6.9.9-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 6.9.9-rc1 review
This is the start of the stable review cycle for the 6.9.9 release. There are 197 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 11 Jul 2024 11:06:25 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.9.9-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.9.9-rc1
Andrii Nakryiko <[email protected]>
libbpf: don't close(-1) in multi-uprobe feature detector
Damien Le Moal <[email protected]>
null_blk: Do not allow runt zone with zone capacity smaller then zone size
Armin Wolf <[email protected]>
hwmon: (dell-smm) Add Dell G15 5511 to fan control whitelist
Alex Deucher <[email protected]>
drm/amdgpu: silence UBSAN warning
Takashi Iwai <[email protected]>
ALSA: ump: Set default protocol when not given explicitly
Witold Sadowski <[email protected]>
spi: cadence: Ensure data lines set to low during dummy-cycle period
Edward Adam Davis <[email protected]>
nfc/nci: Add the inconsistency check between the input data length and count
Masahiro Yamada <[email protected]>
kbuild: fix short log for AS in link-vmlinux.sh
Sagi Grimberg <[email protected]>
nvmet: fix a possible leak when destroy a ctrl during qp establishment
Hannes Reinecke <[email protected]>
block: check for max_hw_sectors underflow
hmtheboy154 <[email protected]>
platform/x86: touchscreen_dmi: Add info for the EZpad 6s Pro
hmtheboy154 <[email protected]>
platform/x86: touchscreen_dmi: Add info for GlobalSpace SolT IVW 11.6" tablet
Jim Wylder <[email protected]>
regmap-i2c: Subtract reg size from max_write
Andrii Nakryiko <[email protected]>
libbpf: detect broken PID filtering logic for multi-uprobe
Kundan Kumar <[email protected]>
nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset
Christian Brauner <[email protected]>
swap: yield device immediately
Matt Jan <[email protected]>
connector: Fix invalid conversion in cn_proc.h
Hawking Zhang <[email protected]>
drm/amdgpu: correct hbm field in boot status
Fedor Pchelkin <[email protected]>
dma-mapping: benchmark: avoid needless copy_to_user if benchmark fails
Nilay Shroff <[email protected]>
nvme-multipath: find NUMA path only for online numa-node
Mike Christie <[email protected]>
vhost-scsi: Handle vhost_vq_work_queue failures for events
Jian-Hong Pan <[email protected]>
ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897
Lang Yu <[email protected]>
drm/amdkfd: Let VRAM allocations go to GTT domain on small APUs
Konstantin Komarov <[email protected]>
fs/ntfs3: Mark volume as dirty if xattr is broken
Piotr Wojtaszczyk <[email protected]>
i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
Pin-yen Lin <[email protected]>
clk: mediatek: mt8183: Only enable runtime PM on mt8183-mfgcfg
Gabor Juhos <[email protected]>
clk: qcom: clk-alpha-pll: set ALPHA_EN bit for Stromer Plus PLLs
Luca Weiss <[email protected]>
clk: qcom: gcc-sm6350: Fix gpll6* & gpll7 parents
Dragan Simic <[email protected]>
arm64: dts: rockchip: Fix the DCDC_REG2 minimum voltage on Quartz64 Model B
Mickaël Salaün <[email protected]>
selftests/harness: Fix tests timeout and race condition
Stefan Haberland <[email protected]>
s390/dasd: Fix invalid dereferencing of indirect CCW data pointer
Ghadi Elie Rahme <[email protected]>
bnx2x: Fix multiple UBSAN array-index-out-of-bounds
Yijie Yang <[email protected]>
net: stmmac: dwmac-qcom-ethqos: fix error array size
Christian Brauner <[email protected]>
fs: don't misleadingly warn during thaw operations
Val Packett <[email protected]>
mtd: rawnand: rockchip: ensure NVDDR timings are rejected
Miquel Raynal <[email protected]>
mtd: rawnand: Bypass a couple of sanity checks during NAND identification
Miquel Raynal <[email protected]>
mtd: rawnand: Fix the nand_read_data_op() early check
Miquel Raynal <[email protected]>
mtd: rawnand: Ensure ECC configuration is propagated to upper layers
Jann Horn <[email protected]>
filelock: Remove locks reliably when fcntl/close race is detected
Thomas Zimmermann <[email protected]>
firmware: sysfb: Fix reference count of sysfb parent device
Jinglin Wen <[email protected]>
powerpc/64s: Fix unnecessary copy to 0 when kernel is booted at address 0
Nicholas Piggin <[email protected]>
powerpc/pseries: Fix scv instruction crash with kexec
Frank Oltmanns <[email protected]>
clk: sunxi-ng: common: Don't call hw_to_ccu_common on hw without common
Md Sadre Alam <[email protected]>
clk: qcom: gcc-ipq9574: Add BRANCH_HALT_VOTED flag
John Schoenick <[email protected]>
drm: panel-orientation-quirks: Add quirk for Valve Galileo
Alex Deucher <[email protected]>
drm/amdgpu/atomfirmware: silence UBSAN warning
Ma Ke <[email protected]>
drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
Thomas Hellström <[email protected]>
drm/ttm: Always take the bo delayed cleanup path for imported bos
Matthew Auld <[email protected]>
drm/xe: fix error handling in xe_migrate_update_pgtables
Jan Kara <[email protected]>
Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
Jan Kara <[email protected]>
fsnotify: Do not generate events for O_PATH file descriptors
Jimmy Assarsson <[email protected]>
can: kvaser_usb: Explicitly initialize family in leafimx driver_info struct
Zijun Hu <[email protected]>
Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
Sven Peter <[email protected]>
Bluetooth: Add quirk to ignore reserved PHY bits in LE Extended Adv Report
Hector Martin <[email protected]>
Bluetooth: hci_bcm4377: Fix msgid release
Nathan Chancellor <[email protected]>
scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add()
Nathan Chancellor <[email protected]>
f2fs: Add inline to f2fs_build_fault_attr() stub
Boris Burkov <[email protected]>
btrfs: fix folio refcount in __alloc_dummy_extent_buffer()
Naohiro Aota <[email protected]>
btrfs: fix adding block group to a reclaim list and the unused list during reclaim
Naohiro Aota <[email protected]>
btrfs: zoned: fix calc_available_free_space() for zoned mode
Jan Kara <[email protected]>
mm: avoid overflows in dirty throttling logic
Jinliang Zheng <[email protected]>
mm: optimize the redundant loop of mm_update_owner_next()
Ryusuke Konishi <[email protected]>
nilfs2: fix incorrect inode allocation from reserved inodes
Ryusuke Konishi <[email protected]>
nilfs2: add missing check for inode numbers on directory entries
Ryusuke Konishi <[email protected]>
nilfs2: fix inode number range checks
Sasha Neftin <[email protected]>
Revert "igc: fix a log entry using uninitialized netdev"
Armin Wolf <[email protected]>
platform/x86: toshiba_acpi: Fix quickstart quirk handling
Dmitry Torokhov <[email protected]>
gpiolib: of: add polarity quirk for TSC2005
Pavan Chebbi <[email protected]>
bnxt_en: Fix the resource check condition for RSS contexts
Aleksandr Mishin <[email protected]>
mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file
Shigeru Yoshida <[email protected]>
inet_diag: Initialize pad field in struct inet_diag_req_v2
Kuniyuki Iwashima <[email protected]>
tcp: Don't flag tcp_sk(sk)->rx_opt.saw_unknown for TCP AO.
Matt Roper <[email protected]>
drm/xe/mcr: Avoid clobbering DSS steering
Zijian Zhang <[email protected]>
selftests: make order checking verbose in msg_zerocopy selftest
Zijian Zhang <[email protected]>
selftests: fix OOM in msg_zerocopy selftest
Petr Oros <[email protected]>
ice: use proper macro for testing bit
Jacob Keller <[email protected]>
ice: Reject pin requests with unsupported flags
Jacob Keller <[email protected]>
ice: Don't process extts if PTP is disabled
Milena Olech <[email protected]>
ice: Fix improper extts handling
Sam Sun <[email protected]>
bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
Radu Rendec <[email protected]>
net: rswitch: Avoid use-after-free in rswitch_poll()
Florian Westphal <[email protected]>
netfilter: nf_tables: unconditionally flush pending work before notifier
Song Shuai <[email protected]>
riscv: kexec: Avoid deadlock in kexec crash path
Jozef Hopko <[email protected]>
wifi: wilc1000: fix ies_len type in connect path
Shiji Yang <[email protected]>
gpio: mmio: do not calculate bgpio_bits via "ngpios"
Eric Farman <[email protected]>
s390/vfio_ccw: Fix target addresses of TIC CCWs
Furong Xu <[email protected]>
net: stmmac: enable HW-accelerated VLAN stripping for gmac4 only
Thomas Huth <[email protected]>
drm/fbdev-generic: Fix framebuffer on big endian devices
Dave Jiang <[email protected]>
net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()
Bartosz Golaszewski <[email protected]>
net: phy: aquantia: add missing include guards
Qu Wenruo <[email protected]>
btrfs: always do the basic checks for btrfs_qgroup_inherit structure
Jiawen Wu <[email protected]>
net: txgbe: free isb resources at the right time
Jiawen Wu <[email protected]>
net: txgbe: add extra handle for MSI/INTx into thread irq handle
Jiawen Wu <[email protected]>
net: txgbe: remove separate irq request for MSI and INTx
Jiawen Wu <[email protected]>
net: txgbe: initialize num_q_vectors for MSI/INTx interrupts
Sagi Grimberg <[email protected]>
net: allow skb_datagram_iter to be called from any context
Dmitry Torokhov <[email protected]>
gpiolib: of: fix lookup quirk for MIPS Lantiq
Dima Ruinskiy <[email protected]>
e1000e: Fix S0ix residency on corporate systems
Christian Borntraeger <[email protected]>
KVM: s390: fix LPSWEY handling
Jakub Kicinski <[email protected]>
tcp_metrics: validate source addr length
Pavel Skripkin <[email protected]>
bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX
Iulia Tanasescu <[email protected]>
Bluetooth: ISO: Check socket flag instead of hcon
Edward Adam Davis <[email protected]>
Bluetooth: Ignore too large handle values in BIG
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_event: Fix setting of unicast qos interval
Leon Romanovsky <[email protected]>
net/mlx5e: Approximate IPsec per-SA payload data bytes count
Leon Romanovsky <[email protected]>
net/mlx5e: Present succeeded IPsec SA bytes and packet
Jianbo Liu <[email protected]>
net/mlx5e: Add mqprio_rl cleanup and free in mlx5e_priv_cleanup()
Chris Mi <[email protected]>
net/mlx5: E-switch, Create ingress ACL when needed
Neal Cardwell <[email protected]>
UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()
Johannes Berg <[email protected]>
wifi: mac80211: fix BSS_CHANGED_UNSOL_BCAST_PROBE_RESP
Marek Vasut <[email protected]>
net: phy: phy_device: Fix PHY LED blinking code comment
Eric Dumazet <[email protected]>
wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
Dmitry Antipov <[email protected]>
mac802154: fix time calculation in ieee802154_configure_durations()
Li Zhang <[email protected]>
virtio-pci: Check if is_avq is NULL
Mike Christie <[email protected]>
vhost_task: Handle SIGKILL by flushing work and exiting
Mike Christie <[email protected]>
vhost: Release worker mutex during flushes
Mike Christie <[email protected]>
vhost: Use virtqueue mutex for swapping worker
Patryk Wlazlyn <[email protected]>
tools/power turbostat: Avoid possible memory corruption due to sparse topology IDs
Len Brown <[email protected]>
tools/power turbostat: Remember global max_die_id
Justin Stitt <[email protected]>
cdrom: rearrange last_media_change check to avoid unintentional overflow
Lu Yao <[email protected]>
btrfs: scrub: initialize ret in scrub_simple_mirror() to fix compilation warning
Holger Dengler <[email protected]>
s390/pkey: Wipe copies of protected- and secure-keys
Holger Dengler <[email protected]>
s390/pkey: Wipe copies of clear-key structures on failure
Holger Dengler <[email protected]>
s390/pkey: Wipe sensitive data on failure
Jules Irenge <[email protected]>
s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings
Sven Schnelle <[email protected]>
s390: Mark psw in __load_psw_mask() as __unitialized
Wang Yong <[email protected]>
jffs2: Fix potential illegal address access in jffs2_free_inode
Matthias Schiffer <[email protected]>
serial: imx: Raise TX trigger level to 8
Tomas Henzl <[email protected]>
scsi: mpi3mr: Sanitise num_phys
Chao Yu <[email protected]>
f2fs: check validation of fault attrs in f2fs_build_fault_attr()
Jose E. Marchesi <[email protected]>
bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
Corinna Vinschen <[email protected]>
igc: fix a log entry using uninitialized netdev
John Hubbard <[email protected]>
selftests/net: fix uninitialized variables
Greg Kurz <[email protected]>
powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"
Mickaël Salaün <[email protected]>
kunit: Handle test faults
Mickaël Salaün <[email protected]>
kunit: Fix timeout message
Mike Marshall <[email protected]>
orangefs: fix out-of-bounds fsid access
Michael Ellerman <[email protected]>
powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n
Heiner Kallweit <[email protected]>
i2c: i801: Annotate apanel_addr as __ro_after_init
Shailend Chand <[email protected]>
gve: Account for stopped queues when reading NIC stats
Benjamin Gray <[email protected]>
powerpc/dexcr: Track the DEXCR per-process
Wenkai Lin <[email protected]>
crypto: hisilicon/sec2 - fix for register offset
Ricardo Ribalda <[email protected]>
media: dvb-frontends: tda10048: Fix integer overflow
Ricardo Ribalda <[email protected]>
media: tc358746: Use the correct div_ function
Ricardo Ribalda <[email protected]>
media: i2c: st-mipid02: Use the correct div function
Ricardo Ribalda <[email protected]>
media: s2255: Use refcount_t instead of atomic_t for num_channels
Ricardo Ribalda <[email protected]>
media: dvb-frontends: tda18271c2dd: Remove casting during div
Simon Horman <[email protected]>
net: dsa: mv88e6xxx: Correct check for empty list
Julien Panis <[email protected]>
thermal/drivers/mediatek/lvts_thermal: Check NULL ptr on lvts_data
StanleyYP Wang <[email protected]>
wifi: mt76: mt7996: add sanity checks for background radar trigger
Felix Fietkau <[email protected]>
wifi: mt76: replace skb_put with skb_put_zero
Niklas Neronin <[email protected]>
usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB
Erick Archer <[email protected]>
Input: ff-core - prefer struct_size over open coded arithmetic
Kees Cook <[email protected]>
kunit/fortify: Do not spam logs with fortify WARNs
Jean Delvare <[email protected]>
firmware: dmi: Stop decoding on broken entry
Erick Archer <[email protected]>
sctp: prefer struct_size over open coded arithmetic
Mauro Carvalho Chehab <[email protected]>
media: dw2102: fix a potential buffer overflow
Samuel Holland <[email protected]>
riscv: Apply SiFive CIP-1200 workaround to single-ASID sfence.vma
Michael Bunk <[email protected]>
media: dw2102: Don't translate i2c read into write
Jesse Zhang <[email protected]>
drm/amdgpu: fix the warning about the expression (int)size - len
Tim Huang <[email protected]>
drm/amdgpu: fix uninitialized scalar variable warning
Alex Hung <[email protected]>
drm/amd/display: Fix uninitialized variables in DM
Alex Hung <[email protected]>
drm/amd/display: ASSERT when failing to find index by plane/stream id
Alex Hung <[email protected]>
drm/amd/display: Do not return negative stream id for array
Wenjing Liu <[email protected]>
drm/amd/display: update pipe topology log to support subvp
Hersen Wu <[email protected]>
drm/amd/display: Fix overlapping copy within dml_core_mode_programming
Alex Hung <[email protected]>
drm/amd/display: Skip finding free audio for unknown engine_id
Alex Hung <[email protected]>
drm/amd/display: Check pipe offset before setting vblank
Alex Hung <[email protected]>
drm/amd/display: Check index msg_id before read or write
Hersen Wu <[email protected]>
drm/amd/display: Add NULL pointer check for kzalloc
Bob Zhou <[email protected]>
drm/amdgpu: fix double free err_addr pointer warnings
Ma Jun <[email protected]>
drm/amdgpu: Initialize timestamp for some legacy SOCs
Jesse Zhang <[email protected]>
drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
Ma Jun <[email protected]>
drm/amdgpu: Fix uninitialized variable warnings
Fei Shao <[email protected]>
media: mediatek: vcodec: Only free buffer VA that is not NULL
Hailey Mothershead <[email protected]>
crypto: aead,cipher - zeroize key buffer after use
Atish Patra <[email protected]>
RISC-V: KVM: Fix the initial sample period value
Eduard Zingerman <[email protected]>
selftests/bpf: dummy_st_ops should reject 0 for non-nullable params
Eduard Zingerman <[email protected]>
bpf: check bpf_dummy_struct_ops program params for test runs
Eduard Zingerman <[email protected]>
selftests/bpf: do not pass NULL for non-nullable params in dummy_st_ops
Eduard Zingerman <[email protected]>
selftests/bpf: adjust dummy_st_ops_success to detect additional error
Eduard Zingerman <[email protected]>
bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable
Guanrui Huang <[email protected]>
irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc
John Meneghini <[email protected]>
scsi: qedf: Make qedf_execute_tmf() non-preemptible
Michael Guralnik <[email protected]>
IB/core: Implement a limit on UMAD receive List
Rodrigo Vivi <[email protected]>
drm/xe: Add outer runtime_pm protection to xe_live_ktest@xe_dma_buf
Zong-Zhe Yang <[email protected]>
wifi: rtw89: fw: scan offload prohibit all 6 GHz channel if no 6 GHz sband
Breno Leitao <[email protected]>
net: dql: Avoid calling BUG() when WARN() is enough
Ricardo Ribalda <[email protected]>
media: dvb-usb: dib0700_devices: Add missing release_firmware()
Ricardo Ribalda <[email protected]>
media: dvb: as102-fe: Fix as10x_register_addr packing
Mahesh Salgaonkar <[email protected]>
powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
Erico Nunes <[email protected]>
drm/lima: fix shared irq handling on driver remove
Chenghai Huang <[email protected]>
crypto: hisilicon/debugfs - Fix debugfs uninit process issue
George Stark <[email protected]>
leds: an30259a: Use devm_mutex_init() for mutex initialization
George Stark <[email protected]>
leds: mlxreg: Use devm_mutex_init() for mutex initialization
George Stark <[email protected]>
locking/mutex: Introduce devm_mutex_init()
Babu Moger <[email protected]>
selftests/resctrl: Fix non-contiguous CBM for AMD
-------------
Diffstat:
Makefile | 4 +- arch/arm64/boot/dts/rockchip/rk3566-quartz64-b.dts | 2 +- arch/powerpc/include/asm/interrupt.h | 10 ++ arch/powerpc/include/asm/io.h | 2 +- arch/powerpc/include/asm/percpu.h | 10 ++ arch/powerpc/include/asm/processor.h | 1 + arch/powerpc/kernel/head_64.S | 5 +- arch/powerpc/kernel/process.c | 10 ++ arch/powerpc/kernel/ptrace/ptrace-view.c | 7 +- arch/powerpc/kernel/setup_64.c | 2 + arch/powerpc/kexec/core_64.c | 11 ++ arch/powerpc/platforms/pseries/kexec.c | 8 -- arch/powerpc/platforms/pseries/pseries.h | 1 - arch/powerpc/platforms/pseries/setup.c | 1 - arch/powerpc/xmon/xmon.c | 6 +- arch/riscv/include/asm/errata_list.h | 12 +- arch/riscv/include/asm/tlbflush.h | 19 ++- arch/riscv/kernel/machine_kexec.c | 10 +- arch/riscv/kvm/vcpu_pmu.c | 2 +- arch/riscv/mm/tlbflush.c | 23 ---- arch/s390/include/asm/kvm_host.h | 1 + arch/s390/include/asm/processor.h | 2 +- arch/s390/kvm/kvm-s390.c | 1 + arch/s390/kvm/kvm-s390.h | 15 +++ arch/s390/kvm/priv.c | 32 +++++ block/blk-settings.c | 8 +- crypto/aead.c | 3 +- crypto/cipher.c | 3 +- drivers/base/regmap/regmap-i2c.c | 3 +- drivers/block/null_blk/zoned.c | 11 ++ drivers/bluetooth/hci_bcm4377.c | 10 +- drivers/bluetooth/hci_qca.c | 18 ++- drivers/cdrom/cdrom.c | 2 +- drivers/clk/mediatek/clk-mt8183-mfgcfg.c | 1 + drivers/clk/mediatek/clk-mtk.c | 24 ++-- drivers/clk/mediatek/clk-mtk.h | 2 + drivers/clk/qcom/clk-alpha-pll.c | 3 + drivers/clk/qcom/gcc-ipq9574.c | 10 +- drivers/clk/qcom/gcc-sm6350.c | 10 +- drivers/clk/sunxi-ng/ccu_common.c | 18 ++- drivers/crypto/hisilicon/debugfs.c | 21 +++- drivers/crypto/hisilicon/sec2/sec_main.c | 2 +- drivers/firmware/dmi_scan.c | 11 ++ drivers/firmware/sysfb.c | 12 +- drivers/gpio/gpio-mmio.c | 2 - drivers/gpio/gpiolib-of.c | 22 +++- drivers/gpu/drm/amd/amdgpu/aldebaran.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 20 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 8 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 +- drivers/gpu/drm/amd/amdgpu/sienna_cichlid.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.h | 3 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 4 +- .../amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c | 8 ++ .../amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 8 ++ drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 106 ++++++++++++----- .../drm/amd/display/dc/dml2/display_mode_core.c | 4 +- .../amd/display/dc/dml2/dml2_dc_resource_mgmt.c | 6 +- .../amd/display/dc/irq/dce110/irq_service_dce110.c | 8 +- .../amd/display/dc/resource/dcn30/dcn30_resource.c | 3 + .../amd/display/dc/resource/dcn31/dcn31_resource.c | 5 + .../display/dc/resource/dcn314/dcn314_resource.c | 5 + .../display/dc/resource/dcn315/dcn315_resource.c | 2 + .../display/dc/resource/dcn316/dcn316_resource.c | 2 + .../amd/display/dc/resource/dcn32/dcn32_resource.c | 5 + .../display/dc/resource/dcn321/dcn321_resource.c | 2 + .../amd/display/dc/resource/dcn35/dcn35_resource.c | 2 + .../display/dc/resource/dcn351/dcn351_resource.c | 2 + .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 8 ++ drivers/gpu/drm/amd/include/atomfirmware.h | 4 +- drivers/gpu/drm/drm_fbdev_generic.c | 3 +- drivers/gpu/drm/drm_panel_orientation_quirks.c | 7 ++ drivers/gpu/drm/lima/lima_gp.c | 2 + drivers/gpu/drm/lima/lima_mmu.c | 5 + drivers/gpu/drm/lima/lima_pp.c | 4 + drivers/gpu/drm/nouveau/nouveau_connector.c | 3 + drivers/gpu/drm/ttm/ttm_bo.c | 1 + drivers/gpu/drm/xe/tests/xe_dma_buf.c | 3 + drivers/gpu/drm/xe/xe_gt_mcr.c | 6 +- drivers/gpu/drm/xe/xe_migrate.c | 8 +- drivers/hwmon/dell-smm-hwmon.c | 8 ++ drivers/i2c/busses/i2c-i801.c | 2 +- drivers/i2c/busses/i2c-pnx.c | 48 ++------ drivers/infiniband/core/user_mad.c | 21 +++- drivers/input/ff-core.c | 7 +- drivers/irqchip/irq-gic-v3-its.c | 2 - drivers/leds/leds-an30259a.c | 14 +-- drivers/leds/leds-mlxreg.c | 14 +-- drivers/media/dvb-frontends/as102_fe_types.h | 2 +- drivers/media/dvb-frontends/tda10048.c | 9 +- drivers/media/dvb-frontends/tda18271c2dd.c | 4 +- drivers/media/i2c/st-mipid02.c | 2 +- drivers/media/i2c/tc358746.c | 3 +- .../vcodec/decoder/vdec/vdec_av1_req_lat_if.c | 22 ++-- .../mediatek/vcodec/encoder/venc/venc_h264_if.c | 5 +- drivers/media/usb/dvb-usb/dib0700_devices.c | 18 ++- drivers/media/usb/dvb-usb/dw2102.c | 120 +++++++++++-------- drivers/media/usb/s2255/s2255drv.c | 20 ++-- drivers/mtd/nand/raw/nand_base.c | 68 ++++++----- drivers/mtd/nand/raw/rockchip-nand-controller.c | 6 +- drivers/net/bonding/bond_options.c | 6 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 1 + drivers/net/dsa/mv88e6xxx/chip.c | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 +- drivers/net/ethernet/google/gve/gve_ethtool.c | 41 ++++++- drivers/net/ethernet/intel/e1000e/netdev.c | 132 ++++++++++----------- drivers/net/ethernet/intel/ice/ice_hwmon.c | 2 +- drivers/net/ethernet/intel/ice/ice_ptp.c | 131 +++++++++++++++----- drivers/net/ethernet/intel/ice/ice_ptp.h | 9 ++ .../ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 46 +++++-- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 5 + .../mellanox/mlx5/core/esw/acl/ingress_ofld.c | 37 ++++-- .../net/ethernet/mellanox/mlxsw/core_linecards.c | 1 + drivers/net/ethernet/renesas/rswitch.c | 4 +- .../ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 7 +- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 1 + drivers/net/ethernet/wangxun/libwx/wx_lib.c | 10 +- drivers/net/ethernet/wangxun/libwx/wx_type.h | 1 + drivers/net/ethernet/wangxun/ngbe/ngbe_main.c | 2 + drivers/net/ethernet/wangxun/txgbe/txgbe_irq.c | 124 ++++++++----------- drivers/net/ethernet/wangxun/txgbe/txgbe_irq.h | 2 +- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 9 +- drivers/net/ntb_netdev.c | 2 +- drivers/net/phy/aquantia/aquantia.h | 5 + .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 10 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 2 +- .../net/wireless/mediatek/mt76/mt7996/debugfs.c | 5 + drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 5 +- drivers/net/wireless/microchip/wilc1000/hif.c | 3 +- drivers/net/wireless/realtek/rtw89/fw.c | 4 + drivers/nfc/virtual_ncidev.c | 4 + drivers/nvme/host/multipath.c | 2 +- drivers/nvme/host/pci.c | 3 +- drivers/nvme/target/core.c | 9 ++ drivers/platform/x86/toshiba_acpi.c | 31 +++-- drivers/platform/x86/touchscreen_dmi.c | 36 ++++++ drivers/s390/block/dasd_eckd.c | 4 +- drivers/s390/block/dasd_fba.c | 2 +- drivers/s390/cio/vfio_ccw_cp.c | 9 +- drivers/s390/crypto/pkey_api.c | 109 ++++++++--------- drivers/scsi/mpi3mr/mpi3mr_transport.c | 10 ++ drivers/scsi/qedf/qedf_io.c | 6 +- drivers/spi/spi-cadence-xspi.c | 20 +++- drivers/thermal/mediatek/lvts_thermal.c | 2 + drivers/tty/serial/imx.c | 2 +- drivers/usb/host/xhci-ring.c | 5 +- drivers/vhost/scsi.c | 17 ++- drivers/vhost/vhost.c | 118 ++++++++++++++---- drivers/vhost/vhost.h | 2 + drivers/virtio/virtio_pci_common.c | 2 +- fs/btrfs/block-group.c | 13 +- fs/btrfs/extent_io.c | 2 +- fs/btrfs/qgroup.c | 10 +- fs/btrfs/scrub.c | 2 +- fs/btrfs/space-info.c | 24 +++- fs/f2fs/f2fs.h | 12 +- fs/f2fs/super.c | 27 +++-- fs/f2fs/sysfs.c | 14 ++- fs/jffs2/super.c | 1 + fs/locks.c | 9 +- fs/nilfs2/alloc.c | 19 ++- fs/nilfs2/alloc.h | 4 +- fs/nilfs2/dat.c | 2 +- fs/nilfs2/dir.c | 6 + fs/nilfs2/ifile.c | 7 +- fs/nilfs2/nilfs.h | 10 +- fs/nilfs2/the_nilfs.c | 6 + fs/nilfs2/the_nilfs.h | 2 +- fs/ntfs3/xattr.c | 5 +- fs/orangefs/super.c | 3 +- fs/super.c | 11 +- include/kunit/try-catch.h | 3 - include/linux/dynamic_queue_limits.h | 3 +- include/linux/fsnotify.h | 8 +- include/linux/mutex.h | 27 +++++ include/linux/phy.h | 2 +- include/linux/sched/vhost_task.h | 3 +- include/net/bluetooth/hci.h | 11 ++ include/net/mac80211.h | 2 +- include/uapi/linux/cn_proc.h | 3 +- kernel/dma/map_benchmark.c | 3 + kernel/exit.c | 2 + kernel/kthread.c | 1 + kernel/locking/mutex-debug.c | 12 ++ kernel/power/swap.c | 2 +- kernel/vhost_task.c | 53 ++++++--- lib/fortify_kunit.c | 9 +- lib/kunit/try-catch.c | 22 ++-- mm/page-writeback.c | 32 ++++- net/bluetooth/hci_conn.c | 15 ++- net/bluetooth/hci_event.c | 33 +++++- net/bluetooth/iso.c | 3 +- net/bpf/bpf_dummy_struct_ops.c | 55 ++++++++- net/core/datagram.c | 19 ++- net/ipv4/inet_diag.c | 2 + net/ipv4/tcp_input.c | 9 +- net/ipv4/tcp_metrics.c | 1 + net/mac802154/main.c | 14 ++- net/netfilter/nf_tables_api.c | 3 +- net/sctp/socket.c | 7 +- net/wireless/nl80211.c | 6 +- scripts/link-vmlinux.sh | 2 +- sound/core/ump.c | 8 ++ sound/pci/hda/patch_realtek.c | 9 ++ tools/lib/bpf/bpf_core_read.h | 1 + tools/lib/bpf/features.c | 32 ++++- tools/power/x86/turbostat/turbostat.c | 35 ++++-- .../selftests/bpf/prog_tests/dummy_st_ops.c | 34 +++++- .../selftests/bpf/progs/dummy_st_ops_success.c | 15 ++- tools/testing/selftests/kselftest_harness.h | 43 ++++--- tools/testing/selftests/net/gro.c | 3 + tools/testing/selftests/net/ip_local_port_range.c | 2 +- tools/testing/selftests/net/mptcp/pm_nl_ctl.c | 2 +- tools/testing/selftests/net/msg_zerocopy.c | 14 ++- tools/testing/selftests/resctrl/cat_test.c | 32 +++-- 225 files changed, 2001 insertions(+), 883 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/197 selftests/resctrl: Fix non-contiguous CBM for AMD
6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Babu Moger <[email protected]>
[ Upstream commit 48236960c06d32370bfa6f2cc408e786873262c8 ]
The non-contiguous CBM test fails on AMD with:
Starting L3_NONCONT_CAT test ...
