6.9.7-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 6.9.7-rc1 review
This is the start of the stable review cycle for the 6.9.7 release. There are 250 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.9.7-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.9.7-rc1
Linus Torvalds <[email protected]>
Revert "mm: mmap: allow for the maximum number of bits for randomizing mmap_base by default"
Andrew Ballance <[email protected]>
hid: asus: asus_report_fixup: fix potential read out of bounds
Linus Torvalds <[email protected]>
kprobe/ftrace: fix build error due to bad function definition
Davide Caratti <[email protected]>
net/sched: unregister lockdep keys in qdisc_create/qdisc_alloc error path
Pierre-Louis Bossart <[email protected]>
ASoC: Intel: sof-sdw: really remove FOUR_SPEAKER quirk
Baochen Qiang <[email protected]>
wifi: ath12k: check M3 buffer size as well whey trying to reuse it
Martin Leung <[email protected]>
drm/amd/display: revert Exit idle optimizations before HDCP execution
Tony Luck <[email protected]>
x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL
Tony Luck <[email protected]>
x86/cpu/vfm: Add new macros to work with (vendor/family/model) values
Jeff Johnson <[email protected]>
tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test
Bart Van Assche <[email protected]>
nbd: Fix signal handling
Bart Van Assche <[email protected]>
nbd: Improve the documentation of the locking assumptions
Matthew Brost <[email protected]>
drm/xe: Use ordered WQ for G2H handler
Patrice Chotard <[email protected]>
spi: stm32: qspi: Clamp stm32_qspi_get_mode() output to CCR_BUSWIDTH_4
Rafael J. Wysocki <[email protected]>
thermal: core: Change PM notifier priority to the minimum
Frank Li <[email protected]>
arm64: dts: imx8qm-mek: fix gpio number for reg_usdhc2_vmmc
Patrice Chotard <[email protected]>
spi: stm32: qspi: Fix dual flash mode sanity test in stm32_qspi_setup()
Srinivas Pandruvada <[email protected]>
thermal: int340x: processor_thermal: Support shared interrupts
Krzysztof Kozlowski <[email protected]>
dt-bindings: i2c: google,cros-ec-i2c-tunnel: correct path to i2c-controller schema
Paolo Bonzini <[email protected]>
virt: guest_memfd: fix reference leak on hwpoisoned page
Krzysztof Kozlowski <[email protected]>
dt-bindings: i2c: atmel,at91sam: correct path to i2c-controller schema
Grygorii Tertychnyi <[email protected]>
i2c: ocores: set IACK bit after core is enabled
GUO Zihua <[email protected]>
ima: Avoid blocking in RCU read-side critical section
Peter Xu <[email protected]>
mm/page_table_check: fix crash on ZONE_DEVICE
Eric Dumazet <[email protected]>
tcp: clear tp->retrans_stamp in tcp_rcv_fastopen_synack()
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: userspace_pm: fixed subtest names
Baolin Wang <[email protected]>
mm: shmem: fix getting incorrect lruvec when replacing a shmem folio
Ran Xiaokai <[email protected]>
mm: huge_memory: fix misused mapping_large_folio_support() for anon folios
Rafael Aquini <[email protected]>
mm: mmap: allow for the maximum number of bits for randomizing mmap_base by default
Jiaxun Yang <[email protected]>
MIPS: mipsmtregs: Fix target register for MFTC0
Andy Shevchenko <[email protected]>
serial: 8250_dw: Revert "Move definitions to the shared header"
Ard Biesheuvel <[email protected]>
efi/x86: Free EFI memory map only when installing a new one.
Aleksandr Nogikh <[email protected]>
kcov: don't lose track of remote references during softirqs
Peter Oberparleiter <[email protected]>
gcov: add support for GCC 14
Dmitry Safonov <[email protected]>
net/tcp_ao: Don't leak ao_info on error-path
Louis Chauvet <[email protected]>
dmaengine: xilinx: xdma: Fix data synchronisation in xdma_channel_isr()
Niklas Cassel <[email protected]>
ata: ahci: Do not enable LPM if no LPM states are supported by the HBA
Bart Van Assche <[email protected]>
scsi: usb: uas: Do not query the IO Advice Hints Grouping mode page for USB/UAS devices
Bart Van Assche <[email protected]>
scsi: core: Introduce the BLIST_SKIP_IO_HINTS flag
Joseph Qi <[email protected]>
ocfs2: fix NULL pointer dereference in ocfs2_abort_trigger()
Joseph Qi <[email protected]>
ocfs2: fix NULL pointer dereference in ocfs2_journal_dirty()
Krzysztof Kozlowski <[email protected]>
dt-bindings: dma: fsl-edma: fix dma-channels constraints
Michael Strauss <[email protected]>
drm/amd/display: Attempt to avoid empty TUs when endpoint is DPIA
Roman Li <[email protected]>
drm/amd/display: Remove redundant idle optimization check
Yunxiang Li <[email protected]>
drm/amdgpu: fix locking scope when flushing tlb
Alex Deucher <[email protected]>
drm/amdgpu: fix UBSAN warning in kv_dpm.c
Alex Deucher <[email protected]>
drm/radeon: fix UBSAN warning in kv_dpm.c
Jani Nikula <[email protected]>
drm/i915/mso: using joiner is not possible with eDP MSO
Pablo Caño <[email protected]>
ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14AHP9
Edson Juliano Drosdeck <[email protected]>
ALSA: hda/realtek: Limit mic boost on N14AP7
Andy Chi <[email protected]>
ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 445/465 G11.
Johannes Berg <[email protected]>
wifi: mac80211: fix monitor channel with chanctx emulation
Miklos Szeredi <[email protected]>
ovl: fix encoding fid for lower only root
Jason Gunthorpe <[email protected]>
RDMA/mlx5: Ensure created mkeys always have a populated rb_key
Jason Gunthorpe <[email protected]>
RDMA/mlx5: Follow rb_key.ats when creating new mkeys
Jason Gunthorpe <[email protected]>
RDMA/mlx5: Remove extra unlock on error path
Honggang LI <[email protected]>
RDMA/rxe: Fix data copy for IB_SEND_INLINE
Sean Christopherson <[email protected]>
KVM: x86: Always sync PIR to IRR prior to scanning I/O APIC routes
Marc Zyngier <[email protected]>
KVM: arm64: Disassociate vcpus from redistributor region on teardown
Breno Leitao <[email protected]>
KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
Hui Li <[email protected]>
LoongArch: Fix multiple hardware watchpoint issues
Hui Li <[email protected]>
LoongArch: Trigger user-space watchpoints correctly
Hui Li <[email protected]>
LoongArch: Fix watchpoint setting error
Steve French <[email protected]>
cifs: fix typo in module parameter enable_gcm_256
Joel Slebodnick <[email protected]>
scsi: ufs: core: Free memory allocated for model before reinit
Boris Burkov <[email protected]>
btrfs: retry block group reclaim without infinite loop
Ignat Korchagin <[email protected]>
net: do not leave a dangling sk pointer, when socket creation fails
Oleksij Rempel <[email protected]>
net: phy: dp83tg720: get master/slave configuration in link down state
Jose Ignacio Tornos Martinez <[email protected]>
net: usb: ax88179_178a: improve reset check
Oleksij Rempel <[email protected]>
net: stmmac: Assign configured channel value to EXTTS event
Oleksij Rempel <[email protected]>
net: phy: dp83tg720: wake up PHYs in managed mode
Baokun Li <[email protected]>
ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists()
Baokun Li <[email protected]>
ext4: avoid overflow when setting values via sysfs
Rafael J. Wysocki <[email protected]>
ACPI: EC: Evaluate orphan _REG under EC device
Konstantin Taranov <[email protected]>
RDMA/mana_ib: Ignore optional access flags for MRs
Patrisious Haddad <[email protected]>
RDMA/mlx5: Add check for srq max_sge attribute
Yishai Hadas <[email protected]>
RDMA/mlx5: Fix unwind flow as part of mlx5_ib_stage_init_init
Xi Ruoyao <[email protected]>
LoongArch: Only allow OBJTOOL & ORC unwinder if toolchain supports -mthin-add-sub
Sudeep Holla <[email protected]>
firmware: psci: Fix return value from psci_system_suspend()
Chenliang Li <[email protected]>
io_uring/rsrc: fix incorrect assignment of iter->nr_segs in io_import_fixed
Michal Wajdeczko <[email protected]>
drm/xe/vf: Don't touch GuC irq registers if using memory irqs
Marc Kleine-Budde <[email protected]>
spi: spi-imx: imx51: revert burst length calculation back to bits_per_word
Dave Martin <[email protected]>
x86/resctrl: Don't try to free nonexistent RMIDs
Amit Kumar Mahapatra <[email protected]>
spi: Fix SPI slave probe failure
Hans de Goede <[email protected]>
ACPI: scan: Ignore camera graph port nodes on all Dell Tiger, Alder and Raptor Lake models
Raju Rangoju <[email protected]>
ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
Max Krummenacher <[email protected]>
arm64: dts: freescale: imx8mm-verdin: enable hysteresis on slow input pin
Fabio Estevam <[email protected]>
arm64: dts: imx93-11x11-evk: Remove the 'no-sdio' property
Tim Harvey <[email protected]>
arm64: dts: freescale: imx8mp-venice-gw73xx-2x: fix BT shutdown GPIO
Liu Ying <[email protected]>
arm: dts: imx53-qsb-hdmi: Disable panel instead of deleting node
Marek Vasut <[email protected]>
arm64: dts: imx8mp: Fix TC9595 input clock on DH i.MX8M Plus DHCOM SoM
Julien Panis <[email protected]>
thermal/drivers/mediatek/lvts_thermal: Return error in case of invalid efuse data
Kalle Niemi <[email protected]>
regulator: bd71815: fix ramp values
Nikita Shubin <[email protected]>
dmaengine: ioatdma: Fix missing kmem_cache_destroy()
Arnd Bergmann <[email protected]>
dmaengine: fsl-edma: avoid linking both modules
Nikita Shubin <[email protected]>
dmaengine: ioatdma: Fix kmemleak in ioat_pci_probe()
Nikita Shubin <[email protected]>
dmaengine: ioatdma: Fix error path in ioat3_dma_probe()
Nikita Shubin <[email protected]>
dmaengine: ioatdma: Fix leaking on version mismatch
Siddharth Vadapalli <[email protected]>
dmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id()
Li RongQing <[email protected]>
dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
Biju Das <[email protected]>
regulator: core: Fix modpost error "regulator_get_regmap" undefined
Honggang LI <[email protected]>
RDMA/rxe: Fix responder length checking for UD request packets
Charles Keepax <[email protected]>
spi: cs42l43: Correct SPI root clock speed
Nathan Lynch <[email protected]>
powerpc/crypto: Add generated P8 asm to .gitignore
Abel Vesa <[email protected]>
phy: qcom: qmp-combo: Switch from V6 to V6 N4 register offsets
Abel Vesa <[email protected]>
phy: qcom-qmp: pcs: Add missing v6 N4 register offsets
Abel Vesa <[email protected]>
phy: qcom-qmp: qserdes-txrx: Add missing registers offsets
Joao Paulo Goncalves <[email protected]>
arm64: dts: freescale: imx8mm-verdin: Fix GPU speed
Selvin Xavier <[email protected]>
RDMA/bnxt_re: Fix the max msix vectors macro
Oliver Neukum <[email protected]>
net: usb: rtl8150 fix unintiatilzed variables in rtl8150_get_link_ksettings
Pavan Chebbi <[email protected]>
bnxt_en: Restore PTP tx_avail count in case of skb_pad() error
Marcin Szycik <[email protected]>
ice: Fix VSI list rule with ICE_SW_LKUP_LAST type
Jianguo Wu <[email protected]>
netfilter: move the sysctl nf_hooks_lwtunnel into the netfilter core
Jianguo Wu <[email protected]>
seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors
Jozsef Kadlecsik <[email protected]>
netfilter: ipset: Fix suspicious rcu_dereference_protected()
Geetha sowjanya <[email protected]>
octeontx2-pf: Fix linking objects into multiple modules
Simon Horman <[email protected]>
octeontx2-pf: Add error handling to VLAN unoffload handling
Heng Qi <[email protected]>
virtio_net: fixing XDP for fully checksummed packets handling
Heng Qi <[email protected]>
virtio_net: checksum offloading handling fix
Xiaolei Wang <[email protected]>
net: stmmac: No need to calculate speed divider when offload is disabled
Simon Horman <[email protected]>
selftests: openvswitch: Use bash as interpreter
Dan Carpenter <[email protected]>
ptp: fix integer overflow in max_vclocks_store
Xin Long <[email protected]>
sched: act_ct: add netns into the key of tcf_ct_flow_table
Xin Long <[email protected]>
tipc: force a dst refcount before doing decryption
David Ruth <[email protected]>
net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
Raju Lakkaraju <[email protected]>
net: phy: mxl-gpy: Remove interrupt mask clearing from config_init
Raju Lakkaraju <[email protected]>
net: lan743x: Support WOL at both the PHY and MAC appropriately
Raju Lakkaraju <[email protected]>
net: lan743x: disable WOL upon resume to restore full data path operation
Stefan Wahren <[email protected]>
qca_spi: Make interrupt remembering atomic
Yue Haibing <[email protected]>
netns: Make get_net_ns() handle zero refcount net
Eric Dumazet <[email protected]>
xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
Eric Dumazet <[email protected]>
ipv6: prevent possible NULL dereference in rt6_probe()
Eric Dumazet <[email protected]>
ipv6: prevent possible NULL deref in fib6_nh_init()
Gavrilov Ilia <[email protected]>
netrom: Fix a memory leak in nr_heartbeat_expiry()
Ajrat Makhmutov <[email protected]>
ALSA: hda/realtek: Enable headset mic on IdeaPad 330-17IKB 81DM
Jakub Kicinski <[email protected]>
netdev-genl: fix error codes when outputting XDP features
Florian Westphal <[email protected]>
bpf: Avoid splat in pskb_pull_reason
Simon Trimmer <[email protected]>
ALSA: hda: tas2781: Component should be unbound before deconstruction
Simon Trimmer <[email protected]>
ALSA: hda: cs35l41: Component should be unbound before deconstruction
Simon Trimmer <[email protected]>
ALSA: hda: cs35l56: Component should be unbound before deconstruction
Ondrej Mosnacek <[email protected]>
cipso: fix total option length computation
Aryan Srivastava <[email protected]>
net: mvpp2: use slab_build_skb for oversized frames
Johannes Thumshirn <[email protected]>
btrfs: zoned: allocate dummy checksums for zoned NODATASUM writes
Daniel Borkmann <[email protected]>
bpf: Fix reg_set_min_max corruption of fake_reg
Wojciech Drewek <[email protected]>
ice: implement AQ download pkg retry
Paul Greenwalt <[email protected]>
ice: fix 200G link speed message log
En-Wei Wu <[email protected]>
ice: avoid IRQ collision to fix init failure on ACPI S3 resume
Peter Ujfalusi <[email protected]>
ALSA/hda: intel-dsp-config: Document AVS as dsp_driver option
Dustin L. Howett <[email protected]>
ALSA: hda/realtek: Remove Framework Laptop 16 from quirks
Remi Pommarel <[email protected]>
wifi: mac80211: Recalc offload when monitor stop
Shaul Triebitz <[email protected]>
wifi: iwlwifi: mvm: fix ROC version check
Masami Hiramatsu (Google) <[email protected]>
tracing: Build event generation tests only as modules
Christian Marangi <[email protected]>
mips: bmips: BCM6358: make sure CBR is correctly set
Ilpo Järvinen <[email protected]>
MIPS: Routerboard 532: Fix vendor retry check code
Takashi Iwai <[email protected]>
ALSA: seq: ump: Fix missing System Reset message handling
Simon Trimmer <[email protected]>
ALSA: hda: cs35l41: Possible null pointer dereference in cs35l41_hda_unbind()
Viresh Kumar <[email protected]>
OPP: Fix required_opp_tables for multiple genpds using same table
Ilpo Järvinen <[email protected]>
PCI: Do not wait for disconnected devices when resuming
Rafael J. Wysocki <[email protected]>
ACPI: EC: Install address space handler at the namespace root
Peng Ma <[email protected]>
cpufreq: amd-pstate: fix memory leak on CPU EPP exit
Dmitry Baryshkov <[email protected]>
usb: typec: qcom-pmic-typec: split HPD bridge alloc and registration
Alex Williamson <[email protected]>
vfio/pci: Collect hot-reset devices to local buffer
Dave Jiang <[email protected]>
cxl: Add post-reset warning if reset results in loss of previously committed HDM decoders
Alexander Stein <[email protected]>
i2c: lpi2c: Avoid calling clk_get_rate during transfer
Linus Torvalds <[email protected]>
tty: add the option to have a tty reject a new ldisc
Mathias Nyman <[email protected]>
xhci: remove XHCI_TRUST_TX_LENGTH quirk
Christophe JAILLET <[email protected]>
usb: gadget: function: Remove usage of the deprecated ida_simple_xx() API
Parker Newman <[email protected]>
serial: exar: adding missing CTI and Exar PCI ids
Esben Haabendal <[email protected]>
serial: imx: Introduce timeout when waiting on transmitter empty
Songyang Li <[email protected]>
MIPS: Octeon: Add PCIe link status check
Jaegeuk Kim <[email protected]>
f2fs: don't set RO when shutting down f2fs
Mario Limonciello <[email protected]>
PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports
Roman Smirnov <[email protected]>
udf: udftime: prevent overflow in udf_disk_stamp_to_time()
Dmitry Baryshkov <[email protected]>
usb: typec: ucsi_glink: drop special handling for CCI_BUSY
Hans de Goede <[email protected]>
usb: dwc3: pci: Don't set "linux,phy_charger_detect" property on Lenovo Yoga Tab2 1380
Joao Pinto <[email protected]>
Avoid hw_desc array overrun in dw-axi-dmac
Alex Henrie <[email protected]>
usb: misc: uss720: check for incompatible versions of the Belkin F5U002
Dmitry Baryshkov <[email protected]>
usb: typec: ucsi_glink: rework quirks implementation
Yunlei He <[email protected]>
f2fs: remove clear SB_INLINECRYPT flag in default_options
Chao Yu <[email protected]>
f2fs: fix to detect inconsistent nat entry during truncation
Michael Grzeschik <[email protected]>
usb: gadget: uvc: configfs: ensure guid to be valid before set
Stephen Brennan <[email protected]>
kprobe/ftrace: bail out if ftrace was killed
Baokun Li <[email protected]>
ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()
Jan Kara <[email protected]>
ext4: do not create EA inode under buffer lock
Aleksandr Aprelkov <[email protected]>
iommu/arm-smmu-v3: Free MSIs in case of ENOMEM
Tzung-Bi Shih <[email protected]>
power: supply: cros_usbpd: provide ID table for avoiding fallback match
Ben Fradella <[email protected]>
platform/x86: p2sb: Don't init until unassigned resources have been assigned
Michael Ellerman <[email protected]>
powerpc/io: Avoid clang null pointer arithmetic warnings
Fullway Wang <[email protected]>
media: mtk-vcodec: potential null pointer deference in SCP
Ricardo Ribalda <[email protected]>
media: intel/ipu6: Fix build with !ACPI
Nathan Lynch <[email protected]>
powerpc/pseries: Enforce hcall result buffer validity and size
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add quirks for Lenovo 13X
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add quirks for HP Omen models using CS35L41
Hans de Goede <[email protected]>
platform/x86: x86-android-tablets: Add Lenovo Yoga Tablet 2 Pro 1380F/L data
Hans de Goede <[email protected]>
platform/x86: x86-android-tablets: Unregister devices in reverse order
Erico Nunes <[email protected]>
drm/lima: mask irqs in timeout path before hard reset
Erico Nunes <[email protected]>
drm/lima: include pp bcast irq in timeout handler check
Erico Nunes <[email protected]>
drm/lima: add mask irq callback to gp and pp
Pierre-Louis Bossart <[email protected]>
ASoC: Intel: sof_sdw: add quirk for Dell SKU 0C0F
Pierre-Louis Bossart <[email protected]>
ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14
Waiman Long <[email protected]>
cgroup/cpuset: Make cpuset hotplug processing synchronous
Arvid Norlander <[email protected]>
platform/x86: toshiba_acpi: Add quirk for buttons on Z830
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Workaround register access in idle race with cursor
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Exit idle optimizations before HDCP execution
Uri Arev <[email protected]>
Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl
David Arinzon <[email protected]>
net: ena: Add validation for completion descriptors consistency
Jakub Kicinski <[email protected]>
selftests: net: fix timestamp not arriving in cmsg_time.sh
Jose E. Marchesi <[email protected]>
bpf: avoid uninitialized warnings in verifier_global_subprogs.c
Takashi Iwai <[email protected]>
ACPI: video: Add backlight=native quirk for Lenovo Slim 7 16ARH7
Luke D. Jones <[email protected]>
HID: asus: fix more n-key report descriptors if n-key quirked
Sean O'Brien <[email protected]>
HID: Add quirk for Logitech Casa touchpad
Leon Yen <[email protected]>
wifi: mt76: mt7921s: fix potential hung tasks during chip recovery
Lingbo Kong <[email protected]>
wifi: ath12k: fix the problem that down grade phy mode operation
Breno Leitao <[email protected]>
netpoll: Fix race condition in netpoll_owner_active
Tamim Khan <[email protected]>
ACPI: resource: Skip IRQ override on Asus Vivobook Pro N6506MV
Luiz Angelo Daros de Luca <[email protected]>
net: dsa: realtek: do not assert reset on remove
Luiz Angelo Daros de Luca <[email protected]>
net: dsa: realtek: keep default LED state in rtl8366rb
Kunwu Chan <[email protected]>
kselftest: arm64: Add a null pointer check
Shiqi Liu <[email protected]>
arm64/sysreg: Update PIE permission encodings
Davide Caratti <[email protected]>
net/sched: fix false lockdep warning on qdisc root lock
Daniel Golle <[email protected]>
net: sfp: add quirk for ATS SFP-GE-T 1000Base-TX module
Marek Behún <[email protected]>
net: sfp: enhance quirk for Fibrestore 2.5G copper SFP module
Manish Rangankar <[email protected]>
scsi: qedi: Fix crash while reading debugfs attribute
Baochen Qiang <[email protected]>
wifi: ath12k: fix kernel crash during resume
Guenter Schafranek <[email protected]>
ACPI: resource: Do IRQ override on GMxBGxx (XMG APEX 17 M23)
Wander Lairson Costa <[email protected]>
drop_monitor: replace spin_lock by raw_spin_lock
Hans de Goede <[email protected]>
ACPI: x86: Add PNP_UART1_SKIP quirk for Lenovo Blade2 tablets
Adrian Hunter <[email protected]>
clocksource: Make watchdog and suspend-timing multiplication overflow safe
Eric Dumazet <[email protected]>
af_packet: avoid a false positive warning in packet_setsockopt()
Arnd Bergmann <[email protected]>
wifi: ath9k: work around memset overflow warning
Ping-Ke Shih <[email protected]>
wifi: rtw89: 8852c: add quirk to set PCI BER for certain platforms
Eric Dumazet <[email protected]>
batman-adv: bypass empty buckets in batadv_purge_orig_ref()
Jian Wen <[email protected]>
devlink: use kvzalloc() to allocate devlink instance resources
Alexei Starovoitov <[email protected]>
bpf: Avoid kfree_rcu() under lock in bpf_lpm_trie.
Yonghong Song <[email protected]>
selftests/bpf: Fix flaky test btf_map_in_map/lookup_update
Alessandro Carminati (Red Hat) <[email protected]>
selftests/bpf: Prevent client connect before server bind in test_tc_tunnel.sh
Rand Deeb <[email protected]>
ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
Justin Stitt <[email protected]>
block/ioctl: prefer different overflow check
Dmitry Baryshkov <[email protected]>
arm64: defconfig: select INTERCONNECT_QCOM_SM6115 as built-in
Kees Cook <[email protected]>
ubsan: Avoid i386 UBSAN handler crashes with Clang
Tzung-Bi Shih <[email protected]>
platform/chrome: cros_usbpd_notify: provide ID table for avoiding fallback match
Tzung-Bi Shih <[email protected]>
platform/chrome: cros_usbpd_logger: provide ID table for avoiding fallback match
Zqiang <[email protected]>
rcutorture: Fix invalid context warning when enable srcu barrier testing
Zqiang <[email protected]>
rcutorture: Make stall-tasks directly exit when rcutorture tests end
Paul E. McKenney <[email protected]>
rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment
Jens Axboe <[email protected]>
io_uring/sqpoll: work around a potential audit memory leak
Chenghai Huang <[email protected]>
crypto: hisilicon/qm - Add the err memory release process to qm uninit
Chenghai Huang <[email protected]>
crypto: hisilicon/sec - Fix memory leak for sec resource release
Herbert Xu <[email protected]>
padata: Disable BH when taking works lock on MT path
Kemeng Shi <[email protected]>
fs/writeback: bail out if there is no more inodes for IO and queued once
-------------
Diffstat:
.../devicetree/bindings/dma/fsl,edma.yaml | 4 +- .../devicetree/bindings/i2c/atmel,at91sam-i2c.yaml | 2 +- .../bindings/i2c/google,cros-ec-i2c-tunnel.yaml | 2 +- Makefile | 4 +- arch/arm/boot/dts/nxp/imx/imx53-qsb-common.dtsi | 2 +- arch/arm/boot/dts/nxp/imx/imx53-qsb-hdmi.dtso | 6 +- arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 3 +- .../arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi | 2 +- .../boot/dts/freescale/imx8mp-venice-gw73xx.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8qm-mek.dts | 2 +- arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts | 1 - arch/arm64/configs/defconfig | 1 + arch/arm64/include/asm/sysreg.h | 24 +-- arch/arm64/kvm/vgic/vgic-init.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 15 +- arch/arm64/kvm/vgic/vgic.h | 2 +- arch/csky/kernel/probes/ftrace.c | 3 + arch/loongarch/Kconfig | 5 +- arch/loongarch/Kconfig.debug | 1 + arch/loongarch/include/asm/hw_breakpoint.h | 4 +- arch/loongarch/kernel/ftrace_dyn.c | 3 + arch/loongarch/kernel/hw_breakpoint.c | 96 +++++---- arch/loongarch/kernel/ptrace.c | 47 +++-- arch/mips/bmips/setup.c | 3 +- arch/mips/include/asm/mipsmtregs.h | 2 +- arch/mips/pci/ops-rc32434.c | 4 +- arch/mips/pci/pcie-octeon.c | 6 + arch/parisc/kernel/ftrace.c | 3 + arch/powerpc/crypto/.gitignore | 2 + arch/powerpc/include/asm/hvcall.h | 8 +- arch/powerpc/include/asm/io.h | 24 +-- arch/powerpc/kernel/kprobes-ftrace.c | 3 + arch/riscv/kernel/probes/ftrace.c | 3 + arch/s390/kernel/ftrace.c | 3 + arch/x86/include/asm/cpu_device_id.h | 98 ++++++++++ arch/x86/include/asm/efi.h | 1 - arch/x86/kernel/cpu/match.c | 4 +- arch/x86/kernel/cpu/resctrl/monitor.c | 3 +- arch/x86/kernel/kprobes/ftrace.c | 3 + arch/x86/kvm/x86.c | 9 +- arch/x86/platform/efi/memmap.c | 12 +- block/ioctl.c | 2 +- drivers/acpi/acpica/acevents.h | 4 + drivers/acpi/acpica/evregion.c | 6 +- drivers/acpi/acpica/evxfregn.c | 54 ++++++ drivers/acpi/acpica/exregion.c | 23 +-- drivers/acpi/ec.c | 28 ++- drivers/acpi/internal.h | 5 +- drivers/acpi/mipi-disco-img.c | 28 ++- drivers/acpi/resource.c | 13 ++ drivers/acpi/video_detect.c | 8 + drivers/acpi/x86/utils.c | 20 +- drivers/ata/ahci.c | 8 + drivers/block/nbd.c | 34 ++-- drivers/bluetooth/ath3k.c | 25 ++- drivers/cpufreq/amd-pstate.c | 7 + drivers/crypto/hisilicon/qm.c | 5 +- drivers/crypto/hisilicon/sec2/sec_crypto.c | 4 +- drivers/cxl/core/pci.c | 29 +++ drivers/cxl/cxl.h | 2 + drivers/cxl/pci.c | 22 +++ drivers/dma/Kconfig | 2 +- drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 6 +- drivers/dma/dw-axi-dmac/dw-axi-dmac.h | 1 + drivers/dma/idxd/irq.c | 4 +- drivers/dma/ioat/init.c | 55 +++--- drivers/dma/ti/k3-udma-glue.c | 5 +- drivers/dma/xilinx/xdma.c | 4 +- drivers/firmware/efi/memmap.c | 9 - drivers/firmware/psci/psci.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 66 ++++--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 - drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 23 ++- .../drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 72 +++++++ .../drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h | 2 + .../gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c | 2 +- drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | 2 + drivers/gpu/drm/i915/display/intel_dp.c | 4 + drivers/gpu/drm/lima/lima_bcast.c | 12 ++ drivers/gpu/drm/lima/lima_bcast.h | 3 + drivers/gpu/drm/lima/lima_gp.c | 8 + drivers/gpu/drm/lima/lima_pp.c | 18 ++ drivers/gpu/drm/lima/lima_sched.c | 9 + drivers/gpu/drm/lima/lima_sched.h | 1 + drivers/gpu/drm/radeon/sumo_dpm.c | 2 + drivers/gpu/drm/xe/xe_guc.c | 4 +- drivers/gpu/drm/xe/xe_guc_ct.c | 4 + drivers/hid/hid-asus.c | 51 +++-- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-multitouch.c | 6 + drivers/i2c/busses/i2c-imx-lpi2c.c | 19 +- drivers/i2c/busses/i2c-ocores.c | 2 +- drivers/infiniband/hw/bnxt_re/bnxt_re.h | 4 +- drivers/infiniband/hw/mana/mr.c | 1 + drivers/infiniband/hw/mlx5/main.c | 4 +- drivers/infiniband/hw/mlx5/mr.c | 8 +- drivers/infiniband/hw/mlx5/srq.c | 13 +- drivers/infiniband/sw/rxe/rxe_resp.c | 13 ++ drivers/infiniband/sw/rxe/rxe_verbs.c | 2 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +- drivers/media/pci/intel/ipu-bridge.c | 66 +++++-- .../mediatek/vcodec/common/mtk_vcodec_fw_scp.c | 2 + drivers/net/dsa/realtek/rtl8366rb.c | 87 ++------- drivers/net/dsa/realtek/rtl83xx.c | 7 +- drivers/net/ethernet/amazon/ena/ena_eth_com.c | 37 +++- drivers/net/ethernet/amazon/ena/ena_netdev.c | 2 + drivers/net/ethernet/amazon/ena/ena_regs_defs.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 +- drivers/net/ethernet/intel/ice/ice_ddp.c | 23 ++- drivers/net/ethernet/intel/ice/ice_main.c | 10 +- drivers/net/ethernet/intel/ice/ice_switch.c | 6 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 5 +- .../net/ethernet/marvell/octeontx2/nic/Makefile | 3 +- .../ethernet/marvell/octeontx2/nic/otx2_dcbnl.c | 7 + .../ethernet/marvell/octeontx2/nic/otx2_devlink.c | 2 + .../net/ethernet/marvell/octeontx2/nic/otx2_txrx.c | 5 +- drivers/net/ethernet/microchip/lan743x_ethtool.c | 44 ++++- drivers/net/ethernet/microchip/lan743x_main.c | 48 ++++- drivers/net/ethernet/microchip/lan743x_main.h | 28 +++ drivers/net/ethernet/qualcomm/qca_debug.c | 6 +- drivers/net/ethernet/qualcomm/qca_spi.c | 16 +- drivers/net/ethernet/qualcomm/qca_spi.h | 3 +- .../net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c | 6 +- drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 40 ++-- drivers/net/phy/dp83tg720.c | 38 +++- drivers/net/phy/mxl-gpy.c | 58 ++++-- drivers/net/phy/sfp.c | 21 +- drivers/net/usb/ax88179_178a.c | 18 +- drivers/net/usb/rtl8150.c | 3 +- drivers/net/virtio_net.c | 32 ++- drivers/net/wireless/ath/ath.h | 6 +- drivers/net/wireless/ath/ath12k/core.c | 1 - drivers/net/wireless/ath/ath12k/mac.c | 16 +- drivers/net/wireless/ath/ath12k/qmi.c | 61 ++++-- drivers/net/wireless/ath/ath12k/qmi.h | 2 + drivers/net/wireless/ath/ath9k/main.c | 3 +- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +- drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 2 + .../net/wireless/mediatek/mt76/mt7921/pci_mac.c | 2 - .../net/wireless/mediatek/mt76/mt7921/sdio_mac.c | 2 - drivers/net/wireless/mediatek/mt76/sdio.c | 3 +- drivers/net/wireless/realtek/rtw89/core.c | 18 ++ drivers/net/wireless/realtek/rtw89/core.h | 10 + drivers/net/wireless/realtek/rtw89/pci.c | 19 ++ drivers/net/wireless/realtek/rtw89/pci.h | 5 + drivers/net/wireless/realtek/rtw89/rtw8851be.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8852ae.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8852be.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8852ce.c | 23 +++ drivers/net/wireless/realtek/rtw89/rtw8922ae.c | 1 + drivers/opp/core.c | 31 ++- drivers/pci/pci.c | 17 ++ drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 189 +++++++++++++++--- drivers/phy/qualcomm/phy-qcom-qmp-pcs-v6-n4.h | 32 +++ .../phy/qualcomm/phy-qcom-qmp-qserdes-txrx-v6_n4.h | 13 ++ drivers/phy/qualcomm/phy-qcom-qmp.h | 2 + drivers/platform/chrome/cros_usbpd_logger.c | 9 +- drivers/platform/chrome/cros_usbpd_notify.c | 9 +- drivers/platform/x86/p2sb.c | 29 +-- drivers/platform/x86/toshiba_acpi.c | 36 +++- drivers/platform/x86/x86-android-tablets/core.c | 8 +- drivers/platform/x86/x86-android-tablets/dmi.c | 18 ++ drivers/platform/x86/x86-android-tablets/lenovo.c | 216 +++++++++++++++++++++ .../x86/x86-android-tablets/x86-android-tablets.h | 1 + drivers/pmdomain/core.c | 10 + drivers/power/supply/cros_usbpd-charger.c | 11 +- drivers/ptp/ptp_sysfs.c | 3 +- drivers/regulator/bd71815-regulator.c | 2 +- drivers/regulator/core.c | 1 + drivers/scsi/qedi/qedi_debugfs.c | 12 +- drivers/scsi/sd.c | 4 + drivers/spi/spi-cs42l43.c | 2 +- drivers/spi/spi-imx.c | 14 +- drivers/spi/spi-stm32-qspi.c | 12 +- drivers/spi/spi.c | 10 +- drivers/ssb/main.c | 4 +- .../int340x_thermal/processor_thermal_device_pci.c | 3 +- drivers/thermal/mediatek/lvts_thermal.c | 6 +- drivers/thermal/thermal_core.c | 6 + drivers/tty/serial/8250/8250_dw.c | 27 +++ drivers/tty/serial/8250/8250_dwlib.h | 32 --- drivers/tty/serial/8250/8250_exar.c | 42 ++++ drivers/tty/serial/imx.c | 7 +- drivers/tty/tty_ldisc.c | 6 + drivers/tty/vt/vt.c | 10 + drivers/ufs/core/ufshcd.c | 1 + drivers/usb/dwc3/dwc3-pci.c | 8 +- drivers/usb/gadget/function/f_hid.c | 6 +- drivers/usb/gadget/function/f_printer.c | 6 +- drivers/usb/gadget/function/rndis.c | 4 +- drivers/usb/gadget/function/uvc_configfs.c | 14 +- drivers/usb/host/xhci-pci.c | 15 +- drivers/usb/host/xhci-rcar.c | 6 +- drivers/usb/host/xhci-ring.c | 15 +- drivers/usb/host/xhci.h | 4 +- drivers/usb/misc/uss720.c | 22 ++- drivers/usb/storage/scsiglue.c | 6 + drivers/usb/storage/uas.c | 7 + drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c | 10 +- drivers/usb/typec/ucsi/ucsi_glink.c | 22 +-- drivers/vfio/pci/vfio_pci_core.c | 78 +++++--- fs/btrfs/bio.c | 4 +- fs/btrfs/block-group.c | 11 +- fs/ext4/mballoc.c | 4 + fs/ext4/super.c | 22 +-- fs/ext4/sysfs.c | 24 ++- fs/ext4/xattr.c | 113 +++++------ fs/f2fs/node.c | 12 +- fs/f2fs/super.c | 12 +- fs/fs-writeback.c | 7 +- fs/ocfs2/journal.c | 192 ++++++++++-------- fs/ocfs2/ocfs2.h | 27 +++ fs/ocfs2/super.c | 4 +- fs/overlayfs/export.c | 6 +- fs/smb/client/cifsfs.c | 2 +- fs/udf/udftime.c | 11 +- include/acpi/acpixf.h | 4 + include/linux/bpf_verifier.h | 2 + include/linux/cpuset.h | 3 - include/linux/kcov.h | 2 + include/linux/kprobes.h | 7 + include/linux/lsm_hook_defs.h | 2 +- include/linux/mod_devicetable.h | 2 + include/linux/pagemap.h | 4 + include/linux/pci.h | 7 +- include/linux/pm_domain.h | 6 + include/linux/security.h | 5 +- include/linux/tty_driver.h | 8 + include/net/netns/netfilter.h | 3 + include/net/sch_generic.h | 1 + include/scsi/scsi_devinfo.h | 4 +- io_uring/rsrc.c | 1 - io_uring/sqpoll.c | 8 + kernel/auditfilter.c | 5 +- kernel/bpf/lpm_trie.c | 13 +- kernel/bpf/verifier.c | 14 +- kernel/cgroup/cpuset.c | 141 ++++++-------- kernel/cpu.c | 48 ----- kernel/gcov/gcc_4_7.c | 4 +- kernel/kcov.c | 1 + kernel/kprobes.c | 6 + kernel/padata.c | 8 +- kernel/power/process.c | 2 - kernel/rcu/rcutorture.c | 16 +- kernel/time/clocksource.c | 42 ++-- kernel/trace/Kconfig | 4 +- kernel/trace/ftrace.c | 1 + kernel/trace/preemptirq_delay_test.c | 1 + lib/ubsan.h | 41 ++-- mm/huge_memory.c | 28 +-- mm/memcontrol.c | 3 +- mm/page_table_check.c | 11 +- mm/shmem.c | 2 +- net/batman-adv/originator.c | 2 + net/core/drop_monitor.c | 20 +- net/core/filter.c | 5 + net/core/net_namespace.c | 9 +- net/core/netdev-genl.c | 16 +- net/core/netpoll.c | 2 +- net/core/sock.c | 3 + net/devlink/core.c | 6 +- net/ipv4/cipso_ipv4.c | 12 +- net/ipv4/tcp_ao.c | 6 +- net/ipv4/tcp_input.c | 1 + net/ipv6/route.c | 4 +- net/ipv6/seg6_local.c | 8 +- net/ipv6/xfrm6_policy.c | 8 +- net/mac80211/driver-ops.c | 17 ++ net/mac80211/iface.c | 22 +-- net/mac80211/util.c | 2 +- net/netfilter/core.c | 13 +- net/netfilter/ipset/ip_set_core.c | 11 +- net/netfilter/nf_conntrack_standalone.c | 15 -- net/netfilter/nf_hooks_lwtunnel.c | 67 +++++++ net/netfilter/nf_internals.h | 6 + net/netrom/nr_timer.c | 3 +- net/packet/af_packet.c | 26 +-- net/sched/act_api.c | 3 +- net/sched/act_ct.c | 16 +- net/sched/sch_api.c | 1 + net/sched/sch_generic.c | 4 + net/sched/sch_htb.c | 22 +-- net/tipc/node.c | 1 + security/apparmor/audit.c | 6 +- security/apparmor/include/audit.h | 2 +- security/integrity/ima/ima.h | 2 +- security/integrity/ima/ima_policy.c | 15 +- security/security.c | 6 +- security/selinux/include/audit.h | 4 +- security/selinux/ss/services.c | 5 +- security/smack/smack_lsm.c | 4 +- sound/core/seq/seq_ump_convert.c | 2 + sound/hda/intel-dsp-config.c | 2 +- sound/pci/hda/cs35l41_hda.c | 6 +- sound/pci/hda/cs35l56_hda.c | 4 +- sound/pci/hda/patch_realtek.c | 15 +- sound/pci/hda/tas2781_hda_i2c.c | 4 +- sound/soc/intel/boards/sof_sdw.c | 18 ++ tools/arch/arm64/include/asm/sysreg.h | 24 +-- tools/testing/selftests/arm64/tags/tags_test.c | 4 + .../selftests/bpf/prog_tests/btf_map_in_map.c | 26 +-- .../selftests/bpf/progs/verifier_global_subprogs.c | 7 + tools/testing/selftests/bpf/test_tc_tunnel.sh | 13 +- tools/testing/selftests/net/cmsg_sender.c | 20 +- tools/testing/selftests/net/mptcp/userspace_pm.sh | 46 +++-- .../selftests/net/openvswitch/openvswitch.sh | 2 +- virt/kvm/guest_memfd.c | 5 +- virt/kvm/kvm_main.c | 5 +- 308 files changed, 3159 insertions(+), 1398 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/250 fs/writeback: bail out if there is no more inodes for IO and queued once
6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kemeng Shi <[email protected]>
[ Upstream commit d92109891f21cf367caa2cc6dff11a4411d917f4 ]
For case there is no more inodes for IO in io list from last wb_writeback, We may bail out early even there is inode in dirty list should be written back. Only bail out when we queued once to avoid missing dirtied inode.
This is from code reading...
--- fs/fs-writeback.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/fs-writeback.c +5 -2
@@ -2069,6 +2069,7 @@ static long wb_writeback(struct bdi_writeback *wb,struct inode *inode;long progress;struct blk_plug plug; +bool queued = false;blk_start_plug (&plug);for (;;) {
@@ -2111,8 +2112,10 @@ static long wb_writeback(struct bdi_writeback *wb, dirtied_before = jiffies;trace_writeback_start (wb, work); -if (list_empty (&wb->b_io)) +if (list_empty (&wb->b_io)) {queue_io (wb, work, dirtied_before); + queued = true; + }if (work->sb) progress =writeback_sb_inodes (work->sb, wb, work);else
@@ -2127,7 +2130,7 @@ static long wb_writeback(struct bdi_writeback *wb,* mean the overall work is done. So we keep looping as long * as made some progress on cleaning pages or inodes. */ -if (progress) { +if (progress || !queued) {spin_unlock (&wb->list_lock);continue ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/250 padata: Disable BH when taking works lock on MT path
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 58329c4312031603bb1786b44265c26d5065fe72 ]
As the old padata code can execute in softirq context, disable softirqs for the new padata_do_mutithreaded code too as otherwise lockdep will get antsy.
--- kernel/padata.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
kernel/padata.c +4 -4
@@ -106,7 +106,7 @@ static int __init padata_work_alloc_mt(int nworks, void *data, {int i; -spin_lock (&padata_works_lock); +spin_lock_bh (&padata_works_lock);/* Start at 1 because the current task participates in the job. */ for (i =1 ; i < nworks; ++i) {struct padata_work *pw =padata_work_alloc ();
@@ -116,7 +116,7 @@ static int __init padata_work_alloc_mt(int nworks, void *data,padata_work_init (pw, padata_mt_helper, data,0 );list_add (&pw->pw_list, head); } -spin_unlock (&padata_works_lock); +spin_unlock_bh (&padata_works_lock);return i; }
@@ -134,12 +134,12 @@ static void __init padata_works_free(struct list_head *works)if (list_empty (works))return ; -spin_lock (&padata_works_lock); +spin_lock_bh (&padata_works_lock);list_for_each_entry_safe (cur, next, works, pw_list) {list_del (&cur->pw_list);padata_work_free (cur); } -spin_unlock (&padata_works_lock); +spin_unlock_bh (&padata_works_lock); }static void padata_parallel_worker (struct work_struct *parallel_work)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/250 crypto: hisilicon/sec - Fix memory leak for sec resource release
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenghai Huang <[email protected]>
[ Upstream commit bba4250757b4ae1680fea435a358d8093f254094 ]
The AIV is one of the SEC resources. When releasing resources, it need to release the AIV resources at the same time. Otherwise, memory leakage occurs.
The aiv resource release is added to the sec resource release function.
--- drivers/crypto/hisilicon/sec2/sec_crypto.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/crypto/hisilicon/sec2/sec_crypto.c +3 -1
@@ -481,8 +481,10 @@ static void sec_alg_resource_free(struct sec_ctx *ctx,if (ctx->pbuf_supported)sec_free_pbuf_resource (dev, qp_ctx->res); -if (ctx->alg_type ==SEC_AEAD ) +if (ctx->alg_type ==SEC_AEAD ) {sec_free_mac_resource (dev, qp_ctx->res); +sec_free_aiv_resource (dev, qp_ctx->res); + } }static int sec_alloc_qp_ctx_resource (struct sec_ctx *ctx,struct sec_qp_ctx *qp_ctx)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/250 crypto: hisilicon/qm - Add the err memory release process to qm uninit
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenghai Huang <[email protected]>
[ Upstream commit c9ccfd5e0ff0dd929ce86d1b5f3c6a414110947a ]
When the qm uninit command is executed, the err data needs to be released to prevent memory leakage. The error information release operation and uacce_remove are integrated in qm_remove_uacce.
So add the qm_remove_uacce to qm uninit to avoid err memory leakage.
--- drivers/crypto/hisilicon/qm.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/crypto/hisilicon/qm.c +1 -4
@@ -2893,12 +2893,9 @@ void hisi_qm_uninit(struct hisi_qm *qm)hisi_qm_set_state (qm,QM_NOT_READY );up_write (&qm->qps_lock); +qm_remove_uacce (qm);qm_irqs_unregister (qm);hisi_qm_pci_uninit (qm); -if (qm->use_sva) { -uacce_remove (qm->uacce); - qm->uacce =NULL ; - } }EXPORT_SYMBOL_GPL (hisi_qm_uninit);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/250 io_uring/sqpoll: work around a potential audit memory leak
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
[ Upstream commit c4ce0ab27646f4206a9eb502d6fe45cb080e1cae ]
kmemleak complains that there's a memory leak related to connect handling:
unreferenced object 0xffff0001093bdf00 (size 128):
comm "iou-sqp-455", pid 457, jiffies 4294894164
hex dump (first 32 bytes):
02 00 fa ea 7f 00 00 01 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 2e481b1a):
[<00000000c0a26af4>] kmemleak_alloc+0x30/0x38 [<000000009c30bb45>] kmalloc_trace+0x228/0x358 [<000000009da9d39f>] __audit_sockaddr+0xd0/0x138 [<0000000089a93e34>] move_addr_to_kernel+0x1a0/0x1f8 [<000000000b4e80e6>] io_connect_prep+0x1ec/0x2d4 [<00000000abfbcd99>] io_submit_sqes+0x588/0x1e48 [<00000000e7c25e07>] io_sq_thread+0x8a4/0x10e4 [<00000000d999b491>] ret_from_fork+0x10/0x20
which can can happen if:
1) The command type does something on the prep side that triggers an audit call.
2) The thread hasn't done any operations before this that triggered an audit call inside ->issue(), where we have audit_uring_entry() and audit_uring_exit().
Work around this by issuing a blanket NOP operation before the SQPOLL does anything.
--- io_uring/sqpoll.c | 8 ++++++++ 1 file changed, 8 insertions(+)
io_uring/sqpoll.c +8 -0
@@ -293,6 +293,14 @@ static int io_sq_thread(void *data) sqd->sq_cpu =raw_smp_processor_id (); } +/* +* Force audit context to get setup, in case we do prep side async +* operations that would trigger an audit call before any issue side +* audit has been done. +*/ +audit_uring_entry (IORING_OP_NOP ); +audit_uring_exit (true,0 ); +mutex_lock (&sqd->lock);while (1 ) {bool cap_entries, sqt_spin = false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/250 rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul E. McKenney <[email protected]>
[ Upstream commit 8b9b443fa860276822b25057cb3ff3b28734dec0 ]
The "pipe_count > RCU_TORTURE_PIPE_LEN" check has a comment saying "Should not happen, but...". This is only true when testing an RCU whose grace periods are always long enough. This commit therefore fixes this comment.
--- kernel/rcu/rcutorture.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/rcu/rcutorture.c +2 -1
@@ -1997,7 +1997,8 @@ static bool rcu_torture_one_read(struct torture_random_state *trsp, long myid)preempt_disable (); pipe_count =READ_ONCE (p->rtort_pipe_count);if (pipe_count >RCU_TORTURE_PIPE_LEN ) { -/* Should not happen, but... */ +// Should not happen in a correct RCU implementation, +// happens quite often for torture_type=busted. pipe_count =RCU_TORTURE_PIPE_LEN ; } completed = cur_ops->get_gp_seq ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/250 rcutorture: Make stall-tasks directly exit when rcutorture tests end
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zqiang <[email protected]>
[ Upstream commit 431315a563015f259b28e34c5842f6166439e969 ]
When the rcutorture tests start to exit, the rcu_torture_cleanup() is invoked to stop kthreads and release resources, if the stall-task kthreads exist, cpu-stall has started and the rcutorture.stall_cpu is set to a larger value, the rcu_torture_cleanup() will be blocked for a long time and the hung-task may occur, this commit therefore add kthread_should_stop() to the loop of cpu-stall operation, when rcutorture tests ends, no need to wait for cpu-stall to end, exit directly.
