flag for non existing early_printk.c file
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Simek <[email protected]>
[ Upstream commit edc66cf0c4164aa3daf6cc55e970bb94383a6a57 ]
early_printk support for removed long time ago but compilation flag for ftrace still points to already removed file that's why remove that line too.
--- arch/microblaze/kernel/Makefile | 1 - 1 file changed, 1 deletion(-)
arch/microblaze/kernel/Makefile +0 -1
@@ -7,7 +7,6 @@ ifdef CONFIG_FUNCTION_TRACER # Do not trace early boot code and low level code CFLAGS_REMOVE_timer.o = -pg CFLAGS_REMOVE_intc.o = -pg -CFLAGS_REMOVE_early_printk.o = -pg CFLAGS_REMOVE_ftrace.o = -pg CFLAGS_REMOVE_process.o = -pg endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 169/317 microblaze: Remove early printk call from cpuinfo-static.c
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Simek <[email protected]>
[ Upstream commit 58d647506c92ccd3cfa0c453c68ddd14f40bf06f ]
Early printk has been removed already that's why also remove calling it. Similar change has been done in cpuinfo-pvr-full.c by commit cfbd8d1979af ("microblaze: Remove early printk setup").
--- arch/microblaze/kernel/cpu/cpuinfo-static.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/microblaze/kernel/cpu/cpuinfo-static.c +1 -1
@@ -18,7 +18,7 @@ static const char family_string[] = CONFIG_XILINX_MICROBLAZE0_FAMILY;static const char cpu_ver_string[] =CONFIG_XILINX_MICROBLAZE0_HW_VER ;#define err_printk (x) \ - early_printk("ERROR: Microblaze " x "-different for kernel and DTS\n"); + pr_err("ERROR: Microblaze " x "-different for kernel and DTS\n");void __init set_cpuinfo_static (struct cpuinfo *ci,struct device_node *cpu) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 170/317 perf intel-pt: Fix unassigned instruction op (discovered by MemorySanitizer)
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit e101a05f79fd4ee3e89d2f3fb716493c33a33708 ]
MemorySanitizer discovered instances where the instruction op value was not assigned.:
WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x5581c00a76b3 in intel_pt_sample_flags tools/perf/util/intel-pt.c:1527:17
Uninitialized value was stored to memory at
#0 0x5581c005ddf8 in intel_pt_walk_insn tools/perf/util/intel-pt-decoder/intel-pt-decoder.c:1256:25The op value is used to set branch flags for branch instructions encountered when walking the code, so fix by setting op to INTEL_PT_OP_OTHER in other cases.
--- tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 2 ++ tools/perf/util/intel-pt.c | 2 ++ 2 files changed, 4 insertions(+)
tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +2 -0
@@ -1118,6 +1118,8 @@ static bool intel_pt_fup_event(struct intel_pt_decoder *decoder)bool ret = false; decoder->state.type &= ~INTEL_PT_BRANCH ; + decoder->state.insn_op =INTEL_PT_OP_OTHER ; + decoder->state.insn_len =0 ;if (decoder->set_fup_tx_flags) { decoder->set_fup_tx_flags = false;
tools/perf/util/intel-pt.c +2 -0
@@ -574,6 +574,7 @@ static int intel_pt_walk_next_insn(struct intel_pt_insn *intel_pt_insn,bool one_map = true; intel_pt_insn->length =0 ; + intel_pt_insn->op =INTEL_PT_OP_OTHER ;if (to_ip && *ip == to_ip) goto out_no_cache;
@@ -649,6 +650,7 @@ static int intel_pt_walk_next_insn(struct intel_pt_insn *intel_pt_insn,if (to_ip && *ip == to_ip) { intel_pt_insn->length =0 ; + intel_pt_insn->op =INTEL_PT_OP_OTHER ; goto out_no_cache; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 171/317 ovl: remove upper umask handling from ovl_create_upper()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
[ Upstream commit 096802748ea1dea8b476938e0a8dc16f4bd2f1ad ]
This is already done by vfs_prepare_mode() when creating the upper object by vfs_create(), vfs_mkdir() and vfs_mknod().
No regressions have been observed in xfstests run with posix acls turned off for the upper filesystem.
--- fs/overlayfs/dir.c | 3 --- 1 file changed, 3 deletions(-)
fs/overlayfs/dir.c +0 -3
@@ -323,9 +323,6 @@ static int ovl_create_upper(struct dentry *dentry, struct inode *inode,struct dentry *newdentry;int err; -if (!attr->hardlink && !IS_POSIXACL (udir)) - attr->mode &= ~current_umask (); -inode_lock_nested (udir,I_MUTEX_PARENT ); newdentry = ovl_create_real(udir, lookup_one_len(dentry->d_name.name,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 172/317 usb: gadget: u_audio: Clear uac pointer when freed.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wulff <[email protected]>
[ Upstream commit a2cf936ebef291ef7395172b9e2f624779fb6dc0 ]
This prevents use of a stale pointer if functions are called after g_cleanup that shouldn't be. This doesn't fix any races, but converts a possibly silent kernel memory corruption into an obvious NULL pointer dereference report.
--- drivers/usb/gadget/function/u_audio.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/gadget/function/u_audio.c +2 -0
@@ -611,6 +611,8 @@ void g_audio_cleanup(struct g_audio *g_audio)return ; uac = g_audio->uac; + g_audio->uac =NULL ; + card = uac->card;if (card)snd_card_free_when_closed (card);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 173/317 stm class: Fix a double free in stm_register_device()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 3df463865ba42b8f88a590326f4c9ea17a1ce459 ]
The put_device(&stm->dev) call will trigger stm_device_release() which frees "stm" so the vfree(stm) on the next line is a double free.
--- drivers/hwtracing/stm/core.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/hwtracing/stm/core.c +6 -5
@@ -868,8 +868,11 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data,return -ENOMEM ; stm->major =register_chrdev (0 , stm_data->name, &stm_fops); -if (stm->major <0 ) - goto err_free; +if (stm->major <0 ) { + err = stm->major; +vfree (stm); +return err; + }device_initialize (&stm->dev); stm->dev.devt =MKDEV (stm->major,0 );
@@ -913,10 +916,8 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data, err_device:unregister_chrdev (stm->major, stm_data->name); -/* matches device_initialize() above */ +/* calls stm_device_release() */ put_device (&stm->dev); -err_free: -vfree (stm);return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 174/317 ppdev: Remove usage of the deprecated ida_simple_xx() API
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit d8407f71ebeaeb6f50bd89791837873e44609708 ]
ida_alloc() and ida_free() should be preferred to the deprecated ida_simple_get() and ida_simple_remove().
This is less verbose.
Stable-dep-of: fbf740aeb86a ("ppdev: Add an error check in register_device")
--- drivers/char/ppdev.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/char/ppdev.c +3 -3
@@ -299,7 +299,7 @@ static int register_device(int minor, struct pp_struct *pp) goto err; } - index =ida_simple_get (&ida_index,0 ,0 ,GFP_KERNEL ); + index =ida_alloc (&ida_index,GFP_KERNEL );memset (&ppdev_cb,0 ,sizeof (ppdev_cb)); ppdev_cb.irq_func = pp_irq; ppdev_cb.flags = (pp->flags &PP_EXCL ) ?PARPORT_FLAG_EXCL :0 ;
@@ -310,7 +310,7 @@ static int register_device(int minor, struct pp_struct *pp)if (!pdev) {pr_warn ("%s: failed to register device!\n" , name); rc = -ENXIO ; -ida_simple_remove (&ida_index, index); +ida_free (&ida_index, index); goto err; }
@@ -750,7 +750,7 @@ static int pp_release(struct inode *inode, struct file *file)if (pp->pdev) {parport_unregister_device (pp->pdev); -ida_simple_remove (&ida_index, pp->index); +ida_free (&ida_index, pp->index); pp->pdev =NULL ;pr_debug (CHRDEV "%x: unregistered pardevice\n" , minor); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 175/317 ppdev: Add an error check in register_device
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huai-Yuan Liu <[email protected]>
[ Upstream commit fbf740aeb86a4fe82ad158d26d711f2f3be79b3e ]
In register_device, the return value of ida_simple_get is unchecked, in witch ida_simple_get will use an invalid index value.
To address this issue, index should be checked after ida_simple_get. When the index value is abnormal, a warning message should be printed, the port should be dropped, and the value should be recorded.
--- drivers/char/ppdev.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/char/ppdev.c +11 -4
@@ -296,28 +296,35 @@ static int register_device(int minor, struct pp_struct *pp)if (!port) {pr_warn ("%s: no associated port!\n" , name); rc = -ENXIO ; - goto err; + goto err_free_name; } index =ida_alloc (&ida_index,GFP_KERNEL ); +if (index <0 ) { +pr_warn ("%s: failed to get index!\n" , name); + rc = index; + goto err_put_port; + } +memset (&ppdev_cb,0 ,sizeof (ppdev_cb)); ppdev_cb.irq_func = pp_irq; ppdev_cb.flags = (pp->flags &PP_EXCL ) ?PARPORT_FLAG_EXCL :0 ; ppdev_cb.private = pp; pdev =parport_register_dev_model (port, name, &ppdev_cb, index); -parport_put_port (port);if (!pdev) {pr_warn ("%s: failed to register device!\n" , name); rc = -ENXIO ;ida_free (&ida_index, index); - goto err; + goto err_put_port; } pp->pdev = pdev; pp->index = index;dev_dbg (&pdev->dev,"registered pardevice\n" ); -err: +err_put_port: +parport_put_port (port); +err_free_name:kfree (name);return rc; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 176/317 perf bench internals inject-build-id: Fix trap divide when collecting just one DSO
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: He Zhe <[email protected]>
[ Upstream commit d9180e23fbfa3875424d3a6b28b71b072862a52a ]
'perf bench internals inject-build-id' suffers from the following error when only one DSO is collected.
# perf bench internals inject-build-id -v
Collected 1 DSOs
traps: internals-injec[2305] trap divide error
ip:557566ba6394 sp:7ffd4de97fe0 error:0 in perf[557566b2a000+23d000]
Build-id injection benchmark
Iteration #1
Floating point exceptionThis patch removes the unnecessary minus one from the divisor which also corrects the randomization range.
--- tools/perf/bench/inject-buildid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/bench/inject-buildid.c +1 -1
@@ -361,7 +361,7 @@ static int inject_build_id(struct bench_data *data, u64 *max_rss)return -1 ;for (i =0 ; i < nr_mmaps; i++) { -int idx =rand () % (nr_dsos -1 ); +int idx =rand () % nr_dsos;struct bench_dso *dso = &dsos[idx];u64 timestamp =rand () %1000000 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 177/317 perf top: Fix TUI exit screen refresh race condition
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: yaowenbin <[email protected]>
[ Upstream commit 64f18d2d043015b3f835ce4c9f3beb97cfd19b6e ]
When the following command is executed several times, a coredump file is generated.
$ timeout -k 9 5 perf top -e task-clock ******* ******* ******* 0.01% [kernel] [k] __do_softirq 0.01% libpthread-2.28.so [.] __pthread_mutex_lock 0.01% [kernel] [k] __ll_sc_atomic64_sub_return double free or corruption (!prev) perf top --sort comm,dso timeout: the monitored command dumped core
When we terminate "perf top" using sending signal method, SLsmg_reset_smg() called. SLsmg_reset_smg() resets the SLsmg screen management routines by freeing all memory allocated while it was active.
However SLsmg_reinit_smg() maybe be called by another thread.
SLsmg_reinit_smg() will free the same memory accessed by SLsmg_reset_smg(), thus it results in a double free.
SLsmg_reinit_smg() is called already protected by ui__lock, so we fix the problem by adding pthread_mutex_trylock of ui__lock when calling SLsmg_reset_smg().
Stable-dep-of: 769e6a1e15bd ("perf ui browser: Don't save pointer to stack memory")
--- tools/perf/ui/tui/setup.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
tools/perf/ui/tui/setup.c +5 -3
@@ -170,9 +170,11 @@ void ui__exit(bool wait_for_ok) "Press any key...", 0);SLtt_set_cursor_visibility (1 ); -SLsmg_refresh (); -SLsmg_reset_smg (); +if (!pthread_mutex_trylock (&ui__lock)) { +SLsmg_refresh (); +SLsmg_reset_smg (); +pthread_mutex_unlock (&ui__lock); + }SLang_reset_tty (); -perf_error__unregister (&perf_tui_eops); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 178/317 perf ui: Update use of pthread mutex
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 82aff6cc070417f26f9b02b26e63c17ff43b4044 ]
Switch to the use of mutex wrappers that provide better error checking.
Stable-dep-of: 769e6a1e15bd ("perf ui browser: Don't save pointer to stack memory")
--- tools/perf/ui/browser.c | 20 ++++++++++---------- tools/perf/ui/browsers/annotate.c | 2 +- tools/perf/ui/setup.c | 5 +++-- tools/perf/ui/tui/helpline.c | 5 ++--- tools/perf/ui/tui/progress.c | 8 ++++---- tools/perf/ui/tui/setup.c | 8 ++++---- tools/perf/ui/tui/util.c | 18 +++++++++--------- tools/perf/ui/ui.h | 4 ++-- 8 files changed, 35 insertions(+), 35 deletions(-)
tools/perf/ui/browser.c +10 -10
@@ -268,9 +268,9 @@ void __ui_browser__show_title(struct ui_browser *browser, const char *title)void ui_browser__show_title (struct ui_browser *browser,const char *title) { -pthread_mutex_lock (&ui__lock); +mutex_lock (&ui__lock);__ui_browser__show_title (browser, title); -pthread_mutex_unlock (&ui__lock); +mutex_unlock (&ui__lock); } int ui_browser__show(struct ui_browser *browser, const char *title,
@@ -284,7 +284,7 @@ int ui_browser__show(struct ui_browser *browser, const char *title, browser->refresh_dimensions (browser); -pthread_mutex_lock (&ui__lock); +mutex_lock (&ui__lock);__ui_browser__show_title (browser, title); browser->title = title;
@@ -295,16 +295,16 @@ int ui_browser__show(struct ui_browser *browser, const char *title,va_end (ap);if (err >0 )ui_helpline__push (browser->helpline); -pthread_mutex_unlock (&ui__lock); +mutex_unlock (&ui__lock);return err ?0 :-1 ; }void ui_browser__hide (struct ui_browser *browser) { -pthread_mutex_lock (&ui__lock); +mutex_lock (&ui__lock);ui_helpline__pop ();zfree (&browser->helpline); -pthread_mutex_unlock (&ui__lock); +mutex_unlock (&ui__lock); }static void ui_browser__scrollbar_set (struct ui_browser *browser)
@@ -352,9 +352,9 @@ static int __ui_browser__refresh(struct ui_browser *browser)int ui_browser__refresh (struct ui_browser *browser) { -pthread_mutex_lock (&ui__lock); +mutex_lock (&ui__lock);__ui_browser__refresh (browser); -pthread_mutex_unlock (&ui__lock); +mutex_unlock (&ui__lock);return 0 ; }
@@ -390,10 +390,10 @@ int ui_browser__run(struct ui_browser *browser, int delay_secs)while (1 ) {off_t offset; -pthread_mutex_lock (&ui__lock); +mutex_lock (&ui__lock); err =__ui_browser__refresh (browser);SLsmg_refresh (); -pthread_mutex_unlock (&ui__lock); +mutex_unlock (&ui__lock);if (err <0 )break ;
tools/perf/ui/browsers/annotate.c +1 -1
@@ -8,11 +8,11 @@#include "../../util/hist.h" #include "../../util/sort.h" #include "../../util/map.h" +#include "../../util/mutex.h" #include "../../util/symbol.h" #include "../../util/evsel.h" #include "../../util/evlist.h" #include <inttypes.h> -#include <pthread.h> #include <linux/kernel.h> #include <linux/string.h> #include <linux/zalloc.h>
tools/perf/ui/setup.c +3 -2
@@ -1,5 +1,4 @@// SPDX-License-Identifier: GPL-2.0 -#include <pthread.h> #include <dlfcn.h> #include <unistd.h>
@@ -8,7 +7,7 @@#include "../util/hist.h" #include "ui.h" -pthread_mutex_t ui__lock =PTHREAD_MUTEX_INITIALIZER ; +struct mutex ui__lock;void *perf_gtk_handle;int use_browser =-1 ;
@@ -76,6 +75,7 @@ int stdio__config_color(const struct option *opt __maybe_unused,void setup_browser (bool fallback_to_pager) { +mutex_init (&ui__lock);if (use_browser <2 && (!isatty (1 ) || dump_trace)) use_browser =0 ;
@@ -118,4 +118,5 @@ void exit_browser(bool wait_for_ok)default :break ; } +mutex_destroy (&ui__lock); }
tools/perf/ui/tui/helpline.c +2 -3
@@ -2,7 +2,6 @@#include <stdio.h> #include <stdlib.h> #include <string.h> -#include <pthread.h> #include <linux/kernel.h> #include <linux/string.h>
@@ -33,7 +32,7 @@ static int tui_helpline__show(const char *format, va_list ap)int ret;static int backlog; -pthread_mutex_lock (&ui__lock); +mutex_lock (&ui__lock); ret =vscnprintf (ui_helpline__last_msg + backlog,sizeof (ui_helpline__last_msg) - backlog, format, ap); backlog += ret;
@@ -45,7 +44,7 @@ static int tui_helpline__show(const char *format, va_list ap)SLsmg_refresh (); backlog =0 ; } -pthread_mutex_unlock (&ui__lock); +mutex_unlock (&ui__lock);return ret; }
tools/perf/ui/tui/progress.c +4 -4
@@ -45,7 +45,7 @@ static void tui_progress__update(struct ui_progress *p) }ui__refresh_dimensions (false); -pthread_mutex_lock (&ui__lock); +mutex_lock (&ui__lock); y = SLtt_Screen_Rows /2 -2 ;SLsmg_set_color (0 );SLsmg_draw_box (y,0 ,3 , SLtt_Screen_Cols);
@@ -56,7 +56,7 @@ static void tui_progress__update(struct ui_progress *p) bar = ((SLtt_Screen_Cols -2 ) * p->curr) / p->total;SLsmg_fill_region (y,1 ,1 , bar,' ' );SLsmg_refresh (); -pthread_mutex_unlock (&ui__lock); +mutex_unlock (&ui__lock); }static void tui_progress__finish (void )
@@ -67,12 +67,12 @@ static void tui_progress__finish(void)return ;ui__refresh_dimensions (false); -pthread_mutex_lock (&ui__lock); +mutex_lock (&ui__lock); y = SLtt_Screen_Rows /2 -2 ;SLsmg_set_color (0 );SLsmg_fill_region (y,0 ,3 , SLtt_Screen_Cols,' ' );SLsmg_refresh (); -pthread_mutex_unlock (&ui__lock); +mutex_unlock (&ui__lock); }static struct ui_progress_ops tui_progress__ops = {
tools/perf/ui/tui/setup.c +4 -4
@@ -29,10 +29,10 @@ void ui__refresh_dimensions(bool force) {if (force || ui__need_resize) { ui__need_resize =0 ; -pthread_mutex_lock (&ui__lock); +mutex_lock (&ui__lock);SLtt_get_screen_size ();SLsmg_reinit_smg (); -pthread_mutex_unlock (&ui__lock); +mutex_unlock (&ui__lock); } }
@@ -170,10 +170,10 @@ void ui__exit(bool wait_for_ok) "Press any key...", 0);SLtt_set_cursor_visibility (1 ); -if (!pthread_mutex_trylock (&ui__lock)) { +if (mutex_trylock (&ui__lock)) {SLsmg_refresh ();SLsmg_reset_smg (); -pthread_mutex_unlock (&ui__lock); +mutex_unlock (&ui__lock); }SLang_reset_tty ();perf_error__unregister (&perf_tui_eops);
tools/perf/ui/tui/util.c +9 -9
@@ -95,7 +95,7 @@ int ui_browser__input_window(const char *title, const char *text, char *input, t = sep +1 ; } -pthread_mutex_lock (&ui__lock); +mutex_lock (&ui__lock); max_len +=2 ; nr_lines +=8 ;
@@ -125,17 +125,17 @@ int ui_browser__input_window(const char *title, const char *text, char *input,SLsmg_write_nstring ((char *)exit_msg, max_len);SLsmg_refresh (); -pthread_mutex_unlock (&ui__lock); +mutex_unlock (&ui__lock); x +=2 ; len =0 ; key =ui__getch (delay_secs);while (key !=K_TIMER && key !=K_ENTER && key !=K_ESC ) { -pthread_mutex_lock (&ui__lock); +mutex_lock (&ui__lock);if (key ==K_BKSPC ) {if (len ==0 ) { -pthread_mutex_unlock (&ui__lock); +mutex_unlock (&ui__lock); goto next_key; }SLsmg_gotorc (y, x + --len);
@@ -147,7 +147,7 @@ int ui_browser__input_window(const char *title, const char *text, char *input, }SLsmg_refresh (); -pthread_mutex_unlock (&ui__lock); +mutex_unlock (&ui__lock);/* XXX more graceful overflow handling needed */ if (len ==sizeof (buf) -1 ) {
@@ -215,19 +215,19 @@ void __ui__info_window(const char *title, const char *text, const char *exit_msgvoid ui__info_window (const char *title,const char *text) { -pthread_mutex_lock (&ui__lock); +mutex_lock (&ui__lock);__ui__info_window (title, text,NULL );SLsmg_refresh (); -pthread_mutex_unlock (&ui__lock); +mutex_unlock (&ui__lock); }int ui__question_window (const char *title,const char *text,const char *exit_msg,int delay_secs) { -pthread_mutex_lock (&ui__lock); +mutex_lock (&ui__lock);__ui__info_window (title, text, exit_msg);SLsmg_refresh (); -pthread_mutex_unlock (&ui__lock); +mutex_unlock (&ui__lock);return ui__getch (delay_secs); }
tools/perf/ui/ui.h +2 -2
@@ -2,11 +2,11 @@#ifndef _PERF_UI_H_#define _PERF_UI_H_ 1 -#include <pthread.h> +#include "../util/mutex.h" #include <stdbool.h> #include <linux/compiler.h> -extern pthread_mutex_t ui__lock; +extern struct mutex ui__lock;extern void *perf_gtk_handle;extern int use_browser;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 179/317 perf ui browser: Dont save pointer to stack memory
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 769e6a1e15bdbbaf2b0d2f37c24f2c53268bd21f ]
ui_browser__show() is capturing the input title that is stack allocated memory in hist_browser__run().
Avoid a use after return by strdup-ing the string.
Committer notes:
Further explanation from Ian Rogers:
My command line using tui is:
$ sudo bash -c 'rm /tmp/asan.log*; export
ASAN_OPTIONS="log_path=/tmp/asan.log"; /tmp/perf/perf mem record -a
sleep 1; /tmp/perf/perf mem report'
I then go to the perf annotate view and quit. This triggers the asan
error (from the log file):
```
==1254591==ERROR: AddressSanitizer: stack-use-after-return on address
0x7f2813331920 at pc 0x7f28180
65991 bp 0x7fff0a21c750 sp 0x7fff0a21bf10
READ of size 80 at 0x7f2813331920 thread T0
#0 0x7f2818065990 in __interceptor_strlen
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:461
#1 0x7f2817698251 in SLsmg_write_wrapped_string
(/lib/x86_64-linux-gnu/libslang.so.2+0x98251)
#2 0x7f28176984b9 in SLsmg_write_nstring
(/lib/x86_64-linux-gnu/libslang.so.2+0x984b9)
#3 0x55c94045b365 in ui_browser__write_nstring ui/browser.c:60
#4 0x55c94045c558 in __ui_browser__show_title ui/browser.c:266
#5 0x55c94045c776 in ui_browser__show ui/browser.c:288
#6 0x55c94045c06d in ui_browser__handle_resize ui/browser.c:206
#7 0x55c94047979b in do_annotate ui/browsers/hists.c:2458
#8 0x55c94047fb17 in evsel__hists_browse ui/browsers/hists.c:3412
#9 0x55c940480a0c in perf_evsel_menu__run ui/browsers/hists.c:3527
#10 0x55c940481108 in __evlist__tui_browse_hists ui/browsers/hists.c:3613
#11 0x55c9404813f7 in evlist__tui_browse_hists ui/browsers/hists.c:3661
#12 0x55c93ffa253f in report__browse_hists tools/perf/builtin-report.c:671
#13 0x55c93ffa58ca in __cmd_report tools/perf/builtin-report.c:1141
#14 0x55c93ffaf159 in cmd_report tools/perf/builtin-report.c:1805
#15 0x55c94000c05c in report_events tools/perf/builtin-mem.c:374
#16 0x55c94000d96d in cmd_mem tools/perf/builtin-mem.c:516
#17 0x55c9400e44ee in run_builtin tools/perf/perf.c:350
#18 0x55c9400e4a5a in handle_internal_command tools/perf/perf.c:403
#19 0x55c9400e4e22 in run_argv tools/perf/perf.c:447
#20 0x55c9400e53ad in main tools/perf/perf.c:561
#21 0x7f28170456c9 in __libc_start_call_main
../sysdeps/nptl/libc_start_call_main.h:58
#22 0x7f2817045784 in __libc_start_main_impl ../csu/libc-start.c:360
#23 0x55c93ff544c0 in _start (/tmp/perf/perf+0x19a4c0) (BuildId:
84899b0e8c7d3a3eaa67b2eb35e3d8b2f8cd4c93)Address 0x7f2813331920 is located in stack of thread T0 at offset 32 in frame
#0 0x55c94046e85e in hist_browser__run ui/browsers/hists.c:746
This frame has 1 object(s):
[32, 192) 'title' (line 747) <== Memory access at offset 32 is
inside this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
```hist_browser__run isn't on the stack so the asan error looks legit. There's no clean init/exit on struct ui_browser so I may be trading a use-after-return for a memory leak, but that seems look a good trade anyway.
--- tools/perf/ui/browser.c | 4 +++- tools/perf/ui/browser.h | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-)
tools/perf/ui/browser.c +3 -1
@@ -287,7 +287,8 @@ int ui_browser__show(struct ui_browser *browser, const char *title,mutex_lock (&ui__lock);__ui_browser__show_title (browser, title); - browser->title = title; +free (browser->title); + browser->title =strdup (title);zfree (&browser->helpline);va_start (ap, helpline);
@@ -304,6 +305,7 @@ void ui_browser__hide(struct ui_browser *browser)mutex_lock (&ui__lock);ui_helpline__pop ();zfree (&browser->helpline); +zfree (&browser->title);mutex_unlock (&ui__lock); }
tools/perf/ui/browser.h +1 -1
@@ -21,7 +21,7 @@ struct ui_browser {u8 extra_title_lines;int current_color;void *priv; -const char *title; +char *title;char *helpline;const char *no_samples_msg;void (*refresh_dimensions)(struct ui_browser *browser);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 180/317 extcon: max8997: select IRQ_DOMAIN instead of depending on it
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit b1781d0a1458070d40134e4f3412ec9d70099bec ]
IRQ_DOMAIN is a hidden (not user visible) symbol. Users cannot set it directly thru "make *config", so drivers should select it instead of depending on it if they need it.
Relying on it being set for a dependency is risky.
Consistently using "select" or "depends on" can also help reduce Kconfig circular dependency issues.
Therefore, change EXTCON_MAX8997's use of "depends on" for IRQ_DOMAIN to "select".
--- drivers/extcon/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/extcon/Kconfig +2 -1
@@ -121,7 +121,8 @@ config EXTCON_MAX77843 config EXTCON_MAX8997 tristate "Maxim MAX8997 EXTCON Support" - depends on MFD_MAX8997 && IRQ_DOMAIN + depends on MFD_MAX8997 + select IRQ_DOMAIN help If you say yes here you get support for the MUIC device of Maxim MAX8997 PMIC. The MAX8997 MUIC is a USB port accessory
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 181/317 PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuppuswamy Sathyanarayanan <[email protected]>
[ Upstream commit f24ba846133d0edec785ac6430d4daf6e9c93a09 ]
The "Downstream Port Containment related Enhancements" ECN of Jan 28, 2019 (document 12888 below), defined the EDR_PORT_DPC_ENABLE_DSM function with Revision ID 5 with Arg3 being an integer. But when the ECN was integrated into PCI Firmware r3.3, sec 4.6.12, it was defined as Revision ID 6 with Arg3 being a package containing an integer.
The implementation in acpi_enable_dpc() supplies a package as Arg3 (arg4 in the code), but it previously specified Revision ID 5. Align this with PCI Firmware r3.3 by using Revision ID 6.
If firmware implemented per the ECN, its Revision 5 function would receive a package as Arg3 when it expects an integer, so acpi_enable_dpc() would likely fail. If such firmware exists and lacks a Revision 6 function that expects a package, we may have to add support for Revision 5.
--- drivers/pci/pcie/edr.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-)
drivers/pci/pcie/edr.c +4 -9
@@ -32,10 +32,10 @@ static int acpi_enable_dpc(struct pci_dev *pdev)int status =0 ;/* -* Behavior when calling unsupported _DSM functions is undefined, -* so check whether EDR_PORT_DPC_ENABLE_DSM is supported. +* Per PCI Firmware r3.3, sec 4.6.12, EDR_PORT_DPC_ENABLE_DSM is +* optional. Return success if it's not implemented. */ -if (!acpi_check_dsm (adev->handle, &pci_acpi_dsm_guid,5 , +if (!acpi_check_dsm (adev->handle, &pci_acpi_dsm_guid,6 ,1ULL <<EDR_PORT_DPC_ENABLE_DSM ))return 0 ;
@@ -46,12 +46,7 @@ static int acpi_enable_dpc(struct pci_dev *pdev) argv4.package.count =1 ; argv4.package.elements = &req; -/* -* Per Downstream Port Containment Related Enhancements ECN to PCI -* Firmware Specification r3.2, sec 4.6.12, EDR_PORT_DPC_ENABLE_DSM is -* optional. Return success if it's not implemented. -*/ - obj =acpi_evaluate_dsm (adev->handle, &pci_acpi_dsm_guid,5 , + obj =acpi_evaluate_dsm (adev->handle, &pci_acpi_dsm_guid,6 ,EDR_PORT_DPC_ENABLE_DSM , &argv4);if (!obj)return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 182/317 PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuppuswamy Sathyanarayanan <[email protected]>
[ Upstream commit e2e78a294a8a863898b781dbcf90e087eda3155d ]
The "Downstream Port Containment related Enhancements" ECN of Jan 28, 2019 (document 12888 below), defined the EDR_PORT_LOCATE_DSM function with Revision ID 5 with a return value encoding (Bits 2:0 = Function, Bits 7:3 = Device, Bits 15:8 = Bus). When the ECN was integrated into PCI Firmware r3.3, sec 4.6.13, Bit 31 was added to indicate success or failure.
Check Bit 31 for failure in acpi_dpc_port_get().
--- drivers/pci/pcie/edr.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/pci/pcie/edr.c +13 -2
@@ -80,8 +80,9 @@ static struct pci_dev *acpi_dpc_port_get(struct pci_dev *pdev)u16 port;/* -* Behavior when calling unsupported _DSM functions is undefined, -* so check whether EDR_PORT_DPC_ENABLE_DSM is supported. +* If EDR_PORT_LOCATE_DSM is not implemented under the target of +* EDR, the target is the port that experienced the containment +* event (PCI Firmware r3.3, sec 4.6.13). */ if (!acpi_check_dsm (adev->handle, &pci_acpi_dsm_guid,5 ,1ULL <<EDR_PORT_LOCATE_DSM ))
@@ -98,6 +99,16 @@ static struct pci_dev *acpi_dpc_port_get(struct pci_dev *pdev)return NULL ; } +/* +* Bit 31 represents the success/failure of the operation. If bit +* 31 is set, the operation failed. +*/ +if (obj->integer.value &BIT (31 )) { +ACPI_FREE (obj); +pci_err (pdev,"Locate Port _DSM failed\n" ); +return NULL ; + } +/* * Firmware returns DPC port BDF details in following format: * 15:8 = bus
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 183/317 perf ui browser: Avoid SEGV on title
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 90f01afb0dfafbc9b094bb61e61a4ac297d9d0d2 ]
If the title is NULL then it can lead to a SEGV.
--- tools/perf/ui/browser.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/ui/browser.c +1 -1
@@ -203,7 +203,7 @@ void ui_browser__refresh_dimensions(struct ui_browser *browser)void ui_browser__handle_resize (struct ui_browser *browser) {ui__refresh_dimensions (false); -ui_browser__show (browser, browser->title, ui_helpline__current); +ui_browser__show (browser, browser->title ?:"" , ui_helpline__current);ui_browser__refresh (browser); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 184/317 perf report: Avoid SEGV in report__setup_sample_type()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 45b4f402a6b782352c4bafcff682bfb01da9ca05 ]
In some cases evsel->name is lazily initialized in evsel__name(). If not initialized passing NULL to strstr() leads to a SEGV.
--- tools/perf/builtin-report.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/builtin-report.c +1 -1
@@ -401,7 +401,7 @@ static int report__setup_sample_type(struct report *rep)* compatibility, set the bit if it's an old perf data file. */ evlist__for_each_entry (session->evlist, evsel) { -if (strstr (evsel->name,"arm_spe" ) && +if (strstr (evsel__name (evsel),"arm_spe" ) && !(sample_type &PERF_SAMPLE_DATA_SRC )) { evsel->core.attr.sample_type |=PERF_SAMPLE_DATA_SRC ; sample_type |=PERF_SAMPLE_DATA_SRC ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 185/317 f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 0a4ed2d97cb6d044196cc3e726b6699222b41019 ]
It needs to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock to avoid racing with checkpoint, otherwise, filesystem metadata including blkaddr in dnode, inode fields and .total_valid_block_count may be corrupted after SPO case.
--- fs/f2fs/file.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
fs/f2fs/file.c +10 -0
@@ -3596,9 +3596,12 @@ static int f2fs_release_compress_blocks(struct file *filp, unsigned long arg)struct dnode_of_data dn;pgoff_t end_offset, count; +f2fs_lock_op (sbi); +set_new_dnode (&dn, inode,NULL ,NULL ,0 ); ret =f2fs_get_dnode_of_data (&dn, page_idx,LOOKUP_NODE );if (ret) { +f2fs_unlock_op (sbi);if (ret == -ENOENT ) { page_idx =f2fs_get_next_page_offset (&dn, page_idx);
@@ -3616,6 +3619,8 @@ static int f2fs_release_compress_blocks(struct file *filp, unsigned long arg)f2fs_put_dnode (&dn); +f2fs_unlock_op (sbi); +if (ret <0 )break ;
@@ -3758,9 +3763,12 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg)struct dnode_of_data dn;pgoff_t end_offset, count; +f2fs_lock_op (sbi); +set_new_dnode (&dn, inode,NULL ,NULL ,0 ); ret =f2fs_get_dnode_of_data (&dn, page_idx,LOOKUP_NODE );if (ret) { +f2fs_unlock_op (sbi);if (ret == -ENOENT ) { page_idx =f2fs_get_next_page_offset (&dn, page_idx);
@@ -3778,6 +3786,8 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg)f2fs_put_dnode (&dn); +f2fs_unlock_op (sbi); +if (ret <0 )break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 186/317 f2fs: fix to release node block count in error path of f2fs_new_node_page()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 0fa4e57c1db263effd72d2149d4e21da0055c316 ]
It missed to call dec_valid_node_count() to release node block count in error path, fix it.
--- fs/f2fs/node.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/node.c +1 -1
@@ -1242,6 +1242,7 @@ struct page *f2fs_new_node_page(struct dnode_of_data *dn, unsigned int ofs) }if (unlikely (new_ni.blk_addr !=NULL_ADDR )) { err = -EFSCORRUPTED ; +dec_valid_node_count (sbi, dn->inode, !ofs);set_sbi_flag (sbi,SBI_NEED_FSCK ); goto fail; }
@@ -1267,7 +1268,6 @@ struct page *f2fs_new_node_page(struct dnode_of_data *dn, unsigned int ofs)if (ofs ==0 )inc_valid_inode_count (sbi);return page; - fail:clear_node_page_dirty (page);f2fs_put_page (page,1 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 187/317 f2fs: compress: dont allow unaligned truncation on released compress inode
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 29ed2b5dd521ce7c5d8466cd70bf0cc9d07afeee ]
f2fs image may be corrupted after below testcase:
- mkfs.f2fs -O extra_attr,compression -f /dev/vdb
- mount /dev/vdb /mnt/f2fs
- touch /mnt/f2fs/file
- f2fs_io setflags compression /mnt/f2fs/file
- dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=4
- f2fs_io release_cblocks /mnt/f2fs/file
- truncate -s 8192 /mnt/f2fs/file
- umount /mnt/f2fs
- fsck.f2fs /dev/vdb
[ASSERT] (fsck_chk_inode_blk:1256) --> ino: 0x5 has i_blocks: 0x00000002, but has 0x3 blocks
[FSCK] valid_block_count matching with CP [Fail] [0x4, 0x5]
[FSCK] other corrupted bugs [Fail]
The reason is: partial truncation assume compressed inode has reserved blocks, after partial truncation, valid block count may change w/o .i_blocks and .total_valid_block_count update, result in corruption.