Mounting resctrl to "/sys/fs/resctrl"
CPUID output doesn't match 'sparse_masks' file content! not ok 5 L3_NONCONT_CAT: test
AMD always supports non-contiguous CBM but does not report it via CPUID.
Fix the non-contiguous CBM test to use CPUID to discover non-contiguous CBM support only on Intel.
--- tools/testing/selftests/resctrl/cat_test.c | 32 +++++++++++++++------- 1 file changed, 22 insertions(+), 10 deletions(-)
tools/testing/selftests/resctrl/cat_test.c +22 -10
@@ -294,11 +294,30 @@ static int cat_run_test(const struct resctrl_test *test, const struct user_paramreturn ret; } +static bool arch_supports_noncont_cat (const struct resctrl_test *test) +{ +unsigned int eax, ebx, ecx, edx; + +/* AMD always supports non-contiguous CBM. */ +if (get_vendor () ==ARCH_AMD ) +return true; + +/* Intel support for non-contiguous CBM needs to be discovered. */ +if (!strcmp (test->resource,"L3" )) +__cpuid_count (0x10 ,1 , eax, ebx, ecx, edx); +else if (!strcmp (test->resource,"L2" )) +__cpuid_count (0x10 ,2 , eax, ebx, ecx, edx); +else +return false; + +return ((ecx >>3 ) &1 ); +} +static int noncont_cat_run_test (const struct resctrl_test *test,const struct user_params *uparams) {unsigned long full_cache_mask, cont_mask, noncont_mask; -unsigned int eax, ebx, ecx, edx, sparse_masks; +unsigned int sparse_masks;int bit_center, ret;char schemata[64 ];
@@ -307,15 +326,8 @@ static int noncont_cat_run_test(const struct resctrl_test *test,if (ret)return ret; -if (!strcmp (test->resource,"L3" )) -__cpuid_count (0x10 ,1 , eax, ebx, ecx, edx); -else if (!strcmp (test->resource,"L2" )) -__cpuid_count (0x10 ,2 , eax, ebx, ecx, edx); -else -return -EINVAL ; - -if (sparse_masks != ((ecx >>3 ) &1 )) { -ksft_print_msg ("CPUID output doesn't match 'sparse_masks' file content!\n" ); +if (arch_supports_noncont_cat (test) != sparse_masks) { +ksft_print_msg ("Hardware and kernel differ on non-contiguous CBM support!\n" );return 1 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/197 locking/mutex: Introduce devm_mutex_init()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: George Stark <[email protected]>
[ Upstream commit 4cd47222e435dec8e3787614924174f53fcfb5ae ]
Using of devm API leads to a certain order of releasing resources. So all dependent resources which are not devm-wrapped should be deleted with respect to devm-release order. Mutex is one of such objects that often is bound to other resources and has no own devm wrapping. Since mutex_destroy() actually does nothing in non-debug builds frequently calling mutex_destroy() is just ignored which is safe for now but wrong formally and can lead to a problem if mutex_destroy() will be extended so introduce devm_mutex_init().
Stable-dep-of: efc347b9efee ("leds: mlxreg: Use devm_mutex_init() for mutex initialization")
--- include/linux/mutex.h | 27 +++++++++++++++++++++++++++ kernel/locking/mutex-debug.c | 12 ++++++++++++ 2 files changed, 39 insertions(+)
include/linux/mutex.h +27 -0
@@ -22,6 +22,8 @@#include <linux/cleanup.h> #include <linux/mutex_types.h> +struct device ; +#ifdef CONFIG_DEBUG_LOCK_ALLOC # define __DEP_MAP_MUTEX_INITIALIZER (lockname) \ , .dep_map = { \
@@ -117,6 +119,31 @@ do { \ } while (0)#endif /* CONFIG_PREEMPT_RT */ +#ifdef CONFIG_DEBUG_MUTEXES + +int __devm_mutex_init (struct device *dev,struct mutex *lock); + +#else + +static inline int __devm_mutex_init (struct device *dev,struct mutex *lock) +{ +/* +* When CONFIG_DEBUG_MUTEXES is off mutex_destroy() is just a nop so +* no really need to register it in the devm subsystem. +*/ +return 0 ; +} + +#endif + +#define devm_mutex_init (dev, mutex) \ +({ \ + typeof(mutex) mutex_ = (mutex); \ + \ + mutex_init(mutex_); \ + __devm_mutex_init(dev, mutex_); \ +}) +/* * See kernel/locking/mutex.c for detailed documentation of these APIs. * Also see Documentation/locking/mutex-design.rst.
kernel/locking/mutex-debug.c +12 -0
@@ -12,6 +12,7 @@*/ #include <linux/mutex.h> #include <linux/delay.h> +#include <linux/device.h> #include <linux/export.h> #include <linux/poison.h> #include <linux/sched.h>
@@ -89,6 +90,17 @@ void debug_mutex_init(struct mutex *lock, const char *name, lock->magic = lock; } +static void devm_mutex_release (void *res) +{ +mutex_destroy (res); +} + +int __devm_mutex_init (struct device *dev,struct mutex *lock) +{ +return devm_add_action_or_reset (dev, devm_mutex_release, lock); +} +EXPORT_SYMBOL_GPL (__devm_mutex_init); +/*** * mutex_destroy - mark a mutex unusable * @lock: the mutex to be destroyed
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/197 leds: mlxreg: Use devm_mutex_init() for mutex initialization
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: George Stark <[email protected]>
[ Upstream commit efc347b9efee1c2b081f5281d33be4559fa50a16 ]
In this driver LEDs are registered using devm_led_classdev_register() so they are automatically unregistered after module's remove() is done. led_classdev_unregister() calls module's led_set_brightness() to turn off the LEDs and that callback uses mutex which was destroyed already in module's remove() so use devm API instead.
--- drivers/leds/leds-mlxreg.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-)
drivers/leds/leds-mlxreg.c +5 -9
@@ -256,6 +256,7 @@ static int mlxreg_led_probe(struct platform_device *pdev) {struct mlxreg_core_platform_data *led_pdata;struct mlxreg_led_priv_data *priv; +int err; led_pdata =dev_get_platdata (&pdev->dev);if (!led_pdata) {
@@ -267,26 +268,21 @@ static int mlxreg_led_probe(struct platform_device *pdev)if (!priv)return -ENOMEM ; -mutex_init (&priv->access_lock); + err =devm_mutex_init (&pdev->dev, &priv->access_lock); +if (err) +return err; + priv->pdev = pdev; priv->pdata = led_pdata;return mlxreg_led_config (priv); } -static void mlxreg_led_remove (struct platform_device *pdev) -{ -struct mlxreg_led_priv_data *priv =dev_get_drvdata (&pdev->dev); - -mutex_destroy (&priv->access_lock); -} -static struct platform_driver mlxreg_led_driver = { .driver = { .name ="leds-mlxreg" , }, .probe = mlxreg_led_probe, - .remove_new = mlxreg_led_remove, };module_platform_driver (mlxreg_led_driver);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/197 leds: an30259a: Use devm_mutex_init() for mutex initialization
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: George Stark <[email protected]>
[ Upstream commit c382e2e3eccb6b7ca8c7aff5092c1668428e7de6 ]
In this driver LEDs are registered using devm_led_classdev_register() so they are automatically unregistered after module's remove() is done. led_classdev_unregister() calls module's led_set_brightness() to turn off the LEDs and that callback uses mutex which was destroyed already in module's remove() so use devm API instead.
--- drivers/leds/leds-an30259a.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-)
drivers/leds/leds-an30259a.c +4 -10
@@ -283,7 +283,10 @@ static int an30259a_probe(struct i2c_client *client)if (err <0 )return err; -mutex_init (&chip->mutex); + err =devm_mutex_init (&client->dev, &chip->mutex); +if (err) +return err; + chip->client = client;i2c_set_clientdata (client, chip);
@@ -317,17 +320,9 @@ static int an30259a_probe(struct i2c_client *client)return 0 ; exit: -mutex_destroy (&chip->mutex);return err; } -static void an30259a_remove (struct i2c_client *client) -{ -struct an30259a *chip =i2c_get_clientdata (client); - -mutex_destroy (&chip->mutex); -} -static const struct of_device_id an30259a_match_table[] = { { .compatible ="panasonic,an30259a" , }, {/* sentinel */ },
@@ -347,7 +342,6 @@ static struct i2c_driver an30259a_driver = { .of_match_table = an30259a_match_table, }, .probe = an30259a_probe, - .remove = an30259a_remove, .id_table = an30259a_id, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/197 crypto: hisilicon/debugfs - Fix debugfs uninit process issue
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenghai Huang <[email protected]>
[ Upstream commit 8be0913389718e8d27c4f1d4537b5e1b99ed7739 ]
During the zip probe process, the debugfs failure does not stop the probe. When debugfs initialization fails, jumping to the error branch will also release regs, in addition to its own rollback operation.
As a result, it may be released repeatedly during the regs uninit process. Therefore, the null check needs to be added to the regs uninit process.
--- drivers/crypto/hisilicon/debugfs.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
drivers/crypto/hisilicon/debugfs.c +18 -3
@@ -809,8 +809,14 @@ static void dfx_regs_uninit(struct hisi_qm *qm, {int i; +if (!dregs) +return ; +/* Setting the pointer is NULL to prevent double free */ for (i =0 ; i < reg_len; i++) { +if (!dregs[i].regs) +continue ; +kfree (dregs[i].regs); dregs[i].regs =NULL ; }
@@ -860,14 +866,21 @@ static struct dfx_diff_registers *dfx_regs_init(struct hisi_qm *qm,static int qm_diff_regs_init (struct hisi_qm *qm,struct dfx_diff_registers *dregs,u32 reg_len) { +int ret; + qm->debug.qm_diff_regs =dfx_regs_init (qm, qm_diff_regs,ARRAY_SIZE (qm_diff_regs)); -if (IS_ERR (qm->debug.qm_diff_regs)) -return PTR_ERR (qm->debug.qm_diff_regs); +if (IS_ERR (qm->debug.qm_diff_regs)) { + ret =PTR_ERR (qm->debug.qm_diff_regs); + qm->debug.qm_diff_regs =NULL ; +return ret; + } qm->debug.acc_diff_regs =dfx_regs_init (qm, dregs, reg_len);if (IS_ERR (qm->debug.acc_diff_regs)) {dfx_regs_uninit (qm, qm->debug.qm_diff_regs,ARRAY_SIZE (qm_diff_regs)); -return PTR_ERR (qm->debug.acc_diff_regs); + ret =PTR_ERR (qm->debug.acc_diff_regs); + qm->debug.acc_diff_regs =NULL ; +return ret; }return 0 ;
@@ -908,7 +921,9 @@ static int qm_last_regs_init(struct hisi_qm *qm)static void qm_diff_regs_uninit (struct hisi_qm *qm,u32 reg_len) {dfx_regs_uninit (qm, qm->debug.acc_diff_regs, reg_len); + qm->debug.acc_diff_regs =NULL ;dfx_regs_uninit (qm, qm->debug.qm_diff_regs,ARRAY_SIZE (qm_diff_regs)); + qm->debug.qm_diff_regs =NULL ; }/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/197 drm/lima: fix shared irq handling on driver remove
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erico Nunes <[email protected]>
[ Upstream commit a6683c690bbfd1f371510cb051e8fa49507f3f5e ]
lima uses a shared interrupt, so the interrupt handlers must be prepared to be called at any time. At driver removal time, the clocks are disabled early and the interrupts stay registered until the very end of the remove process due to the devm usage.
This is potentially a bug as the interrupts access device registers which assumes clocks are enabled. A crash can be triggered by removing the driver in a kernel with CONFIG_DEBUG_SHIRQ enabled.
This patch frees the interrupts at each lima device finishing callback so that the handlers are already unregistered by the time we fully disable clocks.
--- drivers/gpu/drm/lima/lima_gp.c | 2 ++ drivers/gpu/drm/lima/lima_mmu.c | 5 +++++ drivers/gpu/drm/lima/lima_pp.c | 4 ++++ 3 files changed, 11 insertions(+)
drivers/gpu/drm/lima/lima_gp.c +2 -0
@@ -345,7 +345,9 @@ int lima_gp_init(struct lima_ip *ip)void lima_gp_fini (struct lima_ip *ip) { +struct lima_device *dev = ip->dev; +devm_free_irq (dev->dev, ip->irq, ip); }int lima_gp_pipe_init (struct lima_device *dev)
drivers/gpu/drm/lima/lima_mmu.c +5 -0
@@ -118,7 +118,12 @@ int lima_mmu_init(struct lima_ip *ip)void lima_mmu_fini (struct lima_ip *ip) { +struct lima_device *dev = ip->dev; + +if (ip->id == lima_ip_ppmmu_bcast) +return ; +devm_free_irq (dev->dev, ip->irq, ip); }void lima_mmu_flush_tlb (struct lima_ip *ip)
drivers/gpu/drm/lima/lima_pp.c +4 -0
@@ -286,7 +286,9 @@ int lima_pp_init(struct lima_ip *ip)void lima_pp_fini (struct lima_ip *ip) { +struct lima_device *dev = ip->dev; +devm_free_irq (dev->dev, ip->irq, ip); }int lima_pp_bcast_resume (struct lima_ip *ip)
@@ -319,7 +321,9 @@ int lima_pp_bcast_init(struct lima_ip *ip)void lima_pp_bcast_fini (struct lima_ip *ip) { +struct lima_device *dev = ip->dev; +devm_free_irq (dev->dev, ip->irq, ip); } static int lima_pp_task_validate(struct lima_sched_pipe *pipe,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/197 powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahesh Salgaonkar <[email protected]>
[ Upstream commit 0db880fc865ffb522141ced4bfa66c12ab1fbb70 ]
nmi_enter()/nmi_exit() touches per cpu variables which can lead to kernel crash when invoked during real mode interrupt handling (e.g. early HMI/MCE interrupt handler) if percpu allocation comes from vmalloc area.
Early HMI/MCE handlers are called through DEFINE_INTERRUPT_HANDLER_NMI() wrapper which invokes nmi_enter/nmi_exit calls. We don't see any issue when percpu allocation is from the embedded first chunk. However with CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK enabled there are chances where percpu allocation can come from the vmalloc area.
With kernel command line "percpu_alloc=page" we can force percpu allocation to come from vmalloc area and can see kernel crash in machine_check_early:
[ 1.215714] NIP [c000000000e49eb4] rcu_nmi_enter+0x24/0x110 [ 1.215717] LR [c0000000000461a0] machine_check_early+0xf0/0x2c0 [ 1.215719] --- interrupt: 200 [ 1.215720] [c000000fffd73180] [0000000000000000] 0x0 (unreliable) [ 1.215722] [c000000fffd731b0] [0000000000000000] 0x0 [ 1.215724] [c000000fffd73210] [c000000000008364] machine_check_early_common+0x134/0x1f8
Fix this by avoiding use of nmi_enter()/nmi_exit() in real mode if percpu first chunk is not embedded.
--- arch/powerpc/include/asm/interrupt.h | 10 ++++++++++ arch/powerpc/include/asm/percpu.h | 10 ++++++++++ arch/powerpc/kernel/setup_64.c | 2 ++ 3 files changed, 22 insertions(+)
arch/powerpc/include/asm/interrupt.h +10 -0
@@ -336,6 +336,14 @@ static inline void interrupt_nmi_enter_prepare(struct pt_regs *regs, struct inteif (IS_ENABLED (CONFIG_KASAN ))return ; +/* +* Likewise, do not use it in real mode if percpu first chunk is not +* embedded. With CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK enabled there +* are chances where percpu allocation can come from vmalloc area. +*/ +if (percpu_first_chunk_is_paged) +return ; +/* Otherwise, it should be safe to call it */ nmi_enter (); }
@@ -351,6 +359,8 @@ static inline void interrupt_nmi_exit_prepare(struct pt_regs *regs, struct inter// no nmi_exit for a pseries hash guest taking a real mode exception }else if (IS_ENABLED (CONFIG_KASAN )) {// no nmi_exit for KASAN in real mode + }else if (percpu_first_chunk_is_paged) { +// no nmi_exit if percpu first chunk is not embedded }else {nmi_exit (); }
arch/powerpc/include/asm/percpu.h +10 -0
@@ -15,6 +15,16 @@#endif /* CONFIG_SMP */ #endif /* __powerpc64__ */ +#if defined(CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK ) && defined(CONFIG_SMP ) +#include <linux/jump_label.h> +DECLARE_STATIC_KEY_FALSE (__percpu_first_chunk_is_paged); + +#define percpu_first_chunk_is_paged \ + (static_key_enabled(&__percpu_first_chunk_is_paged.key)) +#else +#define percpu_first_chunk_is_paged false +#endif /* CONFIG_PPC64 && CONFIG_SMP */ +#include <asm-generic/percpu.h> #include <asm/paca.h>
arch/powerpc/kernel/setup_64.c +2 -0
@@ -834,6 +834,7 @@ static __init int pcpu_cpu_to_node(int cpu)unsigned long __per_cpu_offset[NR_CPUS ]__read_mostly ;EXPORT_SYMBOL (__per_cpu_offset); +DEFINE_STATIC_KEY_FALSE (__percpu_first_chunk_is_paged);void __init setup_per_cpu_areas (void ) {
@@ -876,6 +877,7 @@ void __init setup_per_cpu_areas(void)if (rc <0 )panic ("cannot initialize percpu area (err=%d)" , rc); +static_key_enable (&__percpu_first_chunk_is_paged.key); delta = (unsigned long )pcpu_base_addr - (unsigned long )__per_cpu_start;for_each_possible_cpu (cpu) { __per_cpu_offset[cpu] = delta + pcpu_unit_offsets[cpu];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/197 media: dvb: as102-fe: Fix as10x_register_addr packing
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 309422d280748c74f57f471559980268ac27732a ]
This structure is embedded in multiple other structures that are packed, which conflicts with it being aligned.
drivers/media/usb/as102/as10x_cmd.h:379:30: warning: field reg_addr within 'struct as10x_dump_memory::(unnamed at drivers/media/usb/as102/as10x_cmd.h:373:2)' is less aligned than 'struct as10x_register_addr' and is usually due to 'struct as10x_dump_memory::(unnamed at drivers/media/usb/as102/as10x_cmd.h:373:2)' being packed, which can lead to unaligned accesses [-Wunaligned-access]
Mark it as being packed.