Use the following command to test:
insmod rcutorture.ko torture_type=srcu fwd_progress=0 stat_interval=4 stall_cpu_block=1 stall_cpu=200 stall_cpu_holdoff=10 read_exit_burst=0 object_debug=1
rmmod rcutorture
[15361.918610] INFO: task rmmod:878 blocked for more than 122 seconds. [15361.918613] Tainted: G W 6.8.0-rc2-yoctodev-standard+ #25 [15361.918615] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [15361.918616] task:rmmod state:D stack:0 pid:878 tgid:878 ppid:773 flags:0x00004002 [15361.918621] Call Trace: [15361.918623] <TASK> [15361.918626] __schedule+0xc0d/0x28f0 [15361.918631] ? __pfx___schedule+0x10/0x10 [15361.918635] ? rcu_is_watching+0x19/0xb0 [15361.918638] ? schedule+0x1f6/0x290 [15361.918642] ? __pfx_lock_release+0x10/0x10 [15361.918645] ? schedule+0xc9/0x290 [15361.918648] ? schedule+0xc9/0x290 [15361.918653] ? trace_preempt_off+0x54/0x100 [15361.918657] ? schedule+0xc9/0x290 [15361.918661] schedule+0xd0/0x290 [15361.918665] schedule_timeout+0x56d/0x7d0 [15361.918669] ? debug_smp_processor_id+0x1b/0x30 [15361.918672] ? rcu_is_watching+0x19/0xb0 [15361.918676] ? __pfx_schedule_timeout+0x10/0x10 [15361.918679] ? debug_smp_processor_id+0x1b/0x30 [15361.918683] ? rcu_is_watching+0x19/0xb0 [15361.918686] ? wait_for_completion+0x179/0x4c0 [15361.918690] ? __pfx_lock_release+0x10/0x10 [15361.918693] ? __kasan_check_write+0x18/0x20 [15361.918696] ? wait_for_completion+0x9d/0x4c0 [15361.918700] ? _raw_spin_unlock_irq+0x36/0x50 [15361.918703] ? wait_for_completion+0x179/0x4c0 [15361.918707] ? _raw_spin_unlock_irq+0x36/0x50 [15361.918710] ? wait_for_completion+0x179/0x4c0 [15361.918714] ? trace_preempt_on+0x54/0x100 [15361.918718] ? wait_for_completion+0x179/0x4c0 [15361.918723] wait_for_completion+0x181/0x4c0 [15361.918728] ? __pfx_wait_for_completion+0x10/0x10 [15361.918738] kthread_stop+0x152/0x470 [15361.918742] _torture_stop_kthread+0x44/0xc0 [torture 7af7f9cbba28271a10503b653f9e05d518fbc8c3] [15361.918752] rcu_torture_cleanup+0x2ac/0xe90 [rcutorture f2cb1f556ee7956270927183c4c2c7749a336529] [15361.918766] ? __pfx_rcu_torture_cleanup+0x10/0x10 [rcutorture f2cb1f556ee7956270927183c4c2c7749a336529] [15361.918777] ? __kasan_check_write+0x18/0x20 [15361.918781] ? __mutex_unlock_slowpath+0x17c/0x670 [15361.918789] ? __might_fault+0xcd/0x180 [15361.918793] ? find_module_all+0x104/0x1d0 [15361.918799] __x64_sys_delete_module+0x2a4/0x3f0 [15361.918803] ? __pfx___x64_sys_delete_module+0x10/0x10 [15361.918807] ? syscall_exit_to_user_mode+0x149/0x280
--- kernel/rcu/rcutorture.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/rcu/rcutorture.c +2 -2
@@ -2487,8 +2487,8 @@ static int rcu_torture_stall(void *args)preempt_disable ();pr_alert ("%s start on CPU %d.\n" , __func__,raw_smp_processor_id ()); -while (ULONG_CMP_LT ((unsigned long )ktime_get_seconds (), - stop_at)) +while (ULONG_CMP_LT ((unsigned long )ktime_get_seconds (), stop_at) && + !kthread_should_stop ())if (stall_cpu_block) {#ifdef CONFIG_PREEMPTION preempt_schedule ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/250 rcutorture: Fix invalid context warning when enable srcu barrier testing
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zqiang <[email protected]>
[ Upstream commit 668c0406d887467d53f8fe79261dda1d22d5b671 ]
When the torture_type is set srcu or srcud and cb_barrier is non-zero, running the rcutorture test will trigger the following warning:
[ 163.910989][ C1] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [ 163.910994][ C1] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1 [ 163.910999][ C1] preempt_count: 10001, expected: 0 [ 163.911002][ C1] RCU nest depth: 0, expected: 0 [ 163.911005][ C1] INFO: lockdep is turned off. [ 163.911007][ C1] irq event stamp: 30964 [ 163.911010][ C1] hardirqs last enabled at (30963): [<ffffffffabc7df52>] do_idle+0x362/0x500 [ 163.911018][ C1] hardirqs last disabled at (30964): [<ffffffffae616eff>] sysvec_call_function_single+0xf/0xd0 [ 163.911025][ C1] softirqs last enabled at (0): [<ffffffffabb6475f>] copy_process+0x16ff/0x6580 [ 163.911033][ C1] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 163.911038][ C1] Preemption disabled at: [ 163.911039][ C1] [<ffffffffacf1964b>] stack_depot_save_flags+0x24b/0x6c0 [ 163.911063][ C1] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G W 6.8.0-rc4-rt4-yocto-preempt-rt+ #3 1e39aa9a737dd024a3275c4f835a872f673a7d3a [ 163.911071][ C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [ 163.911075][ C1] Call Trace: [ 163.911078][ C1] <IRQ> [ 163.911080][ C1] dump_stack_lvl+0x88/0xd0 [ 163.911089][ C1] dump_stack+0x10/0x20 [ 163.911095][ C1] __might_resched+0x36f/0x530 [ 163.911105][ C1] rt_spin_lock+0x82/0x1c0 [ 163.911112][ C1] spin_lock_irqsave_ssp_contention+0xb8/0x100 [ 163.911121][ C1] srcu_gp_start_if_needed+0x782/0xf00 [ 163.911128][ C1] ? _raw_spin_unlock_irqrestore+0x46/0x70 [ 163.911136][ C1] ? debug_object_active_state+0x336/0x470 [ 163.911148][ C1] ? __pfx_srcu_gp_start_if_needed+0x10/0x10 [ 163.911156][ C1] ? __pfx_lock_release+0x10/0x10 [ 163.911165][ C1] ? __pfx_rcu_torture_barrier_cbf+0x10/0x10 [ 163.911188][ C1] __call_srcu+0x9f/0xe0 [ 163.911196][ C1] call_srcu+0x13/0x20 [ 163.911201][ C1] srcu_torture_call+0x1b/0x30 [ 163.911224][ C1] rcu_torture_barrier1cb+0x4a/0x60 [ 163.911247][ C1] __flush_smp_call_function_queue+0x267/0xca0 [ 163.911256][ C1] ? __pfx_rcu_torture_barrier1cb+0x10/0x10 [ 163.911281][ C1] generic_smp_call_function_single_interrupt+0x13/0x20 [ 163.911288][ C1] __sysvec_call_function_single+0x7d/0x280 [ 163.911295][ C1] sysvec_call_function_single+0x93/0xd0 [ 163.911302][ C1] </IRQ> [ 163.911304][ C1] <TASK> [ 163.911308][ C1] asm_sysvec_call_function_single+0x1b/0x20 [ 163.911313][ C1] RIP: 0010:default_idle+0x17/0x20 [ 163.911326][ C1] RSP: 0018:ffff888001997dc8 EFLAGS: 00000246 [ 163.911333][ C1] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffffffffae618b51 [ 163.911337][ C1] RDX: 0000000000000000 RSI: ffffffffaea80920 RDI: ffffffffaec2de80 [ 163.911342][ C1] RBP: ffff888001997dc8 R08: 0000000000000001 R09: ffffed100d740cad [ 163.911346][ C1] R10: ffffed100d740cac R11: ffff88806ba06563 R12: 0000000000000001 [ 163.911350][ C1] R13: ffffffffafe460c0 R14: ffffffffafe460c0 R15: 0000000000000000 [ 163.911358][ C1] ? ct_kernel_exit.constprop.3+0x121/0x160 [ 163.911369][ C1] ? lockdep_hardirqs_on+0xc4/0x150 [ 163.911376][ C1] arch_cpu_idle+0x9/0x10 [ 163.911383][ C1] default_idle_call+0x7a/0xb0 [ 163.911390][ C1] do_idle+0x362/0x500 [ 163.911398][ C1] ? __pfx_do_idle+0x10/0x10 [ 163.911404][ C1] ? complete_with_flags+0x8b/0xb0 [ 163.911416][ C1] cpu_startup_entry+0x58/0x70 [ 163.911423][ C1] start_secondary+0x221/0x280 [ 163.911430][ C1] ? __pfx_start_secondary+0x10/0x10 [ 163.911440][ C1] secondary_startup_64_no_verify+0x17f/0x18b [ 163.911455][ C1] </TASK>
This commit therefore use smp_call_on_cpu() instead of smp_call_function_single(), make rcu_torture_barrier1cb() invoked happens on task-context.
--- kernel/rcu/rcutorture.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
kernel/rcu/rcutorture.c +4 -5
@@ -3041,11 +3041,12 @@ static void rcu_torture_barrier_cbf(struct rcu_head *rcu) }/* IPI handler to get callback posted on desired CPU, if online. */ -static void rcu_torture_barrier1cb (void *rcu_void) +static int rcu_torture_barrier1cb (void *rcu_void) {struct rcu_head *rhp = rcu_void; cur_ops->call (rhp, rcu_torture_barrier_cbf); +return 0 ; }/* kthread function to register callbacks used to test RCU barriers. */
@@ -3071,11 +3072,9 @@ static int rcu_torture_barrier_cbs(void *arg)* The above smp_load_acquire() ensures barrier_phase load * is ordered before the following ->call(). */ -if (smp_call_function_single (myid, rcu_torture_barrier1cb, - &rcu,1 )) { -// IPI failed, so use direct call from current CPU. +if (smp_call_on_cpu (myid, rcu_torture_barrier1cb, &rcu,1 )) cur_ops->call (&rcu, rcu_torture_barrier_cbf); - } +if (atomic_dec_and_test (&barrier_cbs_count))wake_up (&barrier_wq); }while (!torture_must_stop ());
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/250 platform/chrome: cros_usbpd_logger: provide ID table for avoiding fallback match
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <[email protected]>
[ Upstream commit e0e59c5335a0a038058a080474c34fe04debff33 ]
Instead of using fallback driver name match, provide ID table[1] for the primary match.
[1]: https://elixir.bootlin.com/linux/v6.8/source/drivers/base/platform.c#L1353
--- drivers/platform/chrome/cros_usbpd_logger.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/platform/chrome/cros_usbpd_logger.c +8 -1
@@ -7,6 +7,7 @@#include <linux/ktime.h> #include <linux/math64.h> +#include <linux/mod_devicetable.h> #include <linux/module.h> #include <linux/platform_data/cros_ec_commands.h> #include <linux/platform_data/cros_ec_proto.h>
@@ -249,6 +250,12 @@ static int __maybe_unused cros_usbpd_logger_suspend(struct device *dev) static SIMPLE_DEV_PM_OPS(cros_usbpd_logger_pm_ops, cros_usbpd_logger_suspend, cros_usbpd_logger_resume); +static const struct platform_device_id cros_usbpd_logger_id[] = { + {DRV_NAME ,0 }, + {} +}; +MODULE_DEVICE_TABLE (platform, cros_usbpd_logger_id); +static struct platform_driver cros_usbpd_logger_driver = { .driver = { .name =DRV_NAME ,
@@ -256,10 +263,10 @@ static struct platform_driver cros_usbpd_logger_driver = { }, .probe = cros_usbpd_logger_probe, .remove_new = cros_usbpd_logger_remove, + .id_table = cros_usbpd_logger_id, };module_platform_driver (cros_usbpd_logger_driver);MODULE_LICENSE ("GPL v2" );MODULE_DESCRIPTION ("Logging driver for ChromeOS EC USBPD Charger." ); -MODULE_ALIAS ("platform:" DRV_NAME );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/250 platform/chrome: cros_usbpd_notify: provide ID table for avoiding fallback match
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <[email protected]>
[ Upstream commit 8ad3b9652ed6a115c56214a0eab06952818b3ddf ]
Instead of using fallback driver name match, provide ID table[1] for the primary match.
[1]: https://elixir.bootlin.com/linux/v6.8/source/drivers/base/platform.c#L1353
--- drivers/platform/chrome/cros_usbpd_notify.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/platform/chrome/cros_usbpd_notify.c +8 -1
@@ -6,6 +6,7 @@*/ #include <linux/acpi.h> +#include <linux/mod_devicetable.h> #include <linux/module.h> #include <linux/platform_data/cros_ec_proto.h> #include <linux/platform_data/cros_usbpd_notify.h>
@@ -218,12 +219,19 @@ static void cros_usbpd_notify_remove_plat(struct platform_device *pdev) &pdnotify->nb); } +static const struct platform_device_id cros_usbpd_notify_id[] = { + {DRV_NAME ,0 }, + {} +}; +MODULE_DEVICE_TABLE (platform, cros_usbpd_notify_id); +static struct platform_driver cros_usbpd_notify_plat_driver = { .driver = { .name =DRV_NAME , }, .probe = cros_usbpd_notify_probe_plat, .remove_new = cros_usbpd_notify_remove_plat, + .id_table = cros_usbpd_notify_id, };static int __init cros_usbpd_notify_init (void )
@@ -258,4 +266,3 @@ module_exit(cros_usbpd_notify_exit);MODULE_LICENSE ("GPL" );MODULE_DESCRIPTION ("ChromeOS power delivery notifier device" );MODULE_AUTHOR ("Jon Flatley <[email protected]>" ); -MODULE_ALIAS ("platform:" DRV_NAME );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/250 ubsan: Avoid i386 UBSAN handler crashes with Clang
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 2e431b23a13ce4459cf484c8f0b3218c7048b515 ]
When generating Runtime Calls, Clang doesn't respect the -mregparm=3 option used on i386. Hopefully this will be fixed correctly in Clang 19:
https://github.com/llvm/llvm-project/pull/89707
but we need to fix this for earlier Clang versions today. Force the calling convention to use non-register arguments.
--- lib/ubsan.h | 41 +++++++++++++++++++++++++++-------------- 1 file changed, 27 insertions(+), 14 deletions(-)
lib/ubsan.h +27 -14
@@ -124,19 +124,32 @@ typedef s64 s_max;typedef u64 u_max ;#endif -void __ubsan_handle_add_overflow (void *data,void *lhs,void *rhs); -void __ubsan_handle_sub_overflow (void *data,void *lhs,void *rhs); -void __ubsan_handle_mul_overflow (void *data,void *lhs,void *rhs); -void __ubsan_handle_negate_overflow (void *_data,void *old_val); -void __ubsan_handle_divrem_overflow (void *_data,void *lhs,void *rhs); -void __ubsan_handle_type_mismatch (struct type_mismatch_data *data,void *ptr); -void __ubsan_handle_type_mismatch_v1 (void *_data,void *ptr); -void __ubsan_handle_out_of_bounds (void *_data,void *index); -void __ubsan_handle_shift_out_of_bounds (void *_data,void *lhs,void *rhs); -void __ubsan_handle_builtin_unreachable (void *_data); -void __ubsan_handle_load_invalid_value (void *_data,void *val); -void __ubsan_handle_alignment_assumption (void *_data,unsigned long ptr, -unsigned long align, -unsigned long offset); +/* +* When generating Runtime Calls, Clang doesn't respect the -mregparm=3 +* option used on i386: https://github.com/llvm/llvm-project/issues/89670 +* Fix this for earlier Clang versions by forcing the calling convention +* to use non-register arguments. +*/ +#if defined(CONFIG_X86_32 ) && \ + defined(CONFIG_CC_IS_CLANG ) &&CONFIG_CLANG_VERSION <190000 +# define ubsan_linkage asmlinkage +#else +# define ubsan_linkage +#endif + +void ubsan_linkage __ubsan_handle_add_overflow(void *data, void *lhs, void *rhs); +void ubsan_linkage __ubsan_handle_sub_overflow(void *data, void *lhs, void *rhs); +void ubsan_linkage __ubsan_handle_mul_overflow(void *data, void *lhs, void *rhs); +void ubsan_linkage __ubsan_handle_negate_overflow(void *_data, void *old_val); +void ubsan_linkage __ubsan_handle_divrem_overflow(void *_data, void *lhs, void *rhs); +void ubsan_linkage __ubsan_handle_type_mismatch(struct type_mismatch_data *data, void *ptr); +void ubsan_linkage __ubsan_handle_type_mismatch_v1(void *_data, void *ptr); +void ubsan_linkage __ubsan_handle_out_of_bounds(void *_data, void *index); +void ubsan_linkage __ubsan_handle_shift_out_of_bounds(void *_data, void *lhs, void *rhs); +void ubsan_linkage __ubsan_handle_builtin_unreachable(void *_data); +void ubsan_linkage __ubsan_handle_load_invalid_value(void *_data, void *val); +void ubsan_linkage __ubsan_handle_alignment_assumption(void *_data, unsigned long ptr, +unsigned long align, +unsigned long offset);#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/250 arm64: defconfig: select INTERCONNECT_QCOM_SM6115 as built-in
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit b052c7fe3cb787282ab7e1fa088c794a1eb7fdb0 ]
Enable CONFIG_INTERCONNECT_QCOM_SM6115 as built-in to enable the interconnect driver for the SoC used on Qualcomm Robotics RB2 board. Building as built-in is required as on this platform interconnects are required to bring up the console.
--- arch/arm64/configs/defconfig | 1 + 1 file changed, 1 insertion(+)
arch/arm64/configs/defconfig +1 -0
@@ -1585,6 +1585,7 @@ CONFIG_INTERCONNECT_QCOM_SC8180X=y CONFIG_INTERCONNECT_QCOM_SC8280XP=y CONFIG_INTERCONNECT_QCOM_SDM845=y CONFIG_INTERCONNECT_QCOM_SDX75=y +CONFIG_INTERCONNECT_QCOM_SM6115=y CONFIG_INTERCONNECT_QCOM_SM8150=m CONFIG_INTERCONNECT_QCOM_SM8250=y CONFIG_INTERCONNECT_QCOM_SM8350=m
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/250 block/ioctl: prefer different overflow check
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Stitt <[email protected]>
[ Upstream commit ccb326b5f9e623eb7f130fbbf2505ec0e2dcaff9 ]
Running syzkaller with the newly reintroduced signed integer overflow sanitizer shows this report:
[ 62.982337] ------------[ cut here ]------------ [ 62.985692] cgroup: Invalid name [ 62.986211] UBSAN: signed-integer-overflow in ../block/ioctl.c:36:46 [ 62.989370] 9pnet_fd: p9_fd_create_tcp (7343): problem connecting socket to 127.0.0.1 [ 62.992992] 9223372036854775807 + 4095 cannot be represented in type 'long long' [ 62.997827] 9pnet_fd: p9_fd_create_tcp (7345): problem connecting socket to 127.0.0.1 [ 62.999369] random: crng reseeded on system resumption [ 63.000634] GUP no longer grows the stack in syz-executor.2 (7353): 20002000-20003000 (20001000) [ 63.000668] CPU: 0 PID: 7353 Comm: syz-executor.2 Not tainted 6.8.0-rc2-00035-gb3ef86b5a957 #1 [ 63.000677] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 63.000682] Call Trace: [ 63.000686] <TASK> [ 63.000731] dump_stack_lvl+0x93/0xd0 [ 63.000919] __get_user_pages+0x903/0xd30 [ 63.001030] __gup_longterm_locked+0x153e/0x1ba0 [ 63.001041] ? _raw_read_unlock_irqrestore+0x17/0x50 [ 63.001072] ? try_get_folio+0x29c/0x2d0 [ 63.001083] internal_get_user_pages_fast+0x1119/0x1530 [ 63.001109] iov_iter_extract_pages+0x23b/0x580 [ 63.001206] bio_iov_iter_get_pages+0x4de/0x1220 [ 63.001235] iomap_dio_bio_iter+0x9b6/0x1410 [ 63.001297] __iomap_dio_rw+0xab4/0x1810 [ 63.001316] iomap_dio_rw+0x45/0xa0 [ 63.001328] ext4_file_write_iter+0xdde/0x1390 [ 63.001372] vfs_write+0x599/0xbd0 [ 63.001394] ksys_write+0xc8/0x190 [ 63.001403] do_syscall_64+0xd4/0x1b0 [ 63.001421] ? arch_exit_to_user_mode_prepare+0x3a/0x60 [ 63.001479] entry_SYSCALL_64_after_hwframe+0x6f/0x77 [ 63.001535] RIP: 0033:0x7f7fd3ebf539 [ 63.001551] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 63.001562] RSP: 002b:00007f7fd32570c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 63.001584] RAX: ffffffffffffffda RBX: 00007f7fd3ff3f80 RCX: 00007f7fd3ebf539 [ 63.001590] RDX: 4db6d1e4f7e43360 RSI: 0000000020000000 RDI: 0000000000000004 [ 63.001595] RBP: 00007f7fd3f1e496 R08: 0000000000000000 R09: 0000000000000000 [ 63.001599] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 63.001604] R13: 0000000000000006 R14: 00007f7fd3ff3f80 R15: 00007ffd415ad2b8 ... [ 63.018142] ---[ end trace ]---
Historically, the signed integer overflow sanitizer did not work in the kernel due to its interaction with -fwrapv but this has since been changed [1] in the newest version of Clang; It was re-enabled in the kernel with Commit 557f8c582a9ba8ab ("ubsan: Reintroduce signed overflow sanitizer").
Let's rework this overflow checking logic to not actually perform an overflow during the check itself, thus avoiding the UBSAN splat.
[1]: https://github.com/llvm/llvm-project/pull/82432
--- block/ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/ioctl.c +1 -1
@@ -33,7 +33,7 @@ static int blkpg_do_ioctl(struct block_device *bdev,if (op ==BLKPG_DEL_PARTITION )return bdev_del_partition (disk, p.pno); -if (p.start <0 || p.length <=0 || p.start + p.length <0 ) +if (p.start <0 || p.length <=0 ||LLONG_MAX - p.length < p.start)return -EINVAL ;/* Check that the partition is aligned to the block size */ if (!IS_ALIGNED (p.start | p.length,bdev_logical_block_size (bdev)))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/250 ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rand Deeb <[email protected]>
[ Upstream commit 789c17185fb0f39560496c2beab9b57ce1d0cbe7 ]
The ssb_device_uevent() function first attempts to convert the 'dev' pointer to 'struct ssb_device *'. However, it mistakenly dereferences 'dev' before performing the NULL check, potentially leading to a NULL pointer dereference if 'dev' is NULL.
To fix this issue, move the NULL check before dereferencing the 'dev' pointer, ensuring that the pointer is valid before attempting to use it.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/ssb/main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/ssb/main.c +3 -1
@@ -341,11 +341,13 @@ static int ssb_bus_match(struct device *dev, struct device_driver *drv)static int ssb_device_uevent (const struct device *dev,struct kobj_uevent_env *env) { -const struct ssb_device *ssb_dev =dev_to_ssb_dev (dev); +const struct ssb_device *ssb_dev;if (!dev)return -ENODEV ; + ssb_dev =dev_to_ssb_dev (dev); + return add_uevent_var(env, "MODALIAS=ssb:v%04Xid%04Xrev%02X", ssb_dev->id.vendor, ssb_dev->id.coreid,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/250 selftests/bpf: Prevent client connect before server bind in test_tc_tunnel.sh
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alessandro Carminati (Red Hat) <[email protected]>
[ Upstream commit f803bcf9208a2540acb4c32bdc3616673169f490 ]
In some systems, the netcat server can incur in delay to start listening. When this happens, the test can randomly fail in various points. This is an example error message:
# ip gre none gso # encap 192.168.1.1 to 192.168.1.2, type gre, mac none len 2000 # test basic connectivity # Ncat: Connection refused.
The issue stems from a race condition between the netcat client and server. The test author had addressed this problem by implementing a sleep, which I have removed in this patch.
This patch introduces a function capable of sleeping for up to two seconds. However, it can terminate the waiting period early if the port is reported to be listening.
--- tools/testing/selftests/bpf/test_tc_tunnel.sh | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
tools/testing/selftests/bpf/test_tc_tunnel.sh +12 -1
@@ -72,7 +72,6 @@ cleanup() { server_listen() { ip netns exec "${ns2}" nc "${netcat_opt}" -l "${port}" > "${outfile}" & server_pid=$! - sleep 0.2 } client_connect() {
@@ -93,6 +92,16 @@ verify_data() { fi } +wait_for_port() { + for i in $(seq 20); do + if ip netns exec "${ns2}" ss ${2:--4}OHntl | grep -q "$1"; then + return 0 + fi + sleep 0.1 + done + return 1 +} + set -e # no arguments: automated test, run all
@@ -193,6 +202,7 @@ setup # basic communication works echo "test basic connectivity" server_listen +wait_for_port ${port} ${netcat_opt} client_connect verify_data
@@ -204,6 +214,7 @@ ip netns exec "${ns1}" tc filter add dev veth1 egress \ section "encap_${tuntype}_${mac}" echo "test bpf encap without decap (expect failure)" server_listen +wait_for_port ${port} ${netcat_opt} ! client_connect if [[ "$tuntype" =~ "udp" ]]; then
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/250 selftests/bpf: Fix flaky test btf_map_in_map/lookup_update
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <[email protected]>
[ Upstream commit 14bb1e8c8d4ad5d9d2febb7d19c70a3cf536e1e5 ]
Recently, I frequently hit the following test failure:
[root@arch-fb-vm1 bpf]# ./test_progs -n 33/1 test_lookup_update:PASS:skel_open 0 nsec [...]
test_lookup_update:PASS:sync_rcu 0 nsec test_lookup_update:FAIL:map1_leak inner_map1 leaked!
#33/1 btf_map_in_map/lookup_update:FAIL
#33 btf_map_in_map:FAIL
In the test, after map is closed and then after two rcu grace periods, it is assumed that map_id is not available to user space.
But the above assumption cannot be guaranteed. After zero or one or two rcu grace periods in different siturations, the actual freeing-map-work is put into a workqueue. Later on, when the work is dequeued, the map will be actually freed.
See bpf_map_put() in kernel/bpf/syscall.c.
By using workqueue, there is no ganrantee that map will be actually freed after a couple of rcu grace periods. This patch removed such map leak detection and then the test can pass consistently.
--- .../selftests/bpf/prog_tests/btf_map_in_map.c | 26 +------------------ 1 file changed, 1 insertion(+), 25 deletions(-)
tools/testing/selftests/bpf/prog_tests/btf_map_in_map.c +1 -25
@@ -25,7 +25,7 @@ static void test_lookup_update(void)int map1_fd, map2_fd, map3_fd, map4_fd, map5_fd, map1_id, map2_id;int outer_arr_fd, outer_hash_fd, outer_arr_dyn_fd;struct test_btf_map_in_map *skel; -int err, key =0 , val, i, fd; +int err, key =0 , val, i; skel =test_btf_map_in_map__open_and_load ();if (CHECK (!skel,"skel_open" ,"failed to open&load skeleton\n" ))
@@ -102,30 +102,6 @@ static void test_lookup_update(void)CHECK (map1_id ==0 ,"map1_id" ,"failed to get ID 1\n" );CHECK (map2_id ==0 ,"map2_id" ,"failed to get ID 2\n" ); -test_btf_map_in_map__destroy (skel); - skel =NULL ; - -/* we need to either wait for or force synchronize_rcu(), before -* checking for "still exists" condition, otherwise map could still be -* resolvable by ID, causing false positives. -* -* Older kernels (5.8 and earlier) freed map only after two -* synchronize_rcu()s, so trigger two, to be entirely sure. -*/ -CHECK (kern_sync_rcu (),"sync_rcu" ,"failed\n" ); -CHECK (kern_sync_rcu (),"sync_rcu" ,"failed\n" ); - - fd =bpf_map_get_fd_by_id (map1_id); -if (CHECK (fd >=0 ,"map1_leak" ,"inner_map1 leaked!\n" )) { -close (fd); - goto cleanup; - } - fd =bpf_map_get_fd_by_id (map2_id); -if (CHECK (fd >=0 ,"map2_leak" ,"inner_map2 leaked!\n" )) { -close (fd); - goto cleanup; - } - cleanup:test_btf_map_in_map__destroy (skel); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/250 bpf: Avoid kfree_rcu() under lock in bpf_lpm_trie.
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Starovoitov <[email protected]>
[ Upstream commit 59f2f841179aa6a0899cb9cf53659149a35749b7 ]
syzbot reported the following lock sequence:
cpu 2:
grabs timer_base lock
spins on bpf_lpm lock
cpu 1:
grab rcu krcp lock
spins on timer_base lock
cpu 0:
grab bpf_lpm lock
spins on rcu krcp lock
bpf_lpm lock can be the same.timer_base lock can also be the same due to timer migration. but rcu krcp lock is always per-cpu, so it cannot be the same lock. Hence it's a false positive.
To avoid lockdep complaining move kfree_rcu() after spin_unlock.
--- kernel/bpf/lpm_trie.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
kernel/bpf/lpm_trie.c +9 -4
@@ -308,6 +308,7 @@ static long trie_update_elem(struct bpf_map *map, { struct lpm_trie *trie = container_of(map, struct lpm_trie, map);struct lpm_trie_node *node, *im_node =NULL , *new_node =NULL ; +struct lpm_trie_node *free_node =NULL ;struct lpm_trie_node __rcu **slot;struct bpf_lpm_trie_key_u8 *key = _key;unsigned long irq_flags;
@@ -382,7 +383,7 @@ static long trie_update_elem(struct bpf_map *map, trie->n_entries--;rcu_assign_pointer (*slot, new_node); -kfree_rcu (node, rcu); + free_node = node; goto out; }
@@ -429,6 +430,7 @@ static long trie_update_elem(struct bpf_map *map, }spin_unlock_irqrestore (&trie->lock, irq_flags); +kfree_rcu (free_node, rcu);return ret; }
@@ -437,6 +439,7 @@ static long trie_update_elem(struct bpf_map *map,static long trie_delete_elem (struct bpf_map *map,void *_key) { struct lpm_trie *trie = container_of(map, struct lpm_trie, map); +struct lpm_trie_node *free_node =NULL , *free_parent =NULL ;struct bpf_lpm_trie_key_u8 *key = _key;struct lpm_trie_node __rcu **trim, **trim2;struct lpm_trie_node *node, *parent;
@@ -506,8 +509,8 @@ static long trie_delete_elem(struct bpf_map *map, void *_key)else rcu_assign_pointer ( *trim2,rcu_access_pointer (parent->child[0 ])); -kfree_rcu (parent, rcu); -kfree_rcu (node, rcu); + free_parent = parent; + free_node = node; goto out; }
@@ -521,10 +524,12 @@ static long trie_delete_elem(struct bpf_map *map, void *_key)rcu_assign_pointer (*trim,rcu_access_pointer (node->child[1 ])); else RCU_INIT_POINTER(*trim, NULL); -kfree_rcu (node, rcu); + free_node = node; out:spin_unlock_irqrestore (&trie->lock, irq_flags); +kfree_rcu (free_parent, rcu); +kfree_rcu (free_node, rcu);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/250 devlink: use kvzalloc() to allocate devlink instance resources
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jian Wen <[email protected]>
[ Upstream commit 730fffce4fd2eb7a0be2d0b6cd7e55e9194d76d5 ]
During live migration of a virtual machine, the SR-IOV VF need to be re-registered. It may fail when the memory is badly fragmented.
The related log is as follows.
kernel: hv_netvsc 6045bdaa-c0d1-6045-bdaa-c0d16045bdaa eth0: VF slot 1 added
...
kernel: kworker/0:0: page allocation failure: order:7, mode:0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0
kernel: CPU: 0 PID: 24006 Comm: kworker/0:0 Tainted: G E 5.4...x86_64 #1
kernel: Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008 12/07/2018
kernel: Workqueue: events work_for_cpu_fn
kernel: Call Trace:
kernel: dump_stack+0x8b/0xc8
kernel: warn_alloc+0xff/0x170
kernel: __alloc_pages_slowpath+0x92c/0xb2b
kernel: ? get_page_from_freelist+0x1d4/0x1140
kernel: __alloc_pages_nodemask+0x2f9/0x320
kernel: alloc_pages_current+0x6a/0xb0
kernel: kmalloc_order+0x1e/0x70
kernel: kmalloc_order_trace+0x26/0xb0
kernel: ? __switch_to_asm+0x34/0x70
kernel: __kmalloc+0x276/0x280
kernel: ? _raw_spin_unlock_irqrestore+0x1e/0x40
kernel: devlink_alloc+0x29/0x110
kernel: mlx5_devlink_alloc+0x1a/0x20 [mlx5_core]
kernel: init_one+0x1d/0x650 [mlx5_core]
kernel: local_pci_probe+0x46/0x90
kernel: work_for_cpu_fn+0x1a/0x30
kernel: process_one_work+0x16d/0x390
kernel: worker_thread+0x1d3/0x3f0
kernel: kthread+0x105/0x140
kernel: ? max_active_store+0x80/0x80
kernel: ? kthread_bind+0x20/0x20
kernel: ret_from_fork+0x3a/0x50--- net/devlink/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/devlink/core.c +3 -3
@@ -314,7 +314,7 @@ static void devlink_release(struct work_struct *work)mutex_destroy (&devlink->lock);lockdep_unregister_key (&devlink->lock_key);put_device (devlink->dev); -kfree (devlink); +kvfree (devlink); }void devlink_put (struct devlink *devlink)
@@ -420,7 +420,7 @@ struct devlink *devlink_alloc_ns(const struct devlink_ops *ops,if (!devlink_reload_actions_valid (ops))return NULL ; - devlink =kzalloc (sizeof (*devlink) + priv_size,GFP_KERNEL ); + devlink =kvzalloc (struct_size (devlink, priv, priv_size),GFP_KERNEL );if (!devlink)return NULL ;
@@ -455,7 +455,7 @@ struct devlink *devlink_alloc_ns(const struct devlink_ops *ops,return devlink; err_xa_alloc: -kfree (devlink); +kvfree (devlink);return NULL ; }EXPORT_SYMBOL_GPL (devlink_alloc_ns);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/250 batman-adv: bypass empty buckets in batadv_purge_orig_ref()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 40dc8ab605894acae1473e434944924a22cfaaa0 ]
Many syzbot reports are pointing to soft lockups in batadv_purge_orig_ref() [1]
Root cause is unknown, but we can avoid spending too much time there and perhaps get more interesting reports.
[1]
watchdog: BUG: soft lockup - CPU#0 stuck for 27s! [kworker/u4:6:621] Modules linked in: irq event stamp: 6182794 hardirqs last enabled at (6182793): [<ffff8000801dae10>] __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386 hardirqs last disabled at (6182794): [<ffff80008ad66a78>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline] hardirqs last disabled at (6182794): [<ffff80008ad66a78>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551 softirqs last enabled at (6182792): [<ffff80008aab71c4>] spin_unlock_bh include/linux/spinlock.h:396 [inline] softirqs last enabled at (6182792): [<ffff80008aab71c4>] batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287 softirqs last disabled at (6182790): [<ffff80008aab61dc>] spin_lock_bh include/linux/spinlock.h:356 [inline] softirqs last disabled at (6182790): [<ffff80008aab61dc>] batadv_purge_orig_ref+0x164/0x1228 net/batman-adv/originator.c:1271 CPU: 0 PID: 621 Comm: kworker/u4:6 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Workqueue: bat_events batadv_purge_orig pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : should_resched arch/arm64/include/asm/preempt.h:79 [inline] pc : __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:388 lr : __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386
sp : ffff800099007970
x29: ffff800099007980 x28: 1fffe00018fce1bd x27: dfff800000000000
x26: ffff0000d2620008 x25: ffff0000c7e70de8 x24: 0000000000000001
x23: 1fffe00018e57781 x22: dfff800000000000 x21: ffff80008aab71c4
x20: ffff0001b40136c0 x19: ffff0000c72bbc08 x18: 1fffe0001a817bb0
x17: ffff800125414000 x16: ffff80008032116c x15: 0000000000000001
x14: 1fffe0001ee9d610 x13: 0000000000000000 x12: 0000000000000003
x11: 0000000000000000 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 00000000005e5789 x7 : ffff80008aab61dc x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000000006 x1 : 0000000000000080 x0 : ffff800125414000
Call trace: __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline] arch_local_irq_enable arch/arm64/include/asm/irqflags.h:49 [inline] __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:386 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287 batadv_purge_orig+0x20/0x70 net/batman-adv/originator.c:1300 process_one_work+0x694/0x1204 kernel/workqueue.c:2633 process_scheduled_works kernel/workqueue.c:2706 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:2787 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:51 lr : default_idle_call+0xf8/0x128 kernel/sched/idle.c:103
sp : ffff800093a17d30
x29: ffff800093a17d30 x28: dfff800000000000 x27: 1ffff00012742fb4
x26: ffff80008ec9d000 x25: 0000000000000000 x24: 0000000000000002
x23: 1ffff00011d93a74 x22: ffff80008ec9d3a0 x21: 0000000000000000
x20: ffff0000c19dbc00 x19: ffff8000802d0fd8 x18: 1fffe00036804396
x17: ffff80008ec9d000 x16: ffff8000802d089c x15: 0000000000000001
x14: 1fffe00036805f10 x13: 0000000000000000 x12: 0000000000000003
x11: 0000000000000001 x10: 0000000000000003 x9 : 0000000000000000 x8 : 00000000000ce8d1 x7 : ffff8000804609e4 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff80008ad6aac0 x2 : 0000000000000000 x1 : ffff80008aedea60 x0 : ffff800125436000
Call trace: __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline] arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:49 cpuidle_idle_call kernel/sched/idle.c:170 [inline] do_idle+0x1f0/0x4e8 kernel/sched/idle.c:312 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:410 secondary_start_kernel+0x198/0x1c0 arch/arm64/kernel/smp.c:272 __secondary_switched+0xb8/0xbc arch/arm64/kernel/head.S:404
--- net/batman-adv/originator.c | 2 ++ 1 file changed, 2 insertions(+)
net/batman-adv/originator.c +2 -0
@@ -1266,6 +1266,8 @@ void batadv_purge_orig_ref(struct batadv_priv *bat_priv)/* for all origins... */ for (i =0 ; i < hash->size; i++) { head = &hash->table[i]; +if (hlist_empty (head)) +continue ; list_lock = &hash->list_locks[i];spin_lock_bh (list_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/250 wifi: rtw89: 8852c: add quirk to set PCI BER for certain platforms
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping-Ke Shih <[email protected]>
[ Upstream commit 5b919d726b613c78d4dc463dd9f90c55843fd1b3 ]
Increase PCI BER (bit error rate) count depth setting which could increase PHY circuit fault tolerance and improve compatibility.
--- drivers/net/wireless/realtek/rtw89/core.c | 18 +++++++++++++++ drivers/net/wireless/realtek/rtw89/core.h | 10 ++++++++ drivers/net/wireless/realtek/rtw89/pci.c | 19 +++++++++++++++ drivers/net/wireless/realtek/rtw89/pci.h | 5 ++++ .../net/wireless/realtek/rtw89/rtw8851be.c | 1 + .../net/wireless/realtek/rtw89/rtw8852ae.c | 1 + .../net/wireless/realtek/rtw89/rtw8852be.c | 1 + .../net/wireless/realtek/rtw89/rtw8852ce.c | 23 +++++++++++++++++++ .../net/wireless/realtek/rtw89/rtw8922ae.c | 1 + 9 files changed, 79 insertions(+)
drivers/net/wireless/realtek/rtw89/core.c +18 -0
@@ -4069,6 +4069,24 @@ void rtw89_core_ntfy_btc_event(struct rtw89_dev *rtwdev, enum rtw89_btc_hmsg eve } } +void rtw89_check_quirks (struct rtw89_dev *rtwdev,const struct dmi_system_id *quirks) +{ +const struct dmi_system_id *match; +enum rtw89_quirks quirk; + +if (!quirks) +return ; + +for (match =dmi_first_match (quirks); match; match =dmi_first_match (match +1 )) { + quirk = (uintptr_t )match->driver_data; +if (quirk >=NUM_OF_RTW89_QUIRKS ) +continue ; + +set_bit (quirk, rtwdev->quirks); + } +} +EXPORT_SYMBOL (rtw89_check_quirks); +int rtw89_core_start (struct rtw89_dev *rtwdev) {int ret;
drivers/net/wireless/realtek/rtw89/core.h +10 -0
@@ -7,6 +7,7 @@#include <linux/average.h> #include <linux/bitfield.h> +#include <linux/dmi.h> #include <linux/firmware.h> #include <linux/iopoll.h> #include <linux/workqueue.h>
@@ -3977,6 +3978,7 @@ union rtw89_bus_info {struct rtw89_driver_info {const struct rtw89_chip_info *chip; +const struct dmi_system_id *quirks;union rtw89_bus_info bus; };
@@ -4324,6 +4326,12 @@ enum rtw89_flags { NUM_OF_RTW89_FLAGS, }; +enum rtw89_quirks { +RTW89_QUIRK_PCI_BER , + +NUM_OF_RTW89_QUIRKS , +}; +enum rtw89_pkt_drop_sel {RTW89_PKT_DROP_SEL_MACID_BE_ONCE ,RTW89_PKT_DROP_SEL_MACID_BK_ONCE ,
@@ -5084,6 +5092,7 @@ struct rtw89_dev {DECLARE_BITMAP (mac_id_map,RTW89_MAX_MAC_ID_NUM );DECLARE_BITMAP (flags,NUM_OF_RTW89_FLAGS );DECLARE_BITMAP (pkt_offload,RTW89_MAX_PKT_OFLD_NUM ); +DECLARE_BITMAP (quirks,NUM_OF_RTW89_QUIRKS );struct rtw89_phy_stat phystat;struct rtw89_rfk_wait_info rfk_wait;
@@ -6129,6 +6138,7 @@ int rtw89_core_sta_remove(struct rtw89_dev *rtwdev,void rtw89_core_set_tid_config (struct rtw89_dev *rtwdev,struct ieee80211_sta *sta,struct cfg80211_tid_config *tid_config); +void rtw89_check_quirks (struct rtw89_dev *rtwdev,const struct dmi_system_id *quirks);int rtw89_core_init (struct rtw89_dev *rtwdev);void rtw89_core_deinit (struct rtw89_dev *rtwdev);int rtw89_core_register (struct rtw89_dev *rtwdev);
drivers/net/wireless/realtek/rtw89/pci.c +19 -0
@@ -2299,6 +2299,22 @@ static int rtw89_pci_deglitch_setting(struct rtw89_dev *rtwdev)return 0 ; } +static void rtw89_pci_ber (struct rtw89_dev *rtwdev) +{ +u32 phy_offset; + +if (!test_bit (RTW89_QUIRK_PCI_BER , rtwdev->quirks)) +return ; + + phy_offset =R_RAC_DIRECT_OFFSET_G1 ; +rtw89_write16 (rtwdev, phy_offset +RAC_ANA1E *RAC_MULT ,RAC_ANA1E_G1_VAL ); +rtw89_write16 (rtwdev, phy_offset +RAC_ANA2E *RAC_MULT ,RAC_ANA2E_VAL ); + + phy_offset =R_RAC_DIRECT_OFFSET_G2 ; +rtw89_write16 (rtwdev, phy_offset +RAC_ANA1E *RAC_MULT ,RAC_ANA1E_G2_VAL ); +rtw89_write16 (rtwdev, phy_offset +RAC_ANA2E *RAC_MULT ,RAC_ANA2E_VAL ); +} +static void rtw89_pci_rxdma_prefth (struct rtw89_dev *rtwdev) {if (rtwdev->chip->chip_id !=RTL8852A )
@@ -2696,6 +2712,7 @@ static int rtw89_pci_ops_mac_pre_init_ax(struct rtw89_dev *rtwdev)const struct rtw89_pci_info *info = rtwdev->pci_info;int ret; +rtw89_pci_ber (rtwdev);rtw89_pci_rxdma_prefth (rtwdev);rtw89_pci_l1off_pwroff (rtwdev);rtw89_pci_deglitch_setting (rtwdev);
@@ -4172,6 +4189,8 @@ int rtw89_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) rtwdev->hci.rpwm_addr = pci_info->rpwm_addr; rtwdev->hci.cpwm_addr = pci_info->cpwm_addr; +rtw89_check_quirks (rtwdev, info->quirks); +SET_IEEE80211_DEV (rtwdev->hw, &pdev->dev); ret =rtw89_core_init (rtwdev);
drivers/net/wireless/realtek/rtw89/pci.h +5 -0
@@ -26,11 +26,16 @@#define RAC_REG_FLD_0 0x1D#define BAC_AUTOK_N_MASK GENMASK(3, 2)#define PCIE_AUTOK_4 0x3 +#define RAC_ANA1E 0x1E +#define RAC_ANA1E_G1_VAL 0x66EA +#define RAC_ANA1E_G2_VAL 0x6EEA#define RAC_ANA1F 0x1F#define RAC_ANA24 0x24#define B_AX_DEGLITCH GENMASK(11, 8)#define RAC_ANA26 0x26#define B_AX_RXEN GENMASK(15, 14) +#define RAC_ANA2E 0x2E +#define RAC_ANA2E_VAL 0xFFFE#define RAC_CTRL_PPR_V1 0x30#define B_AX_CLK_CALIB_EN BIT(12)#define B_AX_CALIB_EN BIT(13)
drivers/net/wireless/realtek/rtw89/rtw8851be.c +1 -0
@@ -63,6 +63,7 @@ static const struct rtw89_pci_info rtw8851b_pci_info = {static const struct rtw89_driver_info rtw89_8851be_info = { .chip = &rtw8851b_chip_info, + .quirks =NULL , .bus = { .pci = &rtw8851b_pci_info, },
drivers/net/wireless/realtek/rtw89/rtw8852ae.c +1 -0
@@ -61,6 +61,7 @@ static const struct rtw89_pci_info rtw8852a_pci_info = {static const struct rtw89_driver_info rtw89_8852ae_info = { .chip = &rtw8852a_chip_info, + .quirks =NULL , .bus = { .pci = &rtw8852a_pci_info, },
drivers/net/wireless/realtek/rtw89/rtw8852be.c +1 -0
@@ -63,6 +63,7 @@ static const struct rtw89_pci_info rtw8852b_pci_info = {static const struct rtw89_driver_info rtw89_8852be_info = { .chip = &rtw8852b_chip_info, + .quirks =NULL , .bus = { .pci = &rtw8852b_pci_info, },
drivers/net/wireless/realtek/rtw89/rtw8852ce.c +23 -0
@@ -68,8 +68,31 @@ static const struct rtw89_pci_info rtw8852c_pci_info = { .recognize_intrs = rtw89_pci_recognize_intrs_v1, }; +static const struct dmi_system_id rtw8852c_pci_quirks[] = { + { + .ident ="Dell Inc. Vostro 16 5640" , + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Vostro 16 5640" ), +DMI_MATCH (DMI_PRODUCT_SKU ,"0CA0" ), + }, + .driver_data = (void *)RTW89_QUIRK_PCI_BER , + }, + { + .ident ="Dell Inc. Inspiron 16 5640" , + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Inspiron 16 5640" ), +DMI_MATCH (DMI_PRODUCT_SKU ,"0C9F" ), + }, + .driver_data = (void *)RTW89_QUIRK_PCI_BER , + }, + {}, +}; +static const struct rtw89_driver_info rtw89_8852ce_info = { .chip = &rtw8852c_chip_info, + .quirks = rtw8852c_pci_quirks, .bus = { .pci = &rtw8852c_pci_info, },
drivers/net/wireless/realtek/rtw89/rtw8922ae.c +1 -0
@@ -61,6 +61,7 @@ static const struct rtw89_pci_info rtw8922a_pci_info = {static const struct rtw89_driver_info rtw89_8922ae_info = { .chip = &rtw8922a_chip_info, + .quirks =NULL , .bus = { .pci = &rtw8922a_pci_info, },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/250 wifi: ath9k: work around memset overflow warning
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 61752ac69b69ed2e04444d090f6917c77ab36d42 ]
gcc-9 and some other older versions produce a false-positive warning for zeroing two fields
In file included from include/linux/string.h:369,
from drivers/net/wireless/ath/ath9k/main.c:18:
In function 'fortify_memset_chk',
inlined from 'ath9k_ps_wakeup' at drivers/net/wireless/ath/ath9k/main.c:140:3:include/linux/fortify-string.h:462:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]
462 | __write_overflow_field(p_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Using a struct_group seems to reliably avoid the warning and not make the code much uglier. The combined memset() should even save a couple of cpu cycles.
--- drivers/net/wireless/ath/ath.h | 6 ++++-- drivers/net/wireless/ath/ath9k/main.c | 3 +-- 2 files changed, 5 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/ath.h +4 -2
@@ -171,8 +171,10 @@ struct ath_common {unsigned int clockrate;spinlock_t cc_lock; -struct ath_cycle_counters cc_ani; -struct ath_cycle_counters cc_survey; +struct_group (cc, + struct ath_cycle_counters cc_ani; + struct ath_cycle_counters cc_survey; + );struct ath_regulatory regulatory;struct ath_regulatory reg_world_copy;
drivers/net/wireless/ath/ath9k/main.c +1 -2
@@ -135,8 +135,7 @@ void ath9k_ps_wakeup(struct ath_softc *sc)if (power_mode !=ATH9K_PM_AWAKE ) {spin_lock (&common->cc_lock);ath_hw_cycle_counters_update (common); -memset (&common->cc_survey,0 ,sizeof (common->cc_survey)); -memset (&common->cc_ani,0 ,sizeof (common->cc_ani)); +memset (&common->cc,0 ,sizeof (common->cc));spin_unlock (&common->cc_lock); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/250 af_packet: avoid a false positive warning in packet_setsockopt()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 86d43e2bf93ccac88ef71cee36a23282ebd9e427 ]
Although the code is correct, the following line
copy_from_sockptr(&req_u.req, optval, len));
triggers this warning :
memcpy: detected field-spanning write (size 28) of single field "dst" at include/linux/sockptr.h:49 (size 16)
Refactor the code to be more explicit.
--- net/packet/af_packet.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-)
net/packet/af_packet.c +14 -12
@@ -3799,28 +3799,30 @@ packet_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval,case PACKET_TX_RING : {union tpacket_req_u req_u; -int len; + ret = -EINVAL ;lock_sock (sk);switch (po->tp_version) {case TPACKET_V1 :case TPACKET_V2 : - len =sizeof (req_u.req); +if (optlen <sizeof (req_u.req)) +break ; + ret =copy_from_sockptr (&req_u.req, optval, +sizeof (req_u.req)) ? + -EINVAL :0 ;break ;case TPACKET_V3 :default : - len =sizeof (req_u.req3); +if (optlen <sizeof (req_u.req3)) +break ; + ret =copy_from_sockptr (&req_u.req3, optval, +sizeof (req_u.req3)) ? + -EINVAL :0 ;break ; } -if (optlen < len) { - ret = -EINVAL ; - }else { -if (copy_from_sockptr (&req_u.req, optval, len)) - ret = -EFAULT ; -else - ret =packet_set_ring (sk, &req_u,0 , - optname ==PACKET_TX_RING ); - } +if (!ret) + ret =packet_set_ring (sk, &req_u,0 , + optname ==PACKET_TX_RING );release_sock (sk);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/250 clocksource: Make watchdog and suspend-timing multiplication overflow safe
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit d0304569fb019d1bcfbbbce1ce6df6b96f04079b ]
Kernel timekeeping is designed to keep the change in cycles (since the last timer interrupt) below max_cycles, which prevents multiplication overflow when converting cycles to nanoseconds. However, if timer interrupts stop, the clocksource_cyc2ns() calculation will eventually overflow.
Add protection against that. Simplify by folding together clocksource_delta() and clocksource_cyc2ns() into cycles_to_nsec_safe(). Check against max_cycles, falling back to a slower higher precision calculation.
--- kernel/time/clocksource.c | 42 +++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 22 deletions(-)
kernel/time/clocksource.c +20 -22
@@ -20,6 +20,16 @@#include "tick-internal.h" #include "timekeeping_internal.h" +static noinline u64 cycles_to_nsec_safe(struct clocksource *cs, u64 start, u64 end) +{ +u64 delta =clocksource_delta (end, start, cs->mask); + +if (likely (delta < cs->max_cycles)) +return clocksource_cyc2ns (delta, cs->mult, cs->shift); + +return mul_u64_u32_shr (delta, cs->mult, cs->shift); +} +/** * clocks_calc_mult_shift - calculate mult/shift factors for scaled math of clocks * @mult: pointer to mult variable
@@ -222,8 +232,8 @@ enum wd_read_status {static enum wd_read_status cs_watchdog_read (struct clocksource *cs,u64 *csnow,u64 *wdnow) {unsigned int nretries, max_retries; -u64 wd_end, wd_end2, wd_delta;int64_t wd_delay, wd_seq_delay; +u64 wd_end, wd_end2; max_retries =clocksource_get_max_watchdog_retry ();for (nretries =0 ; nretries <= max_retries; nretries++) {
@@ -234,9 +244,7 @@ static enum wd_read_status cs_watchdog_read(struct clocksource *cs, u64 *csnow, wd_end2 = watchdog->read (watchdog);local_irq_enable (); - wd_delta =clocksource_delta (wd_end, *wdnow, watchdog->mask); - wd_delay =clocksource_cyc2ns (wd_delta, watchdog->mult, - watchdog->shift); + wd_delay =cycles_to_nsec_safe (watchdog, *wdnow, wd_end);if (wd_delay <=WATCHDOG_MAX_SKEW ) {if (nretries >1 || nretries >= max_retries) { pr_warn("timekeeping watchdog on CPU%d: %s retried %d times before success\n",
@@ -254,8 +262,7 @@ static enum wd_read_status cs_watchdog_read(struct clocksource *cs, u64 *csnow,* report system busy, reinit the watchdog and skip the current * watchdog test. */ - wd_delta =clocksource_delta (wd_end2, wd_end, watchdog->mask); - wd_seq_delay =clocksource_cyc2ns (wd_delta, watchdog->mult, watchdog->shift); + wd_seq_delay =cycles_to_nsec_safe (watchdog, wd_end, wd_end2);if (wd_seq_delay >WATCHDOG_MAX_SKEW /2 ) goto skip_test; }
@@ -366,8 +373,7 @@ void clocksource_verify_percpu(struct clocksource *cs) delta = (csnow_end - csnow_mid) & cs->mask;if (delta <0 )cpumask_set_cpu (cpu, &cpus_ahead); - delta =clocksource_delta (csnow_end, csnow_begin, cs->mask); - cs_nsec =clocksource_cyc2ns (delta, cs->mult, cs->shift); + cs_nsec =cycles_to_nsec_safe (cs, csnow_begin, csnow_end);if (cs_nsec > cs_nsec_max) cs_nsec_max = cs_nsec;if (cs_nsec < cs_nsec_min)
@@ -398,8 +404,8 @@ static inline void clocksource_reset_watchdog(void)static void clocksource_watchdog (struct timer_list *unused) { -u64 csnow, wdnow, cslast, wdlast, delta;int64_t wd_nsec, cs_nsec, interval; +u64 csnow, wdnow, cslast, wdlast;int next_cpu, reset_pending;struct clocksource *cs;enum wd_read_status read_ret;
@@ -456,12 +462,8 @@ static void clocksource_watchdog(struct timer_list *unused)continue ; } - delta =clocksource_delta (wdnow, cs->wd_last, watchdog->mask); - wd_nsec =clocksource_cyc2ns (delta, watchdog->mult, - watchdog->shift); - - delta =clocksource_delta (csnow, cs->cs_last, cs->mask); - cs_nsec =clocksource_cyc2ns (delta, cs->mult, cs->shift); + wd_nsec =cycles_to_nsec_safe (watchdog, cs->wd_last, wdnow); + cs_nsec =cycles_to_nsec_safe (cs, cs->cs_last, csnow); wdlast = cs->wd_last;/* save these in case we print them */ cslast = cs->cs_last; cs->cs_last = csnow;
@@ -832,7 +834,7 @@ void clocksource_start_suspend_timing(struct clocksource *cs, u64 start_cycles)*/ u64 clocksource_stop_suspend_timing (struct clocksource *cs,u64 cycle_now) { -u64 now, delta, nsec =0 ; +u64 now, nsec =0 ;if (!suspend_clocksource)return 0 ;
@@ -847,12 +849,8 @@ u64 clocksource_stop_suspend_timing(struct clocksource *cs, u64 cycle_now)else now = suspend_clocksource->read (suspend_clocksource); -if (now > suspend_start) { - delta =clocksource_delta (now, suspend_start, - suspend_clocksource->mask); - nsec =mul_u64_u32_shr (delta, suspend_clocksource->mult, - suspend_clocksource->shift); - } +if (now > suspend_start) + nsec =cycles_to_nsec_safe (suspend_clocksource, suspend_start, now);/* * Disable the suspend timer to save power if current clocksource is
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/250 ACPI: x86: Add PNP_UART1_SKIP quirk for Lenovo Blade2 tablets
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit d8f20383a2fc3a3844b08a4999cf0e81164a0e56 ]
The x86 Android tablets on which quirks to skip looking for a matching UartSerialBus resource and instead unconditionally create a serial bus device (serdev) are necessary there are 2 sorts of serialports:
ACPI enumerated highspeed designware UARTs, these are the ones which typcially need to be skipped since they need a serdev for the attached BT HCI.