This patch only allow cluster size aligned truncation on released compress inode for fixing.
--- fs/f2fs/file.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
fs/f2fs/file.c +8 -3
@@ -891,9 +891,14 @@ int f2fs_setattr(struct dentry *dentry, struct iattr *attr) ATTR_GID | ATTR_TIMES_SET))))return -EPERM ; -if ((attr->ia_valid &ATTR_SIZE ) && - !f2fs_is_compress_backend_ready (inode)) -return -EOPNOTSUPP ; +if ((attr->ia_valid &ATTR_SIZE )) { +if (!f2fs_is_compress_backend_ready (inode)) +return -EOPNOTSUPP ; +if (is_inode_flag_set (inode,FI_COMPRESS_RELEASED ) && + !IS_ALIGNED (attr->ia_size, +F2FS_BLK_TO_BYTES (F2FS_I (inode)->i_cluster_size))) +return -EINVAL ; + } err =setattr_prepare (dentry, attr);if (err)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 188/317 serial: sh-sci: protect invalidating RXDMA on shutdown
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit aae20f6e34cd0cbd67a1d0e5877561c40109a81b ]
The to-be-fixed commit removed locking when invalidating the DMA RX descriptors on shutdown. It overlooked that there is still a rx_timer running which may still access the protected data. So, re-add the locking.
--- drivers/tty/serial/sh-sci.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/tty/serial/sh-sci.c +5 -0
@@ -1257,9 +1257,14 @@ static void sci_dma_rx_chan_invalidate(struct sci_port *s)static void sci_dma_rx_release (struct sci_port *s) {struct dma_chan *chan = s->chan_rx_saved; +struct uart_port *port = &s->port; +unsigned long flags; +uart_port_lock_irqsave (port, &flags); s->chan_rx_saved =NULL ;sci_dma_rx_chan_invalidate (s); +uart_port_unlock_irqrestore (port, flags); +dmaengine_terminate_sync (chan);dma_free_coherent (chan->device->dev, s->buf_len_rx *2 , s->rx_buf[0 ],sg_dma_address (&s->sg_rx[0 ]));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 189/317 libsubcmd: Fix parse-options memory leak
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 230a7a71f92212e723fa435d4ca5922de33ec88a ]
If a usage string is built in parse_options_subcommand, also free it.
--- tools/lib/subcmd/parse-options.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
tools/lib/subcmd/parse-options.c +5 -3
@@ -633,11 +633,10 @@ int parse_options_subcommand(int argc, const char **argv, const struct option *o const char *const subcommands[], const char *usagestr[], int flags) { struct parse_opt_ctx_t ctx; +char *buf =NULL ;/* build usage string if it's not provided */ if (subcommands && !usagestr[0 ]) { -char *buf =NULL ; -astrcatf (&buf,"%s %s [<options>] {" , subcmd_config.exec_name, argv[0 ]);for (int i =0 ; subcommands[i]; i++) {
@@ -679,7 +678,10 @@ int parse_options_subcommand(int argc, const char **argv, const struct option *oastrcatf (&error_buf,"unknown switch `%c'" , *ctx.opt);usage_with_options (usagestr, options); } - +if (buf) { + usagestr[0 ] =NULL ; +free (buf); + }return parse_options_end (&ctx); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 190/317 perf stat: Dont display metric header for non-leader uncore events
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 193a9e30207f54777ff42d0d8be8389edc522277 ]
On an Intel tigerlake laptop a metric like:
{
"BriefDescription": "Test",
"MetricExpr": "imc_free_running@data_read@ + imc_free_running@data_write@",
"MetricGroup": "Test",
"MetricName": "Test",
"ScaleUnit": "6.103515625e-5MiB"
},Will have 4 events:
uncore_imc_free_running_0/data_read/
uncore_imc_free_running_0/data_write/
uncore_imc_free_running_1/data_read/
uncore_imc_free_running_1/data_write/
If aggregration is disabled with metric-only 2 column headers are needed:
$ perf stat -M test --metric-only -A -a sleep 1
Performance counter stats for 'system wide':
MiB Test MiB Test
CPU0 1821.0 1820.5
But when not, the counts aggregated in the metric leader and only 1 column should be shown:
$ perf stat -M test --metric-only -a sleep 1 Performance counter stats for 'system wide':
MiB Test
5909.4
1.001258915 seconds time elapsedAchieve this by skipping events that aren't metric leaders when printing column headers and aggregation isn't disabled.
The bug is long standing, the fixes tag is set to a refactor as that is as far back as is reasonable to backport.
--- tools/perf/util/stat-display.c | 3 +++ 1 file changed, 3 insertions(+)
tools/perf/util/stat-display.c +3 -0
@@ -939,6 +939,9 @@ static void print_metric_headers(struct perf_stat_config *config,/* Print metrics headers only */ evlist__for_each_entry (evlist, counter) { +if (config->aggr_mode !=AGGR_NONE && counter->metric_leader != counter) +continue ; + os.evsel = counter; out.ctx = &os; out.print_metric = print_metric_header;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 191/317 s390/ipl: Fix incorrect initialization of len fields in nvme reipl block
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Egorenkov <[email protected]>
[ Upstream commit 9c922b73acaf39f867668d9cbe5dc69c23511f84 ]
Use correct symbolic constants IPL_BP_NVME_LEN and IPL_BP0_NVME_LEN to initialize nvme reipl block when 'scp_data' sysfs attribute is being updated. This bug had not been detected before because the corresponding fcp and nvme symbolic constants are equal.
--- arch/s390/kernel/ipl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/s390/kernel/ipl.c +2 -2
@@ -832,8 +832,8 @@ static ssize_t reipl_nvme_scpdata_write(struct file *filp, struct kobject *kobj, scpdata_len += padding; } - reipl_block_nvme->hdr.len =IPL_BP_FCP_LEN + scpdata_len; - reipl_block_nvme->nvme.len =IPL_BP0_FCP_LEN + scpdata_len; + reipl_block_nvme->hdr.len =IPL_BP_NVME_LEN + scpdata_len; + reipl_block_nvme->nvme.len =IPL_BP0_NVME_LEN + scpdata_len; reipl_block_nvme->nvme.scp_data_len = scpdata_len;return count;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 192/317 s390/ipl: Fix incorrect initialization of nvme dump block
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Egorenkov <[email protected]>
[ Upstream commit 7faacaeaf6ce12fae78751de5ad869d8f1e1cd7a ]
Initialize the correct fields of the nvme dump block.
This bug had not been detected before because first, the fcp and nvme fields of struct ipl_parameter_block are part of the same union and, therefore, overlap in memory and second, they are identical in structure and size.
--- arch/s390/kernel/ipl.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/s390/kernel/ipl.c +3 -3
@@ -1602,9 +1602,9 @@ static int __init dump_nvme_init(void) } dump_block_nvme->hdr.len =IPL_BP_NVME_LEN ; dump_block_nvme->hdr.version =IPL_PARM_BLOCK_VERSION ; - dump_block_nvme->fcp.len =IPL_BP0_NVME_LEN ; - dump_block_nvme->fcp.pbt =IPL_PBT_NVME ; - dump_block_nvme->fcp.opt =IPL_PB0_NVME_OPT_DUMP ; + dump_block_nvme->nvme.len =IPL_BP0_NVME_LEN ; + dump_block_nvme->nvme.pbt =IPL_PBT_NVME ; + dump_block_nvme->nvme.opt =IPL_PB0_NVME_OPT_DUMP ; dump_capabilities |=DUMP_TYPE_NVME ;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 193/317 Input: ims-pcu - fix printf string overflow
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit bf32bceedd0453c70d9d022e2e29f98e446d7161 ]
clang warns about a string overflow in this driver
drivers/input/misc/ims-pcu.c:1802:2: error: 'snprintf' will always be truncated; specified size is 10, but format string expands to at least 12 [-Werror,-Wformat-truncation] drivers/input/misc/ims-pcu.c:1814:2: error: 'snprintf' will always be truncated; specified size is 10, but format string expands to at least 12 [-Werror,-Wformat-truncation]
Make the buffer a little longer to ensure it always fits.
--- drivers/input/misc/ims-pcu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/input/misc/ims-pcu.c +2 -2
@@ -42,8 +42,8 @@ struct ims_pcu_backlight {#define IMS_PCU_PART_NUMBER_LEN 15#define IMS_PCU_SERIAL_NUMBER_LEN 8#define IMS_PCU_DOM_LEN 8 -#define IMS_PCU_FW_VERSION_LEN (9 + 1) -#define IMS_PCU_BL_VERSION_LEN (9 + 1) +#define IMS_PCU_FW_VERSION_LEN 16 +#define IMS_PCU_BL_VERSION_LEN 16#define IMS_PCU_BL_RESET_REASON_LEN (2 + 1)#define IMS_PCU_PCU_B_DEVICE_ID 5
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 194/317 Input: ioc3kbd - convert to platform remove callback returning void
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 150e792dee9ca8416f3d375e48f2f4d7f701fc6b ]
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove().
Trivially convert this driver from always returning zero in the remove callback to the void returning variant.
Stable-dep-of: d40e9edcf3eb ("Input: ioc3kbd - add device table")
--- drivers/input/serio/ioc3kbd.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/input/serio/ioc3kbd.c +2 -4
@@ -190,7 +190,7 @@ static int ioc3kbd_probe(struct platform_device *pdev)return 0 ; } -static int ioc3kbd_remove (struct platform_device *pdev) +static void ioc3kbd_remove (struct platform_device *pdev) {struct ioc3kbd_data *d =platform_get_drvdata (pdev);
@@ -198,13 +198,11 @@ static int ioc3kbd_remove(struct platform_device *pdev)serio_unregister_port (d->kbd);serio_unregister_port (d->aux); - -return 0 ; }static struct platform_driver ioc3kbd_driver = { .probe = ioc3kbd_probe, - .remove = ioc3kbd_remove, + .remove_new = ioc3kbd_remove, .driver = { .name ="ioc3-kbd" , },
Signature · 1 line
2.43.0
Re: [PATCH 5.10 194/317] Input: ioc3kbd - convert to platform remove callback returning void
Greg Kroah-Hartman wrote on Thu, Jun 13, 2024 at 01:33:32PM +0200:
Quoted 8 lines
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove().
A bit late to the party here (this patch was included as commit 0096d223f78c in v5.10.219), but 5.10 does not have .remove_new() (missing commit 5c5a7680e67b ("platform: Provide a remove callback that returns no value")) so there is no way this commit will work.
I'm not building this driver so don't really care and this can be left as is as far as I'm concerned (and since it's been over 2 months probably no-one is using this driver on this old kernel, it doesn't look enabled on e.g. debian's build); so this is just a head's up for mail archives if anyone is notified about the problem they'll want to either revert this or pick up the above commit.
(I checked quickly and that commit was backported to 5.15, so 5.10 is the only tree where that broke, and there is no other driver in 5.10 that tries to set .remove_new)
Thanks,
Signature · 1 line
Dominique
Greg Kroah-Hartman
maintainerRe: [PATCH 5.10 194/317] Input: ioc3kbd - convert to platform remove callback returning void
Quoted 23 lines · Dominique Martinet
Greg Kroah-Hartman wrote on Thu, Jun 13, 2024 at 01:33:32PM +0200:
Quoted 8 lines
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove().
A bit late to the party here (this patch was included as commit
0096d223f78cin v5.10.219), but 5.10 does not have .remove_new() (missing commit5c5a7680e67b("platform: Provide a remove callback that returns no value")) so there is no way this commit will work.I'm not building this driver so don't really care and this can be left as is as far as I'm concerned (and since it's been over 2 months probably no-one is using this driver on this old kernel, it doesn't look enabled on e.g. debian's build); so this is just a head's up for mail archives if anyone is notified about the problem they'll want to either revert this or pick up the above commit.
Quoted 3 lines
(I checked quickly and that commit was backported to 5.15, so 5.10 is the only tree where that broke, and there is no other driver in 5.10 that tries to set .remove_new)
Thanks, I'll go revert this!
greg k-h
Greg Kroah-Hartman
maintainerPATCH 195/317 Input: ioc3kbd - add device table
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karel Balej <[email protected]>
[ Upstream commit d40e9edcf3eb925c259df9f9dd7319a4fcbc675b ]
Without the device table the driver will not auto-load when compiled as a module.
--- drivers/input/serio/ioc3kbd.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/serio/ioc3kbd.c +7 -0
@@ -200,9 +200,16 @@ static void ioc3kbd_remove(struct platform_device *pdev)serio_unregister_port (d->aux); } +static const struct platform_device_id ioc3kbd_id_table[] = { + {"ioc3-kbd" , }, + { } +}; +MODULE_DEVICE_TABLE (platform, ioc3kbd_id_table); +static struct platform_driver ioc3kbd_driver = { .probe = ioc3kbd_probe, .remove_new = ioc3kbd_remove, + .id_table = ioc3kbd_id_table, .driver = { .name ="ioc3-kbd" , },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 196/317 mmc: sdhci_am654: Add tuning algorithm for delay chain
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <[email protected]>
[ Upstream commit 6231d99dd4119312ad41abf9383e18fec66cbe4b ]
Currently the sdhci_am654 driver only supports one tuning algorithm which should be used only when DLL is enabled. The ITAPDLY is selected from the largest passing window and the buffer is viewed as a circular buffer.
The new algorithm should be used when the delay chain is enabled. The ITAPDLY is selected from the largest passing window and the buffer is not viewed as a circular buffer.
This implementation is based off of the following paper: [1].
Also add support for multiple failing windows.
[1] https://www.ti.com/lit/an/spract9/spract9.pdf
--- drivers/mmc/host/sdhci_am654.c | 112 +++++++++++++++++++++++++++------ 1 file changed, 92 insertions(+), 20 deletions(-)
drivers/mmc/host/sdhci_am654.c +92 -20
@@ -149,10 +149,17 @@ struct sdhci_am654_data {int strb_sel;u32 flags;u32 quirks; +bool dll_enable;#define SDHCI_AM654_QUIRK_FORCE_CDTEST BIT(0) }; +struct window { +u8 start; +u8 end; +u8 length; +}; +struct sdhci_am654_driver_data {const struct sdhci_pltfm_data *pdata;u32 flags;
@@ -294,10 +301,13 @@ static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock)regmap_update_bits (sdhci_am654->base,PHY_CTRL4 , mask, val); -if (timing >MMC_TIMING_UHS_SDR25 && clock >=CLOCK_TOO_SLOW_HZ ) +if (timing >MMC_TIMING_UHS_SDR25 && clock >=CLOCK_TOO_SLOW_HZ ) {sdhci_am654_setup_dll (host, clock); -else + sdhci_am654->dll_enable = true; + }else {sdhci_am654_setup_delay_chain (sdhci_am654, timing); + sdhci_am654->dll_enable = false; + }regmap_update_bits (sdhci_am654->base,PHY_CTRL5 ,CLKBUFSEL_MASK , sdhci_am654->clkbuf_sel);
@@ -415,39 +425,101 @@ static u32 sdhci_am654_cqhci_irq(struct sdhci_host *host, u32 intmask)return 0 ; } -#define ITAP_MAX 32 +#define ITAPDLY_LENGTH 32 +#define ITAPDLY_LAST_INDEX (ITAPDLY_LENGTH - 1) + +static u32 sdhci_am654_calculate_itap (struct sdhci_host *host,struct window + *fail_window,u8 num_fails,bool circular_buffer) +{ +u8 itap =0 , start_fail =0 , end_fail =0 , pass_length =0 ; +u8 first_fail_start =0 , last_fail_end =0 ; +struct device *dev =mmc_dev (host->mmc); +struct window pass_window = {0 ,0 ,0 }; +int prev_fail_end =-1 ; +u8 i; + +if (!num_fails) +return ITAPDLY_LAST_INDEX >>1 ; + +if (fail_window->length ==ITAPDLY_LENGTH ) { +dev_err (dev,"No passing ITAPDLY, return 0\n" ); +return 0 ; + } + + first_fail_start = fail_window->start; + last_fail_end = fail_window[num_fails -1 ].end; + +for (i =0 ; i < num_fails; i++) { + start_fail = fail_window[i].start; + end_fail = fail_window[i].end; + pass_length = start_fail - (prev_fail_end +1 ); + +if (pass_length > pass_window.length) { + pass_window.start = prev_fail_end +1 ; + pass_window.length = pass_length; + } + prev_fail_end = end_fail; + } + +if (!circular_buffer) + pass_length =ITAPDLY_LAST_INDEX - last_fail_end; +else + pass_length =ITAPDLY_LAST_INDEX - last_fail_end + first_fail_start; + +if (pass_length > pass_window.length) { + pass_window.start = last_fail_end +1 ; + pass_window.length = pass_length; + } + +if (!circular_buffer) + itap = pass_window.start + (pass_window.length >>1 ); +else + itap = (pass_window.start + (pass_window.length >>1 )) %ITAPDLY_LENGTH ; + +return (itap >ITAPDLY_LAST_INDEX ) ?ITAPDLY_LAST_INDEX >>1 : itap; +} +static int sdhci_am654_platform_execute_tuning (struct sdhci_host *host,u32 opcode) {struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host);struct sdhci_am654_data *sdhci_am654 =sdhci_pltfm_priv (pltfm_host); -int cur_val, prev_val =1 , fail_len =0 , pass_window =0 , pass_len; -u32 itap; +struct window fail_window[ITAPDLY_LENGTH ]; +u8 curr_pass, itap; +u8 fail_index =0 ; +u8 prev_pass =1 ; + +memset (fail_window,0 ,sizeof (fail_window));/* Enable ITAPDLY */ regmap_update_bits (sdhci_am654->base,PHY_CTRL4 ,ITAPDLYENA_MASK ,1 <<ITAPDLYENA_SHIFT ); -for (itap =0 ; itap <ITAP_MAX ; itap++) { +for (itap =0 ; itap <ITAPDLY_LENGTH ; itap++) {sdhci_am654_write_itapdly (sdhci_am654, itap); - cur_val = !mmc_send_tuning (host->mmc, opcode,NULL ); -if (cur_val && !prev_val) - pass_window = itap; + curr_pass = !mmc_send_tuning (host->mmc, opcode,NULL ); -if (!cur_val) - fail_len++; +if (!curr_pass && prev_pass) + fail_window[fail_index].start = itap; - prev_val = cur_val; +if (!curr_pass) { + fail_window[fail_index].end = itap; + fail_window[fail_index].length++; + } + +if (curr_pass && !prev_pass) + fail_index++; + + prev_pass = curr_pass; } -/* -* Having determined the length of the failing window and start of -* the passing window calculate the length of the passing window and -* set the final value halfway through it considering the range as a -* circular buffer -*/ - pass_len =ITAP_MAX - fail_len; - itap = (pass_window + (pass_len >>1 )) %ITAP_MAX ; + +if (fail_window[fail_index].length !=0 ) + fail_index++; + + itap =sdhci_am654_calculate_itap (host, fail_window, fail_index, + sdhci_am654->dll_enable); +sdhci_am654_write_itapdly (sdhci_am654, itap);return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 197/317 mmc: sdhci_am654: Write ITAPDLY for DDR52 timing
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <[email protected]>
[ Upstream commit d465234493bb6ad1b9c10a0c9ef9881b8d85081a ]
For DDR52 timing, DLL is enabled but tuning is not carried out, therefore the ITAPDLY value in PHY CTRL 4 register is not correct. Fix this by writing ITAPDLY after enabling DLL.
--- drivers/mmc/host/sdhci_am654.c | 1 + 1 file changed, 1 insertion(+)
drivers/mmc/host/sdhci_am654.c +1 -0
@@ -304,6 +304,7 @@ static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock)if (timing >MMC_TIMING_UHS_SDR25 && clock >=CLOCK_TOO_SLOW_HZ ) {sdhci_am654_setup_dll (host, clock); sdhci_am654->dll_enable = true; +sdhci_am654_write_itapdly (sdhci_am654, sdhci_am654->itap_del_sel[timing]); }else {sdhci_am654_setup_delay_chain (sdhci_am654, timing); sdhci_am654->dll_enable = false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 198/317 mmc: sdhci_am654: Drop lookup for deprecated ti,otap-del-sel
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vignesh Raghavendra <[email protected]>
[ Upstream commit 5cb2f9286a31f33dc732c57540838ad9339393ab ]
ti,otap-del-sel has been deprecated since v5.7 and there are no users of this property and no documentation in the DT bindings either. Drop the fallback code looking for this property, this makes sdhci_am654_get_otap_delay() much easier to read as all the TAP values can be handled via a single iterator loop.
Stable-dep-of: 387c1bf7dce0 ("mmc: sdhci_am654: Add OTAP/ITAP delay enable")
--- drivers/mmc/host/sdhci_am654.c | 37 ++++++---------------------------- 1 file changed, 6 insertions(+), 31 deletions(-)
drivers/mmc/host/sdhci_am654.c +6 -31
@@ -140,7 +140,6 @@ static const struct timing_data td[] = {struct sdhci_am654_data {struct regmap *base; -bool legacy_otapdly;int otap_del_sel[ARRAY_SIZE (td)];int itap_del_sel[ARRAY_SIZE (td)];int clkbuf_sel;
@@ -278,11 +277,7 @@ static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock)sdhci_set_clock (host, clock);/* Setup DLL Output TAP delay */ -if (sdhci_am654->legacy_otapdly) - otap_del_sel = sdhci_am654->otap_del_sel[0 ]; -else - otap_del_sel = sdhci_am654->otap_del_sel[timing]; - + otap_del_sel = sdhci_am654->otap_del_sel[timing]; otap_del_ena = (timing >MMC_TIMING_UHS_SDR25 ) ?1 :0 ; mask =OTAPDLYENA_MASK |OTAPDLYSEL_MASK ;
@@ -324,10 +319,7 @@ static void sdhci_j721e_4bit_set_clock(struct sdhci_host *host,u32 mask, val;/* Setup DLL Output TAP delay */ -if (sdhci_am654->legacy_otapdly) - otap_del_sel = sdhci_am654->otap_del_sel[0 ]; -else - otap_del_sel = sdhci_am654->otap_del_sel[timing]; + otap_del_sel = sdhci_am654->otap_del_sel[timing]; mask =OTAPDLYENA_MASK |OTAPDLYSEL_MASK ; val = (0x1 << OTAPDLYENA_SHIFT) |
@@ -652,32 +644,15 @@ static int sdhci_am654_get_otap_delay(struct sdhci_host *host,int i;int ret; - ret =device_property_read_u32 (dev, td[MMC_TIMING_LEGACY ].otap_binding, - &sdhci_am654->otap_del_sel[MMC_TIMING_LEGACY ]); -if (ret) { -/* -* ti,otap-del-sel-legacy is mandatory, look for old binding -* if not found. -*/ - ret =device_property_read_u32 (dev,"ti,otap-del-sel" , - &sdhci_am654->otap_del_sel[0 ]); -if (ret) { -dev_err (dev,"Couldn't find otap-del-sel\n" ); - -return ret; - } - -dev_info (dev,"Using legacy binding ti,otap-del-sel\n" ); - sdhci_am654->legacy_otapdly = true; - -return 0 ; - } -for (i =MMC_TIMING_LEGACY ; i <=MMC_TIMING_MMC_HS400 ; i++) { ret =device_property_read_u32 (dev, td[i].otap_binding, &sdhci_am654->otap_del_sel[i]);if (ret) { +if (i ==MMC_TIMING_LEGACY ) { +dev_err (dev,"Couldn't find mandatory ti,otap-del-sel-legacy\n" ); +return ret; + }dev_dbg (dev,"Couldn't find %s\n" , td[i].otap_binding);/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 199/317 mmc: sdhci_am654: Add OTAP/ITAP delay enable
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <[email protected]>
[ Upstream commit 387c1bf7dce0dfea02080c8bdb066b5209e92155 ]
Currently the OTAP/ITAP delay enable functionality is incorrect in the am654_set_clock function. The OTAP delay is not enabled when timing < SDR25 bus speed mode. The ITAP delay is not enabled for timings that do not carry out tuning.
Add this OTAP/ITAP delay functionality according to the datasheet
[1] OTAPDLYENA and ITAPDLYENA for MMC0.
[1] https://www.ti.com/lit/ds/symlink/am62p.pdf
--- drivers/mmc/host/sdhci_am654.c | 40 ++++++++++++++++++++++------------ 1 file changed, 26 insertions(+), 14 deletions(-)
drivers/mmc/host/sdhci_am654.c +26 -14
@@ -142,6 +142,7 @@ struct sdhci_am654_data {struct regmap *base;int otap_del_sel[ARRAY_SIZE (td)];int itap_del_sel[ARRAY_SIZE (td)]; +u32 itap_del_ena[ARRAY_SIZE (td)];int clkbuf_sel;int trm_icp;int drv_strength;
@@ -238,11 +239,13 @@ static void sdhci_am654_setup_dll(struct sdhci_host *host, unsigned int clock) }static void sdhci_am654_write_itapdly (struct sdhci_am654_data *sdhci_am654, -u32 itapdly) +u32 itapdly,u32 enable) {/* Set ITAPCHGWIN before writing to ITAPDLY */ regmap_update_bits (sdhci_am654->base,PHY_CTRL4 ,ITAPCHGWIN_MASK ,1 <<ITAPCHGWIN_SHIFT ); +regmap_update_bits (sdhci_am654->base,PHY_CTRL4 ,ITAPDLYENA_MASK , + enable <<ITAPDLYENA_SHIFT );regmap_update_bits (sdhci_am654->base,PHY_CTRL4 ,ITAPDLYSEL_MASK , itapdly <<ITAPDLYSEL_SHIFT );regmap_update_bits (sdhci_am654->base,PHY_CTRL4 ,ITAPCHGWIN_MASK ,0 );
@@ -259,8 +262,8 @@ static void sdhci_am654_setup_delay_chain(struct sdhci_am654_data *sdhci_am654, mask =SELDLYTXCLK_MASK |SELDLYRXCLK_MASK ;regmap_update_bits (sdhci_am654->base,PHY_CTRL5 , mask, val); -sdhci_am654_write_itapdly (sdhci_am654, - sdhci_am654->itap_del_sel[timing]); +sdhci_am654_write_itapdly (sdhci_am654, sdhci_am654->itap_del_sel[timing], + sdhci_am654->itap_del_ena[timing]); }static void sdhci_am654_set_clock (struct sdhci_host *host,unsigned int clock)
@@ -269,7 +272,6 @@ static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock)struct sdhci_am654_data *sdhci_am654 =sdhci_pltfm_priv (pltfm_host);unsigned char timing = host->mmc->ios.timing;u32 otap_del_sel; -u32 otap_del_ena;u32 mask, val;regmap_update_bits (sdhci_am654->base,PHY_CTRL1 ,ENDLL_MASK ,0 );
@@ -278,10 +280,9 @@ static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock)/* Setup DLL Output TAP delay */ otap_del_sel = sdhci_am654->otap_del_sel[timing]; - otap_del_ena = (timing >MMC_TIMING_UHS_SDR25 ) ?1 :0 ; mask =OTAPDLYENA_MASK |OTAPDLYSEL_MASK ; - val = (otap_del_ena <<OTAPDLYENA_SHIFT ) | + val = (0x1 <<OTAPDLYENA_SHIFT ) | (otap_del_sel <<OTAPDLYSEL_SHIFT );/* Write to STRBSEL for HS400 speed mode */
@@ -299,7 +300,8 @@ static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock)if (timing >MMC_TIMING_UHS_SDR25 && clock >=CLOCK_TOO_SLOW_HZ ) {sdhci_am654_setup_dll (host, clock); sdhci_am654->dll_enable = true; -sdhci_am654_write_itapdly (sdhci_am654, sdhci_am654->itap_del_sel[timing]); +sdhci_am654_write_itapdly (sdhci_am654, sdhci_am654->itap_del_sel[timing], + sdhci_am654->itap_del_ena[timing]); }else {sdhci_am654_setup_delay_chain (sdhci_am654, timing); sdhci_am654->dll_enable = false;
@@ -316,6 +318,7 @@ static void sdhci_j721e_4bit_set_clock(struct sdhci_host *host,struct sdhci_am654_data *sdhci_am654 =sdhci_pltfm_priv (pltfm_host);unsigned char timing = host->mmc->ios.timing;u32 otap_del_sel; +u32 itap_del_ena;u32 mask, val;/* Setup DLL Output TAP delay */
@@ -324,6 +327,12 @@ static void sdhci_j721e_4bit_set_clock(struct sdhci_host *host, mask =OTAPDLYENA_MASK |OTAPDLYSEL_MASK ; val = (0x1 <<OTAPDLYENA_SHIFT ) | (otap_del_sel <<OTAPDLYSEL_SHIFT ); + + itap_del_ena = sdhci_am654->itap_del_ena[timing]; + + mask |=ITAPDLYENA_MASK ; + val |= (itap_del_ena <<ITAPDLYENA_SHIFT ); +regmap_update_bits (sdhci_am654->base,PHY_CTRL4 , mask, val); regmap_update_bits(sdhci_am654->base, PHY_CTRL5, CLKBUFSEL_MASK,
@@ -477,6 +486,7 @@ static int sdhci_am654_platform_execute_tuning(struct sdhci_host *host, {struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host);struct sdhci_am654_data *sdhci_am654 =sdhci_pltfm_priv (pltfm_host); +unsigned char timing = host->mmc->ios.timing;struct window fail_window[ITAPDLY_LENGTH ];u8 curr_pass, itap;u8 fail_index =0 ;
@@ -485,11 +495,10 @@ static int sdhci_am654_platform_execute_tuning(struct sdhci_host *host,memset (fail_window,0 ,sizeof (fail_window));/* Enable ITAPDLY */ -regmap_update_bits (sdhci_am654->base,PHY_CTRL4 ,ITAPDLYENA_MASK , -1 <<ITAPDLYENA_SHIFT ); + sdhci_am654->itap_del_ena[timing] =0x1 ;for (itap =0 ; itap <ITAPDLY_LENGTH ; itap++) { -sdhci_am654_write_itapdly (sdhci_am654, itap); +sdhci_am654_write_itapdly (sdhci_am654, itap, sdhci_am654->itap_del_ena[timing]); curr_pass = !mmc_send_tuning (host->mmc, opcode,NULL );
@@ -513,7 +522,7 @@ static int sdhci_am654_platform_execute_tuning(struct sdhci_host *host, itap =sdhci_am654_calculate_itap (host, fail_window, fail_index, sdhci_am654->dll_enable); -sdhci_am654_write_itapdly (sdhci_am654, itap); +sdhci_am654_write_itapdly (sdhci_am654, itap, sdhci_am654->itap_del_ena[timing]);return 0 ; }
@@ -665,9 +674,12 @@ static int sdhci_am654_get_otap_delay(struct sdhci_host *host, host->mmc->caps2 &= ~td[i].capability; } -if (td[i].itap_binding) -device_property_read_u32 (dev, td[i].itap_binding, - &sdhci_am654->itap_del_sel[i]); +if (td[i].itap_binding) { + ret =device_property_read_u32 (dev, td[i].itap_binding, + &sdhci_am654->itap_del_sel[i]); +if (!ret) + sdhci_am654->itap_del_ena[i] =0x1 ; + } }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 200/317 mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <[email protected]>
[ Upstream commit 9dff65bb5e09903c27d9cff947dff4d22b6ea6a1 ]
Add ITAPDLYSEL to sdhci_j721e_4bit_set_clock function. This allows to set the correct ITAPDLY for timings that do not carry out tuning.
--- drivers/mmc/host/sdhci_am654.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/mmc/host/sdhci_am654.c +9 -3
@@ -319,6 +319,7 @@ static void sdhci_j721e_4bit_set_clock(struct sdhci_host *host,unsigned char timing = host->mmc->ios.timing;u32 otap_del_sel;u32 itap_del_ena; +u32 itap_del_sel;u32 mask, val;/* Setup DLL Output TAP delay */
@@ -328,13 +329,18 @@ static void sdhci_j721e_4bit_set_clock(struct sdhci_host *host, val = (0x1 <<OTAPDLYENA_SHIFT ) | (otap_del_sel <<OTAPDLYSEL_SHIFT ); +/* Setup Input TAP delay */ itap_del_ena = sdhci_am654->itap_del_ena[timing]; + itap_del_sel = sdhci_am654->itap_del_sel[timing]; - mask |=ITAPDLYENA_MASK ; - val |= (itap_del_ena <<ITAPDLYENA_SHIFT ); + mask |=ITAPDLYENA_MASK |ITAPDLYSEL_MASK ; + val |= (itap_del_ena <<ITAPDLYENA_SHIFT ) | + (itap_del_sel <<ITAPDLYSEL_SHIFT ); +regmap_update_bits (sdhci_am654->base,PHY_CTRL4 ,ITAPCHGWIN_MASK , +1 <<ITAPCHGWIN_SHIFT );regmap_update_bits (sdhci_am654->base,PHY_CTRL4 , mask, val); - +regmap_update_bits (sdhci_am654->base,PHY_CTRL4 ,ITAPCHGWIN_MASK ,0 );regmap_update_bits (sdhci_am654->base,PHY_CTRL5 ,CLKBUFSEL_MASK , sdhci_am654->clkbuf_sel);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 201/317 mmc: sdhci_am654: Fix ITAPDLY for HS400 timing
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judith Mendez <[email protected]>
[ Upstream commit d3182932bb070e7518411fd165e023f82afd7d25 ]
While STRB is currently used for DATA and CRC responses, the CMD responses from the device to the host still require ITAPDLY for HS400 timing.
Currently what is stored for HS400 is the ITAPDLY from High Speed mode which is incorrect. The ITAPDLY for HS400 speed mode should be the same as ITAPDLY as HS200 timing after tuning is executed. Add the functionality to save ITAPDLY from HS200 tuning and save as HS400 ITAPDLY.
--- drivers/mmc/host/sdhci_am654.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/mmc/host/sdhci_am654.c +9 -0
@@ -300,6 +300,12 @@ static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock)if (timing >MMC_TIMING_UHS_SDR25 && clock >=CLOCK_TOO_SLOW_HZ ) {sdhci_am654_setup_dll (host, clock); sdhci_am654->dll_enable = true; + +if (timing ==MMC_TIMING_MMC_HS400 ) { + sdhci_am654->itap_del_ena[timing] =0x1 ; + sdhci_am654->itap_del_sel[timing] = sdhci_am654->itap_del_sel[timing -1 ]; + } +sdhci_am654_write_itapdly (sdhci_am654, sdhci_am654->itap_del_sel[timing], sdhci_am654->itap_del_ena[timing]); }else {
@@ -530,6 +536,9 @@ static int sdhci_am654_platform_execute_tuning(struct sdhci_host *host,sdhci_am654_write_itapdly (sdhci_am654, itap, sdhci_am654->itap_del_ena[timing]); +/* Save ITAPDLY */ + sdhci_am654->itap_del_sel[timing] = itap; +return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 202/317 Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fenglin Wu <[email protected]>
[ Upstream commit 48c0687a322d54ac7e7a685c0b6db78d78f593af ]
The output voltage is inclusive hence the max level calculation is off-by-one-step. Correct it.
iWhile we are at it also add a define for the step size instead of using the magic value.
--- drivers/input/misc/pm8xxx-vibrator.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/input/misc/pm8xxx-vibrator.c +4 -3
@@ -14,7 +14,8 @@#define VIB_MAX_LEVEL_mV (3100)#define VIB_MIN_LEVEL_mV (1200) -#define VIB_MAX_LEVELS (VIB_MAX_LEVEL_mV - VIB_MIN_LEVEL_mV) +#define VIB_PER_STEP_mV (100) +#define VIB_MAX_LEVELS (VIB_MAX_LEVEL_mV - VIB_MIN_LEVEL_mV + VIB_PER_STEP_mV)#define MAX_FF_SPEED 0xff
@@ -118,10 +119,10 @@ static void pm8xxx_work_handler(struct work_struct *work) vib->active = true; vib->level = ((VIB_MAX_LEVELS * vib->speed) /MAX_FF_SPEED ) + VIB_MIN_LEVEL_mV; - vib->level /=100 ; + vib->level /= VIB_PER_STEP_mV; }else { vib->active = false; - vib->level = VIB_MIN_LEVEL_mV /100 ; + vib->level = VIB_MIN_LEVEL_mV / VIB_PER_STEP_mV; }pm8xxx_vib_set (vib, vib->active);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 203/317 drm/msm/dpu: Always flush the slave INTF on the CTL
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marijn Suijten <[email protected]>
[ Upstream commit 2b938c3ab0a69ec6ea587bbf6fc2aec3db4a8736 ]
As we can clearly see in a downstream kernel [1], flushing the slave INTF is skipped /only if/ the PPSPLIT topology is active.