Marking the inner struct as 'packed' does not change the layout, since the whole struct is already packed, it just silences the clang warning. See also this llvm discussion:
https://github.com/llvm/llvm-project/issues/55520
--- drivers/media/dvb-frontends/as102_fe_types.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/dvb-frontends/as102_fe_types.h +1 -1
@@ -174,6 +174,6 @@ struct as10x_register_addr {uint32_t addr;/* register mode access */ uint8_t mode; -}; +} __packed;#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/197 media: dvb-usb: dib0700_devices: Add missing release_firmware()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 4b267c23ee064bd24c6933df0588ad1b6e111145 ]
Add missing release_firmware on the error paths.
drivers/media/usb/dvb-usb/dib0700_devices.c:2415 stk9090m_frontend_attach() warn: 'state->frontend_firmware' from request_firmware() not released on lines: 2415. drivers/media/usb/dvb-usb/dib0700_devices.c:2497 nim9090md_frontend_attach() warn: 'state->frontend_firmware' from request_firmware() not released on lines: 2489,2497.
--- drivers/media/usb/dvb-usb/dib0700_devices.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
drivers/media/usb/dvb-usb/dib0700_devices.c +15 -3
@@ -2412,7 +2412,12 @@ static int stk9090m_frontend_attach(struct dvb_usb_adapter *adap) adap->fe_adap[0 ].fe =dvb_attach (dib9000_attach, &adap->dev->i2c_adap,0x80 , &stk9090m_config); -return adap->fe_adap[0 ].fe ==NULL ? -ENODEV :0 ; +if (!adap->fe_adap[0 ].fe) { +release_firmware (state->frontend_firmware); +return -ENODEV ; + } + +return 0 ; }static int dib9090_tuner_attach (struct dvb_usb_adapter *adap)
@@ -2485,8 +2490,10 @@ static int nim9090md_frontend_attach(struct dvb_usb_adapter *adap)dib9000_i2c_enumeration (&adap->dev->i2c_adap,1 ,0x20 ,0x80 ); adap->fe_adap[0 ].fe =dvb_attach (dib9000_attach, &adap->dev->i2c_adap,0x80 , &nim9090md_config[0 ]); -if (adap->fe_adap[0 ].fe ==NULL ) +if (!adap->fe_adap[0 ].fe) { +release_firmware (state->frontend_firmware);return -ENODEV ; + } i2c =dib9000_get_i2c_master (adap->fe_adap[0 ].fe,DIBX000_I2C_INTERFACE_GPIO_3_4 ,0 );dib9000_i2c_enumeration (i2c,1 ,0x12 ,0x82 );
@@ -2494,7 +2501,12 @@ static int nim9090md_frontend_attach(struct dvb_usb_adapter *adap) fe_slave =dvb_attach (dib9000_attach, i2c,0x82 , &nim9090md_config[1 ]);dib9000_set_slave_frontend (adap->fe_adap[0 ].fe, fe_slave); -return fe_slave ==NULL ? -ENODEV :0 ; +if (!fe_slave) { +release_firmware (state->frontend_firmware); +return -ENODEV ; + } + +return 0 ; }static int nim9090md_tuner_attach (struct dvb_usb_adapter *adap)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/197 net: dql: Avoid calling BUG() when WARN() is enough
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit 4854b463c4b27c94a7de86d16ad84f235f4c1a72 ]
If the dql_queued() function receives an invalid argument, WARN about it and continue, instead of crashing the kernel.
This was raised by checkpatch, when I am refactoring this code (see following patch/commit)
WARNING: Do not crash the kernel unless it is absolutely unavoidable--use WARN_ON_ONCE() plus recovery code (if feasible) instead of BUG() or variants
--- include/linux/dynamic_queue_limits.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/linux/dynamic_queue_limits.h +2 -1
@@ -91,7 +91,8 @@ static inline void dql_queued(struct dql *dql, unsigned int count) {unsigned long map, now, now_hi, i; -BUG_ON (count >DQL_MAX_OBJECT ); +if (WARN_ON_ONCE (count >DQL_MAX_OBJECT )) +return ; dql->last_obj_cnt = count;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/197 wifi: rtw89: fw: scan offload prohibit all 6 GHz channel if no 6 GHz sband
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zong-Zhe Yang <[email protected]>
[ Upstream commit bb38626f3f97e16e6d368a9ff6daf320f3fe31d9 ]
We have some policy via BIOS to block uses of 6 GHz. In this case, 6 GHz sband will be NULL even if it is WiFi 7 chip. So, add NULL handling here to avoid crash.
--- drivers/net/wireless/realtek/rtw89/fw.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/realtek/rtw89/fw.c +4 -0
@@ -4646,6 +4646,10 @@ static void rtw89_scan_get_6g_disabled_chan(struct rtw89_dev *rtwdev,u8 i, idx; sband = rtwdev->hw->wiphy->bands[NL80211_BAND_6GHZ ]; +if (!sband) { + option->prohib_chan =U64_MAX ; +return ; + }for (i =0 ; i < sband->n_channels; i++) { chan = &sband->channels[i];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/197 drm/xe: Add outer runtime_pm protection to xe_live_ktest@xe_dma_buf
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rodrigo Vivi <[email protected]>
[ Upstream commit f9116f658a6217b101e3b4e89f845775b6fb05d9 ]
Any kunit doing any memory access should get their own runtime_pm outer references since they don't use the standard driver API entries. In special this dma_buf from the same driver.
Found by pre-merge CI on adding WARN calls for unprotected inner callers:
<6> [318.639739] # xe_dma_buf_kunit: running xe_test_dmabuf_import_same_driver
<4> [318.639957] ------------[ cut here ]------------
<4> [318.639967] xe 0000:4d:00.0: Missing outer runtime PM protection
<4> [318.640049] WARNING: CPU: 117 PID: 3832 at drivers/gpu/drm/xe/xe_pm.c:533 xe_pm_runtime_get_noresume+0x48/0x60 [xe]
--- drivers/gpu/drm/xe/tests/xe_dma_buf.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/xe/tests/xe_dma_buf.c +3 -0
@@ -12,6 +12,7 @@#include "tests/xe_pci_test.h" #include "xe_pci.h" +#include "xe_pm.h" static bool p2p_enabled (struct dma_buf_test_params *params) {
@@ -259,6 +260,7 @@ static int dma_buf_run_device(struct xe_device *xe)const struct dma_buf_test_params *params;struct kunit *test =xe_cur_kunit (); +xe_pm_runtime_get (xe);for (params = test_params; params->mem_mask; ++params) {struct dma_buf_test_params p = *params;
@@ -266,6 +268,7 @@ static int dma_buf_run_device(struct xe_device *xe) test->priv = &p;xe_test_dmabuf_import_same_driver (xe); } +xe_pm_runtime_put (xe);/* A non-zero return would halt iteration over driver devices */ return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/197 IB/core: Implement a limit on UMAD receive List
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Guralnik <[email protected]>
[ Upstream commit ca0b44e20a6f3032224599f02e7c8fb49525c894 ]
The existing behavior of ib_umad, which maintains received MAD packets in an unbounded list, poses a risk of uncontrolled growth. As user-space applications extract packets from this list, the rate of extraction may not match the rate of incoming packets, leading to potential list overflow.
To address this, we introduce a limit to the size of the list. After considering typical scenarios, such as OpenSM processing, which can handle approximately 100k packets per second, and the 1-second retry timeout for most packets, we set the list size limit to 200k. Packets received beyond this limit are dropped, assuming they are likely timed out by the time they are handled by user-space.
Notably, packets queued on the receive list due to reasons like timed-out sends are preserved even when the list is full.
--- drivers/infiniband/core/user_mad.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-)
drivers/infiniband/core/user_mad.c +15 -6
@@ -63,6 +63,8 @@ MODULE_AUTHOR("Roland Dreier");MODULE_DESCRIPTION ("InfiniBand userspace MAD packet access" );MODULE_LICENSE ("Dual BSD/GPL" ); +#define MAX_UMAD_RECV_LIST_SIZE 200000 +enum {IB_UMAD_MAX_PORTS =RDMA_MAX_PORTS ,IB_UMAD_MAX_AGENTS =32 ,
@@ -113,6 +115,7 @@ struct ib_umad_file {struct mutex mutex;struct ib_umad_port *port;struct list_head recv_list; +atomic_t recv_list_size;struct list_head send_list;struct list_head port_list;spinlock_t send_lock;
@@ -180,24 +183,28 @@ static struct ib_mad_agent *__get_agent(struct ib_umad_file *file, int id)return file->agents_dead ?NULL : file->agent[id]; } -static int queue_packet (struct ib_umad_file *file, -struct ib_mad_agent *agent, -struct ib_umad_packet *packet) +static int queue_packet (struct ib_umad_file *file,struct ib_mad_agent *agent, +struct ib_umad_packet *packet,bool is_recv_mad) {int ret =1 ;mutex_lock (&file->mutex); +if (is_recv_mad && +atomic_read (&file->recv_list_size) >MAX_UMAD_RECV_LIST_SIZE ) + goto unlock; +for (packet->mad.hdr.id =0 ; packet->mad.hdr.id <IB_UMAD_MAX_AGENTS ; packet->mad.hdr.id++)if (agent ==__get_agent (file, packet->mad.hdr.id)) {list_add_tail (&packet->list, &file->recv_list); +atomic_inc (&file->recv_list_size);wake_up_interruptible (&file->recv_wait); ret =0 ;break ; } - +unlock:mutex_unlock (&file->mutex);return ret;
@@ -224,7 +231,7 @@ static void send_handler(struct ib_mad_agent *agent,if (send_wc->status ==IB_WC_RESP_TIMEOUT_ERR ) { packet->length =IB_MGMT_MAD_HDR ; packet->mad.hdr.status =ETIMEDOUT ; -if (!queue_packet (file, agent, packet)) +if (!queue_packet (file, agent, packet, false))return ; }kfree (packet);
@@ -284,7 +291,7 @@ static void recv_handler(struct ib_mad_agent *agent,rdma_destroy_ah_attr (&ah_attr); } -if (queue_packet (file, agent, packet)) +if (queue_packet (file, agent, packet, true)) goto err2;return ;
@@ -409,6 +416,7 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf, packet = list_entry(file->recv_list.next, struct ib_umad_packet, list);list_del (&packet->list); +atomic_dec (&file->recv_list_size);mutex_unlock (&file->mutex);
@@ -421,6 +429,7 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf,/* Requeue packet */ mutex_lock (&file->mutex);list_add (&packet->list, &file->recv_list); +atomic_inc (&file->recv_list_size);mutex_unlock (&file->mutex); }else {if (packet->recv_wc)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/197 scsi: qedf: Make qedf_execute_tmf() non-preemptible
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Meneghini <[email protected]>
[ Upstream commit 0d8b637c9c5eeaa1a4e3dfb336f3ff918eb64fec ]
Stop calling smp_processor_id() from preemptible code in qedf_execute_tmf90. This results in BUG_ON() when running an RT kernel.
[ 659.343280] BUG: using smp_processor_id() in preemptible [00000000] code: sg_reset/3646 [ 659.343282] caller is qedf_execute_tmf+0x8b/0x360 [qedf]
--- drivers/scsi/qedf/qedf_io.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/scsi/qedf/qedf_io.c +3 -3
@@ -2324,9 +2324,6 @@ static int qedf_execute_tmf(struct qedf_rport *fcport, u64 tm_lun, io_req->fcport = fcport; io_req->cmd_type =QEDF_TASK_MGMT_CMD ; -/* Record which cpu this request is associated with */ - io_req->cpu =smp_processor_id (); -/* Set TM flags */ io_req->io_req_flags =QEDF_READ ; io_req->data_xfer_len =0 ;
@@ -2349,6 +2346,9 @@ static int qedf_execute_tmf(struct qedf_rport *fcport, u64 tm_lun,spin_lock_irqsave (&fcport->rport_lock, flags); +/* Record which cpu this request is associated with */ + io_req->cpu =smp_processor_id (); + sqe_idx =qedf_get_sqe_idx (fcport); sqe = &fcport->sq[sqe_idx];memset (sqe,0 ,sizeof (struct fcoe_wqe ));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/197 irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guanrui Huang <[email protected]>
[ Upstream commit 382d2ffe86efb1e2fa803d2cf17e5bfc34e574f3 ]
This BUG_ON() is useless, because the same effect will be obtained by letting the code run its course and vm being dereferenced, triggering an exception.
So just remove this check.
--- drivers/irqchip/irq-gic-v3-its.c | 2 -- 1 file changed, 2 deletions(-)
drivers/irqchip/irq-gic-v3-its.c +0 -2
@@ -4507,8 +4507,6 @@ static int its_vpe_irq_domain_alloc(struct irq_domain *domain, unsigned int virqstruct page *vprop_page;int base, nr_ids, i, err =0 ; -BUG_ON (!vm); - bitmap =its_lpi_alloc (roundup_pow_of_two (nr_irqs), &base, &nr_ids);if (!bitmap)return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/197 bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eduard Zingerman <[email protected]>
[ Upstream commit 1479eaff1f16983d8fda7c5a08a586c21891087d ]
Test case dummy_st_ops/dummy_init_ret_value passes NULL as the first parameter of the test_1() function. Mark this parameter as nullable to make verifier aware of such possibility.
Otherwise, NULL check in the test_1() code:
SEC("struct_ops/test_1")
int BPF_PROG(test_1, struct bpf_dummy_ops_state *state)
{
if (!state)
return ...;
... access state ...
}Might be removed by verifier, thus triggering NULL pointer dereference under certain conditions.
--- net/bpf/bpf_dummy_struct_ops.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/bpf/bpf_dummy_struct_ops.c +2 -2
@@ -230,7 +230,7 @@ static void bpf_dummy_unreg(void *kdata) { } -static int bpf_dummy_test_1 (struct bpf_dummy_ops_state *cb) +static int bpf_dummy_ops__test_1 (struct bpf_dummy_ops_state *cb__nullable) {return 0 ; }
@@ -247,7 +247,7 @@ static int bpf_dummy_test_sleepable(struct bpf_dummy_ops_state *cb) }static struct bpf_dummy_ops __bpf_bpf_dummy_ops = { - .test_1 = bpf_dummy_test_1, + .test_1 = bpf_dummy_ops__test_1, .test_2 = bpf_dummy_test_2, .test_sleepable = bpf_dummy_test_sleepable, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/197 selftests/bpf: adjust dummy_st_ops_success to detect additional error
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eduard Zingerman <[email protected]>
[ Upstream commit 3b3b84aacb4420226576c9732e7b539ca7b79633 ]
As reported by Jose E. Marchesi in off-list discussion, GCC and LLVM generate slightly different code for dummy_st_ops_success/test_1():
SEC("struct_ops/test_1")
int BPF_PROG(test_1, struct bpf_dummy_ops_state *state)
{
int ret; if (!state)
return 0xf2f3f4f5;
ret = state->val; state->val = 0x5a; return ret; }
GCC-generated LLVM-generated ---------------------------- --------------------------- 0: r1 = *(u64 *)(r1 + 0x0) 0: w0 = -0xd0c0b0b 1: if r1 == 0x0 goto 5f 1: r1 = *(u64 *)(r1 + 0x0) 2: r0 = *(s32 *)(r1 + 0x0) 2: if r1 == 0x0 goto 6f 3: *(u32 *)(r1 + 0x0) = 0x5a 3: r0 = *(u32 *)(r1 + 0x0) 4: exit 4: w2 = 0x5a 5: r0 = -0xd0c0b0b 5: *(u32 *)(r1 + 0x0) = r2 6: exit 6: exit
If the 'state' argument is not marked as nullable in net/bpf/bpf_dummy_struct_ops.c, the verifier would assume that 'r1 == 0x0' is never true:
- for the GCC version, this means that instructions #5-6 would be marked as dead and removed;
- for the LLVM version, all instructions would be marked as live.
The test dummy_st_ops/dummy_init_ret_value actually sets the 'state' parameter to NULL.
Therefore, when the 'state' argument is not marked as nullable, the GCC-generated version of the code would trigger a NULL pointer dereference at instruction #3.
This patch updates the test_1() test case to always follow a shape similar to the GCC-generated version above, in order to verify whether the 'state' nullability is marked correctly.
--- .../selftests/bpf/progs/dummy_st_ops_success.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
tools/testing/selftests/bpf/progs/dummy_st_ops_success.c +11 -2
@@ -11,8 +11,17 @@ int BPF_PROG(test_1, struct bpf_dummy_ops_state *state) {int ret; -if (!state) -return 0xf2f3f4f5 ; +/* Check that 'state' nullable status is detected correctly. +* If 'state' argument would be assumed non-null by verifier +* the code below would be deleted as dead (which it shouldn't). +* Hide it from the compiler behind 'asm' block to avoid +* unnecessary optimizations. +*/ + asmvolatile ( +"if %[state] != 0 goto +2;" +"r0 = 0xf2f3f4f5;" +"exit;" + ::[state]"p" (state)); ret = state->val; state->val =0x5a ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/197 selftests/bpf: do not pass NULL for non-nullable params in dummy_st_ops
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eduard Zingerman <[email protected]>
[ Upstream commit f612210d456a0b969a0adca91e68dbea0e0ea301 ]
dummy_st_ops.test_2 and dummy_st_ops.test_sleepable do not have their 'state' parameter marked as nullable. Update dummy_st_ops.c to avoid passing NULL for such parameters, as the next patch would allow kernel to enforce this restriction.
--- tools/testing/selftests/bpf/prog_tests/dummy_st_ops.c | 7 +++++-- tools/testing/selftests/bpf/progs/dummy_st_ops_success.c | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-)
tools/testing/selftests/bpf/prog_tests/dummy_st_ops.c +5 -2
@@ -98,7 +98,8 @@ static void test_dummy_init_ptr_arg(void)static void test_dummy_multiple_args (void ) { -__u64 args[5 ] = {0 ,-100 ,0x8a5f ,'c' ,0x1234567887654321ULL }; +struct bpf_dummy_ops_state st = {7 }; +__u64 args[5 ] = {(__u64)&st,-100 ,0x8a5f ,'c' ,0x1234567887654321ULL }; LIBBPF_OPTS(bpf_test_run_opts, attr, .ctx_in = args, .ctx_size_in = sizeof(args),
@@ -115,6 +116,7 @@ static void test_dummy_multiple_args(void) fd =bpf_program__fd (skel->progs.test_2); err =bpf_prog_test_run_opts (fd, &attr);ASSERT_OK (err,"test_run" ); + args[0 ] =7 ;for (i =0 ; i <ARRAY_SIZE (args); i++) {snprintf (name,sizeof (name),"arg %zu" , i);ASSERT_EQ (skel->bss->test_2_args[i], args[i], name);
@@ -125,7 +127,8 @@ static void test_dummy_multiple_args(void)static void test_dummy_sleepable (void ) { -__u64 args[1 ] = {0 }; +struct bpf_dummy_ops_state st; +__u64 args[1 ] = {(__u64)&st}; LIBBPF_OPTS(bpf_test_run_opts, attr, .ctx_in = args, .ctx_size_in = sizeof(args),
tools/testing/selftests/bpf/progs/dummy_st_ops_success.c +1 -1
@@ -34,7 +34,7 @@ SEC("struct_ops/test_2")int BPF_PROG (test_2 ,struct bpf_dummy_ops_state *state,int a1,unsigned short a2,char a3,unsigned long a4) { - test_2_args[0 ] = (unsigned long )state; + test_2_args[0 ] = state->val; test_2_args[1 ] = a1; test_2_args[2 ] = a2; test_2_args[3 ] = a3;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/197 bpf: check bpf_dummy_struct_ops program params for test runs
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eduard Zingerman <[email protected]>
[ Upstream commit 980ca8ceeae69ddf362870ea9183f389ae26324a ]
When doing BPF_PROG_TEST_RUN for bpf_dummy_struct_ops programs, reject execution when NULL is passed for non-nullable params. For programs with non-nullable params verifier assumes that such params are never NULL and thus might optimize out NULL checks.
--- net/bpf/bpf_dummy_struct_ops.c | 51 +++++++++++++++++++++++++++++++++- 1 file changed, 50 insertions(+), 1 deletion(-)
net/bpf/bpf_dummy_struct_ops.c +50 -1
@@ -79,6 +79,51 @@ static int dummy_ops_call_op(void *image, struct bpf_dummy_ops_test_args *args) args->args[3], args->args[4]); } +static const struct bpf_ctx_arg_aux *find_ctx_arg_info (struct bpf_prog_aux *aux,int offset) +{ +int i; + +for (i =0 ; i < aux->ctx_arg_info_size; i++) +if (aux->ctx_arg_info[i].offset == offset) +return &aux->ctx_arg_info[i]; + +return NULL ; +} + +/* There is only one check at the moment: +* - zero should not be passed for pointer parameters not marked as nullable. +*/ +static int check_test_run_args (struct bpf_prog *prog,struct bpf_dummy_ops_test_args *args) +{ +const struct btf_type *func_proto = prog->aux->attach_func_proto; + +for (u32 arg_no =0 ; arg_no <btf_type_vlen (func_proto) ; ++arg_no) { +const struct btf_param *param = &btf_params (func_proto)[arg_no]; +const struct bpf_ctx_arg_aux *info; +const struct btf_type *t; +int offset; + +if (args->args[arg_no] !=0 ) +continue ; + +/* Program is validated already, so there is no need +* to check if t is NULL. +*/ + t =btf_type_skip_modifiers (bpf_dummy_ops_btf, param->type,NULL ); +if (!btf_type_is_ptr (t)) +continue ; + + offset =btf_ctx_arg_offset (bpf_dummy_ops_btf, func_proto, arg_no); + info =find_ctx_arg_info (prog->aux, offset); +if (info && (info->reg_type &PTR_MAYBE_NULL )) +continue ; + +return -EINVAL ; + } + +return 0 ; +} +extern const struct bpf_link_ops bpf_struct_ops_link_lops; int bpf_struct_ops_test_run(struct bpf_prog *prog, const union bpf_attr *kattr,
@@ -87,7 +132,7 @@ int bpf_struct_ops_test_run(struct bpf_prog *prog, const union bpf_attr *kattr,const struct bpf_struct_ops *st_ops = &bpf_bpf_dummy_ops;const struct btf_type *func_proto;struct bpf_dummy_ops_test_args *args; -struct bpf_tramp_links *tlinks; +struct bpf_tramp_links *tlinks =NULL ;struct bpf_tramp_link *link =NULL ;void *image =NULL ;unsigned int op_idx;
@@ -109,6 +154,10 @@ int bpf_struct_ops_test_run(struct bpf_prog *prog, const union bpf_attr *kattr,if (IS_ERR (args))return PTR_ERR (args); + err =check_test_run_args (prog, args); +if (err) + goto out; + tlinks =kcalloc (BPF_TRAMP_MAX ,sizeof (*tlinks),GFP_KERNEL );if (!tlinks) { err = -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/197 selftests/bpf: dummy_st_ops should reject 0 for non-nullable params
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eduard Zingerman <[email protected]>
[ Upstream commit 6a2d30d3c5bf9f088dcfd5f3746b04d84f2fab83 ]
Check if BPF_PROG_TEST_RUN for bpf_dummy_struct_ops programs rejects execution if NULL is passed for non-nullable parameter.