A PNP enumerated UART which is part of the PCU. So far the existing quirks have ignored this. But on the Lenovo Yoga Tablet 2 Pro 1380 models this is used for a custom fastcharging protocol. There is a Micro USB switch which can switch the USB data lines to this uart and then a 600 baud protocol is used to configure the charger for a voltage higher then 5V.
Add a new ACPI_QUIRK_PNP_UART1_SKIP quirk type and set this for the existing entry for the Lenovo Yoga Tablet 2 830 / 1050 models. Note this will lead to unnecessarily also creating a serdev for the PCU UART on the 830 / 1050 which don't need this, but the UART is not used otherwise there so that is not a problem.
--- drivers/acpi/x86/utils.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
drivers/acpi/x86/utils.c +13 -7
@@ -256,9 +256,10 @@ bool force_storage_d3(void)#define ACPI_QUIRK_SKIP_I2C_CLIENTS BIT(0)#define ACPI_QUIRK_UART1_SKIP BIT(1)#define ACPI_QUIRK_UART1_TTY_UART2_SKIP BIT(2) -#define ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY BIT(3) -#define ACPI_QUIRK_USE_ACPI_AC_AND_BATTERY BIT(4) -#define ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS BIT(5) +#define ACPI_QUIRK_PNP_UART1_SKIP BIT(3) +#define ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY BIT(4) +#define ACPI_QUIRK_USE_ACPI_AC_AND_BATTERY BIT(5) +#define ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS BIT(6)static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = {/*
@@ -338,6 +339,7 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = { DMI_MATCH(DMI_BIOS_VERSION, "BLADE_21"), }, .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | +ACPI_QUIRK_PNP_UART1_SKIP | ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY), }, {
@@ -436,14 +438,18 @@ static int acpi_dmi_skip_serdev_enumeration(struct device *controller_parent, boif (ret)return 0 ; -/* to not match on PNP enumerated debug UARTs */ -if (!dev_is_platform (controller_parent)) -return 0 ; - dmi_id =dmi_first_match (acpi_quirk_skip_dmi_ids);if (dmi_id) quirks = (unsigned long )dmi_id->driver_data; +if (!dev_is_platform (controller_parent)) { +/* PNP enumerated UARTs */ +if ((quirks &ACPI_QUIRK_PNP_UART1_SKIP ) && uid ==1 ) + *skip = true; + +return 0 ; + } +if ((quirks &ACPI_QUIRK_UART1_SKIP ) && uid ==1 ) *skip = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/250 drop_monitor: replace spin_lock by raw_spin_lock
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wander Lairson Costa <[email protected]>
[ Upstream commit f1e197a665c2148ebc25fe09c53689e60afea195 ]
trace_drop_common() is called with preemption disabled, and it acquires a spin_lock. This is problematic for RT kernels because spin_locks are sleeping locks in this configuration, which causes the following splat:
BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 449, name: rcuc/47preempt_count: 1, expected: 0
RCU nest depth: 2, expected: 2
5 locks held by rcuc/47/449:
#0: ff1100086ec30a60 ((softirq_ctrl.lock)){+.+.}-{2:2}, at: __local_bh_disable_ip+0x105/0x210 #1: ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: rt_spin_lock+0xbf/0x130 #2: ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: __local_bh_disable_ip+0x11c/0x210 #3: ffffffffb394a160 (rcu_callback){....}-{0:0}, at: rcu_do_batch+0x360/0xc70 #4: ff1100086ee07520 (&data->lock){+.+.}-{2:2}, at: trace_drop_common.constprop.0+0xb5/0x290
irq event stamp: 139909 hardirqs last enabled at (139908): [<ffffffffb1df2b33>] _raw_spin_unlock_irqrestore+0x63/0x80 hardirqs last disabled at (139909): [<ffffffffb19bd03d>] trace_drop_common.constprop.0+0x26d/0x290 softirqs last enabled at (139892): [<ffffffffb07a1083>] __local_bh_enable_ip+0x103/0x170 softirqs last disabled at (139898): [<ffffffffb0909b33>] rcu_cpu_kthread+0x93/0x1f0 Preemption disabled at: [<ffffffffb1de786b>] rt_mutex_slowunlock+0xab/0x2e0 CPU: 47 PID: 449 Comm: rcuc/47 Not tainted 6.9.0-rc2-rt1+ #7 Hardware name: Dell Inc. PowerEdge R650/0Y2G81, BIOS 1.6.5 04/15/2022 Call Trace: <TASK> dump_stack_lvl+0x8c/0xd0 dump_stack+0x14/0x20 __might_resched+0x21e/0x2f0 rt_spin_lock+0x5e/0x130 ? trace_drop_common.constprop.0+0xb5/0x290 ? skb_queue_purge_reason.part.0+0x1bf/0x230 trace_drop_common.constprop.0+0xb5/0x290 ? preempt_count_sub+0x1c/0xd0 ? _raw_spin_unlock_irqrestore+0x4a/0x80 ? __pfx_trace_drop_common.constprop.0+0x10/0x10 ? rt_mutex_slowunlock+0x26a/0x2e0 ? skb_queue_purge_reason.part.0+0x1bf/0x230 ? __pfx_rt_mutex_slowunlock+0x10/0x10 ? skb_queue_purge_reason.part.0+0x1bf/0x230 trace_kfree_skb_hit+0x15/0x20 trace_kfree_skb+0xe9/0x150 kfree_skb_reason+0x7b/0x110 skb_queue_purge_reason.part.0+0x1bf/0x230 ? __pfx_skb_queue_purge_reason.part.0+0x10/0x10 ? mark_lock.part.0+0x8a/0x520
...
trace_drop_common() also disables interrupts, but this is a minor issue because we could easily replace it with a local_lock.
Replace the spin_lock with raw_spin_lock to avoid sleeping in atomic context.
--- net/core/drop_monitor.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
net/core/drop_monitor.c +10 -10
@@ -74,7 +74,7 @@ struct net_dm_hw_entries { };struct per_cpu_dm_data { -spinlock_t lock;/* Protects 'skb', 'hw_entries' and +raw_spinlock_t lock;/* Protects 'skb', 'hw_entries' and * 'send_timer' */ union {
@@ -168,9 +168,9 @@ static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data) err:mod_timer (&data->send_timer, jiffies +HZ /10 ); out: -spin_lock_irqsave (&data->lock, flags); +raw_spin_lock_irqsave (&data->lock, flags);swap (data->skb, skb); -spin_unlock_irqrestore (&data->lock, flags); +raw_spin_unlock_irqrestore (&data->lock, flags);if (skb) {struct nlmsghdr *nlh = (struct nlmsghdr *)skb->data;
@@ -225,7 +225,7 @@ static void trace_drop_common(struct sk_buff *skb, void *location)local_irq_save (flags); data =this_cpu_ptr (&dm_cpu_data); -spin_lock (&data->lock); +raw_spin_lock (&data->lock); dskb = data->skb;if (!dskb)
@@ -259,7 +259,7 @@ static void trace_drop_common(struct sk_buff *skb, void *location) } out: -spin_unlock_irqrestore (&data->lock, flags); +raw_spin_unlock_irqrestore (&data->lock, flags); } static void trace_kfree_skb_hit(void *ignore, struct sk_buff *skb,
@@ -314,9 +314,9 @@ net_dm_hw_reset_per_cpu_data(struct per_cpu_dm_data *hw_data)mod_timer (&hw_data->send_timer, jiffies +HZ /10 ); } -spin_lock_irqsave (&hw_data->lock, flags); +raw_spin_lock_irqsave (&hw_data->lock, flags);swap (hw_data->hw_entries, hw_entries); -spin_unlock_irqrestore (&hw_data->lock, flags); +raw_spin_unlock_irqrestore (&hw_data->lock, flags);return hw_entries; }
@@ -448,7 +448,7 @@ net_dm_hw_trap_summary_probe(void *ignore, const struct devlink *devlink,return ; hw_data =this_cpu_ptr (&dm_hw_cpu_data); -spin_lock_irqsave (&hw_data->lock, flags); +raw_spin_lock_irqsave (&hw_data->lock, flags); hw_entries = hw_data->hw_entries;if (!hw_entries)
@@ -477,7 +477,7 @@ net_dm_hw_trap_summary_probe(void *ignore, const struct devlink *devlink, } out: -spin_unlock_irqrestore (&hw_data->lock, flags); +raw_spin_unlock_irqrestore (&hw_data->lock, flags); }static const struct net_dm_alert_ops net_dm_alert_summary_ops = {
@@ -1673,7 +1673,7 @@ static struct notifier_block dropmon_net_notifier = {static void __net_dm_cpu_data_init (struct per_cpu_dm_data *data) { -spin_lock_init (&data->lock); +raw_spin_lock_init (&data->lock);skb_queue_head_init (&data->drop_queue);u64_stats_init (&data->stats.syncp); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/250 ACPI: resource: Do IRQ override on GMxBGxx (XMG APEX 17 M23)
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Schafranek <[email protected]>
[ Upstream commit 6eaf375a5a98642ba4c327f79673f4f308e0ac03 ]
The XM APEX 17 M23 (TongFang?) GMxBGxx (got using sudo dmidecode -s baseboard-product-name) needs IRQ overriding for the keyboard to work.
Adding an entry for this laptop to the override_table makes the internal keyboard functional [1].
Successfully tested with Arch Linux Kernel v6.8 under Manjaro Linux v23.1.4.
--- drivers/acpi/resource.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/acpi/resource.c +6 -0
@@ -533,6 +533,12 @@ static const struct dmi_system_id irq1_level_low_skip_override[] = {* to have a working keyboard. */ static const struct dmi_system_id irq1_edge_low_force_override[] = { + { +/* XMG APEX 17 (M23) */ + .matches = { +DMI_MATCH (DMI_BOARD_NAME ,"GMxBGxx" ), + }, + }, {/* TongFang GMxRGxx/XMG CORE 15 (M22)/TUXEDO Stellaris 15 Gen4 AMD */ .matches = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/250 wifi: ath12k: fix kernel crash during resume
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit 303c017821d88ebad887814114d4e5966d320b28 ]
Currently during resume, QMI target memory is not properly handled, resulting in kernel crash in case DMA remap is not supported:
BUG: Bad page state in process kworker/u16:54 pfn:36e80 page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36e80 page dumped because: nonzero _refcount Call Trace: bad_page free_page_is_bad_report __free_pages_ok __free_pages dma_direct_free dma_free_attrs ath12k_qmi_free_target_mem_chunk ath12k_qmi_msg_mem_request_cb
The reason is:
Once ath12k module is loaded, firmware sends memory request to host. In case DMA remap not supported, ath12k refuses the first request due to failure in allocating with large segment size:
ath12k_pci 0000:04:00.0: qmi firmware request memory requestath12k_pci 0000:04:00.0: qmi mem seg type 1 size 7077888ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 8454144ath12k_pci 0000:04:00.0: qmi dma allocation failed (7077888 B type 1), will try later with small size ath12k_pci 0000:04:00.0: qmi delays mem_request 2ath12k_pci 0000:04:00.0: qmi firmware request memory request
Later firmware comes back with more but small segments and allocation succeeds:
ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 262144 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 65536 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288
Now ath12k is working. If suspend is triggered, firmware will be reloaded during resume. As same as before, firmware requests two large segments at first. In ath12k_qmi_msg_mem_request_cb() segment count and size are assigned:
ab->qmi.mem_seg_count == 2 ab->qmi.target_mem[0].size == 7077888 ab->qmi.target_mem[1].size == 8454144
Then allocation failed like before and ath12k_qmi_free_target_mem_chunk() is called to free all allocated segments. Note the first segment is skipped because its v.addr is cleared due to allocation failure:
chunk->v.addr = dma_alloc_coherent()
Also note that this leaks that segment because it has not been freed.
While freeing the second segment, a size of 8454144 is passed to dma_free_coherent(). However remember that this segment is allocated at the first time firmware is loaded, before suspend. So its real size is 524288, much smaller than 8454144. As a result kernel found we are freeing some memory which is in use and thus crashed.
So one possible fix would be to free those segments during suspend. This works because with them freed, ath12k_qmi_free_target_mem_chunk() does
nothing: all segment addresses are NULL so dma_free_coherent() is not called.
But note that ath11k has similar logic but never hits this issue. Reviewing code there shows the luck comes from QMI memory reuse logic. So the decision is to port it to ath12k. Like in ath11k, the crash is avoided by adding prev_size to target_mem_chunk structure and caching real segment size in it, then prev_size instead of current size is passed to dma_free_coherent(), no unexpected memory is freed now.
Also reuse m3 buffer.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
--- drivers/net/wireless/ath/ath12k/core.c | 1 - drivers/net/wireless/ath/ath12k/qmi.c | 29 +++++++++++++++++++++----- drivers/net/wireless/ath/ath12k/qmi.h | 2 ++ 3 files changed, 26 insertions(+), 6 deletions(-)
drivers/net/wireless/ath/ath12k/core.c +0 -1
@@ -1132,7 +1132,6 @@ static void ath12k_core_reset(struct work_struct *work) ATH12K_RECOVER_START_TIMEOUT_HZ);ath12k_hif_power_down (ab); -ath12k_qmi_free_resource (ab);ath12k_hif_power_up (ab);ath12k_dbg (ab,ATH12K_DBG_BOOT ,"reset started\n" );
drivers/net/wireless/ath/ath12k/qmi.c +24 -5
@@ -2325,8 +2325,9 @@ static void ath12k_qmi_free_target_mem_chunk(struct ath12k_base *ab)for (i =0 ; i < ab->qmi.mem_seg_count; i++) {if (!ab->qmi.target_mem[i].v.addr)continue ; +dma_free_coherent (ab->dev, - ab->qmi.target_mem[i].size, + ab->qmi.target_mem[i].prev_size, ab->qmi.target_mem[i].v.addr, ab->qmi.target_mem[i].paddr); ab->qmi.target_mem[i].v.addr =NULL ;
@@ -2352,6 +2353,20 @@ static int ath12k_qmi_alloc_target_mem_chunk(struct ath12k_base *ab)case M3_DUMP_REGION_TYPE :case PAGEABLE_MEM_REGION_TYPE :case CALDB_MEM_REGION_TYPE : +/* Firmware reloads in recovery/resume. +* In such cases, no need to allocate memory for FW again. +*/ +if (chunk->v.addr) { +if (chunk->prev_type == chunk->type && + chunk->prev_size == chunk->size) + goto this_chunk_done; + +/* cannot reuse the existing chunk */ +dma_free_coherent (ab->dev, chunk->prev_size, + chunk->v.addr, chunk->paddr); + chunk->v.addr =NULL ; + } + chunk->v.addr = dma_alloc_coherent(ab->dev, chunk->size, &chunk->paddr,
@@ -2370,6 +2385,10 @@ static int ath12k_qmi_alloc_target_mem_chunk(struct ath12k_base *ab) chunk->type, chunk->size);return -ENOMEM ; } + + chunk->prev_type = chunk->type; + chunk->prev_size = chunk->size; +this_chunk_done:break ;default : ath12k_warn(ab, "memory type %u not supported\n",
@@ -2675,10 +2694,6 @@ static int ath12k_qmi_m3_load(struct ath12k_base *ab)size_t m3_len;int ret; -if (m3_mem->vaddr) -/* m3 firmware buffer is already available in the DMA buffer */ -return 0 ; -if (ab->fw.m3_data && ab->fw.m3_len >0 ) {/* firmware-N.bin had a m3 firmware file so use that */ m3_data = ab->fw.m3_data;
@@ -2700,6 +2715,9 @@ static int ath12k_qmi_m3_load(struct ath12k_base *ab) m3_len = fw->size; } +if (m3_mem->vaddr) + goto skip_m3_alloc; + m3_mem->vaddr =dma_alloc_coherent (ab->dev, m3_len, &m3_mem->paddr,GFP_KERNEL );
@@ -2710,6 +2728,7 @@ static int ath12k_qmi_m3_load(struct ath12k_base *ab) goto out; } +skip_m3_alloc:memcpy (m3_mem->vaddr, m3_data, m3_len); m3_mem->size = m3_len;
drivers/net/wireless/ath/ath12k/qmi.h +2 -0
@@ -96,6 +96,8 @@ struct ath12k_qmi_event_msg {struct target_mem_chunk {u32 size;u32 type; +u32 prev_size; +u32 prev_type;dma_addr_t paddr;union {void __iomem *ioaddr;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/250 scsi: qedi: Fix crash while reading debugfs attribute
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manish Rangankar <[email protected]>
[ Upstream commit 28027ec8e32ecbadcd67623edb290dad61e735b5 ]
The qedi_dbg_do_not_recover_cmd_read() function invokes sprintf() directly on a __user pointer, which results into the crash.
To fix this issue, use a small local stack buffer for sprintf() and then call simple_read_from_buffer(), which in turns make the copy_to_user() call.
BUG: unable to handle page fault for address: 00007f4801111000 PGD 8000000864df6067 P4D 8000000864df6067 PUD 864df7067 PMD 846028067 PTE 0 Oops: 0002 [#1] PREEMPT SMP PTI Hardware name: HPE ProLiant DL380 Gen10/ProLiant DL380 Gen10, BIOS U30 06/15/2023 RIP: 0010:memcpy_orig+0xcd/0x130 RSP: 0018:ffffb7a18c3ffc40 EFLAGS: 00010202 RAX: 00007f4801111000 RBX: 00007f4801111000 RCX: 000000000000000f RDX: 000000000000000f RSI: ffffffffc0bfd7a0 RDI: 00007f4801111000 RBP: ffffffffc0bfd7a0 R08: 725f746f6e5f6f64 R09: 3d7265766f636572 R10: ffffb7a18c3ffd08 R11: 0000000000000000 R12: 00007f4881110fff R13: 000000007fffffff R14: ffffb7a18c3ffca0 R15: ffffffffc0bfd7af FS: 00007f480118a740(0000) GS:ffff98e38af00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4801111000 CR3: 0000000864b8e001 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __die_body+0x1a/0x60 ? page_fault_oops+0x183/0x510 ? exc_page_fault+0x69/0x150 ? asm_exc_page_fault+0x22/0x30 ? memcpy_orig+0xcd/0x130 vsnprintf+0x102/0x4c0 sprintf+0x51/0x80 qedi_dbg_do_not_recover_cmd_read+0x2f/0x50 [qedi 6bcfdeeecdea037da47069eca2ba717c84a77324] full_proxy_read+0x50/0x80 vfs_read+0xa5/0x2e0 ? folio_add_new_anon_rmap+0x44/0xa0 ? set_pte_at+0x15/0x30 ? do_pte_missing+0x426/0x7f0 ksys_read+0xa5/0xe0 do_syscall_64+0x58/0x80 ? __count_memcg_events+0x46/0x90 ? count_memcg_event_mm+0x3d/0x60 ? handle_mm_fault+0x196/0x2f0 ? do_user_addr_fault+0x267/0x890 ? exc_page_fault+0x69/0x150 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f4800f20b4d
--- drivers/scsi/qedi/qedi_debugfs.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
drivers/scsi/qedi/qedi_debugfs.c +4 -8
@@ -120,15 +120,11 @@ static ssize_t qedi_dbg_do_not_recover_cmd_read(struct file *filp, char __user *buffer, size_t count, loff_t *ppos) { - size_t cnt = 0; - -if (*ppos) -return 0 ; + char buf[64]; +int len; - cnt =sprintf (buffer,"do_not_recover=%d\n" , qedi_do_not_recover); - cnt =min_t (int, count, cnt - *ppos); - *ppos += cnt; -return cnt; + len =sprintf (buf,"do_not_recover=%d\n" , qedi_do_not_recover); +return simple_read_from_buffer (buffer, count, ppos, buf, len); } static int
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/250 net: sfp: enhance quirk for Fibrestore 2.5G copper SFP module
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Behún <[email protected]>
[ Upstream commit cd4a32e60061789676f7f018a94fcc9ec56732a0 ]
Enhance the quirk for Fibrestore 2.5G copper SFP module. The original commit e27aca3760c0 ("net: sfp: add quirk for FS's 2.5G copper SFP") introducing the quirk says that the PHY is inaccessible, but that is not true.
The module uses Rollball protocol to talk to the PHY, and needs a 4 second wait before probing it, same as FS 10G module.
The PHY inside the module is Realtek RTL8221B-VB-CG PHY. The realtek driver recently gained support to set it up via clause 45 accesses.
--- drivers/net/phy/sfp.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
drivers/net/phy/sfp.c +12 -6
@@ -385,18 +385,23 @@ static void sfp_fixup_rollball(struct sfp *sfp) sfp->phy_t_retry =msecs_to_jiffies (1000 ); } -static void sfp_fixup_fs_10gt (struct sfp *sfp) +static void sfp_fixup_fs_2_5gt (struct sfp *sfp) { -sfp_fixup_10gbaset_30m (sfp);sfp_fixup_rollball (sfp); -/* The RollBall fixup is not enough for FS modules, the AQR chip inside +/* The RollBall fixup is not enough for FS modules, the PHY chip inside * them does not return 0xffff for PHY ID registers in all MMDs for the * while initializing. They need a 4 second wait before accessing PHY. */ sfp->module_t_wait =msecs_to_jiffies (4000 ); } +static void sfp_fixup_fs_10gt (struct sfp *sfp) +{ +sfp_fixup_10gbaset_30m (sfp); +sfp_fixup_fs_2_5gt (sfp); +} +static void sfp_fixup_halny_gsfp (struct sfp *sfp) {/* Ignore the TX_FAULT and LOS signals on this module.
@@ -472,6 +477,10 @@ static const struct sfp_quirk sfp_quirks[] = {// Rollball protocol to talk to the PHY. SFP_QUIRK_F ("FS" ,"SFP-10G-T" , sfp_fixup_fs_10gt), +// Fiberstore SFP-2.5G-T uses Rollball protocol to talk to the PHY and +// needs 4 sec wait before probing the PHY. +SFP_QUIRK_F ("FS" ,"SFP-2.5G-T" , sfp_fixup_fs_2_5gt), +// Fiberstore GPON-ONU-34-20BI can operate at 2500base-X, but report 1.2GBd // NRZ in their EEPROM SFP_QUIRK("FS", "GPON-ONU-34-20BI", sfp_quirk_2500basex,
@@ -488,9 +497,6 @@ static const struct sfp_quirk sfp_quirks[] = {SFP_QUIRK ("HUAWEI" ,"MA5671A" , sfp_quirk_2500basex, sfp_fixup_ignore_tx_fault), -// FS 2.5G Base-T -SFP_QUIRK_M ("FS" ,"SFP-2.5G-T" , sfp_quirk_oem_2_5g), -// Lantech 8330-262D-E can operate at 2500base-X, but incorrectly report // 2500MBd NRZ in their EEPROM SFP_QUIRK_M("Lantech", "8330-262D-E", sfp_quirk_2500basex),
Signature · 1 line
2.43.0
Re: [PATCH 6.9 029/250] net: sfp: enhance quirk for Fibrestore 2.5G copper SFP module
Quoted 1 line · On Tue, 25 Jun 2024 11:29:47 +0200 Greg Kroah-Hartman…
6.9-stable review patch. If anyone has any objections, please let me know.
Sorry I overlooked this, I thought I already replied to this, but in fact I replied to another patch not to be backported:
net: sfp: add quirk for another multigig RollBall transceiver
https://lore.kernel.org/stable/20240527165441.2c5516c9@dellmb/
This patch (net: sfp: enhance quirk for Fibrestore 2.5G copper SFP module) has the same problem: it depends on the same series, so it should not be backported.
Eric informs me that it was already released as 6.9.7 :-(
What can we do?
Marek
Greg Kroah-Hartman
maintainerRe: [PATCH 6.9 029/250] net: sfp: enhance quirk for Fibrestore 2.5G copper SFP module
Quoted 11 lines · Marek Behún
Quoted 1 line · On Tue, 25 Jun 2024 11:29:47 +0200 Greg Kroah-Hartman…
6.9-stable review patch. If anyone has any objections, please let me know.
Sorry I overlooked this, I thought I already replied to this, but in fact I replied to another patch not to be backported:
net: sfp: add quirk for another multigig RollBall transceiver
https://lore.kernel.org/stable/20240527165441.2c5516c9@dellmb/
Quoted 7 lines
This patch (net: sfp: enhance quirk for Fibrestore 2.5G copper SFP module) has the same problem: it depends on the same series, so it should not be backported.
Eric informs me that it was already released as 6.9.7 :-(
What can we do?
Revert is the best, want to send it or can you wait until Monday when I can do it (am traveling this weekend).
thanks,
greg k-h
Greg Kroah-Hartman
maintainerRe: [PATCH 6.9 029/250] net: sfp: enhance quirk for Fibrestore 2.5G copper SFP module
In reply to Marek BehúnQuoted 11 lines · Marek Behún
Quoted 1 line · On Tue, 25 Jun 2024 11:29:47 +0200 Greg Kroah-Hartman…
6.9-stable review patch. If anyone has any objections, please let me know.
Sorry I overlooked this, I thought I already replied to this, but in fact I replied to another patch not to be backported:
net: sfp: add quirk for another multigig RollBall transceiver
https://lore.kernel.org/stable/20240527165441.2c5516c9@dellmb/
Quoted 7 lines
This patch (net: sfp: enhance quirk for Fibrestore 2.5G copper SFP module) has the same problem: it depends on the same series, so it should not be backported.
Eric informs me that it was already released as 6.9.7 :-(
What can we do?
Now reverted, thanks.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 30/250 net: sfp: add quirk for ATS SFP-GE-T 1000Base-TX module
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Golle <[email protected]>
[ Upstream commit 0805d67bc0ef95411228e802f31975cfb7555056 ]
Add quirk for ATS SFP-GE-T 1000Base-TX module.
This copper module comes with broken TX_FAULT indicator which must be ignored for it to work.
--- drivers/net/phy/sfp.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/phy/sfp.c +3 -0
@@ -508,6 +508,9 @@ static const struct sfp_quirk sfp_quirks[] = {SFP_QUIRK_F ("Walsun" ,"HXSX-ATRC-1" , sfp_fixup_fs_10gt),SFP_QUIRK_F ("Walsun" ,"HXSX-ATRI-1" , sfp_fixup_fs_10gt), +// OEM SFP-GE-T is a 1000Base-T module with broken TX_FAULT indicator +SFP_QUIRK_F ("OEM" ,"SFP-GE-T" , sfp_fixup_ignore_tx_fault), +SFP_QUIRK_F ("OEM" ,"SFP-10G-T" , sfp_fixup_rollball_cc),SFP_QUIRK_M ("OEM" ,"SFP-2.5G-T" , sfp_quirk_oem_2_5g), SFP_QUIRK_F("OEM", "RTSFP-10", sfp_fixup_rollball_cc),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/250 net/sched: fix false lockdep warning on qdisc root lock
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Davide Caratti <[email protected]>
[ Upstream commit af0cb3fa3f9ed258d14abab0152e28a0f9593084 ]
Xiumei and Christoph reported the following lockdep splat, complaining of the qdisc root lock being taken twice:
============================================
WARNING: possible recursive locking detected
6.7.0-rc3+ #598 Not tainted
--------------------------------------------
swapper/2/0 is trying to acquire lock:
ffff888177190110 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0x1560/0x2e70
but task is already holding lock:
ffff88811995a110 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0x1560/0x2e70
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
---- lock(&sch->q.lock);
lock(&sch->q.lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
5 locks held by swapper/2/0:
#0: ffff888135a09d98 ((&in_dev->mr_ifc_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11a/0x510 #1: ffffffffaaee5260 (rcu_read_lock){....}-{1:2}, at: ip_finish_output2+0x2c0/0x1ed0 #2: ffffffffaaee5200 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x209/0x2e70 #3: ffff88811995a110 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0x1560/0x2e70 #4: ffffffffaaee5200 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x209/0x2e70
stack backtrace: CPU: 2 PID: 0 Comm: swapper/2 Not tainted 6.7.0-rc3+ #598 Hardware name: Red Hat KVM, BIOS 1.13.0-2.module+el8.3.0+7353+9de0a3cc 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0x4a/0x80 __lock_acquire+0xfdd/0x3150 lock_acquire+0x1ca/0x540 _raw_spin_lock+0x34/0x80 __dev_queue_xmit+0x1560/0x2e70 tcf_mirred_act+0x82e/0x1260 [act_mirred] tcf_action_exec+0x161/0x480 tcf_classify+0x689/0x1170 prio_enqueue+0x316/0x660 [sch_prio] dev_qdisc_enqueue+0x46/0x220 __dev_queue_xmit+0x1615/0x2e70 ip_finish_output2+0x1218/0x1ed0 __ip_finish_output+0x8b3/0x1350 ip_output+0x163/0x4e0 igmp_ifc_timer_expire+0x44b/0x930 call_timer_fn+0x1a2/0x510 run_timer_softirq+0x54d/0x11a0 __do_softirq+0x1b3/0x88f irq_exit_rcu+0x18f/0x1e0 sysvec_apic_timer_interrupt+0x6f/0x90 </IRQ>
This happens when TC does a mirred egress redirect from the root qdisc of device A to the root qdisc of device B. As long as these two locks aren't protecting the same qdisc, they can be acquired in chain: add a per-qdisc lockdep key to silence false warnings.
This dynamic key should safely replace the static key we have in sch_htb:
it was added to allow enqueueing to the device "direct qdisc" while still holding the qdisc root lock.
v2: don't use static keys anymore in HTB direct qdiscs (thanks Eric Dumazet)
--- include/net/sch_generic.h | 1 + net/sched/sch_generic.c | 3 +++ net/sched/sch_htb.c | 22 +++------------------- 3 files changed, 7 insertions(+), 19 deletions(-)
include/net/sch_generic.h +1 -0
@@ -128,6 +128,7 @@ struct Qdisc {struct rcu_head rcu;netdevice_tracker dev_tracker; +struct lock_class_key root_lock_key;/* private data */ long privdata[]____cacheline_aligned ; };
net/sched/sch_generic.c +3 -0
@@ -946,7 +946,9 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,__skb_queue_head_init (&sch->gso_skb);__skb_queue_head_init (&sch->skb_bad_txq);gnet_stats_basic_sync_init (&sch->bstats); +lockdep_register_key (&sch->root_lock_key);spin_lock_init (&sch->q.lock); +lockdep_set_class (&sch->q.lock, &sch->root_lock_key);if (ops->static_flags &TCQ_F_CPUSTATS ) { sch->cpu_bstats =
@@ -1069,6 +1071,7 @@ static void __qdisc_destroy(struct Qdisc *qdisc)if (ops->destroy) ops->destroy (qdisc); +lockdep_unregister_key (&qdisc->root_lock_key);module_put (ops->owner);netdev_put (dev, &qdisc->dev_tracker);
net/sched/sch_htb.c +3 -19
@@ -1039,13 +1039,6 @@ static void htb_work_func(struct work_struct *work)rcu_read_unlock (); } -static void htb_set_lockdep_class_child (struct Qdisc *q) -{ -static struct lock_class_key child_key; - -lockdep_set_class (qdisc_lock (q), &child_key); -} -static int htb_offload (struct net_device *dev,struct tc_htb_qopt_offload *opt) {return dev->netdev_ops->ndo_setup_tc (dev,TC_SETUP_QDISC_HTB , opt);
@@ -1132,7 +1125,6 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt,return -ENOMEM ; } -htb_set_lockdep_class_child (qdisc); q->direct_qdiscs[ntx] = qdisc; qdisc->flags |=TCQ_F_ONETXQUEUE |TCQ_F_NOPARENT ; }
@@ -1468,7 +1460,6 @@ static int htb_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new, }if (q->offload) { -htb_set_lockdep_class_child (new);/* One ref for cl->leaf.q, the other for dev_queue->qdisc. */ qdisc_refcount_inc (new); old_q =htb_graft_helper (dev_queue, new);
@@ -1733,11 +1724,8 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg, new_q =qdisc_create_dflt (dev_queue, &pfifo_qdisc_ops, cl->parent->common.classid,NULL ); -if (q->offload) { -if (new_q) -htb_set_lockdep_class_child (new_q); +if (q->offload)htb_parent_to_leaf_offload (sch, dev_queue, new_q); - } }sch_tree_lock (sch);
@@ -1947,13 +1935,9 @@ static int htb_change_class(struct Qdisc *sch, u32 classid, new_q =qdisc_create_dflt (dev_queue, &pfifo_qdisc_ops, classid,NULL );if (q->offload) { -if (new_q) { -htb_set_lockdep_class_child (new_q); -/* One ref for cl->leaf.q, the other for -* dev_queue->qdisc. -*/ +/* One ref for cl->leaf.q, the other for dev_queue->qdisc. */ +if (new_q)qdisc_refcount_inc (new_q); - } old_q =htb_graft_helper (dev_queue, new_q);/* No qdisc_put needed. */ WARN_ON (!(old_q->flags &TCQ_F_BUILTIN ));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/250 arm64/sysreg: Update PIE permission encodings
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shiqi Liu <[email protected]>
[ Upstream commit 12d712dc8e4f1a30b18f8c3789adfbc07f5eb050 ]
Fix left shift overflow issue when the parameter idx is greater than or equal to 8 in the calculation of perm in PIRx_ELx_PERM macro.
Fix this by modifying the encoding to use a long integer type.
--- arch/arm64/include/asm/sysreg.h | 24 ++++++++++++------------ tools/arch/arm64/include/asm/sysreg.h | 24 ++++++++++++------------ 2 files changed, 24 insertions(+), 24 deletions(-)
arch/arm64/include/asm/sysreg.h +12 -12
@@ -1036,18 +1036,18 @@* Permission Indirection Extension (PIE) permission encodings. * Encodings with the _O suffix, have overlays applied (Permission Overlay Extension). */ -#define PIE_NONE_O 0x0 -#define PIE_R_O 0x1 -#define PIE_X_O 0x2 -#define PIE_RX_O 0x3 -#define PIE_RW_O 0x5 -#define PIE_RWnX_O 0x6 -#define PIE_RWX_O 0x7 -#define PIE_R 0x8 -#define PIE_GCS 0x9 -#define PIE_RX 0xa -#define PIE_RW 0xc -#define PIE_RWX 0xe +#define PIE_NONE_O UL(0x0) +#define PIE_R_O UL(0x1) +#define PIE_X_O UL(0x2) +#define PIE_RX_O UL(0x3) +#define PIE_RW_O UL(0x5) +#define PIE_RWnX_O UL(0x6) +#define PIE_RWX_O UL(0x7) +#define PIE_R UL(0x8) +#define PIE_GCS UL(0x9) +#define PIE_RX UL(0xa) +#define PIE_RW UL(0xc) +#define PIE_RWX UL(0xe)#define PIRx_ELx_PERM (idx, perm) ((perm) << ((idx) * 4))
tools/arch/arm64/include/asm/sysreg.h +12 -12
@@ -701,18 +701,18 @@* Permission Indirection Extension (PIE) permission encodings. * Encodings with the _O suffix, have overlays applied (Permission Overlay Extension). */ -#define PIE_NONE_O 0x0 -#define PIE_R_O 0x1 -#define PIE_X_O 0x2 -#define PIE_RX_O 0x3 -#define PIE_RW_O 0x5 -#define PIE_RWnX_O 0x6 -#define PIE_RWX_O 0x7 -#define PIE_R 0x8 -#define PIE_GCS 0x9 -#define PIE_RX 0xa -#define PIE_RW 0xc -#define PIE_RWX 0xe +#define PIE_NONE_O UL(0x0) +#define PIE_R_O UL(0x1) +#define PIE_X_O UL(0x2) +#define PIE_RX_O UL(0x3) +#define PIE_RW_O UL(0x5) +#define PIE_RWnX_O UL(0x6) +#define PIE_RWX_O UL(0x7) +#define PIE_R UL(0x8) +#define PIE_GCS UL(0x9) +#define PIE_RX UL(0xa) +#define PIE_RW UL(0xc) +#define PIE_RWX UL(0xe)#define PIRx_ELx_PERM (idx, perm) ((perm) << ((idx) * 4))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/250 kselftest: arm64: Add a null pointer check
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit 80164282b3620a3cb73de6ffda5592743e448d0e ]
There is a 'malloc' call, which can be unsuccessful. This patch will add the malloc failure checking
to avoid possible null dereference and give more information about test fail reasons.
--- tools/testing/selftests/arm64/tags/tags_test.c | 4 ++++ 1 file changed, 4 insertions(+)
tools/testing/selftests/arm64/tags/tags_test.c +4 -0
@@ -6,6 +6,7 @@#include <stdint.h> #include <sys/prctl.h> #include <sys/utsname.h> +#include "../../kselftest.h" #define SHIFT_TAG (tag) ((uint64_t)(tag) << 56)#define SET_TAG (ptr, tag) (((uint64_t)(ptr) & ~SHIFT_TAG(0xff)) | \
@@ -21,6 +22,9 @@ int main(void)if (prctl (PR_SET_TAGGED_ADDR_CTRL ,PR_TAGGED_ADDR_ENABLE ,0 ,0 ,0 ) ==0 ) tbi_enabled =1 ; ptr = (struct utsname *)malloc (sizeof (*ptr)); +if (!ptr) +ksft_exit_fail_msg ("Failed to allocate utsname buffer\n" ); +if (tbi_enabled) tag =0x42 ; ptr = (struct utsname *)SET_TAG (ptr, tag);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/250 net: dsa: realtek: keep default LED state in rtl8366rb
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Angelo Daros de Luca <[email protected]>
[ Upstream commit 5edc6585aafefa3d44fb8a84adf241d90227f7a3 ]
This switch family supports four LEDs for each of its six ports. Each LED group is composed of one of these four LEDs from all six ports. LED groups can be configured to display hardware information, such as link activity, or manually controlled through a bitmap in registers RTL8366RB_LED_0_1_CTRL_REG and RTL8366RB_LED_2_3_CTRL_REG.
After a reset, the default LED group configuration for groups 0 to 3 indicates, respectively, link activity, link at 1000M, 100M, and 10M, or RTL8366RB_LED_CTRL_REG as 0x5432. These configurations are commonly used for LED indications. However, the driver was replacing that configuration to use manually controlled LEDs (RTL8366RB_LED_FORCE) without providing a way for the OS to control them. The default configuration is deemed more useful than fixed, uncontrollable turned-on LEDs.
The driver was enabling/disabling LEDs during port_enable/disable. However, these events occur when the port is administratively controlled (up or down) and are not related to link presence. Additionally, when a port N was disabled, the driver was turning off all LEDs for group N, not only the corresponding LED for port N in any of those 4 groups. In such cases, if port 0 was brought down, the LEDs for all ports in LED group 0 would be turned off. As another side effect, the driver was wrongly warning that port 5 didn't have an LED ("no LED for port 5"). Since showing the administrative state of ports is not an orthodox way to use LEDs, it was not worth it to fix it and all this code was dropped.
The code to disable LEDs was simplified only changing each LED group to the RTL8366RB_LED_OFF state. Registers RTL8366RB_LED_0_1_CTRL_REG and RTL8366RB_LED_2_3_CTRL_REG are only used when the corresponding LED group is configured with RTL8366RB_LED_FORCE and they don't need to be cleaned. The code still references an LED controlled by RTL8366RB_INTERRUPT_CONTROL_REG, but as of now, no test device has actually used it. Also, some magic numbers were replaced by macros.
--- drivers/net/dsa/realtek/rtl8366rb.c | 87 +++++++---------------------- 1 file changed, 20 insertions(+), 67 deletions(-)
drivers/net/dsa/realtek/rtl8366rb.c +20 -67
@@ -185,7 +185,12 @@#define RTL8366RB_LED_BLINKRATE_222MS 0x0004#define RTL8366RB_LED_BLINKRATE_446MS 0x0005 +/* LED trigger event for each group */ #define RTL8366RB_LED_CTRL_REG 0x0431 +#define RTL8366RB_LED_CTRL_OFFSET (led_group) \ + (4 * (led_group)) +#define RTL8366RB_LED_CTRL_MASK (led_group) \ + (0xf << RTL8366RB_LED_CTRL_OFFSET(led_group))#define RTL8366RB_LED_OFF 0x0#define RTL8366RB_LED_DUP_COL 0x1#define RTL8366RB_LED_LINK_ACT 0x2
@@ -202,6 +207,11 @@#define RTL8366RB_LED_LINK_TX 0xd#define RTL8366RB_LED_MASTER 0xe#define RTL8366RB_LED_FORCE 0xf + +/* The RTL8366RB_LED_X_X registers are used to manually set the LED state only +* when the corresponding LED group in RTL8366RB_LED_CTRL_REG is +* RTL8366RB_LED_FORCE. Otherwise, it is ignored. +*/ #define RTL8366RB_LED_0_1_CTRL_REG 0x0432#define RTL8366RB_LED_1_OFFSET 6#define RTL8366RB_LED_2_3_CTRL_REG 0x0433
@@ -1001,28 +1011,20 @@ static int rtl8366rb_setup(struct dsa_switch *ds)*/ if (priv->leds_disabled) {/* Turn everything off */ -regmap_update_bits (priv->map, -RTL8366RB_LED_0_1_CTRL_REG , -0x0FFF ,0 ); -regmap_update_bits (priv->map, -RTL8366RB_LED_2_3_CTRL_REG , -0x0FFF ,0 );regmap_update_bits (priv->map,RTL8366RB_INTERRUPT_CONTROL_REG ,RTL8366RB_P4_RGMII_LED ,0 ); - val =RTL8366RB_LED_OFF ; - }else { -/* TODO: make this configurable per LED */ - val =RTL8366RB_LED_FORCE ; - } -for (i =0 ; i <4 ; i++) { - ret =regmap_update_bits (priv->map, -RTL8366RB_LED_CTRL_REG , -0xf << (i *4 ), - val << (i *4 )); -if (ret) -return ret; + +for (i =0 ; i <RTL8366RB_NUM_LEDGROUPS ; i++) { + val =RTL8366RB_LED_OFF <<RTL8366RB_LED_CTRL_OFFSET (i); + ret =regmap_update_bits (priv->map, +RTL8366RB_LED_CTRL_REG , +RTL8366RB_LED_CTRL_MASK (i), + val); +if (ret) +return ret; + } } ret =rtl8366_reset_vlan (priv);
@@ -1167,52 +1169,6 @@ rtl8366rb_mac_link_down(struct dsa_switch *ds, int port, unsigned int mode, } } -static void rb8366rb_set_port_led (struct realtek_priv *priv, -int port,bool enable) -{ -u16 val = enable ?0x3f :0 ; -int ret; - -if (priv->leds_disabled) -return ; - -switch (port) { -case 0 : - ret =regmap_update_bits (priv->map, -RTL8366RB_LED_0_1_CTRL_REG , -0x3F , val); -break ; -case 1 : - ret =regmap_update_bits (priv->map, -RTL8366RB_LED_0_1_CTRL_REG , -0x3F <<RTL8366RB_LED_1_OFFSET , - val <<RTL8366RB_LED_1_OFFSET ); -break ; -case 2 : - ret =regmap_update_bits (priv->map, -RTL8366RB_LED_2_3_CTRL_REG , -0x3F , val); -break ; -case 3 : - ret =regmap_update_bits (priv->map, -RTL8366RB_LED_2_3_CTRL_REG , -0x3F <<RTL8366RB_LED_3_OFFSET , - val <<RTL8366RB_LED_3_OFFSET ); -break ; -case 4 : - ret =regmap_update_bits (priv->map, -RTL8366RB_INTERRUPT_CONTROL_REG , -RTL8366RB_P4_RGMII_LED , - enable ?RTL8366RB_P4_RGMII_LED :0 ); -break ; -default : -dev_err (priv->dev,"no LED for port %d\n" , port); -return ; - } -if (ret) -dev_err (priv->dev,"error updating LED on port %d\n" , port); -} -static int rtl8366rb_port_enable (struct dsa_switch *ds,int port,struct phy_device *phy)
@@ -1226,7 +1182,6 @@ rtl8366rb_port_enable(struct dsa_switch *ds, int port,if (ret)return ret; -rb8366rb_set_port_led (priv, port, true);return 0 ; }
@@ -1241,8 +1196,6 @@ rtl8366rb_port_disable(struct dsa_switch *ds, int port) BIT(port));if (ret)return ; - -rb8366rb_set_port_led (priv, port, false); } static int
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/250 net: dsa: realtek: do not assert reset on remove
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Angelo Daros de Luca <[email protected]>
[ Upstream commit 4f580e9aced1816398c1c64f178302a22b8ea6e2 ]
The necessity of asserting the reset on removal was previously questioned, as DSA's own cleanup methods should suffice to prevent traffic leakage[1].
When a driver has subdrivers controlled by devres, they will be unregistered after the main driver's .remove is executed. If it asserts a reset, the subdrivers will be unable to communicate with the hardware during their cleanup. For LEDs, this means that they will fail to turn off, resulting in a timeout error.
[1] https://lore.kernel.org/r/[email protected]/
--- drivers/net/dsa/realtek/rtl83xx.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/net/dsa/realtek/rtl83xx.c +2 -5
@@ -290,16 +290,13 @@ EXPORT_SYMBOL_NS_GPL(rtl83xx_shutdown, REALTEK_DSA);* rtl83xx_remove() - Cleanup a realtek switch driver * @priv: realtek_priv pointer * -* If a method is provided, this function asserts the hard reset of the switch -* in order to avoid leaking traffic when the driver is gone. +* Placehold for common cleanup procedures. * -* Context: Might sleep if priv->gdev->chip->can_sleep. +* Context: Any * Return: nothing */ void rtl83xx_remove (struct realtek_priv *priv) { -/* leave the device reset asserted */ -rtl83xx_reset_assert (priv); }EXPORT_SYMBOL_NS_GPL (rtl83xx_remove,REALTEK_DSA );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/250 ACPI: resource: Skip IRQ override on Asus Vivobook Pro N6506MV
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tamim Khan <[email protected]>
[ Upstream commit 7c52c7071bd403acee8cb0064627d46c6c2a1ea3 ]
Like various other Asus Vivobook and Expertbook laptops, the Asus Vivobook Pro N6506MV has a DSDT table that describes IRQ 1 as ActiveLow while the kernel is overriding it to Edge_High. This prevents the internal keyboard from working. This patch prevents this issue by adding this laptop to the override table that prevents the kernel from overriding this IRQ
--- drivers/acpi/resource.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/acpi/resource.c +7 -0
@@ -517,6 +517,13 @@ static const struct dmi_system_id irq1_level_low_skip_override[] = { DMI_MATCH(DMI_BOARD_NAME, "E1504GAB"), }, }, + { +/* Asus Vivobook Pro N6506MV */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_BOARD_NAME, "N6506MV"), + }, + }, {/* LG Electronics 17U70P */ .matches = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/250 netpoll: Fix race condition in netpoll_owner_active
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit c2e6a872bde9912f1a7579639c5ca3adf1003916 ]
KCSAN detected a race condition in netpoll:
BUG: KCSAN: data-race in net_rx_action / netpoll_send_skb write (marked) to 0xffff8881164168b0 of 4 bytes by interrupt on cpu 10: net_rx_action (./include/linux/netpoll.h:90 net/core/dev.c:6712 net/core/dev.c:6822) <snip> read to 0xffff8881164168b0 of 4 bytes by task 1 on cpu 2: netpoll_send_skb (net/core/netpoll.c:319 net/core/netpoll.c:345 net/core/netpoll.c:393) netpoll_send_udp (net/core/netpoll.c:?) <snip> value changed: 0x0000000a -> 0xffffffff
This happens because netpoll_owner_active() needs to check if the current CPU is the owner of the lock, touching napi->poll_owner non atomically. The ->poll_owner field contains the current CPU holding the lock.
Use an atomic read to check if the poll owner is the current CPU.
--- net/core/netpoll.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/netpoll.c +1 -1
@@ -316,7 +316,7 @@ static int netpoll_owner_active(struct net_device *dev)struct napi_struct *napi;list_for_each_entry_rcu (napi, &dev->napi_list, dev_list) { -if (napi->poll_owner ==smp_processor_id ()) +if (READ_ONCE (napi->poll_owner) ==smp_processor_id ())return 1 ; }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/250 wifi: ath12k: fix the problem that down grade phy mode operation
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lingbo Kong <[email protected]>
[ Upstream commit bf76b144fe53c7f0de9e294947d903fc7724776f ]
Currently, when using WCN7850 or QCN9274 as AP, ath12k always performs down grade phy mode operation regardless of whether the firmware supports EHT capability or not and then vdev will start in HE mode. When stations that support EHT capability try to connect to the AP, the AP will set phy mode to EHT after receiving the association request packet, and then send WMI_PEER_ASSOC_CMDID command to firmware, AP’s firmware will crash.
This is because when the ath12k_mac_copy_sband_iftype_data() function handles EHT capability, it does not copy the EHT capability into the iftype[band][type] array according to the interface type. So, interface type should not be used as an index to get eht_cap in ath12k_mac_check_down_grade_phy_mode() function.
To address this issue, use types_mask to select the eht_cap in ath12k_mac_check_down_grade_phy_mode() function.
This patch affects QCN9274 and WCN7850 because they have the same issue.
Hostapd log:
wlo1: STA 02:03:7f:37:12:34 IEEE 802.11: Could not set STA to kernel driver
Kernel log:
[270894.816076] ath12k_pci 0000:03:00.0: failed to send WMI_PEER_SET_PARAM cmd [270894.816111] ath12k_pci 0000:03:00.0: failed to setup peer SMPS for vdev 0: -108 [270894.816122] ath12k_pci 0000:03:00.0: Failed to associate station: 02:03:7f:37:12:34 [270894.843389] ieee80211 phy5: Hardware restart was requested [270894.843517] ath12k_pci 0000:03:00.0: failed to lookup peer 02:03:7f:37:12:34 on vdev 0 [270894.843616] ath12k_pci 0000:03:00.0: failed to send WMI_PEER_DELETE cmd [270894.843650] ath12k_pci 0000:03:00.0: failed to delete peer vdev_id 0 addr 02:03:7f:37:12:34 ret -108 [270894.843663] ath12k_pci 0000:03:00.0: Failed to delete peer: 02:03:7f:37:12:34 for VDEV: 0
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath12k/mac.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath12k/mac.c +13 -3
@@ -6286,14 +6286,24 @@ ath12k_mac_check_down_grade_phy_mode(struct ath12k *ar, enum nl80211_band band, enum nl80211_iftype type) { -struct ieee80211_sta_eht_cap *eht_cap; +struct ieee80211_sta_eht_cap *eht_cap =NULL ;enum wmi_phy_mode down_mode; +int n = ar->mac.sbands[band].n_iftype_data; +int i; +struct ieee80211_sband_iftype_data *data;if (mode <MODE_11BE_EHT20 )return mode; - eht_cap = &ar->mac.iftype[band][type].eht_cap; -if (eht_cap->has_eht) + data = ar->mac.iftype[band]; +for (i =0 ; i < n; i++) { +if (data[i].types_mask &BIT (type)) { + eht_cap = &data[i].eht_cap; +break ; + } + } + +if (eht_cap && eht_cap->has_eht)return mode;switch (mode) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/250 wifi: mt76: mt7921s: fix potential hung tasks during chip recovery
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Yen <[email protected]>
[ Upstream commit ecf0b2b8a37c8464186620bef37812a117ff6366 ]
During chip recovery (e.g. chip reset), there is a possible situation that kernel worker reset_work is holding the lock and waiting for kernel thread stat_worker to be parked, while stat_worker is waiting for the release of the same lock.