However, when DPU was originally submitted to mainline PPSPLIT was no longer part of it (seems to have been ripped out before submission), but this clause was incorrectly ported from the original SDE driver. Given that there is no support for PPSPLIT (currently), flushing the slave INTF should /never/ be skipped (as the if (ppsplit && !master) goto skip; clause downstream never becomes true).
Patchwork: https://patchwork.freedesktop.org/patch/589901/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 3 --- 1 file changed, 3 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c +0 -3
@@ -448,9 +448,6 @@ static void dpu_encoder_phys_cmd_enable_helper(_dpu_encoder_phys_cmd_pingpong_config (phys_enc); -if (!dpu_encoder_phys_cmd_is_master (phys_enc)) -return ; - ctl = phys_enc->hw_ctl; ctl->ops.get_bitmask_intf (ctl, &flush_mask, phys_enc->intf_idx); ctl->ops.update_pending_flush (ctl, flush_mask);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 204/317 um: Fix return value in ubd_init()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
[ Upstream commit 31a5990ed253a66712d7ddc29c92d297a991fdf2 ]
When kmalloc_array() fails to allocate memory, the ubd_init() should return -ENOMEM instead of -1. So, fix it.
--- arch/um/drivers/ubd_kern.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/um/drivers/ubd_kern.c +2 -2
@@ -1158,7 +1158,7 @@ static int __init ubd_init(void)if (irq_req_buffer ==NULL ) {printk (KERN_ERR "Failed to initialize ubd buffering\n" ); -return -1 ; +return -ENOMEM ; } io_req_buffer = kmalloc_array(UBD_REQ_BUFFER_SIZE, sizeof(struct io_thread_req *),
@@ -1169,7 +1169,7 @@ static int __init ubd_init(void)if (io_req_buffer ==NULL ) {printk (KERN_ERR "Failed to initialize ubd buffering\n" ); -return -1 ; +return -ENOMEM ; }platform_driver_register (&ubd_driver);mutex_lock (&ubd_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 205/317 um: Add winch to winch_handlers before registering winch IRQ
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roberto Sassu <[email protected]>
[ Upstream commit a0fbbd36c156b9f7b2276871d499c9943dfe5101 ]
Registering a winch IRQ is racy, an interrupt may occur before the winch is added to the winch_handlers list.
If that happens, register_winch_irq() adds to that list a winch that is scheduled to be (or has already been) freed, causing a panic later in winch_cleanup().
Avoid the race by adding the winch to the winch_handlers list before registering the IRQ, and rolling back if um_request_irq() fails.
--- arch/um/drivers/line.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
arch/um/drivers/line.c +8 -6
@@ -668,24 +668,26 @@ void register_winch_irq(int fd, int tty_fd, int pid, struct tty_port *port, goto cleanup; } - *winch = ((struct winch ) { .list =LIST_HEAD_INIT (winch->list), - .fd = fd, + *winch = ((struct winch ) { .fd = fd, .tty_fd = tty_fd, .pid = pid, .port = port, .stack = stack }); +spin_lock (&winch_handler_lock); +list_add (&winch->list, &winch_handlers); +spin_unlock (&winch_handler_lock); +if (um_request_irq (WINCH_IRQ , fd,IRQ_READ , winch_interrupt,IRQF_SHARED ,"winch" , winch) <0 ) {printk (KERN_ERR "register_winch_irq - failed to register " "IRQ\n" ); +spin_lock (&winch_handler_lock); +list_del (&winch->list); +spin_unlock (&winch_handler_lock); goto out_free; } -spin_lock (&winch_handler_lock); -list_add (&winch->list, &winch_handlers); -spin_unlock (&winch_handler_lock); -return ; out_free:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 206/317 um: vector: fix bpfflash parameter evaluation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 584ed2f76ff5fe360d87a04d17b6520c7999e06b ]
With W=1 the build complains about a pointer compared to zero, clearly the result should've been compared.
--- arch/um/drivers/vector_kern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/um/drivers/vector_kern.c +1 -1
@@ -142,7 +142,7 @@ static bool get_bpf_flash(struct arglist *def)if (allow !=NULL ) {if (kstrtoul (allow,10 , &result) ==0 ) -return (allow >0 ); +return result >0 ; }return false; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 207/317 drm/bridge: tc358775: fix support for jeida-18 and jeida-24
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit 30ea09a182cb37c4921b9d477ed18107befe6d78 ]
The bridge always uses 24bpp internally. Therefore, for jeida-18 mapping we need to discard the lowest two bits for each channel and thus starting with LV_[RGB]2. jeida-24 has the same mapping but uses four lanes instead of three, with the forth pair transmitting the lowest two bits of each channel. Thus, the mapping between jeida-18 and jeida-24 is actually the same, except that one channel is turned off (by selecting the RGB666 format in VPCTRL).
While at it, remove the bogus comment about the hardware default because the default is overwritten in any case.
Tested with a jeida-18 display (Evervision VGG644804).
--- drivers/gpu/drm/bridge/tc358775.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-)
drivers/gpu/drm/bridge/tc358775.c +9 -12
@@ -453,10 +453,6 @@ static void tc_bridge_enable(struct drm_bridge *bridge)dev_dbg (tc->dev,"bus_formats %04x bpc %d\n" , connector->display_info.bus_formats[0 ], tc->bpc); -/* -* Default hardware register settings of tc358775 configured -* with MEDIA_BUS_FMT_RGB888_1X7X4_JEIDA jeida-24 format -*/ if (connector->display_info.bus_formats[0 ] ==MEDIA_BUS_FMT_RGB888_1X7X4_SPWG ) {/* VESA-24 */
@@ -467,14 +463,15 @@ static void tc_bridge_enable(struct drm_bridge *bridge)d2l_write (tc->i2c,LV_MX1619 ,LV_MX (LVI_B6 ,LVI_B7 ,LVI_B1 ,LVI_B2 ));d2l_write (tc->i2c,LV_MX2023 ,LV_MX (LVI_B3 ,LVI_B4 ,LVI_B5 ,LVI_L0 ));d2l_write (tc->i2c,LV_MX2427 ,LV_MX (LVI_HS ,LVI_VS ,LVI_DE ,LVI_R6 )); - }else {/* MEDIA_BUS_FMT_RGB666_1X7X3_SPWG - JEIDA-18 */ -d2l_write (tc->i2c,LV_MX0003 ,LV_MX (LVI_R0 ,LVI_R1 ,LVI_R2 ,LVI_R3 )); -d2l_write (tc->i2c,LV_MX0407 ,LV_MX (LVI_R4 ,LVI_L0 ,LVI_R5 ,LVI_G0 )); -d2l_write (tc->i2c,LV_MX0811 ,LV_MX (LVI_G1 ,LVI_G2 ,LVI_L0 ,LVI_L0 )); -d2l_write (tc->i2c,LV_MX1215 ,LV_MX (LVI_G3 ,LVI_G4 ,LVI_G5 ,LVI_B0 )); -d2l_write (tc->i2c,LV_MX1619 ,LV_MX (LVI_L0 ,LVI_L0 ,LVI_B1 ,LVI_B2 )); -d2l_write (tc->i2c,LV_MX2023 ,LV_MX (LVI_B3 ,LVI_B4 ,LVI_B5 ,LVI_L0 )); -d2l_write (tc->i2c,LV_MX2427 ,LV_MX (LVI_HS ,LVI_VS ,LVI_DE ,LVI_L0 )); + }else { +/* JEIDA-18 and JEIDA-24 */ +d2l_write (tc->i2c,LV_MX0003 ,LV_MX (LVI_R2 ,LVI_R3 ,LVI_R4 ,LVI_R5 )); +d2l_write (tc->i2c,LV_MX0407 ,LV_MX (LVI_R6 ,LVI_R1 ,LVI_R7 ,LVI_G2 )); +d2l_write (tc->i2c,LV_MX0811 ,LV_MX (LVI_G3 ,LVI_G4 ,LVI_G0 ,LVI_G1 )); +d2l_write (tc->i2c,LV_MX1215 ,LV_MX (LVI_G5 ,LVI_G6 ,LVI_G7 ,LVI_B2 )); +d2l_write (tc->i2c,LV_MX1619 ,LV_MX (LVI_B0 ,LVI_B1 ,LVI_B3 ,LVI_B4 )); +d2l_write (tc->i2c,LV_MX2023 ,LV_MX (LVI_B5 ,LVI_B6 ,LVI_B7 ,LVI_L0 )); +d2l_write (tc->i2c,LV_MX2427 ,LV_MX (LVI_HS ,LVI_VS ,LVI_DE ,LVI_R0 )); }d2l_write (tc->i2c,VFUEN ,VFUEN_EN );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 208/317 media: stk1160: fix bounds checking in stk1160_copy_video()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit faa4364bef2ec0060de381ff028d1d836600a381 ]
The subtract in this condition is reversed. The ->length is the length of the buffer. The ->bytesused is how many bytes we have copied thus far. When the condition is reversed that means the result of the subtraction is always negative but since it's unsigned then the result is a very high positive value. That means the overflow check is never true.
Additionally, the ->bytesused doesn't actually work for this purpose because we're not writing to "buf->mem + buf->bytesused". Instead, the math to calculate the destination where we are writing is a bit involved. You calculate the number of full lines already written, multiply by two, skip a line if necessary so that we start on an odd numbered line, and add the offset into the line.
To fix this buffer overflow, just take the actual destination where we are writing, if the offset is already out of bounds print an error and return. Otherwise, write up to buf->length bytes.
--- drivers/media/usb/stk1160/stk1160-video.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
drivers/media/usb/stk1160/stk1160-video.c +15 -5
@@ -99,7 +99,7 @@ void stk1160_buffer_done(struct stk1160 *dev)static inline void stk1160_copy_video (struct stk1160 *dev,u8 *src,int len) { -int linesdone, lineoff, lencopy; +int linesdone, lineoff, lencopy, offset;int bytesperline = dev->width *2 ;struct stk1160_buffer *buf = dev->isoc_ctl.buf;u8 *dst = buf->mem;
@@ -139,8 +139,13 @@ void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len)* Check if we have enough space left in the buffer. * In that case, we force loop exit after copy. */ -if (lencopy > buf->bytesused - buf->length) { - lencopy = buf->bytesused - buf->length; + offset = dst - (u8 *)buf->mem; +if (offset > buf->length) { +dev_warn_ratelimited (dev->dev,"out of bounds offset\n" ); +return ; + } +if (lencopy > buf->length - offset) { + lencopy = buf->length - offset; remain = lencopy; }
@@ -182,8 +187,13 @@ void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len)* Check if we have enough space left in the buffer. * In that case, we force loop exit after copy. */ -if (lencopy > buf->bytesused - buf->length) { - lencopy = buf->bytesused - buf->length; + offset = dst - (u8 *)buf->mem; +if (offset > buf->length) { +dev_warn_ratelimited (dev->dev,"offset out of bounds\n" ); +return ; + } +if (lencopy > buf->length - offset) { + lencopy = buf->length - offset; remain = lencopy; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 209/317 scsi: qla2xxx: Replace all non-returning strlcpy() with strscpy()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Azeem Shaikh <[email protected]>
[ Upstream commit 37f1663c91934f664fb850306708094a324c227c ]
strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). No return values were used, so direct replacement is safe.
[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy
[2] https://github.com/KSPP/linux/issues/89
Stable-dep-of: c3408c4ae041 ("scsi: qla2xxx: Avoid possible run-time warning with long model_num")
--- drivers/scsi/qla2xxx/qla_init.c | 8 ++++---- drivers/scsi/qla2xxx/qla_mr.c | 20 ++++++++++---------- 2 files changed, 14 insertions(+), 14 deletions(-)
drivers/scsi/qla2xxx/qla_init.c +4 -4
@@ -4644,7 +4644,7 @@ qla2x00_set_model_info(scsi_qla_host_t *vha, uint8_t *model, size_t len,if (use_tbl && ha->pdev->subsystem_vendor ==PCI_VENDOR_ID_QLOGIC && index <QLA_MODEL_NAMES ) -strlcpy (ha->model_desc, +strscpy (ha->model_desc, qla2x00_model_name[index *2 +1 ],sizeof (ha->model_desc)); }else {
@@ -4652,14 +4652,14 @@ qla2x00_set_model_info(scsi_qla_host_t *vha, uint8_t *model, size_t len,if (use_tbl && ha->pdev->subsystem_vendor ==PCI_VENDOR_ID_QLOGIC && index <QLA_MODEL_NAMES ) { -strlcpy (ha->model_number, +strscpy (ha->model_number, qla2x00_model_name[index *2 ],sizeof (ha->model_number)); -strlcpy (ha->model_desc, +strscpy (ha->model_desc, qla2x00_model_name[index *2 +1 ],sizeof (ha->model_desc)); }else { -strlcpy (ha->model_number, def, +strscpy (ha->model_number, def,sizeof (ha->model_number)); } }
drivers/scsi/qla2xxx/qla_mr.c +10 -10
@@ -691,7 +691,7 @@ qlafx00_pci_info_str(struct scsi_qla_host *vha, char *str, size_t str_len)struct qla_hw_data *ha = vha->hw;if (pci_is_pcie (ha->pdev)) -strlcpy (str,"PCIe iSA" , str_len); +strscpy (str,"PCIe iSA" , str_len);return str; }
@@ -1849,21 +1849,21 @@ qlafx00_fx_disc(scsi_qla_host_t *vha, fc_port_t *fcport, uint16_t fx_type) phost_info = &preg_hsi->hsi;memset (preg_hsi,0 ,sizeof (struct register_host_info )); phost_info->os_type =OS_TYPE_LINUX ; -strlcpy (phost_info->sysname, p_sysid->sysname, +strscpy (phost_info->sysname, p_sysid->sysname,sizeof (phost_info->sysname)); -strlcpy (phost_info->nodename, p_sysid->nodename, +strscpy (phost_info->nodename, p_sysid->nodename,sizeof (phost_info->nodename));if (!strcmp (phost_info->nodename,"(none)" )) ha->mr.host_info_resend = true; -strlcpy (phost_info->release, p_sysid->release, +strscpy (phost_info->release, p_sysid->release,sizeof (phost_info->release)); -strlcpy (phost_info->version, p_sysid->version, +strscpy (phost_info->version, p_sysid->version,sizeof (phost_info->version)); -strlcpy (phost_info->machine, p_sysid->machine, +strscpy (phost_info->machine, p_sysid->machine,sizeof (phost_info->machine)); -strlcpy (phost_info->domainname, p_sysid->domainname, +strscpy (phost_info->domainname, p_sysid->domainname,sizeof (phost_info->domainname)); -strlcpy (phost_info->hostdriver,QLA2XXX_VERSION , +strscpy (phost_info->hostdriver,QLA2XXX_VERSION ,sizeof (phost_info->hostdriver)); preg_hsi->utc = (uint64_t )ktime_get_real_seconds (); ql_dbg(ql_dbg_init, vha, 0x0149,
@@ -1909,9 +1909,9 @@ qlafx00_fx_disc(scsi_qla_host_t *vha, fc_port_t *fcport, uint16_t fx_type)if (fx_type ==FXDISC_GET_CONFIG_INFO ) {struct config_info_data *pinfo = (struct config_info_data *) fdisc->u.fxiocb.rsp_addr; -strlcpy (vha->hw->model_number, pinfo->model_num, +strscpy (vha->hw->model_number, pinfo->model_num,ARRAY_SIZE (vha->hw->model_number)); -strlcpy (vha->hw->model_desc, pinfo->model_description, +strscpy (vha->hw->model_desc, pinfo->model_description,ARRAY_SIZE (vha->hw->model_desc));memcpy (&vha->hw->mr.symbolic_name, pinfo->symbolic_name,sizeof (vha->hw->mr.symbolic_name));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 210/317 media: flexcop-usb: clean up endpoint sanity checks
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 3de50478b5cc2e0c2479a5f2b967f331f7597d23 ]
Add a temporary variable to make the endpoint sanity checks a bit more readable.
While at it, fix a typo in the usb_set_interface() comment.
Stable-dep-of: f62dc8f6bf82 ("media: flexcop-usb: fix sanity check of bNumEndpoints")
--- drivers/media/usb/b2c2/flexcop-usb.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/media/usb/b2c2/flexcop-usb.c +8 -4
@@ -502,17 +502,21 @@ static int flexcop_usb_transfer_init(struct flexcop_usb *fc_usb)static int flexcop_usb_init (struct flexcop_usb *fc_usb) { -/* use the alternate setting with the larges buffer */ -int ret =usb_set_interface (fc_usb->udev,0 ,1 ); +struct usb_host_interface *alt; +int ret; +/* use the alternate setting with the largest buffer */ + ret =usb_set_interface (fc_usb->udev,0 ,1 );if (ret) {err ("set interface failed." );return ret; } -if (fc_usb->uintf->cur_altsetting->desc.bNumEndpoints <1 ) + alt = fc_usb->uintf->cur_altsetting; + +if (alt->desc.bNumEndpoints <1 )return -ENODEV ; -if (!usb_endpoint_is_isoc_in (&fc_usb->uintf->cur_altsetting->endpoint[0 ].desc)) +if (!usb_endpoint_is_isoc_in (&alt->endpoint[0 ].desc))return -ENODEV ;switch (fc_usb->udev->speed) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 211/317 media: flexcop-usb: fix sanity check of bNumEndpoints
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dongliang Mu <[email protected]>
[ Upstream commit f62dc8f6bf82d1b307fc37d8d22cc79f67856c2f ]
Commit d725d20e81c2 ("media: flexcop-usb: sanity checking of endpoint type ") adds a sanity check for endpoint[1], but fails to modify the sanity check of bNumEndpoints.
Fix this by modifying the sanity check of bNumEndpoints to 2.
--- drivers/media/usb/b2c2/flexcop-usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/b2c2/flexcop-usb.c +1 -1
@@ -514,7 +514,7 @@ static int flexcop_usb_init(struct flexcop_usb *fc_usb) alt = fc_usb->uintf->cur_altsetting; -if (alt->desc.bNumEndpoints <1 ) +if (alt->desc.bNumEndpoints <2 )return -ENODEV ;if (!usb_endpoint_is_isoc_in (&alt->endpoint[0 ].desc))return -ENODEV ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 212/317 powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shrikanth Hegde <[email protected]>
[ Upstream commit 6d4341638516bf97b9a34947e0bd95035a8230a5 ]
Couple of Minor fixes:
- hcall return values are long. Fix that for h_get_mpp, h_get_ppp and parse_ppp_data
- If hcall fails, values set should be at-least zero. It shouldn't be uninitialized values. Fix that for h_get_mpp and h_get_ppp
--- arch/powerpc/include/asm/hvcall.h | 2 +- arch/powerpc/platforms/pseries/lpar.c | 6 +++--- arch/powerpc/platforms/pseries/lparcfg.c | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-)
arch/powerpc/include/asm/hvcall.h +1 -1
@@ -494,7 +494,7 @@ struct hvcall_mpp_data {unsigned long backing_mem; }; -int h_get_mpp (struct hvcall_mpp_data *); +long h_get_mpp (struct hvcall_mpp_data *mpp_data);struct hvcall_mpp_x_data {unsigned long coalesced_bytes;
arch/powerpc/platforms/pseries/lpar.c +3 -3
@@ -1883,10 +1883,10 @@ void __trace_hcall_exit(long opcode, long retval, unsigned long *retbuf)* h_get_mpp * H_GET_MPP hcall returns info in 7 parms */ -int h_get_mpp (struct hvcall_mpp_data *mpp_data) +long h_get_mpp (struct hvcall_mpp_data *mpp_data) { -int rc; -unsigned long retbuf[PLPAR_HCALL9_BUFSIZE ]; +unsigned long retbuf[PLPAR_HCALL9_BUFSIZE ] = {0 }; +long rc; rc =plpar_hcall9 (H_GET_MPP , retbuf);
arch/powerpc/platforms/pseries/lparcfg.c +3 -3
@@ -112,8 +112,8 @@ struct hvcall_ppp_data {*/ static unsigned int h_get_ppp (struct hvcall_ppp_data *ppp_data) { -unsigned long rc; -unsigned long retbuf[PLPAR_HCALL9_BUFSIZE ]; +unsigned long retbuf[PLPAR_HCALL9_BUFSIZE ] = {0 }; +long rc; rc =plpar_hcall9 (H_GET_PPP , retbuf);
@@ -192,7 +192,7 @@ static void parse_ppp_data(struct seq_file *m)struct hvcall_ppp_data ppp_data;struct device_node *root;const __be32 *perf_level; -int rc; +long rc; rc =h_get_ppp (&ppp_data);if (rc)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 213/317 um: Fix the -Wmissing-prototypes warning for __switch_mm
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiwei Bie <[email protected]>
[ Upstream commit 2cbade17b18c0f0fd9963f26c9fc9b057eb1cb3a ]
The __switch_mm function is defined in the user code, and is called by the kernel code. It should be declared in a shared header.
--- arch/um/include/asm/mmu.h | 2 -- arch/um/include/shared/skas/mm_id.h | 2 ++ 2 files changed, 2 insertions(+), 2 deletions(-)
arch/um/include/asm/mmu.h +0 -2
@@ -15,8 +15,6 @@ typedef struct mm_context {struct page *stub_pages[2 ]; } mm_context_t; -extern void __switch_mm (struct mm_id * mm_idp); -/* Avoid tangled inclusion with asm/ldt.h */ extern long init_new_ldt (struct mm_context *to_mm,struct mm_context *from_mm);extern void free_ldt (struct mm_context *mm);
arch/um/include/shared/skas/mm_id.h +2 -0
@@ -15,4 +15,6 @@ struct mm_id { int kill; }; +void __switch_mm (struct mm_id *mm_idp); +#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 214/317 media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit 9fe2816816a3c765dff3b88af5b5c3d9bbb911ce ]
Do not check for !data->completed, just always call cancel_delayed_work_sync(). This fixes a small race condition.
--- drivers/media/cec/core/cec-adap.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/media/cec/core/cec-adap.c +1 -2
@@ -913,8 +913,7 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,*/ mutex_unlock (&adap->lock);wait_for_completion_killable (&data->c); -if (!data->completed) -cancel_delayed_work_sync (&data->work); +cancel_delayed_work_sync (&data->work);mutex_lock (&adap->lock);/* Cancel the transmit if it was interrupted */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 215/317 media: cec: cec-api: add locking in cec_release()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit 42bcaacae924bf18ae387c3f78c202df0b739292 ]
When cec_release() uses fh->msgs it has to take fh->lock, otherwise the list can get corrupted.
--- drivers/media/cec/core/cec-api.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/media/cec/core/cec-api.c +3 -0
@@ -672,6 +672,8 @@ static int cec_release(struct inode *inode, struct file *filp)list_del (&data->xfer_list); }mutex_unlock (&adap->lock); + +mutex_lock (&fh->lock);while (!list_empty (&fh->msgs)) {struct cec_msg_entry *entry = list_first_entry(&fh->msgs, struct cec_msg_entry, list);
@@ -689,6 +691,7 @@ static int cec_release(struct inode *inode, struct file *filp)kfree (entry); } } +mutex_unlock (&fh->lock);kfree (fh);cec_put_device (devnode);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 216/317 media: core headers: fix kernel-doc warnings
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit f12b81e47f48940a6ec82ff308a7d97cd2307442 ]
This patch fixes the following kernel-doc warnings:
include/uapi/linux/videodev2.h:996: warning: Function parameter or member 'm' not described in 'v4l2_plane' include/uapi/linux/videodev2.h:996: warning: Function parameter or member 'reserved' not described in 'v4l2_plane' include/uapi/linux/videodev2.h:1057: warning: Function parameter or member 'm' not described in 'v4l2_buffer' include/uapi/linux/videodev2.h:1057: warning: Function parameter or member 'reserved2' not described in 'v4l2_buffer' include/uapi/linux/videodev2.h:1057: warning: Function parameter or member 'reserved' not described in 'v4l2_buffer' include/uapi/linux/videodev2.h:1068: warning: Function parameter or member 'tv' not described in 'v4l2_timeval_to_ns' include/uapi/linux/videodev2.h:1068: warning: Excess function parameter 'ts' description in 'v4l2_timeval_to_ns' include/uapi/linux/videodev2.h:1138: warning: Function parameter or member 'reserved' not described in 'v4l2_exportbuffer' include/uapi/linux/videodev2.h:2237: warning: Function parameter or member 'reserved' not described in 'v4l2_plane_pix_format' include/uapi/linux/videodev2.h:2270: warning: Function parameter or member 'hsv_enc' not described in 'v4l2_pix_format_mplane' include/uapi/linux/videodev2.h:2270: warning: Function parameter or member 'reserved' not described in 'v4l2_pix_format_mplane' include/uapi/linux/videodev2.h:2281: warning: Function parameter or member 'reserved' not described in 'v4l2_sdr_format' include/uapi/linux/videodev2.h:2315: warning: Function parameter or member 'fmt' not described in 'v4l2_format'
include/uapi/linux/v4l2-subdev.h:53: warning: Function parameter or member 'reserved' not described in 'v4l2_subdev_format' include/uapi/linux/v4l2-subdev.h:66: warning: Function parameter or member 'reserved' not described in 'v4l2_subdev_crop' include/uapi/linux/v4l2-subdev.h:89: warning: Function parameter or member 'reserved' not described in 'v4l2_subdev_mbus_code_enum' include/uapi/linux/v4l2-subdev.h:108: warning: Function parameter or member 'min_width' not described in 'v4l2_subdev_frame_size_enum' include/uapi/linux/v4l2-subdev.h:108: warning: Function parameter or member 'max_width' not described in 'v4l2_subdev_frame_size_enum' include/uapi/linux/v4l2-subdev.h:108: warning: Function parameter or member 'min_height' not described in 'v4l2_subdev_frame_size_enum' include/uapi/linux/v4l2-subdev.h:108: warning: Function parameter or member 'max_height' not described in 'v4l2_subdev_frame_size_enum' include/uapi/linux/v4l2-subdev.h:108: warning: Function parameter or member 'reserved' not described in 'v4l2_subdev_frame_size_enum' include/uapi/linux/v4l2-subdev.h:119: warning: Function parameter or member 'reserved' not described in 'v4l2_subdev_frame_interval' include/uapi/linux/v4l2-subdev.h:140: warning: Function parameter or member 'reserved' not described in 'v4l2_subdev_frame_interval_enum'
include/uapi/linux/cec.h:406: warning: Function parameter or member 'raw' not described in 'cec_connector_info' include/uapi/linux/cec.h:470: warning: Function parameter or member 'flags' not described in 'cec_event'
include/media/v4l2-h264.h:82: warning: Function parameter or member 'reflist' not described in 'v4l2_h264_build_p_ref_list' include/media/v4l2-h264.h:82: warning: expecting prototype for v4l2_h264_build_b_ref_lists(). Prototype was for v4l2_h264_build_p_ref_list() instead
include/media/cec.h:50: warning: Function parameter or member 'lock' not described in 'cec_devnode'
include/media/v4l2-jpeg.h:122: warning: Function parameter or member 'num_dht' not described in 'v4l2_jpeg_header' include/media/v4l2-jpeg.h:122: warning: Function parameter or member 'num_dqt' not described in 'v4l2_jpeg_header'
Stable-dep-of: 47c82aac10a6 ("media: cec: core: avoid recursive cec_claim_log_addrs")
--- include/media/cec.h | 2 +- include/media/v4l2-h264.h | 6 +++--- include/media/v4l2-jpeg.h | 2 ++ include/uapi/linux/cec.h | 3 ++- include/uapi/linux/v4l2-subdev.h | 12 +++++++++++- include/uapi/linux/videodev2.h | 15 ++++++++++++++- 6 files changed, 33 insertions(+), 7 deletions(-)
include/media/cec.h +1 -1
@@ -28,8 +28,8 @@* @minor: device node minor number * @registered: the device was correctly registered * @unregistered: the device was unregistered -* @fhs_lock: lock to control access to the filehandle list * @fhs: the list of open filehandles (cec_fh) +* @lock: lock to control access to this structure * * This structure represents a cec-related device node. *
include/media/v4l2-h264.h +3 -3
@@ -66,11 +66,11 @@ v4l2_h264_build_b_ref_lists(const struct v4l2_h264_reflist_builder *builder, u8 *b0_reflist, u8 *b1_reflist);/** -* v4l2_h264_build_b_ref_lists() - Build the P reference list +* v4l2_h264_build_p_ref_list() - Build the P reference list * * @builder: reference list builder context -* @p_reflist: 16-bytes array used to store the P reference list. Each entry -* is an index in the DPB +* @reflist: 16-bytes array used to store the P reference list. Each entry +* is an index in the DPB * * This functions builds the P reference lists. This procedure is describe in * section '8.2.4 Decoding process for reference picture lists construction'
include/media/v4l2-jpeg.h +2 -0
@@ -91,7 +91,9 @@ struct v4l2_jpeg_scan_header {* struct v4l2_jpeg_header - parsed JPEG header * @sof: pointer to frame header and size * @sos: pointer to scan header and size +* @num_dht: number of entries in @dht * @dht: pointers to huffman tables and sizes +* @num_dqt: number of entries in @dqt * @dqt: pointers to quantization tables and sizes * @frame: parsed frame header * @scan: pointer to parsed scan header, optional
include/uapi/linux/cec.h +2 -1
@@ -396,6 +396,7 @@ struct cec_drm_connector_info {* associated with the CEC adapter. * @type: connector type (if any) * @drm: drm connector info +* @raw: array to pad the union */ struct cec_connector_info {__u32 type;
@@ -453,7 +454,7 @@ struct cec_event_lost_msgs {* struct cec_event - CEC event structure * @ts: the timestamp of when the event was sent. * @event: the event. -* array. +* @flags: event flags. * @state_change: the event payload for CEC_EVENT_STATE_CHANGE. * @lost_msgs: the event payload for CEC_EVENT_LOST_MSGS. * @raw: array to pad the union.
include/uapi/linux/v4l2-subdev.h +11 -1
@@ -44,6 +44,7 @@ enum v4l2_subdev_format_whence {* @which: format type (from enum v4l2_subdev_format_whence) * @pad: pad number, as reported by the media API * @format: media bus format (format code and frame size) +* @reserved: drivers and applications must zero this array */ struct v4l2_subdev_format {__u32 which;
@@ -57,6 +58,7 @@ struct v4l2_subdev_format {* @which: format type (from enum v4l2_subdev_format_whence) * @pad: pad number, as reported by the media API * @rect: pad crop rectangle boundaries +* @reserved: drivers and applications must zero this array */ struct v4l2_subdev_crop {__u32 which;
@@ -78,6 +80,7 @@ struct v4l2_subdev_crop {* @code: format code (MEDIA_BUS_FMT_ definitions) * @which: format type (from enum v4l2_subdev_format_whence) * @flags: flags set by the driver, (V4L2_SUBDEV_MBUS_CODE_*) +* @reserved: drivers and applications must zero this array */ struct v4l2_subdev_mbus_code_enum {__u32 pad;
@@ -90,10 +93,15 @@ struct v4l2_subdev_mbus_code_enum {/** * struct v4l2_subdev_frame_size_enum - Media bus format enumeration -* @pad: pad number, as reported by the media API * @index: format index during enumeration +* @pad: pad number, as reported by the media API * @code: format code (MEDIA_BUS_FMT_ definitions) +* @min_width: minimum frame width, in pixels +* @max_width: maximum frame width, in pixels +* @min_height: minimum frame height, in pixels +* @max_height: maximum frame height, in pixels * @which: format type (from enum v4l2_subdev_format_whence) +* @reserved: drivers and applications must zero this array */ struct v4l2_subdev_frame_size_enum {__u32 index;
@@ -111,6 +119,7 @@ struct v4l2_subdev_frame_size_enum {* struct v4l2_subdev_frame_interval - Pad-level frame rate * @pad: pad number, as reported by the media API * @interval: frame interval in seconds +* @reserved: drivers and applications must zero this array */ struct v4l2_subdev_frame_interval {__u32 pad;
@@ -127,6 +136,7 @@ struct v4l2_subdev_frame_interval {* @height: frame height in pixels * @interval: frame interval in seconds * @which: format type (from enum v4l2_subdev_format_whence) +* @reserved: drivers and applications must zero this array */ struct v4l2_subdev_frame_interval_enum {__u32 index;
include/uapi/linux/videodev2.h +14 -1
@@ -976,8 +976,10 @@ struct v4l2_requestbuffers {* pointing to this plane * @fd: when memory is V4L2_MEMORY_DMABUF, a userspace file * descriptor associated with this plane +* @m: union of @mem_offset, @userptr and @fd * @data_offset: offset in the plane to the start of data; usually 0, * unless there is a header in front of the data +* @reserved: drivers and applications must zero this array * * Multi-planar buffers consist of one or more planes, e.g. an YCbCr buffer * with two planes can have one plane for Y, and another for interleaved CbCr
@@ -1019,10 +1021,14 @@ struct v4l2_plane {* a userspace file descriptor associated with this buffer * @planes: for multiplanar buffers; userspace pointer to the array of plane * info structs for this buffer +* @m: union of @offset, @userptr, @planes and @fd * @length: size in bytes of the buffer (NOT its payload) for single-plane * buffers (when type != *_MPLANE); number of elements in the * planes array for multi-plane buffers +* @reserved2: drivers and applications must zero this field * @request_fd: fd of the request that this buffer should use +* @reserved: for backwards compatibility with applications that do not know +* about @request_fd * * Contains data exchanged by application and driver using one of the Streaming * I/O methods.
@@ -1060,7 +1066,7 @@ struct v4l2_buffer {#ifndef __KERNEL__/** * v4l2_timeval_to_ns - Convert timeval to nanoseconds -* @ts: pointer to the timeval variable to be converted +* @tv: pointer to the timeval variable to be converted * * Returns the scalar nanosecond representation of the timeval * parameter.
@@ -1121,6 +1127,7 @@ static inline __u64 v4l2_timeval_to_ns(const struct timeval *tv)* @flags: flags for newly created file, currently only O_CLOEXEC is * supported, refer to manual of open syscall for more details * @fd: file descriptor associated with DMABUF (set by driver) +* @reserved: drivers and applications must zero this array * * Contains data used for exporting a video buffer as DMABUF file descriptor. * The buffer is identified by a 'cookie' returned by VIDIOC_QUERYBUF
@@ -2215,6 +2222,7 @@ struct v4l2_mpeg_vbi_fmt_ivtv {* this plane will be used * @bytesperline: distance in bytes between the leftmost pixels in two * adjacent lines +* @reserved: drivers and applications must zero this array */ struct v4l2_plane_pix_format {__u32 sizeimage;
@@ -2233,8 +2241,10 @@ struct v4l2_plane_pix_format {* @num_planes: number of planes for this format * @flags: format flags (V4L2_PIX_FMT_FLAG_*) * @ycbcr_enc: enum v4l2_ycbcr_encoding, Y'CbCr encoding +* @hsv_enc: enum v4l2_hsv_encoding, HSV encoding * @quantization: enum v4l2_quantization, colorspace quantization * @xfer_func: enum v4l2_xfer_func, colorspace transfer function +* @reserved: drivers and applications must zero this array */ struct v4l2_pix_format_mplane {__u32 width;
@@ -2259,6 +2269,7 @@ struct v4l2_pix_format_mplane {* struct v4l2_sdr_format - SDR format definition * @pixelformat: little endian four character code (fourcc) * @buffersize: maximum size in bytes required for data +* @reserved: drivers and applications must zero this array */ struct v4l2_sdr_format {__u32 pixelformat;
@@ -2285,6 +2296,8 @@ struct v4l2_meta_format {* @vbi: raw VBI capture or output parameters * @sliced: sliced VBI capture or output parameters * @raw_data: placeholder for future extensions and custom formats +* @fmt: union of @pix, @pix_mp, @win, @vbi, @sliced, @sdr, @meta +* and @raw_data */ struct v4l2_format {__u32 type;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 217/317 media: cec: fix a deadlock situation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit a9e6107616bb8108aa4fc22584a05e69761a91f7 ]
The cec_devnode struct has a lock meant to serialize access to the fields of this struct. This lock is taken during device node (un)registration and when opening or releasing a filehandle to the device node. When the last open filehandle is closed the cec adapter might be disabled by calling the adap_enable driver callback with the devnode.lock held.
However, if during that callback a message or event arrives then the driver will call one of the cec_queue_event() variants in cec-adap.c, and those will take the same devnode.lock to walk the open filehandle list.
This obviously causes a deadlock.