--- .../selftests/bpf/prog_tests/dummy_st_ops.c | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+)
tools/testing/selftests/bpf/prog_tests/dummy_st_ops.c +27 -0
@@ -147,6 +147,31 @@ static void test_dummy_sleepable(void)dummy_st_ops_success__destroy (skel); } +/* dummy_st_ops.test_sleepable() parameter is not marked as nullable, +* thus bpf_prog_test_run_opts() below should be rejected as it tries +* to pass NULL for this parameter. +*/ +static void test_dummy_sleepable_reject_null (void ) +{ +__u64 args[1 ] = {0 }; +LIBBPF_OPTS (bpf_test_run_opts, attr, + .ctx_in = args, + .ctx_size_in = sizeof(args), + ); +struct dummy_st_ops_success *skel; +int fd, err; + + skel =dummy_st_ops_success__open_and_load (); +if (!ASSERT_OK_PTR (skel,"dummy_st_ops_load" )) +return ; + + fd =bpf_program__fd (skel->progs.test_sleepable); + err =bpf_prog_test_run_opts (fd, &attr); +ASSERT_EQ (err, -EINVAL ,"test_run" ); + +dummy_st_ops_success__destroy (skel); +} +void test_dummy_st_ops (void ) {if (test__start_subtest ("dummy_st_ops_attach" ))
@@ -159,6 +184,8 @@ void test_dummy_st_ops(void)test_dummy_multiple_args ();if (test__start_subtest ("dummy_sleepable" ))test_dummy_sleepable (); +if (test__start_subtest ("dummy_sleepable_reject_null" )) +test_dummy_sleepable_reject_null ();RUN_TESTS (dummy_st_ops_fail); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/197 RISC-V: KVM: Fix the initial sample period value
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Atish Patra <[email protected]>
[ Upstream commit 57990ab90ce31aadac0d5a6293f5582e24ff7521 ]
The initial sample period value when counter value is not assigned should be set to maximum value supported by the counter width. Otherwise, it may result in spurious interrupts.
--- arch/riscv/kvm/vcpu_pmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/kvm/vcpu_pmu.c +1 -1
@@ -39,7 +39,7 @@ static u64 kvm_pmu_get_sample_period(struct kvm_pmc *pmc)u64 sample_period;if (!pmc->counter_val) - sample_period = counter_val_mask +1 ; + sample_period = counter_val_mask;else sample_period = (-pmc->counter_val) & counter_val_mask;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/197 crypto: aead,cipher - zeroize key buffer after use
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hailey Mothershead <[email protected]>
[ Upstream commit 23e4099bdc3c8381992f9eb975c79196d6755210 ]
I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding cryptographic information should be zeroized once they are no longer needed. Accomplish this by using kfree_sensitive for buffers that previously held the private key.
--- crypto/aead.c | 3 +-- crypto/cipher.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-)
crypto/aead.c +1 -2
@@ -45,8 +45,7 @@ static int setkey_unaligned(struct crypto_aead *tfm, const u8 *key, alignbuffer = (u8 *)ALIGN ((unsigned long )buffer, alignmask +1 );memcpy (alignbuffer, key, keylen); ret =crypto_aead_alg (tfm)->setkey (tfm, alignbuffer, keylen); -memset (alignbuffer,0 , keylen); -kfree (buffer); +kfree_sensitive (buffer);return ret; }
crypto/cipher.c +1 -2
@@ -34,8 +34,7 @@ static int setkey_unaligned(struct crypto_cipher *tfm, const u8 *key, alignbuffer = (u8 *)ALIGN ((unsigned long )buffer, alignmask +1 );memcpy (alignbuffer, key, keylen); ret = cia->cia_setkey (crypto_cipher_tfm (tfm), alignbuffer, keylen); -memset (alignbuffer,0 , keylen); -kfree (buffer); +kfree_sensitive (buffer);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/197 media: mediatek: vcodec: Only free buffer VA that is not NULL
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fei Shao <[email protected]>
[ Upstream commit eb005c801ec70ff4307727bd3bd6e8280169ef32 ]
In the MediaTek vcodec driver, while mtk_vcodec_mem_free() is mostly called only when the buffer to free exists, there are some instances that didn't do the check and triggered warnings in practice.
We believe those checks were forgotten unintentionally. Add the checks back to fix the warnings.
--- .../vcodec/decoder/vdec/vdec_av1_req_lat_if.c | 22 +++++++++++++------ .../vcodec/encoder/venc/venc_h264_if.c | 5 +++-- 2 files changed, 18 insertions(+), 9 deletions(-)
drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_av1_req_lat_if.c +15 -7
@@ -1023,18 +1023,26 @@ static void vdec_av1_slice_free_working_buffer(struct vdec_av1_slice_instance *iint i;for (i =0 ; i <ARRAY_SIZE (instance->mv); i++) -mtk_vcodec_mem_free (ctx, &instance->mv[i]); +if (instance->mv[i].va) +mtk_vcodec_mem_free (ctx, &instance->mv[i]);for (i =0 ; i <ARRAY_SIZE (instance->seg); i++) -mtk_vcodec_mem_free (ctx, &instance->seg[i]); +if (instance->seg[i].va) +mtk_vcodec_mem_free (ctx, &instance->seg[i]);for (i =0 ; i <ARRAY_SIZE (instance->cdf); i++) -mtk_vcodec_mem_free (ctx, &instance->cdf[i]); +if (instance->cdf[i].va) +mtk_vcodec_mem_free (ctx, &instance->cdf[i]); + -mtk_vcodec_mem_free (ctx, &instance->tile); -mtk_vcodec_mem_free (ctx, &instance->cdf_temp); -mtk_vcodec_mem_free (ctx, &instance->cdf_table); -mtk_vcodec_mem_free (ctx, &instance->iq_table); +if (instance->tile.va) +mtk_vcodec_mem_free (ctx, &instance->tile); +if (instance->cdf_temp.va) +mtk_vcodec_mem_free (ctx, &instance->cdf_temp); +if (instance->cdf_table.va) +mtk_vcodec_mem_free (ctx, &instance->cdf_table); +if (instance->iq_table.va) +mtk_vcodec_mem_free (ctx, &instance->iq_table); instance->level =AV1_RES_NONE ; }
drivers/media/platform/mediatek/vcodec/encoder/venc/venc_h264_if.c +3 -2
@@ -301,11 +301,12 @@ static void h264_enc_free_work_buf(struct venc_h264_inst *inst)* other buffers need to be freed by AP. */ for (i =0 ; i <VENC_H264_VPU_WORK_BUF_MAX ; i++) { -if (i !=VENC_H264_VPU_WORK_BUF_SKIP_FRAME ) +if (i !=VENC_H264_VPU_WORK_BUF_SKIP_FRAME && inst->work_bufs[i].va)mtk_vcodec_mem_free (inst->ctx, &inst->work_bufs[i]); } -mtk_vcodec_mem_free (inst->ctx, &inst->pps_buf); +if (inst->pps_buf.va) +mtk_vcodec_mem_free (inst->ctx, &inst->pps_buf); }static int h264_enc_alloc_work_buf (struct venc_h264_inst *inst,bool is_34bit)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/197 drm/amdgpu: Fix uninitialized variable warnings
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit 60c448439f3b5db9431e13f7f361b4074d0e8594 ]
return 0 to avoid returning an uninitialized variable r
--- drivers/gpu/drm/amd/amdgpu/aldebaran.c | 2 +- drivers/gpu/drm/amd/amdgpu/sienna_cichlid.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/aldebaran.c +1 -1
@@ -97,7 +97,7 @@ static int aldebaran_mode2_suspend_ip(struct amdgpu_device *adev) adev->ip_blocks[i].status.hw = false; } -return r; +return 0 ; } static int
drivers/gpu/drm/amd/amdgpu/sienna_cichlid.c +1 -1
@@ -92,7 +92,7 @@ static int sienna_cichlid_mode2_suspend_ip(struct amdgpu_device *adev) adev->ip_blocks[i].status.hw = false; } -return r; +return 0 ; } static int
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/197 drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit 88a9a467c548d0b3c7761b4fd54a68e70f9c0944 ]
Initialize the size before calling amdgpu_vce_cs_reloc, such as case 0x03000001.
V2: To really improve the handling we would actually
need to have a separate value of 0xffffffff.(Christian)
--- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c +2 -1
@@ -743,7 +743,8 @@ int amdgpu_vce_ring_parse_cs(struct amdgpu_cs_parser *p,uint32_t created =0 ;uint32_t allocated =0 ;uint32_t tmp, handle =0 ; -uint32_t *size = &tmp; +uint32_t dummy =0xffffffff ; +uint32_t *size = &dummy;unsigned int idx;int i, r =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/197 drm/amdgpu: Initialize timestamp for some legacy SOCs
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit 2e55bcf3d742a4946d862b86e39e75a95cc6f1c0 ]
Initialize the interrupt timestamp for some legacy SOCs to fix the coverity issue "Uninitialized scalar variable"
--- drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c +8 -0
@@ -445,6 +445,14 @@ void amdgpu_irq_dispatch(struct amdgpu_device *adev, entry.ih = ih; entry.iv_entry = (const uint32_t *)&ih->ring[ring_index]; + +/* +* timestamp is not supported on some legacy SOCs (cik, cz, iceland, +* si and tonga), so initialize timestamp and timestamp_src to 0 +*/ + entry.timestamp =0 ; + entry.timestamp_src =0 ; +amdgpu_ih_decode_iv (adev, &entry);trace_amdgpu_iv (ih - &adev->irq.ih, &entry);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/197 drm/amdgpu: fix double free err_addr pointer warnings
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bob Zhou <[email protected]>
[ Upstream commit 506c245f3f1cd989cb89811a7f06e04ff8813a0d ]
In amdgpu_umc_bad_page_polling_timeout, the amdgpu_umc_handle_bad_pages will be run many times so that double free err_addr in some special case. So set the err_addr to NULL to avoid the warnings.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c +1 -0
@@ -170,6 +170,7 @@ static void amdgpu_umc_handle_bad_pages(struct amdgpu_device *adev, }kfree (err_data->err_addr); + err_data->err_addr =NULL ;mutex_unlock (&con->page_retirement_lock); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/197 drm/amd/display: Add NULL pointer check for kzalloc
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit 8e65a1b7118acf6af96449e1e66b7adbc9396912 ]
[Why & How]
Check return pointer of kzalloc before using it.
--- .../gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c | 8 ++++++++ .../gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 8 ++++++++ .../drm/amd/display/dc/resource/dcn30/dcn30_resource.c | 3 +++ .../drm/amd/display/dc/resource/dcn31/dcn31_resource.c | 5 +++++ .../drm/amd/display/dc/resource/dcn314/dcn314_resource.c | 5 +++++ .../drm/amd/display/dc/resource/dcn315/dcn315_resource.c | 2 ++ .../drm/amd/display/dc/resource/dcn316/dcn316_resource.c | 2 ++ .../drm/amd/display/dc/resource/dcn32/dcn32_resource.c | 5 +++++ .../drm/amd/display/dc/resource/dcn321/dcn321_resource.c | 2 ++ .../drm/amd/display/dc/resource/dcn35/dcn35_resource.c | 2 ++ .../drm/amd/display/dc/resource/dcn351/dcn351_resource.c | 2 ++ 11 files changed, 44 insertions(+)
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c +8 -0
@@ -560,11 +560,19 @@ void dcn3_clk_mgr_construct(dce_clock_read_ss_info (clk_mgr); clk_mgr->base.bw_params =kzalloc (sizeof (*clk_mgr->base.bw_params),GFP_KERNEL ); +if (!clk_mgr->base.bw_params) { +BREAK_TO_DEBUGGER (); +return ; + }/* need physical address of table to give to PMFW */ clk_mgr->wm_range_table =dm_helpers_allocate_gpu_mem (clk_mgr->base.ctx,DC_MEM_ALLOC_TYPE_GART ,sizeof (WatermarksExternal_t), &clk_mgr->wm_range_table_addr); +if (!clk_mgr->wm_range_table) { +BREAK_TO_DEBUGGER (); +return ; + } }void dcn3_clk_mgr_destroy (struct clk_mgr_internal *clk_mgr)
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c +8 -0
@@ -1208,11 +1208,19 @@ void dcn32_clk_mgr_construct( clk_mgr->smu_present = false; clk_mgr->base.bw_params =kzalloc (sizeof (*clk_mgr->base.bw_params),GFP_KERNEL ); +if (!clk_mgr->base.bw_params) { +BREAK_TO_DEBUGGER (); +return ; + }/* need physical address of table to give to PMFW */ clk_mgr->wm_range_table =dm_helpers_allocate_gpu_mem (clk_mgr->base.ctx,DC_MEM_ALLOC_TYPE_GART ,sizeof (WatermarksExternal_t), &clk_mgr->wm_range_table_addr); +if (!clk_mgr->wm_range_table) { +BREAK_TO_DEBUGGER (); +return ; + } }void dcn32_clk_mgr_destroy (struct clk_mgr_internal *clk_mgr)
drivers/gpu/drm/amd/display/dc/resource/dcn30/dcn30_resource.c +3 -0
@@ -2050,6 +2050,9 @@ bool dcn30_validate_bandwidth(struct dc *dc,BW_VAL_TRACE_COUNT (); +if (!pipes) + goto validate_fail; +DC_FP_START (); out =dcn30_internal_validate_bw (dc, context, pipes, &pipe_cnt, &vlevel, fast_validate, true);DC_FP_END ();
drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c +5 -0
@@ -1311,6 +1311,8 @@ static struct hpo_dp_link_encoder *dcn31_hpo_dp_link_encoder_create(/* allocate HPO link encoder */ hpo_dp_enc31 =kzalloc (sizeof (struct dcn31_hpo_dp_link_encoder ),GFP_KERNEL ); +if (!hpo_dp_enc31) +return NULL ;/* out of memory */ hpo_dp_link_encoder31_construct(hpo_dp_enc31, ctx, inst, &hpo_dp_link_enc_regs[inst],
@@ -1767,6 +1769,9 @@ bool dcn31_validate_bandwidth(struct dc *dc,BW_VAL_TRACE_COUNT (); +if (!pipes) + goto validate_fail; +DC_FP_START (); out =dcn30_internal_validate_bw (dc, context, pipes, &pipe_cnt, &vlevel, fast_validate, true);DC_FP_END ();
drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c +5 -0
@@ -1384,6 +1384,8 @@ static struct hpo_dp_link_encoder *dcn31_hpo_dp_link_encoder_create(/* allocate HPO link encoder */ hpo_dp_enc31 =kzalloc (sizeof (struct dcn31_hpo_dp_link_encoder ),GFP_KERNEL ); +if (!hpo_dp_enc31) +return NULL ;/* out of memory */ hpo_dp_link_encoder31_construct(hpo_dp_enc31, ctx, inst, &hpo_dp_link_enc_regs[inst],
@@ -1744,6 +1746,9 @@ bool dcn314_validate_bandwidth(struct dc *dc,BW_VAL_TRACE_COUNT (); +if (!pipes) + goto validate_fail; +if (filter_modes_for_single_channel_workaround (dc, context)) goto validate_fail;
drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c +2 -0
@@ -1309,6 +1309,8 @@ static struct hpo_dp_link_encoder *dcn31_hpo_dp_link_encoder_create(/* allocate HPO link encoder */ hpo_dp_enc31 =kzalloc (sizeof (struct dcn31_hpo_dp_link_encoder ),GFP_KERNEL ); +if (!hpo_dp_enc31) +return NULL ;/* out of memory */ hpo_dp_link_encoder31_construct(hpo_dp_enc31, ctx, inst, &hpo_dp_link_enc_regs[inst],
drivers/gpu/drm/amd/display/dc/resource/dcn316/dcn316_resource.c +2 -0
@@ -1306,6 +1306,8 @@ static struct hpo_dp_link_encoder *dcn31_hpo_dp_link_encoder_create(/* allocate HPO link encoder */ hpo_dp_enc31 =kzalloc (sizeof (struct dcn31_hpo_dp_link_encoder ),GFP_KERNEL ); +if (!hpo_dp_enc31) +return NULL ;/* out of memory */ hpo_dp_link_encoder31_construct(hpo_dp_enc31, ctx, inst, &hpo_dp_link_enc_regs[inst],
drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c +5 -0
@@ -1304,6 +1304,8 @@ static struct hpo_dp_link_encoder *dcn32_hpo_dp_link_encoder_create(/* allocate HPO link encoder */ hpo_dp_enc31 =kzalloc (sizeof (struct dcn31_hpo_dp_link_encoder ),GFP_KERNEL ); +if (!hpo_dp_enc31) +return NULL ;/* out of memory */ #undef REG_STRUCT#define REG_STRUCT hpo_dp_link_enc_regs
@@ -1751,6 +1753,9 @@ static bool dml1_validate(struct dc *dc, struct dc_state *context, bool fast_valBW_VAL_TRACE_COUNT (); +if (!pipes) + goto validate_fail; +DC_FP_START (); out =dcn32_internal_validate_bw (dc, context, pipes, &pipe_cnt, &vlevel, fast_validate);DC_FP_END ();
drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c +2 -0
@@ -1288,6 +1288,8 @@ static struct hpo_dp_link_encoder *dcn321_hpo_dp_link_encoder_create(/* allocate HPO link encoder */ hpo_dp_enc31 =kzalloc (sizeof (struct dcn31_hpo_dp_link_encoder ),GFP_KERNEL ); +if (!hpo_dp_enc31) +return NULL ;/* out of memory */ #undef REG_STRUCT#define REG_STRUCT hpo_dp_link_enc_regs
drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c +2 -0
@@ -1368,6 +1368,8 @@ static struct hpo_dp_link_encoder *dcn31_hpo_dp_link_encoder_create(/* allocate HPO link encoder */ hpo_dp_enc31 =kzalloc (sizeof (struct dcn31_hpo_dp_link_encoder ),GFP_KERNEL ); +if (!hpo_dp_enc31) +return NULL ;/* out of memory */ #undef REG_STRUCT#define REG_STRUCT hpo_dp_link_enc_regs
drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c +2 -0
@@ -1348,6 +1348,8 @@ static struct hpo_dp_link_encoder *dcn31_hpo_dp_link_encoder_create(/* allocate HPO link encoder */ hpo_dp_enc31 =kzalloc (sizeof (struct dcn31_hpo_dp_link_encoder ),GFP_KERNEL ); +if (!hpo_dp_enc31) +return NULL ;/* out of memory */ #undef REG_STRUCT#define REG_STRUCT hpo_dp_link_enc_regs
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/197 drm/amd/display: Check index msg_id before read or write
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 59d99deb330af206a4541db0c4da8f73880fba03 ]
[WHAT]msg_id is used as an array index and it cannot be a negative value, and therefore cannot be equal to MOD_HDCP_MESSAGE_ID_INVALID (-1).
[HOW]
Check whether msg_id is valid before reading and setting.
This fixes 4 OVERRUN issues reported by Coverity.
--- drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c +8 -0
@@ -156,6 +156,10 @@ static enum mod_hdcp_status read(struct mod_hdcp *hdcp,uint32_t cur_size =0 ;uint32_t data_offset =0 ; +if (msg_id ==MOD_HDCP_MESSAGE_ID_INVALID ) { +return MOD_HDCP_STATUS_DDC_FAILURE ; + } +if (is_dp_hdcp (hdcp)) {while (buf_len >0 ) { cur_size =MIN (buf_len,HDCP_MAX_AUX_TRANSACTION_SIZE );
@@ -215,6 +219,10 @@ static enum mod_hdcp_status write(struct mod_hdcp *hdcp,uint32_t cur_size =0 ;uint32_t data_offset =0 ; +if (msg_id ==MOD_HDCP_MESSAGE_ID_INVALID ) { +return MOD_HDCP_STATUS_DDC_FAILURE ; + } +if (is_dp_hdcp (hdcp)) {while (buf_len >0 ) { cur_size =MIN (buf_len,HDCP_MAX_AUX_TRANSACTION_SIZE );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/197 drm/amd/display: Check pipe offset before setting vblank
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 5396a70e8cf462ec5ccf2dc8de103c79de9489e6 ]
pipe_ctx has a size of MAX_PIPES so checking its index before accessing the array.
This fixes an OVERRUN issue reported by Coverity.
--- .../drm/amd/display/dc/irq/dce110/irq_service_dce110.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c +6 -2
@@ -211,8 +211,12 @@ bool dce110_vblank_set(struct irq_service *irq_service, info->ext_id);uint8_t pipe_offset = dal_irq_src -IRQ_TYPE_VBLANK ; -struct timing_generator *tg = - dc->current_state->res_ctx.pipe_ctx[pipe_offset].stream_res.tg; +struct timing_generator *tg; + +if (pipe_offset >=MAX_PIPES ) +return false; + + tg = dc->current_state->res_ctx.pipe_ctx[pipe_offset].stream_res.tg;if (enable) {if (!tg || !tg->funcs->arm_vert_intr (tg,2 )) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/197 drm/amd/display: Skip finding free audio for unknown engine_id
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 1357b2165d9ad94faa4c4a20d5e2ce29c2ff29c3 ]
[WHY]ENGINE_ID_UNKNOWN = -1 and can not be used as an array index. Plus, it also means it is uninitialized and does not need free audio.
[HOW]
Skip and return NULL.
This fixes 2 OVERRUN issues reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +3 -0
@@ -3117,6 +3117,9 @@ static struct audio *find_first_free_audio( {int i, available_audio_count; +if (id ==ENGINE_ID_UNKNOWN ) +return NULL ; + available_audio_count = pool->audio_count;for (i =0 ; i < available_audio_count; i++) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/197 drm/amd/display: Fix overlapping copy within dml_core_mode_programming
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit f1fd8a0a54e6d23a6d16ee29159f247862460fd1 ]
[WHY]&mode_lib->mp.Watermark and &locals->Watermark are the same address. memcpy may lead to unexpected behavior.
[HOW]
memmove should be used.
--- drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c +3 -1
@@ -9460,8 +9460,10 @@ void dml_core_mode_programming(struct display_mode_lib_st *mode_lib, const struc/* Copy the calculated watermarks to mp.Watermark as the getter functions are * implemented by the DML team to copy the calculated values from the mp.Watermark interface. +* &mode_lib->mp.Watermark and &locals->Watermark are the same address, memcpy may lead to +* unexpected behavior. memmove should be used. */ -memcpy (&mode_lib->mp.Watermark, CalculateWatermarks_params->Watermark,sizeof (struct Watermarks )); +memmove (&mode_lib->mp.Watermark, CalculateWatermarks_params->Watermark,sizeof (struct Watermarks ));for (k =0 ; k < mode_lib->ms.num_active_planes; ++k) {if (mode_lib->ms.cache_display_cfg.writeback.WritebackEnable[k] == true) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/197 drm/amd/display: update pipe topology log to support subvp
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenjing Liu <[email protected]>
[ Upstream commit 5db346c256bbacc634ff515a1a9202cd4b61d8c7 ]
[why]
There is an ambiguity in subvp pipe topology log. The log doesn't show subvp relation to main stream and it is not clear that certain stream is an internal stream for subvp pipes.