It causes a deadlock resulting in the dumping of hung tasks messages and possible rebooting of the device.
This patch prevents the execution of stat_worker during the chip recovery.
--- drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 2 ++ drivers/net/wireless/mediatek/mt76/mt7921/pci_mac.c | 2 -- drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c | 2 -- drivers/net/wireless/mediatek/mt76/sdio.c | 3 ++- 4 files changed, 4 insertions(+), 5 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7921/mac.c +2 -0
@@ -663,6 +663,7 @@ void mt7921_mac_reset_work(struct work_struct *work)int i, ret;dev_dbg (dev->mt76.dev,"chip reset\n" ); +set_bit (MT76_RESET , &dev->mphy.state); dev->hw_full_reset = true;ieee80211_stop_queues (hw);
@@ -691,6 +692,7 @@ void mt7921_mac_reset_work(struct work_struct *work) } dev->hw_full_reset = false; +clear_bit (MT76_RESET , &dev->mphy.state); pm->suspended = false;ieee80211_wake_queues (hw); ieee80211_iterate_active_interfaces(hw,
drivers/net/wireless/mediatek/mt76/mt7921/pci_mac.c +0 -2
@@ -64,7 +64,6 @@ int mt7921e_mac_reset(struct mt792x_dev *dev)mt76_wr (dev, dev->irq_map->host_irq_enable,0 );mt76_wr (dev,MT_PCIE_MAC_INT_ENABLE ,0x0 ); -set_bit (MT76_RESET , &dev->mphy.state);set_bit (MT76_MCU_RESET , &dev->mphy.state);wake_up (&dev->mt76.mcu.wait);skb_queue_purge (&dev->mt76.mcu.res_q);
@@ -115,7 +114,6 @@ int mt7921e_mac_reset(struct mt792x_dev *dev) err =__mt7921_start (&dev->phy); out: -clear_bit (MT76_RESET , &dev->mphy.state);local_bh_disable ();napi_enable (&dev->mt76.tx_napi);
drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c +0 -2
@@ -98,7 +98,6 @@ int mt7921s_mac_reset(struct mt792x_dev *dev)mt76_connac_free_pending_tx_skbs (&dev->pm,NULL );mt76_txq_schedule_all (&dev->mphy);mt76_worker_disable (&dev->mt76.tx_worker); -set_bit (MT76_RESET , &dev->mphy.state);set_bit (MT76_MCU_RESET , &dev->mphy.state);wake_up (&dev->mt76.mcu.wait);skb_queue_purge (&dev->mt76.mcu.res_q);
@@ -135,7 +134,6 @@ int mt7921s_mac_reset(struct mt792x_dev *dev) err =__mt7921_start (&dev->phy); out: -clear_bit (MT76_RESET , &dev->mphy.state);mt76_worker_enable (&dev->mt76.tx_worker);
drivers/net/wireless/mediatek/mt76/sdio.c +2 -1
@@ -499,7 +499,8 @@ static void mt76s_tx_status_data(struct mt76_worker *worker) dev = container_of(sdio, struct mt76_dev, sdio);while (true) { -if (test_bit (MT76_REMOVED , &dev->phy.state)) +if (test_bit (MT76_RESET , &dev->phy.state) || +test_bit (MT76_REMOVED , &dev->phy.state))break ;if (!dev->drv->tx_status_data (dev, &update))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/250 HID: Add quirk for Logitech Casa touchpad
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean O'Brien <[email protected]>
[ Upstream commit dd2c345a94cfa3873cc20db87387ee509c345c1b ]
This device sometimes doesn't send touch release signals when moving from >=4 fingers to <4 fingers. Using MT_QUIRK_NOT_SEEN_MEANS_UP instead of MT_QUIRK_ALWAYS_VALID makes sure that no touches become stuck.
MT_QUIRK_FORCE_MULTI_INPUT is not necessary for this device, but does no harm.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-multitouch.c | 6 ++++++ 2 files changed, 7 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -823,6 +823,7 @@#define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e#define USB_DEVICE_ID_LOGITECH_T651 0xb00c#define USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD 0xb309 +#define USB_DEVICE_ID_LOGITECH_CASA_TOUCHPAD 0xbb00#define USB_DEVICE_ID_LOGITECH_C007 0xc007#define USB_DEVICE_ID_LOGITECH_C077 0xc077#define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101
drivers/hid/hid-multitouch.c +6 -0
@@ -2081,6 +2081,12 @@ static const struct hid_device_id mt_devices[] = { USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X12_TAB) }, +/* Logitech devices */ + { .driver_data = MT_CLS_NSMU, +HID_DEVICE (BUS_BLUETOOTH ,HID_GROUP_MULTITOUCH_WIN_8 , +USB_VENDOR_ID_LOGITECH , + USB_DEVICE_ID_LOGITECH_CASA_TOUCHPAD) }, + /* MosArt panels */ { .driver_data = MT_CLS_CONFIDENCE_MINUS_ONE, MT_USB_DEVICE(USB_VENDOR_ID_ASUS,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/250 HID: asus: fix more n-key report descriptors if n-key quirked
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luke D. Jones <[email protected]>
[ Upstream commit 59d2f5b7392e988a391e6924e177c1a68d50223d ]
Adjusts the report descriptor for N-Key devices to make the output count 0x01 which completely avoids the need for a block of filtering.
--- drivers/hid/hid-asus.c | 51 ++++++++++++++++++++---------------------- 1 file changed, 24 insertions(+), 27 deletions(-)
drivers/hid/hid-asus.c +24 -27
@@ -335,36 +335,20 @@ static int asus_raw_event(struct hid_device *hdev,if (drvdata->quirks &QUIRK_MEDION_E1239T )return asus_e1239t_event (drvdata, data, size); -if (drvdata->quirks &QUIRK_USE_KBD_BACKLIGHT ) { +/* +* Skip these report ID, the device emits a continuous stream associated +* with the AURA mode it is in which looks like an 'echo'. +*/ +if (report->id ==FEATURE_KBD_LED_REPORT_ID1 || report->id ==FEATURE_KBD_LED_REPORT_ID2 ) +return -1 ; +if (drvdata->quirks &QUIRK_ROG_NKEY_KEYBOARD ) {/* -* Skip these report ID, the device emits a continuous stream associated -* with the AURA mode it is in which looks like an 'echo'. +* G713 and G733 send these codes on some keypresses, depending on +* the key pressed it can trigger a shutdown event if not caught. */ -if (report->id ==FEATURE_KBD_LED_REPORT_ID1 || - report->id ==FEATURE_KBD_LED_REPORT_ID2 ) { +if (data[0 ] ==0x02 && data[1 ] ==0x30 ) {return -1 ; -/* Additional report filtering */ - }else if (report->id ==FEATURE_KBD_REPORT_ID ) { -/* -* G14 and G15 send these codes on some keypresses with no -* discernable reason for doing so. We'll filter them out to avoid -* unmapped warning messages later. -*/ -if (data[1 ] ==0xea || data[1 ] ==0xec || data[1 ] ==0x02 || - data[1 ] ==0x8a || data[1 ] ==0x9e ) { -return -1 ; - } } -if (drvdata->quirks &QUIRK_ROG_NKEY_KEYBOARD ) { -/* -* G713 and G733 send these codes on some keypresses, depending on -* the key pressed it can trigger a shutdown event if not caught. -*/ -if (data[0 ] ==0x02 && data[1 ] ==0x30 ) { -return -1 ; - } - } - }if (drvdata->quirks &QUIRK_ROG_CLAYMORE_II_KEYBOARD ) {
@@ -1250,6 +1234,19 @@ static __u8 *asus_report_fixup(struct hid_device *hdev, __u8 *rdesc, rdesc[205 ] =0x01 ; } +/* match many more n-key devices */ +if (drvdata->quirks &QUIRK_ROG_NKEY_KEYBOARD ) { +for (int i =0 ; i < *rsize +1 ; i++) { +/* offset to the count from 0x5a report part always 14 */ +if (rdesc[i] ==0x85 && rdesc[i +1 ] ==0x5a && + rdesc[i +14 ] ==0x95 && rdesc[i +15 ] ==0x05 ) { +hid_info (hdev,"Fixing up Asus N-Key report descriptor\n" ); + rdesc[i +15 ] =0x01 ; +break ; + } + } + } +return rdesc; }
@@ -1319,4 +1316,4 @@ static struct hid_driver asus_driver = { };module_hid_driver (asus_driver); -MODULE_LICENSE ("GPL" ); +MODULE_LICENSE ("GPL" );
Signature · 1 line
2.43.0
Re: [PATCH 6.9 041/250] HID: asus: fix more n-key report descriptors if n-key quirked
Quoted 1 line · Greg Kroah-Hartman
6.9-stable review patch. If anyone has any objections, please let me know.
Hi,
No objections here but I believe this patch must also be included if not already - https://lore.kernel.org/linux-input/[email protected]/
Regards,
Luke.
Quoted 101 lines
------------------
From: Luke D. Jones <[email protected]>
[ Upstream commit
59d2f5b7392e988a391e6924e177c1a68d50223d]Adjusts the report descriptor for N-Key devices to make the output count
0x01which completely avoids the need for a block of filtering.Signed-off-by Luke D. Jones <[email protected]>Signed-off-by Jiri Kosina <[email protected]>Signed-off-by Sasha Levin <[email protected]>---
drivers/hid/hid-asus.c| 51 ++++++++++++++++++++----------------------1 file changed, 24 insertions(+), 27 deletions(-)drivers/hid/hid-asus.c +24
-27@@ -335,36 +335,20 @@ static int asus_raw_event(struct hid_device *hdev,if (drvdata->quirks &QUIRK_MEDION_E1239T )return asus_e1239t_event (drvdata, data, size); -if (drvdata->quirks &QUIRK_USE_KBD_BACKLIGHT ) { +/* +* Skip these report ID, the device emits a continuous stream associated +* with the AURA mode it is in which looks like an 'echo'. +*/ +if (report->id ==FEATURE_KBD_LED_REPORT_ID1 || report->id ==FEATURE_KBD_LED_REPORT_ID2 ) +return -1 ; +if (drvdata->quirks &QUIRK_ROG_NKEY_KEYBOARD ) {/* -* Skip these report ID, the device emits a continuous stream associated -* with the AURA mode it is in which looks like an 'echo'. +* G713 and G733 send these codes on some keypresses, depending on +* the key pressed it can trigger a shutdown event if not caught. */ -if (report->id ==FEATURE_KBD_LED_REPORT_ID1 || - report->id ==FEATURE_KBD_LED_REPORT_ID2 ) { +if (data[0 ] ==0x02 && data[1 ] ==0x30 ) {return -1 ; -/* Additional report filtering */ - }else if (report->id ==FEATURE_KBD_REPORT_ID ) { -/* -* G14 and G15 send these codes on some keypresses with no -* discernable reason for doing so. We'll filter them out to avoid -* unmapped warning messages later. -*/ -if (data[1 ] ==0xea || data[1 ] ==0xec || data[1 ] ==0x02 || - data[1 ] ==0x8a || data[1 ] ==0x9e ) { -return -1 ; - } } -if (drvdata->quirks &QUIRK_ROG_NKEY_KEYBOARD ) { -/* -* G713 and G733 send these codes on some keypresses, depending on -* the key pressed it can trigger a shutdown event if not caught. -*/ -if (data[0 ] ==0x02 && data[1 ] ==0x30 ) { -return -1 ; - } - } - }if (drvdata->quirks &QUIRK_ROG_CLAYMORE_II_KEYBOARD ) {@@ -1250,6 +1234,19 @@ static __u8 *asus_report_fixup(struct hid_device *hdev, __u8 *rdesc, rdesc[205 ] =0x01 ; } +/* match many more n-key devices */ +if (drvdata->quirks &QUIRK_ROG_NKEY_KEYBOARD ) { +for (int i =0 ; i < *rsize +1 ; i++) { +/* offset to the count from 0x5a report part always 14 */ +if (rdesc[i] ==0x85 && rdesc[i +1 ] ==0x5a && + rdesc[i +14 ] ==0x95 && rdesc[i +15 ] ==0x05 ) { +hid_info (hdev,"Fixing up Asus N-Key report descriptor\n" ); + rdesc[i +15 ] =0x01 ; +break ; + } + } + } +return rdesc; }@@ -1319,4 +1316,4 @@ static struct hid_driver asus_driver = { };module_hid_driver (asus_driver); -MODULE_LICENSE ("GPL" ); +MODULE_LICENSE ("GPL" );Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerRe: [PATCH 6.9 041/250] HID: asus: fix more n-key report descriptors if n-key quirked
Quoted 6 lines · Luke Jones
Quoted 1 line · Greg Kroah-Hartman
6.9-stable review patch. If anyone has any objections, please let me know.
Hi,
No objections here but I believe this patch must also be included if not already - https://lore.kernel.org/linux-input/[email protected]/
Thanks, already included!
greg k-h
Greg Kroah-Hartman
maintainerPATCH 42/250 ACPI: video: Add backlight=native quirk for Lenovo Slim 7 16ARH7
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit c901f63dc142c48326931f164f787dfff69273d9 ]
Lenovo Slim 7 16ARH7 is a machine with switchable graphics between AMD and Nvidia, and the backlight can't be adjusted properly unless acpi_backlight=native is passed. Although nvidia-wmi-backlight is present and loaded, this doesn't work as expected at all.
For making it working as default, add the corresponding quirk entry with a DMI matching "LENOVO" "82UX".
--- drivers/acpi/video_detect.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/video_detect.c +8 -0
@@ -497,6 +497,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "82BK"), }, }, + { + .callback = video_detect_force_native, +/* Lenovo Slim 7 16ARH7 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_NAME, "82UX"), + }, + }, { .callback = video_detect_force_native,/* Lenovo ThinkPad X131e (3371 AMD version) */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/250 bpf: avoid uninitialized warnings in verifier_global_subprogs.c
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jose E. Marchesi <[email protected]>
[ Upstream commit cd3fc3b9782130a5bc1dc3dfccffbc1657637a93 ]
[Changes from V1:
- The warning to disable is -Wmaybe-uninitialized, not -Wuninitialized.
- This warning is only supported in GCC.]
The BPF selftest verifier_global_subprogs.c contains code that purposedly performs out of bounds access to memory, to check whether the kernel verifier is able to catch them. For example:
__noinline int global_unsupp(const int *mem)
{
if (!mem)
return 0;
return mem[100]; /* BOOM */}
With -O1 and higher and no inlining, GCC notices this fact and emits a "maybe uninitialized" warning. This is by design. Note that the emission of these warnings is highly dependent on the precise optimizations that are performed.
This patch adds a compiler pragma to verifier_global_subprogs.c to ignore these warnings.
Tested in bpf-next master.
No regressions.
--- .../testing/selftests/bpf/progs/verifier_global_subprogs.c | 7 +++++++ 1 file changed, 7 insertions(+)
tools/testing/selftests/bpf/progs/verifier_global_subprogs.c +7 -0
@@ -8,6 +8,13 @@#include "xdp_metadata.h" #include "bpf_kfuncs.h" +/* The compiler may be able to detect the access to uninitialized +memory in the routines performing out of bound memory accesses and +emit warnings about it. This is the case of GCC. */ +#if !defined(__clang__) +#pragma GCC diagnostic ignored "-Wmaybe-uninitialized" +#endif +int arr[1 ];int unkn_idx;const volatile bool call_dead_subprog = false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/250 selftests: net: fix timestamp not arriving in cmsg_time.sh
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 2d3b8dfd82d76b1295167c6453d683ab99e50794 ]
On slow machines the SND timestamp sometimes doesn't arrive before we quit. The test only waits as long as the packet delay, so it's easy for a race condition to happen.
Double the wait but do a bit of polling, once the SND timestamp arrives there's no point to wait any longer.
This fixes the "TXTIME abs" failures on debug kernels, like:
Case ICMPv4 - TXTIME abs returned '', expected 'OK'
--- tools/testing/selftests/net/cmsg_sender.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)
tools/testing/selftests/net/cmsg_sender.c +15 -5
@@ -333,16 +333,17 @@ static const char *cs_ts_info2str(unsigned int info)return "unknown" ; } -static void +static unsigned long cs_read_cmsg (int fd,struct msghdr *msg,char *cbuf,size_t cbuf_sz) {struct sock_extended_err *see;struct scm_timestamping *ts; +unsigned long ts_seen =0 ;struct cmsghdr *cmsg;int i, err;if (!opt.ts.ena) -return ; +return 0 ; msg->msg_control = cbuf; msg->msg_controllen = cbuf_sz;
@@ -396,8 +397,11 @@ cs_read_cmsg(int fd, struct msghdr *msg, char *cbuf, size_t cbuf_sz)printf (" %5s ts%d %lluus\n" ,cs_ts_info2str (see->ee_info), i, rel_time); + ts_seen |=1 << see->ee_info; } } + +return ts_seen; }static void ca_set_sockopts (int fd)
@@ -509,10 +513,16 @@ int main(int argc, char *argv[]) err =ERN_SUCCESS ;if (opt.ts.ena) { -/* Make sure all timestamps have time to loop back */ -usleep (opt.txtime.delay); +unsigned long seen; +int i; -cs_read_cmsg (fd, &msg, cbuf,sizeof (cbuf)); +/* Make sure all timestamps have time to loop back */ +for (i =0 ; i <40 ; i++) { + seen =cs_read_cmsg (fd, &msg, cbuf,sizeof (cbuf)); +if (seen & (1 <<SCM_TSTAMP_SND )) +break ; +usleep (opt.txtime.delay /20 ); + } } err_out:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/250 net: ena: Add validation for completion descriptors consistency
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Arinzon <[email protected]>
[ Upstream commit b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7 ]
Validate that first flag is set only for the first descriptor in multi-buffer packets.
In case of an invalid descriptor, a reset will occur. A new reset reason for RX data corruption has been added.
--- drivers/net/ethernet/amazon/ena/ena_eth_com.c | 37 ++++++++++++++----- drivers/net/ethernet/amazon/ena/ena_netdev.c | 2 + .../net/ethernet/amazon/ena/ena_regs_defs.h | 1 + 3 files changed, 30 insertions(+), 10 deletions(-)
drivers/net/ethernet/amazon/ena/ena_eth_com.c +27 -10
@@ -229,30 +229,43 @@ static struct ena_eth_io_rx_cdesc_base * idx * io_cq->cdesc_entry_size_in_bytes); } -static u16 ena_com_cdesc_rx_pkt_get (struct ena_com_io_cq *io_cq, -u16 *first_cdesc_idx) +static int ena_com_cdesc_rx_pkt_get (struct ena_com_io_cq *io_cq, +u16 *first_cdesc_idx, +u16 *num_descs) { +u16 count = io_cq->cur_rx_pkt_cdesc_count, head_masked;struct ena_eth_io_rx_cdesc_base *cdesc; -u16 count =0 , head_masked;u32 last =0 ;do { +u32 status; + cdesc =ena_com_get_next_rx_cdesc (io_cq);if (!cdesc)break ; + status =READ_ONCE (cdesc->status);ena_com_cq_inc_head (io_cq); +if (unlikely ((status &ENA_ETH_IO_RX_CDESC_BASE_FIRST_MASK ) >> +ENA_ETH_IO_RX_CDESC_BASE_FIRST_SHIFT && count !=0 )) { +struct ena_com_dev *dev =ena_com_io_cq_to_ena_dev (io_cq); + +netdev_err (dev->net_device, +"First bit is on in descriptor #%d on q_id: %d, req_id: %u\n" , + count, io_cq->qid, cdesc->req_id); +return -EFAULT ; + } count++; - last = (READ_ONCE (cdesc->status) &ENA_ETH_IO_RX_CDESC_BASE_LAST_MASK ) >> -ENA_ETH_IO_RX_CDESC_BASE_LAST_SHIFT ; + last = (status &ENA_ETH_IO_RX_CDESC_BASE_LAST_MASK ) >> +ENA_ETH_IO_RX_CDESC_BASE_LAST_SHIFT ; }while (!last);if (last) { *first_cdesc_idx = io_cq->cur_rx_pkt_cdesc_start_idx; - count += io_cq->cur_rx_pkt_cdesc_count; head_masked = io_cq->head & (io_cq->q_depth -1 ); + *num_descs = count; io_cq->cur_rx_pkt_cdesc_count =0 ; io_cq->cur_rx_pkt_cdesc_start_idx = head_masked;
@@ -260,11 +273,11 @@ static u16 ena_com_cdesc_rx_pkt_get(struct ena_com_io_cq *io_cq,"ENA q_id: %d packets were completed. first desc idx %u descs# %d\n" , io_cq->qid, *first_cdesc_idx, count); }else { - io_cq->cur_rx_pkt_cdesc_count += count; - count =0 ; + io_cq->cur_rx_pkt_cdesc_count = count; + *num_descs =0 ; } -return count; +return 0 ; } static int ena_com_create_meta(struct ena_com_io_sq *io_sq,
@@ -539,10 +552,14 @@ int ena_com_rx_pkt(struct ena_com_io_cq *io_cq,u16 cdesc_idx =0 ;u16 nb_hw_desc;u16 i =0 ; +int rc;WARN (io_cq->direction !=ENA_COM_IO_QUEUE_DIRECTION_RX ,"wrong Q type" ); - nb_hw_desc =ena_com_cdesc_rx_pkt_get (io_cq, &cdesc_idx); + rc =ena_com_cdesc_rx_pkt_get (io_cq, &cdesc_idx, &nb_hw_desc); +if (unlikely (rc !=0 )) +return -EFAULT ; +if (nb_hw_desc ==0 ) { ena_rx_ctx->descs = nb_hw_desc;return 0 ;
drivers/net/ethernet/amazon/ena/ena_netdev.c +2 -0
@@ -1347,6 +1347,8 @@ static int ena_clean_rx_irq(struct ena_ring *rx_ring, struct napi_struct *napi,if (rc == -ENOSPC ) {ena_increase_stat (&rx_ring->rx_stats.bad_desc_num,1 , &rx_ring->syncp);ena_reset_device (adapter,ENA_REGS_RESET_TOO_MANY_RX_DESCS ); + }else if (rc == -EFAULT ) { +ena_reset_device (adapter,ENA_REGS_RESET_RX_DESCRIPTOR_MALFORMED ); }else {ena_increase_stat (&rx_ring->rx_stats.bad_req_id,1 , &rx_ring->syncp);
drivers/net/ethernet/amazon/ena/ena_regs_defs.h +1 -0
@@ -22,6 +22,7 @@ enum ena_regs_reset_reason_types {ENA_REGS_RESET_GENERIC =13 ,ENA_REGS_RESET_MISS_INTERRUPT =14 ,ENA_REGS_RESET_SUSPECTED_POLL_STARVATION =15 , + ENA_REGS_RESET_RX_DESCRIPTOR_MALFORMED = 16, };/* ena_registers offsets */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/250 Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uri Arev <[email protected]>
[ Upstream commit 68aa21054ec3a1a313af90a5f95ade16c3326d20 ]
This fixes some CHECKs reported by the checkpatch script.
Issues reported in ath3k.c:
-------ath3k.c
-------
CHECK: Please don't use multiple blank lines
+
+
CHECK: Blank lines aren't necessary after an open brace '{' +static const struct usb_device_id ath3k_blist_tbl[] = { +
CHECK: Alignment should match open parenthesis +static int ath3k_load_firmware(struct usb_device *udev,
+ const struct firmware *firmware)
CHECK: Alignment should match open parenthesis
+ err = usb_bulk_msg(udev, pipe, send_buf, size,
+ &len, 3000);
CHECK: Unnecessary parentheses around 'len != size'
+ if (err || (len != size)) {
CHECK: Alignment should match open parenthesis +static int ath3k_get_version(struct usb_device *udev,
+ struct ath3k_version *version)
CHECK: Alignment should match open parenthesis +static int ath3k_load_fwfile(struct usb_device *udev,
+ const struct firmware *firmware)
CHECK: Alignment should match open parenthesis
+ err = usb_bulk_msg(udev, pipe, send_buf, size,
+ &len, 3000);
CHECK: Unnecessary parentheses around 'len != size'
+ if (err || (len != size)) {
CHECK: Blank lines aren't necessary after an open brace '{'
+ switch (fw_version.ref_clock) {
+
CHECK: Alignment should match open parenthesis
+ snprintf(filename, ATH3K_NAME_LEN, "ar3k/ramps_0x%08x_%d%s",
+ le32_to_cpu(fw_version.rom_version), clk_value, ".dfu");
CHECK: Alignment should match open parenthesis +static int ath3k_probe(struct usb_interface *intf,
+ const struct usb_device_id *id)
CHECK: Alignment should match open parenthesis
+ BT_ERR("Firmware file \"%s\" not found",
+ ATH3K_FIRMWARE);
CHECK: Alignment should match open parenthesis
+ BT_ERR("Firmware file \"%s\" request failed (err=%d)",
+ ATH3K_FIRMWARE, ret);
total: 0 errors, 0 warnings, 14 checks, 540 lines checked
--- drivers/bluetooth/ath3k.c | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-)
drivers/bluetooth/ath3k.c +11 -14
@@ -3,7 +3,6 @@* Copyright (c) 2008-2009 Atheros Communications Inc. */ -#include <linux/module.h> #include <linux/kernel.h> #include <linux/init.h>
@@ -128,7 +127,6 @@ MODULE_DEVICE_TABLE(usb, ath3k_table);* for AR3012 */ static const struct usb_device_id ath3k_blist_tbl[] = { -/* Atheros AR3012 with sflash firmware*/ {USB_DEVICE (0x0489 ,0xe04e ), .driver_info =BTUSB_ATH3012 }, {USB_DEVICE (0x0489 ,0xe04d ), .driver_info =BTUSB_ATH3012 },
@@ -202,7 +200,7 @@ static inline void ath3k_log_failed_loading(int err, int len, int size,#define TIMEGAP_USEC_MAX 100static int ath3k_load_firmware (struct usb_device *udev, -const struct firmware *firmware) +const struct firmware *firmware) {u8 *send_buf;int len =0 ;
@@ -237,9 +235,9 @@ static int ath3k_load_firmware(struct usb_device *udev,memcpy (send_buf, firmware->data + sent, size); err =usb_bulk_msg (udev, pipe, send_buf, size, - &len,3000 ); + &len,3000 ); -if (err || (len != size)) { +if (err || len != size) {ath3k_log_failed_loading (err, len, size, count); goto error; }
@@ -262,7 +260,7 @@ static int ath3k_get_state(struct usb_device *udev, unsigned char *state) }static int ath3k_get_version (struct usb_device *udev, -struct ath3k_version *version) +struct ath3k_version *version) { return usb_control_msg_recv(udev, 0, ATH3K_GETVERSION, USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
@@ -271,7 +269,7 @@ static int ath3k_get_version(struct usb_device *udev, }static int ath3k_load_fwfile (struct usb_device *udev, -const struct firmware *firmware) +const struct firmware *firmware) {u8 *send_buf;int len =0 ;
@@ -310,8 +308,8 @@ static int ath3k_load_fwfile(struct usb_device *udev,memcpy (send_buf, firmware->data + sent, size); err =usb_bulk_msg (udev, pipe, send_buf, size, - &len,3000 ); -if (err || (len != size)) { + &len,3000 ); +if (err || len != size) {ath3k_log_failed_loading (err, len, size, count);kfree (send_buf);return err;
@@ -425,7 +423,6 @@ static int ath3k_load_syscfg(struct usb_device *udev) }switch (fw_version.ref_clock) { -case ATH3K_XTAL_FREQ_26M : clk_value =26 ;break ;
@@ -441,7 +438,7 @@ static int ath3k_load_syscfg(struct usb_device *udev) }snprintf (filename,ATH3K_NAME_LEN ,"ar3k/ramps_0x%08x_%d%s" , -le32_to_cpu (fw_version.rom_version), clk_value,".dfu" ); +le32_to_cpu (fw_version.rom_version), clk_value,".dfu" ); ret =request_firmware (&firmware, filename, &udev->dev);if (ret <0 ) {
@@ -456,7 +453,7 @@ static int ath3k_load_syscfg(struct usb_device *udev) }static int ath3k_probe (struct usb_interface *intf, -const struct usb_device_id *id) +const struct usb_device_id *id) {const struct firmware *firmware;struct usb_device *udev =interface_to_usbdev (intf);
@@ -505,10 +502,10 @@ static int ath3k_probe(struct usb_interface *intf,if (ret <0 ) {if (ret == -ENOENT )BT_ERR ("Firmware file \"%s\" not found" , -ATH3K_FIRMWARE ); +ATH3K_FIRMWARE );else BT_ERR ("Firmware file \"%s\" request failed (err=%d)" , -ATH3K_FIRMWARE , ret); +ATH3K_FIRMWARE , ret);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/250 drm/amd/display: Exit idle optimizations before HDCP execution
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Kazlauskas <[email protected]>
[ Upstream commit f30a3bea92bdab398531129d187629fb1d28f598 ]
[WHY]
PSP can access DCN registers during command submission and we need to ensure that DCN is not in PG before doing so.
[HOW]
Add a callback to DM to lock and notify DC for idle optimization exit. It can't be DC directly because of a potential race condition with the link protection thread and the rest of DM operation.
--- drivers/gpu/drm/amd/display/modules/hdcp/hdcp.c | 10 ++++++++++ drivers/gpu/drm/amd/display/modules/inc/mod_hdcp.h | 8 ++++++++ 2 files changed, 18 insertions(+)
drivers/gpu/drm/amd/display/modules/hdcp/hdcp.c +10 -0
@@ -88,6 +88,14 @@ static uint8_t is_cp_desired_hdcp2(struct mod_hdcp *hdcp) !hdcp->connection.is_hdcp2_revoked; } +static void exit_idle_optimizations (struct mod_hdcp *hdcp) +{ +struct mod_hdcp_dm *dm = &hdcp->config.dm; + +if (dm->funcs.exit_idle_optimizations) + dm->funcs.exit_idle_optimizations (dm->handle); +} +static enum mod_hdcp_status execution (struct mod_hdcp *hdcp,struct mod_hdcp_event_context *event_ctx,union mod_hdcp_transition_input *input)
@@ -543,6 +551,8 @@ enum mod_hdcp_status mod_hdcp_process_event(struct mod_hdcp *hdcp,memset (&event_ctx,0 ,sizeof (struct mod_hdcp_event_context )); event_ctx.event = event; +exit_idle_optimizations (hdcp); +/* execute and transition */ exec_status =execution (hdcp, &event_ctx, &hdcp->auth.trans_input); trans_status = transition(
drivers/gpu/drm/amd/display/modules/inc/mod_hdcp.h +8 -0
@@ -156,6 +156,13 @@ struct mod_hdcp_ddc { } funcs; }; +struct mod_hdcp_dm { +void *handle; +struct { +void (*exit_idle_optimizations)(void *handle); + } funcs; +}; +struct mod_hdcp_psp {void *handle;void *funcs;
@@ -272,6 +279,7 @@ struct mod_hdcp_display_query {struct mod_hdcp_config {struct mod_hdcp_psp psp;struct mod_hdcp_ddc ddc; +struct mod_hdcp_dm dm;uint8_t index; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/250 drm/amd/display: Workaround register access in idle race with cursor
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Kazlauskas <[email protected]>
[ Upstream commit b5b6d6251579a29dafdad25f4bc7f3ff7bfd2c86 ]
[Why]
Cursor update can be pre-empted by a request for setting target flip submission.
This causes an issue where we're in the middle of the exit sequence trying to log to DM, but the pre-emption starts another DMCUB command submission that requires being out of idle.
The DC lock aqusition can fail, and depending on the DM/OS interface it's possible that the function inserted into this thread must not fail.
This means that lock aqusition must be skipped and exit *must* occur.
[How]
Modify when we consider idle as active. Consider it exited only once the exit has fully finished.
Consider it as entered prior to actual notification.
Since we're on the same core/thread the cached values are coherent and we'll see that we still need to exit. Once the cursor update resumes it'll continue doing the double exit but this won't cause a functional issue, just a (potential) redundant operation.
--- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 23 +++++++++++++++----- 1 file changed, 17 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c +17 -6
@@ -1340,16 +1340,27 @@ void dc_dmub_srv_apply_idle_power_optimizations(const struct dc *dc, bool allow_* Powering up the hardware requires notifying PMFW and DMCUB. * Clearing the driver idle allow requires a DMCUB command. * DMCUB commands requires the DMCUB to be powered up and restored. -* -* Exit out early to prevent an infinite loop of DMCUB commands -* triggering exit low power - use software state to track this. */ - dc_dmub_srv->idle_allowed = allow_idle; -if (!allow_idle) +if (!allow_idle) {dc_dmub_srv_exit_low_power_state (dc); -else +/* +* Idle is considered fully exited only after the sequence above +* fully completes. If we have a race of two threads exiting +* at the same time then it's safe to perform the sequence +* twice as long as we're not re-entering. +* +* Infinite command submission is avoided by using the +* dm_execute_dmub_cmd submission instead of the "wake" helpers. +*/ + dc_dmub_srv->idle_allowed = false; + }else { +/* Consider idle as notified prior to the actual submission to +* prevent multiple entries. */ + dc_dmub_srv->idle_allowed = true; +dc_dmub_srv_notify_idle (dc, allow_idle); + } } bool dc_wake_and_execute_dmub_cmd(const struct dc_context *ctx, union dmub_rb_cmd *cmd,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/250 platform/x86: toshiba_acpi: Add quirk for buttons on Z830
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arvid Norlander <[email protected]>
[ Upstream commit 23f1d8b47d125dcd8c1ec62a91164e6bc5d691d0 ]
The Z830 has some buttons that will only work properly as "quickstart" buttons. To enable them in that mode, a value between 1 and 7 must be used for HCI_HOTKEY_EVENT. Windows uses 0x5 on this laptop so use that for maximum predictability and compatibility.
As there is not yet a known way of auto detection, this patch uses a DMI quirk table. A module parameter is exposed to allow setting this on other models for testing.
--- drivers/platform/x86/toshiba_acpi.c | 36 ++++++++++++++++++++++++++--- 1 file changed, 33 insertions(+), 3 deletions(-)
drivers/platform/x86/toshiba_acpi.c +33 -3
@@ -57,6 +57,11 @@ module_param(turn_on_panel_on_resume, int, 0644);MODULE_PARM_DESC (turn_on_panel_on_resume,"Call HCI_PANEL_POWER_ON on resume (-1 = auto, 0 = no, 1 = yes" ); +static int hci_hotkey_quickstart =-1 ; +module_param (hci_hotkey_quickstart, int,0644 ); +MODULE_PARM_DESC (hci_hotkey_quickstart, +"Call HCI_HOTKEY_EVENT with value 0x5 for quickstart button support (-1 = auto, 0 = no, 1 = yes" ); +#define TOSHIBA_WMI_EVENT_GUID "59142400-C6A3-40FA-BADB-8A2652834100"/* Scan code for Fn key on TOS1900 models */
@@ -136,6 +141,7 @@ MODULE_PARM_DESC(turn_on_panel_on_resume,#define HCI_ACCEL_MASK 0x7fff#define HCI_ACCEL_DIRECTION_MASK 0x8000#define HCI_HOTKEY_DISABLE 0x0b +#define HCI_HOTKEY_ENABLE_QUICKSTART 0x05#define HCI_HOTKEY_ENABLE 0x09#define HCI_HOTKEY_SPECIAL_FUNCTIONS 0x10#define HCI_LCD_BRIGHTNESS_BITS 3
@@ -2731,10 +2737,15 @@ static int toshiba_acpi_enable_hotkeys(struct toshiba_acpi_dev *dev)return -ENODEV ;/* +* Enable quickstart buttons if supported. +* * Enable the "Special Functions" mode only if they are * supported and if they are activated. */ -if (dev->kbd_function_keys_supported && dev->special_functions) +if (hci_hotkey_quickstart) + result =hci_write (dev,HCI_HOTKEY_EVENT , +HCI_HOTKEY_ENABLE_QUICKSTART ); +else if (dev->kbd_function_keys_supported && dev->special_functions) result =hci_write (dev,HCI_HOTKEY_EVENT ,HCI_HOTKEY_SPECIAL_FUNCTIONS );else
@@ -3258,7 +3269,14 @@ static const char *find_hci_method(acpi_handle handle)* works. toshiba_acpi_resume() uses HCI_PANEL_POWER_ON to avoid changing * the configured brightness level. */ -static const struct dmi_system_id turn_on_panel_on_resume_dmi_ids[] = { +#define QUIRK_TURN_ON_PANEL_ON_RESUME BIT(0) +/* +* Some Toshibas use "quickstart" keys. On these, HCI_HOTKEY_EVENT must use +* the value HCI_HOTKEY_ENABLE_QUICKSTART. +*/ +#define QUIRK_HCI_HOTKEY_QUICKSTART BIT(1) + +static const struct dmi_system_id toshiba_dmi_quirks[] = { {/* Toshiba Portégé R700 */ /* https://bugzilla.kernel.org/show_bug.cgi?id=21012 */
@@ -3266,6 +3284,7 @@ static const struct dmi_system_id turn_on_panel_on_resume_dmi_ids[] = {DMI_MATCH (DMI_SYS_VENDOR ,"TOSHIBA" ), DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE R700"), }, + .driver_data = (void *)QUIRK_TURN_ON_PANEL_ON_RESUME, }, {/* Toshiba Satellite/Portégé R830 */
@@ -3275,6 +3294,7 @@ static const struct dmi_system_id turn_on_panel_on_resume_dmi_ids[] = {DMI_MATCH (DMI_SYS_VENDOR ,"TOSHIBA" ), DMI_MATCH(DMI_PRODUCT_NAME, "R830"), }, + .driver_data = (void *)QUIRK_TURN_ON_PANEL_ON_RESUME, }, {/* Toshiba Satellite/Portégé Z830 */
@@ -3282,6 +3302,7 @@ static const struct dmi_system_id turn_on_panel_on_resume_dmi_ids[] = { DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), DMI_MATCH(DMI_PRODUCT_NAME, "Z830"), }, + .driver_data = (void *)(QUIRK_TURN_ON_PANEL_ON_RESUME | QUIRK_HCI_HOTKEY_QUICKSTART), }, };
@@ -3290,6 +3311,8 @@ static int toshiba_acpi_add(struct acpi_device *acpi_dev)struct toshiba_acpi_dev *dev;const char *hci_method;u32 dummy; +const struct dmi_system_id *dmi_id; +long quirks =0 ;int ret =0 ;if (toshiba_acpi)
@@ -3442,8 +3465,15 @@ static int toshiba_acpi_add(struct acpi_device *acpi_dev) }#endif + dmi_id =dmi_first_match (toshiba_dmi_quirks); +if (dmi_id) + quirks = (long )dmi_id->driver_data; +if (turn_on_panel_on_resume ==-1 ) - turn_on_panel_on_resume =dmi_check_system (turn_on_panel_on_resume_dmi_ids); + turn_on_panel_on_resume = !!(quirks &QUIRK_TURN_ON_PANEL_ON_RESUME ); + +if (hci_hotkey_quickstart ==-1 ) + hci_hotkey_quickstart = !!(quirks &QUIRK_HCI_HOTKEY_QUICKSTART );toshiba_wwan_available (dev);if (dev->wwan_supported)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/250 cgroup/cpuset: Make cpuset hotplug processing synchronous
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Waiman Long <[email protected]>
[ Upstream commit 2125c0034c5dfd61171b494bd309bb7637bff6eb ]
Since commit 3a5a6d0c2b03("cpuset: don't nest cgroup_mutex inside get_online_cpus()"), cpuset hotplug was done asynchronously via a work function. This is to avoid recursive locking of cgroup_mutex.
Since then, the cgroup locking scheme has changed quite a bit. A cpuset_mutex was introduced to protect cpuset specific operations. The cpuset_mutex is then replaced by a cpuset_rwsem. With commit d74b27d63a8b ("cgroup/cpuset: Change cpuset_rwsem and hotplug lock order"), cpu_hotplug_lock is acquired before cpuset_rwsem. Later on, cpuset_rwsem is reverted back to cpuset_mutex. All these locking changes allow the hotplug code to call into cpuset core directly.
The following commits were also merged due to the asynchronous nature of cpuset hotplug processing.
- commit b22afcdf04c9 ("cpu/hotplug: Cure the cpusets trainwreck")
- commit 50e76632339d ("sched/cpuset/pm: Fix cpuset vs. suspend-resume
bugs")
- commit 28b89b9e6f7b ("cpuset: handle race between CPU hotplug and cpuset_hotplug_work")
Clean up all these bandages by making cpuset hotplug processing synchronous again with the exception that the call to cgroup_transfer_tasks() to transfer tasks out of an empty cgroup v1 cpuset, if necessary, will still be done via a work function due to the existing cgroup_mutex -> cpu_hotplug_lock dependency. It is possible to reverse that dependency, but that will require updating a number of different cgroup controllers. This special hotplug code path should be rarely taken anyway.
As all the cpuset states will be updated by the end of the hotplug operation, we can revert most the above commits except commit 50e76632339d ("sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs") which is partially reverted. Also removing some cpus_read_lock trylock attempts in the cpuset partition code as they are no longer necessary since the cpu_hotplug_lock is now held for the whole duration of the cpuset hotplug code path.
--- include/linux/cpuset.h | 3 - kernel/cgroup/cpuset.c | 141 ++++++++++++++++------------------------- kernel/cpu.c | 48 -------------- kernel/power/process.c | 2 - 4 files changed, 56 insertions(+), 138 deletions(-)
include/linux/cpuset.h +0 -3
@@ -70,7 +70,6 @@ extern int cpuset_init(void);extern void cpuset_init_smp (void );extern void cpuset_force_rebuild (void );extern void cpuset_update_active_cpus (void ); -extern void cpuset_wait_for_hotplug (void );extern void inc_dl_tasks_cs (struct task_struct *task);extern void dec_dl_tasks_cs (struct task_struct *task);extern void cpuset_lock (void );
@@ -185,8 +184,6 @@ static inline void cpuset_update_active_cpus(void)partition_sched_domains (1 ,NULL ,NULL ); } -static inline void cpuset_wait_for_hotplug (void ) { } -static inline void inc_dl_tasks_cs (struct task_struct *task) { }static inline void dec_dl_tasks_cs (struct task_struct *task) { }static inline void cpuset_lock (void ) { }
kernel/cgroup/cpuset.c +56 -85
271 lines not on this page · raw message
kernel/cpu.c +0 -48
66 lines not on this page · raw message
kernel/power/process.c +0 -2
@@ -194,8 +194,6 @@ void thaw_processes(void)__usermodehelper_set_disable_depth (UMH_FREEZING );thaw_workqueues (); -cpuset_wait_for_hotplug (); -read_lock (&tasklist_lock);for_each_process_thread (g, p) {/* No other threads should have PF_SUSPEND_TASK set */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/250 ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 4fee07fbf47d2a5f1065d985459e5ce7bf7969f0 ]
The default JD1 does not seem to work, use JD2 instead.
--- sound/soc/intel/boards/sof_sdw.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/soc/intel/boards/sof_sdw.c +9 -0
@@ -495,6 +495,15 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { SOF_BT_OFFLOAD_SSP(1) | SOF_SSP_BT_OFFLOAD_PRESENT), }, + { + .callback = sof_sdw_quirk_cb, + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "HP"), + DMI_MATCH(DMI_PRODUCT_NAME, "OMEN Transcend Gaming Laptop"), + }, + .driver_data = (void *)(RT711_JD2), + }, +/* LunarLake devices */ { .callback = sof_sdw_quirk_cb,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/250 ASoC: Intel: sof_sdw: add quirk for Dell SKU 0C0F
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit b10cb955c6c0b8dbd9a768166d71cc12680b7fdf ]
The JD1 jack detection doesn't seem to work, use JD2. Also use the 4 speaker configuration.
--- sound/soc/intel/boards/sof_sdw.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
sound/soc/intel/boards/sof_sdw.c +10 -0
@@ -429,6 +429,16 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {RT711_JD2 | SOF_SDW_FOUR_SPK), }, + { + .callback = sof_sdw_quirk_cb, + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc" ), +DMI_EXACT_MATCH (DMI_PRODUCT_SKU ,"0C0F" ) + }, + .driver_data = (void *)(SOF_SDW_TGL_HDMI | +RT711_JD2 | + SOF_SDW_FOUR_SPK), + }, { .callback = sof_sdw_quirk_cb, .matches = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/250 drm/lima: add mask irq callback to gp and pp
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erico Nunes <[email protected]>
[ Upstream commit 49c13b4d2dd4a831225746e758893673f6ae961c ]
This is needed because we want to reset those devices in device-agnostic code such as lima_sched.
In particular, masking irqs will be useful before a hard reset to prevent race conditions.
--- drivers/gpu/drm/lima/lima_bcast.c | 12 ++++++++++++ drivers/gpu/drm/lima/lima_bcast.h | 3 +++ drivers/gpu/drm/lima/lima_gp.c | 8 ++++++++ drivers/gpu/drm/lima/lima_pp.c | 18 ++++++++++++++++++ drivers/gpu/drm/lima/lima_sched.h | 1 + 5 files changed, 42 insertions(+)
drivers/gpu/drm/lima/lima_bcast.c +12 -0
@@ -43,6 +43,18 @@ void lima_bcast_suspend(struct lima_ip *ip) } +int lima_bcast_mask_irq (struct lima_ip *ip) +{ +bcast_write (LIMA_BCAST_BROADCAST_MASK ,0 ); +bcast_write (LIMA_BCAST_INTERRUPT_MASK ,0 ); +return 0 ; +} + +int lima_bcast_reset (struct lima_ip *ip) +{ +return lima_bcast_hw_init (ip); +} +int lima_bcast_init (struct lima_ip *ip) {int i;
drivers/gpu/drm/lima/lima_bcast.h +3 -0
@@ -13,4 +13,7 @@ void lima_bcast_fini(struct lima_ip *ip);void lima_bcast_enable (struct lima_device *dev,int num_pp); +int lima_bcast_mask_irq (struct lima_ip *ip); +int lima_bcast_reset (struct lima_ip *ip); +#endif
drivers/gpu/drm/lima/lima_gp.c +8 -0
@@ -233,6 +233,13 @@ static void lima_gp_task_mmu_error(struct lima_sched_pipe *pipe)lima_sched_pipe_task_done (pipe); } +static void lima_gp_task_mask_irq (struct lima_sched_pipe *pipe) +{ +struct lima_ip *ip = pipe->processor[0 ]; + +gp_write (LIMA_GP_INT_MASK ,0 ); +} +static int lima_gp_task_recover (struct lima_sched_pipe *pipe) {struct lima_ip *ip = pipe->processor[0 ];
@@ -365,6 +372,7 @@ int lima_gp_pipe_init(struct lima_device *dev) pipe->task_error = lima_gp_task_error; pipe->task_mmu_error = lima_gp_task_mmu_error; pipe->task_recover = lima_gp_task_recover; + pipe->task_mask_irq = lima_gp_task_mask_irq;return 0 ; }
drivers/gpu/drm/lima/lima_pp.c +18 -0
@@ -429,6 +429,9 @@ static void lima_pp_task_error(struct lima_sched_pipe *pipe)lima_pp_hard_reset (ip); } + +if (pipe->bcast_processor) +lima_bcast_reset (pipe->bcast_processor); }static void lima_pp_task_mmu_error (struct lima_sched_pipe *pipe)
@@ -437,6 +440,20 @@ static void lima_pp_task_mmu_error(struct lima_sched_pipe *pipe)lima_sched_pipe_task_done (pipe); } +static void lima_pp_task_mask_irq (struct lima_sched_pipe *pipe) +{ +int i; + +for (i =0 ; i < pipe->num_processor; i++) { +struct lima_ip *ip = pipe->processor[i]; + +pp_write (LIMA_PP_INT_MASK ,0 ); + } + +if (pipe->bcast_processor) +lima_bcast_mask_irq (pipe->bcast_processor); +} +static struct kmem_cache *lima_pp_task_slab;static int lima_pp_task_slab_refcnt;
@@ -468,6 +485,7 @@ int lima_pp_pipe_init(struct lima_device *dev) pipe->task_fini = lima_pp_task_fini; pipe->task_error = lima_pp_task_error; pipe->task_mmu_error = lima_pp_task_mmu_error; + pipe->task_mask_irq = lima_pp_task_mask_irq;return 0 ; }
drivers/gpu/drm/lima/lima_sched.h +1 -0
@@ -80,6 +80,7 @@ struct lima_sched_pipe {void (*task_error)(struct lima_sched_pipe *pipe);void (*task_mmu_error)(struct lima_sched_pipe *pipe);int (*task_recover)(struct lima_sched_pipe *pipe); +void (*task_mask_irq)(struct lima_sched_pipe *pipe);struct work_struct recover_work; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/250 drm/lima: include pp bcast irq in timeout handler check
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erico Nunes <[email protected]>
[ Upstream commit d8100caf40a35904d27ce446fb2088b54277997a ]
In commit 53cb55b20208 ("drm/lima: handle spurious timeouts due to high irq latency") a check was added to detect an unexpectedly high interrupt latency timeout.
With further investigation it was noted that on Mali-450 the pp bcast irq may also be a trigger of race conditions against the timeout handler, so add it to this check too.
--- drivers/gpu/drm/lima/lima_sched.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/lima/lima_sched.c +2 -0
@@ -422,6 +422,8 @@ static enum drm_gpu_sched_stat lima_sched_timedout_job(struct drm_sched_job *job*/ for (i =0 ; i < pipe->num_processor; i++)synchronize_irq (pipe->processor[i]->irq); +if (pipe->bcast_processor) +synchronize_irq (pipe->bcast_processor->irq);if (dma_fence_is_signaled (task->fence)) {DRM_WARN ("%s unexpectedly high interrupt latency\n" ,lima_ip_name (ip));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/250 drm/lima: mask irqs in timeout path before hard reset
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erico Nunes <[email protected]>
[ Upstream commit a421cc7a6a001b70415aa4f66024fa6178885a14 ]
There is a race condition in which a rendering job might take just long enough to trigger the drm sched job timeout handler but also still complete before the hard reset is done by the timeout handler. This runs into race conditions not expected by the timeout handler. In some very specific cases it currently may result in a refcount imbalance on lima_pm_idle, with a stack dump such as:
[10136.669170] WARNING: CPU: 0 PID: 0 at drivers/gpu/drm/lima/lima_devfreq.c:205 lima_devfreq_record_idle+0xa0/0xb0 ... [10136.669459] pc : lima_devfreq_record_idle+0xa0/0xb0 ... [10136.669628] Call trace: [10136.669634] lima_devfreq_record_idle+0xa0/0xb0 [10136.669646] lima_sched_pipe_task_done+0x5c/0xb0 [10136.669656] lima_gp_irq_handler+0xa8/0x120 [10136.669666] __handle_irq_event_percpu+0x48/0x160 [10136.669679] handle_irq_event+0x4c/0xc0
We can prevent that race condition entirely by masking the irqs at the beginning of the timeout handler, at which point we give up on waiting for that job entirely.
The irqs will be enabled again at the next hard reset which is already done as a recovery by the timeout handler.
--- drivers/gpu/drm/lima/lima_sched.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/gpu/drm/lima/lima_sched.c +7 -0
@@ -430,6 +430,13 @@ static enum drm_gpu_sched_stat lima_sched_timedout_job(struct drm_sched_job *jobreturn DRM_GPU_SCHED_STAT_NOMINAL ; } +/* +* The task might still finish while this timeout handler runs. +* To prevent a race condition on its completion, mask all irqs +* on the running core until the next hard reset completes. +*/ + pipe->task_mask_irq (pipe); +if (!pipe->error)DRM_ERROR ("%s job timeout\n" ,lima_ip_name (ip));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/250 platform/x86: x86-android-tablets: Unregister devices in reverse order
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 3de0f2627ef849735f155c1818247f58404dddfe ]
Not all subsystems support a device getting removed while there are still consumers of the device with a reference to the device.
One example of this is the regulator subsystem. If a regulator gets unregistered while there are still drivers holding a reference a WARN() at drivers/regulator/core.c:5829 triggers, e.g.:
WARNING: CPU: 1 PID: 1587 at drivers/regulator/core.c:5829 regulator_unregister Hardware name: Intel Corp. VALLEYVIEW C0 PLATFORM/BYT-T FFD8, BIOS BLADE_21.X64.0005.R00.1504101516 FFD8_X64_R_2015_04_10_1516 04/10/2015 RIP: 0010:regulator_unregister Call Trace: <TASK> regulator_unregister devres_release_group i2c_device_remove device_release_driver_internal bus_remove_device device_del device_unregister x86_android_tablet_remove
On the Lenovo Yoga Tablet 2 series the bq24190 charger chip also provides a 5V boost converter output for powering USB devices connected to the micro USB port, the bq24190-charger driver exports this as a Vbus regulator.
On the 830 (8") and 1050 ("10") models this regulator is controlled by a platform_device and x86_android_tablet_remove() removes platform_device-s before i2c_clients so the consumer gets removed first.