This is quite easy to reproduce with the cec-gpio driver since that uses the cec-pin framework which generated lots of events and uses a kernel thread for the processing, so when adap_enable is called the thread is still running and can generate events.
But I suspect that it might also happen with other drivers if an interrupt arrives signaling e.g. a received message before adap_enable had a chance to disable the interrupts.
This patch adds a new mutex to serialize access to the fhs list. When adap_enable() is called the devnode.lock mutex is held, but not devnode.lock_fhs. The event functions in cec-adap.c will now use devnode.lock_fhs instead of devnode.lock, ensuring that it is safe to call those functions from the adap_enable callback.
This specific issue only happens if the last open filehandle is closed and the physical address is invalid. This is not something that happens during normal operation, but it does happen when monitoring CEC traffic (e.g. cec-ctl --monitor) with an unconfigured CEC adapter.
Stable-dep-of: 47c82aac10a6 ("media: cec: core: avoid recursive cec_claim_log_addrs")
--- drivers/media/cec/core/cec-adap.c | 38 +++++++++++++++++-------------- drivers/media/cec/core/cec-api.c | 6 +++++ drivers/media/cec/core/cec-core.c | 3 +++ include/media/cec.h | 11 +++++++-- 4 files changed, 39 insertions(+), 19 deletions(-)
drivers/media/cec/core/cec-adap.c +21 -17
@@ -161,10 +161,10 @@ static void cec_queue_event(struct cec_adapter *adap,u64 ts =ktime_get_ns ();struct cec_fh *fh; -mutex_lock (&adap->devnode.lock); +mutex_lock (&adap->devnode.lock_fhs);list_for_each_entry (fh, &adap->devnode.fhs, list)cec_queue_event_fh (fh, ev, ts); -mutex_unlock (&adap->devnode.lock); +mutex_unlock (&adap->devnode.lock_fhs); }/* Notify userspace that the CEC pin changed state at the given time. */
@@ -178,11 +178,12 @@ void cec_queue_pin_cec_event(struct cec_adapter *adap, bool is_high, };struct cec_fh *fh; -mutex_lock (&adap->devnode.lock); -list_for_each_entry (fh, &adap->devnode.fhs, list) +mutex_lock (&adap->devnode.lock_fhs); +list_for_each_entry (fh, &adap->devnode.fhs, list) {if (fh->mode_follower ==CEC_MODE_MONITOR_PIN )cec_queue_event_fh (fh, &ev,ktime_to_ns (ts)); -mutex_unlock (&adap->devnode.lock); + } +mutex_unlock (&adap->devnode.lock_fhs); }EXPORT_SYMBOL_GPL (cec_queue_pin_cec_event);
@@ -195,10 +196,10 @@ void cec_queue_pin_hpd_event(struct cec_adapter *adap, bool is_high, ktime_t ts) };struct cec_fh *fh; -mutex_lock (&adap->devnode.lock); +mutex_lock (&adap->devnode.lock_fhs);list_for_each_entry (fh, &adap->devnode.fhs, list)cec_queue_event_fh (fh, &ev,ktime_to_ns (ts)); -mutex_unlock (&adap->devnode.lock); +mutex_unlock (&adap->devnode.lock_fhs); }EXPORT_SYMBOL_GPL (cec_queue_pin_hpd_event);
@@ -211,10 +212,10 @@ void cec_queue_pin_5v_event(struct cec_adapter *adap, bool is_high, ktime_t ts) };struct cec_fh *fh; -mutex_lock (&adap->devnode.lock); +mutex_lock (&adap->devnode.lock_fhs);list_for_each_entry (fh, &adap->devnode.fhs, list)cec_queue_event_fh (fh, &ev,ktime_to_ns (ts)); -mutex_unlock (&adap->devnode.lock); +mutex_unlock (&adap->devnode.lock_fhs); }EXPORT_SYMBOL_GPL (cec_queue_pin_5v_event);
@@ -286,12 +287,12 @@ static void cec_queue_msg_monitor(struct cec_adapter *adap,u32 monitor_mode = valid_la ?CEC_MODE_MONITOR :CEC_MODE_MONITOR_ALL ; -mutex_lock (&adap->devnode.lock); +mutex_lock (&adap->devnode.lock_fhs);list_for_each_entry (fh, &adap->devnode.fhs, list) {if (fh->mode_follower >= monitor_mode)cec_queue_msg_fh (fh, msg); } -mutex_unlock (&adap->devnode.lock); +mutex_unlock (&adap->devnode.lock_fhs); }/*
@@ -302,12 +303,12 @@ static void cec_queue_msg_followers(struct cec_adapter *adap, {struct cec_fh *fh; -mutex_lock (&adap->devnode.lock); +mutex_lock (&adap->devnode.lock_fhs);list_for_each_entry (fh, &adap->devnode.fhs, list) {if (fh->mode_follower ==CEC_MODE_FOLLOWER )cec_queue_msg_fh (fh, msg); } -mutex_unlock (&adap->devnode.lock); +mutex_unlock (&adap->devnode.lock_fhs); }/* Notify userspace of an adapter state change. */
@@ -1559,6 +1560,7 @@ void __cec_s_phys_addr(struct cec_adapter *adap, u16 phys_addr, bool block)/* Disabling monitor all mode should always succeed */ if (adap->monitor_all_cnt)WARN_ON (call_op (adap, adap_monitor_all_enable, false)); +/* serialize adap_enable */ mutex_lock (&adap->devnode.lock);if (adap->needs_hpd ||list_empty (&adap->devnode.fhs)) {WARN_ON (adap->ops->adap_enable (adap, false));
@@ -1570,14 +1572,16 @@ void __cec_s_phys_addr(struct cec_adapter *adap, u16 phys_addr, bool block)return ; } +/* serialize adap_enable */ mutex_lock (&adap->devnode.lock); adap->last_initiator =0xff ; adap->transmit_in_progress = false; -if ((adap->needs_hpd ||list_empty (&adap->devnode.fhs)) && - adap->ops->adap_enable (adap, true)) { -mutex_unlock (&adap->devnode.lock); -return ; +if (adap->needs_hpd ||list_empty (&adap->devnode.fhs)) { +if (adap->ops->adap_enable (adap, true)) { +mutex_unlock (&adap->devnode.lock); +return ; + } } if (adap->monitor_all_cnt &&
drivers/media/cec/core/cec-api.c +6 -0
@@ -586,6 +586,7 @@ static int cec_open(struct inode *inode, struct file *filp)return err; } +/* serialize adap_enable */ mutex_lock (&devnode->lock); if (list_empty(&devnode->fhs) && !adap->needs_hpd &&
@@ -624,7 +625,9 @@ static int cec_open(struct inode *inode, struct file *filp) }#endif +mutex_lock (&devnode->lock_fhs);list_add (&fh->list, &devnode->fhs); +mutex_unlock (&devnode->lock_fhs);mutex_unlock (&devnode->lock);return 0 ;
@@ -653,8 +656,11 @@ static int cec_release(struct inode *inode, struct file *filp)cec_monitor_all_cnt_dec (adap);mutex_unlock (&adap->lock); +/* serialize adap_enable */ mutex_lock (&devnode->lock); +mutex_lock (&devnode->lock_fhs);list_del (&fh->list); +mutex_unlock (&devnode->lock_fhs);if (cec_is_registered (adap) &&list_empty (&devnode->fhs) && !adap->needs_hpd && adap->phys_addr ==CEC_PHYS_ADDR_INVALID ) {WARN_ON (adap->ops->adap_enable (adap, false));
drivers/media/cec/core/cec-core.c +3 -0
@@ -167,8 +167,10 @@ static void cec_devnode_unregister(struct cec_adapter *adap)return ; } +mutex_lock (&devnode->lock_fhs);list_for_each_entry (fh, &devnode->fhs, list)wake_up_interruptible (&fh->wait); +mutex_unlock (&devnode->lock_fhs); devnode->registered = false; devnode->unregistered = true;
@@ -272,6 +274,7 @@ struct cec_adapter *cec_allocate_adapter(const struct cec_adap_ops *ops,/* adap->devnode initialization */ INIT_LIST_HEAD (&adap->devnode.fhs); +mutex_init (&adap->devnode.lock_fhs);mutex_init (&adap->devnode.lock); adap->kthread =kthread_run (cec_thread_func, adap,"cec-%s" , name);
include/media/cec.h +9 -2
@@ -26,13 +26,17 @@* @dev: cec device * @cdev: cec character device * @minor: device node minor number +* @lock: lock to serialize open/release and registration * @registered: the device was correctly registered * @unregistered: the device was unregistered +* @lock_fhs: lock to control access to @fhs * @fhs: the list of open filehandles (cec_fh) -* @lock: lock to control access to this structure * * This structure represents a cec-related device node. * +* To add or remove filehandles from @fhs the @lock must be taken first, +* followed by @lock_fhs. It is safe to access @fhs if either lock is held. +* * The @parent is a physical device. It must be set by core or device drivers * before registering the node. */
@@ -43,10 +47,13 @@ struct cec_devnode {/* device info */ int minor; +/* serialize open/release and registration */ +struct mutex lock;bool registered;bool unregistered; +/* protect access to fhs */ +struct mutex lock_fhs;struct list_head fhs; -struct mutex lock; };struct cec_adapter ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 218/317 media: cec: call enable_adap on s_log_addrs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit 3813c932ed970dd4f413498ccecb03c73c4f1784 ]
Don't enable/disable the adapter if the first fh is opened or the last fh is closed, instead do this when the adapter is configured or unconfigured, and also when we enter Monitor All or Monitor Pin mode for the first time or we exit the Monitor All/Pin mode for the last time.
However, if needs_hpd is true, then do this when the physical address is set or cleared: in that case the adapter typically is powered by the HPD, so it really is disabled when the HPD is low. This case (needs_hpd is true) was already handled in this way, so this wasn't changed.
The problem with the old behavior was that if the HPD goes low when no fh is open, and a transmit was in progress, then the adapter would be disabled, typically stopping the transmit immediately which leaves a partial message on the bus, which isn't nice and can confuse some adapters.
It makes much more sense to disable it only when the adapter is unconfigured and we're not monitoring the bus, since then you really won't be using it anymore.
To keep track of this store a CEC activation count and call adap_enable only when it goes from 0 to 1 or back to 0.
Stable-dep-of: 47c82aac10a6 ("media: cec: core: avoid recursive cec_claim_log_addrs")
--- drivers/media/cec/core/cec-adap.c | 174 ++++++++++++++++++++++-------- drivers/media/cec/core/cec-api.c | 18 +--- include/media/cec.h | 2 + 3 files changed, 130 insertions(+), 64 deletions(-)
drivers/media/cec/core/cec-adap.c +127 -47
@@ -1532,6 +1532,7 @@ static void cec_claim_log_addrs(struct cec_adapter *adap, bool block) "ceccfg-%s", adap->name);if (IS_ERR (adap->kthread_config)) { adap->kthread_config =NULL ; + adap->is_configuring = false; }else if (block) {mutex_unlock (&adap->lock);wait_for_completion (&adap->config_completion);
@@ -1539,59 +1540,90 @@ static void cec_claim_log_addrs(struct cec_adapter *adap, bool block) } } +/* +* Helper functions to enable/disable the CEC adapter. +* +* These functions are called with adap->lock held. +*/ +static int cec_activate_cnt_inc (struct cec_adapter *adap) +{ +int ret; + +if (adap->activate_cnt++) +return 0 ; + +/* serialize adap_enable */ +mutex_lock (&adap->devnode.lock); + adap->last_initiator =0xff ; + adap->transmit_in_progress = false; + ret = adap->ops->adap_enable (adap, true); +if (ret) + adap->activate_cnt--; +mutex_unlock (&adap->devnode.lock); +return ret; +} + +static void cec_activate_cnt_dec (struct cec_adapter *adap) +{ +if (WARN_ON (!adap->activate_cnt)) +return ; + +if (--adap->activate_cnt) +return ; + +/* serialize adap_enable */ +mutex_lock (&adap->devnode.lock); +WARN_ON (adap->ops->adap_enable (adap, false)); + adap->last_initiator =0xff ; + adap->transmit_in_progress = false; +mutex_unlock (&adap->devnode.lock); +} +/* Set a new physical address and send an event notifying userspace of this. * * This function is called with adap->lock held. */ void __cec_s_phys_addr (struct cec_adapter *adap,u16 phys_addr,bool block) { +bool becomes_invalid = phys_addr ==CEC_PHYS_ADDR_INVALID ; +bool is_invalid = adap->phys_addr ==CEC_PHYS_ADDR_INVALID ; +if (phys_addr == adap->phys_addr)return ; -if (phys_addr !=CEC_PHYS_ADDR_INVALID && adap->devnode.unregistered) +if (!becomes_invalid && adap->devnode.unregistered)return ;dprintk (1 ,"new physical address %x.%x.%x.%x\n" ,cec_phys_addr_exp (phys_addr)); -if (phys_addr ==CEC_PHYS_ADDR_INVALID || - adap->phys_addr !=CEC_PHYS_ADDR_INVALID ) { +if (becomes_invalid || !is_invalid) { adap->phys_addr =CEC_PHYS_ADDR_INVALID ;cec_post_state_event (adap);cec_adap_unconfigure (adap); -/* Disabling monitor all mode should always succeed */ -if (adap->monitor_all_cnt) -WARN_ON (call_op (adap, adap_monitor_all_enable, false)); -/* serialize adap_enable */ -mutex_lock (&adap->devnode.lock); -if (adap->needs_hpd ||list_empty (&adap->devnode.fhs)) { -WARN_ON (adap->ops->adap_enable (adap, false)); - adap->transmit_in_progress = false; +if (becomes_invalid && adap->needs_hpd) { +/* Disable monitor-all/pin modes if needed */ +if (adap->monitor_all_cnt) +WARN_ON (call_op (adap, adap_monitor_all_enable, false)); +if (adap->monitor_pin_cnt) +WARN_ON (call_op (adap, adap_monitor_pin_enable, false)); +cec_activate_cnt_dec (adap);wake_up_interruptible (&adap->kthread_waitq); } -mutex_unlock (&adap->devnode.lock); -if (phys_addr ==CEC_PHYS_ADDR_INVALID ) +if (becomes_invalid)return ; } -/* serialize adap_enable */ -mutex_lock (&adap->devnode.lock); - adap->last_initiator =0xff ; - adap->transmit_in_progress = false; - -if (adap->needs_hpd ||list_empty (&adap->devnode.fhs)) { -if (adap->ops->adap_enable (adap, true)) { -mutex_unlock (&adap->devnode.lock); +if (is_invalid && adap->needs_hpd) { +if (cec_activate_cnt_inc (adap))return ; - } - } - -if (adap->monitor_all_cnt && -call_op (adap, adap_monitor_all_enable, true)) { -if (adap->needs_hpd ||list_empty (&adap->devnode.fhs)) -WARN_ON (adap->ops->adap_enable (adap, false)); -mutex_unlock (&adap->devnode.lock); -return ; +/* +* Re-enable monitor-all/pin modes if needed. We warn, but +* continue if this fails as this is not a critical error. +*/ +if (adap->monitor_all_cnt) +WARN_ON (call_op (adap, adap_monitor_all_enable, true)); +if (adap->monitor_pin_cnt) +WARN_ON (call_op (adap, adap_monitor_pin_enable, true)); } -mutex_unlock (&adap->devnode.lock); adap->phys_addr = phys_addr;cec_post_state_event (adap);
@@ -1656,6 +1688,8 @@ int __cec_s_log_addrs(struct cec_adapter *adap,return -ENODEV ;if (!log_addrs || log_addrs->num_log_addrs ==0 ) { +if (!adap->is_configuring && !adap->is_configured) +return 0 ;cec_adap_unconfigure (adap); adap->log_addrs.num_log_addrs =0 ;for (i =0 ; i <CEC_MAX_LOG_ADDRS ; i++)
@@ -1663,6 +1697,8 @@ int __cec_s_log_addrs(struct cec_adapter *adap, adap->log_addrs.osd_name[0 ] ='\0' ; adap->log_addrs.vendor_id =CEC_VENDOR_ID_NONE ; adap->log_addrs.cec_version =CEC_OP_CEC_VERSION_2_0 ; +if (!adap->needs_hpd) +cec_activate_cnt_dec (adap);return 0 ; }
@@ -1796,6 +1832,12 @@ int __cec_s_log_addrs(struct cec_adapter *adap, sizeof(log_addrs->features[i])); } +if (!adap->needs_hpd && !adap->is_configuring && !adap->is_configured) { +int ret =cec_activate_cnt_inc (adap); + +if (ret) +return ret; + } log_addrs->log_addr_mask = adap->log_addrs.log_addr_mask; adap->log_addrs = *log_addrs;if (adap->phys_addr !=CEC_PHYS_ADDR_INVALID )
@@ -2099,20 +2141,37 @@ static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg,*/ int cec_monitor_all_cnt_inc (struct cec_adapter *adap) { -int ret =0 ; +int ret; -if (adap->monitor_all_cnt ==0 ) - ret =call_op (adap, adap_monitor_all_enable,1 ); -if (ret ==0 ) - adap->monitor_all_cnt++; +if (adap->monitor_all_cnt++) +return 0 ; + +if (!adap->needs_hpd) { + ret =cec_activate_cnt_inc (adap); +if (ret) { + adap->monitor_all_cnt--; +return ret; + } + } + + ret =call_op (adap, adap_monitor_all_enable, true); +if (ret) { + adap->monitor_all_cnt--; +if (!adap->needs_hpd) +cec_activate_cnt_dec (adap); + }return ret; }void cec_monitor_all_cnt_dec (struct cec_adapter *adap) { - adap->monitor_all_cnt--; -if (adap->monitor_all_cnt ==0 ) -WARN_ON (call_op (adap, adap_monitor_all_enable,0 )); +if (WARN_ON (!adap->monitor_all_cnt)) +return ; +if (--adap->monitor_all_cnt) +return ; +WARN_ON (call_op (adap, adap_monitor_all_enable, false)); +if (!adap->needs_hpd) +cec_activate_cnt_dec (adap); }/*
@@ -2122,20 +2181,37 @@ void cec_monitor_all_cnt_dec(struct cec_adapter *adap)*/ int cec_monitor_pin_cnt_inc (struct cec_adapter *adap) { -int ret =0 ; +int ret; -if (adap->monitor_pin_cnt ==0 ) - ret =call_op (adap, adap_monitor_pin_enable,1 ); -if (ret ==0 ) - adap->monitor_pin_cnt++; +if (adap->monitor_pin_cnt++) +return 0 ; + +if (!adap->needs_hpd) { + ret =cec_activate_cnt_inc (adap); +if (ret) { + adap->monitor_pin_cnt--; +return ret; + } + } + + ret =call_op (adap, adap_monitor_pin_enable, true); +if (ret) { + adap->monitor_pin_cnt--; +if (!adap->needs_hpd) +cec_activate_cnt_dec (adap); + }return ret; }void cec_monitor_pin_cnt_dec (struct cec_adapter *adap) { - adap->monitor_pin_cnt--; -if (adap->monitor_pin_cnt ==0 ) -WARN_ON (call_op (adap, adap_monitor_pin_enable,0 )); +if (WARN_ON (!adap->monitor_pin_cnt)) +return ; +if (--adap->monitor_pin_cnt) +return ; +WARN_ON (call_op (adap, adap_monitor_pin_enable, false)); +if (!adap->needs_hpd) +cec_activate_cnt_dec (adap); }#ifdef CONFIG_DEBUG_FS
@@ -2149,6 +2225,7 @@ int cec_adap_status(struct seq_file *file, void *priv)struct cec_data *data;mutex_lock (&adap->lock); +seq_printf (file,"activation count: %u\n" , adap->activate_cnt);seq_printf (file,"configured: %d\n" , adap->is_configured);seq_printf (file,"configuring: %d\n" , adap->is_configuring); seq_printf(file, "phys_addr: %x.%x.%x.%x\n",
@@ -2163,6 +2240,9 @@ int cec_adap_status(struct seq_file *file, void *priv)if (adap->monitor_all_cnt)seq_printf (file,"file handles in Monitor All mode: %u\n" , adap->monitor_all_cnt); +if (adap->monitor_pin_cnt) +seq_printf (file,"file handles in Monitor Pin mode: %u\n" , + adap->monitor_pin_cnt);if (adap->tx_timeouts) {seq_printf (file,"transmit timeouts: %u\n" , adap->tx_timeouts);
drivers/media/cec/core/cec-api.c +1 -17
@@ -586,18 +586,6 @@ static int cec_open(struct inode *inode, struct file *filp)return err; } -/* serialize adap_enable */ -mutex_lock (&devnode->lock); -if (list_empty (&devnode->fhs) && - !adap->needs_hpd && - adap->phys_addr ==CEC_PHYS_ADDR_INVALID ) { - err = adap->ops->adap_enable (adap, true); -if (err) { -mutex_unlock (&devnode->lock); -kfree (fh); -return err; - } - } filp->private_data = fh;/* Queue up initial state events */
@@ -625,6 +613,7 @@ static int cec_open(struct inode *inode, struct file *filp) }#endif +mutex_lock (&devnode->lock);mutex_lock (&devnode->lock_fhs);list_add (&fh->list, &devnode->fhs);mutex_unlock (&devnode->lock_fhs);
@@ -656,15 +645,10 @@ static int cec_release(struct inode *inode, struct file *filp)cec_monitor_all_cnt_dec (adap);mutex_unlock (&adap->lock); -/* serialize adap_enable */ mutex_lock (&devnode->lock);mutex_lock (&devnode->lock_fhs);list_del (&fh->list);mutex_unlock (&devnode->lock_fhs); -if (cec_is_registered (adap) &&list_empty (&devnode->fhs) && - !adap->needs_hpd && adap->phys_addr ==CEC_PHYS_ADDR_INVALID ) { -WARN_ON (adap->ops->adap_enable (adap, false)); - }mutex_unlock (&devnode->lock);/* Unhook pending transmits from this filehandle. */
include/media/cec.h +2 -0
@@ -185,6 +185,7 @@ struct cec_adap_ops {* Drivers that need this can set this field to true after the * cec_allocate_adapter() call. * @last_initiator: the initiator of the last transmitted message. +* @activate_cnt: number of times that CEC is activated * @monitor_all_cnt: number of filehandles monitoring all msgs * @monitor_pin_cnt: number of filehandles monitoring pin changes * @follower_cnt: number of filehandles in follower mode
@@ -236,6 +237,7 @@ struct cec_adapter {bool cec_pin_is_high;bool adap_controls_phys_addr;u8 last_initiator; +u32 activate_cnt;u32 monitor_all_cnt;u32 monitor_pin_cnt;u32 follower_cnt;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 219/317 media: cec: abort if the current transmit was canceled
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit 590a8e564c6eff7e77a84e728612f1269e3c0685 ]
If a transmit-in-progress was canceled, then, once the transmit is done, mark it as aborted and refrain from retrying the transmit.
To signal this situation the new transmit_in_progress_aborted field is set to true.
The old implementation would just set adap->transmitting to NULL and set adap->transmit_in_progress to false, but on the hardware level the transmit was still ongoing. However, the framework would think the transmit was aborted, and if a new transmit was issued, then it could overwrite the HW buffer containing the old transmit with the new transmit, leading to garbled data on the CEC bus.
Stable-dep-of: 47c82aac10a6 ("media: cec: core: avoid recursive cec_claim_log_addrs")
--- drivers/media/cec/core/cec-adap.c | 14 +++++++++++--- include/media/cec.h | 6 ++++++ 2 files changed, 17 insertions(+), 3 deletions(-)
drivers/media/cec/core/cec-adap.c +11 -3
@@ -421,7 +421,7 @@ static void cec_flush(struct cec_adapter *adap)cec_data_cancel (data,CEC_TX_STATUS_ABORTED ); }if (adap->transmitting) -cec_data_cancel (adap->transmitting,CEC_TX_STATUS_ABORTED ); + adap->transmit_in_progress_aborted = true;/* Cancel the pending timeout work. */ list_for_each_entry_safe (data, n, &adap->wait_queue, list) {
@@ -572,6 +572,7 @@ int cec_thread_func(void *_adap)if (data->attempts ==0 ) data->attempts = attempts; + adap->transmit_in_progress_aborted = false;/* Tell the adapter to transmit, cancel on error */ if (adap->ops->adap_transmit (adap, data->attempts, signal_free_time, &data->msg))
@@ -599,6 +600,8 @@ void cec_transmit_done_ts(struct cec_adapter *adap, u8 status,struct cec_msg *msg;unsigned int attempts_made = arb_lost_cnt + nack_cnt + low_drive_cnt + error_cnt; +bool done = status & (CEC_TX_STATUS_MAX_RETRIES |CEC_TX_STATUS_OK ); +bool aborted = adap->transmit_in_progress_aborted;dprintk (2 ,"%s: status 0x%02x\n" , __func__, status);if (attempts_made <1 )
@@ -619,6 +622,7 @@ void cec_transmit_done_ts(struct cec_adapter *adap, u8 status, goto wake_thread; } adap->transmit_in_progress = false; + adap->transmit_in_progress_aborted = false; msg = &data->msg;
@@ -639,8 +643,7 @@ void cec_transmit_done_ts(struct cec_adapter *adap, u8 status,* the hardware didn't signal that it retried itself (by setting * CEC_TX_STATUS_MAX_RETRIES), then we will retry ourselves. */ -if (data->attempts > attempts_made && - !(status & (CEC_TX_STATUS_MAX_RETRIES |CEC_TX_STATUS_OK ))) { +if (!aborted && data->attempts > attempts_made && !done) {/* Retry this message */ data->attempts -= attempts_made;if (msg->timeout)
@@ -655,6 +658,8 @@ void cec_transmit_done_ts(struct cec_adapter *adap, u8 status, goto wake_thread; } +if (aborted && !done) + status |=CEC_TX_STATUS_ABORTED ; data->attempts =0 ;/* Always set CEC_TX_STATUS_MAX_RETRIES on error */
@@ -1576,6 +1581,9 @@ static void cec_activate_cnt_dec(struct cec_adapter *adap)WARN_ON (adap->ops->adap_enable (adap, false)); adap->last_initiator =0xff ; adap->transmit_in_progress = false; + adap->transmit_in_progress_aborted = false; +if (adap->transmitting) +cec_data_cancel (adap->transmitting,CEC_TX_STATUS_ABORTED );mutex_unlock (&adap->devnode.lock); }
include/media/cec.h +6 -0
@@ -163,6 +163,11 @@ struct cec_adap_ops {* @wait_queue: queue of transmits waiting for a reply * @transmitting: CEC messages currently being transmitted * @transmit_in_progress: true if a transmit is in progress +* @transmit_in_progress_aborted: true if a transmit is in progress is to be +* aborted. This happens if the logical address is +* invalidated while the transmit is ongoing. In that +* case the transmit will finish, but will not retransmit +* and be marked as ABORTED. * @kthread_config: kthread used to configure a CEC adapter * @config_completion: used to signal completion of the config kthread * @kthread: main CEC processing thread
@@ -218,6 +223,7 @@ struct cec_adapter {struct list_head wait_queue;struct cec_data *transmitting;bool transmit_in_progress; +bool transmit_in_progress_aborted;struct task_struct *kthread_config;struct completion config_completion;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 220/317 media: cec: correctly pass on reply results
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit f9d0ecbf56f4b90745a6adc5b59281ad8f70ab54 ]
The results of non-blocking transmits were not correctly communicated to userspace.
Specifically:
1) if a non-blocking transmit was canceled, then rx_status wasn't set to 0 as it should.
2) if the non-blocking transmit succeeded, but the corresponding reply never arrived (aborted or timed out), then tx_status wasn't set to 0 as it should, and rx_status was hardcoded to ABORTED instead of the actual reason, such as TIMEOUT. In addition, adap->ops->received() was never called, so drivers that want to do message processing themselves would not be informed of the failed reply.
Stable-dep-of: 47c82aac10a6 ("media: cec: core: avoid recursive cec_claim_log_addrs")
--- drivers/media/cec/core/cec-adap.c | 48 +++++++++++++++++++------------ 1 file changed, 30 insertions(+), 18 deletions(-)
drivers/media/cec/core/cec-adap.c +30 -18
@@ -366,38 +366,48 @@ static void cec_data_completed(struct cec_data *data)/* * A pending CEC transmit needs to be cancelled, either because the CEC * adapter is disabled or the transmit takes an impossibly long time to -* finish. +* finish, or the reply timed out. * * This function is called with adap->lock held. */ -static void cec_data_cancel (struct cec_data *data,u8 tx_status) +static void cec_data_cancel (struct cec_data *data,u8 tx_status,u8 rx_status) { +struct cec_adapter *adap = data->adap; +/* * It's either the current transmit, or it is a pending * transmit. Take the appropriate action to clear it. */ -if (data->adap->transmitting == data) { - data->adap->transmitting =NULL ; +if (adap->transmitting == data) { + adap->transmitting =NULL ; }else {list_del_init (&data->list);if (!(data->msg.tx_status &CEC_TX_STATUS_OK )) -if (!WARN_ON (!data->adap->transmit_queue_sz)) - data->adap->transmit_queue_sz--; +if (!WARN_ON (!adap->transmit_queue_sz)) + adap->transmit_queue_sz--; }if (data->msg.tx_status &CEC_TX_STATUS_OK ) { data->msg.rx_ts =ktime_get_ns (); - data->msg.rx_status =CEC_RX_STATUS_ABORTED ; + data->msg.rx_status = rx_status; +if (!data->blocking) + data->msg.tx_status =0 ; }else { data->msg.tx_ts =ktime_get_ns (); data->msg.tx_status |= tx_status |CEC_TX_STATUS_MAX_RETRIES ; data->msg.tx_error_cnt++; data->attempts =0 ; +if (!data->blocking) + data->msg.rx_status =0 ; }/* Queue transmitted message for monitoring purposes */ -cec_queue_msg_monitor (data->adap, &data->msg,1 ); +cec_queue_msg_monitor (adap, &data->msg,1 ); + +if (!data->blocking && data->msg.sequence && adap->ops->received) +/* Allow drivers to process the message first */ + adap->ops->received (adap, &data->msg);cec_data_completed (data); }
@@ -418,7 +428,7 @@ static void cec_flush(struct cec_adapter *adap)while (!list_empty (&adap->transmit_queue)) { data =list_first_entry (&adap->transmit_queue, struct cec_data, list); -cec_data_cancel (data,CEC_TX_STATUS_ABORTED ); +cec_data_cancel (data,CEC_TX_STATUS_ABORTED ,0 ); }if (adap->transmitting) adap->transmit_in_progress_aborted = true;
@@ -426,7 +436,7 @@ static void cec_flush(struct cec_adapter *adap)/* Cancel the pending timeout work. */ list_for_each_entry_safe (data, n, &adap->wait_queue, list) {if (cancel_delayed_work (&data->work)) -cec_data_cancel (data,CEC_TX_STATUS_OK ); +cec_data_cancel (data,CEC_TX_STATUS_OK ,CEC_RX_STATUS_ABORTED );/* * If cancel_delayed_work returned false, then * the cec_wait_timeout function is running,
@@ -516,7 +526,7 @@ int cec_thread_func(void *_adap) adap->transmitting->msg.msg);/* Just give up on this. */ cec_data_cancel (adap->transmitting, -CEC_TX_STATUS_TIMEOUT ); +CEC_TX_STATUS_TIMEOUT ,0 ); }else {pr_warn ("cec-%s: transmit timed out\n" , adap->name); }
@@ -576,7 +586,7 @@ int cec_thread_func(void *_adap)/* Tell the adapter to transmit, cancel on error */ if (adap->ops->adap_transmit (adap, data->attempts, signal_free_time, &data->msg)) -cec_data_cancel (data,CEC_TX_STATUS_ABORTED ); +cec_data_cancel (data,CEC_TX_STATUS_ABORTED ,0 );else adap->transmit_in_progress = true;
@@ -738,9 +748,7 @@ static void cec_wait_timeout(struct work_struct *work)/* Mark the message as timed out */ list_del_init (&data->list); - data->msg.rx_ts =ktime_get_ns (); - data->msg.rx_status =CEC_RX_STATUS_TIMEOUT ; -cec_data_completed (data); +cec_data_cancel (data,CEC_TX_STATUS_OK ,CEC_RX_STATUS_TIMEOUT ); unlock:mutex_unlock (&adap->lock); }
@@ -923,8 +931,12 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,mutex_lock (&adap->lock);/* Cancel the transmit if it was interrupted */ -if (!data->completed) -cec_data_cancel (data,CEC_TX_STATUS_ABORTED ); +if (!data->completed) { +if (data->msg.tx_status &CEC_TX_STATUS_OK ) +cec_data_cancel (data,CEC_TX_STATUS_OK ,CEC_RX_STATUS_ABORTED ); +else +cec_data_cancel (data,CEC_TX_STATUS_ABORTED ,0 ); + }/* The transmit completed (possibly with an error) */ *msg = data->msg;
@@ -1583,7 +1595,7 @@ static void cec_activate_cnt_dec(struct cec_adapter *adap) adap->transmit_in_progress = false; adap->transmit_in_progress_aborted = false;if (adap->transmitting) -cec_data_cancel (adap->transmitting,CEC_TX_STATUS_ABORTED ); +cec_data_cancel (adap->transmitting,CEC_TX_STATUS_ABORTED ,0 );mutex_unlock (&adap->devnode.lock); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 221/317 media: cec: use call_op and check for !unregistered
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit e2ed5024ac2bc27d4bfc99fd58f5ab54de8fa965 ]
Use call_(void_)op consistently in the CEC core framework. Ditto for the cec pin ops. And check if !adap->devnode.unregistered before calling each op. This avoids calls to ops when the device has been unregistered and the underlying hardware may be gone.