[how]
Separate subvp pipe topology logging from main pipe topology. Log main stream indices instead of the internal stream for subvp pipes. The following is a sample log showing 2 streams with subvp enabled on both:
pipe topology update
________________________
| plane0 slice0 stream0| |DPP1----OPP1----OTG1----| | plane0 slice0 stream1| |DPP0----OPP0----OTG0----| | (phantom pipes) | | plane0 slice0 stream0| |DPP3----OPP3----OTG3----| | plane0 slice0 stream1| |DPP2----OPP2----OTG2----| |________________________|
Stable-dep-of: 3ac31c9a707d ("drm/amd/display: Do not return negative stream id for array")
--- .../gpu/drm/amd/display/dc/core/dc_resource.c | 96 +++++++++++++------ 1 file changed, 65 insertions(+), 31 deletions(-)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +65 -31
@@ -2168,50 +2168,84 @@ static void resource_log_pipe(struct dc *dc, struct pipe_ctx *pipe, } } -void resource_log_pipe_topology_update (struct dc *dc,struct dc_state *state) +static void resource_log_pipe_for_stream (struct dc *dc,struct dc_state *state, +struct pipe_ctx *otg_master,int stream_idx) { -struct pipe_ctx *otg_master;struct pipe_ctx *opp_heads[MAX_PIPES ];struct pipe_ctx *dpp_pipes[MAX_PIPES ]; -int stream_idx, slice_idx, dpp_idx, plane_idx, slice_count, dpp_count; +int slice_idx, dpp_idx, plane_idx, slice_count, dpp_count;bool is_primary;DC_LOGGER_INIT (dc->ctx->logger); + slice_count =resource_get_opp_heads_for_otg_master (otg_master, + &state->res_ctx, opp_heads); +for (slice_idx =0 ; slice_idx < slice_count; slice_idx++) { + plane_idx =-1 ; +if (opp_heads[slice_idx]->plane_state) { + dpp_count =resource_get_dpp_pipes_for_opp_head ( + opp_heads[slice_idx], + &state->res_ctx, + dpp_pipes); +for (dpp_idx =0 ; dpp_idx < dpp_count; dpp_idx++) { + is_primary = !dpp_pipes[dpp_idx]->top_pipe || + dpp_pipes[dpp_idx]->top_pipe->plane_state != dpp_pipes[dpp_idx]->plane_state; +if (is_primary) + plane_idx++; +resource_log_pipe (dc, dpp_pipes[dpp_idx], + stream_idx, slice_idx, + plane_idx, slice_count, + is_primary); + } + }else { +resource_log_pipe (dc, opp_heads[slice_idx], + stream_idx, slice_idx, plane_idx, + slice_count, true); + } + + } +} + +static int resource_stream_to_stream_idx (struct dc_state *state, +struct dc_stream_state *stream) +{ +int i, stream_idx =-1 ; + +for (i =0 ; i < state->stream_count; i++) +if (state->streams[i] == stream) { + stream_idx = i; +break ; + } +return stream_idx; +} + +void resource_log_pipe_topology_update (struct dc *dc,struct dc_state *state) +{ +struct pipe_ctx *otg_master; +int stream_idx, phantom_stream_idx; +DC_LOGGER_INIT (dc->ctx->logger); +DC_LOG_DC (" pipe topology update" );DC_LOG_DC (" ________________________" );for (stream_idx =0 ; stream_idx < state->stream_count; stream_idx++) { +if (state->streams[stream_idx]->is_phantom) +continue ; + otg_master =resource_get_otg_master_for_stream ( &state->res_ctx, state->streams[stream_idx]); -if (!otg_master || otg_master->stream_res.tg ==NULL ) { -DC_LOG_DC ("topology update: otg_master NULL stream_idx %d!\n" , stream_idx); -return ; - } - slice_count =resource_get_opp_heads_for_otg_master (otg_master, - &state->res_ctx, opp_heads); -for (slice_idx =0 ; slice_idx < slice_count; slice_idx++) { - plane_idx =-1 ; -if (opp_heads[slice_idx]->plane_state) { - dpp_count =resource_get_dpp_pipes_for_opp_head ( - opp_heads[slice_idx], - &state->res_ctx, - dpp_pipes); -for (dpp_idx =0 ; dpp_idx < dpp_count; dpp_idx++) { - is_primary = !dpp_pipes[dpp_idx]->top_pipe || - dpp_pipes[dpp_idx]->top_pipe->plane_state != dpp_pipes[dpp_idx]->plane_state; -if (is_primary) - plane_idx++; -resource_log_pipe (dc, dpp_pipes[dpp_idx], - stream_idx, slice_idx, - plane_idx, slice_count, - is_primary); - } - }else { -resource_log_pipe (dc, opp_heads[slice_idx], - stream_idx, slice_idx, plane_idx, - slice_count, true); - } +resource_log_pipe_for_stream (dc, state, otg_master, stream_idx); + } +if (state->phantom_stream_count >0 ) { +DC_LOG_DC (" | (phantom pipes) |" ); +for (stream_idx =0 ; stream_idx < state->stream_count; stream_idx++) { +if (state->stream_status[stream_idx].mall_stream_config.type !=SUBVP_MAIN ) +continue ; + phantom_stream_idx =resource_stream_to_stream_idx (state, + state->stream_status[stream_idx].mall_stream_config.paired_stream); + otg_master =resource_get_otg_master_for_stream ( + &state->res_ctx, state->streams[phantom_stream_idx]); +resource_log_pipe_for_stream (dc, state, otg_master, stream_idx); } }DC_LOG_DC (" |________________________|\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/197 drm/amd/display: Do not return negative stream id for array
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 3ac31c9a707dd1c7c890b95333182f955e9dcb57 ]
[WHY]resource_stream_to_stream_idx returns an array index and it return -1 when not found; however, -1 is not a valid array index number.
[HOW]
When this happens, call ASSERT(), and return a zero instead.
This fixes an OVERRUN and an NEGATIVE_RETURNS issues reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +7 -0
@@ -2216,6 +2216,13 @@ static int resource_stream_to_stream_idx(struct dc_state *state, stream_idx = i;break ; } + +/* never return negative array index */ +if (stream_idx ==-1 ) { +ASSERT (0 ); +return 0 ; + } +return stream_idx; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/197 drm/amd/display: ASSERT when failing to find index by plane/stream id
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 01eb50e53c1ce505bf449348d433181310288765 ]
[WHY]find_disp_cfg_idx_by_plane_id and find_disp_cfg_idx_by_stream_id returns an array index and they return -1 when not found; however, -1 is not a valid index number.
[HOW]
When this happens, call ASSERT(), and return a positive number (which is fewer than callers' array size) instead.
This fixes 4 OVERRUN and 2 NEGATIVE_RETURNS issues reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/dml2/dml2_dc_resource_mgmt.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dml2/dml2_dc_resource_mgmt.c +4 -2
@@ -88,7 +88,8 @@ static int find_disp_cfg_idx_by_plane_id(struct dml2_dml_to_dc_pipe_mapping *mapreturn i; } -return -1 ; +ASSERT (false); +return __DML2_WRAPPER_MAX_STREAMS_PLANES__; }static int find_disp_cfg_idx_by_stream_id (struct dml2_dml_to_dc_pipe_mapping *mapping,unsigned int stream_id)
@@ -100,7 +101,8 @@ static int find_disp_cfg_idx_by_stream_id(struct dml2_dml_to_dc_pipe_mapping *mareturn i; } -return -1 ; +ASSERT (false); +return __DML2_WRAPPER_MAX_STREAMS_PLANES__; }// The master pipe of a stream is defined as the top pipe in odm slice 0
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/197 drm/amd/display: Fix uninitialized variables in DM
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit f95bcb041f213a5da3da5fcaf73269bd13dba945 ]
This fixes 11 UNINIT issues reported by Coverity.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 ++++---- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +4 -4
@@ -274,7 +274,7 @@ static u32 dm_vblank_get_counter(struct amdgpu_device *adev, int crtc)static int dm_crtc_get_scanoutpos (struct amdgpu_device *adev,int crtc,u32 *vbl,u32 *position) { -u32 v_blank_start, v_blank_end, h_position, v_position; +u32 v_blank_start =0 , v_blank_end =0 , h_position =0 , v_position =0 ;struct amdgpu_crtc *acrtc =NULL ;struct dc *dc = adev->dm.dc;
@@ -848,7 +848,7 @@ static void dm_handle_hpd_work(struct work_struct *work)*/ static void dm_dmub_outbox1_low_irq (void *interrupt_params) { -struct dmub_notification notify; +struct dmub_notification notify = {0 };struct common_irq_params *irq_params = interrupt_params;struct amdgpu_device *adev = irq_params->adev;struct amdgpu_display_manager *dm = &adev->dm;
@@ -7192,7 +7192,7 @@ static int dm_update_mst_vcpi_slots_for_dsc(struct drm_atomic_state *state,struct amdgpu_dm_connector *aconnector;struct dm_connector_state *dm_conn_state;int i, j, ret; -int vcpi, pbn_div, pbn, slot_num =0 ; +int vcpi, pbn_div, pbn =0 , slot_num =0 ;for_each_new_connector_in_state (state, connector, new_con_state, i) {
@@ -10595,7 +10595,7 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev,struct dm_crtc_state *dm_old_crtc_state, *dm_new_crtc_state;struct drm_dp_mst_topology_mgr *mgr;struct drm_dp_mst_topology_state *mst_state; -struct dsc_mst_fairness_vars vars[MAX_PIPES ]; +struct dsc_mst_fairness_vars vars[MAX_PIPES ] = {0 };trace_amdgpu_dm_atomic_check_begin (state);
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +2 -2
@@ -1249,7 +1249,7 @@ static ssize_t dp_sdp_message_debugfs_write(struct file *f, const char __user *b size_t size, loff_t *pos) { int r; -uint8_t data[36 ]; +uint8_t data[36 ] = {0 };struct amdgpu_dm_connector *connector =file_inode (f)->i_private;struct dm_crtc_state *acrtc_state;uint32_t write_size =36 ;
@@ -2960,7 +2960,7 @@ static int psr_read_residency(void *data, u64 *val) {struct amdgpu_dm_connector *connector = data;struct dc_link *link = connector->dc_link; -u32 residency; +u32 residency =0 ; link->dc->link_srv->edp_get_psr_residency (link, &residency);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/197 drm/amdgpu: fix uninitialized scalar variable warning
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit 9a5f15d2a29d06ce5bd50919da7221cda92afb69 ]
Clear warning that uses uninitialized value fw_size.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +2 -1
@@ -1206,7 +1206,8 @@ void amdgpu_gfx_cp_init_microcode(struct amdgpu_device *adev, fw_size =le32_to_cpu (cp_hdr_v2_0->data_size_bytes);break ;default : -break ; +dev_err (adev->dev,"Invalid ucode id %u\n" , ucode_id); +return ; }if (adev->firmware.load_type ==AMDGPU_FW_LOAD_PSP ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/197 drm/amdgpu: fix the warning about the expression (int)size - len
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit ea686fef5489ef7a2450a9fdbcc732b837fb46a8 ]
Converting size from size_t to int may overflow.
v2: keep reverse xmas tree order (Christian)
--- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +3 -2
@@ -2065,12 +2065,13 @@ static ssize_t amdgpu_reset_dump_register_list_write(struct file *f,struct amdgpu_device *adev = (struct amdgpu_device *)file_inode (f)->i_private;char reg_offset[11 ];uint32_t *new =NULL , *tmp =NULL ; -int ret, i =0 , len =0 ; +unsigned int len =0 ; +int ret, i =0 ; do { memset(reg_offset, 0, 11); if (copy_from_user(reg_offset, buf + len, - min(10, ((int)size-len)))) { + min(10, (size-len)))) { ret = -EFAULT; goto error_free; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/197 media: dw2102: Dont translate i2c read into write
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bunk <[email protected]>
[ Upstream commit 0e148a522b8453115038193e19ec7bea71403e4a ]
The code ignored the I2C_M_RD flag on I2C messages. Instead it assumed an i2c transaction with a single message must be a write operation and a transaction with two messages would be a read operation.
Though this works for the driver code, it leads to problems once the i2c device is exposed to code not knowing this convention. For example, I did "insmod i2c-dev" and issued read requests from userspace, which were translated into write requests and destroyed the EEPROM of my device.
So, just check and respect the I2C_M_READ flag, which indicates a read when set on a message. If it is absent, it is a write message.
Incidentally, changing from the case statement to a while loop allows the code to lift the limitation to two i2c messages per transaction.
There are 4 more *_i2c_transfer functions affected by the same behaviour and limitation that should be fixed in the same way.
--- drivers/media/usb/dvb-usb/dw2102.c | 120 ++++++++++++++++++----------- 1 file changed, 73 insertions(+), 47 deletions(-)
drivers/media/usb/dvb-usb/dw2102.c +73 -47
@@ -716,6 +716,7 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], {struct dvb_usb_device *d =i2c_get_adapdata (adap);struct dw2102_state *state; +int j;if (!d)return -ENODEV ;
@@ -729,11 +730,11 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],return -EAGAIN ; } -switch (num) { -case 1 : -switch (msg[0 ].addr) { + j =0 ; +while (j < num) { +switch (msg[j].addr) {case SU3000_STREAM_CTRL : - state->data[0 ] = msg[0 ].buf[0 ] +0x36 ; + state->data[0 ] = msg[j].buf[0 ] +0x36 ; state->data[1 ] =3 ; state->data[2 ] =0 ; if (dvb_usb_generic_rw(d, state->data, 3,
@@ -745,61 +746,86 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],if (dvb_usb_generic_rw (d, state->data,1 , state->data,2 ,0 ) <0 )err ("i2c transfer failed." ); - msg[0 ].buf[1 ] = state->data[0 ]; - msg[0 ].buf[0 ] = state->data[1 ]; + msg[j].buf[1 ] = state->data[0 ]; + msg[j].buf[0 ] = state->data[1 ];break ;default : -if (3 + msg[0 ].len >sizeof (state->data)) { -warn ("i2c wr: len=%d is too big!\n" , - msg[0 ].len); +/* if the current write msg is followed by a another +* read msg to/from the same address +*/ +if ((j+1 < num) && (msg[j+1 ].flags &I2C_M_RD ) && + (msg[j].addr == msg[j+1 ].addr)) { +/* join both i2c msgs to one usb read command */ +if (4 + msg[j].len >sizeof (state->data)) { +warn ("i2c combined wr/rd: write len=%d is too big!\n" , + msg[j].len); + num = -EOPNOTSUPP ; +break ; + } +if (1 + msg[j+1 ].len >sizeof (state->data)) { +warn ("i2c combined wr/rd: read len=%d is too big!\n" , + msg[j+1 ].len); + num = -EOPNOTSUPP ; +break ; + } + + state->data[0 ] =0x09 ; + state->data[1 ] = msg[j].len; + state->data[2 ] = msg[j+1 ].len; + state->data[3 ] = msg[j].addr; +memcpy (&state->data[4 ], msg[j].buf, msg[j].len); + +if (dvb_usb_generic_rw (d, state->data, msg[j].len +4 , + state->data, msg[j+1 ].len +1 ,0 ) <0 ) +err ("i2c transfer failed." ); + +memcpy (msg[j+1 ].buf, &state->data[1 ], msg[j+1 ].len); + j++; +break ; + } + +if (msg[j].flags &I2C_M_RD ) { +/* single read */ +if (1 + msg[j].len >sizeof (state->data)) { +warn ("i2c rd: len=%d is too big!\n" , msg[j].len); + num = -EOPNOTSUPP ; +break ; + } + + state->data[0 ] =0x09 ; + state->data[1 ] =0 ; + state->data[2 ] = msg[j].len; + state->data[3 ] = msg[j].addr; +memcpy (&state->data[4 ], msg[j].buf, msg[j].len); + +if (dvb_usb_generic_rw (d, state->data,4 , + state->data, msg[j].len +1 ,0 ) <0 ) +err ("i2c transfer failed." ); + +memcpy (msg[j].buf, &state->data[1 ], msg[j].len); +break ; + } + +/* single write */ +if (3 + msg[j].len >sizeof (state->data)) { +warn ("i2c wr: len=%d is too big!\n" , msg[j].len); num = -EOPNOTSUPP ;break ; } -/* always i2c write*/ state->data[0 ] =0x08 ; - state->data[1 ] = msg[0 ].addr; - state->data[2 ] = msg[0 ].len; + state->data[1 ] = msg[j].addr; + state->data[2 ] = msg[j].len; -memcpy (&state->data[3 ], msg[0 ].buf, msg[0 ].len); +memcpy (&state->data[3 ], msg[j].buf, msg[j].len); -if (dvb_usb_generic_rw (d, state->data, msg[0 ].len +3 , +if (dvb_usb_generic_rw (d, state->data, msg[j].len +3 , state->data,1 ,0 ) <0 )err ("i2c transfer failed." ); + }// switch + j++; - } -break ; -case 2 : -/* always i2c read */ -if (4 + msg[0 ].len >sizeof (state->data)) { -warn ("i2c rd: len=%d is too big!\n" , - msg[0 ].len); - num = -EOPNOTSUPP ; -break ; - } -if (1 + msg[1 ].len >sizeof (state->data)) { -warn ("i2c rd: len=%d is too big!\n" , - msg[1 ].len); - num = -EOPNOTSUPP ; -break ; - } - - state->data[0 ] =0x09 ; - state->data[1 ] = msg[0 ].len; - state->data[2 ] = msg[1 ].len; - state->data[3 ] = msg[0 ].addr; -memcpy (&state->data[4 ], msg[0 ].buf, msg[0 ].len); - -if (dvb_usb_generic_rw (d, state->data, msg[0 ].len +4 , - state->data, msg[1 ].len +1 ,0 ) <0 ) -err ("i2c transfer failed." ); - -memcpy (msg[1 ].buf, &state->data[1 ], msg[1 ].len); -break ; -default : -warn ("more than 2 i2c messages at a time is not handled yet." ); -break ; - } + }// while mutex_unlock (&d->data_mutex);mutex_unlock (&d->i2c_mutex);return num;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/197 riscv: Apply SiFive CIP-1200 workaround to single-ASID sfence.vma
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Holland <[email protected]>
[ Upstream commit 20e03d702e00a3e0269a1d6f9549c2e370492054 ]
commit 3f1e782998cd ("riscv: add ASID-based tlbflushing methods") added calls to the sfence.vma instruction with rs2 != x0. These single-ASID instruction variants are also affected by SiFive errata CIP-1200.
Until now, the errata workaround was not needed for the single-ASID sfence.vma variants, because they were only used when the ASID allocator was enabled, and the affected SiFive platforms do not support multiple ASIDs. However, we are going to start using those sfence.vma variants regardless of ASID support, so now we need alternatives covering them.
--- arch/riscv/include/asm/errata_list.h | 12 +++++++++++- arch/riscv/include/asm/tlbflush.h | 19 ++++++++++++++++++- arch/riscv/mm/tlbflush.c | 23 ----------------------- 3 files changed, 29 insertions(+), 25 deletions(-)
arch/riscv/include/asm/errata_list.h +11 -1
@@ -43,11 +43,21 @@ ALTERNATIVE(__stringify(RISCV_PTR do_page_fault), \ CONFIG_ERRATA_SIFIVE_CIP_453)#else /* !__ASSEMBLY__ */ -#define ALT_FLUSH_TLB_PAGE (x) \ +#define ALT_SFENCE_VMA_ASID (asid) \ +asm(ALTERNATIVE("sfence.vma x0, %0", "sfence.vma", SIFIVE_VENDOR_ID, \ + ERRATA_SIFIVE_CIP_1200, CONFIG_ERRATA_SIFIVE_CIP_1200) \ + : : "r" (asid) : "memory") + +#define ALT_SFENCE_VMA_ADDR (addr) \ asm(ALTERNATIVE("sfence.vma %0", "sfence.vma", SIFIVE_VENDOR_ID, \ ERRATA_SIFIVE_CIP_1200, CONFIG_ERRATA_SIFIVE_CIP_1200) \ : : "r" (addr) : "memory") +#define ALT_SFENCE_VMA_ADDR_ASID (addr, asid) \ +asm(ALTERNATIVE("sfence.vma %0, %1", "sfence.vma", SIFIVE_VENDOR_ID, \ + ERRATA_SIFIVE_CIP_1200, CONFIG_ERRATA_SIFIVE_CIP_1200) \ + : : "r" (addr), "r" (asid) : "memory") +/* * _val is marked as "will be overwritten", so need to set it to 0 * in the default case.
arch/riscv/include/asm/tlbflush.h +18 -1
@@ -22,10 +22,27 @@ static inline void local_flush_tlb_all(void) __asm__ __volatile__ ("sfence.vma" : : : "memory"); } +static inline void local_flush_tlb_all_asid (unsigned long asid) +{ +if (asid !=FLUSH_TLB_NO_ASID ) +ALT_SFENCE_VMA_ASID (asid); +else +local_flush_tlb_all (); +} +/* Flush one page from local TLB */ static inline void local_flush_tlb_page (unsigned long addr) { -ALT_FLUSH_TLB_PAGE (__asm__ __volatile__ ("sfence.vma %0" : :"r" (addr) :"memory" )); +ALT_SFENCE_VMA_ADDR (addr); +} + +static inline void local_flush_tlb_page_asid (unsigned long addr, +unsigned long asid) +{ +if (asid !=FLUSH_TLB_NO_ASID ) +ALT_SFENCE_VMA_ADDR_ASID (addr, asid); +else +local_flush_tlb_page (addr); }#else /* CONFIG_MMU */ #define local_flush_tlb_all () do { } while (0)
arch/riscv/mm/tlbflush.c +0 -23
@@ -7,29 +7,6 @@#include <asm/sbi.h> #include <asm/mmu_context.h> -static inline void local_flush_tlb_all_asid (unsigned long asid) -{ -if (asid !=FLUSH_TLB_NO_ASID ) - __asm__ __volatile__ ("sfence.vma x0, %0" - : - :"r" (asid) - :"memory" ); -else -local_flush_tlb_all (); -} - -static inline void local_flush_tlb_page_asid (unsigned long addr, -unsigned long asid) -{ -if (asid !=FLUSH_TLB_NO_ASID ) - __asm__ __volatile__ ("sfence.vma %0, %1" - : - :"r" (addr),"r" (asid) - :"memory" ); -else -local_flush_tlb_page (addr); -} -/* * Flush entire TLB if number of entries to be flushed is greater * than the threshold below.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/197 media: dw2102: fix a potential buffer overflow
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
[ Upstream commit 1c73d0b29d04bf4082e7beb6a508895e118ee30d ]
As pointed by smatch:
drivers/media/usb/dvb-usb/dw2102.c:802 su3000_i2c_transfer() error: __builtin_memcpy() '&state->data[4]' too small (64 vs 67)
That seemss to be due to a wrong copy-and-paste.
--- drivers/media/usb/dvb-usb/dw2102.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/dvb-usb/dw2102.c +1 -1
@@ -786,7 +786,7 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],if (msg[j].flags &I2C_M_RD ) {/* single read */ -if (1 + msg[j].len >sizeof (state->data)) { +if (4 + msg[j].len >sizeof (state->data)) {warn ("i2c rd: len=%d is too big!\n" , msg[j].len); num = -EOPNOTSUPP ;break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/197 sctp: prefer struct_size over open coded arithmetic
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erick Archer <[email protected]>
[ Upstream commit e5c5f3596de224422561d48eba6ece5210d967b3 ]
This is an effort to get rid of all multiplications from allocation functions in order to prevent integer overflows [1][2].
As the "ids" variable is a pointer to "struct sctp_assoc_ids" and this structure ends in a flexible array:
struct sctp_assoc_ids {
[...]
sctp_assoc_t gaids_assoc_id[];
};the preferred way in the kernel is to use the struct_size() helper to do the arithmetic instead of the calculation "size + size * count" in the kmalloc() function.
Also, refactor the code adding the "ids_size" variable to avoid sizing twice.
This way, the code is more readable and safer.
This code was detected with the help of Coccinelle, and audited and modified manually.