But on the 1380 (13") model there is a lc824206xa micro-USB switch connected over I2C and the extcon driver for that controls the regulator. The bq24190 i2c-client *must* be registered first, because that creates the regulator with the lc824206xa listed as its consumer. If the regulator has not been registered yet the lc824206xa driver will end up getting a dummy regulator.
Since in this case both the regulator provider and consumer are I2C devices, the only way to ensure that the consumer is unregistered first is to unregister the I2C devices in reverse order of in which they were created.
For consistency and to avoid similar problems in the future change x86_android_tablet_remove() to unregister all device types in reverse order.
--- drivers/platform/x86/x86-android-tablets/core.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/platform/x86/x86-android-tablets/core.c +4 -4
@@ -278,25 +278,25 @@ static void x86_android_tablet_remove(struct platform_device *pdev) {int i; -for (i =0 ; i < serdev_count; i++) { +for (i = serdev_count -1 ; i >=0 ; i--) {if (serdevs[i])serdev_device_remove (serdevs[i]); }kfree (serdevs); -for (i =0 ; i < pdev_count; i++) +for (i = pdev_count -1 ; i >=0 ; i--)platform_device_unregister (pdevs[i]);kfree (pdevs);kfree (buttons); -for (i =0 ; i < spi_dev_count; i++) +for (i = spi_dev_count -1 ; i >=0 ; i--)spi_unregister_device (spi_devs[i]);kfree (spi_devs); -for (i =0 ; i < i2c_client_count; i++) +for (i = i2c_client_count -1 ; i >=0 ; i--)i2c_unregister_device (i2c_clients[i]);kfree (i2c_clients);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/250 platform/x86: x86-android-tablets: Add Lenovo Yoga Tablet 2 Pro 1380F/L data
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 3eee73ad42c3899d97e073bf2c41e7670a3c575c ]
The Lenovo Yoga Tablet 2 Pro 1380F/L is a x86 ACPI tablet which ships with Android x86 as factory OS. Its DSDT contains a bunch of I2C devices which are not actually there, causing various resource conflicts. Enumeration of these is skipped through the acpi_quirk_skip_i2c_client_enumeration().
Add support for manually instantiating the I2C + other devices which are actually present on this tablet by adding the necessary device info to the x86-android-tablets module.
--- .../platform/x86/x86-android-tablets/dmi.c | 18 ++ .../platform/x86/x86-android-tablets/lenovo.c | 216 ++++++++++++++++++ .../x86-android-tablets/x86-android-tablets.h | 1 + 3 files changed, 235 insertions(+)
drivers/platform/x86/x86-android-tablets/dmi.c +18 -0
@@ -104,6 +104,24 @@ const struct dmi_system_id x86_android_tablet_ids[] __initconst = { }, .driver_data = (void *)&lenovo_yogabook_x91_info, }, + { +/* +* Lenovo Yoga Tablet 2 Pro 1380F/L (13") This has more or less +* the same BIOS as the 830F/L or 1050F/L (8" and 10") below, +* but unlike the 8" / 10" models which share the same mainboard +* this model has a different mainboard. +* This match for the 13" model MUST come before the 8" + 10" +* match since that one will also match the 13" model! +*/ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Intel Corp." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"VALLEYVIEW C0 PLATFORM" ), +DMI_MATCH (DMI_BOARD_NAME ,"BYT-T FFD8" ), +/* Full match so as to NOT match the 830/1050 BIOS */ + DMI_MATCH(DMI_BIOS_VERSION, "BLADE_21.X64.0005.R00.1504101516"), + }, + .driver_data = (void *)&lenovo_yoga_tab2_1380_info, + }, {/* * Lenovo Yoga Tablet 2 830F/L or 1050F/L (The 8" and 10"
drivers/platform/x86/x86-android-tablets/lenovo.c +216 -0
228 lines not on this page · raw message
drivers/platform/x86/x86-android-tablets/x86-android-tablets.h +1 -0
@@ -112,6 +112,7 @@ extern const struct x86_dev_info czc_p10t;extern const struct x86_dev_info lenovo_yogabook_x90_info;extern const struct x86_dev_info lenovo_yogabook_x91_info;extern const struct x86_dev_info lenovo_yoga_tab2_830_1050_info; +extern const struct x86_dev_info lenovo_yoga_tab2_1380_info;extern const struct x86_dev_info lenovo_yt3_info;extern const struct x86_dev_info medion_lifetab_s10346_info;extern const struct x86_dev_info nextbook_ares8_info;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/250 ALSA: hda/realtek: Add quirks for HP Omen models using CS35L41
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Binding <[email protected]>
[ Upstream commit 875e0cd59758a3d636ce94936287787514305095 ]
Add 4 laptops using CS35L41 HDA.
None of these laptops have _DSD, so require entries in property configuration table for cs35l41_hda driver.
Message-ID: <[email protected]>
--- sound/pci/hda/patch_realtek.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/pci/hda/patch_realtek.c +4 -0
@@ -10147,6 +10147,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x8b92 ,"HP" ,ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8b96 ,"HP" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ),SND_PCI_QUIRK (0x103c ,0x8b97 ,"HP" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ), +SND_PCI_QUIRK (0x103c ,0x8bb3 ,"HP Slim OMEN" ,ALC287_FIXUP_CS35L41_I2C_2 ), +SND_PCI_QUIRK (0x103c ,0x8bb4 ,"HP Slim OMEN" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x103c ,0x8bdd ,"HP Envy 17" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x103c ,0x8bde ,"HP Envy 17" ,ALC287_FIXUP_CS35L41_I2C_2 ), SND_PCI_QUIRK(0x103c, 0x8bdf, "HP Envy 15", ALC287_FIXUP_CS35L41_I2C_2),
@@ -10167,6 +10169,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x8c47 ,"HP EliteBook 840 G11" ,ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8c48 ,"HP EliteBook 860 G11" ,ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8c49 ,"HP Elite x360 830 2-in-1 G11" ,ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED ), +SND_PCI_QUIRK (0x103c ,0x8c4d ,"HP Omen" ,ALC287_FIXUP_CS35L41_I2C_2 ), +SND_PCI_QUIRK (0x103c ,0x8c4e ,"HP Omen" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x103c ,0x8c4f ,"HP Envy 15" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x103c ,0x8c50 ,"HP Envy 17" ,ALC287_FIXUP_CS35L41_I2C_2 ), SND_PCI_QUIRK(0x103c, 0x8c51, "HP Envy 17", ALC287_FIXUP_CS35L41_I2C_2),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/250 ALSA: hda/realtek: Add quirks for Lenovo 13X
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Binding <[email protected]>
[ Upstream commit 25f46354dca912c84f1f79468fd636a94b8d287a ]
Add laptop using CS35L41 HDA.
This laptop does not have _DSD, so require entries in property configuration table for cs35l41_hda driver.
Message-ID: <[email protected]>
--- sound/pci/hda/patch_realtek.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/patch_realtek.c +2 -0
@@ -10501,6 +10501,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x17aa ,0x3852 ,"Lenovo Yoga 7 14ITL5" ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ),SND_PCI_QUIRK (0x17aa ,0x3853 ,"Lenovo Yoga 7 15ITL5" ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ),SND_PCI_QUIRK (0x17aa ,0x3855 ,"Legion 7 16ITHG6" ,ALC287_FIXUP_LEGION_16ITHG6 ), +SND_PCI_QUIRK (0x17aa ,0x3865 ,"Lenovo 13X" ,ALC287_FIXUP_CS35L41_I2C_2 ), +SND_PCI_QUIRK (0x17aa ,0x3866 ,"Lenovo 13X" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x17aa ,0x3869 ,"Lenovo Yoga7 14IAL7" ,ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN ),SND_PCI_QUIRK (0x17aa ,0x386f ,"Legion Pro 7/7i" ,ALC287_FIXUP_LENOVO_LEGION_7 ), SND_PCI_QUIRK(0x17aa, 0x3870, "Lenovo Yoga 7 14ARB7", ALC287_FIXUP_YOGA7_14ARB7_I2C),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/250 powerpc/pseries: Enforce hcall result buffer validity and size
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Lynch <[email protected]>
[ Upstream commit ff2e185cf73df480ec69675936c4ee75a445c3e4 ]
plpar_hcall(), plpar_hcall9(), and related functions expect callers to provide valid result buffers of certain minimum size. Currently this is communicated only through comments in the code and the compiler has no idea.
For example, if I write a bug like this:
long retbuf[PLPAR_HCALL_BUFSIZE]; // should be PLPAR_HCALL9_BUFSIZE plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf, ...);
This compiles with no diagnostics emitted, but likely results in stack corruption at runtime when plpar_hcall9() stores results past the end of the array. (To be clear this is a contrived example and I have not found a real instance yet.)
To make this class of error less likely, we can use explicitly-sized array parameters instead of pointers in the declarations for the hcall APIs. When compiled with -Warray-bounds[1], the code above now provokes a diagnostic like this:
error: array argument is too small;
is of size 32, callee requires at least 72 [-Werror,-Warray-bounds]
60 | plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf,
| ^ ~~~~~~[1] Enabled for LLVM builds but not GCC for now. See commit
0da6e5fd6c37 ("gcc: disable '-Warray-bounds' for gcc-13 too") and
related changes.--- arch/powerpc/include/asm/hvcall.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/powerpc/include/asm/hvcall.h +4 -4
@@ -524,7 +524,7 @@ long plpar_hcall_norets_notrace(unsigned long opcode, ...);* Used for all but the craziest of phyp interfaces (see plpar_hcall9) */ #define PLPAR_HCALL_BUFSIZE 4 -long plpar_hcall (unsigned long opcode,unsigned long *retbuf, ...); +long plpar_hcall (unsigned long opcode,unsigned long retbuf[static PLPAR_HCALL_BUFSIZE ], ...);/** * plpar_hcall_raw: - Make a hypervisor call without calculating hcall stats
@@ -538,7 +538,7 @@ long plpar_hcall(unsigned long opcode, unsigned long *retbuf, ...);* plpar_hcall, but plpar_hcall_raw works in real mode and does not * calculate hypervisor call statistics. */ -long plpar_hcall_raw (unsigned long opcode,unsigned long *retbuf, ...); +long plpar_hcall_raw (unsigned long opcode,unsigned long retbuf[static PLPAR_HCALL_BUFSIZE ], ...);/** * plpar_hcall9: - Make a pseries hypervisor call with up to 9 return arguments
@@ -549,8 +549,8 @@ long plpar_hcall_raw(unsigned long opcode, unsigned long *retbuf, ...);* PLPAR_HCALL9_BUFSIZE to size the return argument buffer. */ #define PLPAR_HCALL9_BUFSIZE 9 -long plpar_hcall9 (unsigned long opcode,unsigned long *retbuf, ...); -long plpar_hcall9_raw (unsigned long opcode,unsigned long *retbuf, ...); +long plpar_hcall9 (unsigned long opcode,unsigned long retbuf[static PLPAR_HCALL9_BUFSIZE ], ...); +long plpar_hcall9_raw (unsigned long opcode,unsigned long retbuf[static PLPAR_HCALL9_BUFSIZE ], ...);/* pseries hcall tracing */ extern struct static_key hcall_tracepoint_key;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/250 media: intel/ipu6: Fix build with !ACPI
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 8810e055b57543f3465cf3c15ba4980f9f14a84e ]
Modify the code so it can be compiled tested in configurations that do not have ACPI enabled.
It fixes the following errors:drivers/media/pci/intel/ipu-bridge.c:103:30: error: implicit declaration of function ‘acpi_device_handle’; did you mean ‘acpi_fwnode_handle’? [-Werror=implicit-function-declaration] drivers/media/pci/intel/ipu-bridge.c:103:30: warning: initialization of ‘acpi_handle’ {aka ‘void *’} from ‘int’ makes pointer from integer without a cast [-Wint-conversion] drivers/media/pci/intel/ipu-bridge.c:110:17: error: implicit declaration of function ‘for_each_acpi_dev_match’ [-Werror=implicit-function-declaration] drivers/media/pci/intel/ipu-bridge.c:110:74: error: expected ‘;’ before ‘for_each_acpi_consumer_dev’drivers/media/pci/intel/ipu-bridge.c:104:29: warning: unused variable ‘consumer’ [-Wunused-variable]drivers/media/pci/intel/ipu-bridge.c:103:21: warning: unused variable ‘handle’ [-Wunused-variable]drivers/media/pci/intel/ipu-bridge.c:166:38: error: invalid use of undefined type ‘struct acpi_device’drivers/media/pci/intel/ipu-bridge.c:185:43: error: invalid use of undefined type ‘struct acpi_device’drivers/media/pci/intel/ipu-bridge.c:191:30: error: invalid use of undefined type ‘struct acpi_device’drivers/media/pci/intel/ipu-bridge.c:196:30: error: invalid use of undefined type ‘struct acpi_device’drivers/media/pci/intel/ipu-bridge.c:202:30: error: invalid use of undefined type ‘struct acpi_device’drivers/media/pci/intel/ipu-bridge.c:223:31: error: invalid use of undefined type ‘struct acpi_device’drivers/media/pci/intel/ipu-bridge.c:236:18: error: implicit declaration of function ‘acpi_get_physical_device_location’ [-Werror=implicit-function-declaration] drivers/media/pci/intel/ipu-bridge.c:236:56: error: invalid use of undefined type ‘struct acpi_device’drivers/media/pci/intel/ipu-bridge.c:238:31: error: invalid use of undefined type ‘struct acpi_device’drivers/media/pci/intel/ipu-bridge.c:256:31: error: invalid use of undefined type ‘struct acpi_device’drivers/media/pci/intel/ipu-bridge.c:275:31: error: invalid use of undefined type ‘struct acpi_device’drivers/media/pci/intel/ipu-bridge.c:280:30: error: invalid use of undefined type ‘struct acpi_device’drivers/media/pci/intel/ipu-bridge.c:469:26: error: implicit declaration of function ‘acpi_device_hid’; did you mean ‘dmi_device_id’? [-Werror=implicit-function-declaration] drivers/media/pci/intel/ipu-bridge.c:468:74: warning: format ‘%s’ expects argument of type ‘char *’, but argument 4 has type ‘int’ [-Wformat=] drivers/media/pci/intel/ipu-bridge.c:637:58: error: expected ‘;’ before ‘{’ tokendrivers/media/pci/intel/ipu-bridge.c:696:1: warning: label ‘err_put_adev’ defined but not used [-Wunused-label] drivers/media/pci/intel/ipu-bridge.c:693:1: warning: label ‘err_put_ivsc’ defined but not used [-Wunused-label] drivers/media/pci/intel/ipu-bridge.c:691:1: warning: label ‘err_free_swnodes’ defined but not used [-Wunused-label] drivers/media/pci/intel/ipu-bridge.c:632:40: warning: unused variable ‘primary’ [-Wunused-variable]drivers/media/pci/intel/ipu-bridge.c:632:31: warning: unused variable ‘fwnode’ [-Wunused-variable]drivers/media/pci/intel/ipu-bridge.c:733:73: error: expected ‘;’ before ‘{’ tokendrivers/media/pci/intel/ipu-bridge.c:725:24: warning: unused variable ‘csi_dev’ [-Wunused-variable]drivers/media/pci/intel/ipu-bridge.c:724:43: warning: unused variable ‘adev’ [-Wunused-variable]drivers/media/pci/intel/ipu-bridge.c:599:12: warning: ‘ipu_bridge_instantiate_ivsc’ defined but not used [-Wunused-function] drivers/media/pci/intel/ipu-bridge.c:444:13: warning: ‘ipu_bridge_create_connection_swnodes’ defined but not used [-Wunused-function] drivers/media/pci/intel/ipu-bridge.c:297:13: warning: ‘ipu_bridge_create_fwnode_properties’ defined but not used [-Wunused-function] drivers/media/pci/intel/ipu-bridge.c:155:12: warning: ‘ipu_bridge_check_ivsc_dev’ defined but not used [-Wunused-function]
--- drivers/media/pci/intel/ipu-bridge.c | 66 ++++++++++++++++++++-------- 1 file changed, 47 insertions(+), 19 deletions(-)
drivers/media/pci/intel/ipu-bridge.c +47 -19
@@ -15,6 +15,8 @@#include <media/ipu-bridge.h> #include <media/v4l2-fwnode.h> +#define ADEV_DEV (adev) ACPI_PTR(&((adev)->dev)) +/* * 92335fcf-3203-4472-af93-7b4453ac29da *
@@ -87,6 +89,7 @@ static const char * const ipu_vcm_types[] = { "lc898212axb", }; +#if IS_ENABLED (CONFIG_ACPI )/* * Used to figure out IVSC acpi device by ipu_bridge_get_ivsc_acpi_dev() * instead of device and driver match to probe IVSC device.
@@ -100,13 +103,13 @@ static const struct acpi_device_id ivsc_acpi_ids[] = {static struct acpi_device *ipu_bridge_get_ivsc_acpi_dev (struct acpi_device *adev) { -acpi_handle handle =acpi_device_handle (adev); -struct acpi_device *consumer, *ivsc_adev;unsigned int i;for (i =0 ; i <ARRAY_SIZE (ivsc_acpi_ids); i++) {const struct acpi_device_id *acpi_id = &ivsc_acpi_ids[i]; +struct acpi_device *consumer, *ivsc_adev; +acpi_handle handle =acpi_device_handle (adev);for_each_acpi_dev_match (ivsc_adev, acpi_id->id,NULL ,-1 )/* camera sensor depends on IVSC in DSDT if exist */ for_each_acpi_consumer_dev (ivsc_adev, consumer)
@@ -118,6 +121,12 @@ static struct acpi_device *ipu_bridge_get_ivsc_acpi_dev(struct acpi_device *adev return NULL; } +#else +static struct acpi_device *ipu_bridge_get_ivsc_acpi_dev (struct acpi_device *adev) +{ +return NULL ; +} +#endif static int ipu_bridge_match_ivsc_dev (struct device *dev,const void *adev) {
@@ -163,7 +172,7 @@ static int ipu_bridge_check_ivsc_dev(struct ipu_sensor *sensor, csi_dev =ipu_bridge_get_ivsc_csi_dev (adev);if (!csi_dev) {acpi_dev_put (adev); -dev_err (&adev->dev,"Failed to find MEI CSI dev\n" ); +dev_err (ADEV_DEV (adev),"Failed to find MEI CSI dev\n" );return -ENODEV ; }
@@ -182,24 +191,25 @@ static int ipu_bridge_read_acpi_buffer(struct acpi_device *adev, char *id,acpi_status status;int ret =0 ; - status =acpi_evaluate_object (adev->handle, id,NULL , &buffer); + status =acpi_evaluate_object (ACPI_PTR (adev->handle), + id,NULL , &buffer);if (ACPI_FAILURE (status))return -ENODEV ; obj = buffer.pointer;if (!obj) { -dev_err (&adev->dev,"Couldn't locate ACPI buffer\n" ); +dev_err (ADEV_DEV (adev),"Couldn't locate ACPI buffer\n" );return -ENODEV ; }if (obj->type !=ACPI_TYPE_BUFFER ) { -dev_err (&adev->dev,"Not an ACPI buffer\n" ); +dev_err (ADEV_DEV (adev),"Not an ACPI buffer\n" ); ret = -ENODEV ; goto out_free_buff; }if (obj->buffer.length > size) { -dev_err (&adev->dev,"Given buffer is too small\n" ); +dev_err (ADEV_DEV (adev),"Given buffer is too small\n" ); ret = -EINVAL ; goto out_free_buff; }
@@ -220,7 +230,7 @@ static u32 ipu_bridge_parse_rotation(struct acpi_device *adev,case IPU_SENSOR_ROTATION_INVERTED :return 180 ;default : -dev_warn (&adev->dev, +dev_warn (ADEV_DEV (adev),"Unknown rotation %d. Assume 0 degree rotation\n" , ssdb->degree);return 0 ;
@@ -230,12 +240,14 @@ static u32 ipu_bridge_parse_rotation(struct acpi_device *adev,static enum v4l2_fwnode_orientation ipu_bridge_parse_orientation (struct acpi_device *adev) {enum v4l2_fwnode_orientation orientation; -struct acpi_pld_info *pld; -acpi_status status; +struct acpi_pld_info *pld =NULL ; +acpi_status status =AE_ERROR ; +#if IS_ENABLED (CONFIG_ACPI ) status =acpi_get_physical_device_location (adev->handle, &pld); +#endif if (ACPI_FAILURE (status)) { -dev_warn (&adev->dev,"_PLD call failed, using default orientation\n" ); +dev_warn (ADEV_DEV (adev),"_PLD call failed, using default orientation\n" );return V4L2_FWNODE_ORIENTATION_EXTERNAL ; }
@@ -253,7 +265,8 @@ static enum v4l2_fwnode_orientation ipu_bridge_parse_orientation(struct acpi_dev orientation =V4L2_FWNODE_ORIENTATION_EXTERNAL ;break ;default : -dev_warn (&adev->dev,"Unknown _PLD panel val %d\n" , pld->panel); +dev_warn (ADEV_DEV (adev),"Unknown _PLD panel val %d\n" , + pld->panel); orientation =V4L2_FWNODE_ORIENTATION_EXTERNAL ;break ; }
@@ -272,12 +285,12 @@ int ipu_bridge_parse_ssdb(struct acpi_device *adev, struct ipu_sensor *sensor)return ret;if (ssdb.vcmtype >ARRAY_SIZE (ipu_vcm_types)) { -dev_warn (&adev->dev,"Unknown VCM type %d\n" , ssdb.vcmtype); +dev_warn (ADEV_DEV (adev),"Unknown VCM type %d\n" , ssdb.vcmtype); ssdb.vcmtype =0 ; }if (ssdb.lanes >IPU_MAX_LANES ) { -dev_err (&adev->dev,"Number of lanes in SSDB is invalid\n" ); +dev_err (ADEV_DEV (adev),"Number of lanes in SSDB is invalid\n" );return -EINVAL ; }
@@ -465,8 +478,14 @@ static void ipu_bridge_create_connection_swnodes(struct ipu_bridge *bridge, sensor->ipu_properties);if (sensor->csi_dev) { +const char *device_hid ="" ; + +#if IS_ENABLED (CONFIG_ACPI ) + device_hid =acpi_device_hid (sensor->ivsc_adev); +#endif +snprintf (sensor->ivsc_name,sizeof (sensor->ivsc_name),"%s-%u" , -acpi_device_hid (sensor->ivsc_adev), sensor->link); + device_hid, sensor->link); nodes[SWNODE_IVSC_HID ] =NODE_SENSOR (sensor->ivsc_name, sensor->ivsc_properties);
@@ -631,11 +650,15 @@ static int ipu_bridge_connect_sensor(const struct ipu_sensor_config *cfg, {struct fwnode_handle *fwnode, *primary;struct ipu_sensor *sensor; -struct acpi_device *adev; +struct acpi_device *adev =NULL ;int ret; +#if IS_ENABLED (CONFIG_ACPI )for_each_acpi_dev_match (adev, cfg->hid,NULL ,-1 ) { -if (!adev->status.enabled) +#else +while (true) { +#endif +if (!ACPI_PTR (adev->status.enabled))continue ;if (bridge->n_sensors >=IPU_MAX_PORTS ) {
@@ -671,7 +694,7 @@ static int ipu_bridge_connect_sensor(const struct ipu_sensor_config *cfg, goto err_free_swnodes; } - sensor->adev =acpi_dev_get (adev); + sensor->adev =ACPI_PTR (acpi_dev_get (adev)); primary =acpi_fwnode_handle (adev); primary->secondary = fwnode;
@@ -727,11 +750,16 @@ static int ipu_bridge_ivsc_is_ready(void)unsigned int i;for (i =0 ; i <ARRAY_SIZE (ipu_supported_sensors); i++) { +#if IS_ENABLED (CONFIG_ACPI )const struct ipu_sensor_config *cfg = &ipu_supported_sensors[i];for_each_acpi_dev_match (sensor_adev, cfg->hid,NULL ,-1 ) { -if (!sensor_adev->status.enabled) +#else +while (true) { + sensor_adev =NULL ; +#endif +if (!ACPI_PTR (sensor_adev->status.enabled))continue ; adev =ipu_bridge_get_ivsc_acpi_dev (sensor_adev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/250 media: mtk-vcodec: potential null pointer deference in SCP
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fullway Wang <[email protected]>
[ Upstream commit 53dbe08504442dc7ba4865c09b3bbf5fe849681b ]
The return value of devm_kzalloc() needs to be checked to avoid NULL pointer deference. This is similar to CVE-2022-3113.
--- .../media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c +2 -0
@@ -79,6 +79,8 @@ struct mtk_vcodec_fw *mtk_vcodec_fw_scp_init(void *priv, enum mtk_vcodec_fw_use } fw =devm_kzalloc (&plat_dev->dev,sizeof (*fw),GFP_KERNEL ); +if (!fw) +return ERR_PTR (-ENOMEM ); fw->type =SCP ; fw->ops = &mtk_vcodec_rproc_msg; fw->scp = scp;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/250 powerpc/io: Avoid clang null pointer arithmetic warnings
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit 03c0f2c2b2220fc9cf8785cd7b61d3e71e24a366 ]
With -Wextra clang warns about pointer arithmetic using a null pointer. When building with CONFIG_PCI=n, that triggers a warning in the IO accessors, eg:
In file included from linux/arch/powerpc/include/asm/io.h:672:
linux/arch/powerpc/include/asm/io-defs.h:23:1: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
23 | DEF_PCI_AC_RET(inb, u8, (unsigned long port), (port), pio, port)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
...
linux/arch/powerpc/include/asm/io.h:591:53: note: expanded from macro '__do_inb'
591 | #define __do_inb(port) readb((PCI_IO_ADDR)_IO_BASE + port);
| ~~~~~~~~~~~~~~~~~~~~~ ^That is because when CONFIG_PCI=n, _IO_BASE is defined as 0.
Although _IO_BASE is defined as plain 0, the cast (PCI_IO_ADDR) converts it to void * before the addition with port happens.
Instead the addition can be done first, and then the cast. The resulting value will be the same, but avoids the warning, and also avoids void pointer arithmetic which is apparently non-standard.
--- arch/powerpc/include/asm/io.h | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
arch/powerpc/include/asm/io.h +12 -12
@@ -585,12 +585,12 @@ __do_out_asm(_rec_outl, "stwbrx")#define __do_inw (port) _rec_inw(port)#define __do_inl (port) _rec_inl(port)#else /* CONFIG_PPC32 */ -#define __do_outb (val, port) writeb(val,(PCI_IO_ADDR)_IO_BASE+port); -#define __do_outw (val, port) writew(val,(PCI_IO_ADDR)_IO_BASE+port); -#define __do_outl (val, port) writel(val,(PCI_IO_ADDR)_IO_BASE+port); -#define __do_inb (port) readb((PCI_IO_ADDR)_IO_BASE + port); -#define __do_inw (port) readw((PCI_IO_ADDR)_IO_BASE + port); -#define __do_inl (port) readl((PCI_IO_ADDR)_IO_BASE + port); +#define __do_outb (val, port) writeb(val,(PCI_IO_ADDR)(_IO_BASE+port)); +#define __do_outw (val, port) writew(val,(PCI_IO_ADDR)(_IO_BASE+port)); +#define __do_outl (val, port) writel(val,(PCI_IO_ADDR)(_IO_BASE+port)); +#define __do_inb (port) readb((PCI_IO_ADDR)(_IO_BASE + port)); +#define __do_inw (port) readw((PCI_IO_ADDR)(_IO_BASE + port)); +#define __do_inl (port) readl((PCI_IO_ADDR)(_IO_BASE + port));#endif /* !CONFIG_PPC32 */ #ifdef CONFIG_EEH
@@ -606,12 +606,12 @@ __do_out_asm(_rec_outl, "stwbrx")#define __do_writesw (a, b, n) _outsw(PCI_FIX_ADDR(a),(b),(n))#define __do_writesl (a, b, n) _outsl(PCI_FIX_ADDR(a),(b),(n)) -#define __do_insb (p, b, n) readsb((PCI_IO_ADDR)_IO_BASE+(p), (b), (n)) -#define __do_insw (p, b, n) readsw((PCI_IO_ADDR)_IO_BASE+(p), (b), (n)) -#define __do_insl (p, b, n) readsl((PCI_IO_ADDR)_IO_BASE+(p), (b), (n)) -#define __do_outsb (p, b, n) writesb((PCI_IO_ADDR)_IO_BASE+(p),(b),(n)) -#define __do_outsw (p, b, n) writesw((PCI_IO_ADDR)_IO_BASE+(p),(b),(n)) -#define __do_outsl (p, b, n) writesl((PCI_IO_ADDR)_IO_BASE+(p),(b),(n)) +#define __do_insb (p, b, n) readsb((PCI_IO_ADDR)(_IO_BASE+(p)), (b), (n)) +#define __do_insw (p, b, n) readsw((PCI_IO_ADDR)(_IO_BASE+(p)), (b), (n)) +#define __do_insl (p, b, n) readsl((PCI_IO_ADDR)(_IO_BASE+(p)), (b), (n)) +#define __do_outsb (p, b, n) writesb((PCI_IO_ADDR)(_IO_BASE+(p)),(b),(n)) +#define __do_outsw (p, b, n) writesw((PCI_IO_ADDR)(_IO_BASE+(p)),(b),(n)) +#define __do_outsl (p, b, n) writesl((PCI_IO_ADDR)(_IO_BASE+(p)),(b),(n))#define __do_memset_io (addr, c, n) \ _memset_io(PCI_FIX_ADDR(addr), c, n)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/250 platform/x86: p2sb: Dont init until unassigned resources have been assigned
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Fradella <[email protected]>
[ Upstream commit 2c6370e6607663fc5fa0fd9ed58e2e01014898c7 ]
The P2SB could get an invalid BAR from the BIOS, and that won't be fixed up until pcibios_assign_resources(), which is an fs_initcall().
- Move p2sb_fs_init() to an fs_initcall_sync(). This is still early enough to avoid a race with any dependent drivers.
- Add a check for IORESOURCE_UNSET in p2sb_valid_resource() to catch unset BARs going forward.
- Return error values from p2sb_fs_init() so that the 'initcall_debug' cmdline arg provides useful data.
--- drivers/platform/x86/p2sb.c | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-)
drivers/platform/x86/p2sb.c +15 -14
@@ -56,12 +56,9 @@ static int p2sb_get_devfn(unsigned int *devfn)return 0 ; } -static bool p2sb_valid_resource (struct resource *res) +static bool p2sb_valid_resource (const struct resource *res) { -if (res->flags) -return true; - -return false; +return res->flags & ~IORESOURCE_UNSET ; }/* Copy resource from the first BAR of the device in question */
@@ -220,16 +217,20 @@ EXPORT_SYMBOL_GPL(p2sb_bar);static int __init p2sb_fs_init (void ) { -p2sb_cache_resources (); -return 0 ; +return p2sb_cache_resources (); }/* -* pci_rescan_remove_lock to avoid access to unhidden P2SB devices can -* not be locked in sysfs pci bus rescan path because of deadlock. To -* avoid the deadlock, access to P2SB devices with the lock at an early -* step in kernel initialization and cache required resources. This -* should happen after subsys_initcall which initializes PCI subsystem -* and before device_initcall which requires P2SB resources. +* pci_rescan_remove_lock() can not be locked in sysfs PCI bus rescan path +* because of deadlock. To avoid the deadlock, access P2SB devices with the lock +* at an early step in kernel initialization and cache required resources. +* +* We want to run as early as possible. If the P2SB was assigned a bad BAR, +* we'll need to wait on pcibios_assign_resources() to fix it. So, our list of +* initcall dependencies looks something like this: +* +* ... +* subsys_initcall (pci_subsys_init) +* fs_initcall (pcibios_assign_resources) */ -fs_initcall (p2sb_fs_init); +fs_initcall_sync (p2sb_fs_init);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/250 power: supply: cros_usbpd: provide ID table for avoiding fallback match
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <[email protected]>
[ Upstream commit 0f8678c34cbfdc63569a9b0ede1fe235ec6ec693 ]
Instead of using fallback driver name match, provide ID table[1] for the primary match.
[1]: https://elixir.bootlin.com/linux/v6.8/source/drivers/base/platform.c#L1353
--- drivers/power/supply/cros_usbpd-charger.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/power/supply/cros_usbpd-charger.c +9 -2
@@ -5,6 +5,7 @@* Copyright (c) 2014 - 2018 Google, Inc */ +#include <linux/mod_devicetable.h> #include <linux/module.h> #include <linux/platform_data/cros_ec_commands.h> #include <linux/platform_data/cros_ec_proto.h>
@@ -711,16 +712,22 @@ static int cros_usbpd_charger_resume(struct device *dev) static SIMPLE_DEV_PM_OPS(cros_usbpd_charger_pm_ops, NULL, cros_usbpd_charger_resume); +static const struct platform_device_id cros_usbpd_charger_id[] = { + {DRV_NAME ,0 }, + {} +}; +MODULE_DEVICE_TABLE (platform, cros_usbpd_charger_id); +static struct platform_driver cros_usbpd_charger_driver = { .driver = { .name =DRV_NAME , .pm = &cros_usbpd_charger_pm_ops, }, - .probe = cros_usbpd_charger_probe + .probe = cros_usbpd_charger_probe, + .id_table = cros_usbpd_charger_id, };module_platform_driver (cros_usbpd_charger_driver);MODULE_LICENSE ("GPL" );MODULE_DESCRIPTION ("ChromeOS EC USBPD charger" ); -MODULE_ALIAS ("platform:" DRV_NAME );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/250 iommu/arm-smmu-v3: Free MSIs in case of ENOMEM
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Aprelkov <[email protected]>
[ Upstream commit 80fea979dd9d48d67c5b48d2f690c5da3e543ebd ]
If devm_add_action() returns -ENOMEM, then MSIs are allocated but not not freed on teardown. Use devm_add_action_or_reset() instead to keep the static analyser happy.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +1 -1
@@ -3402,7 +3402,7 @@ static void arm_smmu_setup_msis(struct arm_smmu_device *smmu) smmu->priq.q.irq =msi_get_virq (dev,PRIQ_MSI_INDEX );/* Add callback to free MSIs on teardown */ -devm_add_action (dev, arm_smmu_free_msis, dev); +devm_add_action_or_reset (dev, arm_smmu_free_msis, dev); }static void arm_smmu_setup_unique_irqs (struct arm_smmu_device *smmu)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/250 ext4: do not create EA inode under buffer lock
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 0a46ef234756dca04623b7591e8ebb3440622f0b ]
ext4_xattr_set_entry() creates new EA inodes while holding buffer lock on the external xattr block. This is problematic as it nests all the allocation locking (which acquires locks on other buffers) under the buffer lock. This can even deadlock when the filesystem is corrupted and e.g. quota file is setup to contain xattr block as data block. Move the allocation of EA inode out of ext4_xattr_set_entry() into the callers.
--- fs/ext4/xattr.c | 113 +++++++++++++++++++++++------------------------- 1 file changed, 53 insertions(+), 60 deletions(-)
fs/ext4/xattr.c +53 -60
@@ -1619,6 +1619,7 @@ static struct inode *ext4_xattr_inode_lookup_create(handle_t *handle,static int ext4_xattr_set_entry (struct ext4_xattr_info *i,struct ext4_xattr_search *s,handle_t *handle,struct inode *inode, +struct inode *new_ea_inode,bool is_block) {struct ext4_xattr_entry *last, *next;
@@ -1626,7 +1627,6 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i,size_t min_offs = s->end - s->base, name_len =strlen (i->name);int in_inode = i->in_inode;struct inode *old_ea_inode =NULL ; -struct inode *new_ea_inode =NULL ;size_t old_size, new_size;int ret;
@@ -1711,38 +1711,11 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i, old_ea_inode =NULL ; goto out; } - } -if (i->value && in_inode) { -WARN_ON_ONCE (!i->value_len); - - new_ea_inode =ext4_xattr_inode_lookup_create (handle, inode, - i->value, i->value_len); -if (IS_ERR (new_ea_inode)) { - ret =PTR_ERR (new_ea_inode); - new_ea_inode =NULL ; - goto out; - } - } -if (old_ea_inode) {/* We are ready to release ref count on the old_ea_inode. */ ret =ext4_xattr_inode_dec_ref (handle, old_ea_inode); -if (ret) { -/* Release newly required ref count on new_ea_inode. */ -if (new_ea_inode) { -int err; - - err =ext4_xattr_inode_dec_ref (handle, - new_ea_inode); -if (err) -ext4_warning_inode (new_ea_inode, -"dec ref new_ea_inode err=%d" , - err); -ext4_xattr_inode_free_quota (inode, new_ea_inode, - i->value_len); - } +if (ret) goto out; - }ext4_xattr_inode_free_quota (inode, old_ea_inode,le32_to_cpu (here->e_value_size));
@@ -1866,7 +1839,6 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i, ret =0 ; out:iput (old_ea_inode); -iput (new_ea_inode);return ret; }
@@ -1929,9 +1901,21 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,size_t old_ea_inode_quota =0 ;unsigned int ea_ino; -#define header (x) ((struct ext4_xattr_header *)(x)) +/* If we need EA inode, prepare it before locking the buffer */ +if (i->value && i->in_inode) { +WARN_ON_ONCE (!i->value_len); + + ea_inode =ext4_xattr_inode_lookup_create (handle, inode, + i->value, i->value_len); +if (IS_ERR (ea_inode)) { + error =PTR_ERR (ea_inode); + ea_inode =NULL ; + goto cleanup; + } + } +if (s->base) {int offset = (char *)s->here - bs->bh->b_data;
@@ -1940,6 +1924,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode, EXT4_JTR_NONE);if (error) goto cleanup; +lock_buffer (bs->bh);if (header (s->base)->h_refcount ==cpu_to_le32 (1 )) {
@@ -1966,7 +1951,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode, }ea_bdebug (bs->bh,"modifying in-place" ); error =ext4_xattr_set_entry (i, s, handle, inode, - true/* is_block */ ); + ea_inode, true/* is_block */ );ext4_xattr_block_csum_set (inode, bs->bh);unlock_buffer (bs->bh);if (error == -EFSCORRUPTED )
@@ -2034,29 +2019,13 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode, s->end = s->base + sb->s_blocksize; } - error =ext4_xattr_set_entry (i, s, handle, inode, true/* is_block */ ); + error =ext4_xattr_set_entry (i, s, handle, inode, ea_inode, + true/* is_block */ );if (error == -EFSCORRUPTED ) goto bad_block;if (error) goto cleanup; -if (i->value && s->here->e_value_inum) { -/* -* A ref count on ea_inode has been taken as part of the call to -* ext4_xattr_set_entry() above. We would like to drop this -* extra ref but we have to wait until the xattr block is -* initialized and has its own ref count on the ea_inode. -*/ - ea_ino =le32_to_cpu (s->here->e_value_inum); - error =ext4_xattr_inode_iget (inode, ea_ino, -le32_to_cpu (s->here->e_hash), - &ea_inode); -if (error) { - ea_inode =NULL ; - goto cleanup; - } - } - inserted:if (!IS_LAST_ENTRY (s->first)) { new_bh = ext4_xattr_block_cache_find(inode, header(s->base),
@@ -2198,17 +2167,16 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode, cleanup:if (ea_inode) { -int error2; - - error2 =ext4_xattr_inode_dec_ref (handle, ea_inode); -if (error2) -ext4_warning_inode (ea_inode,"dec ref error=%d" , - error2); +if (error) { +int error2; -/* If there was an error, revert the quota charge. */ -if (error) + error2 =ext4_xattr_inode_dec_ref (handle, ea_inode); +if (error2) +ext4_warning_inode (ea_inode,"dec ref error=%d" , + error2);ext4_xattr_inode_free_quota (inode, ea_inode,i_size_read (ea_inode)); + }iput (ea_inode); }if (ce)
@@ -2266,14 +2234,38 @@ int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode, {struct ext4_xattr_ibody_header *header;struct ext4_xattr_search *s = &is->s; +struct inode *ea_inode =NULL ;int error;if (!EXT4_INODE_HAS_XATTR_SPACE (inode))return -ENOSPC ; - error =ext4_xattr_set_entry (i, s, handle, inode, false/* is_block */ ); -if (error) +/* If we need EA inode, prepare it before locking the buffer */ +if (i->value && i->in_inode) { +WARN_ON_ONCE (!i->value_len); + + ea_inode =ext4_xattr_inode_lookup_create (handle, inode, + i->value, i->value_len); +if (IS_ERR (ea_inode)) +return PTR_ERR (ea_inode); + } + error =ext4_xattr_set_entry (i, s, handle, inode, ea_inode, + false/* is_block */ ); +if (error) { +if (ea_inode) { +int error2; + + error2 =ext4_xattr_inode_dec_ref (handle, ea_inode); +if (error2) +ext4_warning_inode (ea_inode,"dec ref error=%d" , + error2); + +ext4_xattr_inode_free_quota (inode, ea_inode, +i_size_read (ea_inode)); +iput (ea_inode); + }return error; + } header =IHDR (inode,ext4_raw_inode (&is->iloc));if (!IS_LAST_ENTRY (s->first)) { header->h_magic =cpu_to_le32 (EXT4_XATTR_MAGIC );
@@ -2282,6 +2274,7 @@ int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode, header->h_magic =cpu_to_le32 (0 );ext4_clear_inode_state (inode,EXT4_STATE_XATTR ); } +iput (ea_inode);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/250 ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit b4b4fda34e535756f9e774fb2d09c4537b7dfd1c ]
In the following concurrency we will access the uninitialized rs->lock:
ext4_fill_super
ext4_register_sysfs
// sysfs registered msg_ratelimit_interval_ms
// Other processes modify rs->interval to
// non-zero via msg_ratelimit_interval_ms
ext4_orphan_cleanup
ext4_msg(sb, KERN_INFO, "Errors on filesystem, "
__ext4_msg
___ratelimit(&(EXT4_SB(sb)->s_msg_ratelimit_state)
if (!rs->interval) // do nothing if interval is 0
return 1;
raw_spin_trylock_irqsave(&rs->lock, flags)
raw_spin_trylock(lock)
_raw_spin_trylock
__raw_spin_trylock
spin_acquire(&lock->dep_map, 0, 1, _RET_IP_)
lock_acquire
__lock_acquire
register_lock_class
assign_lock_key
dump_stack();
ratelimit_state_init(&sbi->s_msg_ratelimit_state, 5 * HZ, 10);
raw_spin_lock_init(&rs->lock);
// init rs->lock hereand get the following dump_stack:
=========================================================
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe you didn't initialize this object before use? turning off the locking correctness validator.
CPU: 12 PID: 753 Comm: mount Tainted: G E 6.7.0-rc6-next-20231222 #504 [...] Call Trace: dump_stack_lvl+0xc5/0x170 dump_stack+0x18/0x30 register_lock_class+0x740/0x7c0 __lock_acquire+0x69/0x13a0 lock_acquire+0x120/0x450 _raw_spin_trylock+0x98/0xd0 ___ratelimit+0xf6/0x220 __ext4_msg+0x7f/0x160 [ext4] ext4_orphan_cleanup+0x665/0x740 [ext4] __ext4_fill_super+0x21ea/0x2b10 [ext4] ext4_fill_super+0x14d/0x360 [ext4]
[...]
=========================================================
Normally interval is 0 until s_msg_ratelimit_state is initialized, so ___ratelimit() does nothing. But registering sysfs precedes initializing rs->lock, so it is possible to change rs->interval to a non-zero value via the msg_ratelimit_interval_ms interface of sysfs while rs->lock is uninitialized, and then a call to ext4_msg triggers the problem by accessing an uninitialized rs->lock. Therefore register sysfs after all initializations are complete to avoid such problems.
--- fs/ext4/super.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-)
fs/ext4/super.c +10 -12
@@ -5551,19 +5551,15 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)if (err) goto failed_mount6; - err =ext4_register_sysfs (sb); -if (err) - goto failed_mount7; - err =ext4_init_orphan_info (sb);if (err) - goto failed_mount8; + goto failed_mount7;#ifdef CONFIG_QUOTA /* Enable quota usage during mount. */ if (ext4_has_feature_quota (sb) && !sb_rdonly (sb)) { err =ext4_enable_quotas (sb);if (err) - goto failed_mount9; + goto failed_mount8; }#endif /* CONFIG_QUOTA */
@@ -5589,7 +5585,7 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)ext4_msg (sb,KERN_INFO ,"recovery complete" ); err =ext4_mark_recovery_complete (sb, es);if (err) - goto failed_mount10; + goto failed_mount9; }if (test_opt (sb,DISCARD ) && !bdev_max_discard_sectors (sb->s_bdev))
@@ -5606,15 +5602,17 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)atomic_set (&sbi->s_warning_count,0 );atomic_set (&sbi->s_msg_count,0 ); +/* Register sysfs after all initializations are complete. */ + err =ext4_register_sysfs (sb); +if (err) + goto failed_mount9; +return 0 ; -failed_mount10: +failed_mount9:ext4_quotas_off (sb,EXT4_MAXQUOTAS ); -failed_mount9:__maybe_unused +failed_mount8:__maybe_unused ext4_release_orphan_info (sb); -failed_mount8: -ext4_unregister_sysfs (sb); -kobject_put (&sbi->s_kobj); failed_mount7:ext4_unregister_li_request (sb); failed_mount6:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/250 kprobe/ftrace: bail out if ftrace was killed
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Brennan <[email protected]>
[ Upstream commit 1a7d0890dd4a502a202aaec792a6c04e6e049547 ]
If an error happens in ftrace, ftrace_kill() will prevent disarming kprobes. Eventually, the ftrace_ops associated with the kprobes will be freed, yet the kprobes will still be active, and when triggered, they will use the freed memory, likely resulting in a page fault and panic.
This behavior can be reproduced quite easily, by creating a kprobe and then triggering a ftrace_kill(). For simplicity, we can simulate an ftrace error with a kernel module like [1]:
[1]: https://github.com/brenns10/kernel_stuff/tree/master/ftrace_killer
sudo perf probe --add commit_creds sudo perf trace -e probe:commit_creds # In another terminal make sudo insmod ftrace_killer.ko # calls ftrace_kill(), simulating bug # Back to perf terminal # ctrl-c sudo perf probe --del commit_creds
After a short period, a page fault and panic would occur as the kprobe continues to execute and uses the freed ftrace_ops. While ftrace_kill() is supposed to be used only in extreme circumstances, it is invoked in FTRACE_WARN_ON() and so there are many places where an unexpected bug could be triggered, yet the system may continue operating, possibly without the administrator noticing. If ftrace_kill() does not panic the system, then we should do everything we can to continue operating, rather than leave a ticking time bomb.
--- arch/csky/kernel/probes/ftrace.c | 3 +++ arch/loongarch/kernel/ftrace_dyn.c | 3 +++ arch/parisc/kernel/ftrace.c | 3 +++ arch/powerpc/kernel/kprobes-ftrace.c | 3 +++ arch/riscv/kernel/probes/ftrace.c | 3 +++ arch/s390/kernel/ftrace.c | 3 +++ arch/x86/kernel/kprobes/ftrace.c | 3 +++ include/linux/kprobes.h | 7 +++++++ kernel/kprobes.c | 6 ++++++ kernel/trace/ftrace.c | 1 + 10 files changed, 35 insertions(+)
arch/csky/kernel/probes/ftrace.c +3 -0
@@ -12,6 +12,9 @@ void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip,struct kprobe_ctlblk *kcb;struct pt_regs *regs; +if (unlikely (kprobe_ftrace_disabled)) +return ; + bit =ftrace_test_recursion_trylock (ip, parent_ip);if (bit <0 )return ;
arch/loongarch/kernel/ftrace_dyn.c +3 -0
@@ -287,6 +287,9 @@ void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip,struct kprobe *p;struct kprobe_ctlblk *kcb; +if (unlikely (kprobe_ftrace_disabled)) +return ; + bit =ftrace_test_recursion_trylock (ip, parent_ip);if (bit <0 )return ;
arch/parisc/kernel/ftrace.c +3 -0
@@ -206,6 +206,9 @@ void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip,struct kprobe *p;int bit; +if (unlikely (kprobe_ftrace_disabled)) +return ; + bit =ftrace_test_recursion_trylock (ip, parent_ip);if (bit <0 )return ;
arch/powerpc/kernel/kprobes-ftrace.c +3 -0
@@ -21,6 +21,9 @@ void kprobe_ftrace_handler(unsigned long nip, unsigned long parent_nip,struct pt_regs *regs;int bit; +if (unlikely (kprobe_ftrace_disabled)) +return ; + bit =ftrace_test_recursion_trylock (nip, parent_nip);if (bit <0 )return ;
arch/riscv/kernel/probes/ftrace.c +3 -0
@@ -11,6 +11,9 @@ void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip,struct kprobe_ctlblk *kcb;int bit; +if (unlikely (kprobe_ftrace_disabled)) +return ; + bit =ftrace_test_recursion_trylock (ip, parent_ip);if (bit <0 )return ;
arch/s390/kernel/ftrace.c +3 -0
@@ -296,6 +296,9 @@ void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip,struct kprobe *p;int bit; +if (unlikely (kprobe_ftrace_disabled)) +return ; + bit =ftrace_test_recursion_trylock (ip, parent_ip);if (bit <0 )return ;
arch/x86/kernel/kprobes/ftrace.c +3 -0
@@ -21,6 +21,9 @@ void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip,struct kprobe_ctlblk *kcb;int bit; +if (unlikely (kprobe_ftrace_disabled)) +return ; + bit =ftrace_test_recursion_trylock (ip, parent_ip);if (bit <0 )return ;
include/linux/kprobes.h +7 -0
@@ -378,11 +378,15 @@ static inline void wait_for_kprobe_optimizer(void) { }extern void kprobe_ftrace_handler (unsigned long ip,unsigned long parent_ip,struct ftrace_ops *ops,struct ftrace_regs *fregs);extern int arch_prepare_kprobe_ftrace (struct kprobe *p); +/* Set when ftrace has been killed: kprobes on ftrace must be disabled for safety */ +extern bool kprobe_ftrace_disabled__read_mostly ; +extern void kprobe_ftrace_kill (void );#else static inline int arch_prepare_kprobe_ftrace (struct kprobe *p) {return -EINVAL ; } +static inline void kprobe_ftrace_kill (void ) {}#endif /* CONFIG_KPROBES_ON_FTRACE */ /* Get the kprobe at this addr (if any) - called with preemption disabled */
@@ -495,6 +499,9 @@ static inline void kprobe_flush_task(struct task_struct *tk)static inline void kprobe_free_init_mem (void ) { } +static inline void kprobe_ftrace_kill (void ) +{ +}static inline int disable_kprobe (struct kprobe *kp) {return -EOPNOTSUPP ;
kernel/kprobes.c +6 -0
@@ -1068,6 +1068,7 @@ static struct ftrace_ops kprobe_ipmodify_ops __read_mostly = {static int kprobe_ipmodify_enabled;static int kprobe_ftrace_enabled; +bool kprobe_ftrace_disabled;static int __arm_kprobe_ftrace (struct kprobe *p,struct ftrace_ops *ops,int *cnt)
@@ -1136,6 +1137,11 @@ static int disarm_kprobe_ftrace(struct kprobe *p) ipmodify ? &kprobe_ipmodify_ops : &kprobe_ftrace_ops, ipmodify ? &kprobe_ipmodify_enabled : &kprobe_ftrace_enabled); } + +void kprobe_ftrace_kill () +{ + kprobe_ftrace_disabled = true; +}#else /* !CONFIG_KPROBES_ON_FTRACE */ static inline int arm_kprobe_ftrace (struct kprobe *p) {
kernel/trace/ftrace.c +1 -0
@@ -7902,6 +7902,7 @@ void ftrace_kill(void) ftrace_disabled =1 ; ftrace_enabled =0 ; ftrace_trace_function = ftrace_stub; +kprobe_ftrace_kill (); }/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/250 usb: gadget: uvc: configfs: ensure guid to be valid before set
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Grzeschik <[email protected]>
[ Upstream commit f7a7f80ccc8df017507e2b1e1dd652361374d25b ]
When setting the guid via configfs it is possible to test if its value is one of the kernel supported ones by calling uvc_format_by_guid on it. If the result is NULL, we know the guid is unsupported and can be ignored.