Stable-dep-of: 47c82aac10a6 ("media: cec: core: avoid recursive cec_claim_log_addrs")
--- drivers/media/cec/core/cec-adap.c | 37 ++++++++++----------------- drivers/media/cec/core/cec-api.c | 6 +++-- drivers/media/cec/core/cec-core.c | 4 +-- drivers/media/cec/core/cec-pin-priv.h | 11 ++++++++ drivers/media/cec/core/cec-pin.c | 23 ++++++++--------- drivers/media/cec/core/cec-priv.h | 10 ++++++++ 6 files changed, 51 insertions(+), 40 deletions(-)
drivers/media/cec/core/cec-adap.c +13 -24
@@ -39,15 +39,6 @@ static void cec_fill_msg_report_features(struct cec_adapter *adap,*/ #define CEC_XFER_TIMEOUT_MS (5 * 400 + 100) -#define call_op(adap, op, arg...) \ - (adap->ops->op ? adap->ops->op(adap, ## arg) : 0) - -#define call_void_op(adap, op, arg...) \ - do { \ - if (adap->ops->op) \ - adap->ops->op(adap, ## arg); \ - } while (0) -static int cec_log_addr2idx (const struct cec_adapter *adap,u8 log_addr) {int i;
@@ -405,9 +396,9 @@ static void cec_data_cancel(struct cec_data *data, u8 tx_status, u8 rx_status)/* Queue transmitted message for monitoring purposes */ cec_queue_msg_monitor (adap, &data->msg,1 ); -if (!data->blocking && data->msg.sequence && adap->ops->received) +if (!data->blocking && data->msg.sequence)/* Allow drivers to process the message first */ - adap->ops->received (adap, &data->msg); +call_op (adap, received, &data->msg);cec_data_completed (data); }
@@ -584,8 +575,8 @@ int cec_thread_func(void *_adap) adap->transmit_in_progress_aborted = false;/* Tell the adapter to transmit, cancel on error */ -if (adap->ops->adap_transmit (adap, data->attempts, - signal_free_time, &data->msg)) +if (call_op (adap, adap_transmit, data->attempts, + signal_free_time, &data->msg))cec_data_cancel (data,CEC_TX_STATUS_ABORTED ,0 );else adap->transmit_in_progress = true;
@@ -1311,7 +1302,7 @@ static int cec_config_log_addr(struct cec_adapter *adap,* Message not acknowledged, so this logical * address is free to use. */ - err = adap->ops->adap_log_addr (adap, log_addr); + err =call_op (adap, adap_log_addr, log_addr);if (err)return err;
@@ -1328,9 +1319,8 @@ static int cec_config_log_addr(struct cec_adapter *adap,*/ static void cec_adap_unconfigure (struct cec_adapter *adap) { -if (!adap->needs_hpd || - adap->phys_addr !=CEC_PHYS_ADDR_INVALID ) -WARN_ON (adap->ops->adap_log_addr (adap,CEC_LOG_ADDR_INVALID )); +if (!adap->needs_hpd || adap->phys_addr !=CEC_PHYS_ADDR_INVALID ) +WARN_ON (call_op (adap, adap_log_addr,CEC_LOG_ADDR_INVALID )); adap->log_addrs.log_addr_mask =0 ; adap->is_configured = false;cec_flush (adap);
@@ -1573,7 +1563,7 @@ static int cec_activate_cnt_inc(struct cec_adapter *adap)mutex_lock (&adap->devnode.lock); adap->last_initiator =0xff ; adap->transmit_in_progress = false; - ret = adap->ops->adap_enable (adap, true); + ret =call_op (adap, adap_enable, true);if (ret) adap->activate_cnt--;mutex_unlock (&adap->devnode.lock);
@@ -1590,7 +1580,7 @@ static void cec_activate_cnt_dec(struct cec_adapter *adap)/* serialize adap_enable */ mutex_lock (&adap->devnode.lock); -WARN_ON (adap->ops->adap_enable (adap, false)); +WARN_ON (call_op (adap, adap_enable, false)); adap->last_initiator =0xff ; adap->transmit_in_progress = false; adap->transmit_in_progress_aborted = false;
@@ -1964,11 +1954,10 @@ static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg, msg->msg[1] != CEC_MSG_CDC_MESSAGE)return 0 ; -if (adap->ops->received) { -/* Allow drivers to process the message first */ -if (adap->ops->received (adap, msg) != -ENOMSG ) -return 0 ; - } +/* Allow drivers to process the message first */ +if (adap->ops->received && !adap->devnode.unregistered && + adap->ops->received (adap, msg) != -ENOMSG ) +return 0 ;/* * REPORT_PHYSICAL_ADDR, CEC_MSG_USER_CONTROL_PRESSED and
drivers/media/cec/core/cec-api.c +4 -2
@@ -595,7 +595,8 @@ static int cec_open(struct inode *inode, struct file *filp) adap->conn_info.type !=CEC_CONNECTOR_TYPE_NO_CONNECTOR ;cec_queue_event_fh (fh, &ev,0 );#ifdef CONFIG_CEC_PIN -if (adap->pin && adap->pin->ops->read_hpd) { +if (adap->pin && adap->pin->ops->read_hpd && + !adap->devnode.unregistered) { err = adap->pin->ops->read_hpd (adap);if (err >=0 ) { ev.event = err ? CEC_EVENT_PIN_HPD_HIGH :
@@ -603,7 +604,8 @@ static int cec_open(struct inode *inode, struct file *filp)cec_queue_event_fh (fh, &ev,0 ); } } -if (adap->pin && adap->pin->ops->read_5v) { +if (adap->pin && adap->pin->ops->read_5v && + !adap->devnode.unregistered) { err = adap->pin->ops->read_5v (adap);if (err >=0 ) { ev.event = err ? CEC_EVENT_PIN_5V_HIGH :
drivers/media/cec/core/cec-core.c +2 -2
@@ -204,7 +204,7 @@ static ssize_t cec_error_inj_write(struct file *file, line =strsep (&p,"\n" );if (!*line || *line =='#' )continue ; -if (!adap->ops->error_inj_parse_line (adap, line)) { +if (!call_op (adap, error_inj_parse_line, line)) {kfree (buf);return -EINVAL ; }
@@ -217,7 +217,7 @@ static int cec_error_inj_show(struct seq_file *sf, void *unused) {struct cec_adapter *adap = sf->private; -return adap->ops->error_inj_show (adap, sf); +return call_op (adap, error_inj_show, sf); }static int cec_error_inj_open (struct inode *inode,struct file *file)
drivers/media/cec/core/cec-pin-priv.h +11 -0
@@ -12,6 +12,17 @@#include <linux/atomic.h> #include <media/cec-pin.h> +#define call_pin_op(pin, op, arg...) \ + ((pin && pin->ops->op && !pin->adap->devnode.unregistered) ? \ + pin->ops->op(pin->adap, ## arg) : 0) + +#define call_void_pin_op(pin, op, arg...) \ + do { \ + if (pin && pin->ops->op && \ + !pin->adap->devnode.unregistered) \ + pin->ops->op(pin->adap, ## arg); \ + } while (0) +enum cec_pin_state {/* CEC is off */ CEC_ST_OFF ,
drivers/media/cec/core/cec-pin.c +11 -12
@@ -135,7 +135,7 @@ static void cec_pin_update(struct cec_pin *pin, bool v, bool force)static bool cec_pin_read (struct cec_pin *pin) { -bool v = pin->ops->read (pin->adap); +bool v =call_pin_op (pin, read);cec_pin_update (pin, v, false);return v;
@@ -143,13 +143,13 @@ static bool cec_pin_read(struct cec_pin *pin)static void cec_pin_low (struct cec_pin *pin) { - pin->ops->low (pin->adap); +call_void_pin_op (pin, low);cec_pin_update (pin, false, false); }static bool cec_pin_high (struct cec_pin *pin) { - pin->ops->high (pin->adap); +call_void_pin_op (pin, high);return cec_pin_read (pin); }
@@ -1086,7 +1086,7 @@ static int cec_pin_thread_func(void *_adap) CEC_PIN_IRQ_UNCHANGED)) {case CEC_PIN_IRQ_DISABLE :if (irq_enabled) { - pin->ops->disable_irq (adap); +call_void_pin_op (pin, disable_irq); irq_enabled = false; }cec_pin_high (pin);
@@ -1097,7 +1097,7 @@ static int cec_pin_thread_func(void *_adap)case CEC_PIN_IRQ_ENABLE :if (irq_enabled)break ; - pin->enable_irq_failed = !pin->ops->enable_irq (adap); + pin->enable_irq_failed = !call_pin_op (pin, enable_irq);if (pin->enable_irq_failed) {cec_pin_to_idle (pin); hrtimer_start(&pin->timer, ns_to_ktime(0),
@@ -1112,8 +1112,8 @@ static int cec_pin_thread_func(void *_adap)if (kthread_should_stop ())break ; } -if (pin->ops->disable_irq && irq_enabled) - pin->ops->disable_irq (adap); +if (irq_enabled) +call_void_pin_op (pin, disable_irq);hrtimer_cancel (&pin->timer);cec_pin_read (pin);cec_pin_to_idle (pin);
@@ -1208,7 +1208,7 @@ static void cec_pin_adap_status(struct cec_adapter *adap,seq_printf (file,"state: %s\n" , states[pin->state].name);seq_printf (file,"tx_bit: %d\n" , pin->tx_bit);seq_printf (file,"rx_bit: %d\n" , pin->rx_bit); -seq_printf (file,"cec pin: %d\n" , pin->ops->read (adap)); +seq_printf (file,"cec pin: %d\n" ,call_pin_op (pin, read));seq_printf (file,"cec pin events dropped: %u\n" , pin->work_pin_events_dropped_cnt);seq_printf (file,"irq failed: %d\n" , pin->enable_irq_failed);
@@ -1261,8 +1261,7 @@ static void cec_pin_adap_status(struct cec_adapter *adap, pin->rx_data_bit_too_long_cnt =0 ; pin->rx_low_drive_cnt =0 ; pin->tx_low_drive_cnt =0 ; -if (pin->ops->status) - pin->ops->status (adap, file); +call_void_pin_op (pin, status, file); } static int cec_pin_adap_monitor_all_enable(struct cec_adapter *adap,
@@ -1278,7 +1277,7 @@ static void cec_pin_adap_free(struct cec_adapter *adap) {struct cec_pin *pin = adap->pin; -if (pin->ops->free) +if (pin && pin->ops->free) pin->ops->free (adap); adap->pin =NULL ;kfree (pin);
@@ -1288,7 +1287,7 @@ static int cec_pin_received(struct cec_adapter *adap, struct cec_msg *msg) {struct cec_pin *pin = adap->pin; -if (pin->ops->received) +if (pin->ops->received && !adap->devnode.unregistered)return pin->ops->received (adap, msg);return -ENOMSG ; }
drivers/media/cec/core/cec-priv.h +10 -0
@@ -17,6 +17,16 @@ pr_info("cec-%s: " fmt, adap->name, ## arg); \ } while (0) +#define call_op(adap, op, arg...) \ + ((adap->ops->op && !adap->devnode.unregistered) ? \ + adap->ops->op(adap, ## arg) : 0) + +#define call_void_op(adap, op, arg...) \ + do { \ + if (adap->ops->op && !adap->devnode.unregistered) \ + adap->ops->op(adap, ## arg); \ + } while (0) +/* devnode to cec_adapter */ #define to_cec_adapter (node) container_of(node, struct cec_adapter, devnode)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 222/317 media: cec-adap.c: drop activate_cnt, use state info instead
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit f9222f8ca18bcb1d55dd749b493b29fd8092fb82 ]
Using an activation counter to decide when the enable or disable the cec adapter is not the best approach and can lead to race conditions.
Change this to determining the current status of the adapter, and enable or disable the adapter accordingly.
It now only needs to be called whenever there is a chance that the state changes, and it can handle enabling/disabling monitoring as well if needed.
This simplifies the code and it should be a more robust approach as well.
Stable-dep-of: 47c82aac10a6 ("media: cec: core: avoid recursive cec_claim_log_addrs")
--- drivers/media/cec/core/cec-adap.c | 152 ++++++++++++------------------ include/media/cec.h | 4 +- 2 files changed, 61 insertions(+), 95 deletions(-)
drivers/media/cec/core/cec-adap.c +59 -93
@@ -1548,47 +1548,59 @@ static void cec_claim_log_addrs(struct cec_adapter *adap, bool block) }/* -* Helper functions to enable/disable the CEC adapter. +* Helper function to enable/disable the CEC adapter. * -* These functions are called with adap->lock held. +* This function is called with adap->lock held. */ -static int cec_activate_cnt_inc (struct cec_adapter *adap) +static int cec_adap_enable (struct cec_adapter *adap) { -int ret; +bool enable; +int ret =0 ; + + enable = adap->monitor_all_cnt || adap->monitor_pin_cnt || + adap->log_addrs.num_log_addrs; +if (adap->needs_hpd) + enable = enable && adap->phys_addr !=CEC_PHYS_ADDR_INVALID ; -if (adap->activate_cnt++) +if (enable == adap->is_enabled)return 0 ;/* serialize adap_enable */ mutex_lock (&adap->devnode.lock); - adap->last_initiator =0xff ; - adap->transmit_in_progress = false; - ret =call_op (adap, adap_enable, true); -if (ret) - adap->activate_cnt--; +if (enable) { + adap->last_initiator =0xff ; + adap->transmit_in_progress = false; + ret = adap->ops->adap_enable (adap, true); +if (!ret) { +/* +* Enable monitor-all/pin modes if needed. We warn, but +* continue if this fails as this is not a critical error. +*/ +if (adap->monitor_all_cnt) +WARN_ON (call_op (adap, adap_monitor_all_enable, true)); +if (adap->monitor_pin_cnt) +WARN_ON (call_op (adap, adap_monitor_pin_enable, true)); + } + }else { +/* Disable monitor-all/pin modes if needed (needs_hpd == 1) */ +if (adap->monitor_all_cnt) +WARN_ON (call_op (adap, adap_monitor_all_enable, false)); +if (adap->monitor_pin_cnt) +WARN_ON (call_op (adap, adap_monitor_pin_enable, false)); +WARN_ON (adap->ops->adap_enable (adap, false)); + adap->last_initiator =0xff ; + adap->transmit_in_progress = false; + adap->transmit_in_progress_aborted = false; +if (adap->transmitting) +cec_data_cancel (adap->transmitting,CEC_TX_STATUS_ABORTED ,0 ); + } +if (!ret) + adap->is_enabled = enable; +wake_up_interruptible (&adap->kthread_waitq);mutex_unlock (&adap->devnode.lock);return ret; } -static void cec_activate_cnt_dec (struct cec_adapter *adap) -{ -if (WARN_ON (!adap->activate_cnt)) -return ; - -if (--adap->activate_cnt) -return ; - -/* serialize adap_enable */ -mutex_lock (&adap->devnode.lock); -WARN_ON (call_op (adap, adap_enable, false)); - adap->last_initiator =0xff ; - adap->transmit_in_progress = false; - adap->transmit_in_progress_aborted = false; -if (adap->transmitting) -cec_data_cancel (adap->transmitting,CEC_TX_STATUS_ABORTED ,0 ); -mutex_unlock (&adap->devnode.lock); -} -/* Set a new physical address and send an event notifying userspace of this. * * This function is called with adap->lock held.
@@ -1609,33 +1621,16 @@ void __cec_s_phys_addr(struct cec_adapter *adap, u16 phys_addr, bool block) adap->phys_addr =CEC_PHYS_ADDR_INVALID ;cec_post_state_event (adap);cec_adap_unconfigure (adap); -if (becomes_invalid && adap->needs_hpd) { -/* Disable monitor-all/pin modes if needed */ -if (adap->monitor_all_cnt) -WARN_ON (call_op (adap, adap_monitor_all_enable, false)); -if (adap->monitor_pin_cnt) -WARN_ON (call_op (adap, adap_monitor_pin_enable, false)); -cec_activate_cnt_dec (adap); -wake_up_interruptible (&adap->kthread_waitq); - } -if (becomes_invalid) +if (becomes_invalid) { +cec_adap_enable (adap);return ; - } - -if (is_invalid && adap->needs_hpd) { -if (cec_activate_cnt_inc (adap)) -return ; -/* -* Re-enable monitor-all/pin modes if needed. We warn, but -* continue if this fails as this is not a critical error. -*/ -if (adap->monitor_all_cnt) -WARN_ON (call_op (adap, adap_monitor_all_enable, true)); -if (adap->monitor_pin_cnt) -WARN_ON (call_op (adap, adap_monitor_pin_enable, true)); + } } adap->phys_addr = phys_addr; +if (is_invalid) +cec_adap_enable (adap); +cec_post_state_event (adap);if (adap->log_addrs.num_log_addrs)cec_claim_log_addrs (adap, block);
@@ -1692,6 +1687,7 @@ int __cec_s_log_addrs(struct cec_adapter *adap, struct cec_log_addrs *log_addrs, bool block) {u16 type_mask =0 ; +int err;int i;if (adap->devnode.unregistered)
@@ -1707,8 +1703,7 @@ int __cec_s_log_addrs(struct cec_adapter *adap, adap->log_addrs.osd_name[0 ] ='\0' ; adap->log_addrs.vendor_id =CEC_VENDOR_ID_NONE ; adap->log_addrs.cec_version =CEC_OP_CEC_VERSION_2_0 ; -if (!adap->needs_hpd) -cec_activate_cnt_dec (adap); +cec_adap_enable (adap);return 0 ; }
@@ -1842,17 +1837,12 @@ int __cec_s_log_addrs(struct cec_adapter *adap, sizeof(log_addrs->features[i])); } -if (!adap->needs_hpd && !adap->is_configuring && !adap->is_configured) { -int ret =cec_activate_cnt_inc (adap); - -if (ret) -return ret; - } log_addrs->log_addr_mask = adap->log_addrs.log_addr_mask; adap->log_addrs = *log_addrs; -if (adap->phys_addr !=CEC_PHYS_ADDR_INVALID ) + err =cec_adap_enable (adap); +if (!err && adap->phys_addr !=CEC_PHYS_ADDR_INVALID )cec_claim_log_addrs (adap, block); -return 0 ; +return err; } int cec_s_log_addrs(struct cec_adapter *adap,
@@ -2155,20 +2145,9 @@ int cec_monitor_all_cnt_inc(struct cec_adapter *adap)if (adap->monitor_all_cnt++)return 0 ; -if (!adap->needs_hpd) { - ret =cec_activate_cnt_inc (adap); -if (ret) { - adap->monitor_all_cnt--; -return ret; - } - } - - ret =call_op (adap, adap_monitor_all_enable, true); -if (ret) { + ret =cec_adap_enable (adap); +if (ret) adap->monitor_all_cnt--; -if (!adap->needs_hpd) -cec_activate_cnt_dec (adap); - }return ret; }
@@ -2179,8 +2158,7 @@ void cec_monitor_all_cnt_dec(struct cec_adapter *adap)if (--adap->monitor_all_cnt)return ;WARN_ON (call_op (adap, adap_monitor_all_enable, false)); -if (!adap->needs_hpd) -cec_activate_cnt_dec (adap); +cec_adap_enable (adap); }/*
@@ -2195,20 +2173,9 @@ int cec_monitor_pin_cnt_inc(struct cec_adapter *adap)if (adap->monitor_pin_cnt++)return 0 ; -if (!adap->needs_hpd) { - ret =cec_activate_cnt_inc (adap); -if (ret) { - adap->monitor_pin_cnt--; -return ret; - } - } - - ret =call_op (adap, adap_monitor_pin_enable, true); -if (ret) { + ret =cec_adap_enable (adap); +if (ret) adap->monitor_pin_cnt--; -if (!adap->needs_hpd) -cec_activate_cnt_dec (adap); - }return ret; }
@@ -2219,8 +2186,7 @@ void cec_monitor_pin_cnt_dec(struct cec_adapter *adap)if (--adap->monitor_pin_cnt)return ;WARN_ON (call_op (adap, adap_monitor_pin_enable, false)); -if (!adap->needs_hpd) -cec_activate_cnt_dec (adap); +cec_adap_enable (adap); }#ifdef CONFIG_DEBUG_FS
@@ -2234,7 +2200,7 @@ int cec_adap_status(struct seq_file *file, void *priv)struct cec_data *data;mutex_lock (&adap->lock); -seq_printf (file,"activation count: %u\n" , adap->activate_cnt); +seq_printf (file,"enabled: %d\n" , adap->is_enabled);seq_printf (file,"configured: %d\n" , adap->is_configured);seq_printf (file,"configuring: %d\n" , adap->is_configuring); seq_printf(file, "phys_addr: %x.%x.%x.%x\n",
include/media/cec.h +2 -2
@@ -180,6 +180,7 @@ struct cec_adap_ops {* @needs_hpd: if true, then the HDMI HotPlug Detect pin must be high * in order to transmit or receive CEC messages. This is usually a HW * limitation. +* @is_enabled: the CEC adapter is enabled * @is_configuring: the CEC adapter is configuring (i.e. claiming LAs) * @is_configured: the CEC adapter is configured (i.e. has claimed LAs) * @cec_pin_is_high: if true then the CEC pin is high. Only used with the
@@ -190,7 +191,6 @@ struct cec_adap_ops {* Drivers that need this can set this field to true after the * cec_allocate_adapter() call. * @last_initiator: the initiator of the last transmitted message. -* @activate_cnt: number of times that CEC is activated * @monitor_all_cnt: number of filehandles monitoring all msgs * @monitor_pin_cnt: number of filehandles monitoring pin changes * @follower_cnt: number of filehandles in follower mode
@@ -238,12 +238,12 @@ struct cec_adapter {u16 phys_addr;bool needs_hpd; +bool is_enabled;bool is_configuring;bool is_configured;bool cec_pin_is_high;bool adap_controls_phys_addr;u8 last_initiator; -u32 activate_cnt;u32 monitor_all_cnt;u32 monitor_pin_cnt;u32 follower_cnt;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 223/317 media: cec: core: avoid recursive cec_claim_log_addrs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit 47c82aac10a6954d68f29f10d9758d016e8e5af1 ]
Keep track if cec_claim_log_addrs() is running, and return -EBUSY if it is when calling CEC_ADAP_S_LOG_ADDRS.
This prevents a case where cec_claim_log_addrs() could be called while it was still in progress.
--- drivers/media/cec/core/cec-adap.c | 6 +++++- drivers/media/cec/core/cec-api.c | 2 +- include/media/cec.h | 1 + 3 files changed, 7 insertions(+), 2 deletions(-)
drivers/media/cec/core/cec-adap.c +5 -1
@@ -1528,9 +1528,12 @@ static int cec_config_thread_func(void *arg)*/ static void cec_claim_log_addrs (struct cec_adapter *adap,bool block) { -if (WARN_ON (adap->is_configuring || adap->is_configured)) +if (WARN_ON (adap->is_claiming_log_addrs || + adap->is_configuring || adap->is_configured))return ; + adap->is_claiming_log_addrs = true; +init_completion (&adap->config_completion);/* Ready to kick off the thread */
@@ -1545,6 +1548,7 @@ static void cec_claim_log_addrs(struct cec_adapter *adap, bool block)wait_for_completion (&adap->config_completion);mutex_lock (&adap->lock); } + adap->is_claiming_log_addrs = false; }/*
drivers/media/cec/core/cec-api.c +1 -1
@@ -178,7 +178,7 @@ static long cec_adap_s_log_addrs(struct cec_adapter *adap, struct cec_fh *fh,CEC_LOG_ADDRS_FL_ALLOW_RC_PASSTHRU |CEC_LOG_ADDRS_FL_CDC_ONLY ;mutex_lock (&adap->lock); -if (!adap->is_configuring && +if (!adap->is_claiming_log_addrs && !adap->is_configuring && (!log_addrs.num_log_addrs || !adap->is_configured) && !cec_is_busy (adap, fh)) { err =__cec_s_log_addrs (adap, &log_addrs, block);
include/media/cec.h +1 -0
@@ -239,6 +239,7 @@ struct cec_adapter {u16 phys_addr;bool needs_hpd;bool is_enabled; +bool is_claiming_log_addrs;bool is_configuring;bool is_configured;bool cec_pin_is_high;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 224/317 media: cec: core: avoid confusing "transmit timed out" message
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit cbe499977bc36fedae89f0a0d7deb4ccde9798fe ]
If, when waiting for a transmit to finish, the wait is interrupted, then you might get a "transmit timed out" message, even though the transmit was interrupted and did not actually time out.
Set transmit_in_progress_aborted to true if the wait_for_completion_killable() call was interrupted and ensure that the transmit is properly marked as ABORTED.
--- drivers/media/cec/core/cec-adap.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
drivers/media/cec/core/cec-adap.c +14 -1
@@ -502,6 +502,15 @@ int cec_thread_func(void *_adap) goto unlock; } +if (adap->transmit_in_progress && + adap->transmit_in_progress_aborted) { +if (adap->transmitting) +cec_data_cancel (adap->transmitting, +CEC_TX_STATUS_ABORTED ,0 ); + adap->transmit_in_progress = false; + adap->transmit_in_progress_aborted = false; + goto unlock; + }if (adap->transmit_in_progress && timeout) {/* * If we timeout, then log that. Normally this does
@@ -755,6 +764,7 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg, {struct cec_data *data;bool is_raw =msg_is_raw (msg); +int err;if (adap->devnode.unregistered)return -ENODEV ;
@@ -917,10 +927,13 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,* Release the lock and wait, retake the lock afterwards. */ mutex_unlock (&adap->lock); -wait_for_completion_killable (&data->c); + err =wait_for_completion_killable (&data->c);cancel_delayed_work_sync (&data->work);mutex_lock (&adap->lock); +if (err) + adap->transmit_in_progress_aborted = true; +/* Cancel the transmit if it was interrupted */ if (!data->completed) {if (data->msg.tx_status &CEC_TX_STATUS_OK )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 225/317 null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Yanjun <[email protected]>
[ Upstream commit 9e6727f824edcdb8fdd3e6e8a0862eb49546e1cd ]
No functional changes intended.
--- drivers/block/null_blk/main.c | 1 + 1 file changed, 1 insertion(+)
drivers/block/null_blk/main.c +1 -0
@@ -2040,4 +2040,5 @@ module_init(null_init);module_exit (null_exit);MODULE_AUTHOR ("Jens Axboe <[email protected]>" ); +MODULE_DESCRIPTION ("multi queue aware block test driver" );MODULE_LICENSE ("GPL" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 226/317 regulator: bd71828: Dont overwrite runtime voltages
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matti Vaittinen <[email protected]>
[ Upstream commit 0f9f7c63c415e287cd57b5c98be61eb320dedcfc ]
Some of the regulators on the BD71828 have common voltage setting for RUN/SUSPEND/IDLE/LPSR states. The enable control can be set for each state though.
The driver allows setting the voltage values for these states via device-tree. As a side effect, setting the voltages for SUSPEND/IDLE/LPSR will also change the RUN level voltage which is not desired and can break the system.
The comment in code reflects this behaviour, but it is likely to not make people any happier. The right thing to do is to allow setting the enable/disable state at SUSPEND/IDLE/LPSR via device-tree, but to disallow setting state specific voltages for those regulators.
BUCK1 is a bit different. It only shares the SUSPEND and LPSR state voltages. The former behaviour of allowing to silently overwrite the SUSPEND state voltage by LPSR state voltage is also changed here so that the SUSPEND voltage is prioritized over LPSR voltage.
Prevent setting PMIC state specific voltages for regulators which do not support it.
--- drivers/regulator/bd71828-regulator.c | 58 +-------------------------- 1 file changed, 2 insertions(+), 56 deletions(-)
drivers/regulator/bd71828-regulator.c +2 -56
@@ -234,14 +234,11 @@ static const struct bd71828_regulator_data bd71828_rdata[] = { .suspend_reg = BD71828_REG_BUCK1_SUSP_VOLT, .suspend_mask = BD71828_MASK_BUCK1267_VOLT, .suspend_on_mask = BD71828_MASK_SUSP_EN, - .lpsr_on_mask = BD71828_MASK_LPSR_EN,/* * LPSR voltage is same as SUSPEND voltage. Allow -* setting it so that regulator can be set enabled at -* LPSR state +* only enabling/disabling regulator for LPSR state */ - .lpsr_reg = BD71828_REG_BUCK1_SUSP_VOLT, - .lpsr_mask = BD71828_MASK_BUCK1267_VOLT, + .lpsr_on_mask = BD71828_MASK_LPSR_EN, }, .reg_inits = buck1_inits, .reg_init_amnt = ARRAY_SIZE(buck1_inits),
@@ -312,13 +309,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = {ROHM_DVS_LEVEL_SUSPEND | ROHM_DVS_LEVEL_LPSR, .run_reg = BD71828_REG_BUCK3_VOLT, - .idle_reg = BD71828_REG_BUCK3_VOLT, - .suspend_reg = BD71828_REG_BUCK3_VOLT, - .lpsr_reg = BD71828_REG_BUCK3_VOLT, .run_mask = BD71828_MASK_BUCK3_VOLT, - .idle_mask = BD71828_MASK_BUCK3_VOLT, - .suspend_mask = BD71828_MASK_BUCK3_VOLT, - .lpsr_mask = BD71828_MASK_BUCK3_VOLT, .idle_on_mask = BD71828_MASK_IDLE_EN, .suspend_on_mask = BD71828_MASK_SUSP_EN, .lpsr_on_mask = BD71828_MASK_LPSR_EN,
@@ -353,13 +344,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = {ROHM_DVS_LEVEL_SUSPEND | ROHM_DVS_LEVEL_LPSR, .run_reg = BD71828_REG_BUCK4_VOLT, - .idle_reg = BD71828_REG_BUCK4_VOLT, - .suspend_reg = BD71828_REG_BUCK4_VOLT, - .lpsr_reg = BD71828_REG_BUCK4_VOLT, .run_mask = BD71828_MASK_BUCK4_VOLT, - .idle_mask = BD71828_MASK_BUCK4_VOLT, - .suspend_mask = BD71828_MASK_BUCK4_VOLT, - .lpsr_mask = BD71828_MASK_BUCK4_VOLT, .idle_on_mask = BD71828_MASK_IDLE_EN, .suspend_on_mask = BD71828_MASK_SUSP_EN, .lpsr_on_mask = BD71828_MASK_LPSR_EN,
@@ -394,13 +379,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = {ROHM_DVS_LEVEL_SUSPEND | ROHM_DVS_LEVEL_LPSR, .run_reg = BD71828_REG_BUCK5_VOLT, - .idle_reg = BD71828_REG_BUCK5_VOLT, - .suspend_reg = BD71828_REG_BUCK5_VOLT, - .lpsr_reg = BD71828_REG_BUCK5_VOLT, .run_mask = BD71828_MASK_BUCK5_VOLT, - .idle_mask = BD71828_MASK_BUCK5_VOLT, - .suspend_mask = BD71828_MASK_BUCK5_VOLT, - .lpsr_mask = BD71828_MASK_BUCK5_VOLT, .idle_on_mask = BD71828_MASK_IDLE_EN, .suspend_on_mask = BD71828_MASK_SUSP_EN, .lpsr_on_mask = BD71828_MASK_LPSR_EN,
@@ -509,13 +488,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = {ROHM_DVS_LEVEL_SUSPEND | ROHM_DVS_LEVEL_LPSR, .run_reg = BD71828_REG_LDO1_VOLT, - .idle_reg = BD71828_REG_LDO1_VOLT, - .suspend_reg = BD71828_REG_LDO1_VOLT, - .lpsr_reg = BD71828_REG_LDO1_VOLT, .run_mask = BD71828_MASK_LDO_VOLT, - .idle_mask = BD71828_MASK_LDO_VOLT, - .suspend_mask = BD71828_MASK_LDO_VOLT, - .lpsr_mask = BD71828_MASK_LDO_VOLT, .idle_on_mask = BD71828_MASK_IDLE_EN, .suspend_on_mask = BD71828_MASK_SUSP_EN, .lpsr_on_mask = BD71828_MASK_LPSR_EN,
@@ -549,13 +522,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = {ROHM_DVS_LEVEL_SUSPEND | ROHM_DVS_LEVEL_LPSR, .run_reg = BD71828_REG_LDO2_VOLT, - .idle_reg = BD71828_REG_LDO2_VOLT, - .suspend_reg = BD71828_REG_LDO2_VOLT, - .lpsr_reg = BD71828_REG_LDO2_VOLT, .run_mask = BD71828_MASK_LDO_VOLT, - .idle_mask = BD71828_MASK_LDO_VOLT, - .suspend_mask = BD71828_MASK_LDO_VOLT, - .lpsr_mask = BD71828_MASK_LDO_VOLT, .idle_on_mask = BD71828_MASK_IDLE_EN, .suspend_on_mask = BD71828_MASK_SUSP_EN, .lpsr_on_mask = BD71828_MASK_LPSR_EN,
@@ -589,13 +556,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = {ROHM_DVS_LEVEL_SUSPEND | ROHM_DVS_LEVEL_LPSR, .run_reg = BD71828_REG_LDO3_VOLT, - .idle_reg = BD71828_REG_LDO3_VOLT, - .suspend_reg = BD71828_REG_LDO3_VOLT, - .lpsr_reg = BD71828_REG_LDO3_VOLT, .run_mask = BD71828_MASK_LDO_VOLT, - .idle_mask = BD71828_MASK_LDO_VOLT, - .suspend_mask = BD71828_MASK_LDO_VOLT, - .lpsr_mask = BD71828_MASK_LDO_VOLT, .idle_on_mask = BD71828_MASK_IDLE_EN, .suspend_on_mask = BD71828_MASK_SUSP_EN, .lpsr_on_mask = BD71828_MASK_LPSR_EN,
@@ -630,13 +591,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = {ROHM_DVS_LEVEL_SUSPEND | ROHM_DVS_LEVEL_LPSR, .run_reg = BD71828_REG_LDO4_VOLT, - .idle_reg = BD71828_REG_LDO4_VOLT, - .suspend_reg = BD71828_REG_LDO4_VOLT, - .lpsr_reg = BD71828_REG_LDO4_VOLT, .run_mask = BD71828_MASK_LDO_VOLT, - .idle_mask = BD71828_MASK_LDO_VOLT, - .suspend_mask = BD71828_MASK_LDO_VOLT, - .lpsr_mask = BD71828_MASK_LDO_VOLT, .idle_on_mask = BD71828_MASK_IDLE_EN, .suspend_on_mask = BD71828_MASK_SUSP_EN, .lpsr_on_mask = BD71828_MASK_LPSR_EN,
@@ -671,13 +626,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = {ROHM_DVS_LEVEL_SUSPEND | ROHM_DVS_LEVEL_LPSR, .run_reg = BD71828_REG_LDO5_VOLT, - .idle_reg = BD71828_REG_LDO5_VOLT, - .suspend_reg = BD71828_REG_LDO5_VOLT, - .lpsr_reg = BD71828_REG_LDO5_VOLT, .run_mask = BD71828_MASK_LDO_VOLT, - .idle_mask = BD71828_MASK_LDO_VOLT, - .suspend_mask = BD71828_MASK_LDO_VOLT, - .lpsr_mask = BD71828_MASK_LDO_VOLT, .idle_on_mask = BD71828_MASK_IDLE_EN, .suspend_on_mask = BD71828_MASK_SUSP_EN, .lpsr_on_mask = BD71828_MASK_LPSR_EN,
@@ -736,9 +685,6 @@ static const struct bd71828_regulator_data bd71828_rdata[] = { .suspend_reg = BD71828_REG_LDO7_VOLT, .lpsr_reg = BD71828_REG_LDO7_VOLT, .run_mask = BD71828_MASK_LDO_VOLT, - .idle_mask = BD71828_MASK_LDO_VOLT, - .suspend_mask = BD71828_MASK_LDO_VOLT, - .lpsr_mask = BD71828_MASK_LDO_VOLT, .idle_on_mask = BD71828_MASK_IDLE_EN, .suspend_on_mask = BD71828_MASK_SUSP_EN, .lpsr_on_mask = BD71828_MASK_LPSR_EN,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 227/317 x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit 66ee3636eddcc82ab82b539d08b85fb5ac1dff9b ]
It took me some time to understand the purpose of the tricky code at the end of arch/x86/Kconfig.debug.
Without it, the following would be shown:
WARNING: unmet direct dependencies detected for FRAME_POINTER
because
81d387190039 ("x86/kconfig: Consolidate unwinders into multiple choice selection")
removed 'select ARCH_WANT_FRAME_POINTERS'.
The correct and more straightforward approach should have been to move it where 'select FRAME_POINTER' is located.
Several architectures properly handle the conditional selection of ARCH_WANT_FRAME_POINTERS. For example, 'config UNWINDER_FRAME_POINTER' in arch/arm/Kconfig.debug.
--- arch/x86/Kconfig.debug | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
arch/x86/Kconfig.debug +1 -4
@@ -258,6 +258,7 @@ config UNWINDER_ORC config UNWINDER_FRAME_POINTER bool "Frame pointer unwinder" + select ARCH_WANT_FRAME_POINTERS select FRAME_POINTER help This option enables the frame pointer unwinder for unwinding kernel
@@ -281,7 +282,3 @@ config UNWINDER_GUESS overhead. endchoice - -config FRAME_POINTER - depends on !UNWINDER_ORC && !UNWINDER_GUESS - bool
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 228/317 nfc: nci: Fix uninit-value in nci_rx_work
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryosuke Yasuoka <[email protected]>
[ Upstream commit e4a87abf588536d1cdfb128595e6e680af5cf3ed ]
syzbot reported the following uninit-value access issue [1]
nci_rx_work() parses received packet from ndev->rx_q. It should be validated header size, payload size and total packet size before processing the packet. If an invalid packet is detected, it should be silently discarded.
--- net/nfc/nci/core.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
net/nfc/nci/core.c +14 -1
@@ -1452,6 +1452,19 @@ int nci_core_ntf_packet(struct nci_dev *ndev, __u16 opcode, ndev->ops->n_core_ops); } +static bool nci_valid_size (struct sk_buff *skb) +{ +BUILD_BUG_ON (NCI_CTRL_HDR_SIZE !=NCI_DATA_HDR_SIZE ); +unsigned int hdr_size =NCI_CTRL_HDR_SIZE ; + +if (skb->len < hdr_size || + !nci_plen (skb->data) || + skb->len < hdr_size +nci_plen (skb->data)) { +return false; + } +return true; +} +/* ---- NCI TX Data worker thread ---- */ static void nci_tx_work (struct work_struct *work)
@@ -1502,7 +1515,7 @@ static void nci_rx_work(struct work_struct *work)nfc_send_to_raw_sock (ndev->nfc_dev, skb,RAW_PAYLOAD_NCI ,NFC_DIRECTION_RX ); -if (!nci_plen (skb->data)) { +if (!nci_valid_size (skb)) {kfree_skb (skb);break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 229/317 ASoC: tas2552: Add TX path for capturing AUDIO-OUT data
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shenghao Ding <[email protected]>
[ Upstream commit 7078ac4fd179a68d0bab448004fcd357e7a45f8d ]
TAS2552 is a Smartamp with I/V sense data, add TX path to support capturing I/V data.