--- net/sctp/socket.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/sctp/socket.c +4 -3
@@ -7119,6 +7119,7 @@ static int sctp_getsockopt_assoc_ids(struct sock *sk, int len,struct sctp_sock *sp =sctp_sk (sk);struct sctp_association *asoc;struct sctp_assoc_ids *ids; +size_t ids_size;u32 num =0 ;if (sctp_style (sk,TCP ))
@@ -7131,11 +7132,11 @@ static int sctp_getsockopt_assoc_ids(struct sock *sk, int len, num++; } -if (len <sizeof (struct sctp_assoc_ids ) +sizeof (sctp_assoc_t) * num) + ids_size =struct_size (ids, gaids_assoc_id, num); +if (len < ids_size)return -EINVAL ; - len =sizeof (struct sctp_assoc_ids ) +sizeof (sctp_assoc_t) * num; - + len = ids_size; ids =kmalloc (len,GFP_USER | __GFP_NOWARN);if (unlikely (!ids))return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/197 firmware: dmi: Stop decoding on broken entry
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean Delvare <[email protected]>
[ Upstream commit 0ef11f604503b1862a21597436283f158114d77e ]
If a DMI table entry is shorter than 4 bytes, it is invalid. Due to how DMI table parsing works, it is impossible to safely recover from such an error, so we have to stop decoding the table.
--- drivers/firmware/dmi_scan.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/firmware/dmi_scan.c +11 -0
@@ -101,6 +101,17 @@ static void dmi_decode_table(u8 *buf, (data - buf + sizeof(struct dmi_header)) <= dmi_len) {const struct dmi_header *dm = (const struct dmi_header *)data; +/* +* If a short entry is found (less than 4 bytes), not only it +* is invalid, but we cannot reliably locate the next entry. +*/ +if (dm->length <sizeof (struct dmi_header )) { +pr_warn (FW_BUG +"Corrupted DMI table, offset %zd (only %d entries processed)\n" , + data - buf, i); +break ; + } +/* * We want to know the total length (formatted area and * strings) before decoding to make sure we won't run off the
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/197 kunit/fortify: Do not spam logs with fortify WARNs
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 091f79e8de44736a1e677701d67334bba5b749e3 ]
When running KUnit fortify tests, we're already doing precise tracking of which warnings are getting hit. Don't fill the logs with WARNs unless we've been explicitly built with DEBUG enabled.
--- lib/fortify_kunit.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
lib/fortify_kunit.c +8 -1
@@ -15,10 +15,17 @@*/ #define pr_fmt (fmt) KBUILD_MODNAME ": " fmt +/* We don't need to fill dmesg with the fortify WARNs during testing. */ +#ifdef DEBUG +# define FORTIFY_REPORT_KUNIT(x...) __fortify_report(x) +#else +# define FORTIFY_REPORT_KUNIT(x...) do { } while (0) +#endif +/* Redefine fortify_panic() to track failures. */ void fortify_add_kunit_error (int write);#define fortify_panic (func, write, avail, size, retfail) do { \ - __fortify_report(FORTIFY_REASON(func, write), avail, size); \ + FORTIFY_REPORT_KUNIT(FORTIFY_REASON(func, write), avail, size); \ fortify_add_kunit_error(write); \ return (retfail); \ } while (0)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/197 Input: ff-core - prefer struct_size over open coded arithmetic
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erick Archer <[email protected]>
[ Upstream commit a08b8f8557ad88ffdff8905e5da972afe52e3307 ]
This is an effort to get rid of all multiplications from allocation functions in order to prevent integer overflows [1][2].
As the "ff" variable is a pointer to "struct ff_device" and this structure ends in a flexible array:
struct ff_device {
[...]
struct file *effect_owners[] __counted_by(max_effects);
};the preferred way in the kernel is to use the struct_size() helper to do the arithmetic instead of the calculation "size + count * size" in the kzalloc() function.
The struct_size() helper returns SIZE_MAX on overflow. So, refactor the comparison to take advantage of this.
This way, the code is more readable and safer.
This code was detected with the help of Coccinelle, and audited and modified manually.
--- drivers/input/ff-core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/input/ff-core.c +4 -3
@@ -9,8 +9,10 @@/* #define DEBUG */ #include <linux/input.h> +#include <linux/limits.h> #include <linux/module.h> #include <linux/mutex.h> +#include <linux/overflow.h> #include <linux/sched.h> #include <linux/slab.h>
@@ -315,9 +317,8 @@ int input_ff_create(struct input_dev *dev, unsigned int max_effects)return -EINVAL ; } - ff_dev_size =sizeof (struct ff_device ) + - max_effects *sizeof (struct file *); -if (ff_dev_size < max_effects)/* overflow */ + ff_dev_size =struct_size (ff, effect_owners, max_effects); +if (ff_dev_size ==SIZE_MAX )/* overflow */ return -EINVAL ; ff =kzalloc (ff_dev_size,GFP_KERNEL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/197 usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Neronin <[email protected]>
[ Upstream commit 66cb618bf0bb82859875b00eeffaf223557cb416 ]
Some transfer events don't always point to a TRB, and consequently don't have a endpoint ring. In these cases, function handle_tx_event() should not proceed, because if 'ep->skip' is set, the pointer to the endpoint ring is used.
To prevent a potential failure and make the code logical, return after checking the completion code for a Transfer event without TRBs.
--- drivers/usb/host/xhci-ring.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/host/xhci-ring.c +3 -2
@@ -2658,16 +2658,17 @@ static int handle_tx_event(struct xhci_hcd *xhci,else xhci_handle_halted_endpoint (xhci, ep,NULL ,EP_SOFT_RESET ); - goto cleanup; +break ;case COMP_RING_UNDERRUN :case COMP_RING_OVERRUN :case COMP_STOPPED_LENGTH_INVALID : - goto cleanup; +break ;default :xhci_err (xhci,"ERROR Transfer event for unknown stream ring slot %u ep %u\n" , slot_id, ep_index); goto err_out; } +return 0 ; }/* Count current td numbers if ep->skip is set */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/197 wifi: mt76: replace skb_put with skb_put_zero
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 7f819a2f4fbc510e088b49c79addcf1734503578 ]
Avoid potentially reusing uninitialized data
--- drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 10 +++++----- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-)
drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c +5 -5
@@ -257,7 +257,7 @@ mt76_connac_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len, };u16 ntlv; - ptlv =skb_put (skb, len); + ptlv =skb_put_zero (skb, len);memcpy (ptlv, &tlv,sizeof (tlv)); ntlv =le16_to_cpu (ntlv_hdr->tlv_num);
@@ -1670,7 +1670,7 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,set_bit (MT76_HW_SCANNING , &phy->state); mvif->scan_seq_num = (mvif->scan_seq_num +1 ) &0x7f ; - req = (struct mt76_connac_hw_scan_req *)skb_put (skb,sizeof (*req)); + req = (struct mt76_connac_hw_scan_req *)skb_put_zero (skb,sizeof (*req)); req->seq_num = mvif->scan_seq_num | mvif->band_idx <<7 ; req->bss_idx = mvif->idx;
@@ -1798,7 +1798,7 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy, mvif->scan_seq_num = (mvif->scan_seq_num +1 ) &0x7f ; - req = (struct mt76_connac_sched_scan_req *)skb_put (skb,sizeof (*req)); + req = (struct mt76_connac_sched_scan_req *)skb_put_zero (skb,sizeof (*req)); req->version =1 ; req->seq_num = mvif->scan_seq_num | mvif->band_idx <<7 ;
@@ -2321,7 +2321,7 @@ int mt76_connac_mcu_update_gtk_rekey(struct ieee80211_hw *hw,return -ENOMEM ;skb_put_data (skb, &hdr,sizeof (hdr)); - gtk_tlv = (struct mt76_connac_gtk_rekey_tlv *)skb_put (skb, + gtk_tlv = (struct mt76_connac_gtk_rekey_tlv *)skb_put_zero (skb,sizeof (*gtk_tlv)); gtk_tlv->tag =cpu_to_le16 (UNI_OFFLOAD_OFFLOAD_GTK_REKEY ); gtk_tlv->len =cpu_to_le16 (sizeof (*gtk_tlv));
@@ -2446,7 +2446,7 @@ mt76_connac_mcu_set_wow_pattern(struct mt76_dev *dev,return -ENOMEM ;skb_put_data (skb, &hdr,sizeof (hdr)); - ptlv = (struct mt76_connac_wow_pattern_tlv *)skb_put (skb,sizeof (*ptlv)); + ptlv = (struct mt76_connac_wow_pattern_tlv *)skb_put_zero (skb,sizeof (*ptlv)); ptlv->tag =cpu_to_le16 (UNI_SUSPEND_WOW_PATTERN ); ptlv->len =cpu_to_le16 (sizeof (*ptlv)); ptlv->data_len = pattern->pattern_len;
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +1 -1
@@ -424,7 +424,7 @@ mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len, .len = cpu_to_le16(sub_len), }; - ptlv =skb_put (skb, sub_len); + ptlv =skb_put_zero (skb, sub_len);memcpy (ptlv, &tlv,sizeof (tlv));le16_add_cpu (sub_ntlv,1 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/197 wifi: mt76: mt7996: add sanity checks for background radar trigger
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: StanleyYP Wang <[email protected]>
[ Upstream commit ec55d8e7dfea92daff87f5c01689633f8c4e6a62 ]
Check if background radar is enabled or not before manually triggering it, and also add more checks in radar detected event.
--- drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c | 5 +++++ drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 5 ++++- 2 files changed, 9 insertions(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c +5 -0
@@ -225,6 +225,11 @@ mt7996_radar_trigger(void *data, u64 val)if (val >MT_RX_SEL2 )return -EINVAL ; +if (val ==MT_RX_SEL2 && !dev->rdd2_phy) { +dev_err (dev->mt76.dev,"Background radar is not enabled\n" ); +return -EINVAL ; + } +return mt7996_mcu_rdd_cmd (dev,RDD_RADAR_EMULATE , val,0 ,0 ); }
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +4 -1
@@ -355,7 +355,10 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)if (r->band_idx >=ARRAY_SIZE (dev->mt76.phys))return ; -if (dev->rdd2_phy && r->band_idx ==MT_RX_SEL2 ) +if (r->band_idx ==MT_RX_SEL2 && !dev->rdd2_phy) +return ; + +if (r->band_idx ==MT_RX_SEL2 ) mphy = dev->rdd2_phy->mt76;else mphy = dev->mt76.phys[r->band_idx];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/197 thermal/drivers/mediatek/lvts_thermal: Check NULL ptr on lvts_data
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julien Panis <[email protected]>
[ Upstream commit a1191a77351e25ddf091bb1a231cae12ee598b5d ]
Verify that lvts_data is not NULL before using it.
--- drivers/thermal/mediatek/lvts_thermal.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/thermal/mediatek/lvts_thermal.c +2 -0
@@ -1250,6 +1250,8 @@ static int lvts_probe(struct platform_device *pdev)return -ENOMEM ; lvts_data =of_device_get_match_data (dev); +if (!lvts_data) +return -ENODEV ; lvts_td->clk =devm_clk_get_enabled (dev,NULL );if (IS_ERR (lvts_td->clk))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/197 net: dsa: mv88e6xxx: Correct check for empty list
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit 4c7f3950a9fd53a62b156c0fe7c3a2c43b0ba19b ]
Since commit a3c53be55c95 ("net: dsa: mv88e6xxx: Support multiple MDIO busses") mv88e6xxx_default_mdio_bus() has checked that the return value of list_first_entry() is non-NULL.
This appears to be intended to guard against the list chip->mdios being empty. However, it is not the correct check as the implementation of list_first_entry is not designed to return NULL for empty lists.
Instead, use list_first_entry_or_null() which does return NULL if the list is empty.
Flagged by Smatch.
Compile tested only.
--- drivers/net/dsa/mv88e6xxx/chip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/dsa/mv88e6xxx/chip.c +2 -2
@@ -131,8 +131,8 @@ struct mii_bus *mv88e6xxx_default_mdio_bus(struct mv88e6xxx_chip *chip) {struct mv88e6xxx_mdio_bus *mdio_bus; - mdio_bus = list_first_entry(&chip->mdios, struct mv88e6xxx_mdio_bus, - list); + mdio_bus =list_first_entry_or_null (&chip->mdios, + struct mv88e6xxx_mdio_bus, list);if (!mdio_bus)return NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/197 media: dvb-frontends: tda18271c2dd: Remove casting during div
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit e9a844632630e18ed0671a7e3467431bd719952e ]
do_div() divides 64 bits by 32. We were adding a casting to the divider to 64 bits, for a number that fits perfectly in 32 bits. Remove it.
Found by cocci:
drivers/media/dvb-frontends/tda18271c2dd.c:355:1-7: WARNING: do_div() does a 64-by-32 division, please consider using div64_u64 instead. drivers/media/dvb-frontends/tda18271c2dd.c:331:1-7: WARNING: do_div() does a 64-by-32 division, please consider using div64_u64 instead.
--- drivers/media/dvb-frontends/tda18271c2dd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/dvb-frontends/tda18271c2dd.c +2 -2
@@ -328,7 +328,7 @@ static int CalcMainPLL(struct tda_state *state, u32 freq) OscFreq = (u64 ) freq * (u64 ) Div; OscFreq *= (u64 )16384 ; -do_div (OscFreq, (u64 )16000000 ); +do_div (OscFreq,16000000 ); MainDiv = OscFreq; state->m_Regs[MPD ] = PostDiv &0x77 ;
@@ -352,7 +352,7 @@ static int CalcCalPLL(struct tda_state *state, u32 freq) OscFreq = (u64 )freq * (u64 )Div;/* CalDiv = u32( OscFreq * 16384 / 16000000 ); */ OscFreq *= (u64 )16384 ; -do_div (OscFreq, (u64 )16000000 ); +do_div (OscFreq,16000000 ); CalDiv = OscFreq; state->m_Regs[CPD ] = PostDiv;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/197 media: s2255: Use refcount_t instead of atomic_t for num_channels
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 6cff72f6bcee89228a662435b7c47e21a391c8d0 ]
Use an API that resembles more the actual use of num_channels.
Found by cocci:
drivers/media/usb/s2255/s2255drv.c:2362:5-24: WARNING: atomic_dec_and_test variation before object free at line 2363. drivers/media/usb/s2255/s2255drv.c:1557:5-24: WARNING: atomic_dec_and_test variation before object free at line 1558.
--- drivers/media/usb/s2255/s2255drv.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
drivers/media/usb/s2255/s2255drv.c +10 -10
@@ -247,7 +247,7 @@ struct s2255_vc {struct s2255_dev {struct s2255_vc vc[MAX_CHANNELS ];struct v4l2_device v4l2_dev; -atomic_t num_channels; +refcount_t num_channels;int frames;struct mutex lock;/* channels[].vdev.lock */ struct mutex cmdlock;/* protects cmdbuf */
@@ -1550,11 +1550,11 @@ static void s2255_video_device_release(struct video_device *vdev) container_of(vdev, struct s2255_vc, vdev);dprintk (dev,4 ,"%s, chnls: %d\n" , __func__, -atomic_read (&dev->num_channels)); +refcount_read (&dev->num_channels));v4l2_ctrl_handler_free (&vc->hdl); -if (atomic_dec_and_test (&dev->num_channels)) +if (refcount_dec_and_test (&dev->num_channels))s2255_destroy (dev);return ; }
@@ -1659,7 +1659,7 @@ static int s2255_probe_v4l(struct s2255_dev *dev) "failed to register video device!\n");break ; } -atomic_inc (&dev->num_channels); +refcount_inc (&dev->num_channels);v4l2_info (&dev->v4l2_dev,"V4L2 device registered as %s\n" ,video_device_node_name (&vc->vdev));
@@ -1667,11 +1667,11 @@ static int s2255_probe_v4l(struct s2255_dev *dev)pr_info ("Sensoray 2255 V4L driver Revision: %s\n" ,S2255_VERSION );/* if no channels registered, return error and probe will fail*/ -if (atomic_read (&dev->num_channels) ==0 ) { +if (refcount_read (&dev->num_channels) ==0 ) {v4l2_device_unregister (&dev->v4l2_dev);return ret; } -if (atomic_read (&dev->num_channels) !=MAX_CHANNELS ) +if (refcount_read (&dev->num_channels) !=MAX_CHANNELS )pr_warn ("s2255: Not all channels available.\n" );return 0 ; }
@@ -2221,7 +2221,7 @@ static int s2255_probe(struct usb_interface *interface, goto errorFWDATA1; } -atomic_set (&dev->num_channels,0 ); +refcount_set (&dev->num_channels,0 ); dev->pid = id->idProduct; dev->fw_data =kzalloc (sizeof (struct s2255_fw ),GFP_KERNEL );if (!dev->fw_data)
@@ -2341,12 +2341,12 @@ static void s2255_disconnect(struct usb_interface *interface) {struct s2255_dev *dev =to_s2255_dev (usb_get_intfdata (interface));int i; -int channels =atomic_read (&dev->num_channels); +int channels =refcount_read (&dev->num_channels);mutex_lock (&dev->lock);v4l2_device_disconnect (&dev->v4l2_dev);mutex_unlock (&dev->lock);/*see comments in the uvc_driver.c usb disconnect function */ -atomic_inc (&dev->num_channels); +refcount_inc (&dev->num_channels);/* unregister each video device. */ for (i =0 ; i < channels; i++)video_unregister_device (&dev->vc[i].vdev);
@@ -2359,7 +2359,7 @@ static void s2255_disconnect(struct usb_interface *interface) dev->vc[i].vidstatus_ready =1 ;wake_up (&dev->vc[i].wait_vidstatus); } -if (atomic_dec_and_test (&dev->num_channels)) +if (refcount_dec_and_test (&dev->num_channels))s2255_destroy (dev);dev_info (&interface->dev,"%s\n" , __func__); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/197 media: i2c: st-mipid02: Use the correct div function
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 22dccf029e4a67ad5aa62537c47ece9f24c8f970 ]
link_freq does not fit in 32 bits.
Found by cocci:
drivers/media/i2c/st-mipid02.c:329:1-7: WARNING: do_div() does a 64-by-32 division, please consider using div64_s64 instead.
--- drivers/media/i2c/st-mipid02.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/st-mipid02.c +1 -1
@@ -326,7 +326,7 @@ static int mipid02_configure_from_rx_speed(struct mipid02_dev *bridge, }dev_dbg (&client->dev,"detect link_freq = %lld Hz" , link_freq); -do_div (ui_4, link_freq); + ui_4 =div64_u64 (ui_4, link_freq); bridge->r.clk_lane_reg1 |= ui_4 <<2 ;return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/197 media: tc358746: Use the correct div_ function
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit d77731382f57b9c18664a13c7e197285060ebf93 ]
fin does not fit in 32 bits in some arches.
Found by cocci:
drivers/media/i2c/tc358746.c:847:2-8: WARNING: do_div() does a 64-by-32 division, please consider using div64_ul instead.
--- drivers/media/i2c/tc358746.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/media/i2c/tc358746.c +1 -2
@@ -844,8 +844,7 @@ static unsigned long tc358746_find_pll_settings(struct tc358746 *tc358746,continue ; tmp = fout * postdiv; -do_div (tmp, fin); - mul = tmp; + mul =div64_ul (tmp, fin);if (mul >511 )continue ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/197 media: dvb-frontends: tda10048: Fix integer overflow
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 1aa1329a67cc214c3b7bd2a14d1301a795760b07 ]
state->xtal_hz can be up to 16M, so it can overflow a 32 bit integer when multiplied by pll_mfactor.
Create a new 64 bit variable to hold the calculations.
--- drivers/media/dvb-frontends/tda10048.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/media/dvb-frontends/tda10048.c +6 -3
@@ -410,6 +410,7 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw)struct tda10048_config *config = &state->config;int i;u32 if_freq_khz; +u64 sample_freq;dprintk (1 ,"%s(bw = %d)\n" , __func__, bw);
@@ -451,9 +452,11 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw)dprintk (1 ,"- pll_pfactor = %d\n" , state->pll_pfactor);/* Calculate the sample frequency */ - state->sample_freq = state->xtal_hz * (state->pll_mfactor +45 ); - state->sample_freq /= (state->pll_nfactor +1 ); - state->sample_freq /= (state->pll_pfactor +4 ); + sample_freq = state->xtal_hz; + sample_freq *= state->pll_mfactor +45 ; +do_div (sample_freq, state->pll_nfactor +1 ); +do_div (sample_freq, state->pll_pfactor +4 ); + state->sample_freq = sample_freq;dprintk (1 ,"- sample_freq = %d\n" , state->sample_freq);/* Update the I/F */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/197 crypto: hisilicon/sec2 - fix for register offset
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenkai Lin <[email protected]>
[ Upstream commit 6117af86365916e4202b5a709c155f7e6e5df810 ]
The offset of SEC_CORE_ENABLE_BITMAP should be 0 instead of 32, it cause a kasan shift-out-bounds warning, fix it.
--- drivers/crypto/hisilicon/sec2/sec_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/hisilicon/sec2/sec_main.c +1 -1
@@ -152,7 +152,7 @@ static const struct hisi_qm_cap_info sec_basic_info[] = { {SEC_CORE_TYPE_NUM_CAP, 0x313c, 16, GENMASK(3, 0), 0x1, 0x1, 0x1}, {SEC_CORE_NUM_CAP, 0x313c, 8, GENMASK(7, 0), 0x4, 0x4, 0x4}, {SEC_CORES_PER_CLUSTER_NUM_CAP, 0x313c, 0, GENMASK(7, 0), 0x4, 0x4, 0x4}, - {SEC_CORE_ENABLE_BITMAP, 0x3140, 32, GENMASK(31, 0), 0x17F, 0x17F, 0xF}, + {SEC_CORE_ENABLE_BITMAP, 0x3140, 0, GENMASK(31, 0), 0x17F, 0x17F, 0xF}, {SEC_DRV_ALG_BITMAP_LOW, 0x3144, 0, GENMASK(31, 0), 0x18050CB, 0x18050CB, 0x18670CF}, {SEC_DRV_ALG_BITMAP_HIGH, 0x3148, 0, GENMASK(31, 0), 0x395C, 0x395C, 0x395C}, {SEC_DEV_ALG_BITMAP_LOW, 0x314c, 0, GENMASK(31, 0), 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF},
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/197 powerpc/dexcr: Track the DEXCR per-process
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Gray <[email protected]>
[ Upstream commit 75171f06c4507c3b6b5a69d793879fb20d108bb1 ]
Add capability to make the DEXCR act as a per-process SPR.
We do not yet have an interface for changing the values per task. We also expect the kernel to use a single DEXCR value across all tasks while in privileged state, so there is no need to synchronize after changing it (the userspace aspects will synchronize upon returning to userspace).
Stable-dep-of: bbd99922d0f4 ("powerpc/dexcr: Reset DEXCR value across exec")
--- arch/powerpc/include/asm/processor.h | 1 + arch/powerpc/kernel/process.c | 10 ++++++++++ arch/powerpc/kernel/ptrace/ptrace-view.c | 7 +------ 3 files changed, 12 insertions(+), 6 deletions(-)
arch/powerpc/include/asm/processor.h +1 -0
@@ -260,6 +260,7 @@ struct thread_struct {unsigned long sier2;unsigned long sier3;unsigned long hashkeyr; +unsigned long dexcr;#endif };
arch/powerpc/kernel/process.c +10 -0
@@ -1185,6 +1185,9 @@ static inline void save_sprs(struct thread_struct *t)if (cpu_has_feature (CPU_FTR_DEXCR_NPHIE )) t->hashkeyr =mfspr (SPRN_HASHKEYR ); + +if (cpu_has_feature (CPU_FTR_ARCH_31 )) + t->dexcr =mfspr (SPRN_DEXCR );#endif }
@@ -1267,6 +1270,10 @@ static inline void restore_sprs(struct thread_struct *old_thread,if (cpu_has_feature (CPU_FTR_DEXCR_NPHIE ) && old_thread->hashkeyr != new_thread->hashkeyr)mtspr (SPRN_HASHKEYR , new_thread->hashkeyr); + +if (cpu_has_feature (CPU_FTR_ARCH_31 ) && + old_thread->dexcr != new_thread->dexcr) +mtspr (SPRN_DEXCR , new_thread->dexcr);#endif }
@@ -1878,6 +1885,9 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)#ifdef CONFIG_PPC_BOOK3S_64 if (cpu_has_feature (CPU_FTR_DEXCR_NPHIE )) p->thread.hashkeyr = current->thread.hashkeyr; + +if (cpu_has_feature (CPU_FTR_ARCH_31 )) + p->thread.dexcr =mfspr (SPRN_DEXCR );#endif return 0 ; }
arch/powerpc/kernel/ptrace/ptrace-view.c +1 -6
@@ -469,12 +469,7 @@ static int dexcr_get(struct task_struct *target, const struct user_regset *regseif (!cpu_has_feature (CPU_FTR_ARCH_31 ))return -ENODEV ; -/* -* The DEXCR is currently static across all CPUs, so we don't -* store the target's value anywhere, but the static value -* will also be correct. -*/ -membuf_store (&to, (u64 )lower_32_bits (DEXCR_INIT )); +membuf_store (&to, (u64 )lower_32_bits (target->thread.dexcr));/* * Technically the HDEXCR is per-cpu, but a hypervisor can't reasonably
Signature · 1 line
2.43.0
Re: [PATCH 6.9 057/197] powerpc/dexcr: Track the DEXCR per-process
Quoted 16 lines · Greg Kroah-Hartman
6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Gray <[email protected]>
[ Upstream commit
75171f06c4507c3b6b5a69d793879fb20d108bb1]Add capability to make the DEXCR act as a per-process SPR.