--- drivers/usb/gadget/function/uvc_configfs.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/uvc_configfs.c +13 -1
@@ -13,6 +13,7 @@#include "uvc_configfs.h" #include <linux/sort.h> +#include <linux/usb/uvc.h> #include <linux/usb/video.h> /* -----------------------------------------------------------------------------
@@ -2260,6 +2261,8 @@ static ssize_t uvcg_uncompressed_guid_format_store(struct config_item *item,struct f_uvc_opts *opts;struct config_item *opts_item;struct mutex *su_mutex = &ch->fmt.group.cg_subsys->su_mutex; +const struct uvc_format_desc *format; +u8 tmpguidFormat[sizeof (ch->desc.guidFormat)];int ret;mutex_lock (su_mutex);/* for navigating configfs hierarchy */
@@ -2273,7 +2276,16 @@ static ssize_t uvcg_uncompressed_guid_format_store(struct config_item *item, goto end; } -memcpy (ch->desc.guidFormat, page, +memcpy (tmpguidFormat, page, +min (sizeof (tmpguidFormat), len)); + + format =uvc_format_by_guid (tmpguidFormat); +if (!format) { + ret = -EINVAL ; + goto end; + } + +memcpy (ch->desc.guidFormat, tmpguidFormat,min (sizeof (ch->desc.guidFormat), len)); ret =sizeof (ch->desc.guidFormat);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/250 f2fs: fix to detect inconsistent nat entry during truncation
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 92c556ed6318e13c16746495a8d4513129eb9b0f ]
As Roman Smirnov reported as below:
"
There is a possible bug in f2fs_truncate_inode_blocks():
if (err < 0 && err != -ENOENT)
goto fail;
...
offset[1] = 0;
offset[0]++;
nofs += err;If err = -ENOENT then nofs will sum with an error code, which is strange behaviour. Also if nofs < ENOENT this will cause an overflow. err will be equal to -ENOENT with the following call stack:
truncate_nodes()
f2fs_get_node_page()
__get_node_page()
read_node_page()"
If nat is corrupted, truncate_nodes() may return -ENOENT, and f2fs_truncate_inode_blocks() doesn't handle such error correctly, fix it.
--- fs/f2fs/node.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
fs/f2fs/node.c +11 -1
@@ -1187,7 +1187,17 @@ int f2fs_truncate_inode_blocks(struct inode *inode, pgoff_t from)default :BUG (); } -if (err <0 && err != -ENOENT ) +if (err == -ENOENT ) { +set_sbi_flag (F2FS_P_SB (page),SBI_NEED_FSCK ); +f2fs_handle_error (sbi,ERROR_INVALID_BLKADDR ); +f2fs_err_ratelimited (sbi, +"truncate node fail, ino:%lu, nid:%u, " +"offset[0]:%d, offset[1]:%d, nofs:%d" , + inode->i_ino, dn.nid, offset[0 ], + offset[1 ], nofs); + err =0 ; + } +if (err <0 ) goto fail;if (offset[1 ] ==0 && ri->i_nid[offset[0 ] -NODE_DIR1_BLOCK ]) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/250 f2fs: remove clear SB_INLINECRYPT flag in default_options
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunlei He <[email protected]>
[ Upstream commit ac5eecf481c29942eb9a862e758c0c8b68090c33 ]
In f2fs_remount, SB_INLINECRYPT flag will be clear and re-set. If create new file or open file during this gap, these files will not use inlinecrypt. Worse case, it may lead to data corruption if wrappedkey_v0 is enable.
Thread A: Thread B:
-f2fs_remount -f2fs_file_open or f2fs_new_inode
-default_options
<- clear SB_INLINECRYPT flag
-fscrypt_select_encryption_impl
-parse_options
<- set SB_INLINECRYPT again
--- fs/f2fs/super.c | 2 -- 1 file changed, 2 deletions(-)
fs/f2fs/super.c +0 -2
@@ -2132,8 +2132,6 @@ static void default_options(struct f2fs_sb_info *sbi, bool remount)F2FS_OPTION (sbi).memory_mode =MEMORY_MODE_NORMAL ;F2FS_OPTION (sbi).errors =MOUNT_ERRORS_CONTINUE ; - sbi->sb->s_flags &= ~SB_INLINECRYPT ; -set_opt (sbi,INLINE_XATTR );set_opt (sbi,INLINE_DATA );set_opt (sbi,INLINE_DENTRY );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/250 usb: typec: ucsi_glink: rework quirks implementation
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 3f81cf54c1889eeecbb8d9188f5f2f597622170e ]
In preparation to adding more quirks, extract quirks to the static variables and reference them through match->data. Otherwise adding more quirks will add the table really cumbersome.
--- drivers/usb/typec/ucsi/ucsi_glink.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/usb/typec/ucsi/ucsi_glink.c +8 -6
@@ -311,12 +311,14 @@ static void pmic_glink_ucsi_destroy(void *data)mutex_unlock (&ucsi->lock); } +static unsigned long quirk_sc8180x =UCSI_NO_PARTNER_PDOS ; +static const struct of_device_id pmic_glink_ucsi_of_quirks[] = { - { .compatible ="qcom,qcm6490-pmic-glink" , .data = (void *)UCSI_NO_PARTNER_PDOS , }, - { .compatible ="qcom,sc8180x-pmic-glink" , .data = (void *)UCSI_NO_PARTNER_PDOS , }, - { .compatible ="qcom,sc8280xp-pmic-glink" , .data = (void *)UCSI_NO_PARTNER_PDOS , }, - { .compatible ="qcom,sm8350-pmic-glink" , .data = (void *)UCSI_NO_PARTNER_PDOS , }, - { .compatible ="qcom,sm8550-pmic-glink" , .data = (void *)UCSI_NO_PARTNER_PDOS , }, + { .compatible ="qcom,qcm6490-pmic-glink" , .data = &quirk_sc8180x, }, + { .compatible ="qcom,sc8180x-pmic-glink" , .data = &quirk_sc8180x, }, + { .compatible ="qcom,sc8280xp-pmic-glink" , .data = &quirk_sc8180x, }, + { .compatible ="qcom,sm8350-pmic-glink" , .data = &quirk_sc8180x, }, + { .compatible ="qcom,sm8550-pmic-glink" , .data = &quirk_sc8180x, }, {} };
@@ -354,7 +356,7 @@ static int pmic_glink_ucsi_probe(struct auxiliary_device *adev, match =of_match_device (pmic_glink_ucsi_of_quirks, dev->parent);if (match) - ucsi->ucsi->quirks = (unsigned long )match->data; + ucsi->ucsi->quirks = *(unsigned long *)match->data;ucsi_set_drvdata (ucsi->ucsi, ucsi);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/250 usb: misc: uss720: check for incompatible versions of the Belkin F5U002
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Henrie <[email protected]>
[ Upstream commit 3295f1b866bfbcabd625511968e8a5c541f9ab32 ]
The incompatible device in my possession has a sticker that says "F5U002 Rev 2" and "P80453-B", and lsusb identifies it as "050d:0002 Belkin Components IEEE-1284 Controller". There is a bug report from 2007 from Michael Trausch who was seeing the exact same errors that I saw in 2024 trying to use this cable.
--- drivers/usb/misc/uss720.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
drivers/usb/misc/uss720.c +13 -7
@@ -677,7 +677,7 @@ static int uss720_probe(struct usb_interface *intf,struct parport_uss720_private *priv;struct parport *pp;unsigned char reg; -int i; +int ret; dev_dbg(&intf->dev, "probe: vendor id 0x%x, device id 0x%x\n", le16_to_cpu(usbdev->descriptor.idVendor),
@@ -688,8 +688,8 @@ static int uss720_probe(struct usb_interface *intf,usb_put_dev (usbdev);return -ENODEV ; } - i =usb_set_interface (usbdev, intf->altsetting->desc.bInterfaceNumber,2 ); -dev_dbg (&intf->dev,"set interface result %d\n" , i); + ret =usb_set_interface (usbdev, intf->altsetting->desc.bInterfaceNumber,2 ); +dev_dbg (&intf->dev,"set interface result %d\n" , ret); interface = intf->cur_altsetting;
@@ -725,12 +725,18 @@ static int uss720_probe(struct usb_interface *intf,set_1284_register (pp,7 ,0x00 ,GFP_KERNEL );set_1284_register (pp,6 ,0x30 ,GFP_KERNEL );/* PS/2 mode */ set_1284_register (pp,2 ,0x0c ,GFP_KERNEL ); -/* debugging */ -get_1284_register (pp,0 , ®,GFP_KERNEL ); + +/* The Belkin F5U002 Rev 2 P80453-B USB parallel port adapter shares the +* device ID 050d:0002 with some other device that works with this +* driver, but it itself does not. Detect and handle the bad cable +* here. */ + ret =get_1284_register (pp,0 , ®,GFP_KERNEL );dev_dbg (&intf->dev,"reg: %7ph\n" , priv->reg); +if (ret <0 ) +return ret; - i =usb_find_last_int_in_endpoint (interface, &epd); -if (!i) { + ret =usb_find_last_int_in_endpoint (interface, &epd); +if (!ret) {dev_dbg (&intf->dev,"epaddr %d interval %d\n" , epd->bEndpointAddress, epd->bInterval); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/250 Avoid hw_desc array overrun in dw-axi-dmac
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joao Pinto <[email protected]>
[ Upstream commit 333e11bf47fa8d477db90e2900b1ed3c9ae9b697 ]
I have a use case where nr_buffers = 3 and in which each descriptor is composed by 3 segments, resulting in the DMA channel descs_allocated to be 9. Since axi_desc_put() handles the hw_desc considering the descs_allocated, this scenario would result in a kernel panic (hw_desc array will be overrun).
To fix this, the proposal is to add a new member to the axi_dma_desc structure, where we keep the number of allocated hw_descs (axi_desc_alloc()) and use it in axi_desc_put() to handle the hw_desc array correctly.
Additionally I propose to remove the axi_chan_start_first_queued() call after completing the transfer, since it was identified that unbalance can occur (started descriptors can be interrupted and transfer ignored due to DMA channel not being enabled).
--- drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 6 ++---- drivers/dma/dw-axi-dmac/dw-axi-dmac.h | 1 + 2 files changed, 3 insertions(+), 4 deletions(-)
drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +2 -4
@@ -302,6 +302,7 @@ static struct axi_dma_desc *axi_desc_alloc(u32 num)kfree (desc);return NULL ; } + desc->nr_hw_descs = num;return desc; }
@@ -328,7 +329,7 @@ static struct axi_dma_lli *axi_desc_get(struct axi_dma_chan *chan,static void axi_desc_put (struct axi_dma_desc *desc) {struct axi_dma_chan *chan = desc->chan; -int count =atomic_read (&chan->descs_allocated); +int count = desc->nr_hw_descs;struct axi_dma_hw_desc *hw_desc;int descs_put;
@@ -1139,9 +1140,6 @@ static void axi_chan_block_xfer_complete(struct axi_dma_chan *chan)/* Remove the completed descriptor from issued list before completing */ list_del (&vd->node);vchan_cookie_complete (vd); - -/* Submit queued descriptors after processing the completed ones */ -axi_chan_start_first_queued (chan); } out:
drivers/dma/dw-axi-dmac/dw-axi-dmac.h +1 -0
@@ -104,6 +104,7 @@ struct axi_dma_desc {u32 completed_blocks;u32 length;u32 period_len; +u32 nr_hw_descs; };struct axi_dma_chan_config {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/250 usb: dwc3: pci: Dont set "linux,phy_charger_detect" property on Lenovo Yoga Tab2 1380
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 0fb782b5d5c462b2518b3b4fe7d652114c28d613 ]
The Lenovo Yoga Tablet 2 Pro 1380 model is the exception to the rule that devices which use the Crystal Cove PMIC without using ACPI for battery and AC power_supply class support use the USB-phy for charger detection.
Unlike the Lenovo Yoga Tablet 2 830 / 1050 models this model has an extra LC824206XA Micro USB switch which does the charger detection.
Add a DMI quirk to not set the "linux,phy_charger_detect" property on the 1380 model. This quirk matches on the BIOS version to differentiate the 1380 model from the 830 and 1050 models which otherwise have the same DMI strings.
--- drivers/usb/dwc3/dwc3-pci.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/usb/dwc3/dwc3-pci.c +7 -1
@@ -8,6 +8,7 @@* Sebastian Andrzej Siewior <[email protected]> */ +#include <linux/dmi.h> #include <linux/kernel.h> #include <linux/module.h> #include <linux/slab.h>
@@ -220,6 +221,7 @@ static int dwc3_pci_quirks(struct dwc3_pci *dwc,if (pdev->device ==PCI_DEVICE_ID_INTEL_BYT ) {struct gpio_desc *gpio; +const char *bios_ver;int ret;/* On BYT the FW does not always enable the refclock */
@@ -277,8 +279,12 @@ static int dwc3_pci_quirks(struct dwc3_pci *dwc,* detection. These can be identified by them _not_ * using the standard ACPI battery and ac drivers. */ + bios_ver =dmi_get_system_info (DMI_BIOS_VERSION );if (acpi_dev_present ("INT33FD" ,"1" ,2 ) && -acpi_quirk_skip_acpi_ac_and_battery ()) { +acpi_quirk_skip_acpi_ac_and_battery () && +/* Lenovo Yoga Tablet 2 Pro 1380 uses LC824206XA instead */ + !(bios_ver && +strstarts (bios_ver,"BLADE_21.X64.0005.R00.1504101516" ))) {dev_info (&pdev->dev,"Using TUSB1211 phy for charger detection\n" ); swnode = &dwc3_pci_intel_phy_charger_detect_swnode; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/250 usb: typec: ucsi_glink: drop special handling for CCI_BUSY
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 1a395af9d53c6240bf7799abc43b4dc292ca9dd0 ]
Newer Qualcomm platforms (sm8450+) successfully handle busy state and send the Command Completion after sending the Busy state. Older devices have firmware bug and can not continue after sending the CCI_BUSY state, but the command that leads to CCI_BUSY is already forbidden by the NO_PARTNER_PDOS quirk.
Follow other UCSI glue drivers and drop special handling for CCI_BUSY event. Let the UCSI core properly handle this state.
--- drivers/usb/typec/ucsi/ucsi_glink.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/usb/typec/ucsi/ucsi_glink.c +3 -5
@@ -176,7 +176,8 @@ static int pmic_glink_ucsi_sync_write(struct ucsi *__ucsi, unsigned int offset, left =wait_for_completion_timeout (&ucsi->sync_ack,5 *HZ );if (!left) {dev_err (ucsi->dev,"timeout waiting for UCSI sync write response\n" ); - ret = -ETIMEDOUT ; +/* return 0 here and let core UCSI code handle the CCI_BUSY */ + ret =0 ; }else if (ucsi->sync_val) {dev_err (ucsi->dev,"sync write returned: %d\n" , ucsi->sync_val); }
@@ -243,10 +244,7 @@ static void pmic_glink_ucsi_notify(struct work_struct *work)ucsi_connector_change (ucsi->ucsi, con_num); } -if (ucsi->sync_pending && cci &UCSI_CCI_BUSY ) { - ucsi->sync_val = -EBUSY ; -complete (&ucsi->sync_ack); - }else if (ucsi->sync_pending && +if (ucsi->sync_pending && (cci & (UCSI_CCI_ACK_COMPLETE |UCSI_CCI_COMMAND_COMPLETE ))) {complete (&ucsi->sync_ack); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/250 udf: udftime: prevent overflow in udf_disk_stamp_to_time()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Smirnov <[email protected]>
[ Upstream commit 3b84adf460381169c085e4bc09e7b57e9e16db0a ]
An overflow can occur in a situation where src.centiseconds takes the value of 255. This situation is unlikely, but there is no validation check anywere in the code.
Found by Linux Verification Center (linuxtesting.org) with Svace.
Message-Id: <[email protected]>
--- fs/udf/udftime.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
fs/udf/udftime.c +8 -3
@@ -46,13 +46,18 @@ udf_disk_stamp_to_time(struct timespec64 *dest, struct timestamp src) dest->tv_sec =mktime64 (year, src.month, src.day, src.hour, src.minute, src.second); dest->tv_sec -= offset *60 ; - dest->tv_nsec =1000 * (src.centiseconds *10000 + - src.hundredsOfMicroseconds *100 + src.microseconds); +/* * Sanitize nanosecond field since reportedly some filesystems are * recorded with bogus sub-second values. */ - dest->tv_nsec %=NSEC_PER_SEC ; +if (src.centiseconds <100 && src.hundredsOfMicroseconds <100 && + src.microseconds <100 ) { + dest->tv_nsec =1000 * (src.centiseconds *10000 + + src.hundredsOfMicroseconds *100 + src.microseconds); + }else { + dest->tv_nsec =0 ; + } }void
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/250 PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit 256df20c590bf0e4d63ac69330cf23faddac3e08 ]
Hewlett-Packard HP Pavilion 17 Notebook PC/1972 is an Intel Ivy Bridge system with a muxless AMD Radeon dGPU. Attempting to use the dGPU fails with the following sequence:
ACPI Error: Aborting method \AMD3._ON due to previous error (AE_AML_LOOP_TIMEOUT) (20230628/psparse-529) radeon 0000:01:00.0: not ready 1023ms after resume; waiting
radeon 0000:01:00.0: not ready 2047ms after resume; waiting
radeon 0000:01:00.0: not ready 4095ms after resume; waiting
radeon 0000:01:00.0: not ready 8191ms after resume; waiting
radeon 0000:01:00.0: not ready 16383ms after resume; waiting
radeon 0000:01:00.0: not ready 32767ms after resume; waiting
radeon 0000:01:00.0: not ready 65535ms after resume; giving up
radeon 0000:01:00.0: Unable to change power state from D3cold to D0, device inaccessible
The issue is that the Root Port the dGPU is connected to can't handle the transition from D3cold to D0 so the dGPU can't properly exit runtime PM.
The existing logic in pci_bridge_d3_possible() checks for systems that are newer than 2015 to decide that D3 is safe. This would nominally work for an Ivy Bridge system (which was discontinued in 2015), but this system appears to have continued to receive BIOS updates until 2017 and so this existing logic doesn't appropriately capture it.
Add the system to bridge_d3_blacklist to prevent D3cold from being used.
--- drivers/pci/pci.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/pci/pci.c +12 -0
@@ -2962,6 +2962,18 @@ static const struct dmi_system_id bridge_d3_blacklist[] = { DMI_MATCH(DMI_BOARD_VERSION, "Continental Z2"), }, }, + { +/* +* Changing power state of root port dGPU is connected fails +* https://gitlab.freedesktop.org/drm/amd/-/issues/3229 +*/ + .ident = "Hewlett-Packard HP Pavilion 17 Notebook PC/1972", + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"Hewlett-Packard" ), +DMI_MATCH (DMI_BOARD_NAME ,"1972" ), + DMI_MATCH(DMI_BOARD_VERSION, "95.33"), + }, + }, #endif { } };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/250 f2fs: dont set RO when shutting down f2fs
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
[ Upstream commit 3bdb7f161697e2d5123b89fe1778ef17a44858e7 ]
Shutdown does not check the error of thaw_super due to readonly, which causes a deadlock like below.
f2fs_ioc_shutdown(F2FS_GOING_DOWN_FULLSYNC) issue_discard_thread
- bdev_freeze
- freeze_super
- f2fs_stop_checkpoint()
- f2fs_handle_critical_error - sb_start_write
- set RO - waiting
- bdev_thaw
- thaw_super_locked
- return -EINVAL, if sb_rdonly()
- f2fs_stop_discard_thread
-> wait for kthread_stop(discard_thread);
--- fs/f2fs/super.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/f2fs/super.c +8 -2
@@ -4129,9 +4129,15 @@ void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason,if (shutdown)set_sbi_flag (sbi,SBI_IS_SHUTDOWN ); -/* continue filesystem operators if errors=continue */ -if (continue_fs ||f2fs_readonly (sb)) +/* +* Continue filesystem operators if errors=continue. Should not set +* RO by shutdown, since RO bypasses thaw_super which can hang the +* system. +*/ +if (continue_fs ||f2fs_readonly (sb) || shutdown) { +f2fs_warn (sbi,"Stopped filesystem due to reason: %d" , reason);return ; + }f2fs_warn (sbi,"Remounting filesystem read-only" );/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/250 MIPS: Octeon: Add PCIe link status check
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Songyang Li <[email protected]>
[ Upstream commit 29b83a64df3b42c88c0338696feb6fdcd7f1f3b7 ]
The standard PCIe configuration read-write interface is used to access the configuration space of the peripheral PCIe devices of the mips processor after the PCIe link surprise down, it can generate kernel panic caused by "Data bus error". So it is necessary to add PCIe link status check for system protection. When the PCIe link is down or in training, assigning a value of 0 to the configuration address can prevent read-write behavior to the configuration space of peripheral PCIe devices, thereby preventing kernel panic.
--- arch/mips/pci/pcie-octeon.c | 6 ++++++ 1 file changed, 6 insertions(+) mode change 100644 => 100755 arch/mips/pci/pcie-octeon.c
arch/mips/pci/pcie-octeon.c +6 -0
@@ -230,12 +230,18 @@ static inline uint64_t __cvmx_pcie_build_config_addr(int pcie_port, int bus, {union cvmx_pcie_address pcie_addr;union cvmx_pciercx_cfg006 pciercx_cfg006; +union cvmx_pciercx_cfg032 pciercx_cfg032; pciercx_cfg006.u32 =cvmx_pcie_cfgx_read (pcie_port,CVMX_PCIERCX_CFG006 (pcie_port));if ((bus <= pciercx_cfg006.s.pbnum) && (dev !=0 ))return 0 ; + pciercx_cfg032.u32 = +cvmx_pcie_cfgx_read (pcie_port,CVMX_PCIERCX_CFG032 (pcie_port)); +if ((pciercx_cfg032.s.dlla ==0 ) || (pciercx_cfg032.s.lt ==1 )) +return 0 ; + pcie_addr.u64 =0 ; pcie_addr.config.upper =2 ; pcie_addr.config.io =1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/250 serial: imx: Introduce timeout when waiting on transmitter empty
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Esben Haabendal <[email protected]>
[ Upstream commit e533e4c62e9993e62e947ae9bbec34e4c7ae81c2 ]
By waiting at most 1 second for USR2_TXDC to be set, we avoid a potential deadlock.
In case of the timeout, there is not much we can do, so we simply ignore the transmitter state and optimistically try to continue.
--- drivers/tty/serial/imx.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/tty/serial/imx.c +4 -3
@@ -26,6 +26,7 @@#include <linux/slab.h> #include <linux/of.h> #include <linux/io.h> +#include <linux/iopoll.h> #include <linux/dma-mapping.h> #include <asm/irq.h>
@@ -2010,7 +2011,7 @@ imx_uart_console_write(struct console *co, const char *s, unsigned int count)struct imx_port *sport = imx_uart_ports[co->index];struct imx_port_ucrs old_ucr;unsigned long flags; -unsigned int ucr1; +unsigned int ucr1, usr2;int locked =1 ;if (sport->port.sysrq)
@@ -2041,8 +2042,8 @@ imx_uart_console_write(struct console *co, const char *s, unsigned int count)* Finally, wait for transmitter to become empty * and restore UCR1/2/3 */ -while (!(imx_uart_readl (sport,USR2 ) &USR2_TXDC )); - +read_poll_timeout_atomic (imx_uart_readl, usr2, usr2 &USR2_TXDC , +0 ,USEC_PER_SEC , false, sport,USR2 );imx_uart_ucrs_restore (sport, &old_ucr);if (locked)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/250 serial: exar: adding missing CTI and Exar PCI ids
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Parker Newman <[email protected]>
[ Upstream commit b86ae40ffcf5a16b9569b1016da4a08c4f352ca2 ]
- Added Connect Tech and Exar IDs not already in pci_ids.h
--- drivers/tty/serial/8250/8250_exar.c | 42 +++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+)
drivers/tty/serial/8250/8250_exar.c +42 -0
@@ -46,8 +46,50 @@#define PCI_DEVICE_ID_COMMTECH_4228PCIE 0x0021#define PCI_DEVICE_ID_COMMTECH_4222PCIE 0x0022 +#define PCI_VENDOR_ID_CONNECT_TECH 0x12c4 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_SP_OPTO 0x0340 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_SP_OPTO_A 0x0341 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_SP_OPTO_B 0x0342 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_XPRS 0x0350 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_XPRS_A 0x0351 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_XPRS_B 0x0352 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_XPRS 0x0353 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_16_XPRS_A 0x0354 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_16_XPRS_B 0x0355 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_XPRS_OPTO 0x0360 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_XPRS_OPTO_A 0x0361 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_XPRS_OPTO_B 0x0362 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_SP 0x0370 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_SP_232 0x0371 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_SP_485 0x0372 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_4_SP 0x0373 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_6_2_SP 0x0374 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_6_SP 0x0375 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_SP_232_NS 0x0376 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_XP_OPTO_LEFT 0x0380 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_XP_OPTO_RIGHT 0x0381 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_XP_OPTO 0x0382 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_4_XPRS_OPTO 0x0392 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_XPRS_LP 0x03A0 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_XPRS_LP_232 0x03A1 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_XPRS_LP_485 0x03A2 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_XPRS_LP_232_NS 0x03A3 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XEG001 0x0602 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_BASE 0x1000 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_2 0x1002 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_4 0x1004 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_8 0x1008 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_12 0x100C +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_16 0x1010 +#define PCI_DEVICE_ID_CONNECT_TECH_PCI_XR79X_12_XIG00X 0x110c +#define PCI_DEVICE_ID_CONNECT_TECH_PCI_XR79X_12_XIG01X 0x110d +#define PCI_DEVICE_ID_CONNECT_TECH_PCI_XR79X_16 0x1110 +#define PCI_DEVICE_ID_EXAR_XR17V4358 0x4358#define PCI_DEVICE_ID_EXAR_XR17V8358 0x8358 +#define PCI_DEVICE_ID_EXAR_XR17V252 0x0252 +#define PCI_DEVICE_ID_EXAR_XR17V254 0x0254 +#define PCI_DEVICE_ID_EXAR_XR17V258 0x0258#define PCI_SUBDEVICE_ID_USR_2980 0x0128#define PCI_SUBDEVICE_ID_USR_2981 0x0129
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/250 usb: gadget: function: Remove usage of the deprecated ida_simple_xx() API
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 920e7522e3bab5ebc2fb0cc1a034f4470c87fa97 ]
ida_alloc() and ida_free() should be preferred to the deprecated ida_simple_get() and ida_simple_remove().
Note that the upper limit of ida_simple_get() is exclusive, but the one of ida_alloc_max() is inclusive. So a -1 has been added when needed.
--- drivers/usb/gadget/function/f_hid.c | 6 +++--- drivers/usb/gadget/function/f_printer.c | 6 +++--- drivers/usb/gadget/function/rndis.c | 4 ++-- 3 files changed, 8 insertions(+), 8 deletions(-)
drivers/usb/gadget/function/f_hid.c +3 -3
@@ -1029,9 +1029,9 @@ static inline int hidg_get_minor(void) {int ret; - ret =ida_simple_get (&hidg_ida,0 ,0 ,GFP_KERNEL ); + ret =ida_alloc (&hidg_ida,GFP_KERNEL );if (ret >=HIDG_MINORS ) { -ida_simple_remove (&hidg_ida, ret); +ida_free (&hidg_ida, ret); ret = -ENODEV ; }
@@ -1176,7 +1176,7 @@ static const struct config_item_type hid_func_type = {static inline void hidg_put_minor (int minor) { -ida_simple_remove (&hidg_ida, minor); +ida_free (&hidg_ida, minor); }static void hidg_free_inst (struct usb_function_instance *f)
drivers/usb/gadget/function/f_printer.c +3 -3
@@ -1312,9 +1312,9 @@ static inline int gprinter_get_minor(void) {int ret; - ret =ida_simple_get (&printer_ida,0 ,0 ,GFP_KERNEL ); + ret =ida_alloc (&printer_ida,GFP_KERNEL );if (ret >=PRINTER_MINORS ) { -ida_simple_remove (&printer_ida, ret); +ida_free (&printer_ida, ret); ret = -ENODEV ; }
@@ -1323,7 +1323,7 @@ static inline int gprinter_get_minor(void)static inline void gprinter_put_minor (int minor) { -ida_simple_remove (&printer_ida, minor); +ida_free (&printer_ida, minor); }static int gprinter_setup (int );
drivers/usb/gadget/function/rndis.c +2 -2
@@ -869,12 +869,12 @@ EXPORT_SYMBOL_GPL(rndis_msg_parser);static inline int rndis_get_nr (void ) { -return ida_simple_get (&rndis_ida,0 ,1000 ,GFP_KERNEL ); +return ida_alloc_max (&rndis_ida,999 ,GFP_KERNEL ); }static inline void rndis_put_nr (int nr) { -ida_simple_remove (&rndis_ida, nr); +ida_free (&rndis_ida, nr); }struct rndis_params *rndis_register (void (*resp_avail)(void *v),void *v)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/250 xhci: remove XHCI_TRUST_TX_LENGTH quirk
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
[ Upstream commit 34b67198244f2d7d8409fa4eb76204c409c0c97e ]
If this quirk was set then driver would treat transfer events with 'Success' completion code as 'Short packet' if there were untransferred bytes left.
This is so common that turn it into default behavior.
xhci_warn_ratelimited() is no longer used after this, so remove it.
A success event with untransferred bytes left doesn't always mean a misbehaving controller. If there was an error mid a multi-TRB TD it's allowed to issue a success event for the last TRB in that TD.
See xhci 1.2 spec 4.9.1 Transfer Descriptors
"Note: If an error is detected while processing a multi-TRB TD, the xHC
shall generate a Transfer Event for the TRB that the error was detected on with the appropriate error Condition Code, then may advance to the next TD. If in the process of advancing to the next TD, a Transfer TRB is encountered with its IOC flag set, then the Condition Code of the Transfer Event generated for that Transfer TRB should be Success, because there was no error actually associated with the TRB that generated the Event. However, an xHC implementation may redundantly assert the original error Condition Code."
--- drivers/usb/host/xhci-pci.c | 15 ++------------- drivers/usb/host/xhci-rcar.c | 6 ++---- drivers/usb/host/xhci-ring.c | 15 +++++---------- drivers/usb/host/xhci.h | 4 +--- 4 files changed, 10 insertions(+), 30 deletions(-)
drivers/usb/host/xhci-pci.c +2 -13
@@ -271,17 +271,12 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)"QUIRK: Fresco Logic revision %u " "has broken MSI implementation" , pdev->revision); - xhci->quirks |=XHCI_TRUST_TX_LENGTH ; }if (pdev->vendor ==PCI_VENDOR_ID_FRESCO_LOGIC && pdev->device ==PCI_DEVICE_ID_FRESCO_LOGIC_FL1009 ) xhci->quirks |=XHCI_BROKEN_STREAMS ; -if (pdev->vendor ==PCI_VENDOR_ID_FRESCO_LOGIC && - pdev->device ==PCI_DEVICE_ID_FRESCO_LOGIC_FL1100 ) - xhci->quirks |=XHCI_TRUST_TX_LENGTH ; -if (pdev->vendor ==PCI_VENDOR_ID_NEC ) xhci->quirks |=XHCI_NEC_HOST ;
@@ -308,11 +303,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) xhci->quirks |=XHCI_RESET_ON_RESUME ; } -if (pdev->vendor ==PCI_VENDOR_ID_AMD ) { - xhci->quirks |=XHCI_TRUST_TX_LENGTH ; -if (pdev->device ==0x43f7 ) - xhci->quirks |=XHCI_DEFAULT_PM_RUNTIME_ALLOW ; - } +if (pdev->vendor ==PCI_VENDOR_ID_AMD && pdev->device ==0x43f7 ) + xhci->quirks |=XHCI_DEFAULT_PM_RUNTIME_ALLOW ; if ((pdev->vendor == PCI_VENDOR_ID_AMD) && ((pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4) ||
@@ -400,7 +392,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)if (pdev->vendor ==PCI_VENDOR_ID_ETRON && pdev->device ==PCI_DEVICE_ID_EJ168 ) { xhci->quirks |=XHCI_RESET_ON_RESUME ; - xhci->quirks |=XHCI_TRUST_TX_LENGTH ; xhci->quirks |=XHCI_BROKEN_STREAMS ; } if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
@@ -411,7 +402,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)if (pdev->vendor ==PCI_VENDOR_ID_RENESAS && pdev->device ==0x0014 ) { - xhci->quirks |=XHCI_TRUST_TX_LENGTH ; xhci->quirks |=XHCI_ZERO_64B_REGS ; } if (pdev->vendor == PCI_VENDOR_ID_RENESAS &&
@@ -441,7 +431,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) }if (pdev->vendor ==PCI_VENDOR_ID_ASMEDIA && pdev->device ==PCI_DEVICE_ID_ASMEDIA_1042A_XHCI ) { - xhci->quirks |=XHCI_TRUST_TX_LENGTH ; xhci->quirks |=XHCI_NO_64BIT_SUPPORT ; } if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
drivers/usb/host/xhci-rcar.c +2 -4
@@ -214,8 +214,7 @@ static int xhci_rcar_resume_quirk(struct usb_hcd *hcd)*/ #define SET_XHCI_PLAT_PRIV_FOR_RCAR (firmware) \ .firmware_name = firmware, \ - .quirks = XHCI_NO_64BIT_SUPPORT | XHCI_TRUST_TX_LENGTH | \ - XHCI_SLOW_SUSPEND, \ + .quirks = XHCI_NO_64BIT_SUPPORT | XHCI_SLOW_SUSPEND, \ .init_quirk = xhci_rcar_init_quirk, \ .plat_start = xhci_rcar_start, \ .resume_quirk = xhci_rcar_resume_quirk,
@@ -229,8 +228,7 @@ static const struct xhci_plat_priv xhci_plat_renesas_rcar_gen3 = { };static const struct xhci_plat_priv xhci_plat_renesas_rzv2m = { - .quirks =XHCI_NO_64BIT_SUPPORT |XHCI_TRUST_TX_LENGTH | -XHCI_SLOW_SUSPEND , + .quirks =XHCI_NO_64BIT_SUPPORT |XHCI_SLOW_SUSPEND , .init_quirk = xhci_rzv2m_init_quirk, .plat_start = xhci_rzv2m_start, };
drivers/usb/host/xhci-ring.c +5 -10
@@ -2431,8 +2431,7 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_virt_ep *ep,break ;if (remaining) { frame->status = short_framestatus; -if (xhci->quirks &XHCI_TRUST_TX_LENGTH ) - sum_trbs_for_length = true; + sum_trbs_for_length = true;break ; } frame->status =0 ;
@@ -2681,15 +2680,11 @@ static int handle_tx_event(struct xhci_hcd *xhci,* transfer type */ case COMP_SUCCESS : -if (EVENT_TRB_LEN (le32_to_cpu (event->transfer_len)) ==0 ) -break ; -if (xhci->quirks &XHCI_TRUST_TX_LENGTH || - ep_ring->last_td_was_short) +if (EVENT_TRB_LEN (le32_to_cpu (event->transfer_len)) !=0 ) { trb_comp_code =COMP_SHORT_PACKET ; -else -xhci_warn_ratelimited (xhci, -"WARN Successful completion on short TX for slot %u ep %u: needs XHCI_TRUST_TX_LENGTH quirk?\n" , - slot_id, ep_index); +xhci_dbg (xhci,"Successful completion on short TX for slot %u ep %u with last td short %d\n" , + slot_id, ep_index, ep_ring->last_td_was_short); + }break ;case COMP_SHORT_PACKET :break ;
drivers/usb/host/xhci.h +1 -3
@@ -1590,7 +1590,7 @@ struct xhci_hcd {#define XHCI_RESET_ON_RESUME BIT_ULL(7)#define XHCI_SW_BW_CHECKING BIT_ULL(8)#define XHCI_AMD_0x96_HOST BIT_ULL(9) -#define XHCI_TRUST_TX_LENGTH BIT_ULL(10) +#define XHCI_TRUST_TX_LENGTH BIT_ULL(10)/* Deprecated */ #define XHCI_LPM_SUPPORT BIT_ULL(11)#define XHCI_INTEL_HOST BIT_ULL(12)#define XHCI_SPURIOUS_REBOOT BIT_ULL(13)
@@ -1730,8 +1730,6 @@ static inline bool xhci_has_one_roothub(struct xhci_hcd *xhci) dev_err(xhci_to_hcd(xhci)->self.controller , fmt , ## args) #define xhci_warn(xhci, fmt, args...) \ dev_warn(xhci_to_hcd(xhci)->self.controller , fmt , ## args) -#define xhci_warn_ratelimited(xhci, fmt, args...) \ - dev_warn_ratelimited(xhci_to_hcd(xhci)->self.controller , fmt , ## args) #define xhci_info(xhci, fmt, args...) \ dev_info(xhci_to_hcd(xhci)->self.controller , fmt , ## args)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/250 tty: add the option to have a tty reject a new ldisc
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
[ Upstream commit 6bd23e0c2bb6c65d4f5754d1456bc9a4427fc59b ]
... and use it to limit the virtual terminals to just N_TTY. They are kind of special, and in particular, the "con_write()" routine violates the "writes cannot sleep" rule that some ldiscs rely on.
This avoids the
BUG: sleeping function called from invalid context at kernel/printk/printk.c:2659
when N_GSM has been attached to a virtual console, and gsmld_write() calls con_write() while holding a spinlock, and con_write() then tries to get the console lock.
--- drivers/tty/tty_ldisc.c | 6 ++++++ drivers/tty/vt/vt.c | 10 ++++++++++ include/linux/tty_driver.h | 8 ++++++++ 3 files changed, 24 insertions(+)
drivers/tty/tty_ldisc.c +6 -0
@@ -545,6 +545,12 @@ int tty_set_ldisc(struct tty_struct *tty, int disc) goto out; } +if (tty->ops->ldisc_ok) { + retval = tty->ops->ldisc_ok (tty, disc); +if (retval) + goto out; + } + old_ldisc = tty->ldisc;/* Shutdown the old discipline. */
drivers/tty/vt/vt.c +10 -0
@@ -3576,6 +3576,15 @@ static void con_cleanup(struct tty_struct *tty)tty_port_put (&vc->port); } +/* +* We can't deal with anything but the N_TTY ldisc, +* because we can sleep in our write() routine. +*/ +static int con_ldisc_ok (struct tty_struct *tty,int ldisc) +{ +return ldisc ==N_TTY ?0 : -EINVAL ; +} +static int default_color =7 ;/* white */ static int default_italic_color =2 ;// green (ASCII) static int default_underline_color =3 ;// cyan (ASCII)
@@ -3695,6 +3704,7 @@ static const struct tty_operations con_ops = { .resize = vt_resize, .shutdown = con_shutdown, .cleanup = con_cleanup, + .ldisc_ok = con_ldisc_ok, };static struct cdev vc0_cdev;
include/linux/tty_driver.h +8 -0
@@ -154,6 +154,13 @@ struct serial_struct;* * Optional. Called under the @tty->termios_rwsem. May sleep. * +* @ldisc_ok: ``int ()(struct tty_struct *tty, int ldisc)`` +* +* This routine allows the @tty driver to decide if it can deal +* with a particular @ldisc. +* +* Optional. Called under the @tty->ldisc_sem and @tty->termios_rwsem. +* * @set_ldisc: ``void ()(struct tty_struct *tty)`` * * This routine allows the @tty driver to be notified when the device's
@@ -372,6 +379,7 @@ struct tty_operations {void (*hangup)(struct tty_struct *tty);int (*break_ctl)(struct tty_struct *tty,int state);void (*flush_buffer)(struct tty_struct *tty); +int (*ldisc_ok)(struct tty_struct *tty,int ldisc);void (*set_ldisc)(struct tty_struct *tty);void (*wait_until_sent)(struct tty_struct *tty,int timeout);void (*send_xchar)(struct tty_struct *tty,u8 ch);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/250 i2c: lpi2c: Avoid calling clk_get_rate during transfer
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 4268254a39484fc11ba991ae148bacbe75d9cc0a ]
Instead of repeatedly calling clk_get_rate for each transfer, lock the clock rate and cache the value.
A deadlock has been observed while adding tlv320aic32x4 audio codec to the system. When this clock provider adds its clock, the clk mutex is locked already, it needs to access i2c, which in return needs the mutex for clk_get_rate as well.
--- drivers/i2c/busses/i2c-imx-lpi2c.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
drivers/i2c/busses/i2c-imx-lpi2c.c +16 -3
@@ -99,6 +99,7 @@ struct lpi2c_imx_struct {__u8 *rx_buf;__u8 *tx_buf;struct completion complete; +unsigned long rate_per;unsigned int msglen;unsigned int delivered;unsigned int block_data;
@@ -212,9 +213,7 @@ static int lpi2c_imx_config(struct lpi2c_imx_struct *lpi2c_imx)lpi2c_imx_set_mode (lpi2c_imx); - clk_rate =clk_get_rate (lpi2c_imx->clks[0 ].clk); -if (!clk_rate) -return -EINVAL ; + clk_rate = lpi2c_imx->rate_per;if (lpi2c_imx->mode ==HS || lpi2c_imx->mode ==ULTRA_FAST ) filt =0 ;
@@ -611,6 +610,20 @@ static int lpi2c_imx_probe(struct platform_device *pdev)if (ret)return ret; +/* +* Lock the parent clock rate to avoid getting parent clock upon +* each transfer +*/ + ret =devm_clk_rate_exclusive_get (&pdev->dev, lpi2c_imx->clks[0 ].clk); +if (ret) +return dev_err_probe (&pdev->dev, ret, +"can't lock I2C peripheral clock rate\n" ); + + lpi2c_imx->rate_per =clk_get_rate (lpi2c_imx->clks[0 ].clk); +if (!lpi2c_imx->rate_per) +return dev_err_probe (&pdev->dev, -EINVAL , +"can't get I2C peripheral clock rate\n" ); +pm_runtime_set_autosuspend_delay (&pdev->dev,I2C_PM_TIMEOUT );pm_runtime_use_autosuspend (&pdev->dev);pm_runtime_get_noresume (&pdev->dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/250 cxl: Add post-reset warning if reset results in loss of previously committed HDM decoders
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <[email protected]>
[ Upstream commit 934edcd436dca0447e0d3691a908394ba16d06c3 ]
Secondary Bus Reset (SBR) is equivalent to a device being hot removed and inserted again. Doing a SBR on a CXL type 3 device is problematic if the exported device memory is part of system memory that cannot be offlined. The event is equivalent to violently ripping out that range of memory from the kernel. While the hardware requires the "Unmask SBR" bit set in the Port Control Extensions register and the kernel currently does not unmask it, user can unmask this bit via setpci or similar tool.
The driver does not have a way to detect whether a reset coming from the PCI subsystem is a Function Level Reset (FLR) or SBR. The only way to detect is to note if a decoder is marked as enabled in software but the decoder control register indicates it's not committed.
Add a helper function to find discrepancy between the decoder software state versus the hardware register state.
--- drivers/cxl/core/pci.c | 29 +++++++++++++++++++++++++++++ drivers/cxl/cxl.h | 2 ++ drivers/cxl/pci.c | 22 ++++++++++++++++++++++ 3 files changed, 53 insertions(+)
drivers/cxl/core/pci.c +29 -0
@@ -1045,3 +1045,32 @@ long cxl_pci_get_latency(struct pci_dev *pdev)return cxl_flit_size (pdev) *MEGA / bw; } + +static int __cxl_endpoint_decoder_reset_detected (struct device *dev,void *data) +{ +struct cxl_port *port = data; +struct cxl_decoder *cxld; +struct cxl_hdm *cxlhdm; +void __iomem *hdm; +u32 ctrl; + +if (!is_endpoint_decoder (dev)) +return 0 ; + + cxld =to_cxl_decoder (dev); +if ((cxld->flags &CXL_DECODER_F_ENABLE ) ==0 ) +return 0 ; + + cxlhdm =dev_get_drvdata (&port->dev); + hdm = cxlhdm->regs.hdm_decoder; + ctrl =readl (hdm +CXL_HDM_DECODER0_CTRL_OFFSET (cxld->id)); + +return !FIELD_GET (CXL_HDM_DECODER0_CTRL_COMMITTED , ctrl); +} + +bool cxl_endpoint_decoder_reset_detected (struct cxl_port *port) +{ +return device_for_each_child (&port->dev, port, + __cxl_endpoint_decoder_reset_detected); +} +EXPORT_SYMBOL_NS_GPL (cxl_endpoint_decoder_reset_detected,CXL );
drivers/cxl/cxl.h +2 -0
@@ -891,6 +891,8 @@ void cxl_coordinates_combine(struct access_coordinate *out,struct access_coordinate *c1, struct access_coordinate *c2); +bool cxl_endpoint_decoder_reset_detected (struct cxl_port *port); +/* * Unit test builds overrides this to __weak, find the 'strong' version * of these symbols in tools/testing/cxl/.
drivers/cxl/pci.c +22 -0
@@ -957,11 +957,33 @@ static void cxl_error_resume(struct pci_dev *pdev) dev->driver ? "successful" : "failed"); } +static void cxl_reset_done (struct pci_dev *pdev) +{ +struct cxl_dev_state *cxlds =pci_get_drvdata (pdev); +struct cxl_memdev *cxlmd = cxlds->cxlmd; +struct device *dev = &pdev->dev; + +/* +* FLR does not expect to touch the HDM decoders and related +* registers. SBR, however, will wipe all device configurations. +* Issue a warning if there was an active decoder before the reset +* that no longer exists. +*/ +guard (device)(&cxlmd->dev); +if (cxlmd->endpoint && +cxl_endpoint_decoder_reset_detected (cxlmd->endpoint)) { +dev_crit (dev,"SBR happened without memory regions removal.\n" ); +dev_crit (dev,"System may be unstable if regions hosted system memory.\n" ); +add_taint (TAINT_USER ,LOCKDEP_STILL_OK ); + } +} +static const struct pci_error_handlers cxl_error_handlers = { .error_detected = cxl_error_detected, .slot_reset = cxl_slot_reset, .resume = cxl_error_resume, .cor_error_detected = cxl_cor_error_detected, + .reset_done = cxl_reset_done, };static struct pci_driver cxl_pci_driver = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/250 vfio/pci: Collect hot-reset devices to local buffer
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <[email protected]>
[ Upstream commit f6944d4a0b87c16bc34ae589169e1ded3d4db08e ]
Lockdep reports the below circular locking dependency issue. The mmap_lock acquisition while holding pci_bus_sem is due to the use of copy_to_user() from within a pci_walk_bus() callback.
Building the devices array directly into the user buffer is only for convenience. Instead we can allocate a local buffer for the array, bounded by the number of devices on the bus/slot, fill the device information into this local buffer, then copy it into the user buffer outside the bus walk callback.
======================================================
WARNING: possible circular locking dependency detected
6.9.0-rc5+ #39 Not tainted
------------------------------------------------------
CPU 0/KVM/4113 is trying to acquire lock:ffff99a609ee18a8 (&vdev->vma_lock){+.+.}-{4:4}, at: vfio_pci_mmap_fault+0x35/0x1a0 [vfio_pci_core]
but task is already holding lock:ffff99a243a052a0 (&mm->mmap_lock){++++}-{4:4}, at: vaddr_get_pfns+0x3f/0x170 [vfio_iommu_type1]
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&mm->mmap_lock){++++}-{4:4}:
__lock_acquire+0x4e4/0xb90
lock_acquire+0xbc/0x2d0
__might_fault+0x5c/0x80
_copy_to_user+0x1e/0x60
vfio_pci_fill_devs+0x9f/0x130 [vfio_pci_core]
vfio_pci_walk_wrapper+0x45/0x60 [vfio_pci_core]
__pci_walk_bus+0x6b/0xb0
vfio_pci_ioctl_get_pci_hot_reset_info+0x10b/0x1d0 [vfio_pci_core]
vfio_pci_core_ioctl+0x1cb/0x400 [vfio_pci_core]
vfio_device_fops_unl_ioctl+0x7e/0x140 [vfio]
__x64_sys_ioctl+0x8a/0xc0
do_syscall_64+0x8d/0x170
entry_SYSCALL_64_after_hwframe+0x76/0x7e-> #2 (pci_bus_sem){++++}-{4:4}:
__lock_acquire+0x4e4/0xb90
lock_acquire+0xbc/0x2d0
down_read+0x3e/0x160
pci_bridge_wait_for_secondary_bus.part.0+0x33/0x2d0
pci_reset_bus+0xdd/0x160
vfio_pci_dev_set_hot_reset+0x256/0x270 [vfio_pci_core]
vfio_pci_ioctl_pci_hot_reset_groups+0x1a3/0x280 [vfio_pci_core]
vfio_pci_core_ioctl+0x3b5/0x400 [vfio_pci_core]
vfio_device_fops_unl_ioctl+0x7e/0x140 [vfio]
__x64_sys_ioctl+0x8a/0xc0
do_syscall_64+0x8d/0x170
entry_SYSCALL_64_after_hwframe+0x76/0x7e-> #1 (&vdev->memory_lock){+.+.}-{4:4}:
__lock_acquire+0x4e4/0xb90
lock_acquire+0xbc/0x2d0
down_write+0x3b/0xc0
vfio_pci_zap_and_down_write_memory_lock+0x1c/0x30 [vfio_pci_core]
vfio_basic_config_write+0x281/0x340 [vfio_pci_core]
vfio_config_do_rw+0x1fa/0x300 [vfio_pci_core]
vfio_pci_config_rw+0x75/0xe50 [vfio_pci_core]
vfio_pci_rw+0xea/0x1a0 [vfio_pci_core]
vfs_write+0xea/0x520
__x64_sys_pwrite64+0x90/0xc0
do_syscall_64+0x8d/0x170
entry_SYSCALL_64_after_hwframe+0x76/0x7e-> #0 (&vdev->vma_lock){+.+.}-{4:4}:
check_prev_add+0xeb/0xcc0
validate_chain+0x465/0x530
__lock_acquire+0x4e4/0xb90
lock_acquire+0xbc/0x2d0
__mutex_lock+0x97/0xde0
vfio_pci_mmap_fault+0x35/0x1a0 [vfio_pci_core]
__do_fault+0x31/0x160
do_pte_missing+0x65/0x3b0
__handle_mm_fault+0x303/0x720
handle_mm_fault+0x10f/0x460
fixup_user_fault+0x7f/0x1f0
follow_fault_pfn+0x66/0x1c0 [vfio_iommu_type1]
vaddr_get_pfns+0xf2/0x170 [vfio_iommu_type1]
vfio_pin_pages_remote+0x348/0x4e0 [vfio_iommu_type1]
vfio_pin_map_dma+0xd2/0x330 [vfio_iommu_type1]
vfio_dma_do_map+0x2c0/0x440 [vfio_iommu_type1]
vfio_iommu_type1_ioctl+0xc5/0x1d0 [vfio_iommu_type1]
__x64_sys_ioctl+0x8a/0xc0
do_syscall_64+0x8d/0x170
entry_SYSCALL_64_after_hwframe+0x76/0x7eother info that might help us debug this:
Chain exists of: &vdev->vma_lock --> pci_bus_sem --> &mm->mmap_lock Possible unsafe locking scenario:
block dm-0: the capability attribute has been deprecated.