--- sound/soc/codecs/tas2552.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
sound/soc/codecs/tas2552.c +13 -2
@@ -2,7 +2,8 @@/* * tas2552.c - ALSA SoC Texas Instruments TAS2552 Mono Audio Amplifier * -* Copyright (C) 2014 Texas Instruments Incorporated - https://www.ti.com +* Copyright (C) 2014 - 2024 Texas Instruments Incorporated - +* https://www.ti.com * * Author: Dan Murphy <[email protected]> */
@@ -119,12 +120,14 @@ static const struct snd_soc_dapm_widget tas2552_dapm_widgets[] = &tas2552_input_mux_control),SND_SOC_DAPM_AIF_IN ("DAC IN" ,"DAC Playback" ,0 ,SND_SOC_NOPM ,0 ,0 ), +SND_SOC_DAPM_AIF_OUT ("ASI OUT" ,"DAC Capture" ,0 ,SND_SOC_NOPM ,0 ,0 ),SND_SOC_DAPM_DAC ("DAC" ,NULL ,SND_SOC_NOPM ,0 ,0 ),SND_SOC_DAPM_OUT_DRV ("ClassD" ,TAS2552_CFG_2 ,7 ,0 ,NULL ,0 ),SND_SOC_DAPM_SUPPLY ("PLL" ,TAS2552_CFG_2 ,3 ,0 ,NULL ,0 ),SND_SOC_DAPM_POST ("Post Event" , tas2552_post_event), -SND_SOC_DAPM_OUTPUT ("OUT" ) +SND_SOC_DAPM_OUTPUT ("OUT" ), +SND_SOC_DAPM_INPUT ("DMIC" ) }; static const struct snd_soc_dapm_route tas2552_audio_map[] = {
@@ -134,6 +137,7 @@ static const struct snd_soc_dapm_route tas2552_audio_map[] = { {"ClassD", NULL, "Input selection"}, {"OUT", NULL, "ClassD"}, {"ClassD", NULL, "PLL"}, + {"ASI OUT", NULL, "DMIC"} };#ifdef CONFIG_PM
@@ -538,6 +542,13 @@ static struct snd_soc_dai_driver tas2552_dai[] = { .rates = SNDRV_PCM_RATE_8000_192000, .formats = TAS2552_FORMATS, }, + .capture = { + .stream_name = "Capture", + .channels_min = 2, + .channels_max = 2, + .rates = SNDRV_PCM_RATE_8000_192000, + .formats = TAS2552_FORMATS, + }, .ops = &tas2552_speaker_dai_ops, }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 230/317 sunrpc: fix NFSACL RPC retry on soft mount
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Aloni <[email protected]>
[ Upstream commit 0dc9f430027b8bd9073fdafdfcdeb1a073ab5594 ]
It used to be quite awhile ago since 1b63a75180c6 ('SUNRPC: Refactor rpc_clone_client()'), in 2012, that cl_timeout was copied in so that all mount parameters propagate to NFSACL clients. However since that change, if mount options as follows are given:
soft,timeo=50,retrans=16,vers=3
The resultant NFSACL client receives:
cl_softrtry: 1
cl_timeout: to_initval=60000, to_maxval=60000, to_increment=0, to_retries=2, to_exponential=0These values lead to NFSACL operations not being retried under the condition of transient network outages with soft mount. Instead, getacl call fails after 60 seconds with EIO.
The simple fix is to pass the existing client's cl_timeout as the new client timeout.
--- net/sunrpc/clnt.c | 1 + 1 file changed, 1 insertion(+)
net/sunrpc/clnt.c +1 -0
@@ -970,6 +970,7 @@ struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *old, .authflavor = old->cl_auth->au_flavor, .cred = old->cl_cred, .stats = old->cl_stats, + .timeout = old->cl_timeout, };struct rpc_clnt *clnt;int err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 231/317 rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Aloni <[email protected]>
[ Upstream commit 4836da219781ec510c4c0303df901aa643507a7a ]
Under the scenario of IB device bonding, when bringing down one of the ports, or all ports, we saw xprtrdma entering a non-recoverable state where it is not even possible to complete the disconnect and shut it down the mount, requiring a reboot. Following debug, we saw that transport connect never ended after receiving the RDMA_CM_EVENT_DEVICE_REMOVAL callback.
The DEVICE_REMOVAL callback is irrespective of whether the CM_ID is connected, and ESTABLISHED may not have happened. So need to work with each of these states accordingly.
--- net/sunrpc/xprtrdma/verbs.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/sunrpc/xprtrdma/verbs.c +5 -1
@@ -268,7 +268,11 @@ rpcrdma_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event)case RDMA_CM_EVENT_DEVICE_REMOVAL :pr_info ("rpcrdma: removing device %s for %pISpc\n" , ep->re_id->device->name, sap); - fallthrough; +switch (xchg (&ep->re_connect_status, -ENODEV )) { +case 0 : goto wake_connect_worker; +case 1 : goto disconnected; + } +return 0 ;case RDMA_CM_EVENT_ADDR_CHANGE : ep->re_connect_status = -ENODEV ; goto disconnected;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 232/317 ipv6: sr: fix memleak in seg6_hmac_init_algo
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit efb9f4f19f8e37fde43dfecebc80292d179f56c6 ]
seg6_hmac_init_algo returns without cleaning up the previous allocations if one fails, so it's going to leak all that memory and the crypto tfms.
Update seg6_hmac_exit to only free the memory when allocated, so we can reuse the code directly.
--- net/ipv6/seg6_hmac.c | 42 ++++++++++++++++++++++++++++-------------- 1 file changed, 28 insertions(+), 14 deletions(-)
net/ipv6/seg6_hmac.c +28 -14
@@ -355,6 +355,7 @@ static int seg6_hmac_init_algo(void)struct crypto_shash *tfm;struct shash_desc *shash;int i, alg_count, cpu; +int ret = -ENOMEM ; alg_count =ARRAY_SIZE (hmac_algos);
@@ -365,12 +366,14 @@ static int seg6_hmac_init_algo(void) algo = &hmac_algos[i]; algo->tfms = alloc_percpu(struct crypto_shash *);if (!algo->tfms) -return -ENOMEM ; + goto error_out;for_each_possible_cpu (cpu) { tfm =crypto_alloc_shash (algo->name,0 ,0 ); -if (IS_ERR (tfm)) -return PTR_ERR (tfm); +if (IS_ERR (tfm)) { + ret =PTR_ERR (tfm); + goto error_out; + } p_tfm =per_cpu_ptr (algo->tfms, cpu); *p_tfm = tfm; }
@@ -382,18 +385,22 @@ static int seg6_hmac_init_algo(void) algo->shashs = alloc_percpu(struct shash_desc *);if (!algo->shashs) -return -ENOMEM ; + goto error_out;for_each_possible_cpu (cpu) { shash =kzalloc_node (shsize,GFP_KERNEL ,cpu_to_node (cpu));if (!shash) -return -ENOMEM ; + goto error_out; *per_cpu_ptr (algo->shashs, cpu) = shash; } }return 0 ; + +error_out: +seg6_hmac_exit (); +return ret; }int __init seg6_hmac_init (void )
@@ -413,22 +420,29 @@ int __net_init seg6_hmac_net_init(struct net *net)void seg6_hmac_exit (void ) {struct seg6_hmac_algo *algo =NULL ; +struct crypto_shash *tfm; +struct shash_desc *shash;int i, alg_count, cpu; alg_count =ARRAY_SIZE (hmac_algos);for (i =0 ; i < alg_count; i++) { algo = &hmac_algos[i]; -for_each_possible_cpu (cpu) { -struct crypto_shash *tfm; -struct shash_desc *shash; - shash = *per_cpu_ptr (algo->shashs, cpu); -kfree (shash); - tfm = *per_cpu_ptr (algo->tfms, cpu); -crypto_free_shash (tfm); +if (algo->shashs) { +for_each_possible_cpu (cpu) { + shash = *per_cpu_ptr (algo->shashs, cpu); +kfree (shash); + } +free_percpu (algo->shashs); + } + +if (algo->tfms) { +for_each_possible_cpu (cpu) { + tfm = *per_cpu_ptr (algo->tfms, cpu); +crypto_free_shash (tfm); + } +free_percpu (algo->tfms); } -free_percpu (algo->tfms); -free_percpu (algo->shashs); } }EXPORT_SYMBOL (seg6_hmac_exit);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 233/317 params: lift param_set_uint_minmax to common code
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Grimberg <[email protected]>
[ Upstream commit 2a14c9ae15a38148484a128b84bff7e9ffd90d68 ]
It is a useful helper hence move it to common code so others can enjoy it.
Stable-dep-of: 3ebc46ca8675 ("tcp: Fix shift-out-of-bounds in dctcp_update_alpha().")
--- include/linux/moduleparam.h | 2 ++ kernel/params.c | 18 ++++++++++++++++++ net/sunrpc/xprtsock.c | 18 ------------------ 3 files changed, 20 insertions(+), 18 deletions(-)
include/linux/moduleparam.h +2 -0
@@ -431,6 +431,8 @@ extern int param_get_int(char *buffer, const struct kernel_param *kp);extern const struct kernel_param_ops param_ops_uint;extern int param_set_uint (const char *val,const struct kernel_param *kp);extern int param_get_uint (char *buffer,const struct kernel_param *kp); +int param_set_uint_minmax (const char *val,const struct kernel_param *kp, +unsigned int min,unsigned int max);#define param_check_uint (name, p) __param_check(name, p, unsigned int)extern const struct kernel_param_ops param_ops_long;
kernel/params.c +18 -0
@@ -243,6 +243,24 @@ STANDARD_PARAM_DEF(ulong, unsigned long, "%lu", kstrtoul); STANDARD_PARAM_DEF(ullong, unsigned long long, "%llu", kstrtoull); STANDARD_PARAM_DEF(hexint, unsigned int, "%#08x", kstrtouint); +int param_set_uint_minmax (const char *val,const struct kernel_param *kp, +unsigned int min,unsigned int max) +{ +unsigned int num; +int ret; + +if (!val) +return -EINVAL ; + ret =kstrtouint (val,0 , &num); +if (ret) +return ret; +if (num < min || num > max) +return -EINVAL ; + *((unsigned int *)kp->arg) = num; +return 0 ; +} +EXPORT_SYMBOL_GPL (param_set_uint_minmax); +int param_set_charp (const char *val,const struct kernel_param *kp) {if (strlen (val) >1024 ) {
net/sunrpc/xprtsock.c +0 -18
@@ -3166,24 +3166,6 @@ void cleanup_socket_xprt(void)xprt_unregister_transport (&xs_bc_tcp_transport); } -static int param_set_uint_minmax (const char *val, -const struct kernel_param *kp, -unsigned int min,unsigned int max) -{ -unsigned int num; -int ret; - -if (!val) -return -EINVAL ; - ret =kstrtouint (val,0 , &num); -if (ret) -return ret; -if (num < min || num > max) -return -EINVAL ; - *((unsigned int *)kp->arg) = num; -return 0 ; -} -static int param_set_portnr (const char *val,const struct kernel_param *kp) { return param_set_uint_minmax(val, kp,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 234/317 tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 3ebc46ca8675de6378e3f8f40768e180bb8afa66 ]
In dctcp_update_alpha(), we use a module parameter dctcp_shift_g as follows:
alpha -= min_not_zero(alpha, alpha >> dctcp_shift_g); ... delivered_ce <<= (10 - dctcp_shift_g);
It seems syzkaller started fuzzing module parameters and triggered shift-out-of-bounds [0] by setting 100 to dctcp_shift_g:
memcpy((void*)0x20000080,
"/sys/module/tcp_dctcp/parameters/dctcp_shift_g\000", 47);
res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000080ul,
/*flags=*/2ul, /*mode=*/0ul);
memcpy((void*)0x20000000, "100\000", 4);
syscall(__NR_write, /*fd=*/r[0], /*val=*/0x20000000ul, /*len=*/4ul);Let's limit the max value of dctcp_shift_g by param_set_uint_minmax().
With this patch:
# echo 10 > /sys/module/tcp_dctcp/parameters/dctcp_shift_g # cat /sys/module/tcp_dctcp/parameters/dctcp_shift_g 10 # echo 11 > /sys/module/tcp_dctcp/parameters/dctcp_shift_g -bash: echo: write error: Invalid argument
[0]:
UBSAN: shift-out-of-bounds in net/ipv4/tcp_dctcp.c:143:12 shift exponent 100 is too large for 32-bit type 'u32' (aka 'unsigned int') CPU: 0 PID: 8083 Comm: syz-executor345 Not tainted 6.9.0-05151-g1b294a1f3561 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x201/0x300 lib/dump_stack.c:114 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_shift_out_of_bounds+0x346/0x3a0 lib/ubsan.c:468 dctcp_update_alpha+0x540/0x570 net/ipv4/tcp_dctcp.c:143 tcp_in_ack_event net/ipv4/tcp_input.c:3802 [inline] tcp_ack+0x17b1/0x3bc0 net/ipv4/tcp_input.c:3948 tcp_rcv_state_process+0x57a/0x2290 net/ipv4/tcp_input.c:6711 tcp_v4_do_rcv+0x764/0xc40 net/ipv4/tcp_ipv4.c:1937 sk_backlog_rcv include/net/sock.h:1106 [inline] __release_sock+0x20f/0x350 net/core/sock.c:2983 release_sock+0x61/0x1f0 net/core/sock.c:3549 mptcp_subflow_shutdown+0x3d0/0x620 net/mptcp/protocol.c:2907 mptcp_check_send_data_fin+0x225/0x410 net/mptcp/protocol.c:2976 __mptcp_close+0x238/0xad0 net/mptcp/protocol.c:3072 mptcp_close+0x2a/0x1a0 net/mptcp/protocol.c:3127 inet_release+0x190/0x1f0 net/ipv4/af_inet.c:437 __sock_release net/socket.c:659 [inline] sock_close+0xc0/0x240 net/socket.c:1421 __fput+0x41b/0x890 fs/file_table.c:422 task_work_run+0x23b/0x300 kernel/task_work.c:180 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0x9c8/0x2540 kernel/exit.c:878 do_group_exit+0x201/0x2b0 kernel/exit.c:1027 __do_sys_exit_group kernel/exit.c:1038 [inline] __se_sys_exit_group kernel/exit.c:1036 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1036 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xe4/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x67/0x6f RIP: 0033:0x7f6c2b5005b6 Code: Unable to access opcode bytes at 0x7f6c2b50058c. RSP: 002b:00007ffe883eb948 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 00007f6c2b5862f0 RCX: 00007f6c2b5005b6 RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001 RBP: 0000000000000001 R08: 00000000000000e7 R09: ffffffffffffffc0 R10: 0000000000000006 R11: 0000000000000246 R12: 00007f6c2b5862f0 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 </TASK>
--- net/ipv4/tcp_dctcp.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
net/ipv4/tcp_dctcp.c +12 -1
@@ -55,7 +55,18 @@ struct dctcp { };static unsigned int dctcp_shift_g__read_mostly =4 ;/* g = 1/2^4 */ -module_param (dctcp_shift_g, uint,0644 ); + +static int dctcp_shift_g_set (const char *val,const struct kernel_param *kp) +{ +return param_set_uint_minmax (val, kp,0 ,10 ); +} + +static const struct kernel_param_ops dctcp_shift_g_ops = { + .set = dctcp_shift_g_set, + .get = param_get_uint, +}; + +module_param_cb (dctcp_shift_g, &dctcp_shift_g_ops, &dctcp_shift_g,0644 );MODULE_PARM_DESC (dctcp_shift_g,"parameter g for updating dctcp_alpha" );static unsigned int dctcp_alpha_on_init__read_mostly =DCTCP_MAX_ALPHA ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 235/317 openvswitch: Set the skbuff pkt_type for proper pmtud support.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Conole <[email protected]>
[ Upstream commit 30a92c9e3d6b073932762bef2ac66f4ee784c657 ]
Open vSwitch is originally intended to switch at layer 2, only dealing with Ethernet frames. With the introduction of l3 tunnels support, it crossed into the realm of needing to care a bit about some routing details when making forwarding decisions. If an oversized packet would need to be fragmented during this forwarding decision, there is a chance for pmtu to get involved and generate a routing exception. This is gated by the skbuff->pkt_type field.
When a flow is already loaded into the openvswitch module this field is set up and transitioned properly as a packet moves from one port to another. In the case that a packet execute is invoked after a flow is newly installed this field is not properly initialized. This causes the pmtud mechanism to omit sending the required exception messages across the tunnel boundary and a second attempt needs to be made to make sure that the routing exception is properly setup. To fix this, we set the outgoing packet's pkt_type to PACKET_OUTGOING, since it can only get to the openvswitch module via a port device or packet command.
Even for bridge ports as users, the pkt_type needs to be reset when doing the transmit as the packet is truly outgoing and routing needs to get involved post packet transformations, in the case of VXLAN/GENEVE/udp-tunnel packets. In general, the pkt_type on output gets ignored, since we go straight to the driver, but in the case of tunnel ports they go through IP routing layer.
This issue is periodically encountered in complex setups, such as large openshift deployments, where multiple sets of tunnel traversal occurs. A way to recreate this is with the ovn-heater project that can setup a networking environment which mimics such large deployments. We need larger environments for this because we need to ensure that flow misses occur. In these environment, without this patch, we can see:
./ovn_cluster.sh start
podman exec ovn-chassis-1 ip r a 170.168.0.5/32 dev eth1 mtu 1200 podman exec ovn-chassis-1 ip netns exec sw01p1 ip r flush cache podman exec ovn-chassis-1 ip netns exec sw01p1 \
ping 21.0.0.3 -M do -s 1300 -c2
PING 21.0.0.3 (21.0.0.3) 1300(1328) bytes of data. From 21.0.0.3 icmp_seq=2 Frag needed and DF set (mtu = 1142)
--- 21.0.0.3 ping statistics ---
...
Using tcpdump, we can also see the expected ICMP FRAG_NEEDED message is not sent into the server.
With this patch, setting the pkt_type, we see the following:
podman exec ovn-chassis-1 ip netns exec sw01p1 \
ping 21.0.0.3 -M do -s 1300 -c2
PING 21.0.0.3 (21.0.0.3) 1300(1328) bytes of data. From 21.0.0.3 icmp_seq=1 Frag needed and DF set (mtu = 1222)
ping: local error: message too long, mtu=1222
--- 21.0.0.3 ping statistics ---
...
In this case, the first ping request receives the FRAG_NEEDED message and a local routing exception is created.
Reported-at: https://issues.redhat.com/browse/FDP-164
--- net/openvswitch/actions.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/openvswitch/actions.c +6 -0
@@ -923,6 +923,12 @@ static void do_output(struct datapath *dp, struct sk_buff *skb, int out_port,pskb_trim (skb,ovs_mac_header_len (key)); } +/* Need to set the pkt_type to involve the routing layer. The +* packet movement through the OVS datapath doesn't generally +* use routing, but this is needed for tunnel cases. +*/ + skb->pkt_type =PACKET_OUTGOING ; +if (likely (!mru || (skb->len <= mru + vport->dev->hard_header_len))) {ovs_vport_send (vport, skb,ovs_key_mac_proto (key));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 236/317 arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiangfeng Xiao <[email protected]>
[ Upstream commit ffbf4fb9b5c12ff878a10ea17997147ea4ebea6f ]
When CONFIG_DEBUG_BUGVERBOSE=n, we fail to add necessary padding bytes to bug_table entries, and as a result the last entry in a bug table will be ignored, potentially leading to an unexpected panic(). All prior entries in the table will be handled correctly.
The arm64 ABI requires that struct fields of up to 8 bytes are naturally-aligned, with padding added within a struct such that struct are suitably aligned within arrays.
When CONFIG_DEBUG_BUGVERPOSE=y, the layout of a bug_entry is:
struct bug_entry {
signed int bug_addr_disp; // 4 bytes
signed int file_disp; // 4 bytes
unsigned short line; // 2 bytes
unsigned short flags; // 2 bytes
}
... with 12 bytes total, requiring 4-byte alignment.
When CONFIG_DEBUG_BUGVERBOSE=n, the layout of a bug_entry is:
struct bug_entry {
signed int bug_addr_disp; // 4 bytes
unsigned short flags; // 2 bytes
< implicit padding > // 2 bytes
}
... with 8 bytes total, with 6 bytes of data and 2 bytes of trailing padding, requiring 4-byte alginment.
When we create a bug_entry in assembly, we align the start of the entry to 4 bytes, which implicitly handles padding for any prior entries. However, we do not align the end of the entry, and so when CONFIG_DEBUG_BUGVERBOSE=n, the final entry lacks the trailing padding bytes.
For the main kernel image this is not a problem as find_bug() doesn't depend on the trailing padding bytes when searching for entries:
for (bug = __start___bug_table; bug < __stop___bug_table; ++bug) if (bugaddr == bug_addr(bug)) return bug;
However for modules, module_bug_finalize() depends on the trailing bytes when calculating the number of entries:
mod->num_bugs = sechdrs[i].sh_size / sizeof(struct bug_entry);
... and as the last bug_entry lacks the necessary padding bytes, this entry will not be counted, e.g. in the case of a single entry:
sechdrs[i].sh_size == 6 sizeof(struct bug_entry) == 8; sechdrs[i].sh_size / sizeof(struct bug_entry) == 0;
Consequently module_find_bug() will miss the last bug_entry when it does:
for (i = 0; i < mod->num_bugs; ++i, ++bug) if (bugaddr == bug_addr(bug)) goto out;
... which can lead to a kenrel panic due to an unhandled bug.
This can be demonstrated with the following module:
static int __init buginit(void)
{
WARN(1, "hello\n");
return 0;
}
static void __exit bugexit(void)
{
}
module_init(buginit);
module_exit(bugexit);
MODULE_LICENSE("GPL");... which will trigger a kernel panic when loaded:
------------[ cut here ]------------ hello Unexpected kernel BRK exception at EL1 Internal error: BRK handler: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: hello(O+) CPU: 0 PID: 50 Comm: insmod Tainted: G O 6.9.1 #8 Hardware name: linux,dummy-virt (DT) pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : buginit+0x18/0x1000 [hello] lr : buginit+0x18/0x1000 [hello] sp : ffff800080533ae0 x29: ffff800080533ae0 x28: 0000000000000000 x27: 0000000000000000 x26: ffffaba8c4e70510 x25: ffff800080533c30 x24: ffffaba8c4a28a58 x23: 0000000000000000 x22: 0000000000000000 x21: ffff3947c0eab3c0 x20: ffffaba8c4e3f000 x19: ffffaba846464000 x18: 0000000000000006 x17: 0000000000000000 x16: ffffaba8c2492834 x15: 0720072007200720 x14: 0720072007200720 x13: ffffaba8c49b27c8 x12: 0000000000000312 x11: 0000000000000106 x10: ffffaba8c4a0a7c8 x9 : ffffaba8c49b27c8 x8 : 00000000ffffefff x7 : ffffaba8c4a0a7c8 x6 : 80000000fffff000 x5 : 0000000000000107 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff3947c0eab3c0 Call trace: buginit+0x18/0x1000 [hello] do_one_initcall+0x80/0x1c8 do_init_module+0x60/0x218 load_module+0x1ba4/0x1d70 __do_sys_init_module+0x198/0x1d0 __arm64_sys_init_module+0x1c/0x28 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xd8 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x190/0x194 Code: d0ffffe0 910003fd 91000000 9400000b (d4210000) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: BRK handler: Fatal exception
Fix this by always aligning the end of a bug_entry to 4 bytes, which is correct regardless of CONFIG_DEBUG_BUGVERBOSE.
--- arch/arm64/include/asm/asm-bug.h | 1 + 1 file changed, 1 insertion(+)
arch/arm64/include/asm/asm-bug.h +1 -0
@@ -28,6 +28,7 @@ 14470: .long 14471f - 14470b; \_BUGVERBOSE_LOCATION (__FILE__, __LINE__) \ .short flags; \ + .align 2; \ .popsection; \ 14471:#else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 237/317 virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Pirko <[email protected]>
[ Upstream commit 89875151fccdd024d571aa884ea97a0128b968b6 ]
When request_irq() fails, error path calls vp_del_vqs(). There, as vq is present in the list, free_irq() is called for the same vector. That causes following splat:
[ 0.414355] Trying to free already-free IRQ 27 [ 0.414403] WARNING: CPU: 1 PID: 1 at kernel/irq/manage.c:1899 free_irq+0x1a1/0x2d0 [ 0.414510] Modules linked in: [ 0.414540] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.9.0-rc4+ #27 [ 0.414540] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014 [ 0.414540] RIP: 0010:free_irq+0x1a1/0x2d0 [ 0.414540] Code: 1e 00 48 83 c4 08 48 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 90 8b 74 24 04 48 c7 c7 98 80 6c b1 e8 00 c9 f7 ff 90 <0f> 0b 90 90 48 89 ee 4c 89 ef e8 e0 20 b8 00 49 8b 47 40 48 8b 40 [ 0.414540] RSP: 0000:ffffb71480013ae0 EFLAGS: 00010086 [ 0.414540] RAX: 0000000000000000 RBX: ffffa099c2722000 RCX: 0000000000000000 [ 0.414540] RDX: 0000000000000000 RSI: ffffb71480013998 RDI: 0000000000000001 [ 0.414540] RBP: 0000000000000246 R08: 00000000ffffdfff R09: 0000000000000001 [ 0.414540] R10: 00000000ffffdfff R11: ffffffffb18729c0 R12: ffffa099c1c91760 [ 0.414540] R13: ffffa099c1c916a4 R14: ffffa099c1d2f200 R15: ffffa099c1c91600 [ 0.414540] FS: 0000000000000000(0000) GS:ffffa099fec40000(0000) knlGS:0000000000000000 [ 0.414540] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 0.414540] CR2: 0000000000000000 CR3: 0000000008e3e001 CR4: 0000000000370ef0 [ 0.414540] Call Trace: [ 0.414540] <TASK> [ 0.414540] ? __warn+0x80/0x120 [ 0.414540] ? free_irq+0x1a1/0x2d0 [ 0.414540] ? report_bug+0x164/0x190 [ 0.414540] ? handle_bug+0x3b/0x70 [ 0.414540] ? exc_invalid_op+0x17/0x70 [ 0.414540] ? asm_exc_invalid_op+0x1a/0x20 [ 0.414540] ? free_irq+0x1a1/0x2d0 [ 0.414540] vp_del_vqs+0xc1/0x220 [ 0.414540] vp_find_vqs_msix+0x305/0x470 [ 0.414540] vp_find_vqs+0x3e/0x1a0 [ 0.414540] vp_modern_find_vqs+0x1b/0x70 [ 0.414540] init_vqs+0x387/0x600 [ 0.414540] virtnet_probe+0x50a/0xc80 [ 0.414540] virtio_dev_probe+0x1e0/0x2b0 [ 0.414540] really_probe+0xc0/0x2c0 [ 0.414540] ? __pfx___driver_attach+0x10/0x10 [ 0.414540] __driver_probe_device+0x73/0x120 [ 0.414540] driver_probe_device+0x1f/0xe0 [ 0.414540] __driver_attach+0x88/0x180 [ 0.414540] bus_for_each_dev+0x85/0xd0 [ 0.414540] bus_add_driver+0xec/0x1f0 [ 0.414540] driver_register+0x59/0x100 [ 0.414540] ? __pfx_virtio_net_driver_init+0x10/0x10 [ 0.414540] virtio_net_driver_init+0x90/0xb0 [ 0.414540] do_one_initcall+0x58/0x230 [ 0.414540] kernel_init_freeable+0x1a3/0x2d0 [ 0.414540] ? __pfx_kernel_init+0x10/0x10 [ 0.414540] kernel_init+0x1a/0x1c0 [ 0.414540] ret_from_fork+0x31/0x50 [ 0.414540] ? __pfx_kernel_init+0x10/0x10 [ 0.414540] ret_from_fork_asm+0x1a/0x30 [ 0.414540] </TASK>
Fix this by calling deleting the current vq when request_irq() fails.
Message-Id: <[email protected]>
--- drivers/virtio/virtio_pci_common.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/virtio/virtio_pci_common.c +3 -1
@@ -339,8 +339,10 @@ static int vp_find_vqs_msix(struct virtio_device *vdev, unsigned nvqs, vring_interrupt,0 , vp_dev->msix_names[msix_vec], vqs[i]); -if (err) +if (err) { +vp_del_vq (vqs[i]); goto error_find; + } }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 238/317 riscv: Cleanup stacktrace
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kefeng Wang <[email protected]>
[ Upstream commit 99c168fccbfedbc10ce1cb2dcb9eb790c478d833 ]
1. add asm/stacktrace.h for walk_stackframe and struct stackframe
2. remove unnecessary blank lines in stacktrace.c
3. fix warning "no previous prototype for ‘fill_callchain’"
Stable-dep-of: a2a4d4a6a0bf ("riscv: stacktrace: fixed walk_stackframe()")
--- arch/riscv/include/asm/stacktrace.h | 17 +++++++++++++++++ arch/riscv/kernel/perf_callchain.c | 10 ++-------- arch/riscv/kernel/stacktrace.c | 9 ++------- 3 files changed, 21 insertions(+), 15 deletions(-) create mode 100644 arch/riscv/include/asm/stacktrace.h
arch/riscv/include/asm/stacktrace.h new file +17 -0
@@ -0,0 +1,17 @@ +/* SPDX-License-Identifier: GPL-2.0 */ + +#ifndef _ASM_RISCV_STACKTRACE_H +#define _ASM_RISCV_STACKTRACE_H + +#include <linux/sched.h> +#include <asm/ptrace.h> + +struct stackframe { +unsigned long fp; +unsigned long ra; +}; + +extern void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs, +bool (*fn)(unsigned long ,void *),void *arg); + +#endif /* _ASM_RISCV_STACKTRACE_H */
arch/riscv/kernel/perf_callchain.c +2 -8
@@ -4,11 +4,7 @@#include <linux/perf_event.h> #include <linux/uaccess.h> -/* Kernel callchain */ -struct stackframe { -unsigned long fp; -unsigned long ra; -}; +#include <asm/stacktrace.h> /* * Get the return address for a single stackframe and return a pointer to the
@@ -75,13 +71,11 @@ void perf_callchain_user(struct perf_callchain_entry_ctx *entry, fp =user_backtrace (entry, fp,0 ); } -bool fill_callchain (unsigned long pc,void *entry) +static bool fill_callchain (unsigned long pc,void *entry) {return perf_callchain_store (entry, pc) ==0 ; } -void notrace walk_stackframe(struct task_struct *task, -struct pt_regs *regs,bool (*fn)(unsigned long ,void *),void *arg);void perf_callchain_kernel (struct perf_callchain_entry_ctx *entry,struct pt_regs *regs) {
arch/riscv/kernel/stacktrace.c +2 -7
@@ -12,15 +12,12 @@#include <linux/stacktrace.h> #include <linux/ftrace.h> +#include <asm/stacktrace.h> + registerunsigned long sp_in_global __asm__("sp" );#ifdef CONFIG_FRAME_POINTER -struct stackframe { -unsigned long fp; -unsigned long ra; -}; - void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs,bool (*fn)(unsigned long ,void *),void *arg) {
@@ -102,7 +99,6 @@ void notrace walk_stackframe(struct task_struct *task,#endif /* CONFIG_FRAME_POINTER */ -static bool print_trace_address (unsigned long pc,void *arg) {const char *loglvl = arg;
@@ -136,7 +132,6 @@ unsigned long get_wchan(struct task_struct *task)return pc; } -#ifdef CONFIG_STACKTRACE static bool __save_trace (unsigned long pc,void *arg,bool nosched)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 239/317 riscv: stacktrace: Make walk_stackframe cross pt_regs frame
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guo Ren <[email protected]>
[ Upstream commit 7ecdadf7f8c659524f6b2aebf6be7bf619764d90 ]
The current walk_stackframe with FRAME_POINTER would stop unwinding at ret_from_exception:
BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1518 in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 1, name: init CPU: 0 PID: 1 Comm: init Not tainted 5.10.113-00021-g15c15974895c-dirty #192 Call Trace: [<ffffffe0002038c8>] walk_stackframe+0x0/0xee [<ffffffe000aecf48>] show_stack+0x32/0x4a [<ffffffe000af1618>] dump_stack_lvl+0x72/0x8e [<ffffffe000af1648>] dump_stack+0x14/0x1c [<ffffffe000239ad2>] ___might_sleep+0x12e/0x138 [<ffffffe000239aec>] __might_sleep+0x10/0x18 [<ffffffe000afe3fe>] down_read+0x22/0xa4 [<ffffffe000207588>] do_page_fault+0xb0/0x2fe [<ffffffe000201b80>] ret_from_exception+0x0/0xc
The optimization would help walk_stackframe cross the pt_regs frame and get more backtrace of debug info:
BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1518 in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 1, name: init CPU: 0 PID: 1 Comm: init Not tainted 5.10.113-00021-g15c15974895c-dirty #192 Call Trace: [<ffffffe0002038c8>] walk_stackframe+0x0/0xee [<ffffffe000aecf48>] show_stack+0x32/0x4a [<ffffffe000af1618>] dump_stack_lvl+0x72/0x8e [<ffffffe000af1648>] dump_stack+0x14/0x1c [<ffffffe000239ad2>] ___might_sleep+0x12e/0x138 [<ffffffe000239aec>] __might_sleep+0x10/0x18 [<ffffffe000afe3fe>] down_read+0x22/0xa4 [<ffffffe000207588>] do_page_fault+0xb0/0x2fe [<ffffffe000201b80>] ret_from_exception+0x0/0xc [<ffffffe000613c06>] riscv_intc_irq+0x1a/0x72 [<ffffffe000201b80>] ret_from_exception+0x0/0xc [<ffffffe00033f44a>] vma_link+0x54/0x160 [<ffffffe000341d7a>] mmap_region+0x2cc/0x4d0 [<ffffffe000342256>] do_mmap+0x2d8/0x3ac [<ffffffe000326318>] vm_mmap_pgoff+0x70/0xb8 [<ffffffe00032638a>] vm_mmap+0x2a/0x36 [<ffffffe0003cfdde>] elf_map+0x72/0x84 [<ffffffe0003d05f8>] load_elf_binary+0x69a/0xec8 [<ffffffe000376240>] bprm_execve+0x246/0x53a [<ffffffe00037786c>] kernel_execve+0xe8/0x124 [<ffffffe000aecdf2>] run_init_process+0xfa/0x10c [<ffffffe000aece16>] try_to_run_init_process+0x12/0x3c [<ffffffe000afa920>] kernel_init+0xb4/0xf8 [<ffffffe000201b80>] ret_from_exception+0x0/0xc
Here is the error injection test code for the above output:
drivers/irqchip/irq-riscv-intc.c:
static asmlinkage void riscv_intc_irq(struct pt_regs *regs)
{
unsigned long cause = regs->cause & ~CAUSE_IRQ_FLAG;+ u32 tmp; __get_user(tmp, (u32 *)0);
Stable-dep-of: a2a4d4a6a0bf ("riscv: stacktrace: fixed walk_stackframe()")
--- arch/riscv/kernel/entry.S | 3 ++- arch/riscv/kernel/stacktrace.c | 9 +++++++++ 2 files changed, 11 insertions(+), 1 deletion(-)
arch/riscv/kernel/entry.S +2 -1
@@ -218,7 +218,7 @@ ret_from_syscall_rejected: andi t0, t0, _TIF_SYSCALL_WORK bnez t0, handle_syscall_trace_exit -ret_from_exception: +SYM_CODE_START_NOALIGN(ret_from_exception) REG_L s0, PT_STATUS(sp) csrc CSR_STATUS, SR_IE #ifdef CONFIG_TRACE_IRQFLAGS
@@ -232,6 +232,7 @@ ret_from_exception: andi s0, s0, SR_SPP #endif bnez s0, resume_kernel +SYM_CODE_END(ret_from_exception) resume_userspace: /* Interrupts must be disabled here so flags are checked atomically */
arch/riscv/kernel/stacktrace.c +9 -0
@@ -18,6 +18,8 @@ register unsigned long sp_in_global __asm__("sp");#ifdef CONFIG_FRAME_POINTER +extern asmlinkage void ret_from_exception(void); + void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs,bool (*fn)(unsigned long ,void *),void *arg) {
@@ -61,6 +63,13 @@ void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs, fp = frame->fp; pc =ftrace_graph_ret_addr (current,NULL , frame->ra, &frame->ra); +if (pc == (unsigned long )ret_from_exception) { +if (unlikely (!__kernel_text_address (pc) || !fn (arg, pc))) +break ; + + pc = ((struct pt_regs *)sp)->epc; + fp = ((struct pt_regs *)sp)->s0; + } } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 240/317 riscv: stacktrace: fixed walk_stackframe()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Bystrin <[email protected]>
[ Upstream commit a2a4d4a6a0bf5eba66f8b0b32502cc20d82715a0 ]
If the load access fault occures in a leaf function (with CONFIG_FRAME_POINTER=y), when wrong stack trace will be displayed:
[<ffffffff804853c2>] regmap_mmio_read32le+0xe/0x1c ---[ end trace 0000000000000000 ]---
Registers dump:
ra 0xffffffff80485758 <regmap_mmio_read+36>
sp 0xffffffc80200b9a0
fp 0xffffffc80200b9b0
pc 0xffffffff804853ba <regmap_mmio_read32le+6>Stack dump:
0xffffffc80200b9a0: 0xffffffc80200b9e0 0xffffffc80200b9e0
0xffffffc80200b9b0: 0xffffffff8116d7e8 0x0000000000000100
0xffffffc80200b9c0: 0xffffffd8055b9400 0xffffffd8055b9400
0xffffffc80200b9d0: 0xffffffc80200b9f0 0xffffffff8047c526
0xffffffc80200b9e0: 0xffffffc80200ba30 0xffffffff8047fe9aThe assembler dump of the function preambula:
add sp,sp,-16
sd s0,8(sp)
add s0,sp,16In the fist stack frame, where ra is not stored on the stack we can observe:
0(sp) 8(sp)
.---------------------------------------------.
sp->| frame->fp | frame->ra (saved fp) |
|---------------------------------------------|
fp->| .... | .... |
|---------------------------------------------|
| | |and in the code check is performed:
if (regs && (regs->epc == pc) && (frame->fp & 0x7))
I see no reason to check frame->fp value at all, because it is can be uninitialized value on the stack. A better way is to check frame->ra to be an address on the stack. After the stacktrace shows as expect:
[<ffffffff804853c2>] regmap_mmio_read32le+0xe/0x1c [<ffffffff80485758>] regmap_mmio_read+0x24/0x52 [<ffffffff8047c526>] _regmap_bus_reg_read+0x1a/0x22 [<ffffffff8047fe9a>] _regmap_read+0x5c/0xea [<ffffffff80480376>] _regmap_update_bits+0x76/0xc0 ... ---[ end trace 0000000000000000 ]---
As pointed by Samuel Holland it is incorrect to remove check of the stackframe entirely.