We do not yet have an interface for changing the values per task. We also expect the kernel to use a single DEXCR value across all tasks while in privileged state, so there is no need to synchronize after changing it (the userspace aspects will synchronize upon returning to userspace).
Quoted 4 lines
Signed-off-by Benjamin Gray <[email protected]>Signed-off-by Michael Ellerman <[email protected]>Stable-dep-of:
bbd99922d0f4("powerpc/dexcr: Reset DEXCR value across exec")
This is listed as a dep, but I don't see that commit (bbd99922d0f4) queued up?
This series included user-visible changes including new prctls, it shouldn't be backported piecemeal.
I think this series shouldn't be backported unless someone explicitly wants it.
cheers
Greg Kroah-Hartman
maintainerRe: [PATCH 6.9 057/197] powerpc/dexcr: Track the DEXCR per-process
Quoted 22 lines · Michael Ellerman
Quoted 16 lines · Greg Kroah-Hartman
6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Gray <[email protected]>
[ Upstream commit
75171f06c4507c3b6b5a69d793879fb20d108bb1]Add capability to make the DEXCR act as a per-process SPR.
We do not yet have an interface for changing the values per task. We also expect the kernel to use a single DEXCR value across all tasks while in privileged state, so there is no need to synchronize after changing it (the userspace aspects will synchronize upon returning to userspace).
Quoted 4 lines
Signed-off-by Benjamin Gray <[email protected]>Signed-off-by Michael Ellerman <[email protected]>Stable-dep-of:
bbd99922d0f4("powerpc/dexcr: Reset DEXCR value across exec")
Quoted 8 lines
This is listed as a dep, but I don't see that commit (
bbd99922d0f4) queued up?This series included user-visible changes including new prctls, it shouldn't be backported piecemeal.
I think this series shouldn't be backported unless someone explicitly wants it.
Thanks for the review, now removed.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 58/197 gve: Account for stopped queues when reading NIC stats
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shailend Chand <[email protected]>
[ Upstream commit af9bcf910b1f86244f39e15e701b2dc564b469a6 ]
We now account for the fact that the NIC might send us stats for a subset of queues. Without this change, gve_get_ethtool_stats might make an invalid access on the priv->stats_report->stats array.
--- drivers/net/ethernet/google/gve/gve_ethtool.c | 41 ++++++++++++++++--- 1 file changed, 35 insertions(+), 6 deletions(-)
drivers/net/ethernet/google/gve/gve_ethtool.c +35 -6
@@ -8,6 +8,7 @@#include "gve.h" #include "gve_adminq.h" #include "gve_dqo.h" +#include "gve_utils.h" static void gve_get_drvinfo (struct net_device *netdev,struct ethtool_drvinfo *info)
@@ -165,6 +166,8 @@ gve_get_ethtool_stats(struct net_device *netdev,struct stats *report_stats;int *rx_qid_to_stats_idx;int *tx_qid_to_stats_idx; +int num_stopped_rxqs =0 ; +int num_stopped_txqs =0 ;struct gve_priv *priv;bool skip_nic_stats;unsigned int start;
@@ -181,12 +184,23 @@ gve_get_ethtool_stats(struct net_device *netdev, sizeof(int), GFP_KERNEL);if (!rx_qid_to_stats_idx)return ; +for (ring =0 ; ring < priv->rx_cfg.num_queues; ring++) { + rx_qid_to_stats_idx[ring] =-1 ; +if (!gve_rx_was_added_to_block (priv, ring)) + num_stopped_rxqs++; + } tx_qid_to_stats_idx =kmalloc_array (num_tx_queues,sizeof (int ),GFP_KERNEL );if (!tx_qid_to_stats_idx) {kfree (rx_qid_to_stats_idx);return ; } +for (ring =0 ; ring < num_tx_queues; ring++) { + tx_qid_to_stats_idx[ring] =-1 ; +if (!gve_tx_was_added_to_block (priv, ring)) + num_stopped_txqs++; + } + for (rx_pkts = 0, rx_bytes = 0, rx_hsplit_pkt = 0, rx_skb_alloc_fail = 0, rx_buf_alloc_fail = 0, rx_desc_err_dropped_pkt = 0, rx_hsplit_unsplit_pkt = 0,
@@ -260,7 +274,13 @@ gve_get_ethtool_stats(struct net_device *netdev,/* For rx cross-reporting stats, start from nic rx stats in report */ base_stats_idx =GVE_TX_STATS_REPORT_NUM * num_tx_queues +GVE_RX_STATS_REPORT_NUM * priv->rx_cfg.num_queues; - max_stats_idx =NIC_RX_STATS_REPORT_NUM * priv->rx_cfg.num_queues + +/* The boundary between driver stats and NIC stats shifts if there are +* stopped queues. +*/ + base_stats_idx +=NIC_RX_STATS_REPORT_NUM * num_stopped_rxqs + +NIC_TX_STATS_REPORT_NUM * num_stopped_txqs; + max_stats_idx =NIC_RX_STATS_REPORT_NUM * + (priv->rx_cfg.num_queues - num_stopped_rxqs) + base_stats_idx;/* Preprocess the stats report for rx, map queue id to start index */ skip_nic_stats = false;
@@ -274,6 +294,10 @@ gve_get_ethtool_stats(struct net_device *netdev, skip_nic_stats = true;break ; } +if (queue_id <0 || queue_id >= priv->rx_cfg.num_queues) { +net_err_ratelimited ("Invalid rxq id in NIC stats\n" ); +continue ; + } rx_qid_to_stats_idx[queue_id] = stats_idx; }/* walk RX rings */
@@ -308,11 +332,11 @@ gve_get_ethtool_stats(struct net_device *netdev, data[i++] = rx->rx_copybreak_pkt; data[i++] = rx->rx_copied_pkt;/* stats from NIC */ -if (skip_nic_stats) { + stats_idx = rx_qid_to_stats_idx[ring]; +if (skip_nic_stats || stats_idx <0 ) {/* skip NIC rx stats */ i +=NIC_RX_STATS_REPORT_NUM ; }else { - stats_idx = rx_qid_to_stats_idx[ring];for (j =0 ; j <NIC_RX_STATS_REPORT_NUM ; j++) {u64 value =be64_to_cpu (report_stats[stats_idx + j].value);
@@ -338,7 +362,8 @@ gve_get_ethtool_stats(struct net_device *netdev,/* For tx cross-reporting stats, start from nic tx stats in report */ base_stats_idx = max_stats_idx; - max_stats_idx =NIC_TX_STATS_REPORT_NUM * num_tx_queues + + max_stats_idx =NIC_TX_STATS_REPORT_NUM * + (num_tx_queues - num_stopped_txqs) + max_stats_idx;/* Preprocess the stats report for tx, map queue id to start index */ skip_nic_stats = false;
@@ -352,6 +377,10 @@ gve_get_ethtool_stats(struct net_device *netdev, skip_nic_stats = true;break ; } +if (queue_id <0 || queue_id >= num_tx_queues) { +net_err_ratelimited ("Invalid txq id in NIC stats\n" ); +continue ; + } tx_qid_to_stats_idx[queue_id] = stats_idx; }/* walk TX rings */
@@ -383,11 +412,11 @@ gve_get_ethtool_stats(struct net_device *netdev, data[i++] =gve_tx_load_event_counter (priv, tx); data[i++] = tx->dma_mapping_error;/* stats from NIC */ -if (skip_nic_stats) { + stats_idx = tx_qid_to_stats_idx[ring]; +if (skip_nic_stats || stats_idx <0 ) {/* skip NIC tx stats */ i +=NIC_TX_STATS_REPORT_NUM ; }else { - stats_idx = tx_qid_to_stats_idx[ring];for (j =0 ; j <NIC_TX_STATS_REPORT_NUM ; j++) {u64 value =be64_to_cpu (report_stats[stats_idx + j].value);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/197 i2c: i801: Annotate apanel_addr as __ro_after_init
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
[ Upstream commit 355b1513b1e97b6cef84b786c6480325dfd3753d ]
Annotate this variable as __ro_after_init to protect it from being overwritten later.
--- drivers/i2c/busses/i2c-i801.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-i801.c +1 -1
@@ -1059,7 +1059,7 @@ static const struct pci_device_id i801_ids[] = {MODULE_DEVICE_TABLE (pci, i801_ids);#if definedCONFIG_X86 && definedCONFIG_DMI -static unsigned char apanel_addr; +static unsigned char apanel_addr__ro_after_init ;/* Scan the system ROM for the signature "FJKEYINF" */ static __init const void __iomem *bios_signature (const void __iomem *bios)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/197 powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit be140f1732b523947425aaafbe2e37b41b622d96 ]
There is code that builds with calls to IO accessors even when CONFIG_PCI=n, but the actual calls are guarded by runtime checks.
If not those calls would be faulting, because the page at virtual address zero is (usually) not mapped into the kernel. As Arnd pointed out, it is possible a large port value could cause the address to be above mmap_min_addr which would then access userspace, which would be a bug.
To avoid any such issues, set _IO_BASE to POISON_POINTER_DELTA. That is a value chosen to point into unmapped space between the kernel and userspace, so any access will always fault.
Note that on 32-bit POISON_POINTER_DELTA is 0, so the patch only has an effect on 64-bit.
--- arch/powerpc/include/asm/io.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/include/asm/io.h +1 -1
@@ -37,7 +37,7 @@ extern struct pci_dev *isa_bridge_pcidev;* define properly based on the platform */ #ifndef CONFIG_PCI -#define _IO_BASE 0 +#define _IO_BASE POISON_POINTER_DELTA#define _ISA_MEM_BASE 0#define PCI_DRAM_OFFSET 0#elif defined(CONFIG_PPC32 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/197 orangefs: fix out-of-bounds fsid access
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marshall <[email protected]>
[ Upstream commit 53e4efa470d5fc6a96662d2d3322cfc925818517 ]
Arnd Bergmann sent a patch to fsdevel, he says:
"orangefs_statfs() copies two consecutive fields of the superblock into the statfs structure, which triggers a warning from the string fortification helpers"
Jan Kara suggested an alternate way to do the patch to make it more readable.
I ran both ideas through xfstests and both seem fine. This patch is based on Jan Kara's suggestion.
--- fs/orangefs/super.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/orangefs/super.c +2 -1
@@ -201,7 +201,8 @@ static int orangefs_statfs(struct dentry *dentry, struct kstatfs *buf) (long)new_op->downcall.resp.statfs.files_avail); buf->f_type = sb->s_magic; -memcpy (&buf->f_fsid, &ORANGEFS_SB (sb)->fs_id,sizeof (buf->f_fsid)); + buf->f_fsid.val[0 ] =ORANGEFS_SB (sb)->fs_id; + buf->f_fsid.val[1 ] =ORANGEFS_SB (sb)->id; buf->f_bsize = new_op->downcall.resp.statfs.block_size; buf->f_namelen =ORANGEFS_NAME_MAX ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/197 kunit: Fix timeout message
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mickaël Salaün <[email protected]>
[ Upstream commit 53026ff63bb07c04a0e962a74723eb10ff6f9dc7 ]
The exit code is always checked, so let's properly handle the -ETIMEDOUT error code.
Stable-dep-of: 3a35c13007de ("kunit: Handle test faults")
--- lib/kunit/try-catch.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
lib/kunit/try-catch.c +2 -1
@@ -78,7 +78,6 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context) time_remaining =wait_for_completion_timeout (&try_completion,kunit_test_timeout ());if (time_remaining ==0 ) { -kunit_err (test,"try timed out\n" ); try_catch->try_result = -ETIMEDOUT ;kthread_stop (task_struct); }
@@ -93,6 +92,8 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context) try_catch->try_result =0 ; else if (exit_code == -EINTR) kunit_err(test, "wake_up_process() was never called\n"); + else if (exit_code == -ETIMEDOUT) + kunit_err(test, "try timed out\n"); else if (exit_code) kunit_err(test, "Unknown error: %d\n", exit_code);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/197 kunit: Handle test faults
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mickaël Salaün <[email protected]>
[ Upstream commit 3a35c13007dea132a65f07de05c26b87837fadc2 ]
Previously, when a kernel test thread crashed (e.g. NULL pointer dereference, general protection fault), the KUnit test hanged for 30 seconds and exited with a timeout error.
Fix this issue by waiting on task_struct->vfork_done instead of the custom kunit_try_catch.try_completion, and track the execution state by initially setting try_result with -EINTR and only setting it to 0 if the test passed.
Fix kunit_generic_run_threadfn_adapter() signature by returning 0 instead of calling kthread_complete_and_exit(). Because thread's exit code is never checked, always set it to 0 to make it clear. To make this explicit, export kthread_exit() for KUnit tests built as module.
Fix the -EINTR error message, which couldn't be reached until now.
This is tested with a following patch.
--- include/kunit/try-catch.h | 3 --- kernel/kthread.c | 1 + lib/kunit/try-catch.c | 19 ++++++++++++------- 3 files changed, 13 insertions(+), 10 deletions(-)
include/kunit/try-catch.h +0 -3
@@ -14,13 +14,11 @@typedef void (*kunit_try_catch_func_t )(void *); -struct completion ;struct kunit ;/** * struct kunit_try_catch - provides a generic way to run code which might fail. * @test: The test case that is currently being executed. -* @try_completion: Completion that the control thread waits on while test runs. * @try_result: Contains any errno obtained while running test case. * @try: The function, the test case, to attempt to run. * @catch: The function called if @try bails out.
@@ -46,7 +44,6 @@ struct kunit;struct kunit_try_catch {/* private: internal use only. */ struct kunit *test; -struct completion *try_completion;int try_result;kunit_try_catch_func_t try;kunit_try_catch_func_t catch;
kernel/kthread.c +1 -0
@@ -315,6 +315,7 @@ void __noreturn kthread_exit(long result) kthread->result = result;do_exit (0 ); } +EXPORT_SYMBOL (kthread_exit);/** * kthread_complete_and_exit - Exit the current kthread.
lib/kunit/try-catch.c +12 -7
@@ -18,7 +18,7 @@void __noreturn kunit_try_catch_throw (struct kunit_try_catch *try_catch) { try_catch->try_result = -EFAULT ; -kthread_complete_and_exit (try_catch->try_completion, -EFAULT ); +kthread_exit (0 ); }EXPORT_SYMBOL_GPL (kunit_try_catch_throw);
@@ -26,9 +26,12 @@ static int kunit_generic_run_threadfn_adapter(void *data) {struct kunit_try_catch *try_catch = data; + try_catch->try_result = -EINTR ; try_catch->try (try_catch->context); +if (try_catch->try_result == -EINTR ) + try_catch->try_result =0 ; -kthread_complete_and_exit (try_catch->try_completion,0 ); +return 0 ; }static unsigned long kunit_test_timeout (void )
@@ -58,13 +61,11 @@ static unsigned long kunit_test_timeout(void)void kunit_try_catch_run (struct kunit_try_catch *try_catch,void *context) { -DECLARE_COMPLETION_ONSTACK (try_completion);struct kunit *test = try_catch->test;struct task_struct *task_struct;int exit_code, time_remaining; try_catch->context = context; - try_catch->try_completion = &try_completion; try_catch->try_result =0 ; task_struct =kthread_create (kunit_generic_run_threadfn_adapter, try_catch,"kunit_try_catch_thread" );
@@ -74,8 +75,12 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context) }get_task_struct (task_struct);wake_up_process (task_struct); - - time_remaining =wait_for_completion_timeout (&try_completion, +/* +* As for a vfork(2), task_struct->vfork_done (pointing to the +* underlying kthread->exited) can be used to wait for the end of a +* kernel thread. +*/ + time_remaining =wait_for_completion_timeout (task_struct->vfork_done,kunit_test_timeout ());if (time_remaining ==0 ) { try_catch->try_result = -ETIMEDOUT ;
@@ -91,7 +96,7 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context)if (exit_code == -EFAULT ) try_catch->try_result =0 ;else if (exit_code == -EINTR ) -kunit_err (test,"wake_up_process() was never called\n" ); +kunit_err (test,"try faulted\n" );else if (exit_code == -ETIMEDOUT )kunit_err (test,"try timed out\n" );else if (exit_code)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/197 powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kurz <[email protected]>
[ Upstream commit 8873aab8646194a4446117bb617cc71bddda2dee ]
All these commands end up peeking into the PACA using the user originated cpu id as an index. Check the cpu id is valid in order to prevent xmon to crash. Instead of printing an error, this follows the same behavior as the "lp s #" command : ignore the buggy cpu id parameter and fall back to the #-less version of the command.
--- arch/powerpc/xmon/xmon.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/powerpc/xmon/xmon.c +3 -3
@@ -1350,7 +1350,7 @@ static int cpu_cmd(void) } termch = cpu; -if (!scanhex (&cpu)) { +if (!scanhex (&cpu) || cpu >=num_possible_cpus ()) {/* print cpus waiting or in xmon */ printf ("cpus stopped:" ); last_cpu = first_cpu =NR_CPUS ;
@@ -2772,7 +2772,7 @@ static void dump_pacas(void) termch = c;/* Put c back, it wasn't 'a' */ -if (scanhex (&num)) +if (scanhex (&num) && num <num_possible_cpus ())dump_one_paca (num);else dump_one_paca (xmon_owner);
@@ -2845,7 +2845,7 @@ static void dump_xives(void) termch = c;/* Put c back, it wasn't 'a' */ -if (scanhex (&num)) +if (scanhex (&num) && num <num_possible_cpus ())dump_one_xive (num);else dump_one_xive (xmon_owner);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/197 selftests/net: fix uninitialized variables
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Hubbard <[email protected]>
[ Upstream commit eb709b5f6536636dfb87b85ded0b2af9bb6cd9e6 ]
When building with clang, via:
make LLVM=1 -C tools/testing/selftest
...clang warns about three variables that are not initialized in all cases:
1) The opt_ipproto_off variable is used uninitialized if "testname" is not "ip". Willem de Bruijn pointed out that this is an actual bug, and suggested the fix that I'm using here (thanks!).
2) The addr_len is used uninitialized, but only in the assert case, which bails out, so this is harmless.
3) The family variable in add_listener() is only used uninitialized in the error case (neither IPv4 nor IPv6 is specified), so it's also harmless.
Fix by initializing each variable.
--- tools/testing/selftests/net/gro.c | 3 +++ tools/testing/selftests/net/ip_local_port_range.c | 2 +- tools/testing/selftests/net/mptcp/pm_nl_ctl.c | 2 +- 3 files changed, 5 insertions(+), 2 deletions(-)
tools/testing/selftests/net/gro.c +3 -0
@@ -119,6 +119,9 @@ static void setup_sock_filter(int fd) next_off = offsetof(struct ipv6hdr , nexthdr); ipproto_off =ETH_HLEN + next_off; +/* Overridden later if exthdrs are used: */ + opt_ipproto_off = ipproto_off; +if (strcmp (testname,"ip" ) ==0 ) {if (proto ==PF_INET ) optlen =sizeof (struct ip_timestamp );
tools/testing/selftests/net/ip_local_port_range.c +1 -1
@@ -359,7 +359,7 @@ TEST_F(ip_local_port_range, late_bind)struct sockaddr_in v4;struct sockaddr_in6 v6; } addr; -socklen_t addr_len; +socklen_t addr_len =0 ;const int one =1 ;int fd, err;__u32 range;
tools/testing/selftests/net/mptcp/pm_nl_ctl.c +1 -1
@@ -1276,7 +1276,7 @@ int add_listener(int argc, char *argv[])struct sockaddr_storage addr;struct sockaddr_in6 *a6;struct sockaddr_in *a4; -u_int16_t family; +u_int16_t family =AF_UNSPEC ;int enable =1 ;int sock;int err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/197 igc: fix a log entry using uninitialized netdev
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corinna Vinschen <[email protected]>
[ Upstream commit 86167183a17e03ec77198897975e9fdfbd53cb0b ]
During successful probe, igc logs this:
[ 5.133667] igc 0000:01:00.0 (unnamed net_device) (uninitialized): PHC added
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^The reason is that igc_ptp_init() is called very early, even before register_netdev() has been called. So the netdev_info() call works on a partially uninitialized netdev.
Fix this by calling igc_ptp_init() after register_netdev(), right after the media autosense check, just as in igb. Add a comment, just as in igb.
Now the log message is fine:
[ 5.200987] igc 0000:01:00.0 eth0: PHC added
--- drivers/net/ethernet/intel/igc/igc_main.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/igc/igc_main.c +3 -2
@@ -6932,8 +6932,6 @@ static int igc_probe(struct pci_dev *pdev,device_set_wakeup_enable (&adapter->pdev->dev, adapter->flags &IGC_FLAG_WOL_SUPPORTED ); -igc_ptp_init (adapter); -igc_tsn_clear_schedule (adapter);/* reset the hardware with the new settings */
@@ -6955,6 +6953,9 @@ static int igc_probe(struct pci_dev *pdev,/* Check if Media Autosense is enabled */ adapter->ei = *ei; +/* do hw tstamp init after resetting */ +igc_ptp_init (adapter); +/* print pcie link status and MAC address */ pcie_print_link_status (pdev);netdev_info (netdev,"MAC: %pM\n" , netdev->dev_addr);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/197 bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jose E. Marchesi <[email protected]>
[ Upstream commit 009367099eb61a4fc2af44d4eb06b6b4de7de6db ]
[Changes from V1:
- Use a default branch in the switch statement to initialize `val'.]
GCC warns that `val' may be used uninitialized in the BPF_CRE_READ_BITFIELD macro, defined in bpf_core_read.h as:
[...]
unsigned long long val; \
[...] \
switch (__CORE_RELO(s, field, BYTE_SIZE)) { \
case 1: val = *(const unsigned char *)p; break; \
case 2: val = *(const unsigned short *)p; break; \
case 4: val = *(const unsigned int *)p; break; \
case 8: val = *(const unsigned long long *)p; break; \
} \
[...]
val; \
} \This patch adds a default entry in the switch statement that sets `val' to zero in order to avoid the warning, and random values to be used in case __builtin_preserve_field_info returns unexpected values for BPF_FIELD_BYTE_SIZE.
Tested in bpf-next master.
No regressions.
--- tools/lib/bpf/bpf_core_read.h | 1 + 1 file changed, 1 insertion(+)
tools/lib/bpf/bpf_core_read.h +1 -0
@@ -104,6 +104,7 @@ enum bpf_enum_value_kind {case 2 : val = *(const unsigned short *)p;break ; \case 4 : val = *(const unsigned int *)p;break ; \case 8 : val = *(const unsigned long long *)p;break ; \ +default : val =0 ;break ; \ } \ val <<=__CORE_RELO (s, field,LSHIFT_U64 ); \if (__CORE_RELO (s, field,SIGNED )) \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/197 f2fs: check validation of fault attrs in f2fs_build_fault_attr()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 4ed886b187f47447ad559619c48c086f432d2b77 ]
- It missed to check validation of fault attrs in parse_options(), let's fix to add check condition in f2fs_build_fault_attr().
- Use f2fs_build_fault_attr() in __sbi_store() to clean up code.