CPU0 CPU1
---- ----
rlock(&mm->mmap_lock);
lock(pci_bus_sem);
lock(&mm->mmap_lock); lock(&vdev->vma_lock);
*** DEADLOCK ***
2 locks held by CPU 0/KVM/4113:
#0: ffff99a25f294888 (&iommu->lock#2){+.+.}-{4:4}, at: vfio_dma_do_map+0x60/0x440 [vfio_iommu_type1] #1: ffff99a243a052a0 (&mm->mmap_lock){++++}-{4:4}, at: vaddr_get_pfns+0x3f/0x170 [vfio_iommu_type1]
stack backtrace: CPU: 1 PID: 4113 Comm: CPU 0/KVM Not tainted 6.9.0-rc5+ #39 Hardware name: Dell Inc. PowerEdge T640/04WYPY, BIOS 2.15.1 06/16/2022 Call Trace: <TASK> dump_stack_lvl+0x64/0xa0 check_noncircular+0x131/0x150 check_prev_add+0xeb/0xcc0 ? add_chain_cache+0x10a/0x2f0 ? __lock_acquire+0x4e4/0xb90 validate_chain+0x465/0x530 __lock_acquire+0x4e4/0xb90 lock_acquire+0xbc/0x2d0 ? vfio_pci_mmap_fault+0x35/0x1a0 [vfio_pci_core] ? lock_is_held_type+0x9a/0x110 __mutex_lock+0x97/0xde0 ? vfio_pci_mmap_fault+0x35/0x1a0 [vfio_pci_core] ? lock_acquire+0xbc/0x2d0 ? vfio_pci_mmap_fault+0x35/0x1a0 [vfio_pci_core] ? find_held_lock+0x2b/0x80 ? vfio_pci_mmap_fault+0x35/0x1a0 [vfio_pci_core] vfio_pci_mmap_fault+0x35/0x1a0 [vfio_pci_core] __do_fault+0x31/0x160 do_pte_missing+0x65/0x3b0 __handle_mm_fault+0x303/0x720 handle_mm_fault+0x10f/0x460 fixup_user_fault+0x7f/0x1f0 follow_fault_pfn+0x66/0x1c0 [vfio_iommu_type1] vaddr_get_pfns+0xf2/0x170 [vfio_iommu_type1] vfio_pin_pages_remote+0x348/0x4e0 [vfio_iommu_type1] vfio_pin_map_dma+0xd2/0x330 [vfio_iommu_type1] vfio_dma_do_map+0x2c0/0x440 [vfio_iommu_type1] vfio_iommu_type1_ioctl+0xc5/0x1d0 [vfio_iommu_type1] __x64_sys_ioctl+0x8a/0xc0 do_syscall_64+0x8d/0x170 ? rcu_core+0x8d/0x250 ? __lock_release+0x5e/0x160 ? rcu_core+0x8d/0x250 ? lock_release+0x5f/0x120 ? sched_clock+0xc/0x30 ? sched_clock_cpu+0xb/0x190 ? irqtime_account_irq+0x40/0xc0 ? __local_bh_enable+0x54/0x60 ? __do_softirq+0x315/0x3ca ? lockdep_hardirqs_on_prepare.part.0+0x97/0x140 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f8300d0357b Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 75 68 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007f82ef3fb948 EFLAGS: 00000206 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f8300d0357b RDX: 00007f82ef3fb990 RSI: 0000000000003b71 RDI: 0000000000000023 RBP: 00007f82ef3fb9c0 R08: 0000000000000000 R09: 0000561b7e0bcac2 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000200000000 R14: 0000381800000000 R15: 0000000000000000 </TASK>
--- drivers/vfio/pci/vfio_pci_core.c | 78 ++++++++++++++++++++------------ 1 file changed, 49 insertions(+), 29 deletions(-)
drivers/vfio/pci/vfio_pci_core.c +49 -29
@@ -778,25 +778,26 @@ static int vfio_pci_count_devs(struct pci_dev *pdev, void *data) }struct vfio_pci_fill_info { -struct vfio_pci_dependent_device __user *devices; -struct vfio_pci_dependent_device __user *devices_end;struct vfio_device *vdev; +struct vfio_pci_dependent_device *devices; +int nr_devices;u32 count;u32 flags; };static int vfio_pci_fill_devs (struct pci_dev *pdev,void *data) { -struct vfio_pci_dependent_device info = { - .segment =pci_domain_nr (pdev->bus), - .bus = pdev->bus->number, - .devfn = pdev->devfn, - }; +struct vfio_pci_dependent_device *info;struct vfio_pci_fill_info *fill = data; - fill->count++; -if (fill->devices >= fill->devices_end) -return 0 ; +/* The topology changed since we counted devices */ +if (fill->count >= fill->nr_devices) +return -EAGAIN ; + + info = &fill->devices[fill->count++]; + info->segment =pci_domain_nr (pdev->bus); + info->bus = pdev->bus->number; + info->devfn = pdev->devfn;if (fill->flags &VFIO_PCI_HOT_RESET_FLAG_DEV_ID ) {struct iommufd_ctx *iommufd =vfio_iommufd_device_ictx (fill->vdev);
@@ -809,19 +810,19 @@ static int vfio_pci_fill_devs(struct pci_dev *pdev, void *data)*/ vdev =vfio_find_device_in_devset (dev_set, &pdev->dev);if (!vdev) { - info.devid =VFIO_PCI_DEVID_NOT_OWNED ; + info->devid =VFIO_PCI_DEVID_NOT_OWNED ; }else {int id =vfio_iommufd_get_dev_id (vdev, iommufd);if (id >0 ) - info.devid = id; + info->devid = id;else if (id == -ENOENT ) - info.devid =VFIO_PCI_DEVID_OWNED ; + info->devid =VFIO_PCI_DEVID_OWNED ;else - info.devid =VFIO_PCI_DEVID_NOT_OWNED ; + info->devid =VFIO_PCI_DEVID_NOT_OWNED ; }/* If devid is VFIO_PCI_DEVID_NOT_OWNED, clear owned flag. */ -if (info.devid ==VFIO_PCI_DEVID_NOT_OWNED ) +if (info->devid ==VFIO_PCI_DEVID_NOT_OWNED ) fill->flags &= ~VFIO_PCI_HOT_RESET_FLAG_DEV_ID_OWNED ; }else {struct iommu_group *iommu_group;
@@ -830,13 +831,10 @@ static int vfio_pci_fill_devs(struct pci_dev *pdev, void *data)if (!iommu_group)return -EPERM ;/* Cannot reset non-isolated devices */ - info.group_id =iommu_group_id (iommu_group); + info->group_id =iommu_group_id (iommu_group);iommu_group_put (iommu_group); } -if (copy_to_user (fill->devices, &info,sizeof (info))) -return -EFAULT ; - fill->devices++;return 0 ; }
@@ -1258,10 +1256,11 @@ static int vfio_pci_ioctl_get_pci_hot_reset_info( {unsigned long minsz = offsetofend(struct vfio_pci_hot_reset_info, count); +struct vfio_pci_dependent_device *devices =NULL ;struct vfio_pci_hot_reset_info hdr;struct vfio_pci_fill_info fill = {};bool slot = false; -int ret =0 ; +int ret, count;if (copy_from_user (&hdr, arg, minsz))return -EFAULT ;
@@ -1277,9 +1276,23 @@ static int vfio_pci_ioctl_get_pci_hot_reset_info(else if (pci_probe_reset_bus (vdev->pdev->bus))return -ENODEV ; - fill.devices = arg->devices; - fill.devices_end = arg->devices + - (hdr.argsz -sizeof (hdr)) /sizeof (arg->devices[0 ]); + ret =vfio_pci_for_each_slot_or_bus (vdev->pdev, vfio_pci_count_devs, + &count, slot); +if (ret) +return ret; + +if (count > (hdr.argsz -sizeof (hdr)) /sizeof (*devices)) { + hdr.count = count; + ret = -ENOSPC ; + goto header; + } + + devices =kcalloc (count,sizeof (*devices),GFP_KERNEL ); +if (!devices) +return -ENOMEM ; + + fill.devices = devices; + fill.nr_devices = count; fill.vdev = &vdev->vdev;if (vfio_device_cdev_opened (&vdev->vdev))
@@ -1291,16 +1304,23 @@ static int vfio_pci_ioctl_get_pci_hot_reset_info( &fill, slot);mutex_unlock (&vdev->vdev.dev_set->lock);if (ret) -return ret; + goto out; + +if (copy_to_user (arg->devices, devices, +sizeof (*devices) * fill.count)) { + ret = -EFAULT ; + goto out; + } hdr.count = fill.count; hdr.flags = fill.flags; -if (copy_to_user (arg, &hdr, minsz)) -return -EFAULT ; -if (fill.count > fill.devices - arg->devices) -return -ENOSPC ; -return 0 ; +header: +if (copy_to_user (arg, &hdr, minsz)) + ret = -EFAULT ; +out: +kfree (devices); +return ret; } static int
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/250 usb: typec: qcom-pmic-typec: split HPD bridge alloc and registration
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 718b36a7b49acbba36546371db2d235271ceb06c ]
If a probe function returns -EPROBE_DEFER after creating another device there is a change of ending up in a probe deferral loop, (see commit fbc35b45f9f6 ("Add documentation on meaning of -EPROBE_DEFER"). In case of the qcom-pmic-typec driver the tcpm_register_port() function looks up external resources (USB role switch and inherently via called typec_register_port() USB-C muxes, switches and retimers).
In order to prevent such probe-defer loops caused by qcom-pmic-typec driver, use the API added by Johan Hovold and move HPD bridge registration to the end of the probe function.
The devm_drm_dp_hpd_bridge_add() is called at the end of the probe function after all TCPM start functions. This is done as a way to overcome a different problem, the DRM subsystem can not properly cope with the DRM bridges being destroyed once the bridge is attached. Having this function call at the end of the probe function prevents possible DRM bridge device creation followed by destruction in case one of the TCPM start functions returns an error.
--- drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c +8 -2
@@ -41,7 +41,7 @@ static int qcom_pmic_typec_probe(struct platform_device *pdev)struct device_node *np = dev->of_node;const struct pmic_typec_resources *res;struct regmap *regmap; -struct device *bridge_dev; +struct auxiliary_device *bridge_dev;u32 base;int ret;
@@ -92,7 +92,7 @@ static int qcom_pmic_typec_probe(struct platform_device *pdev)if (!tcpm->tcpc.fwnode)return -EINVAL ; - bridge_dev =drm_dp_hpd_bridge_register (tcpm->dev,to_of_node (tcpm->tcpc.fwnode)); + bridge_dev =devm_drm_dp_hpd_bridge_alloc (tcpm->dev,to_of_node (tcpm->tcpc.fwnode));if (IS_ERR (bridge_dev))return PTR_ERR (bridge_dev);
@@ -110,8 +110,14 @@ static int qcom_pmic_typec_probe(struct platform_device *pdev)if (ret) goto port_stop; + ret =devm_drm_dp_hpd_bridge_add (tcpm->dev, bridge_dev); +if (ret) + goto pdphy_stop; +return 0 ; +pdphy_stop: + tcpm->pdphy_stop (tcpm); port_stop: tcpm->port_stop (tcpm); port_unregister:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/250 cpufreq: amd-pstate: fix memory leak on CPU EPP exit
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Ma <[email protected]>
[ Upstream commit cea04f3d9aeebda9d9c063c0dfa71e739c322c81 ]
The cpudata memory from kzalloc() in amd_pstate_epp_cpu_init() is not freed in the analogous exit function, so fix that.
--- drivers/cpufreq/amd-pstate.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/cpufreq/amd-pstate.c +7 -0
@@ -1462,6 +1462,13 @@ static int amd_pstate_epp_cpu_init(struct cpufreq_policy *policy)static int amd_pstate_epp_cpu_exit (struct cpufreq_policy *policy) { +struct amd_cpudata *cpudata = policy->driver_data; + +if (cpudata) { +kfree (cpudata); + policy->driver_data =NULL ; + } +pr_debug ("CPU %d exiting\n" , policy->cpu);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/250 ACPI: EC: Install address space handler at the namespace root
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 60fa6ae6e6d09e377fce6f8d9b6f6a4d88769f63 ]
It is reported that _DSM evaluation fails in ucsi_acpi_dsm() on Lenovo IdeaPad Pro 5 due to a missing address space handler for the EC address space:
ACPI Error: No handler for Region [ECSI] (000000007b8176ee) [EmbeddedControl] (20230628/evregion-130)
This happens because if there is no ECDT, the EC driver only registers the EC address space handler for operation regions defined in the EC device scope of the ACPI namespace while the operation region being accessed by the _DSM in question is located beyond that scope.
To address this, modify the ACPI EC driver to install the EC address space handler at the root of the ACPI namespace for the first EC that can be found regardless of whether or not an ECDT is present.
Note that this change is consistent with some examples in the ACPI specification in which EC operation regions located outside the EC device scope are used (for example, see Section 9.17.15 in ACPI 6.5), so the current behavior of the EC driver is arguably questionable.
--- drivers/acpi/ec.c | 25 ++++++++++++++++--------- drivers/acpi/internal.h | 1 - 2 files changed, 16 insertions(+), 10 deletions(-)
drivers/acpi/ec.c +16 -9
@@ -1482,13 +1482,14 @@ static bool install_gpio_irq_event_handler(struct acpi_ec *ec)static int ec_install_handlers (struct acpi_ec *ec,struct acpi_device *device,bool call_reg) { +acpi_handle scope_handle = ec == first_ec ?ACPI_ROOT_OBJECT : ec->handle;acpi_status status;acpi_ec_start (ec, false);if (!test_bit (EC_FLAGS_EC_HANDLER_INSTALLED , &ec->flags)) {acpi_ec_enter_noirq (ec); - status =acpi_install_address_space_handler_no_reg (ec->handle, + status =acpi_install_address_space_handler_no_reg (scope_handle,ACPI_ADR_SPACE_EC , &acpi_ec_space_handler,NULL , ec);
@@ -1497,11 +1498,10 @@ static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device,return -ENODEV ; }set_bit (EC_FLAGS_EC_HANDLER_INSTALLED , &ec->flags); - ec->address_space_handler_holder = ec->handle; }if (call_reg && !test_bit (EC_FLAGS_EC_REG_CALLED , &ec->flags)) { -acpi_execute_reg_methods (ec->handle,ACPI_ADR_SPACE_EC ); +acpi_execute_reg_methods (scope_handle,ACPI_ADR_SPACE_EC );set_bit (EC_FLAGS_EC_REG_CALLED , &ec->flags); }
@@ -1553,10 +1553,13 @@ static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device,static void ec_remove_handlers (struct acpi_ec *ec) { +acpi_handle scope_handle = ec == first_ec ?ACPI_ROOT_OBJECT : ec->handle; +if (test_bit (EC_FLAGS_EC_HANDLER_INSTALLED , &ec->flags)) {if (ACPI_FAILURE (acpi_remove_address_space_handler ( - ec->address_space_handler_holder, -ACPI_ADR_SPACE_EC , &acpi_ec_space_handler))) + scope_handle, +ACPI_ADR_SPACE_EC , + &acpi_ec_space_handler)))pr_err ("failed to remove space handler\n" );clear_bit (EC_FLAGS_EC_HANDLER_INSTALLED , &ec->flags); }
@@ -1595,14 +1598,18 @@ static int acpi_ec_setup(struct acpi_ec *ec, struct acpi_device *device, bool ca {int ret; - ret =ec_install_handlers (ec, device, call_reg); -if (ret) -return ret; -/* First EC capable of handling transactions */ if (!first_ec) first_ec = ec; + ret =ec_install_handlers (ec, device, call_reg); +if (ret) { +if (ec == first_ec) + first_ec =NULL ; + +return ret; + } +pr_info ("EC_CMD/EC_SC=0x%lx, EC_DATA=0x%lx\n" , ec->command_addr, ec->data_addr);
drivers/acpi/internal.h +0 -1
@@ -185,7 +185,6 @@ enum acpi_ec_event_state {struct acpi_ec {acpi_handle handle; -acpi_handle address_space_handler_holder;int gpe;int irq;unsigned long command_addr;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/250 PCI: Do not wait for disconnected devices when resuming
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 6613443ffc49d03e27f0404978f685c4eac43fba ]
On runtime resume, pci_dev_wait() is called:
pci_pm_runtime_resume()
pci_pm_bridge_power_up_actions()
pci_bridge_wait_for_secondary_bus()
pci_dev_wait()While a device is runtime suspended along with its PCI hierarchy, the device could get disconnected. In such case, the link will not come up no matter how long pci_dev_wait() waits for it.
Besides the above mentioned case, there could be other ways to get the device disconnected while pci_dev_wait() is waiting for the link to come up.
Make pci_dev_wait() exit if the device is already disconnected to avoid unnecessary delay.
The use cases of pci_dev_wait() boil down to two:
1. Waiting for the device after reset
2. pci_bridge_wait_for_secondary_bus()
The callers in both cases seem to benefit from propagating the disconnection as error even if device disconnection would be more analoguous to the case where there is no device in the first place which return 0 from pci_dev_wait(). In the case 2, it results in unnecessary marking of the devices disconnected again but that is just harmless extra work.
Also make sure compiler does not become too clever with dev->error_state and use READ_ONCE() to force a fetch for the up-to-date value.
--- drivers/pci/pci.c | 5 +++++ include/linux/pci.h | 7 ++++++- 2 files changed, 11 insertions(+), 1 deletion(-)
drivers/pci/pci.c +5 -0
@@ -1277,6 +1277,11 @@ static int pci_dev_wait(struct pci_dev *dev, char *reset_type, int timeout)for (;;) {u32 id; +if (pci_dev_is_disconnected (dev)) { +pci_dbg (dev,"disconnected; not waiting\n" ); +return -ENOTTY ; + } +pci_read_config_dword (dev,PCI_COMMAND , &id);if (!PCI_POSSIBLE_ERROR (id))break ;
include/linux/pci.h +6 -1
@@ -2519,7 +2519,12 @@ static inline struct pci_dev *pcie_find_root_port(struct pci_dev *dev)static inline bool pci_dev_is_disconnected (const struct pci_dev *dev) { -return dev->error_state == pci_channel_io_perm_failure; +/* +* error_state is set in pci_dev_set_io_state() using xchg/cmpxchg() +* and read w/o common lock. READ_ONCE() ensures compiler cannot cache +* the value (e.g. inside the loop in pci_dev_wait()). +*/ +return READ_ONCE (dev->error_state) == pci_channel_io_perm_failure; }void pci_request_acs (void );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/250 OPP: Fix required_opp_tables for multiple genpds using same table
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <[email protected]>
[ Upstream commit 2a56c462fe5a2ee61d38e2d7b772bee56115a00c ]
The required_opp_tables parsing is not perfect, as the OPP core does the parsing solely based on the DT node pointers.
The core sets the required_opp_tables entry to the first OPP table in the "opp_tables" list, that matches with the node pointer.
If the target DT OPP table is used by multiple devices and they all create separate instances of 'struct opp_table' from it, then it is possible that the required_opp_tables entry may be set to the incorrect sibling device.
Unfortunately, there is no clear way to initialize the right values during the initial parsing and we need to do this at a later point of time.
Cross check the OPP table again while the genpds are attached and fix them if required.
Also add a new API for the genpd core to fetch the device pointer for the genpd.
--- drivers/opp/core.c | 31 ++++++++++++++++++++++++++++++- drivers/pmdomain/core.c | 10 ++++++++++ include/linux/pm_domain.h | 6 ++++++ 3 files changed, 46 insertions(+), 1 deletion(-)
drivers/opp/core.c +30 -1
@@ -2394,7 +2394,8 @@ static void _opp_detach_genpd(struct opp_table *opp_table)static int _opp_attach_genpd (struct opp_table *opp_table,struct device *dev,const char *const *names,struct device ***virt_devs) { -struct device *virt_dev; +struct device *virt_dev, *gdev; +struct opp_table *genpd_table;int index =0 , ret = -EINVAL ;const char *const *name = names;
@@ -2427,6 +2428,34 @@ static int _opp_attach_genpd(struct opp_table *opp_table, struct device *dev, goto err; } +/* +* The required_opp_tables parsing is not perfect, as the OPP +* core does the parsing solely based on the DT node pointers. +* The core sets the required_opp_tables entry to the first OPP +* table in the "opp_tables" list, that matches with the node +* pointer. +* +* If the target DT OPP table is used by multiple devices and +* they all create separate instances of 'struct opp_table' from +* it, then it is possible that the required_opp_tables entry +* may be set to the incorrect sibling device. +* +* Cross check it again and fix if required. +*/ + gdev =dev_to_genpd_dev (virt_dev); +if (IS_ERR (gdev)) +return PTR_ERR (gdev); + + genpd_table =_find_opp_table (gdev); +if (!IS_ERR (genpd_table)) { +if (genpd_table != opp_table->required_opp_tables[index]) { +dev_pm_opp_put_opp_table (opp_table->required_opp_tables[index]); + opp_table->required_opp_tables[index] = genpd_table; + }else { +dev_pm_opp_put_opp_table (genpd_table); + } + } +/* * Add the virtual genpd device as a user of the OPP table, so * we can call dev_pm_opp_set_opp() on it directly.
drivers/pmdomain/core.c +10 -0
@@ -184,6 +184,16 @@ static struct generic_pm_domain *dev_to_genpd(struct device *dev)return pd_to_genpd (dev->pm_domain); } +struct device *dev_to_genpd_dev (struct device *dev) +{ +struct generic_pm_domain *genpd =dev_to_genpd (dev); + +if (IS_ERR (genpd)) +return ERR_CAST (genpd); + +return &genpd->dev; +} +static int genpd_stop_dev (const struct generic_pm_domain *genpd,struct device *dev) {
include/linux/pm_domain.h +6 -0
@@ -260,6 +260,7 @@ int pm_genpd_remove_subdomain(struct generic_pm_domain *genpd,int pm_genpd_init (struct generic_pm_domain *genpd,struct dev_power_governor *gov,bool is_off);int pm_genpd_remove (struct generic_pm_domain *genpd); +struct device *dev_to_genpd_dev (struct device *dev);int dev_pm_genpd_set_performance_state (struct device *dev,unsigned int state);int dev_pm_genpd_add_notifier (struct device *dev,struct notifier_block *nb);int dev_pm_genpd_remove_notifier (struct device *dev);
@@ -307,6 +308,11 @@ static inline int pm_genpd_remove(struct generic_pm_domain *genpd)return -EOPNOTSUPP ; } +static inline struct device *dev_to_genpd_dev (struct device *dev) +{ +return ERR_PTR (-EOPNOTSUPP ); +} +static inline int dev_pm_genpd_set_performance_state (struct device *dev,unsigned int state) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/250 ALSA: hda: cs35l41: Possible null pointer dereference in cs35l41_hda_unbind()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Trimmer <[email protected]>
[ Upstream commit 6386682cdc8b41319c92fbbe421953e33a28840c ]
The cs35l41_hda_unbind() function clears the hda_component entry matching it's index and then dereferences the codec pointer held in the first element of the hda_component array, this is an issue when the device index was 0.
Instead use the codec pointer stashed in the cs35l41_hda structure as it will still be valid.
--- sound/pci/hda/cs35l41_hda.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/cs35l41_hda.c +1 -1
@@ -1362,7 +1362,7 @@ static void cs35l41_hda_unbind(struct device *dev, struct device *master, void *if (comps[cs35l41->index].dev == dev) {memset (&comps[cs35l41->index],0 ,sizeof (*comps)); sleep_flags =lock_system_sleep (); -device_link_remove (&comps->codec->core.dev, cs35l41->dev); +device_link_remove (&cs35l41->codec->core.dev, cs35l41->dev);unlock_system_sleep (sleep_flags); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/250 ALSA: seq: ump: Fix missing System Reset message handling
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 55fac50ea46f46a22a92e2139b92afaa3822ad19 ]
The conversion from System Reset event to UMP was missing. Add the entry for a conversion to a proper UMP System message.
--- sound/core/seq/seq_ump_convert.c | 2 ++ 1 file changed, 2 insertions(+)
sound/core/seq/seq_ump_convert.c +2 -0
@@ -1075,6 +1075,8 @@ static const struct seq_ev_to_ump seq_ev_ump_encoders[] = { system_ev_to_ump_midi1, system_ev_to_ump_midi2 }, { SNDRV_SEQ_EVENT_SENSING, UMP_SYSTEM_STATUS_ACTIVE_SENSING, system_ev_to_ump_midi1, system_ev_to_ump_midi2 }, + { SNDRV_SEQ_EVENT_RESET, UMP_SYSTEM_STATUS_RESET, + system_ev_to_ump_midi1, system_ev_to_ump_midi2 }, };static const struct seq_ev_to_ump *find_ump_encoder (int type)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/250 MIPS: Routerboard 532: Fix vendor retry check code
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit ae9daffd9028f2500c9ac1517e46d4f2b57efb80 ]
read_config_dword() contains strange condition checking ret for a number of values. The ret variable, however, is always zero because config_access() never returns anything else. Thus, the retry is always taken until number of tries is exceeded.
The code looks like it wants to check *val instead of ret to see if the read gave an error response.
--- arch/mips/pci/ops-rc32434.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/mips/pci/ops-rc32434.c +2 -2
@@ -112,8 +112,8 @@ static int read_config_dword(struct pci_bus *bus, unsigned int devfn,* gives them time to settle */ if (where ==PCI_VENDOR_ID ) { -if (ret ==0xffffffff || ret ==0x00000000 || - ret ==0x0000ffff || ret ==0xffff0000 ) { +if (*val ==0xffffffff || *val ==0x00000000 || + *val ==0x0000ffff || *val ==0xffff0000 ) {if (delay >4 )return 0 ; delay *=2 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/250 mips: bmips: BCM6358: make sure CBR is correctly set
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Marangi <[email protected]>
[ Upstream commit ce5cdd3b05216b704a704f466fb4c2dff3778caf ]
It was discovered that some device have CBR address set to 0 causing kernel panic when arch_sync_dma_for_cpu_all is called.
This was notice in situation where the system is booted from TP1 and BMIPS_GET_CBR() returns 0 instead of a valid address and !!(read_c0_brcm_cmt_local() & (1 << 31)); not failing.
The current check whether RAC flush should be disabled or not are not enough hence lets check if CBR is a valid address or not.
--- arch/mips/bmips/setup.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/mips/bmips/setup.c +2 -1
@@ -110,7 +110,8 @@ static void bcm6358_quirks(void)* RAC flush causes kernel panics on BCM6358 when booting from TP1 * because the bootloader is not initializing it properly. */ - bmips_rac_flush_disable = !!(read_c0_brcm_cmt_local () & (1 <<31 )); + bmips_rac_flush_disable = !!(read_c0_brcm_cmt_local () & (1 <<31 )) || + !!BMIPS_GET_CBR (); }static void bcm6368_quirks (void )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/250 tracing: Build event generation tests only as modules
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit 3572bd5689b0812b161b40279e39ca5b66d73e88 ]
The kprobes and synth event generation test modules add events and lock (get a reference) those event file reference in module init function, and unlock and delete it in module exit function. This is because those are designed for playing as modules.
If we make those modules as built-in, those events are left locked in the kernel, and never be removed. This causes kprobe event self-test failure as below.
[ 97.349708] ------------[ cut here ]------------ [ 97.353453] WARNING: CPU: 3 PID: 1 at kernel/trace/trace_kprobe.c:2133 kprobe_trace_self_tests_init+0x3f1/0x480 [ 97.357106] Modules linked in: [ 97.358488] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 6.9.0-g699646734ab5-dirty #14 [ 97.361556] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 97.363880] RIP: 0010:kprobe_trace_self_tests_init+0x3f1/0x480 [ 97.365538] Code: a8 24 08 82 e9 ae fd ff ff 90 0f 0b 90 48 c7 c7 e5 aa 0b 82 e9 ee fc ff ff 90 0f 0b 90 48 c7 c7 2d 61 06 82 e9 8e fd ff ff 90 <0f> 0b 90 48 c7 c7 33 0b 0c 82 89 c6 e8 6e 03 1f ff 41 ff c7 e9 90 [ 97.370429] RSP: 0000:ffffc90000013b50 EFLAGS: 00010286 [ 97.371852] RAX: 00000000fffffff0 RBX: ffff888005919c00 RCX: 0000000000000000 [ 97.373829] RDX: ffff888003f40000 RSI: ffffffff8236a598 RDI: ffff888003f40a68 [ 97.375715] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 97.377675] R10: ffffffff811c9ae5 R11: ffffffff8120c4e0 R12: 0000000000000000 [ 97.379591] R13: 0000000000000001 R14: 0000000000000015 R15: 0000000000000000 [ 97.381536] FS: 0000000000000000(0000) GS:ffff88807dcc0000(0000) knlGS:0000000000000000 [ 97.383813] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 97.385449] CR2: 0000000000000000 CR3: 0000000002244000 CR4: 00000000000006b0 [ 97.387347] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 97.389277] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 97.391196] Call Trace: [ 97.391967] <TASK> [ 97.392647] ? __warn+0xcc/0x180 [ 97.393640] ? kprobe_trace_self_tests_init+0x3f1/0x480 [ 97.395181] ? report_bug+0xbd/0x150 [ 97.396234] ? handle_bug+0x3e/0x60 [ 97.397311] ? exc_invalid_op+0x1a/0x50 [ 97.398434] ? asm_exc_invalid_op+0x1a/0x20 [ 97.399652] ? trace_kprobe_is_busy+0x20/0x20 [ 97.400904] ? tracing_reset_all_online_cpus+0x15/0x90 [ 97.402304] ? kprobe_trace_self_tests_init+0x3f1/0x480 [ 97.403773] ? init_kprobe_trace+0x50/0x50 [ 97.404972] do_one_initcall+0x112/0x240 [ 97.406113] do_initcall_level+0x95/0xb0 [ 97.407286] ? kernel_init+0x1a/0x1a0 [ 97.408401] do_initcalls+0x3f/0x70 [ 97.409452] kernel_init_freeable+0x16f/0x1e0 [ 97.410662] ? rest_init+0x1f0/0x1f0 [ 97.411738] kernel_init+0x1a/0x1a0 [ 97.412788] ret_from_fork+0x39/0x50 [ 97.413817] ? rest_init+0x1f0/0x1f0 [ 97.414844] ret_from_fork_asm+0x11/0x20 [ 97.416285] </TASK> [ 97.417134] irq event stamp: 13437323 [ 97.418376] hardirqs last enabled at (13437337): [<ffffffff8110bc0c>] console_unlock+0x11c/0x150 [ 97.421285] hardirqs last disabled at (13437370): [<ffffffff8110bbf1>] console_unlock+0x101/0x150 [ 97.423838] softirqs last enabled at (13437366): [<ffffffff8108e17f>] handle_softirqs+0x23f/0x2a0 [ 97.426450] softirqs last disabled at (13437393): [<ffffffff8108e346>] __irq_exit_rcu+0x66/0xd0 [ 97.428850] ---[ end trace 0000000000000000 ]---
And also, since we can not cleanup dynamic_event file, ftracetest are failed too.
To avoid these issues, build these tests only as modules.
--- kernel/trace/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/trace/Kconfig +2 -2
@@ -1123,7 +1123,7 @@ config PREEMPTIRQ_DELAY_TEST config SYNTH_EVENT_GEN_TEST tristate "Test module for in-kernel synthetic event generation" - depends on SYNTH_EVENTS + depends on SYNTH_EVENTS && m help This option creates a test module to check the base functionality of in-kernel synthetic event definition and
@@ -1136,7 +1136,7 @@ config SYNTH_EVENT_GEN_TEST config KPROBE_EVENT_GEN_TEST tristate "Test module for in-kernel kprobe event generation" - depends on KPROBE_EVENTS + depends on KPROBE_EVENTS && m help This option creates a test module to check the base functionality of in-kernel kprobe event definition.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/250 wifi: iwlwifi: mvm: fix ROC version check
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaul Triebitz <[email protected]>
[ Upstream commit 4c2bed6042fb6aca1d1d4f291f85461b1d5ac08c ]
For using the ROC command, check that the ROC version is *greater or equal* to 3, rather than *equal* to 3. The ROC version was added to the TLV starting from version 3.
--- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +1 -1
@@ -4643,7 +4643,7 @@ static int iwl_mvm_roc_station(struct iwl_mvm *mvm,if (fw_ver ==IWL_FW_CMD_VER_UNKNOWN ) { ret =iwl_mvm_send_aux_roc_cmd (mvm, channel, vif, duration); - }else if (fw_ver ==3 ) { + }else if (fw_ver >=3 ) { ret =iwl_mvm_roc_add_cmd (mvm, channel, vif, duration,ROC_ACTIVITY_HOTSPOT ); }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/250 wifi: mac80211: Recalc offload when monitor stop
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Remi Pommarel <[email protected]>
[ Upstream commit 7d09e17c0415fe6d946044c7e70bce31cda952ec ]
When a monitor interface is started, ieee80211_recalc_offload() is called and 802.11 encapsulation offloading support get disabled so monitor interface could get native wifi frames directly. But when this interface is stopped there is no need to keep the 802.11 encpasulation offloading off.
This call ieee80211_recalc_offload() when monitor interface is stopped so 802.11 encapsulation offloading gets re-activated if possible.
--- net/mac80211/iface.c | 1 + 1 file changed, 1 insertion(+)
net/mac80211/iface.c +1 -0
@@ -686,6 +686,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_doieee80211_del_virtual_monitor (local);ieee80211_recalc_idle (local); +ieee80211_recalc_offload (local);if (!(sdata->u.mntr.flags &MONITOR_FLAG_ACTIVE ))break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/250 ALSA: hda/realtek: Remove Framework Laptop 16 from quirks
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dustin L. Howett <[email protected]>
[ Upstream commit e799bdf51d54bebaf939fdb655aad424e624c1b1 ]
The Framework Laptop 16 does not have a combination headphone/headset 3.5mm jack; however, applying the pincfg from the Laptop 13 (nid=0x19) erroneously informs hda that the node is present.
--- sound/pci/hda/patch_realtek.c | 1 - 1 file changed, 1 deletion(-)
sound/pci/hda/patch_realtek.c +0 -1
@@ -10592,7 +10592,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x8086 ,0x2081 ,"Intel NUC 10" ,ALC256_FIXUP_INTEL_NUC10 ),SND_PCI_QUIRK (0x8086 ,0x3038 ,"Intel NUC 13" ,ALC295_FIXUP_CHROME_BOOK ),SND_PCI_QUIRK (0xf111 ,0x0001 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), -SND_PCI_QUIRK (0xf111 ,0x0005 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0xf111 ,0x0006 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), #if 0
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/250 ALSA/hda: intel-dsp-config: Document AVS as dsp_driver option
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit 2646b43910c0e6d7f4ad535919b44b88f98c688d ]
dsp_driver=4 will force the AVS driver stack to be used, it is better to docuement this.
--- sound/hda/intel-dsp-config.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/hda/intel-dsp-config.c +1 -1
@@ -16,7 +16,7 @@static int dsp_driver;module_param (dsp_driver, int,0444 ); -MODULE_PARM_DESC (dsp_driver,"Force the DSP driver for Intel DSP (0=auto, 1=legacy, 2=SST, 3=SOF)" ); +MODULE_PARM_DESC (dsp_driver,"Force the DSP driver for Intel DSP (0=auto, 1=legacy, 2=SST, 3=SOF, 4=AVS)" );#define FLAG_SST BIT(0)#define FLAG_SOF BIT(1)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/250 ice: avoid IRQ collision to fix init failure on ACPI S3 resume
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: En-Wei Wu <[email protected]>
[ Upstream commit bc69ad74867dba1377abe14356c94a946d9837a3 ]
A bug in https://bugzilla.kernel.org/show_bug.cgi?id=218906 describes that irdma would break and report hardware initialization failed after suspend/resume with Intel E810 NIC (tested on 6.9.0-rc5).
The problem is caused due to the collision between the irq numbers requested in irdma and the irq numbers requested in other drivers after suspend/resume.
The irq numbers used by irdma are derived from ice's ice_pf->msix_entries which stores mappings between MSI-X index and Linux interrupt number. It's supposed to be cleaned up when suspend and rebuilt in resume but it's not, causing irdma using the old irq numbers stored in the old ice_pf->msix_entries to request_irq() when resume. And eventually collide with other drivers.
This patch fixes this problem. On suspend, we call ice_deinit_rdma() to clean up the ice_pf->msix_entries (and free the MSI-X vectors used by irdma if we've dynamically allocated them). On resume, we call ice_init_rdma() to rebuild the ice_pf->msix_entries (and allocate the MSI-X vectors if we would like to dynamically allocate them).
--- drivers/net/ethernet/intel/ice/ice_main.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_main.c +6 -1
@@ -5451,7 +5451,7 @@ static int __maybe_unused ice_suspend(struct device *dev)*/ disabled =ice_service_task_stop (pf); -ice_unplug_aux_dev (pf); +ice_deinit_rdma (pf);/* Already suspended?, then there is nothing to do */ if (test_and_set_bit (ICE_SUSPENDED , pf->state)) {
@@ -5531,6 +5531,11 @@ static int __maybe_unused ice_resume(struct device *dev)if (ret)dev_err (dev,"Cannot restore interrupt scheme: %d\n" , ret); + ret =ice_init_rdma (pf); +if (ret) +dev_err (dev,"Reinitialize RDMA during resume failed: %d\n" , + ret); +clear_bit (ICE_DOWN , pf->state);/* Now perform PF reset and rebuild */ reset_type =ICE_RESET_PFR ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/250 ice: fix 200G link speed message log
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Greenwalt <[email protected]>
[ Upstream commit aeccadb24d9dacdde673a0f68f0a9135c6be4993 ]
Commit 24407a01e57c ("ice: Add 200G speed/phy type use") added support for 200G PHY speeds, but did not include 200G link speed message support. As a result the driver incorrectly reports Unknown for 200G link speed.
Fix this by adding 200G support to ice_print_link_msg().
--- drivers/net/ethernet/intel/ice/ice_main.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/intel/ice/ice_main.c +3 -0
@@ -803,6 +803,9 @@ void ice_print_link_msg(struct ice_vsi *vsi, bool isup) }switch (vsi->port_info->phy.link_info.link_speed) { +case ICE_AQ_LINK_SPEED_200GB : + speed ="200 G" ; +break ;case ICE_AQ_LINK_SPEED_100GB : speed ="100 G" ;break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/250 ice: implement AQ download pkg retry
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wojciech Drewek <[email protected]>
[ Upstream commit a27f6ac9d404ea84196639dcc456f969ef813c0f ]
ice_aqc_opc_download_pkg (0x0C40) AQ sporadically returns error due to FW issue. Fix this by retrying five times before moving to Safe Mode. Sleep for 20 ms before retrying. This was tested with the 4.40 firmware.
--- drivers/net/ethernet/intel/ice/ice_ddp.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/ice/ice_ddp.c +21 -2
@@ -1329,6 +1329,7 @@ ice_dwnld_cfg_bufs_no_lock(struct ice_hw *hw, struct ice_buf *bufs, u32 start,for (i =0 ; i < count; i++) {bool last = false; +int try_cnt =0 ;int status; bh = (struct ice_buf_hdr *)(bufs + start + i);
@@ -1336,8 +1337,26 @@ ice_dwnld_cfg_bufs_no_lock(struct ice_hw *hw, struct ice_buf *bufs, u32 start,if (indicate_last) last =ice_is_last_download_buffer (bh, i, count); - status =ice_aq_download_pkg (hw, bh,ICE_PKG_BUF_SIZE , last, - &offset, &info,NULL ); +while (1 ) { + status =ice_aq_download_pkg (hw, bh,ICE_PKG_BUF_SIZE , + last, &offset, &info, +NULL ); +if (hw->adminq.sq_last_status !=ICE_AQ_RC_ENOSEC && + hw->adminq.sq_last_status !=ICE_AQ_RC_EBADSIG ) +break ; + + try_cnt++; + +if (try_cnt ==5 ) +break ; + +msleep (20 ); + } + +if (try_cnt) +dev_dbg (ice_hw_to_dev (hw), +"ice_aq_download_pkg number of retries: %d\n" , + try_cnt);/* Save AQ status from download package */ if (status) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/250 bpf: Fix reg_set_min_max corruption of fake_reg
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 92424801261d1564a0bb759da3cf3ccd69fdf5a2 ]
Juan reported that after doing some changes to buzzer [0] and implementing a new fuzzing strategy guided by coverage, they noticed the following in one of the probes:
[...]
13: (79) r6 = *(u64 *)(r0 +0) ; R0=map_value(ks=4,vs=8) R6_w=scalar() 14: (b7) r0 = 0 ; R0_w=0 15: (b4) w0 = -1 ; R0_w=0xffffffff 16: (74) w0 >>= 1 ; R0_w=0x7fffffff 17: (5c) w6 &= w0 ; R0_w=0x7fffffff R6_w=scalar(smin=smin32=0,smax=umax=umax32=0x7fffffff,var_off=(0x0; 0x7fffffff)) 18: (44) w6 |= 2 ; R6_w=scalar(smin=umin=smin32=umin32=2,smax=umax=umax32=0x7fffffff,var_off=(0x2; 0x7ffffffd))
19: (56) if w6 != 0x7ffffffd goto pc+1
REG INVARIANTS VIOLATION (true_reg2): range bounds violation u64=[0x7fffffff, 0x7ffffffd] s64=[0x7fffffff, 0x7ffffffd] u32=[0x7fffffff, 0x7ffffffd] s32=[0x7fffffff, 0x7ffffffd] var_off=(0x7fffffff, 0x0) REG INVARIANTS VIOLATION (false_reg1): range bounds violation u64=[0x7fffffff, 0x7ffffffd] s64=[0x7fffffff, 0x7ffffffd] u32=[0x7fffffff, 0x7ffffffd] s32=[0x7fffffff, 0x7ffffffd] var_off=(0x7fffffff, 0x0) REG INVARIANTS VIOLATION (false_reg2): const tnum out of sync with range bounds u64=[0x0, 0xffffffffffffffff] s64=[0x8000000000000000, 0x7fffffffffffffff] u32=[0x0, 0xffffffff] s32=[0x80000000, 0x7fffffff] var_off=(0x7fffffff, 0x0) 19: R6_w=0x7fffffff
20: (95) exit
from 19 to 21: R0=0x7fffffff R6=scalar(smin=umin=smin32=umin32=2,smax=umax=smax32=umax32=0x7ffffffe,var_off=(0x2; 0x7ffffffd)) R7=map_ptr(ks=4,vs=8) R9=ctx() R10=fp0 fp-24=map_ptr(ks=4,vs=8) fp-40=mmmmmmmm 21: R0=0x7fffffff R6=scalar(smin=umin=smin32=umin32=2,smax=umax=smax32=umax32=0x7ffffffe,var_off=(0x2; 0x7ffffffd)) R7=map_ptr(ks=4,vs=8) R9=ctx() R10=fp0 fp-24=map_ptr(ks=4,vs=8) fp-40=mmmmmmmm
21: (14) w6 -= 2147483632 ; R6_w=scalar(smin=umin=umin32=2,smax=umax=0xffffffff,smin32=0x80000012,smax32=14,var_off=(0x2; 0xfffffffd))
22: (76) if w6 s>= 0xe goto pc+1 ; R6_w=scalar(smin=umin=umin32=2,smax=umax=0xffffffff,smin32=0x80000012,smax32=13,var_off=(0x2; 0xfffffffd))
23: (95) exit
from 22 to 24: R0=0x7fffffff R6_w=14 R7=map_ptr(ks=4,vs=8) R9=ctx() R10=fp0 fp-24=map_ptr(ks=4,vs=8) fp-40=mmmmmmmm 24: R0=0x7fffffff R6_w=14 R7=map_ptr(ks=4,vs=8) R9=ctx() R10=fp0 fp-24=map_ptr(ks=4,vs=8) fp-40=mmmmmmmm
24: (14) w6 -= 14 ; R6_w=0
[...]
What can be seen here is a register invariant violation on line 19. After the binary-or in line 18, the verifier knows that bit 2 is set but knows nothing about the rest of the content which was loaded from a map value, meaning, range is [2,0x7fffffff] with var_off=(0x2; 0x7ffffffd). When in line 19 the verifier analyzes the branch, it splits the register states in reg_set_min_max() into the registers of the true branch (true_reg1, true_reg2) and the registers of the false branch (false_reg1, false_reg2).
Since the test is w6 != 0x7ffffffd, the src_reg is a known constant. Internally, the verifier creates a "fake" register initialized as scalar to the value of 0x7ffffffd, and then passes it onto reg_set_min_max(). Now, for line 19, it is mathematically impossible to take the false branch of this program, yet the verifier analyzes it. It is impossible because the second bit of r6 will be set due to the prior or operation and the constant in the condition has that bit unset (hex(fd) == binary(1111 1101).
When the verifier first analyzes the false / fall-through branch, it will compute an intersection between the var_off of r6 and of the constant. This is because the verifier creates a "fake" register initialized to the value of the constant. The intersection result later refines both registers in regs_refine_cond_op():
[...] t = tnum_intersect(tnum_subreg(reg1->var_off), tnum_subreg(reg2->var_off)); reg1->var_off = tnum_with_subreg(reg1->var_off, t); reg2->var_off = tnum_with_subreg(reg2->var_off, t); [...]
Since the verifier is analyzing the false branch of the conditional jump, reg1 is equal to false_reg1 and reg2 is equal to false_reg2, i.e. the reg2 is the "fake" register that was meant to hold a constant value. The resulting var_off of the intersection says that both registers now hold a known value of var_off=(0x7fffffff, 0x0) or in other words: this operation manages to make the verifier think that the "constant" value that was passed in the jump operation now holds a different value.
Normally this would not be an issue since it should not influence the true branch, however, false_reg2 and true_reg2 are pointers to the same "fake" register. Meaning, the false branch can influence the results of the true branch. In line 24, the verifier assumes R6_w=0, but the actual runtime value in this case is 1. The fix is simply not passing in the same "fake" register location as inputs to reg_set_min_max(), but instead making a copy. Moving the fake_reg into the env also reduces stack consumption by 120 bytes. With this, the verifier successfully rejects invalid accesses from the test program.
[0] https://github.com/google/buzzer
--- include/linux/bpf_verifier.h | 2 ++ kernel/bpf/verifier.c | 14 ++++++++++---- 2 files changed, 12 insertions(+), 4 deletions(-)
include/linux/bpf_verifier.h +2 -0
@@ -737,6 +737,8 @@ struct bpf_verifier_env {/* Same as scratched_regs but for stack slots */ u64 scratched_stack_slots;u64 prev_log_pos, prev_insn_print_pos; +/* buffer used to temporary hold constants as scalar registers */ +struct bpf_reg_state fake_reg[2 ];/* buffer used to generate temporary string representations, * e.g., in reg_type_str() to generate reg_type string */
kernel/bpf/verifier.c +10 -4
@@ -14973,7 +14973,6 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env,struct bpf_reg_state *regs = this_branch->frame[this_branch->curframe]->regs;struct bpf_reg_state *dst_reg, *other_branch_regs, *src_reg =NULL ;struct bpf_reg_state *eq_branch_regs; -struct bpf_reg_state fake_reg = {};u8 opcode =BPF_OP (insn->code);bool is_jmp32;int pred =-1 ;
@@ -15039,7 +15038,8 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env,verbose (env,"BPF_JMP/JMP32 uses reserved fields\n" );return -EINVAL ; } - src_reg = &fake_reg; + src_reg = &env->fake_reg[0 ]; +memset (src_reg,0 ,sizeof (*src_reg)); src_reg->type =SCALAR_VALUE ;__mark_reg_known (src_reg, insn->imm); }
@@ -15099,10 +15099,16 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env, &other_branch_regs[insn->src_reg], dst_reg, src_reg, opcode, is_jmp32); }else /* BPF_SRC(insn->code) == BPF_K */ { +/* reg_set_min_max() can mangle the fake_reg. Make a copy +* so that these are two different memory locations. The +* src_reg is not used beyond here in context of K. +*/ +memcpy (&env->fake_reg[1 ], &env->fake_reg[0 ], +sizeof (env->fake_reg[0 ])); err =reg_set_min_max (env, &other_branch_regs[insn->dst_reg], - src_reg/* fake one */ , - dst_reg, src_reg/* same fake one */ , + &env->fake_reg[0 ], + dst_reg, &env->fake_reg[1 ], opcode, is_jmp32); }if (err)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/250 btrfs: zoned: allocate dummy checksums for zoned NODATASUM writes
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Thumshirn <[email protected]>
[ Upstream commit cebae292e0c32a228e8f2219c270a7237be24a6a ]
Shin'ichiro reported that when he's running fstests' test-case btrfs/167 on emulated zoned devices, he's seeing the following NULL pointer dereference in 'btrfs_zone_finish_endio()':
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000011: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f] CPU: 4 PID: 2332440 Comm: kworker/u80:15 Tainted: G W 6.10.0-rc2-kts+ #4 Hardware name: Supermicro Super Server/X11SPi-TF, BIOS 3.3 02/21/2020 Workqueue: btrfs-endio-write btrfs_work_helper [btrfs] RIP: 0010:btrfs_zone_finish_endio.part.0+0x34/0x160 [btrfs]
RSP: 0018:ffff88867f107a90 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff893e5534
RDX: 0000000000000011 RSI: 0000000000000004 RDI: 0000000000000088
RBP: 0000000000000002 R08: 0000000000000001 R09: ffffed1081696028
R10: ffff88840b4b0143 R11: ffff88834dfff600 R12: ffff88840b4b0000
R13: 0000000000020000 R14: 0000000000000000 R15: ffff888530ad5210
FS: 0000000000000000(0000) GS:ffff888e3f800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f87223fff38 CR3: 00000007a7c6a002 CR4: 00000000007706f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace: <TASK> ? __die_body.cold+0x19/0x27 ? die_addr+0x46/0x70 ? exc_general_protection+0x14f/0x250 ? asm_exc_general_protection+0x26/0x30 ? do_raw_read_unlock+0x44/0x70 ? btrfs_zone_finish_endio.part.0+0x34/0x160 [btrfs] btrfs_finish_one_ordered+0x5d9/0x19a0 [btrfs] ? __pfx_lock_release+0x10/0x10 ? do_raw_write_lock+0x90/0x260 ? __pfx_do_raw_write_lock+0x10/0x10 ? __pfx_btrfs_finish_one_ordered+0x10/0x10 [btrfs] ? _raw_write_unlock+0x23/0x40 ? btrfs_finish_ordered_zoned+0x5a9/0x850 [btrfs] ? lock_acquire+0x435/0x500 btrfs_work_helper+0x1b1/0xa70 [btrfs] ? __schedule+0x10a8/0x60b0 ? __pfx___might_resched+0x10/0x10 process_one_work+0x862/0x1410 ? __pfx_lock_acquire+0x10/0x10 ? __pfx_process_one_work+0x10/0x10 ? assign_work+0x16c/0x240 worker_thread+0x5e6/0x1010 ? __pfx_worker_thread+0x10/0x10 kthread+0x2c3/0x3a0 ? trace_irq_enable.constprop.0+0xce/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
Enabling CONFIG_BTRFS_ASSERT revealed the following assertion to trigger:
assertion failed: !list_empty(&ordered->list), in fs/btrfs/zoned.c:1815
This indicates, that we're missing the checksums list on the ordered_extent. As btrfs/167 is doing a NOCOW write this is to be expected.
Further analysis with drgn confirmed the assumption:
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
inode = prog.crashed_thread().stack_trace()[11]['ordered'].inode
btrfs_inode= drgn.container_of(inode, "structbtrfs_inode", \
"vfs_inode")
Quoted 1 line
Quoted 1 line
Quoted 1 line
print(btrfs_inode.flags)
(u32)1
As zoned emulation mode simulates conventional zones on regular devices, we cannot use zone-append for writing. But we're only attaching dummy checksums if we're doing a zone-append write.
So for NOCOW zoned data writes on conventional zones, also attach a dummy checksum.
--- fs/btrfs/bio.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/btrfs/bio.c +3 -1
@@ -741,7 +741,9 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num) ret =btrfs_bio_csum (bbio);if (ret) goto fail_put_bio; - }else if (use_append) { + }else if (use_append || + (btrfs_is_zoned (fs_info) && inode && + inode->flags &BTRFS_INODE_NODATASUM )) { ret =btrfs_alloc_dummy_sum (bbio);if (ret) goto fail_put_bio;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/250 net: mvpp2: use slab_build_skb for oversized frames
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aryan Srivastava <[email protected]>
[ Upstream commit 4467c09bc7a66a17ffd84d6262d48279b26106ea ]
Setting frag_size to 0 to indicate kmalloc has been deprecated, use slab_build_skb directly.
--- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +4 -1
@@ -4013,7 +4013,10 @@ static int mvpp2_rx(struct mvpp2_port *port, struct napi_struct *napi, } } - skb =build_skb (data, frag_size); +if (frag_size) + skb =build_skb (data, frag_size); +else + skb =slab_build_skb (data);if (!skb) {netdev_warn (port->dev,"skb build failed\n" ); goto err_drop_frame;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/250 cipso: fix total option length computation
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ondrej Mosnacek <[email protected]>
[ Upstream commit 9f36169912331fa035d7b73a91252d7c2512eb1a ]
As evident from the definition of ip_options_get(), the IP option IPOPT_END is used to pad the IP option data array, not IPOPT_NOP. Yet the loop that walks the IP options to determine the total IP options length in cipso_v4_delopt() doesn't take IPOPT_END into account.
Fix it by recognizing the IPOPT_END value as the end of actual options.
--- net/ipv4/cipso_ipv4.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
net/ipv4/cipso_ipv4.c +8 -4
@@ -2012,12 +2012,16 @@ static int cipso_v4_delopt(struct ip_options_rcu __rcu **opt_ptr)* from there we can determine the new total option length */ iter =0 ; optlen_new =0 ; -while (iter < opt->opt.optlen) -if (opt->opt.__data[iter] !=IPOPT_NOP ) { +while (iter < opt->opt.optlen) { +if (opt->opt.__data[iter] ==IPOPT_END ) { +break ; + }else if (opt->opt.__data[iter] ==IPOPT_NOP ) { + iter++; + }else { iter += opt->opt.__data[iter +1 ]; optlen_new = iter; - }else - iter++; + } + } hdr_delta = opt->opt.optlen; opt->opt.optlen = (optlen_new +3 ) & ~3 ; hdr_delta -= opt->opt.optlen;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/250 ALSA: hda: cs35l56: Component should be unbound before deconstruction
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Trimmer <[email protected]>
[ Upstream commit 721f2e6653f5ab0cc52b3a459c4a2158b92fcf80 ]
The interface associated with the hda_component should be deactivated before the driver is deconstructed during removal.
--- sound/pci/hda/cs35l56_hda.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/cs35l56_hda.c +2 -2
@@ -1072,12 +1072,12 @@ void cs35l56_hda_remove(struct device *dev) {struct cs35l56_hda *cs35l56 =dev_get_drvdata (dev); +component_del (cs35l56->base.dev, &cs35l56_hda_comp_ops); +pm_runtime_dont_use_autosuspend (cs35l56->base.dev);pm_runtime_get_sync (cs35l56->base.dev);pm_runtime_disable (cs35l56->base.dev); -component_del (cs35l56->base.dev, &cs35l56_hda_comp_ops); -cs_dsp_remove (&cs35l56->cs_dsp);kfree (cs35l56->system_name);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/250 ALSA: hda: cs35l41: Component should be unbound before deconstruction
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Trimmer <[email protected]>
[ Upstream commit 6f9a40d61cad0f5560e8530b4dd4a05fc4d15987 ]
The interface associated with the hda_component should be deactivated before the driver is deconstructed during removal.