Changes since v2 [2]:
- Add accidentally forgotten curly brace
Changes since v1 [1]:
- Instead of just dropping frame->fp check, replace it with validation of frame->ra, which should be a stack address.
- Move frame pointer validation into the separate function.
[1] https://lore.kernel.org/linux-riscv/[email protected]/
[2] https://lore.kernel.org/linux-riscv/[email protected]/
--- arch/riscv/kernel/stacktrace.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
arch/riscv/kernel/stacktrace.c +14 -6
@@ -20,6 +20,16 @@ register unsigned long sp_in_global __asm__("sp"); extern asmlinkage void ret_from_exception(void); +static inline int fp_is_valid (unsigned long fp,unsigned long sp) +{ +unsigned long low, high; + + low = sp +sizeof (struct stackframe ); + high =ALIGN (sp,THREAD_SIZE ); + +return !(fp < low || fp > high || fp &0x07 ); +} + void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs,bool (*fn)(unsigned long ,void *),void *arg) {
@@ -42,21 +52,19 @@ void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs, }for (;;) { -unsigned long low, high;struct stackframe *frame;if (unlikely (!__kernel_text_address (pc) ||fn (pc, arg)))break ; -/* Validate frame pointer */ - low = sp +sizeof (struct stackframe ); - high =ALIGN (sp,THREAD_SIZE ); -if (unlikely (fp < low || fp > high || fp &0x7 )) +if (unlikely (!fp_is_valid (fp, sp)))break ; +/* Unwind stack frame */ frame = (struct stackframe *)fp -1 ; sp = fp; -if (regs && (regs->epc == pc) && (frame->fp &0x7 )) { +if (regs && (regs->epc == pc) &&fp_is_valid (frame->ra, sp)) { +/* We hit function where ra is not saved on the stack */ fp = frame->ra; pc = regs->ra; }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 241/317 net: fec: avoid lock evasion when reading pps_enable
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit 3b1c92f8e5371700fada307cc8fd2c51fa7bc8c1 ]
The assignment of pps_enable is protected by tmreg_lock, but the read operation of pps_enable is not. So the Coverity tool reports a lock evasion warning which may cause data race to occur when running in a multithread environment. Although this issue is almost impossible to occur, we'd better fix it, at least it seems more logically reasonable, and it also prevents Coverity from continuing to issue warnings.
--- drivers/net/ethernet/freescale/fec_ptp.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/net/ethernet/freescale/fec_ptp.c +8 -6
@@ -103,14 +103,13 @@ static int fec_ptp_enable_pps(struct fec_enet_private *fep, uint enable)u64 ns; val =0 ; -if (fep->pps_enable == enable) -return 0 ; - - fep->pps_channel =DEFAULT_PPS_CHANNEL ; - fep->reload_period =PPS_OUPUT_RELOAD_PERIOD ; -spin_lock_irqsave (&fep->tmreg_lock, flags); +if (fep->pps_enable == enable) { +spin_unlock_irqrestore (&fep->tmreg_lock, flags); +return 0 ; + } +if (enable) {/* clear capture or output compare interrupt status if have. */
@@ -441,6 +440,9 @@ static int fec_ptp_enable(struct ptp_clock_info *ptp,int ret =0 ;if (rq->type ==PTP_CLK_REQ_PPS ) { + fep->pps_channel =DEFAULT_PPS_CHANNEL ; + fep->reload_period =PPS_OUPUT_RELOAD_PERIOD ; + ret =fec_ptp_enable_pps (fep, on);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 242/317 tls: fix missing memory barrier in tls_init
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dae R. Jeong <[email protected]>
[ Upstream commit 91e61dd7a0af660408e87372d8330ceb218be302 ]
In tls_init(), a write memory barrier is missing, and store-store reordering may cause NULL dereference in tls_{setsockopt,getsockopt}.
CPU0 CPU1
----- -----
// In tls_init()
// In tls_ctx_create()
ctx = kzalloc()ctx->sk_proto = READ_ONCE(sk->sk_prot) -(1)
// In update_sk_prot()WRITE_ONCE(sk->sk_prot, tls_prots) -(2)
// In sock_common_setsockopt()
READ_ONCE(sk->sk_prot)->setsockopt()
// In tls_{setsockopt,getsockopt}()
ctx->sk_proto->setsockopt() -(3)In the above scenario, when (1) and (2) are reordered, (3) can observe the NULL value of ctx->sk_proto, causing NULL dereference.
To fix it, we rely on rcu_assign_pointer() which implies the release barrier semantic. By moving rcu_assign_pointer() after ctx->sk_proto is initialized, we can ensure that ctx->sk_proto are visible when changing sk->sk_prot.
--- net/tls/tls_main.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
net/tls/tls_main.c +9 -1
@@ -633,9 +633,17 @@ struct tls_context *tls_ctx_create(struct sock *sk)return NULL ;mutex_init (&ctx->tx_lock); -rcu_assign_pointer (icsk->icsk_ulp_data, ctx); ctx->sk_proto =READ_ONCE (sk->sk_prot); ctx->sk = sk; +/* Release semantic of rcu_assign_pointer() ensures that +* ctx->sk_proto is visible before changing sk->sk_prot in +* update_sk_prot(), and prevents reading uninitialized value in +* tls_{getsockopt, setsockopt}. Note that we do not need a +* read barrier in tls_{getsockopt,setsockopt} as there is an +* address dependency between sk->sk_proto->{getsockopt,setsockopt} +* and ctx->sk_proto. +*/ +rcu_assign_pointer (icsk->icsk_ulp_data, ctx);return ctx; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 243/317 nfc: nci: Fix kcov check in nci_rx_work()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit 19e35f24750ddf860c51e51c68cf07ea181b4881 ]
Commit 7e8cdc97148c ("nfc: Add KCOV annotations") added kcov_remote_start_common()/kcov_remote_stop() pair into nci_rx_work(), with an assumption that kcov_remote_stop() is called upon continue of the for loop. But commit d24b03535e5e ("nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet") forgot to call kcov_remote_stop() before break of the for loop.
Stable-dep-of: 6671e352497c ("nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()")
--- net/nfc/nci/core.c | 1 + 1 file changed, 1 insertion(+)
net/nfc/nci/core.c +1 -0
@@ -1517,6 +1517,7 @@ static void nci_rx_work(struct work_struct *work)if (!nci_valid_size (skb)) {kfree_skb (skb); +kcov_remote_stop ();break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 244/317 nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryosuke Yasuoka <[email protected]>
[ Upstream commit 6671e352497ca4bb07a96c48e03907065ff77d8a ]
When nci_rx_work() receives a zero-length payload packet, it should not discard the packet and exit the loop. Instead, it should continue processing subsequent packets.
--- net/nfc/nci/core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/nfc/nci/core.c +1 -2
@@ -1517,8 +1517,7 @@ static void nci_rx_work(struct work_struct *work)if (!nci_valid_size (skb)) {kfree_skb (skb); -kcov_remote_stop (); -break ; +continue ; }/* Process frame */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 245/317 netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit dc21c6cc3d6986d938efbf95de62473982c98dec ]
syzbot reported that nf_reinject() could be called without rcu_read_lock() :
WARNING: suspicious RCU usage 6.9.0-rc7-syzkaller-02060-g5c1672705a1a #0 Not tainted
net/netfilter/nfnetlink_queue.c:263 suspicious rcu_dereference_check() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
2 locks held by syz-executor.4/13427:
#0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2190 [inline] #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_core+0xa86/0x1830 kernel/rcu/tree.c:2471 #1: ffff88801ca92958 (&inst->lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline] #1: ffff88801ca92958 (&inst->lock){+.-.}-{2:2}, at: nfqnl_flush net/netfilter/nfnetlink_queue.c:405 [inline] #1: ffff88801ca92958 (&inst->lock){+.-.}-{2:2}, at: instance_destroy_rcu+0x30/0x220 net/netfilter/nfnetlink_queue.c:172
stack backtrace: CPU: 0 PID: 13427 Comm: syz-executor.4 Not tainted 6.9.0-rc7-syzkaller-02060-g5c1672705a1a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712 nf_reinject net/netfilter/nfnetlink_queue.c:323 [inline] nfqnl_reinject+0x6ec/0x1120 net/netfilter/nfnetlink_queue.c:397 nfqnl_flush net/netfilter/nfnetlink_queue.c:410 [inline] instance_destroy_rcu+0x1ae/0x220 net/netfilter/nfnetlink_queue.c:172 rcu_do_batch kernel/rcu/tree.c:2196 [inline] rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2471 handle_softirqs+0x2d6/0x990 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 </IRQ> <TASK>
--- net/netfilter/nfnetlink_queue.c | 2 ++ 1 file changed, 2 insertions(+)
net/netfilter/nfnetlink_queue.c +2 -0
@@ -167,7 +167,9 @@ instance_destroy_rcu(struct rcu_head *head) struct nfqnl_instance *inst = container_of(head, struct nfqnl_instance, rcu); +rcu_read_lock ();nfqnl_flush (inst,NULL ,0 ); +rcu_read_unlock ();kfree (inst);module_put (THIS_MODULE ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 246/317 netfilter: nft_payload: restore vlan q-in-q match support
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit aff5c01fa1284d606f8e7cbdaafeef2511bb46c1 ]
Revert f6ae9f120dad ("netfilter: nft_payload: add C-VLAN support").
f41f72d09ee1 ("netfilter: nft_payload: simplify vlan header handling") already allows to match on inner vlan tags by subtract the vlan header size to the payload offset which has been popped and stored in skbuff metadata fields.
--- net/netfilter/nft_payload.c | 23 +++++++---------------- 1 file changed, 7 insertions(+), 16 deletions(-)
net/netfilter/nft_payload.c +7 -16
@@ -44,36 +44,27 @@ nft_payload_copy_vlan(u32 *d, const struct sk_buff *skb, u8 offset, u8 len)int mac_off =skb_mac_header (skb) - skb->data;u8 *vlanh, *dst_u8 = (u8 *) d;struct vlan_ethhdr veth; -u8 vlan_hlen =0 ; - -if ((skb->protocol ==htons (ETH_P_8021AD ) || - skb->protocol ==htons (ETH_P_8021Q )) && - offset >=VLAN_ETH_HLEN && offset <VLAN_ETH_HLEN +VLAN_HLEN ) - vlan_hlen +=VLAN_HLEN ; vlanh = (u8 *) &veth; -if (offset <VLAN_ETH_HLEN + vlan_hlen) { +if (offset <VLAN_ETH_HLEN ) {u8 ethlen = len; -if (vlan_hlen && -skb_copy_bits (skb, mac_off, &veth,VLAN_ETH_HLEN ) <0 ) -return false; -else if (!nft_payload_rebuild_vlan_hdr (skb, mac_off, &veth)) +if (!nft_payload_rebuild_vlan_hdr (skb, mac_off, &veth))return false; -if (offset + len >VLAN_ETH_HLEN + vlan_hlen) - ethlen -= offset + len -VLAN_ETH_HLEN - vlan_hlen; +if (offset + len >VLAN_ETH_HLEN ) + ethlen -= offset + len -VLAN_ETH_HLEN ; -memcpy (dst_u8, vlanh + offset - vlan_hlen, ethlen); +memcpy (dst_u8, vlanh + offset, ethlen); len -= ethlen;if (len ==0 )return true; dst_u8 += ethlen; - offset =ETH_HLEN + vlan_hlen; + offset =ETH_HLEN ; }else { - offset -=VLAN_HLEN + vlan_hlen; + offset -=VLAN_HLEN ; }return skb_copy_bits (skb, offset + mac_off, dst_u8, len) ==0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 247/317 spi: Dont mark message DMA mapped when no transfer in it is
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 9f788ba457b45b0ce422943fcec9fa35c4587764 ]
There is no need to set the DMA mapped flag of the message if it has no mapped transfers. Moreover, it may give the code a chance to take the wrong paths, i.e. to exercise DMA related APIs on unmapped data. Make __spi_map_msg() to bail earlier on the above mentioned cases.
--- drivers/spi/spi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/spi/spi.c +4 -0
@@ -970,6 +970,7 @@ static int __spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg)else rx_dev = ctlr->dev.parent; + ret = -ENOMSG ;list_for_each_entry (xfer, &msg->transfers, transfer_list) {if (!ctlr->can_dma (ctlr, msg->spi, xfer))continue ;
@@ -993,6 +994,9 @@ static int __spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg) } } } +/* No transfer has been mapped, bail out with success */ +if (ret) +return 0 ; ctlr->cur_msg_mapped = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 248/317 nvmet: fix ns enable/disable possible hang
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Grimberg <[email protected]>
[ Upstream commit f97914e35fd98b2b18fb8a092e0a0799f73afdfe ]
When disabling an nvmet namespace, there is a period where the subsys->lock is released, as the ns disable waits for backend IO to complete, and the ns percpu ref to be properly killed. The original intent was to avoid taking the subsystem lock for a prolong period as other processes may need to acquire it (for example new incoming connections).
However, it opens up a window where another process may come in and enable the ns, (re)intiailizing the ns percpu_ref, causing the disable sequence to hang.
Solve this by taking the global nvmet_config_sem over the entire configfs enable/disable sequence.
--- drivers/nvme/target/configfs.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/nvme/target/configfs.c +8 -0
@@ -532,10 +532,18 @@ static ssize_t nvmet_ns_enable_store(struct config_item *item,if (strtobool (page, &enable))return -EINVAL ; +/* +* take a global nvmet_config_sem because the disable routine has a +* window where it releases the subsys-lock, giving a chance to +* a parallel enable to concurrently execute causing the disable to +* have a misaccounting of the ns percpu_ref. +*/ +down_write (&nvmet_config_sem);if (enable) ret =nvmet_ns_enable (ns);else nvmet_ns_disable (ns); +up_write (&nvmet_config_sem);return ret ? ret : count; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 249/317 net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carolina Jubran <[email protected]>
[ Upstream commit 5c74195d5dd977e97556e6fa76909b831c241230 ]
Previously, the driver incorrectly used rx_dropped to report device buffer exhaustion.
According to the documentation, rx_dropped should not be used to count packets dropped due to buffer exhaustion, which is the purpose of rx_missed_errors.
Use rx_missed_errors as intended for counting packets dropped due to buffer exhaustion.
--- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +1 -1
@@ -3695,7 +3695,7 @@ mlx5e_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats)mlx5e_fold_sw_stats64 (priv, stats); } - stats->rx_dropped = priv->stats.qcnt.rx_out_of_buffer; + stats->rx_missed_errors = priv->stats.qcnt.rx_out_of_buffer; stats->rx_length_errors = PPORT_802_3_GET(pstats, a_in_range_length_errors) +
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 250/317 dma-buf/sw-sync: dont enable IRQ from sync_print_obj()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit b794918961516f667b0c745aebdfebbb8a98df39 ]
Since commit a6aa8fca4d79 ("dma-buf/sw-sync: Reduce irqsave/irqrestore from known context") by error replaced spin_unlock_irqrestore() with spin_unlock_irq() for both sync_debugfs_show() and sync_print_obj() despite sync_print_obj() is called from sync_debugfs_show(), lockdep complains inconsistent lock state warning.
Use plain spin_{lock,unlock}() for sync_print_obj(), for sync_debugfs_show() is already using spin_{lock,unlock}_irq().
--- drivers/dma-buf/sync_debug.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/dma-buf/sync_debug.c +2 -2
@@ -110,12 +110,12 @@ static void sync_print_obj(struct seq_file *s, struct sync_timeline *obj)seq_printf (s,"%s: %d\n" , obj->name, obj->value); -spin_lock_irq (&obj->lock); +spin_lock (&obj->lock);/* Caller already disabled IRQ. */ list_for_each (pos, &obj->pt_list) { struct sync_pt *pt = container_of(pos, struct sync_pt, link);sync_print_fence (s, &pt->base, false); } -spin_unlock_irq (&obj->lock); +spin_unlock (&obj->lock); } static void sync_print_sync_file(struct seq_file *s,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 251/317 bpf: Fix potential integer overflow in resolve_btfids
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Friedrich Vock <[email protected]>
[ Upstream commit 44382b3ed6b2787710c8ade06c0e97f5970a47c8 ]
err is a 32-bit integer, but elf_update returns an off_t, which is 64-bit at least on 64-bit platforms. If symbols_patch is called on a binary between 2-4GB in size, the result will be negative when cast to a 32-bit integer, which the code assumes means an error occurred. This can wrongly trigger build failures when building very large kernel images.
--- tools/bpf/resolve_btfids/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/bpf/resolve_btfids/main.c +1 -1
@@ -637,7 +637,7 @@ static int sets_patch(struct object *obj)static int symbols_patch (struct object *obj) { -int err; +off_t err; if (__symbols_patch(obj, &obj->structs) || __symbols_patch(obj, &obj->unions) ||
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 252/317 enic: Validate length of nl attributes in enic_set_vf_port
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roded Zats <[email protected]>
[ Upstream commit e8021b94b0412c37bcc79027c2e382086b6ce449 ]
enic_set_vf_port assumes that the nl attribute IFLA_PORT_PROFILE is of length PORT_PROFILE_MAX and that the nl attributes IFLA_PORT_INSTANCE_UUID, IFLA_PORT_HOST_UUID are of length PORT_UUID_MAX. These attributes are validated (in the function do_setlink in rtnetlink.c) using the nla_policy ifla_port_policy. The policy defines IFLA_PORT_PROFILE as NLA_STRING, IFLA_PORT_INSTANCE_UUID as NLA_BINARY and IFLA_PORT_HOST_UUID as NLA_STRING. That means that the length validation using the policy is for the max size of the attributes and not on exact size so the length of these attributes might be less than the sizes that enic_set_vf_port expects. This might cause an out of bands
read access in the memcpys of the data of these
attributes in enic_set_vf_port.
--- drivers/net/ethernet/cisco/enic/enic_main.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/net/ethernet/cisco/enic/enic_main.c +12 -0
@@ -1117,18 +1117,30 @@ static int enic_set_vf_port(struct net_device *netdev, int vf, pp->request =nla_get_u8 (port[IFLA_PORT_REQUEST ]);if (port[IFLA_PORT_PROFILE ]) { +if (nla_len (port[IFLA_PORT_PROFILE ]) !=PORT_PROFILE_MAX ) { +memcpy (pp, &prev_pp,sizeof (*pp)); +return -EINVAL ; + } pp->set |=ENIC_SET_NAME ;memcpy (pp->name,nla_data (port[IFLA_PORT_PROFILE ]),PORT_PROFILE_MAX ); }if (port[IFLA_PORT_INSTANCE_UUID ]) { +if (nla_len (port[IFLA_PORT_INSTANCE_UUID ]) !=PORT_UUID_MAX ) { +memcpy (pp, &prev_pp,sizeof (*pp)); +return -EINVAL ; + } pp->set |=ENIC_SET_INSTANCE ;memcpy (pp->instance_uuid,nla_data (port[IFLA_PORT_INSTANCE_UUID ]),PORT_UUID_MAX ); }if (port[IFLA_PORT_HOST_UUID ]) { +if (nla_len (port[IFLA_PORT_HOST_UUID ]) !=PORT_UUID_MAX ) { +memcpy (pp, &prev_pp,sizeof (*pp)); +return -EINVAL ; + } pp->set |=ENIC_SET_HOST ;memcpy (pp->host_uuid,nla_data (port[IFLA_PORT_HOST_UUID ]),PORT_UUID_MAX );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 253/317 net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Parthiban Veerasooran <[email protected]>
[ Upstream commit 52a2f0608366a629d43dacd3191039c95fef74ba ]
LED Select (LED_SEL) bit in the LED General Purpose IO Configuration register is used to determine the functionality of external LED pins (Speed Indicator, Link and Activity Indicator, Full Duplex Link Indicator). The default value for this bit is 0 when no EEPROM is present. If a EEPROM is present, the default value is the value of the LED Select bit in the Configuration Flags of the EEPROM. A USB Reset or Lite Reset (LRST) will cause this bit to be restored to the image value last loaded from EEPROM, or to be set to 0 if no EEPROM is present.
While configuring the dual purpose GPIO/LED pins to LED outputs in the LED General Purpose IO Configuration register, the LED_SEL bit is changed as 0 and resulting the configured value from the EEPROM is cleared. The issue is fixed by using read-modify-write approach.
--- drivers/net/usb/smsc95xx.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/net/usb/smsc95xx.c +7 -4
@@ -845,7 +845,7 @@ static int smsc95xx_start_rx_path(struct usbnet *dev, int in_pm)static int smsc95xx_reset (struct usbnet *dev) {struct smsc95xx_priv *pdata = dev->driver_priv; -u32 read_buf, write_buf, burst_cap; +u32 read_buf, burst_cap;int ret =0 , timeout;netif_dbg (dev, ifup, dev->net,"entering smsc95xx_reset\n" );
@@ -987,10 +987,13 @@ static int smsc95xx_reset(struct usbnet *dev)return ret;netif_dbg (dev, ifup, dev->net,"ID_REV = 0x%08x\n" , read_buf); + ret =smsc95xx_read_reg (dev,LED_GPIO_CFG , &read_buf); +if (ret <0 ) +return ret;/* Configure GPIO pins as LED outputs */ - write_buf =LED_GPIO_CFG_SPD_LED |LED_GPIO_CFG_LNK_LED | -LED_GPIO_CFG_FDX_LED ; - ret =smsc95xx_write_reg (dev,LED_GPIO_CFG , write_buf); + read_buf |=LED_GPIO_CFG_SPD_LED |LED_GPIO_CFG_LNK_LED | +LED_GPIO_CFG_FDX_LED ; + ret =smsc95xx_write_reg (dev,LED_GPIO_CFG , read_buf);if (ret <0 )return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 254/317 bpf: Allow delete from sockmap/sockhash only if update is allowed
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Sitnicki <[email protected]>
[ Upstream commit 98e948fb60d41447fd8d2d0c3b8637fc6b6dc26d ]
We have seen an influx of syzkaller reports where a BPF program attached to a tracepoint triggers a locking rule violation by performing a map_delete on a sockmap/sockhash.
We don't intend to support this artificial use scenario. Extend the existing verifier allowed-program-type check for updating sockmap/sockhash to also cover deleting from a map.
Quoted 1 line
From now on only BPF programs which were previously allowed to update
sockmap/sockhash can delete from these map types.
--- kernel/bpf/verifier.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
kernel/bpf/verifier.c +7 -3
@@ -4890,7 +4890,8 @@ static bool may_update_sockmap(struct bpf_verifier_env *env, int func_id)enum bpf_attach_type eatype = env->prog->expected_attach_type;enum bpf_prog_type type =resolve_prog_type (env->prog); -if (func_id != BPF_FUNC_map_update_elem) +if (func_id != BPF_FUNC_map_update_elem && + func_id != BPF_FUNC_map_delete_elem)return false;/* It's not possible to get access to a locked struct sock in these
@@ -4901,6 +4902,11 @@ static bool may_update_sockmap(struct bpf_verifier_env *env, int func_id)if (eatype ==BPF_TRACE_ITER )return true;break ; +case BPF_PROG_TYPE_SOCK_OPS : +/* map_update allowed only via dedicated helpers with event type checks */ +if (func_id == BPF_FUNC_map_delete_elem) +return true; +break ;case BPF_PROG_TYPE_SOCKET_FILTER :case BPF_PROG_TYPE_SCHED_CLS :case BPF_PROG_TYPE_SCHED_ACT :
@@ -4988,7 +4994,6 @@ static int check_map_func_compatibility(struct bpf_verifier_env *env,case BPF_MAP_TYPE_SOCKMAP : if (func_id != BPF_FUNC_sk_redirect_map && func_id != BPF_FUNC_sock_map_update && - func_id != BPF_FUNC_map_delete_elem && func_id != BPF_FUNC_msg_redirect_map && func_id != BPF_FUNC_sk_select_reuseport && func_id != BPF_FUNC_map_lookup_elem &&
@@ -4998,7 +5003,6 @@ static int check_map_func_compatibility(struct bpf_verifier_env *env,case BPF_MAP_TYPE_SOCKHASH : if (func_id != BPF_FUNC_sk_redirect_hash && func_id != BPF_FUNC_sock_hash_update && - func_id != BPF_FUNC_map_delete_elem && func_id != BPF_FUNC_msg_redirect_hash && func_id != BPF_FUNC_sk_select_reuseport && func_id != BPF_FUNC_map_lookup_elem &&
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 255/317 net:fec: Add fec_enet_deinit()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaolei Wang <[email protected]>
[ Upstream commit bf0497f53c8535f99b72041529d3f7708a6e2c0d ]
When fec_probe() fails or fec_drv_remove() needs to release the fec queue and remove a NAPI context, therefore add a function corresponding to fec_enet_init() and call fec_enet_deinit() which does the opposite to release memory and remove a NAPI context.
--- drivers/net/ethernet/freescale/fec_main.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/ethernet/freescale/fec_main.c +10 -0
@@ -3443,6 +3443,14 @@ static int fec_enet_init(struct net_device *ndev)return ret; } +static void fec_enet_deinit (struct net_device *ndev) +{ +struct fec_enet_private *fep =netdev_priv (ndev); + +netif_napi_del (&fep->napi); +fec_enet_free_queue (ndev); +} +#ifdef CONFIG_OF static int fec_reset_phy (struct platform_device *pdev) {
@@ -3813,6 +3821,7 @@ fec_probe(struct platform_device *pdev)fec_enet_mii_remove (fep); failed_mii_init: failed_irq: +fec_enet_deinit (ndev); failed_init:fec_ptp_stop (pdev); failed_reset:
@@ -3874,6 +3883,7 @@ fec_drv_remove(struct platform_device *pdev)pm_runtime_put_noidle (&pdev->dev);pm_runtime_disable (&pdev->dev); +fec_enet_deinit (ndev);free_netdev (ndev);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 256/317 netfilter: tproxy: bail out if IP has been disabled on the device
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 21a673bddc8fd4873c370caf9ae70ffc6d47e8d3 ]
syzbot reports:
general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] [..] RIP: 0010:nf_tproxy_laddr4+0xb7/0x340 net/ipv4/netfilter/nf_tproxy_ipv4.c:62 Call Trace: nft_tproxy_eval_v4 net/netfilter/nft_tproxy.c:56 [inline] nft_tproxy_eval+0xa9a/0x1a00 net/netfilter/nft_tproxy.c:168
__in_dev_get_rcu() can return NULL, so check for this.
--- net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 ++ 1 file changed, 2 insertions(+)
net/ipv4/netfilter/nf_tproxy_ipv4.c +2 -0
@@ -58,6 +58,8 @@ __be32 nf_tproxy_laddr4(struct sk_buff *skb, __be32 user_laddr, __be32 daddr) laddr =0 ; indev =__in_dev_get_rcu (skb->dev); +if (!indev) +return daddr;in_dev_for_each_ifa_rcu (ifa, indev) {if (ifa->ifa_flags &IFA_F_SECONDARY )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 257/317 kconfig: fix comparison to constant symbols, m, n
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit aabdc960a283ba78086b0bf66ee74326f49e218e ]
Currently, comparisons to 'm' or 'n' result in incorrect output.
[Test Code]
config MODULES
def_bool y
modules
config A
def_tristate m
config B
def_bool A > n
CONFIG_B is unset, while CONFIG_B=y is expected.
The reason for the issue is because Kconfig compares the tristate values as strings.
Currently, the .type fields in the constant symbol definitions, symbol_{yes,mod,no} are unspecified, i.e., S_UNKNOWN.
When expr_calc_value() evaluates 'A > n', it checks the types of 'A' and 'n' to determine how to compare them.
The left-hand side, 'A', is a tristate symbol with a value of 'm', which corresponds to a numeric value of 1. (Internally, 'y', 'm', and 'n' are represented as 2, 1, and 0, respectively.)
The right-hand side, 'n', has an unknown type, so it is treated as the string "n" during the comparison.
expr_calc_value() compares two values numerically only when both can have numeric values. Otherwise, they are compared as strings.
symbol numeric value ASCII code
-------------------------------------
y 2 0x79
m 1 0x6d
n 0 0x6e'm' is greater than 'n' if compared numerically (since 1 is greater than 0), but smaller than 'n' if compared as strings (since the ASCII code 0x6d is smaller than 0x6e).
Specifying .type=S_TRISTATE for symbol_{yes,mod,no} fixes the above test code.
Doing so, however, would cause a regression to the following test code.
[Test Code 2]
config MODULES
def_bool n
modules
config A
def_tristate n
config B
def_bool A = m
You would get CONFIG_B=y, while CONFIG_B should not be set.
The reason is because sym_get_string_value() turns 'm' into 'n' when the module feature is disabled. Consequently, expr_calc_value() evaluates 'A = n' instead of 'A = m'. This oddity has been hidden because the type of 'm' was previously S_UNKNOWN instead of S_TRISTATE.
sym_get_string_value() should not tweak the string because the tristate value has already been correctly calculated. There is no reason to return the string "n" where its tristate value is mod.
--- scripts/kconfig/symbol.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
scripts/kconfig/symbol.c +4 -2
@@ -13,18 +13,21 @@struct symbol symbol_yes = { .name ="y" , + .type =S_TRISTATE , .curr = {"y" , yes }, .flags =SYMBOL_CONST |SYMBOL_VALID , };struct symbol symbol_mod = { .name ="m" , + .type =S_TRISTATE , .curr = {"m" , mod }, .flags =SYMBOL_CONST |SYMBOL_VALID , };struct symbol symbol_no = { .name ="n" , + .type =S_TRISTATE , .curr = {"n" , no }, .flags =SYMBOL_CONST |SYMBOL_VALID , };
@@ -776,8 +779,7 @@ const char *sym_get_string_value(struct symbol *sym)case no:return "n" ;case mod: -sym_calc_value (modules_sym); -return (modules_sym->curr.tri == no) ?"n" :"m" ; +return "m" ;case yes:return "y" ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 258/317 spi: stm32: Dont warn about spurious interrupts
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 95d7c452a26564ef0c427f2806761b857106d8c4 ]
The dev_warn to notify about a spurious interrupt was introduced with the reasoning that these are unexpected. However spurious interrupts tend to trigger continously and the error message on the serial console prevents that the core's detection of spurious interrupts kicks in (which disables the irq) and just floods the console.
--- drivers/spi/spi-stm32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-stm32.c +1 -1
@@ -931,7 +931,7 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id) mask |=STM32H7_SPI_SR_TXP |STM32H7_SPI_SR_RXP ;if (!(sr & mask)) { -dev_warn (spi->dev,"spurious IT (sr=0x%08x, ier=0x%08x)\n" , +dev_vdbg (spi->dev,"spurious IT (sr=0x%08x, ier=0x%08x)\n" , sr, ier);spin_unlock_irqrestore (&spi->lock, flags);return IRQ_NONE ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 259/317 ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yue Haibing <[email protected]>
[ Upstream commit b3dc6e8003b500861fa307e9a3400c52e78e4d3a ]
Raw packet from PF_PACKET socket ontop of an IPv6-backed ipvlan device will hit WARN_ON_ONCE() in sk_mc_loop() through sch_direct_xmit() path.
WARNING: CPU: 2 PID: 0 at net/core/sock.c:775 sk_mc_loop+0x2d/0x70 Modules linked in: sch_netem ipvlan rfkill cirrus drm_shmem_helper sg drm_kms_helper CPU: 2 PID: 0 Comm: swapper/2 Kdump: loaded Not tainted 6.9.0+ #279 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:sk_mc_loop+0x2d/0x70 Code: fa 0f 1f 44 00 00 65 0f b7 15 f7 96 a3 4f 31 c0 66 85 d2 75 26 48 85 ff 74 1c RSP: 0018:ffffa9584015cd78 EFLAGS: 00010212 RAX: 0000000000000011 RBX: ffff91e585793e00 RCX: 0000000002c6a001 RDX: 0000000000000000 RSI: 0000000000000040 RDI: ffff91e589c0f000 RBP: ffff91e5855bd100 R08: 0000000000000000 R09: 3d00545216f43d00 R10: ffff91e584fdcc50 R11: 00000060dd8616f4 R12: ffff91e58132d000 R13: ffff91e584fdcc68 R14: ffff91e5869ce800 R15: ffff91e589c0f000 FS: 0000000000000000(0000) GS:ffff91e898100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f788f7c44c0 CR3: 0000000008e1a000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> ? __warn (kernel/panic.c:693) ? sk_mc_loop (net/core/sock.c:760) ? report_bug (lib/bug.c:201 lib/bug.c:219) ? handle_bug (arch/x86/kernel/traps.c:239) ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1)) ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) ? sk_mc_loop (net/core/sock.c:760) ip6_finish_output2 (net/ipv6/ip6_output.c:83 (discriminator 1)) ? nf_hook_slow (net/netfilter/core.c:626) ip6_finish_output (net/ipv6/ip6_output.c:222) ? __pfx_ip6_finish_output (net/ipv6/ip6_output.c:215) ipvlan_xmit_mode_l3 (drivers/net/ipvlan/ipvlan_core.c:602) ipvlan ipvlan_start_xmit (drivers/net/ipvlan/ipvlan_main.c:226) ipvlan dev_hard_start_xmit (net/core/dev.c:3594) sch_direct_xmit (net/sched/sch_generic.c:343) __qdisc_run (net/sched/sch_generic.c:416) net_tx_action (net/core/dev.c:5286) handle_softirqs (kernel/softirq.c:555) __irq_exit_rcu (kernel/softirq.c:589) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1043)
The warning triggers as this:packet_sendmsg
packet_snd //skb->sk is packet sk
__dev_queue_xmit
__dev_xmit_skb //q->enqueue is not NULL
__qdisc_run
sch_direct_xmit
dev_hard_start_xmit
ipvlan_start_xmit
ipvlan_xmit_mode_l3 //l3 mode
ipvlan_process_outbound //vepa flag
ipvlan_process_v6_outbound
ip6_local_out
__ip6_finish_output
ip6_finish_output2 //multicast packet
sk_mc_loop //sk->sk_family is AF_PACKETCall ip{6}_local_out() with NULL sk in ipvlan as other tunnels to fix this.
--- drivers/net/ipvlan/ipvlan_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ipvlan/ipvlan_core.c +2 -2
@@ -440,7 +440,7 @@ static noinline_for_stack int ipvlan_process_v4_outbound(struct sk_buff *skb)memset (IPCB (skb),0 ,sizeof (*IPCB (skb))); - err =ip_local_out (net, skb->sk, skb); + err =ip_local_out (net,NULL , skb);if (unlikely (net_xmit_eval (err)))DEV_STATS_INC (dev, tx_errors);else
@@ -495,7 +495,7 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb)memset (IP6CB (skb),0 ,sizeof (*IP6CB (skb))); - err =ip6_local_out (dev_net (dev), skb->sk, skb); + err =ip6_local_out (dev_net (dev),NULL , skb);if (unlikely (net_xmit_eval (err)))DEV_STATS_INC (dev, tx_errors);else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 260/317 powerpc/uaccess: Use asm goto for get_user when compiler supports it
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 5cd29b1fd3e8f2b45fe6d011588d832417defe31 ]
clang 11 and future GCC are supporting asm goto with outputs.
Use it to implement get_user in order to get better generated code.