--- sound/pci/hda/cs35l41_hda.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/cs35l41_hda.c +2 -2
@@ -1857,6 +1857,8 @@ void cs35l41_hda_remove(struct device *dev) {struct cs35l41_hda *cs35l41 =dev_get_drvdata (dev); +component_del (cs35l41->dev, &cs35l41_hda_comp_ops); +pm_runtime_get_sync (cs35l41->dev);pm_runtime_dont_use_autosuspend (cs35l41->dev);pm_runtime_disable (cs35l41->dev);
@@ -1864,8 +1866,6 @@ void cs35l41_hda_remove(struct device *dev)if (cs35l41->halo_initialized)cs35l41_remove_dsp (cs35l41); -component_del (cs35l41->dev, &cs35l41_hda_comp_ops); -acpi_dev_put (cs35l41->dacpi);pm_runtime_put_noidle (cs35l41->dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/250 ALSA: hda: tas2781: Component should be unbound before deconstruction
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Trimmer <[email protected]>
[ Upstream commit d832b5a03e94a2a9f866dab3d04937a0f84ea116 ]
The interface associated with the hda_component should be deactivated before the driver is deconstructed during removal.
--- sound/pci/hda/tas2781_hda_i2c.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/tas2781_hda_i2c.c +2 -2
@@ -777,11 +777,11 @@ static void tas2781_hda_remove(struct device *dev) {struct tas2781_hda *tas_hda =dev_get_drvdata (dev); +component_del (tas_hda->dev, &tas2781_hda_comp_ops); +pm_runtime_get_sync (tas_hda->dev);pm_runtime_disable (tas_hda->dev); -component_del (tas_hda->dev, &tas2781_hda_comp_ops); -pm_runtime_put_noidle (tas_hda->dev);tasdevice_remove (tas_hda->priv);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/250 bpf: Avoid splat in pskb_pull_reason
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 2bbe3e5a2f4ef69d13be54f1cf895b4658287080 ]
syzkaller builds (CONFIG_DEBUG_NET=y) frequently trigger a debug hint in pskb_may_pull.
We'd like to retain this debug check because it might hint at integer overflows and other issues (kernel code should pull headers, not huge value).
In bpf case, this splat isn't interesting at all: such (nonsensical) bpf programs are typically generated by a fuzzer anyway.
Do what Eric suggested and suppress such warning.
For CONFIG_DEBUG_NET=n we don't need the extra check because pskb_may_pull will do the right thing: return an error without the WARN() backtrace.
--- net/core/filter.c | 5 +++++ 1 file changed, 5 insertions(+)
net/core/filter.c +5 -0
@@ -1662,6 +1662,11 @@ static DEFINE_PER_CPU(struct bpf_scratchpad, bpf_sp);static inline int __bpf_try_make_writable (struct sk_buff *skb,unsigned int write_len) { +#ifdef CONFIG_DEBUG_NET +/* Avoid a splat in pskb_may_pull_reason() */ +if (write_len >INT_MAX ) +return -EINVAL ; +#endif return skb_ensure_writable (skb, write_len); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/250 netdev-genl: fix error codes when outputting XDP features
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 7ed352d34f1a09a7659c53de07785115587499fe ]
-EINVAL will interrupt the dump. The correct error to return if we have more data to dump is -EMSGSIZE.
Discovered by doing:
for i in seq 80; do ip link add type veth; done
./cli.py --dbg-small-recv 5300 --spec netdev.yaml --dump dev-get >> /dev/null [...]
nl_len = 64 (48) nl_flags = 0x0 nl_type = 19
nl_len = 20 (4) nl_flags = 0x2 nl_type = 3error: -22
--- net/core/netdev-genl.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
net/core/netdev-genl.c +8 -8
@@ -59,22 +59,22 @@ XDP_METADATA_KFUNC_xxxnla_put_u64_64bit (rsp,NETDEV_A_DEV_XDP_RX_METADATA_FEATURES , xdp_rx_meta,NETDEV_A_DEV_PAD ) ||nla_put_u64_64bit (rsp,NETDEV_A_DEV_XSK_FEATURES , - xsk_features, NETDEV_A_DEV_PAD)) { -genlmsg_cancel (rsp, hdr); -return -EINVAL ; - } + xsk_features, NETDEV_A_DEV_PAD)) + goto err_cancel_msg;if (netdev->xdp_features &NETDEV_XDP_ACT_XSK_ZEROCOPY ) {if (nla_put_u32 (rsp,NETDEV_A_DEV_XDP_ZC_MAX_SEGS , - netdev->xdp_zc_max_segs)) { -genlmsg_cancel (rsp, hdr); -return -EINVAL ; - } + netdev->xdp_zc_max_segs)) + goto err_cancel_msg; }genlmsg_end (rsp, hdr);return 0 ; + +err_cancel_msg: +genlmsg_cancel (rsp, hdr); +return -EMSGSIZE ; } static void
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/250 ALSA: hda/realtek: Enable headset mic on IdeaPad 330-17IKB 81DM
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ajrat Makhmutov <[email protected]>
[ Upstream commit b1fd0d1285b1eae8b99af36fb26ed2512b809af6 ]
Headset microphone do not work out of the box with this laptop. This quirk fixes it. Zihao Wang specified the wrong subsystem id in his patch.
--- sound/pci/hda/patch_realtek.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +1 -1
@@ -10490,7 +10490,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x17aa ,0x3813 ,"Legion 7i 15IMHG05" ,ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS ),SND_PCI_QUIRK (0x17aa ,0x3818 ,"Lenovo C940 / Yoga Duet 7" ,ALC298_FIXUP_LENOVO_C940_DUET7 ),SND_PCI_QUIRK (0x17aa ,0x3819 ,"Lenovo 13s Gen2 ITL" ,ALC287_FIXUP_13S_GEN2_SPEAKERS ), -SND_PCI_QUIRK (0x17aa ,0x3820 ,"Yoga Duet 7 13ITL6" ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ), +SND_PCI_QUIRK (0x17aa ,0x3820 ,"IdeaPad 330-17IKB 81DM" ,ALC269_FIXUP_ASPIRE_HEADSET_MIC ),SND_PCI_QUIRK (0x17aa ,0x3824 ,"Legion Y9000X 2020" ,ALC285_FIXUP_LEGION_Y9000X_SPEAKERS ),SND_PCI_QUIRK (0x17aa ,0x3827 ,"Ideapad S740" ,ALC285_FIXUP_IDEAPAD_S740_COEF ), SND_PCI_QUIRK(0x17aa, 0x3834, "Lenovo IdeaPad Slim 9i 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/250 netrom: Fix a memory leak in nr_heartbeat_expiry()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gavrilov Ilia <[email protected]>
[ Upstream commit 0b9130247f3b6a1122478471ff0e014ea96bb735 ]
syzbot reported a memory leak in nr_create() [0].
Commit 409db27e3a2e ("netrom: Fix use-after-free of a listening socket.") added sock_hold() to the nr_heartbeat_expiry() function, where
a) a socket has a SOCK_DESTROY flag or
b) a listening socket has a SOCK_DEAD flag.
But in the case "a," when the SOCK_DESTROY flag is set, the file descriptor has already been closed and the nr_release() function has been called. So it makes no sense to hold the reference count because no one will call another nr_destroy_socket() and put it as in the case "b."
nr_connect
nr_establish_data_link
nr_start_heartbeat
nr_release
switch (nr->state)
case NR_STATE_3
nr->state = NR_STATE_2
sock_set_flag(sk, SOCK_DESTROY);
nr_rx_frame
nr_process_rx_frame
switch (nr->state)
case NR_STATE_2
nr_state2_machine()
nr_disconnect()
nr_sk(sk)->state = NR_STATE_0
sock_set_flag(sk, SOCK_DEAD)
nr_heartbeat_expiry
switch (nr->state)
case NR_STATE_0
if (sock_flag(sk, SOCK_DESTROY) ||
(sk->sk_state == TCP_LISTEN
&& sock_flag(sk, SOCK_DEAD)))
sock_hold() // ( !!! )
nr_destroy_socket()To fix the memory leak, let's call sock_hold() only for a listening socket.
Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with Syzkaller.
[0]: https://syzkaller.appspot.com/bug?extid=d327a1f3b12e1e206c16
--- net/netrom/nr_timer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/netrom/nr_timer.c +2 -1
@@ -121,7 +121,8 @@ static void nr_heartbeat_expiry(struct timer_list *t)is accepted() it isn't 'dead' so doesn't get removed. */ if (sock_flag (sk,SOCK_DESTROY ) || (sk->sk_state ==TCP_LISTEN &&sock_flag (sk,SOCK_DEAD ))) { -sock_hold (sk); +if (sk->sk_state ==TCP_LISTEN ) +sock_hold (sk);bh_unlock_sock (sk);nr_destroy_socket (sk); goto out;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/250 ipv6: prevent possible NULL deref in fib6_nh_init()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 2eab4543a2204092c3a7af81d7d6c506e59a03a6 ]
syzbot reminds us that in6_dev_get() can return NULL.
fib6_nh_init()
ip6_validate_gw( &idev )
ip6_route_check_nh( idev )
*idev = in6_dev_get(dev); // can be NULL
Oops: general protection fault, probably for non-canonical address 0xdffffc00000000bc: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x00000000000005e0-0x00000000000005e7] CPU: 0 PID: 11237 Comm: syz-executor.3 Not tainted 6.10.0-rc2-syzkaller-00249-gbe27b8965297 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 RIP: 0010:fib6_nh_init+0x640/0x2160 net/ipv6/route.c:3606 Code: 00 00 fc ff df 4c 8b 64 24 58 48 8b 44 24 28 4c 8b 74 24 30 48 89 c1 48 89 44 24 28 48 8d 98 e0 05 00 00 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 b3 17 00 00 8b 1b 31 ff 89 de e8 b8 8b RSP: 0018:ffffc900032775a0 EFLAGS: 00010202 RAX: 00000000000000bc RBX: 00000000000005e0 RCX: 0000000000000000 RDX: 0000000000000010 RSI: ffffc90003277a54 RDI: ffff88802b3a08d8 RBP: ffffc900032778b0 R08: 00000000000002fc R09: 0000000000000000 R10: 00000000000002fc R11: 0000000000000000 R12: ffff88802b3a08b8 R13: 1ffff9200064eec8 R14: ffffc90003277a00 R15: dffffc0000000000 FS: 00007f940feb06c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000245e8000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ip6_route_info_create+0x99e/0x12b0 net/ipv6/route.c:3809 ip6_route_add+0x28/0x160 net/ipv6/route.c:3853 ipv6_route_ioctl+0x588/0x870 net/ipv6/route.c:4483 inet6_ioctl+0x21a/0x280 net/ipv6/af_inet6.c:579 sock_do_ioctl+0x158/0x460 net/socket.c:1222 sock_ioctl+0x629/0x8e0 net/socket.c:1341 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f940f07cea9
--- net/ipv6/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/route.c +1 -1
@@ -3603,7 +3603,7 @@ int fib6_nh_init(struct net *net, struct fib6_nh *fib6_nh,if (!dev) goto out; -if (idev->cnf.disable_ipv6) { +if (!idev || idev->cnf.disable_ipv6) {NL_SET_ERR_MSG (extack,"IPv6 is disabled on nexthop device" ); err = -EACCES ; goto out;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/250 ipv6: prevent possible NULL dereference in rt6_probe()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit b86762dbe19a62e785c189f313cda5b989931f37 ]
syzbot caught a NULL dereference in rt6_probe() [1]
Bail out if __in6_dev_get() returns NULL.
[1]
Oops: general protection fault, probably for non-canonical address 0xdffffc00000000cb: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000658-0x000000000000065f] CPU: 1 PID: 22444 Comm: syz-executor.0 Not tainted 6.10.0-rc2-syzkaller-00383-gb8481381d4e2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 RIP: 0010:rt6_probe net/ipv6/route.c:656 [inline] RIP: 0010:find_match+0x8c4/0xf50 net/ipv6/route.c:758 Code: 14 fd f7 48 8b 85 38 ff ff ff 48 c7 45 b0 00 00 00 00 48 8d b8 5c 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 19 RSP: 0018:ffffc900034af070 EFLAGS: 00010203 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90004521000 RDX: 00000000000000cb RSI: ffffffff8990d0cd RDI: 000000000000065c RBP: ffffc900034af150 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000002 R12: 000000000000000a R13: 1ffff92000695e18 R14: ffff8880244a1d20 R15: 0000000000000000 FS: 00007f4844a5a6c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b31b27000 CR3: 000000002d42c000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> rt6_nh_find_match+0xfa/0x1a0 net/ipv6/route.c:784 nexthop_for_each_fib6_nh+0x26d/0x4a0 net/ipv4/nexthop.c:1496 __find_rr_leaf+0x6e7/0xe00 net/ipv6/route.c:825 find_rr_leaf net/ipv6/route.c:853 [inline] rt6_select net/ipv6/route.c:897 [inline] fib6_table_lookup+0x57e/0xa30 net/ipv6/route.c:2195 ip6_pol_route+0x1cd/0x1150 net/ipv6/route.c:2231 pol_lookup_func include/net/ip6_fib.h:616 [inline] fib6_rule_lookup+0x386/0x720 net/ipv6/fib6_rules.c:121 ip6_route_output_flags_noref net/ipv6/route.c:2639 [inline] ip6_route_output_flags+0x1d0/0x640 net/ipv6/route.c:2651 ip6_dst_lookup_tail.constprop.0+0x961/0x1760 net/ipv6/ip6_output.c:1147 ip6_dst_lookup_flow+0x99/0x1d0 net/ipv6/ip6_output.c:1250 rawv6_sendmsg+0xdab/0x4340 net/ipv6/raw.c:898 inet_sendmsg+0x119/0x140 net/ipv4/af_inet.c:853 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] sock_write_iter+0x4b8/0x5c0 net/socket.c:1160 new_sync_write fs/read_write.c:497 [inline] vfs_write+0x6b6/0x1140 fs/read_write.c:590 ksys_write+0x1f8/0x260 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- net/ipv6/route.c | 2 ++ 1 file changed, 2 insertions(+)
net/ipv6/route.c +2 -0
@@ -638,6 +638,8 @@ static void rt6_probe(struct fib6_nh *fib6_nh)rcu_read_lock (); last_probe =READ_ONCE (fib6_nh->last_probe); idev =__in6_dev_get (dev); +if (!idev) + goto out; neigh =__ipv6_neigh_lookup_noref (dev, nh_gw);if (neigh) {if (READ_ONCE (neigh->nud_state) &NUD_VALID )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/250 xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit d46401052c2d5614da8efea5788532f0401cb164 ]
ip6_dst_idev() can return NULL, xfrm6_get_saddr() must act accordingly.
syzbot reported:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 PID: 12 Comm: kworker/u8:1 Not tainted 6.10.0-rc2-syzkaller-00383-gb8481381d4e2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Workqueue: wg-kex-wg1 wg_packet_handshake_send_worker RIP: 0010:xfrm6_get_saddr+0x93/0x130 net/ipv6/xfrm6_policy.c:64 Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 97 00 00 00 4c 8b ab d8 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 86 00 00 00 4d 8b 6d 00 e8 ca 13 47 01 48 b8 00 RSP: 0018:ffffc90000117378 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffff88807b079dc0 RCX: ffffffff89a0d6d7 RDX: 0000000000000000 RSI: ffffffff89a0d6e9 RDI: ffff88807b079e98 RBP: ffff88807ad73248 R08: 0000000000000007 R09: fffffffffffff000 R10: ffff88807b079dc0 R11: 0000000000000007 R12: ffffc90000117480 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4586d00440 CR3: 0000000079042000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> xfrm_get_saddr net/xfrm/xfrm_policy.c:2452 [inline] xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2481 [inline] xfrm_tmpl_resolve+0xa26/0xf10 net/xfrm/xfrm_policy.c:2541 xfrm_resolve_and_create_bundle+0x140/0x2570 net/xfrm/xfrm_policy.c:2835 xfrm_bundle_lookup net/xfrm/xfrm_policy.c:3070 [inline] xfrm_lookup_with_ifid+0x4d1/0x1e60 net/xfrm/xfrm_policy.c:3201 xfrm_lookup net/xfrm/xfrm_policy.c:3298 [inline] xfrm_lookup_route+0x3b/0x200 net/xfrm/xfrm_policy.c:3309 ip6_dst_lookup_flow+0x15c/0x1d0 net/ipv6/ip6_output.c:1256 send6+0x611/0xd20 drivers/net/wireguard/socket.c:139 wg_socket_send_skb_to_peer+0xf9/0x220 drivers/net/wireguard/socket.c:178 wg_socket_send_buffer_to_peer+0x12b/0x190 drivers/net/wireguard/socket.c:200 wg_packet_send_handshake_initiation+0x227/0x360 drivers/net/wireguard/send.c:40 wg_packet_handshake_send_worker+0x1c/0x30 drivers/net/wireguard/send.c:51 process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
--- net/ipv6/xfrm6_policy.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
net/ipv6/xfrm6_policy.c +7 -1
@@ -56,12 +56,18 @@ static int xfrm6_get_saddr(struct net *net, int oif, {struct dst_entry *dst;struct net_device *dev; +struct inet6_dev *idev; dst =xfrm6_dst_lookup (net,0 , oif,NULL , daddr, mark);if (IS_ERR (dst))return -EHOSTUNREACH ; - dev =ip6_dst_idev (dst)->dev; + idev =ip6_dst_idev (dst); +if (!idev) { +dst_release (dst); +return -EHOSTUNREACH ; + } + dev = idev->dev;ipv6_dev_get_saddr (dev_net (dev), dev, &daddr->in6,0 , &saddr->in6);dst_release (dst);return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/250 netns: Make get_net_ns() handle zero refcount net
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yue Haibing <[email protected]>
[ Upstream commit ff960f9d3edbe08a736b5a224d91a305ccc946b0 ]
Syzkaller hit a warning:refcount_t: addition on 0; use-after-free.
WARNING: CPU: 3 PID: 7890 at lib/refcount.c:25 refcount_warn_saturate+0xdf/0x1d0 Modules linked in: CPU: 3 PID: 7890 Comm: tun Not tainted 6.10.0-rc3-00100-gcaa4f9578aba-dirty #310 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:refcount_warn_saturate+0xdf/0x1d0 Code: 41 49 04 31 ff 89 de e8 9f 1e cd fe 84 db 75 9c e8 76 26 cd fe c6 05 b6 41 49 04 01 90 48 c7 c7 b8 8e 25 86 e8 d2 05 b5 fe 90 <0f> 0b 90 90 e9 79 ff ff ff e8 53 26 cd fe 0f b6 1 RSP: 0018:ffff8881067b7da0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff811c72ac RDX: ffff8881026a2140 RSI: ffffffff811c72b5 RDI: 0000000000000001 RBP: ffff8881067b7db0 R08: 0000000000000000 R09: 205b5d3730353139 R10: 0000000000000000 R11: 205d303938375420 R12: ffff8881086500c4 R13: ffff8881086500c4 R14: ffff8881086500b0 R15: ffff888108650040 FS: 00007f5b2961a4c0(0000) GS:ffff88823bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055d7ed36fd18 CR3: 00000001482f6000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? show_regs+0xa3/0xc0 ? __warn+0xa5/0x1c0 ? refcount_warn_saturate+0xdf/0x1d0 ? report_bug+0x1fc/0x2d0 ? refcount_warn_saturate+0xdf/0x1d0 ? handle_bug+0xa1/0x110 ? exc_invalid_op+0x3c/0xb0 ? asm_exc_invalid_op+0x1f/0x30 ? __warn_printk+0xcc/0x140 ? __warn_printk+0xd5/0x140 ? refcount_warn_saturate+0xdf/0x1d0 get_net_ns+0xa4/0xc0 ? __pfx_get_net_ns+0x10/0x10 open_related_ns+0x5a/0x130 __tun_chr_ioctl+0x1616/0x2370 ? __sanitizer_cov_trace_switch+0x58/0xa0 ? __sanitizer_cov_trace_const_cmp2+0x1c/0x30 ? __pfx_tun_chr_ioctl+0x10/0x10 tun_chr_ioctl+0x2f/0x40 __x64_sys_ioctl+0x11b/0x160 x64_sys_call+0x1211/0x20d0 do_syscall_64+0x9e/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5b28f165d7 Code: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 8 RSP: 002b:00007ffc2b59c5e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5b28f165d7 RDX: 0000000000000000 RSI: 00000000000054e3 RDI: 0000000000000003 RBP: 00007ffc2b59c650 R08: 00007f5b291ed8c0 R09: 00007f5b2961a4c0 R10: 0000000029690010 R11: 0000000000000246 R12: 0000000000400730 R13: 00007ffc2b59cf40 R14: 0000000000000000 R15: 0000000000000000 </TASK> Kernel panic - not syncing: kernel: panic_on_warn set ...
This is trigger as below:
ns0 ns1tun_set_iff() //dev is tun0
tun->dev = dev
//ip link set tun0 netns ns1
put_net() //ref is 0
__tun_chr_ioctl() //TUNGETDEVNETNS
net = dev_net(tun->dev);
open_related_ns(&net->ns, get_net_ns); //ns1
get_net_ns()
get_net() //addition on 0
Use maybe_get_net() in get_net_ns in case net's ref is zero to fix this
--- net/core/net_namespace.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
net/core/net_namespace.c +7 -2
@@ -693,11 +693,16 @@ EXPORT_SYMBOL_GPL(__put_net);* get_net_ns - increment the refcount of the network namespace * @ns: common namespace (net) * -* Returns the net's common namespace. +* Returns the net's common namespace or ERR_PTR() if ref is zero. */ struct ns_common *get_net_ns (struct ns_common *ns) { - return &get_net(container_of(ns, struct net, ns))->ns; +struct net *net; + + net = maybe_get_net(container_of(ns, struct net, ns)); +if (net) +return &net->ns; +return ERR_PTR (-EINVAL ); }EXPORT_SYMBOL_GPL (get_net_ns);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/250 qca_spi: Make interrupt remembering atomic
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
[ Upstream commit 2d7198278ece01818cd95a3beffbdf8b2a353fa0 ]
The whole mechanism to remember occurred SPI interrupts is not atomic, which could lead to unexpected behavior. So fix this by using atomic bit operations instead.
--- drivers/net/ethernet/qualcomm/qca_debug.c | 6 ++---- drivers/net/ethernet/qualcomm/qca_spi.c | 16 ++++++++-------- drivers/net/ethernet/qualcomm/qca_spi.h | 3 +-- 3 files changed, 11 insertions(+), 14 deletions(-)
drivers/net/ethernet/qualcomm/qca_debug.c +2 -4
@@ -98,10 +98,8 @@ qcaspi_info_show(struct seq_file *s, void *what)seq_printf (s,"IRQ : %d\n" , qca->spi_dev->irq); -seq_printf (s,"INTR REQ : %u\n" , - qca->intr_req); -seq_printf (s,"INTR SVC : %u\n" , - qca->intr_svc); +seq_printf (s,"INTR : %lx\n" , + qca->intr);seq_printf (s,"SPI max speed : %lu\n" , (unsigned long )qca->spi_dev->max_speed_hz);
drivers/net/ethernet/qualcomm/qca_spi.c +8 -8
@@ -35,6 +35,8 @@#define MAX_DMA_BURST_LEN 5000 +#define SPI_INTR 0 +/* Modules parameters */ #define QCASPI_CLK_SPEED_MIN 1000000#define QCASPI_CLK_SPEED_MAX 16000000
@@ -579,14 +581,14 @@ qcaspi_spi_thread(void *data)continue ; } -if ((qca->intr_req == qca->intr_svc) && +if (!test_bit (SPI_INTR , &qca->intr) && !qca->txr.skb[qca->txr.head])schedule ();set_current_state (TASK_RUNNING ); -netdev_dbg (qca->net_dev,"have work to do. int: %d, tx_skb: %p\n" , - qca->intr_req - qca->intr_svc, +netdev_dbg (qca->net_dev,"have work to do. int: %lu, tx_skb: %p\n" , + qca->intr, qca->txr.skb[qca->txr.head]);qcaspi_qca7k_sync (qca,QCASPI_EVENT_UPDATE );
@@ -600,8 +602,7 @@ qcaspi_spi_thread(void *data)msleep (QCASPI_QCA7K_REBOOT_TIME_MS ); } -if (qca->intr_svc != qca->intr_req) { - qca->intr_svc = qca->intr_req; +if (test_and_clear_bit (SPI_INTR , &qca->intr)) {start_spi_intr_handling (qca, &intr_cause);if (intr_cause &SPI_INT_CPU_ON ) {
@@ -663,7 +664,7 @@ qcaspi_intr_handler(int irq, void *data) {struct qcaspi *qca = data; - qca->intr_req++; +set_bit (SPI_INTR , &qca->intr);if (qca->spi_thread)wake_up_process (qca->spi_thread);
@@ -679,8 +680,7 @@ qcaspi_netdev_open(struct net_device *dev)if (!qca)return -EINVAL ; - qca->intr_req =1 ; - qca->intr_svc =0 ; +set_bit (SPI_INTR , &qca->intr); qca->sync =QCASPI_SYNC_UNKNOWN ;qcafrm_fsm_init_spi (&qca->frm_handle);
drivers/net/ethernet/qualcomm/qca_spi.h +1 -2
@@ -81,8 +81,7 @@ struct qcaspi {struct qcafrm_handle frm_handle;struct sk_buff *rx_skb; -unsigned int intr_req; -unsigned int intr_svc; +unsigned long intr;u16 reset_count;#ifdef CONFIG_DEBUG_FS
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/250 net: lan743x: disable WOL upon resume to restore full data path operation
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Lakkaraju <[email protected]>
[ Upstream commit 7725363936a88351b71495774c1e0e852ae4cdca ]
When Wake-on-LAN (WoL) is active and the system is in suspend mode, triggering a system event can wake the system from sleep, which may block the data path. To restore normal data path functionality after waking, disable all wake-up events. Furthermore, clear all Write 1 to Clear (W1C) status bits by writing 1's to them.
--- drivers/net/ethernet/microchip/lan743x_main.c | 30 ++++++++++++++++--- drivers/net/ethernet/microchip/lan743x_main.h | 24 +++++++++++++++ 2 files changed, 50 insertions(+), 4 deletions(-)
drivers/net/ethernet/microchip/lan743x_main.c +26 -4
@@ -3568,7 +3568,7 @@ static void lan743x_pm_set_wol(struct lan743x_adapter *adapter)/* clear wake settings */ pmtctl =lan743x_csr_read (adapter,PMT_CTL ); - pmtctl |=PMT_CTL_WUPS_MASK_ ; + pmtctl |=PMT_CTL_WUPS_MASK_ |PMT_CTL_RES_CLR_WKP_MASK_ ; pmtctl &= ~(PMT_CTL_GPIO_WAKEUP_EN_ |PMT_CTL_EEE_WAKEUP_EN_ |PMT_CTL_WOL_EN_ |PMT_CTL_MAC_D3_RX_CLK_OVR_ |PMT_CTL_RX_FCT_RFE_D3_CLK_OVR_ |PMT_CTL_ETH_PHY_WAKE_EN_ );
@@ -3703,6 +3703,7 @@ static int lan743x_pm_resume(struct device *dev)struct pci_dev *pdev =to_pci_dev (dev);struct net_device *netdev =pci_get_drvdata (pdev);struct lan743x_adapter *adapter =netdev_priv (netdev); +u32 data;int ret;pci_set_power_state (pdev,PCI_D0 );
@@ -3721,6 +3722,30 @@ static int lan743x_pm_resume(struct device *dev)return ret; } + ret =lan743x_csr_read (adapter,MAC_WK_SRC ); +netif_dbg (adapter, drv, adapter->netdev, +"Wakeup source : 0x%08X\n" , ret); + +/* Clear the wol configuration and status bits. Note that +* the status bits are "Write One to Clear (W1C)" +*/ + data =MAC_WUCSR_EEE_TX_WAKE_ |MAC_WUCSR_EEE_RX_WAKE_ | +MAC_WUCSR_RFE_WAKE_FR_ |MAC_WUCSR_PFDA_FR_ |MAC_WUCSR_WUFR_ | +MAC_WUCSR_MPR_ |MAC_WUCSR_BCAST_FR_ ; +lan743x_csr_write (adapter,MAC_WUCSR , data); + + data =MAC_WUCSR2_NS_RCD_ |MAC_WUCSR2_ARP_RCD_ | +MAC_WUCSR2_IPV6_TCPSYN_RCD_ |MAC_WUCSR2_IPV4_TCPSYN_RCD_ ; +lan743x_csr_write (adapter,MAC_WUCSR2 , data); + + data =MAC_WK_SRC_ETH_PHY_WK_ |MAC_WK_SRC_IPV6_TCPSYN_RCD_WK_ | +MAC_WK_SRC_IPV4_TCPSYN_RCD_WK_ |MAC_WK_SRC_EEE_TX_WK_ | +MAC_WK_SRC_EEE_RX_WK_ |MAC_WK_SRC_RFE_FR_WK_ | +MAC_WK_SRC_PFDA_FR_WK_ |MAC_WK_SRC_MP_FR_WK_ | +MAC_WK_SRC_BCAST_FR_WK_ |MAC_WK_SRC_WU_FR_WK_ | +MAC_WK_SRC_WK_FR_SAVED_ ; +lan743x_csr_write (adapter,MAC_WK_SRC , data); +/* open netdev when netdev is at running state while resume. * For instance, it is true when system wakesup after pm-suspend * However, it is false when system wakes up after suspend GUI menu
@@ -3729,9 +3754,6 @@ static int lan743x_pm_resume(struct device *dev)lan743x_netdev_open (netdev);netif_device_attach (netdev); - ret =lan743x_csr_read (adapter,MAC_WK_SRC ); -netif_info (adapter, drv, adapter->netdev, -"Wakeup source : 0x%08X\n" , ret);return 0 ; }
drivers/net/ethernet/microchip/lan743x_main.h +24 -0
@@ -61,6 +61,7 @@#define PMT_CTL_RX_FCT_RFE_D3_CLK_OVR_ BIT(18)#define PMT_CTL_GPIO_WAKEUP_EN_ BIT(15)#define PMT_CTL_EEE_WAKEUP_EN_ BIT(13) +#define PMT_CTL_RES_CLR_WKP_MASK_ GENMASK(9, 8)#define PMT_CTL_READY_ BIT(7)#define PMT_CTL_ETH_PHY_RST_ BIT(4)#define PMT_CTL_WOL_EN_ BIT(3)
@@ -227,12 +228,31 @@#define MAC_WUCSR (0x140)#define MAC_MP_SO_EN_ BIT(21)#define MAC_WUCSR_RFE_WAKE_EN_ BIT(14) +#define MAC_WUCSR_EEE_TX_WAKE_ BIT(13) +#define MAC_WUCSR_EEE_RX_WAKE_ BIT(11) +#define MAC_WUCSR_RFE_WAKE_FR_ BIT(9) +#define MAC_WUCSR_PFDA_FR_ BIT(7) +#define MAC_WUCSR_WUFR_ BIT(6) +#define MAC_WUCSR_MPR_ BIT(5) +#define MAC_WUCSR_BCAST_FR_ BIT(4)#define MAC_WUCSR_PFDA_EN_ BIT(3)#define MAC_WUCSR_WAKE_EN_ BIT(2)#define MAC_WUCSR_MPEN_ BIT(1)#define MAC_WUCSR_BCST_EN_ BIT(0)#define MAC_WK_SRC (0x144) +#define MAC_WK_SRC_ETH_PHY_WK_ BIT(17) +#define MAC_WK_SRC_IPV6_TCPSYN_RCD_WK_ BIT(16) +#define MAC_WK_SRC_IPV4_TCPSYN_RCD_WK_ BIT(15) +#define MAC_WK_SRC_EEE_TX_WK_ BIT(14) +#define MAC_WK_SRC_EEE_RX_WK_ BIT(13) +#define MAC_WK_SRC_RFE_FR_WK_ BIT(12) +#define MAC_WK_SRC_PFDA_FR_WK_ BIT(11) +#define MAC_WK_SRC_MP_FR_WK_ BIT(10) +#define MAC_WK_SRC_BCAST_FR_WK_ BIT(9) +#define MAC_WK_SRC_WU_FR_WK_ BIT(8) +#define MAC_WK_SRC_WK_FR_SAVED_ BIT(7) +#define MAC_MP_SO_HI (0x148)#define MAC_MP_SO_LO (0x14C)
@@ -295,6 +315,10 @@#define RFE_INDX (index) (0x580 + (index << 2))#define MAC_WUCSR2 (0x600) +#define MAC_WUCSR2_NS_RCD_ BIT(7) +#define MAC_WUCSR2_ARP_RCD_ BIT(6) +#define MAC_WUCSR2_IPV6_TCPSYN_RCD_ BIT(5) +#define MAC_WUCSR2_IPV4_TCPSYN_RCD_ BIT(4)#define SGMII_ACC (0x720)#define SGMII_ACC_SGMII_BZY_ BIT(31)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/250 net: lan743x: Support WOL at both the PHY and MAC appropriately
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Lakkaraju <[email protected]>
[ Upstream commit 8c248cd836014339498486f14f435c0e344183a7 ]
Prevent options not supported by the PHY from being requested to it by the MAC Whenever a WOL option is supported by both, the PHY is given priority since that usually leads to better power savings.
--- .../net/ethernet/microchip/lan743x_ethtool.c | 44 +++++++++++++++++-- drivers/net/ethernet/microchip/lan743x_main.c | 18 ++++++-- drivers/net/ethernet/microchip/lan743x_main.h | 4 ++ 3 files changed, 58 insertions(+), 8 deletions(-)
drivers/net/ethernet/microchip/lan743x_ethtool.c +40 -4
@@ -1148,8 +1148,12 @@ static void lan743x_ethtool_get_wol(struct net_device *netdev,if (netdev->phydev)phy_ethtool_get_wol (netdev->phydev, wol); - wol->supported |=WAKE_BCAST |WAKE_UCAST |WAKE_MCAST | -WAKE_MAGIC |WAKE_PHY |WAKE_ARP ; +if (wol->supported != adapter->phy_wol_supported) +netif_warn (adapter, drv, adapter->netdev, +"PHY changed its supported WOL! old=%x, new=%x\n" , + adapter->phy_wol_supported, wol->supported); + + wol->supported |=MAC_SUPPORTED_WAKES ;if (adapter->is_pci11x1x) wol->supported |=WAKE_MAGICSECURE ;
@@ -1164,7 +1168,39 @@ static int lan743x_ethtool_set_wol(struct net_device *netdev, {struct lan743x_adapter *adapter =netdev_priv (netdev); +/* WAKE_MAGICSEGURE is a modifier of and only valid together with +* WAKE_MAGIC +*/ +if ((wol->wolopts &WAKE_MAGICSECURE ) && !(wol->wolopts &WAKE_MAGIC )) +return -EINVAL ; + +if (netdev->phydev) { +struct ethtool_wolinfo phy_wol; +int ret; + + phy_wol.wolopts = wol->wolopts & adapter->phy_wol_supported; + +/* If WAKE_MAGICSECURE was requested, filter out WAKE_MAGIC +* for PHYs that do not support WAKE_MAGICSECURE +*/ +if (wol->wolopts &WAKE_MAGICSECURE && + !(adapter->phy_wol_supported &WAKE_MAGICSECURE )) + phy_wol.wolopts &= ~WAKE_MAGIC ; + + ret =phy_ethtool_set_wol (netdev->phydev, &phy_wol); +if (ret && (ret != -EOPNOTSUPP )) +return ret; + +if (ret == -EOPNOTSUPP ) + adapter->phy_wolopts =0 ; +else + adapter->phy_wolopts = phy_wol.wolopts; + }else { + adapter->phy_wolopts =0 ; + } + adapter->wolopts =0 ; + wol->wolopts &= ~adapter->phy_wolopts;if (wol->wolopts &WAKE_UCAST ) adapter->wolopts |=WAKE_UCAST ;if (wol->wolopts &WAKE_MCAST )
@@ -1185,10 +1221,10 @@ static int lan743x_ethtool_set_wol(struct net_device *netdev, memset(adapter->sopass, 0, sizeof(u8) * SOPASS_MAX); } + wol->wolopts = adapter->wolopts | adapter->phy_wolopts;device_set_wakeup_enable (&adapter->pdev->dev, (bool )wol->wolopts); -return netdev->phydev ?phy_ethtool_set_wol (netdev->phydev, wol) - : -ENETDOWN ; +return 0 ; }#endif /* CONFIG_PM */
drivers/net/ethernet/microchip/lan743x_main.c +14 -4
@@ -3111,6 +3111,17 @@ static int lan743x_netdev_open(struct net_device *netdev)if (ret) goto close_tx; } + +#ifdef CONFIG_PM +if (adapter->netdev->phydev) { +struct ethtool_wolinfo wol = { .cmd =ETHTOOL_GWOL }; + +phy_ethtool_get_wol (netdev->phydev, &wol); + adapter->phy_wol_supported = wol.supported; + adapter->phy_wolopts = wol.wolopts; + } +#endif +return 0 ; close_tx:
@@ -3580,10 +3591,9 @@ static void lan743x_pm_set_wol(struct lan743x_adapter *adapter) pmtctl |=PMT_CTL_ETH_PHY_D3_COLD_OVR_ |PMT_CTL_ETH_PHY_D3_OVR_ ; -if (adapter->wolopts &WAKE_PHY ) { - pmtctl |=PMT_CTL_ETH_PHY_EDPD_PLL_CTL_ ; +if (adapter->phy_wolopts) pmtctl |=PMT_CTL_ETH_PHY_WAKE_EN_ ; - } +if (adapter->wolopts &WAKE_MAGIC ) { wucsr |=MAC_WUCSR_MPEN_ ; macrx |=MAC_RX_RXEN_ ;
@@ -3679,7 +3689,7 @@ static int lan743x_pm_suspend(struct device *dev)lan743x_csr_write (adapter,MAC_WUCSR2 ,0 );lan743x_csr_write (adapter,MAC_WK_SRC ,0xFFFFFFFF ); -if (adapter->wolopts) +if (adapter->wolopts || adapter->phy_wolopts)lan743x_pm_set_wol (adapter);if (adapter->is_pci11x1x) {
drivers/net/ethernet/microchip/lan743x_main.h +4 -0
@@ -1042,6 +1042,8 @@ enum lan743x_sgmii_lsd {LINK_2500_SLAVE }; +#define MAC_SUPPORTED_WAKES (WAKE_BCAST | WAKE_UCAST | WAKE_MCAST | \ + WAKE_MAGIC | WAKE_ARP)struct lan743x_adapter {struct net_device *netdev;struct mii_bus *mdiobus;
@@ -1049,6 +1051,8 @@ struct lan743x_adapter {#ifdef CONFIG_PM u32 wolopts;u8 sopass[SOPASS_MAX ]; +u32 phy_wolopts; +u32 phy_wol_supported;#endif struct pci_dev *pdev;struct lan743x_csr csr;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/250 net: phy: mxl-gpy: Remove interrupt mask clearing from config_init
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Lakkaraju <[email protected]>
[ Upstream commit c44d3ffd85db03ebcc3090e55589e10d5af9f3a9 ]
When the system resumes from sleep, the phy_init_hw() function invokes config_init(), which clears all interrupt masks and causes wake events to be lost in subsequent wake sequences. Remove interrupt mask clearing from config_init() and preserve relevant masks in config_intr().
--- drivers/net/phy/mxl-gpy.c | 58 +++++++++++++++++++++++++-------------- 1 file changed, 38 insertions(+), 20 deletions(-)
drivers/net/phy/mxl-gpy.c +38 -20
@@ -107,6 +107,7 @@ struct gpy_priv {u8 fw_major;u8 fw_minor; +u32 wolopts;/* It takes 3 seconds to fully switch out of loopback mode before * it can safely re-enter loopback mode. Record the time when
@@ -221,6 +222,15 @@ static int gpy_hwmon_register(struct phy_device *phydev) }#endif +static int gpy_ack_interrupt (struct phy_device *phydev) +{ +int ret; + +/* Clear all pending interrupts */ + ret =phy_read (phydev,PHY_ISTAT ); +return ret <0 ? ret :0 ; +} +static int gpy_mbox_read (struct phy_device *phydev,u32 addr) {struct gpy_priv *priv = phydev->priv;
@@ -262,16 +272,8 @@ static int gpy_mbox_read(struct phy_device *phydev, u32 addr)static int gpy_config_init (struct phy_device *phydev) { -int ret; - -/* Mask all interrupts */ - ret =phy_write (phydev,PHY_IMASK ,0 ); -if (ret) -return ret; - -/* Clear all pending interrupts */ - ret =phy_read (phydev,PHY_ISTAT ); -return ret <0 ? ret :0 ; +/* Nothing to configure. Configuration Requirement Placeholder */ +return 0 ; }static int gpy21x_config_init (struct phy_device *phydev)
@@ -627,11 +629,23 @@ static int gpy_read_status(struct phy_device *phydev)static int gpy_config_intr (struct phy_device *phydev) { +struct gpy_priv *priv = phydev->priv;u16 mask =0 ; +int ret; + + ret =gpy_ack_interrupt (phydev); +if (ret) +return ret;if (phydev->interrupts ==PHY_INTERRUPT_ENABLED ) mask =PHY_IMASK_MASK ; +if (priv->wolopts &WAKE_MAGIC ) + mask |=PHY_IMASK_WOL ; + +if (priv->wolopts &WAKE_PHY ) + mask |=PHY_IMASK_LSTC ; +return phy_write (phydev,PHY_IMASK , mask); }
@@ -678,6 +692,7 @@ static int gpy_set_wol(struct phy_device *phydev, struct ethtool_wolinfo *wol) {struct net_device *attach_dev = phydev->attached_dev; +struct gpy_priv *priv = phydev->priv;int ret;if (wol->wolopts &WAKE_MAGIC ) {
@@ -725,6 +740,8 @@ static int gpy_set_wol(struct phy_device *phydev, ret =phy_read (phydev,PHY_ISTAT );if (ret <0 )return ret; + + priv->wolopts |=WAKE_MAGIC ; }else {/* Disable magic packet matching */ ret = phy_clear_bits_mmd(phydev, MDIO_MMD_VEND2,
@@ -732,6 +749,13 @@ static int gpy_set_wol(struct phy_device *phydev, WOL_EN);if (ret <0 )return ret; + +/* Disable the WOL interrupt */ + ret =phy_clear_bits (phydev,PHY_IMASK ,PHY_IMASK_WOL ); +if (ret <0 ) +return ret; + + priv->wolopts &= ~WAKE_MAGIC ; }if (wol->wolopts &WAKE_PHY ) {
@@ -748,9 +772,11 @@ static int gpy_set_wol(struct phy_device *phydev,if (ret & (PHY_IMASK_MASK & ~PHY_IMASK_LSTC ))phy_trigger_machine (phydev); + priv->wolopts |=WAKE_PHY ;return 0 ; } + priv->wolopts &= ~WAKE_PHY ;/* Disable the link state change interrupt */ return phy_clear_bits (phydev,PHY_IMASK ,PHY_IMASK_LSTC ); }
@@ -758,18 +784,10 @@ static int gpy_set_wol(struct phy_device *phydev,static void gpy_get_wol (struct phy_device *phydev,struct ethtool_wolinfo *wol) { -int ret; +struct gpy_priv *priv = phydev->priv; wol->supported =WAKE_MAGIC |WAKE_PHY ; - wol->wolopts =0 ; - - ret =phy_read_mmd (phydev,MDIO_MMD_VEND2 ,VPSPEC2_WOL_CTL ); -if (ret &WOL_EN ) - wol->wolopts |=WAKE_MAGIC ; - - ret =phy_read (phydev,PHY_IMASK ); -if (ret &PHY_IMASK_LSTC ) - wol->wolopts |=WAKE_PHY ; + wol->wolopts = priv->wolopts; }static int gpy_loopback (struct phy_device *phydev,bool enable)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/250 net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ruth <[email protected]>
[ Upstream commit d864319871b05fadd153e0aede4811ca7008f5d6 ]
syzbot found hanging tasks waiting on rtnl_lock [1]
A reproducer is available in the syzbot bug.
When a request to add multiple actions with the same index is sent, the second request will block forever on the first request. This holds rtnl_lock, and causes tasks to hang.
Return -EAGAIN to prevent infinite looping, while keeping documented behavior.
[1]
INFO: task kworker/1:0:5088 blocked for more than 143 seconds. Not tainted 6.9.0-rc4-syzkaller-00173-g3cdb45594619 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:0 state:D stack:23744 pid:5088 tgid:5088 ppid:2 flags:0x00004000 Workqueue: events_power_efficient reg_check_chans_work Call Trace: <TASK> context_switch kernel/sched/core.c:5409 [inline] __schedule+0xf15/0x5d00 kernel/sched/core.c:6746 __schedule_loop kernel/sched/core.c:6823 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6838 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6895 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 wiphy_lock include/net/cfg80211.h:5953 [inline] reg_leave_invalid_chans net/wireless/reg.c:2466 [inline] reg_check_chans_work+0x10a/0x10e0 net/wireless/reg.c:2481
--- net/sched/act_api.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/sched/act_api.c +1 -2
@@ -830,7 +830,6 @@ int tcf_idr_check_alloc(struct tc_action_net *tn, u32 *index,u32 max;if (*index) { -again:rcu_read_lock (); p =idr_find (&idrinfo->action_idr, *index);
@@ -839,7 +838,7 @@ int tcf_idr_check_alloc(struct tc_action_net *tn, u32 *index,* index but did not assign the pointer yet. */ rcu_read_unlock (); - goto again; +return -EAGAIN ; }if (!p) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/250 tipc: force a dst refcount before doing decryption
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 2ebe8f840c7450ecbfca9d18ac92e9ce9155e269 ]
As it says in commit 3bc07321ccc2 ("xfrm: Force a dst refcount before entering the xfrm type handlers"):
"Crypto requests might return asynchronous. In this case we leave the
rcu protected region, so force a refcount on the skb's destination entry before we enter the xfrm type input/output handlers."
On TIPC decryption path it has the same problem, and skb_dst_force() should be called before doing decryption to avoid a possible crash.
Shuang reported this issue when this warning is triggered:
[] WARNING: include/net/dst.h:337 tipc_sk_rcv+0x1055/0x1ea0 [tipc] [] Kdump: loaded Tainted: G W --------- - - 4.18.0-496.el8.x86_64+debug [] Workqueue: crypto cryptd_queue_worker
[] RIP: 0010:tipc_sk_rcv+0x1055/0x1ea0 [tipc]
[] Call Trace:
[] tipc_sk_mcast_rcv+0x548/0xea0 [tipc]
[] tipc_rcv+0xcf5/0x1060 [tipc]
[] tipc_aead_decrypt_done+0x215/0x2e0 [tipc]
[] cryptd_aead_crypt+0xdb/0x190
[] cryptd_queue_worker+0xed/0x190
[] process_one_work+0x93d/0x17e0
--- net/tipc/node.c | 1 + 1 file changed, 1 insertion(+)
net/tipc/node.c +1 -0
@@ -2105,6 +2105,7 @@ void tipc_rcv(struct net *net, struct sk_buff *skb, struct tipc_bearer *b) }else { n =tipc_node_find_by_id (net, ehdr->id); } +skb_dst_force (skb);tipc_crypto_rcv (net, (n) ? n->crypto_rx :NULL , &skb, b);if (!skb)return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/250 sched: act_ct: add netns into the key of tcf_ct_flow_table
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 88c67aeb14070bab61d3dd8be96c8b42ebcaf53a ]
zones_ht is a global hashtable for flow_table with zone as key. However, it does not consider netns when getting a flow_table from zones_ht in tcf_ct_init(), and it means an act_ct action in netns A may get a flow_table that belongs to netns B if it has the same zone value.
In Shuang's test with the TOPO:
tcf2_c <---> tcf2_sw1 <---> tcf2_sw2 <---> tcf2_s
tcf2_sw1 and tcf2_sw2 saw the same flow and used the same flow table, which caused their ct entries entering unexpected states and the TCP connection not able to end normally.
This patch fixes the issue simply by adding netns into the key of tcf_ct_flow_table so that an act_ct action gets a flow_table that belongs to its own netns in tcf_ct_init().
Note that for easy coding we don't use tcf_ct_flow_table.nf_ft.net, as the ct_ft is initialized after inserting it to the hashtable in tcf_ct_flow_table_get() and also it requires to implement several functions in rhashtable_params including hashfn, obj_hashfn and obj_cmpfn.
--- net/sched/act_ct.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
net/sched/act_ct.c +11 -5
@@ -41,21 +41,26 @@ static struct workqueue_struct *act_ct_wq;static struct rhashtable zones_ht;static DEFINE_MUTEX (zones_mutex); +struct zones_ht_key { +struct net *net; +u16 zone; +}; +struct tcf_ct_flow_table {struct rhash_head node;/* In zones tables */ struct rcu_work rwork;struct nf_flowtable nf_ft;refcount_t ref; -u16 zone; +struct zones_ht_key key;bool dying; };static const struct rhashtable_params zones_params = { .head_offset = offsetof(struct tcf_ct_flow_table , node), - .key_offset = offsetof(struct tcf_ct_flow_table , zone), - .key_len = sizeof_field(struct tcf_ct_flow_table, zone), + .key_offset = offsetof(struct tcf_ct_flow_table , key), + .key_len = sizeof_field(struct tcf_ct_flow_table, key), .automatic_shrinking = true, };
@@ -316,11 +321,12 @@ static struct nf_flowtable_type flowtable_ct = {static int tcf_ct_flow_table_get (struct net *net,struct tcf_ct_params *params) { +struct zones_ht_key key = { .net = net, .zone = params->zone };struct tcf_ct_flow_table *ct_ft;int err = -ENOMEM ;mutex_lock (&zones_mutex); - ct_ft =rhashtable_lookup_fast (&zones_ht, ¶ms->zone, zones_params); + ct_ft =rhashtable_lookup_fast (&zones_ht, &key, zones_params);if (ct_ft &&refcount_inc_not_zero (&ct_ft->ref)) goto out_unlock;
@@ -329,7 +335,7 @@ static int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params) goto err_alloc;refcount_set (&ct_ft->ref,1 ); - ct_ft->zone = params->zone; + ct_ft->key = key; err =rhashtable_insert_fast (&zones_ht, &ct_ft->node, zones_params);if (err) goto err_insert;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/250 ptp: fix integer overflow in max_vclocks_store
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 81d23d2a24012e448f651e007fac2cfd20a45ce0 ]
On 32bit systems, the "4 * max" multiply can overflow. Use kcalloc() to do the allocation to prevent this.
--- drivers/ptp/ptp_sysfs.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/ptp/ptp_sysfs.c +1 -2
@@ -296,8 +296,7 @@ static ssize_t max_vclocks_store(struct device *dev,if (max < ptp->n_vclocks) goto out; - size =sizeof (int ) * max; - vclock_index =kzalloc (size,GFP_KERNEL ); + vclock_index =kcalloc (max,sizeof (int ),GFP_KERNEL );if (!vclock_index) { err = -ENOMEM ; goto out;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/250 selftests: openvswitch: Use bash as interpreter
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit e2b447c9a1bba718f9c07513a1e8958209e862a1 ]
openvswitch.sh makes use of substitutions of the form ${ns:0:1}, to obtain the first character of $ns. Empirically, this is works with bash but not dash. When run with dash these evaluate to an empty string and printing an error to stdout.
# dash -c 'ns=client; echo "${ns:0:1}"' 2>error
# cat error
dash: 1: Bad substitution
# bash -c 'ns=client; echo "${ns:0:1}"' 2>error
c
# cat errorThis leads to tests that neither pass nor fail.
F.e.
TEST: arp_ping [START]
adding sandbox 'test_arp_ping'
Adding DP/Bridge IF: sbx:test_arp_ping dp:arpping {, , } create namespaces
./openvswitch.sh: 282: eval: Bad substitution
TEST: ct_connect_v4 [START]
adding sandbox 'test_ct_connect_v4'
Adding DP/Bridge IF: sbx:test_ct_connect_v4 dp:ct4 {, , } ./openvswitch.sh: 322: eval: Bad substitution create namespaces
Resolve this by making openvswitch.sh a bash script.
--- tools/testing/selftests/net/openvswitch/openvswitch.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/openvswitch/openvswitch.sh +1 -1
@@ -1,4 +1,4 @@ -#!/bin/sh +#!/bin/bash # SPDX-License-Identifier: GPL-2.0 # # OVS kernel module self tests
Signature · 1 line
2.43.0