Note that clang requires to set x in the default branch of __get_user_size_goto() otherwise is compliant about x not being initialised :puzzled:
Stable-dep-of: 50934945d542 ("powerpc/uaccess: Use YZ asm constraint for ld")
--- arch/powerpc/include/asm/uaccess.h | 55 ++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+)
arch/powerpc/include/asm/uaccess.h +55 -0
@@ -243,6 +243,59 @@ extern long __get_user_bad(void); : "=r" (err) \ : "b" (uaddr), "b" (kaddr), "i" (-EFAULT), "0" (err)) +#ifdef CONFIG_CC_HAS_ASM_GOTO_OUTPUT + +#define __get_user_asm_goto (x, addr, label, op) \ + asm_volatile_goto( \ + "1: "op"%U1%X1 %0, %1 # get_user\n" \ + EX_TABLE(1b, %l2) \ + : "=r" (x) \ + : "m"UPD_CONSTR (*addr) \ + : \ + : label) + +#ifdef __powerpc64__ +#define __get_user_asm2_goto (x, addr, label) \ + __get_user_asm_goto(x, addr, label, "ld") +#else /* __powerpc64__ */ +#define __get_user_asm2_goto (x, addr, label) \ + asm_volatile_goto( \ + "1: lwz%X1 %0, %1\n" \ + "2: lwz%X1 %L0, %L1\n" \ + EX_TABLE(1b, %l2) \ + EX_TABLE(2b, %l2) \ + : "=r" (x) \ + : "m" (*addr) \ + : \ + : label) +#endif /* __powerpc64__ */ + +#define __get_user_size_goto (x, ptr, size, label) \ +do { \ + BUILD_BUG_ON(size > sizeof(x)); \ + switch (size) { \ + case 1: __get_user_asm_goto(x, (u8 __user *)ptr, label, "lbz"); break; \ + case 2: __get_user_asm_goto(x, (u16 __user *)ptr, label, "lhz"); break; \ + case 4: __get_user_asm_goto(x, (u32 __user *)ptr, label, "lwz"); break; \ + case 8: __get_user_asm2_goto(x, (u64 __user *)ptr, label); break; \ + default: x = 0; BUILD_BUG(); \ + } \ +} while (0) + +#define __get_user_size_allowed (x, ptr, size, retval) \ +do { \ + __label__ __gus_failed; \ + \ + __get_user_size_goto(x, ptr, size, __gus_failed); \ + retval = 0; \ + break; \ +__gus_failed: \ + x = 0; \ + retval = -EFAULT; \ +} while (0) + +#else /* CONFIG_CC_HAS_ASM_GOTO_OUTPUT */ +#define __get_user_asm (x, addr, err, op) \ __asm__ __volatile__( \ "1: "op"%U2%X2 %1, %2 # get_user\n" \
@@ -299,6 +352,8 @@ do { \prevent_read_from_user (ptr, size); \ } while (0) +#endif /* CONFIG_CC_HAS_ASM_GOTO_OUTPUT */ +/* * This is a type: either unsigned long, if the argument fits into * that type, or otherwise unsigned long long.
Signature · 1 line
2.43.0
Re: [PATCH 5.10 260/317] powerpc/uaccess: Use asm goto for get_user when compiler supports it
Quoted 16 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit
5cd29b1fd3e8f2b45fe6d011588d832417defe31]clang 11 and future GCC are supporting asm goto with outputs.
Use it to implement
get_userin order to get better generated code.Note that clang requires to set x in the default branch of
__get_user_size_goto()otherwise is compliant about x not being initialised :puzzled:
Quoted 8 lines
Signed-off-by Christophe Leroy <[email protected]>Signed-off-by Michael Ellerman <[email protected]>Stable-dep-of:
50934945d542("powerpc/uaccess: Use YZ asm constraint for ld")Signed-off-by Sasha Levin <[email protected]>--- arch/powerpc/include/asm/uaccess.h | 55 ++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+)
This is causing a build break. Please drop it.
There have been a lot of changes to uaccess.h since v5.10. I think rather than trying to pull in enough of them to allow backporting the recent uaccess fixes it'd be better to do a custom backport. I'll send one once I've done some build tests.
cheers
Greg Kroah-Hartman
maintainerRe: [PATCH 5.10 260/317] powerpc/uaccess: Use asm goto for get_user when compiler supports it
Quoted 26 lines · Michael Ellerman
Quoted 16 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit
5cd29b1fd3e8f2b45fe6d011588d832417defe31]clang 11 and future GCC are supporting asm goto with outputs.
Use it to implement
get_userin order to get better generated code.Note that clang requires to set x in the default branch of
__get_user_size_goto()otherwise is compliant about x not being initialised :puzzled:Quoted 8 lines
Signed-off-by Christophe Leroy <[email protected]>Signed-off-by Michael Ellerman <[email protected]>Stable-dep-of:
50934945d542("powerpc/uaccess: Use YZ asm constraint for ld")Signed-off-by Sasha Levin <[email protected]>--- arch/powerpc/include/asm/uaccess.h | 55 ++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+)
Quoted 6 lines
This is causing a build break. Please drop it.
There have been a lot of changes to
uaccess.hsince v5.10. I think rather than trying to pull in enough of them to allow backporting the recent uaccess fixes it'd be better to do a custom backport. I'll send one once I've done some build tests.
Now dropped, thanks!
greg k-h
Greg Kroah-Hartman
maintainerPATCH 261/317 hwmon: (shtc1) Fix property misspelling
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 52a2c70c3ec555e670a34dd1ab958986451d2dd2 ]
The property name is "sensirion,low-precision", not "sensicon,low-precision".
--- drivers/hwmon/shtc1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/shtc1.c +1 -1
@@ -238,7 +238,7 @@ static int shtc1_probe(struct i2c_client *client)if (np) { data->setup.blocking_io =of_property_read_bool (np,"sensirion,blocking-io" ); - data->setup.high_precision = !of_property_read_bool (np,"sensicon,low-precision" ); + data->setup.high_precision = !of_property_read_bool (np,"sensirion,low-precision" ); }else {if (client->dev.platform_data) data->setup = *(struct shtc1_platform_data *)dev->platform_data;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 262/317 ALSA: timer: Set lower bound of start tick time
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 4a63bd179fa8d3fcc44a0d9d71d941ddd62f0c4e upstream.
Currently ALSA timer doesn't have the lower limit of the start tick time, and it allows a very small size, e.g. 1 tick with 1ns resolution for hrtimer. Such a situation may lead to an unexpected RCU stall, where the callback repeatedly queuing the expire update, as reported by fuzzer.
This patch introduces a sanity check of the timer start tick time, so that the system returns an error when a too small start size is set. As of this patch, the lower limit is hard-coded to 100us, which is small enough but can still work somehow.
[ backport note: the error handling is changed, as the original commit
is based on the recent cleanup with guard() in commit beb45974dd49 -- tiwai ]
--- sound/core/timer.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
sound/core/timer.c +10 -0
@@ -553,6 +553,16 @@ static int snd_timer_start1(struct snd_t goto unlock; } +/* check the actual time for the start tick; +* bail out as error if it's way too low (< 100us) +*/ +if (start) { +if ((u64 )snd_timer_hw_resolution (timer) * ticks <100000 ) { + result = -EINVAL ; + goto unlock; + } + } +if (start) timeri->ticks = timeri->cticks = ticks;else if (!timeri->cticks)
Greg Kroah-Hartman
maintainerPATCH 263/317 genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dongli Zhang <[email protected]>
commit a6c11c0a5235fb144a65e0cb2ffd360ddc1f6c32 upstream.
The absence of IRQD_MOVE_PCNTXT prevents immediate effectiveness of interrupt affinity reconfiguration via procfs. Instead, the change is deferred until the next instance of the interrupt being triggered on the original CPU.
When the interrupt next triggers on the original CPU, the new affinity is enforced within __irq_move_irq(). A vector is allocated from the new CPU, but the old vector on the original CPU remains and is not immediately reclaimed. Instead, apicd->move_in_progress is flagged, and the reclaiming process is delayed until the next trigger of the interrupt on the new CPU.
Upon the subsequent triggering of the interrupt on the new CPU, irq_complete_move() adds a task to the old CPU's vector_cleanup list if it remains online. Subsequently, the timer on the old CPU iterates over its vector_cleanup list, reclaiming old vectors.
However, a rare scenario arises if the old CPU is outgoing before the interrupt triggers again on the new CPU.
In that case irq_force_complete_move() is not invoked on the outgoing CPU to reclaim the old apicd->prev_vector because the interrupt isn't currently affine to the outgoing CPU, and irq_needs_fixup() returns false. Even though __vector_schedule_cleanup() is later called on the new CPU, it doesn't reclaim apicd->prev_vector; instead, it simply resets both apicd->move_in_progress and apicd->prev_vector to 0.
As a result, the vector remains unreclaimed in vector_matrix, leading to a CPU vector leak.
To address this issue, move the invocation of irq_force_complete_move() before the irq_needs_fixup() call to reclaim apicd->prev_vector, if the interrupt is currently or used to be affine to the outgoing CPU.
Additionally, reclaim the vector in __vector_schedule_cleanup() as well, following a warning message, although theoretically it should never see apicd->move_in_progress with apicd->prev_cpu pointing to an offline CPU.
--- arch/x86/kernel/apic/vector.c | 9 ++++++--- kernel/irq/cpuhotplug.c | 16 ++++++++-------- 2 files changed, 14 insertions(+), 11 deletions(-)
arch/x86/kernel/apic/vector.c +6 -3
@@ -920,7 +920,8 @@ static void __send_cleanup_vector(structhlist_add_head (&apicd->clist,per_cpu_ptr (&cleanup_list, cpu)); apic->send_IPI (cpu,IRQ_MOVE_CLEANUP_VECTOR ); }else { - apicd->prev_vector =0 ; +pr_warn ("IRQ %u schedule cleanup for offline CPU %u\n" , apicd->irq, cpu); +free_moved_vector (apicd); }raw_spin_unlock (&vector_lock); }
@@ -957,6 +958,7 @@ void irq_complete_move(struct irq_cfg *c*/ void irq_force_complete_move (struct irq_desc *desc) { +unsigned int cpu =smp_processor_id ();struct apic_chip_data *apicd;struct irq_data *irqd;unsigned int vector;
@@ -981,10 +983,11 @@ void irq_force_complete_move(struct irq_ goto unlock;/* -* If prev_vector is empty, no action required. +* If prev_vector is empty or the descriptor is neither currently +* nor previously on the outgoing CPU no action required. */ vector = apicd->prev_vector; -if (!vector) +if (!vector || (apicd->cpu != cpu && apicd->prev_cpu != cpu)) goto unlock;/*
kernel/irq/cpuhotplug.c +8 -8
@@ -70,6 +70,14 @@ static bool migrate_one_irq(struct irq_d }/* +* Complete an eventually pending irq move cleanup. If this +* interrupt was moved in hard irq context, then the vectors need +* to be cleaned up. It can't wait until this interrupt actually +* happens and this CPU was involved. +*/ +irq_force_complete_move (desc); + +/* * No move required, if: * - Interrupt is per cpu * - Interrupt is not started
@@ -88,14 +96,6 @@ static bool migrate_one_irq(struct irq_d }/* -* Complete an eventually pending irq move cleanup. If this -* interrupt was moved in hard irq context, then the vectors need -* to be cleaned up. It can't wait until this interrupt actually -* happens and this CPU was involved. -*/ -irq_force_complete_move (desc); - -/* * If there is a setaffinity pending, then try to reuse the pending * mask, so the last change of the affinity does not get lost. If * there is no move pending or the pending mask does not contain
Greg Kroah-Hartman
maintainerPATCH 264/317 media: cec: core: add adap_nb_transmit_canceled() callback
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
commit da53c36ddd3f118a525a04faa8c47ca471e6c467 upstream.
A potential deadlock was found by Zheng Zhang with a local syzkaller instance.
The problem is that when a non-blocking CEC transmit is canceled by calling cec_data_cancel, that in turn can call the high-level received() driver callback, which can call cec_transmit_msg() to transmit a new message.
The cec_data_cancel() function is called with the adap->lock mutex held, and cec_transmit_msg() tries to take that same lock.
The root cause is that the received() callback can either be used to pass on a received message (and then adap->lock is not held), or to report a canceled transmit (and then adap->lock is held).
This is confusing, so create a new low-level adap_nb_transmit_canceled callback that reports back that a non-blocking transmit was canceled.
And the received() callback is only called when a message is received, as was the case before commit f9d0ecbf56f4 ("media: cec: correctly pass on reply results") complicated matters.
--- drivers/media/cec/core/cec-adap.c | 4 ++-- include/media/cec.h | 6 ++++-- 2 files changed, 6 insertions(+), 4 deletions(-)
drivers/media/cec/core/cec-adap.c +2 -2
@@ -397,8 +397,8 @@ static void cec_data_cancel(struct cec_dcec_queue_msg_monitor (adap, &data->msg,1 );if (!data->blocking && data->msg.sequence) -/* Allow drivers to process the message first */ -call_op (adap, received, &data->msg); +/* Allow drivers to react to a canceled transmit */ +call_void_op (adap, adap_nb_transmit_canceled, &data->msg);cec_data_completed (data); }
include/media/cec.h +4 -2
@@ -120,14 +120,16 @@ struct cec_adap_ops {int (*adap_log_addr)(struct cec_adapter *adap,u8 logical_addr);int (*adap_transmit)(struct cec_adapter *adap,u8 attempts,u32 signal_free_time,struct cec_msg *msg); +void (*adap_nb_transmit_canceled)(struct cec_adapter *adap, +const struct cec_msg *msg);void (*adap_status)(struct cec_adapter *adap,struct seq_file *file);void (*adap_free)(struct cec_adapter *adap); -/* Error injection callbacks */ +/* Error injection callbacks, called without adap->lock held */ int (*error_inj_show)(struct cec_adapter *adap,struct seq_file *sf);bool (*error_inj_parse_line)(struct cec_adapter *adap,char *line); -/* High-level CEC message callback */ +/* High-level CEC message callback, called without adap->lock held */ int (*received)(struct cec_adapter *adap,struct cec_msg *msg); };
Greg Kroah-Hartman
maintainerPATCH 265/317 SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
commit 4a77c3dead97339478c7422eb07bf4bf63577008 upstream.
The in_token->pages[] array is not NULL terminated. This results in the following KASAN splat:
KASAN: maybe wild-memory-access in range [0x04a2013400000008-0x04a201340000000f]
--- net/sunrpc/auth_gss/svcauth_gss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sunrpc/auth_gss/svcauth_gss.c +1 -1
@@ -1156,7 +1156,7 @@ static int gss_read_proxy_verf(struct sv } pages =DIV_ROUND_UP (inlen,PAGE_SIZE ); - in_token->pages =kcalloc (pages,sizeof (struct page *),GFP_KERNEL ); + in_token->pages =kcalloc (pages +1 ,sizeof (struct page *),GFP_KERNEL );if (!in_token->pages) {kfree (in_handle->data);return SVC_DENIED ;
Greg Kroah-Hartman
maintainerPATCH 266/317 binder: fix max_thread type inconsistency
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit 42316941335644a98335f209daafa4c122f28983 upstream.
The type defined for the BINDER_SET_MAX_THREADS ioctl was changed from size_t to __u32 in order to avoid incompatibility issues between 32 and 64-bit kernels. However, the internal types used to copy from user and store the value were never updated. Use u32 to fix the inconsistency.
--- drivers/android/binder.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/android/binder.c +2 -2
@@ -476,7 +476,7 @@ struct binder_proc {struct list_head todo;struct binder_stats stats;struct list_head delivered_death; -int max_threads; +u32 max_threads;int requested_threads;int requested_threads_started;int tmp_ref;
@@ -5408,7 +5408,7 @@ static long binder_ioctl(struct file *fi goto err;break ;case BINDER_SET_MAX_THREADS : { -int max_threads; +u32 max_threads;if (copy_from_user (&max_threads, ubuf,sizeof (max_threads))) {
Greg Kroah-Hartman
maintainerPATCH 267/317 mmc: core: Do not force a retune before RPMB switch
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jorge Ramirez-Ortiz <[email protected]>
commit 67380251e8bbd3302c64fea07f95c31971b91c22 upstream.
Requesting a retune before switching to the RPMB partition has been observed to cause CRC errors on the RPMB reads (-EILSEQ).
Since RPMB reads can not be retried, the clients would be directly affected by the errors.
This commit disables the retune request prior to switching to the RPMB
partition: mmc_retune_pause() no longer triggers a retune before the pause period begins.
This was verified with the sdhci-of-arasan driver (ZynqMP) configured for HS200 using two separate eMMC cards (DG4064 and 064GB2). In both cases, the error was easy to reproduce triggering every few tenths of reads.
With this commit, systems that were utilizing OP-TEE to access RPMB variables will experience an enhanced performance. Specifically, when OP-TEE is configured to employ RPMB as a secure storage solution, it not only writes the data but also the secure filesystem within the partition. As a result, retrieving any variable involves multiple RPMB reads, typically around five.
For context, on ZynqMP, each retune request consumed approximately 8ms. Consequently, reading any RPMB variable used to take at the very minimum 40ms.
After droping the need to retune before switching to the RPMB partition, this is no longer the case.
--- drivers/mmc/core/host.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/mmc/core/host.c +1 -2
@@ -114,13 +114,12 @@ void mmc_retune_enable(struct mmc_host */* * Pause re-tuning for a small set of operations. The pause begins after the -* next command and after first doing re-tuning. +* next command. */ void mmc_retune_pause (struct mmc_host *host) {if (!host->retune_paused) { host->retune_paused =1 ; -mmc_retune_needed (host);mmc_retune_hold (host); } }
Greg Kroah-Hartman
maintainerPATCH 268/317 io_uring: fail NOP if non-zero op flags is passed in
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
commit 3d8f874bd620ce03f75a5512847586828ab86544 upstream.
The NOP op flags should have been checked from beginning like any other opcode, otherwise NOP may not be extended with the op flags.
Given both liburing and Rust io-uring crate always zeros SQE op flags, just ignore users which play raw NOP uring interface without zeroing SQE, because NOP is just for test purpose. Then we can save one NOP2 opcode.
--- io_uring/io_uring.c | 2 ++ 1 file changed, 2 insertions(+)
io_uring/io_uring.c +2 -0
@@ -6474,6 +6474,8 @@ static int io_req_prep(struct io_kiocb * {switch (req->opcode) {case IORING_OP_NOP : +if (READ_ONCE (sqe->rw_flags)) +return -EINVAL ;return 0 ;case IORING_OP_READV :case IORING_OP_READ_FIXED :
Greg Kroah-Hartman
maintainerPATCH 269/317 afs: Dont cross .backup mountpoint from backup volume
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Dionne <[email protected]>
commit 29be9100aca2915fab54b5693309bc42956542e5 upstream.
Don't cross a mountpoint that explicitly specifies a backup volume (target is <vol>.backup) when starting from a backup volume.
It it not uncommon to mount a volume's backup directly in the volume itself. This can cause tools that are not paying attention to get into a loop mounting the volume onto itself as they attempt to traverse the tree, leading to a variety of problems.
This doesn't prevent the general case of loops in a sequence of mountpoints, but addresses a common special case in the same way as other afs clients.
--- fs/afs/mntpt.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/afs/mntpt.c +5 -0
@@ -146,6 +146,11 @@ static int afs_mntpt_set_params(struct fput_page (page);if (ret <0 )return ret; + +/* Don't cross a backup volume mountpoint from a backup volume */ +if (src_as->volume && src_as->volume->type ==AFSVL_BACKVOL && + ctx->type ==AFSVL_BACKVOL ) +return -ENODEV ; }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 270/317 nilfs2: fix use-after-free of timer for log writer thread
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit f5d4e04634c9cf68bdf23de08ada0bb92e8befe7 upstream.
Patch series "nilfs2: fix log writer related issues".
This bug fix series covers three nilfs2 log writer-related issues, including a timer use-after-free issue and potential deadlock issue on unmount, and a potential freeze issue in event synchronization found during their analysis. Details are described in each commit log.
This patch (of 3):
A use-after-free issue has been reported regarding the timer sc_timer on the nilfs_sc_info structure.
The problem is that even though it is used to wake up a sleeping log writer thread, sc_timer is not shut down until the nilfs_sc_info structure is about to be freed, and is used regardless of the thread's lifetime.
Fix this issue by limiting the use of sc_timer only while the log writer thread is alive.
--- fs/nilfs2/segment.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-)
fs/nilfs2/segment.c +19 -6
@@ -2164,8 +2164,10 @@ static void nilfs_segctor_start_timer(st {spin_lock (&sci->sc_state_lock);if (!(sci->sc_state &NILFS_SEGCTOR_COMMIT )) { - sci->sc_timer.expires = jiffies + sci->sc_interval; -add_timer (&sci->sc_timer); +if (sci->sc_task) { + sci->sc_timer.expires = jiffies + sci->sc_interval; +add_timer (&sci->sc_timer); + } sci->sc_state |=NILFS_SEGCTOR_COMMIT ; }spin_unlock (&sci->sc_state_lock);
@@ -2385,10 +2387,21 @@ int nilfs_construct_dsync_segment(struct*/ static void nilfs_segctor_accept (struct nilfs_sc_info *sci) { +bool thread_is_alive; +spin_lock (&sci->sc_state_lock); sci->sc_seq_accepted = sci->sc_seq_request; + thread_is_alive = (bool )sci->sc_task;spin_unlock (&sci->sc_state_lock); -del_timer_sync (&sci->sc_timer); + +/* +* This function does not race with the log writer thread's +* termination. Therefore, deleting sc_timer, which should not be +* done after the log writer thread exits, can be done safely outside +* the area protected by sc_state_lock. +*/ +if (thread_is_alive) +del_timer_sync (&sci->sc_timer); }/**
@@ -2414,7 +2427,7 @@ static void nilfs_segctor_notify(struct sci->sc_flush_request &= ~FLUSH_DAT_BIT ;/* re-enable timer if checkpoint creation was not done */ -if ((sci->sc_state &NILFS_SEGCTOR_COMMIT ) && +if ((sci->sc_state &NILFS_SEGCTOR_COMMIT ) && sci->sc_task &&time_before (jiffies, sci->sc_timer.expires))add_timer (&sci->sc_timer); }
@@ -2604,6 +2617,7 @@ static int nilfs_segctor_thread(void *arint timeout =0 ; sci->sc_timer_task = current; +timer_setup (&sci->sc_timer, nilfs_construction_timeout,0 );/* start sync. */ sci->sc_task = current;
@@ -2670,6 +2684,7 @@ static int nilfs_segctor_thread(void *ar end_thread:/* end sync. */ sci->sc_task =NULL ; +del_timer_sync (&sci->sc_timer);wake_up (&sci->sc_wait_task);/* for nilfs_segctor_kill_thread() */ spin_unlock (&sci->sc_state_lock);return 0 ;
@@ -2733,7 +2748,6 @@ static struct nilfs_sc_info *nilfs_segctINIT_LIST_HEAD (&sci->sc_gc_inodes);INIT_LIST_HEAD (&sci->sc_iput_queue);INIT_WORK (&sci->sc_iput_work, nilfs_iput_work_func); -timer_setup (&sci->sc_timer, nilfs_construction_timeout,0 ); sci->sc_interval =HZ *NILFS_SC_DEFAULT_TIMEOUT ; sci->sc_mjcp_freq =HZ *NILFS_SC_DEFAULT_SR_FREQ ;
@@ -2819,7 +2833,6 @@ static void nilfs_segctor_destroy(structdown_write (&nilfs->ns_segctor_sem); -del_timer_sync (&sci->sc_timer);kfree (sci); }
Greg Kroah-Hartman
maintainerPATCH 271/317 vxlan: Fix regression when dropping packets due to invalid src addresses
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
commit 1cd4bc987abb2823836cbb8f887026011ccddc8a upstream.
Commit f58f45c1e5b9 ("vxlan: drop packets from invalid src-address") has recently been added to vxlan mainly in the context of source address snooping/learning so that when it is enabled, an entry in the FDB is not being created for an invalid address for the corresponding tunnel endpoint.
Before commit f58f45c1e5b9 vxlan was similarly behaving as geneve in that it passed through whichever macs were set in the L2 header. It turns out that this change in behavior breaks setups, for example, Cilium with netkit in L3 mode for Pods as well as tunnel mode has been passing before the change in f58f45c1e5b9 for both vxlan and geneve. After mentioned change it is only passing for geneve as in case of vxlan packets are dropped due to vxlan_set_mac() returning false as source and destination macs are zero which for E/W traffic via tunnel is totally fine.
Fix it by only opting into the is_valid_ether_addr() check in vxlan_set_mac() when in fact source address snooping/learning is actually enabled in vxlan. This is done by moving the check into vxlan_snoop(). With this change, the Cilium connectivity test suite passes again for both tunnel flavors.
[ Backport note: vxlan snooping/learning not supported in 6.8 or older,
so commit is simply a revert. ]
--- drivers/net/vxlan/vxlan_core.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/net/vxlan/vxlan_core.c +0 -4
@@ -1778,10 +1778,6 @@ static bool vxlan_set_mac(struct vxlan_dif (ether_addr_equal (eth_hdr (skb)->h_source, vxlan->dev->dev_addr))return false; -/* Ignore packets from invalid src-address */ -if (!is_valid_ether_addr (eth_hdr (skb)->h_source)) -return false; -/* Get address from the outer IP header */ if (vxlan_get_sk_family (vs) ==AF_INET ) { saddr.sin.sin_addr.s_addr =ip_hdr (skb)->saddr;
Greg Kroah-Hartman
maintainerPATCH 272/317 x86/mm: Remove broken vsyscall emulation code from the page fault code
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit 02b670c1f88e78f42a6c5aee155c7b26960ca054 upstream.
The syzbot-reported stack trace from hell in this discussion thread actually has three nested page faults:
https://lore.kernel.org/r/[email protected]
... and I think that's actually the important thing here:
- the first page fault is from user space, and triggers the vsyscall emulation.
- the second page fault is from __do_sys_gettimeofday(), and that should just have caused the exception that then sets the return value to -EFAULT
- the third nested page fault is due to _raw_spin_unlock_irqrestore() -> preempt_schedule() -> trace_sched_switch(), which then causes a BPF trace program to run, which does that bpf_probe_read_compat(), which causes that page fault under pagefault_disable().
It's quite the nasty backtrace, and there's a lot going on.
The problem is literally the vsyscall emulation, which sets
current->thread.sig_on_uaccess_err = 1;
and that causes the fixup_exception() code to send the signal *despite* the exception being caught.
And I think that is in fact completely bogus. It's completely bogus exactly because it sends that signal even when it *shouldn't* be sent - like for the BPF user mode trace gathering.
In other words, I think the whole "sig_on_uaccess_err" thing is entirely broken, because it makes any nested page-faults do all the wrong things.
Now, arguably, I don't think anybody should enable vsyscall emulation any more, but this test case clearly does.
I think we should just make the "send SIGSEGV" be something that the vsyscall emulation does on its own, not this broken per-thread state for something that isn't actually per thread.
The x86 page fault code actually tried to deal with the "incorrect nesting" by having that:
if (in_interrupt())
return;which ignores the sig_on_uaccess_err case when it happens in interrupts, but as shown by this example, these nested page faults do not need to be about interrupts at all.
IOW, I think the only right thing is to remove that horrendously broken code.
The attached patch looks like the ObviouslyCorrect(tm) thing to do.
NOTE! This broken code goes back to this commit in 2011:
4fc3490114bb ("x86-64: Set siginfo and context on vsyscall emulation faults")
... and back then the reason was to get all the siginfo details right. Honestly, I do not for a moment believe that it's worth getting the siginfo details right here, but part of the commit says:
This fixes issues with UML when vsyscall=emulate.
... and so my patch to remove this garbage will probably break UML in this situation.
I do not believe that anybody should be running with vsyscall=emulate in 2024 in the first place, much less if you are doing things like UML. But let's see if somebody screams.
[gpiccoli: Backport the patch due to differences in the trees. The main change
between 5.10.y and 5.15.y is due to renaming the fixup function, by commit 6456a2a69ee1 ("x86/fault: Rename no_context() to kernelmode_fixup_or_oops()"). Following 2 commits cause divergence in the diffs too (in the removed lines):
cd072dab453a ("x86/fault: Add a helper function to sanitize error code") d4ffd5df9d18 ("x86/fault: Fix wrong signal when vsyscall fails with pkey") Finally, there is context adjustment in the processor.h file.]
--- arch/x86/entry/vsyscall/vsyscall_64.c | 28 ++-------------------------- arch/x86/include/asm/processor.h | 1 - arch/x86/mm/fault.c | 27 +-------------------------- 3 files changed, 3 insertions(+), 53 deletions(-)
arch/x86/entry/vsyscall/vsyscall_64.c +2 -26
@@ -98,11 +98,6 @@ static int addr_to_vsyscall_nr(unsignedstatic bool write_ok_or_segv (unsigned long ptr,size_t size) { -/* -* XXX: if access_ok, get_user, and put_user handled -* sig_on_uaccess_err, this could go away. -*/ -if (!access_ok ((void __user *)ptr, size)) {struct thread_struct *thread = ¤t->thread;
@@ -120,10 +115,8 @@ static bool write_ok_or_segv(unsigned lobool emulate_vsyscall (unsigned long error_code,struct pt_regs *regs,unsigned long address) { -struct task_struct *tsk;unsigned long caller;int vsyscall_nr, syscall_nr, tmp; -int prev_sig_on_uaccess_err;long ret;unsigned long orig_dx;
@@ -172,8 +165,6 @@ bool emulate_vsyscall(unsigned long erro goto sigsegv; } - tsk = current; -/* * Check for access_ok violations and find the syscall nr. *
@@ -233,12 +224,8 @@ bool emulate_vsyscall(unsigned long erro goto do_ret;/* skip requested */ /* -* With a real vsyscall, page faults cause SIGSEGV. We want to -* preserve that behavior to make writing exploits harder. +* With a real vsyscall, page faults cause SIGSEGV. */ - prev_sig_on_uaccess_err = current->thread.sig_on_uaccess_err; - current->thread.sig_on_uaccess_err =1 ; - ret = -EFAULT ;switch (vsyscall_nr) {case 0 :
@@ -261,23 +248,12 @@ bool emulate_vsyscall(unsigned long errobreak ; } - current->thread.sig_on_uaccess_err = prev_sig_on_uaccess_err; - check_fault:if (ret == -EFAULT ) {/* Bad news -- userspace fed a bad pointer to a vsyscall. */ warn_bad_vsyscall (KERN_INFO , regs,"vsyscall fault (exploit attempt?)" ); - -/* -* If we failed to generate a signal for any reason, -* generate one here. (This should be impossible.) -*/ -if (WARN_ON_ONCE (!sigismember (&tsk->pending.signal,SIGBUS ) && - !sigismember (&tsk->pending.signal,SIGSEGV ))) - goto sigsegv; - -return true;/* Don't emulate the ret. */ + goto sigsegv; } regs->ax = ret;
arch/x86/include/asm/processor.h +0 -1
@@ -528,7 +528,6 @@ struct thread_struct {unsigned long iopl_emul; unsigned int iopl_warn:1; - unsigned int sig_on_uaccess_err:1;/* Floating point and extended processor state */ struct fpu fpu;
arch/x86/mm/fault.c +1 -26
@@ -649,33 +649,8 @@ no_context(struct pt_regs *regs, unsigne }/* Are we prepared to handle this kernel fault? */ -if (fixup_exception (regs,X86_TRAP_PF , error_code, address)) { -/* -* Any interrupt that takes a fault gets the fixup. This makes -* the below recursive fault logic only apply to a faults from -* task context. -*/ -if (in_interrupt ()) -return ; - -/* -* Per the above we're !in_interrupt(), aka. task context. -* -* In this case we need to make sure we're not recursively -* faulting through the emulate_vsyscall() logic. -*/ -if (current->thread.sig_on_uaccess_err && signal) { -set_signal_archinfo (address, error_code); - -/* XXX: hwpoison faults will set the wrong code. */ -force_sig_fault (signal, si_code, (void __user *)address); - } - -/* -* Barring that, we can do the fixup and be happy. -*/ +if (fixup_exception (regs,X86_TRAP_PF , error_code, address))return ; - }#ifdef CONFIG_VMAP_STACK /*
Greg Kroah-Hartman
maintainerPATCH 273/317 netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 776d451648443f9884be4a1b4e38e8faf1c621f9 upstream.
Bail out on using the tunnel dst template from other than netdev family. Add the infrastructure to check for the family in objects.
--- include/net/netfilter/nf_tables.h | 2 ++ net/netfilter/nf_tables_api.c | 14 +++++++++----- net/netfilter/nft_tunnel.c | 1 + 3 files changed, 12 insertions(+), 5 deletions(-)
include/net/netfilter/nf_tables.h +2 -0
@@ -1174,6 +1174,7 @@ void nft_obj_notify(struct net *net, con* @type: stateful object numeric type * @owner: module owner * @maxattr: maximum netlink attribute +* @family: address family for AF-specific object types * @policy: netlink attribute policy */ struct nft_object_type {
@@ -1183,6 +1184,7 @@ struct nft_object_type {struct list_head list;u32 type;unsigned int maxattr; +u8 family;struct module *owner;const struct nla_policy *policy; };
net/netfilter/nf_tables_api.c +9 -5
@@ -6234,11 +6234,15 @@ nla_put_failure:return -1 ; } -static const struct nft_object_type *__nft_obj_type_get (u32 objtype) +static const struct nft_object_type *__nft_obj_type_get (u32 objtype,u8 family) {const struct nft_object_type *type;list_for_each_entry (type, &nf_tables_objects, list) { +if (type->family !=NFPROTO_UNSPEC && + type->family != family) +continue ; +if (objtype == type->type)return type; }
@@ -6246,11 +6250,11 @@ static const struct nft_object_type *__n }static const struct nft_object_type * -nft_obj_type_get (struct net *net,u32 objtype) +nft_obj_type_get (struct net *net,u32 objtype,u8 family) {const struct nft_object_type *type; - type =__nft_obj_type_get (objtype); + type =__nft_obj_type_get (objtype, family);if (type !=NULL &&try_module_get (type->owner))return type;
@@ -6343,7 +6347,7 @@ static int nf_tables_newobj(struct net *if (nlh->nlmsg_flags &NLM_F_REPLACE )return -EOPNOTSUPP ; - type =__nft_obj_type_get (objtype); + type =__nft_obj_type_get (objtype, family);nft_ctx_init (&ctx, net, skb, nlh, family, table,NULL , nla);return nf_tables_updobj (&ctx, type, nla[NFTA_OBJ_DATA ], obj);
@@ -6354,7 +6358,7 @@ static int nf_tables_newobj(struct net *if (!nft_use_inc (&table->use))return -EMFILE ; - type =nft_obj_type_get (net, objtype); + type =nft_obj_type_get (net, objtype, family);if (IS_ERR (type)) { err =PTR_ERR (type); goto err_type;
net/netfilter/nft_tunnel.c +1 -0
@@ -684,6 +684,7 @@ static const struct nft_object_ops nft_tstatic struct nft_object_type nft_tunnel_obj_type__read_mostly = { .type =NFT_OBJECT_TUNNEL , + .family =NFPROTO_NETDEV , .ops = &nft_tunnel_obj_ops, .maxattr =NFTA_TUNNEL_KEY_MAX , .policy = nft_tunnel_key_policy,
Greg Kroah-Hartman
maintainerPATCH 274/317 netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyang Xuan <[email protected]>
commit d78d867dcea69c328db30df665be5be7d0148484 upstream.
nft_unregister_obj() can concurrent with __nft_obj_type_get(), and there is not any protection when iterate over nf_tables_objects list in __nft_obj_type_get(). Therefore, there is potential data-race of nf_tables_objects list entry.
Use list_for_each_entry_rcu() to iterate over nf_tables_objects list in __nft_obj_type_get(), and use rcu_read_lock() in the caller nft_obj_type_get() to protect the entire type query process.
--- net/netfilter/nf_tables_api.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +6 -2
@@ -6238,7 +6238,7 @@ static const struct nft_object_type *__n {const struct nft_object_type *type; -list_for_each_entry (type, &nf_tables_objects, list) { +list_for_each_entry_rcu (type, &nf_tables_objects, list) {if (type->family !=NFPROTO_UNSPEC && type->family != family)continue ;
@@ -6254,9 +6254,13 @@ nft_obj_type_get(struct net *net, u32 ob {const struct nft_object_type *type; +rcu_read_lock (); type =__nft_obj_type_get (objtype, family); -if (type !=NULL &&try_module_get (type->owner)) +if (type !=NULL &&try_module_get (type->owner)) { +rcu_read_unlock ();return type; + } +rcu_read_unlock ();lockdep_nfnl_nft_mutex_not_held ();#ifdef CONFIG_MODULES