--- fs/f2fs/f2fs.h | 12 ++++++++---- fs/f2fs/super.c | 27 ++++++++++++++++++++------- fs/f2fs/sysfs.c | 14 ++++++++++---- 3 files changed, 38 insertions(+), 15 deletions(-)
fs/f2fs/f2fs.h +8 -4
@@ -72,7 +72,7 @@ enum {struct f2fs_fault_info {atomic_t inject_ops; -unsigned int inject_rate; +int inject_rate;unsigned int inject_type; };
@@ -4597,10 +4597,14 @@ static inline bool f2fs_need_verity(const struct inode *inode, pgoff_t idx) }#ifdef CONFIG_F2FS_FAULT_INJECTION -extern void f2fs_build_fault_attr (struct f2fs_sb_info *sbi,unsigned int rate, -unsigned int type); +extern int f2fs_build_fault_attr (struct f2fs_sb_info *sbi,unsigned long rate, +unsigned long type);#else -#define f2fs_build_fault_attr (sbi, rate, type) do { } while (0) +static int f2fs_build_fault_attr (struct f2fs_sb_info *sbi,unsigned long rate, +unsigned long type) +{ +return 0 ; +}#endif static inline bool is_journalled_quota (struct f2fs_sb_info *sbi)
fs/f2fs/super.c +20 -7
@@ -66,21 +66,31 @@ const char *f2fs_fault_name[FAULT_MAX] = { [FAULT_NO_SEGMENT] = "no free segment", }; -void f2fs_build_fault_attr (struct f2fs_sb_info *sbi,unsigned int rate, -unsigned int type) +int f2fs_build_fault_attr (struct f2fs_sb_info *sbi,unsigned long rate, +unsigned long type) {struct f2fs_fault_info *ffi = &F2FS_OPTION (sbi).fault_info;if (rate) { +if (rate >INT_MAX ) +return -EINVAL ;atomic_set (&ffi->inject_ops,0 ); - ffi->inject_rate = rate; + ffi->inject_rate = (int )rate; } -if (type) - ffi->inject_type = type; +if (type) { +if (type >=BIT (FAULT_MAX )) +return -EINVAL ; + ffi->inject_type = (unsigned int )type; + }if (!rate && !type)memset (ffi,0 ,sizeof (struct f2fs_fault_info )); +else +f2fs_info (sbi, +"build fault injection attr: rate: %lu, type: 0x%lx" , + rate, type); +return 0 ; }#endif
@@ -886,14 +896,17 @@ static int parse_options(struct super_block *sb, char *options, bool is_remount)case Opt_fault_injection:if (args->from &&match_int (args, &arg))return -EINVAL ; -f2fs_build_fault_attr (sbi, arg,F2FS_ALL_FAULT_TYPE ); +if (f2fs_build_fault_attr (sbi, arg, +F2FS_ALL_FAULT_TYPE )) +return -EINVAL ;set_opt (sbi,FAULT_INJECTION );break ;case Opt_fault_type:if (args->from &&match_int (args, &arg))return -EINVAL ; -f2fs_build_fault_attr (sbi,0 , arg); +if (f2fs_build_fault_attr (sbi,0 , arg)) +return -EINVAL ;set_opt (sbi,FAULT_INJECTION );break ;#else
fs/f2fs/sysfs.c +10 -4
@@ -484,10 +484,16 @@ static ssize_t __sbi_store(struct f2fs_attr *a,if (ret <0 )return ret;#ifdef CONFIG_F2FS_FAULT_INJECTION -if (a->struct_type ==FAULT_INFO_TYPE && t >=BIT (FAULT_MAX )) -return -EINVAL ; -if (a->struct_type ==FAULT_INFO_RATE && t >=UINT_MAX ) -return -EINVAL ; +if (a->struct_type ==FAULT_INFO_TYPE ) { +if (f2fs_build_fault_attr (sbi,0 , t)) +return -EINVAL ; +return count; + } +if (a->struct_type ==FAULT_INFO_RATE ) { +if (f2fs_build_fault_attr (sbi, t,0 )) +return -EINVAL ; +return count; + }#endif if (a->struct_type ==RESERVED_BLOCKS ) {spin_lock (&sbi->stat_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/197 scsi: mpi3mr: Sanitise num_phys
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Henzl <[email protected]>
[ Upstream commit 3668651def2c1622904e58b0280ee93121f2b10b ]
Information is stored in mr_sas_port->phy_mask, values larger then size of this field shouldn't be allowed.
--- drivers/scsi/mpi3mr/mpi3mr_transport.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/scsi/mpi3mr/mpi3mr_transport.c +10 -0
@@ -1355,11 +1355,21 @@ static struct mpi3mr_sas_port *mpi3mr_sas_port_add(struct mpi3mr_ioc *mrioc,mpi3mr_sas_port_sanity_check (mrioc, mr_sas_node, mr_sas_port->remote_identify.sas_address, hba_port); +if (mr_sas_node->num_phys >sizeof (mr_sas_port->phy_mask) *8 ) +ioc_info (mrioc,"max port count %u could be too high\n" , + mr_sas_node->num_phys); +for (i =0 ; i < mr_sas_node->num_phys; i++) {if ((mr_sas_node->phy[i].remote_identify.sas_address != mr_sas_port->remote_identify.sas_address) || (mr_sas_node->phy[i].hba_port != hba_port))continue ; + +if (i >sizeof (mr_sas_port->phy_mask) *8 ) { +ioc_warn (mrioc,"skipping port %u, max allowed value is %lu\n" , + i,sizeof (mr_sas_port->phy_mask) *8 ); + goto out_fail; + }list_add_tail (&mr_sas_node->phy[i].port_siblings, &mr_sas_port->phy_list); mr_sas_port->num_phys++;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/197 serial: imx: Raise TX trigger level to 8
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Schiffer <[email protected]>
[ Upstream commit a3d8728ab079951741efa11360df43dbfacba7ab ]
At the default TX trigger level of 2 in non-DMA mode (meaning that an interrupt is generated when less than 2 characters are left in the FIFO), we have observed frequent buffer underruns at 115200 Baud on an i.MX8M Nano. This can cause communication issues if the receiving side expects a continuous transfer.
Increasing the level to 8 makes the UART trigger an interrupt earlier, giving the kernel enough time to refill the FIFO, at the cost of triggering one interrupt per ~24 instead of ~30 bytes of transmitted data (as the i.MX UART has a 32 byte FIFO).
--- drivers/tty/serial/imx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/imx.c +1 -1
@@ -1314,7 +1314,7 @@ static void imx_uart_clear_rx_errors(struct imx_port *sport) } -#define TXTL_DEFAULT 2/* reset default */ +#define TXTL_DEFAULT 8#define RXTL_DEFAULT 8/* 8 characters or aging timer */ #define TXTL_DMA 8/* DMA burst setting */ #define RXTL_DMA 9/* DMA burst setting */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/197 jffs2: Fix potential illegal address access in jffs2_free_inode
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Yong <[email protected]>
[ Upstream commit af9a8730ddb6a4b2edd779ccc0aceb994d616830 ]
During the stress testing of the jffs2 file system,the following abnormal printouts were found:
[ 2430.649000] Unable to handle kernel paging request at virtual address 0069696969696948 [ 2430.649622] Mem abort info: [ 2430.649829] ESR = 0x96000004 [ 2430.650115] EC = 0x25: DABT (current EL), IL = 32 bits [ 2430.650564] SET = 0, FnV = 0 [ 2430.650795] EA = 0, S1PTW = 0 [ 2430.651032] FSC = 0x04: level 0 translation fault [ 2430.651446] Data abort info: [ 2430.651683] ISV = 0, ISS = 0x00000004 [ 2430.652001] CM = 0, WnR = 0 [ 2430.652558] [0069696969696948] address between user and kernel address ranges [ 2430.653265] Internal error: Oops: 96000004 [#1] PREEMPT SMP [ 2430.654512] CPU: 2 PID: 20919 Comm: cat Not tainted 5.15.25-g512f31242bf6 #33 [ 2430.655008] Hardware name: linux,dummy-virt (DT) [ 2430.655517] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 2430.656142] pc : kfree+0x78/0x348 [ 2430.656630] lr : jffs2_free_inode+0x24/0x48 [ 2430.657051] sp : ffff800009eebd10 [ 2430.657355] x29: ffff800009eebd10 x28: 0000000000000001 x27: 0000000000000000 [ 2430.658327] x26: ffff000038f09d80 x25: 0080000000000000 x24: ffff800009d38000 [ 2430.658919] x23: 5a5a5a5a5a5a5a5a x22: ffff000038f09d80 x21: ffff8000084f0d14 [ 2430.659434] x20: ffff0000bf9a6ac0 x19: 0169696969696940 x18: 0000000000000000 [ 2430.659969] x17: ffff8000b6506000 x16: ffff800009eec000 x15: 0000000000004000 [ 2430.660637] x14: 0000000000000000 x13: 00000001000820a1 x12: 00000000000d1b19 [ 2430.661345] x11: 0004000800000000 x10: 0000000000000001 x9 : ffff8000084f0d14 [ 2430.662025] x8 : ffff0000bf9a6b40 x7 : ffff0000bf9a6b48 x6 : 0000000003470302 [ 2430.662695] x5 : ffff00002e41dcc0 x4 : ffff0000bf9aa3b0 x3 : 0000000003470342 [ 2430.663486] x2 : 0000000000000000 x1 : ffff8000084f0d14 x0 : fffffc0000000000 [ 2430.664217] Call trace: [ 2430.664528] kfree+0x78/0x348 [ 2430.664855] jffs2_free_inode+0x24/0x48 [ 2430.665233] i_callback+0x24/0x50 [ 2430.665528] rcu_do_batch+0x1ac/0x448 [ 2430.665892] rcu_core+0x28c/0x3c8 [ 2430.666151] rcu_core_si+0x18/0x28 [ 2430.666473] __do_softirq+0x138/0x3cc [ 2430.666781] irq_exit+0xf0/0x110 [ 2430.667065] handle_domain_irq+0x6c/0x98 [ 2430.667447] gic_handle_irq+0xac/0xe8 [ 2430.667739] call_on_irq_stack+0x28/0x54
The parameter passed to kfree was 5a5a5a5a, which corresponds to the target field of the jffs_inode_info structure. It was found that all variables in the jffs_inode_info structure were 5a5a5a5a, except for the first member sem. It is suspected that these variables are not initialized because they were set to 5a5a5a5a during memory testing, which is meant to detect uninitialized memory.The sem variable is initialized in the function jffs2_i_init_once, while other members are initialized in
the function jffs2_init_inode_info.
The function jffs2_init_inode_info is called after iget_locked, but in the iget_locked function, the destroy_inode process is triggered, which releases the inode and consequently, the target member of the inode is not initialized.In concurrent high pressure scenarios, iget_locked may enter the destroy_inode branch as described in the code.
Since the destroy_inode functionality of jffs2 only releases the target, the fix method is to set target to NULL in jffs2_i_init_once.
--- fs/jffs2/super.c | 1 + 1 file changed, 1 insertion(+)
fs/jffs2/super.c +1 -0
@@ -58,6 +58,7 @@ static void jffs2_i_init_once(void *foo)struct jffs2_inode_info *f = foo;mutex_init (&f->sem); + f->target =NULL ;inode_init_once (&f->vfs_inode); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/197 s390: Mark psw in __load_psw_mask() as __unitialized
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Schnelle <[email protected]>
[ Upstream commit 7278a8fb8d032dfdc03d9b5d17e0bc451cdc1492 ]
Without __unitialized, the following code is generated when INIT_STACK_ALL_ZERO is enabled:
86: d7 0f f0 a0 f0 a0 xc 160(16,%r15), 160(%r15) 8c: e3 40 f0 a0 00 24 stg %r4, 160(%r15) 92: c0 10 00 00 00 08 larl %r1, 0xa2 98: e3 10 f0 a8 00 24 stg %r1, 168(%r15) 9e: b2 b2 f0 a0 lpswe 160(%r15)
The xc is not adding any security because psw is fully initialized with the following instructions. Add __unitialized to the psw definitiation to avoid the superfluous clearing of psw.
--- arch/s390/include/asm/processor.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/include/asm/processor.h +1 -1
@@ -305,8 +305,8 @@ static inline void __load_psw(psw_t psw)*/ static __always_inline void __load_psw_mask(unsigned long mask) { + psw_t psw __uninitialized;unsigned long addr; -psw_t psw; psw.mask = mask;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/197 s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jules Irenge <[email protected]>
[ Upstream commit 22e6824622e8a8889df0f8fc4ed5aea0e702a694 ]
Replace memzero_explicit() and kfree() with kfree_sensitive() to fix warnings reported by Coccinelle:
WARNING opportunity for kfree_sensitive/kvfree_sensitive (line 1506) WARNING opportunity for kfree_sensitive/kvfree_sensitive (line 1643) WARNING opportunity for kfree_sensitive/kvfree_sensitive (line 1770)
--- drivers/s390/crypto/pkey_api.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/s390/crypto/pkey_api.c +3 -6
@@ -1503,8 +1503,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, rc =pkey_keyblob2pkey (kkey, ktp.keylen, ktp.protkey.protkey, &ktp.protkey.len, &ktp.protkey.type);pr_debug ("%s pkey_keyblob2pkey()=%d\n" , __func__, rc); -memzero_explicit (kkey, ktp.keylen); -kfree (kkey); +kfree_sensitive (kkey);if (rc)break ;if (copy_to_user (utp, &ktp,sizeof (ktp)))
@@ -1640,8 +1639,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, &ktp.protkey.type);pr_debug ("%s pkey_keyblob2pkey2()=%d\n" , __func__, rc);kfree (apqns); -memzero_explicit (kkey, ktp.keylen); -kfree (kkey); +kfree_sensitive (kkey);if (rc)break ;if (copy_to_user (utp, &ktp,sizeof (ktp)))
@@ -1767,8 +1765,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, protkey, &protkeylen, &ktp.pkeytype);pr_debug ("%s pkey_keyblob2pkey3()=%d\n" , __func__, rc);kfree (apqns); -memzero_explicit (kkey, ktp.keylen); -kfree (kkey); +kfree_sensitive (kkey);if (rc) {kfree (protkey);break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/197 s390/pkey: Wipe sensitive data on failure
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Holger Dengler <[email protected]>
[ Upstream commit 1d8c270de5eb74245d72325d285894a577a945d9 ]
Wipe sensitive data from stack also if the copy_to_user() fails.
--- drivers/s390/crypto/pkey_api.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/s390/crypto/pkey_api.c +2 -2
@@ -1377,7 +1377,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,if (rc)break ;if (copy_to_user (ucs, &kcs,sizeof (kcs))) -return -EFAULT ; + rc = -EFAULT ;memzero_explicit (&kcs,sizeof (kcs));break ; }
@@ -1412,7 +1412,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,if (rc)break ;if (copy_to_user (ucp, &kcp,sizeof (kcp))) -return -EFAULT ; + rc = -EFAULT ;memzero_explicit (&kcp,sizeof (kcp));break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/197 s390/pkey: Wipe copies of clear-key structures on failure
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Holger Dengler <[email protected]>
[ Upstream commit d65d76a44ffe74c73298ada25b0f578680576073 ]
Wipe all sensitive data from stack for all IOCTLs, which convert a clear-key into a protected- or secure-key.
--- drivers/s390/crypto/pkey_api.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/s390/crypto/pkey_api.c +9 -7
@@ -1374,9 +1374,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, rc =cca_clr2seckey (kcs.cardnr, kcs.domain, kcs.keytype, kcs.clrkey.clrkey, kcs.seckey.seckey);pr_debug ("%s cca_clr2seckey()=%d\n" , __func__, rc); -if (rc) -break ; -if (copy_to_user (ucs, &kcs,sizeof (kcs))) +if (!rc &©_to_user (ucs, &kcs,sizeof (kcs))) rc = -EFAULT ;memzero_explicit (&kcs,sizeof (kcs));break ;
@@ -1409,9 +1407,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, kcp.protkey.protkey, &kcp.protkey.len, &kcp.protkey.type);pr_debug ("%s pkey_clr2protkey()=%d\n" , __func__, rc); -if (rc) -break ; -if (copy_to_user (ucp, &kcp,sizeof (kcp))) +if (!rc &©_to_user (ucp, &kcp,sizeof (kcp))) rc = -EFAULT ;memzero_explicit (&kcp,sizeof (kcp));break ;
@@ -1562,11 +1558,14 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,if (copy_from_user (&kcs, ucs,sizeof (kcs)))return -EFAULT ; apqns =_copy_apqns_from_user (kcs.apqns, kcs.apqn_entries); -if (IS_ERR (apqns)) +if (IS_ERR (apqns)) { +memzero_explicit (&kcs,sizeof (kcs));return PTR_ERR (apqns); + } kkey =kzalloc (klen,GFP_KERNEL );if (!kkey) {kfree (apqns); +memzero_explicit (&kcs,sizeof (kcs));return -ENOMEM ; } rc = pkey_clr2seckey2(apqns, kcs.apqn_entries,
@@ -1576,15 +1575,18 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,kfree (apqns);if (rc) {kfree (kkey); +memzero_explicit (&kcs,sizeof (kcs));break ; }if (kcs.key) {if (kcs.keylen < klen) {kfree (kkey); +memzero_explicit (&kcs,sizeof (kcs));return -EINVAL ; }if (copy_to_user (kcs.key, kkey, klen)) {kfree (kkey); +memzero_explicit (&kcs,sizeof (kcs));return -EFAULT ; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/197 s390/pkey: Wipe copies of protected- and secure-keys
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Holger Dengler <[email protected]>
[ Upstream commit f2ebdadd85af4f4d0cae1e5d009c70eccc78c207 ]
Although the clear-key of neither protected- nor secure-keys is accessible, this key material should only be visible to the calling process. So wipe all copies of protected- or secure-keys from stack, even in case of an error.
--- drivers/s390/crypto/pkey_api.c | 80 ++++++++++++++++------------------ 1 file changed, 37 insertions(+), 43 deletions(-)
drivers/s390/crypto/pkey_api.c +37 -43
@@ -1359,10 +1359,9 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, rc =cca_genseckey (kgs.cardnr, kgs.domain, kgs.keytype, kgs.seckey.seckey);pr_debug ("%s cca_genseckey()=%d\n" , __func__, rc); -if (rc) -break ; -if (copy_to_user (ugs, &kgs,sizeof (kgs))) -return -EFAULT ; +if (!rc &©_to_user (ugs, &kgs,sizeof (kgs))) + rc = -EFAULT ; +memzero_explicit (&kgs,sizeof (kgs));break ; }case PKEY_CLR2SECK : {
@@ -1390,10 +1389,9 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, ksp.seckey.seckey, ksp.protkey.protkey, &ksp.protkey.len, &ksp.protkey.type);pr_debug ("%s cca_sec2protkey()=%d\n" , __func__, rc); -if (rc) -break ; -if (copy_to_user (usp, &ksp,sizeof (ksp))) -return -EFAULT ; +if (!rc &©_to_user (usp, &ksp,sizeof (ksp))) + rc = -EFAULT ; +memzero_explicit (&ksp,sizeof (ksp));break ; }case PKEY_CLR2PROTK : {
@@ -1437,10 +1435,9 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, rc =pkey_skey2pkey (ksp.seckey.seckey, ksp.protkey.protkey, &ksp.protkey.len, &ksp.protkey.type);pr_debug ("%s pkey_skey2pkey()=%d\n" , __func__, rc); -if (rc) -break ; -if (copy_to_user (usp, &ksp,sizeof (ksp))) -return -EFAULT ; +if (!rc &©_to_user (usp, &ksp,sizeof (ksp))) + rc = -EFAULT ; +memzero_explicit (&ksp,sizeof (ksp));break ; }case PKEY_VERIFYKEY : {
@@ -1452,10 +1449,9 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, rc =pkey_verifykey (&kvk.seckey, &kvk.cardnr, &kvk.domain, &kvk.keysize, &kvk.attributes);pr_debug ("%s pkey_verifykey()=%d\n" , __func__, rc); -if (rc) -break ; -if (copy_to_user (uvk, &kvk,sizeof (kvk))) -return -EFAULT ; +if (!rc &©_to_user (uvk, &kvk,sizeof (kvk))) + rc = -EFAULT ; +memzero_explicit (&kvk,sizeof (kvk));break ; }case PKEY_GENPROTK : {
@@ -1468,10 +1464,9 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, rc =pkey_genprotkey (kgp.keytype, kgp.protkey.protkey, &kgp.protkey.len, &kgp.protkey.type);pr_debug ("%s pkey_genprotkey()=%d\n" , __func__, rc); -if (rc) -break ; -if (copy_to_user (ugp, &kgp,sizeof (kgp))) -return -EFAULT ; +if (!rc &©_to_user (ugp, &kgp,sizeof (kgp))) + rc = -EFAULT ; +memzero_explicit (&kgp,sizeof (kgp));break ; }case PKEY_VERIFYPROTK : {
@@ -1483,6 +1478,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, rc =pkey_verifyprotkey (kvp.protkey.protkey, kvp.protkey.len, kvp.protkey.type);pr_debug ("%s pkey_verifyprotkey()=%d\n" , __func__, rc); +memzero_explicit (&kvp,sizeof (kvp));break ; }case PKEY_KBLOB2PROTK : {
@@ -1500,10 +1496,9 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, &ktp.protkey.len, &ktp.protkey.type);pr_debug ("%s pkey_keyblob2pkey()=%d\n" , __func__, rc);kfree_sensitive (kkey); -if (rc) -break ; -if (copy_to_user (utp, &ktp,sizeof (ktp))) -return -EFAULT ; +if (!rc &©_to_user (utp, &ktp,sizeof (ktp))) + rc = -EFAULT ; +memzero_explicit (&ktp,sizeof (ktp));break ; }case PKEY_GENSECK2 : {
@@ -1529,23 +1524,23 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,pr_debug ("%s pkey_genseckey2()=%d\n" , __func__, rc);kfree (apqns);if (rc) { -kfree (kkey); +kfree_sensitive (kkey);break ; }if (kgs.key) {if (kgs.keylen < klen) { -kfree (kkey); +kfree_sensitive (kkey);return -EINVAL ; }if (copy_to_user (kgs.key, kkey, klen)) { -kfree (kkey); +kfree_sensitive (kkey);return -EFAULT ; } } kgs.keylen = klen;if (copy_to_user (ugs, &kgs,sizeof (kgs))) rc = -EFAULT ; -kfree (kkey); +kfree_sensitive (kkey);break ; }case PKEY_CLR2SECK2 : {
@@ -1574,18 +1569,18 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,pr_debug ("%s pkey_clr2seckey2()=%d\n" , __func__, rc);kfree (apqns);if (rc) { -kfree (kkey); +kfree_sensitive (kkey);memzero_explicit (&kcs,sizeof (kcs));break ; }if (kcs.key) {if (kcs.keylen < klen) { -kfree (kkey); +kfree_sensitive (kkey);memzero_explicit (&kcs,sizeof (kcs));return -EINVAL ; }if (copy_to_user (kcs.key, kkey, klen)) { -kfree (kkey); +kfree_sensitive (kkey);memzero_explicit (&kcs,sizeof (kcs));return -EFAULT ; }
@@ -1594,7 +1589,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,if (copy_to_user (ucs, &kcs,sizeof (kcs))) rc = -EFAULT ;memzero_explicit (&kcs,sizeof (kcs)); -kfree (kkey); +kfree_sensitive (kkey);break ; }case PKEY_VERIFYKEY2 : {
@@ -1611,7 +1606,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, &kvk.cardnr, &kvk.domain, &kvk.type, &kvk.size, &kvk.flags);pr_debug ("%s pkey_verifykey2()=%d\n" , __func__, rc); -kfree (kkey); +kfree_sensitive (kkey);if (rc)break ;if (copy_to_user (uvk, &kvk,sizeof (kvk)))
@@ -1642,10 +1637,9 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,pr_debug ("%s pkey_keyblob2pkey2()=%d\n" , __func__, rc);kfree (apqns);kfree_sensitive (kkey); -if (rc) -break ; -if (copy_to_user (utp, &ktp,sizeof (ktp))) -return -EFAULT ; +if (!rc &©_to_user (utp, &ktp,sizeof (ktp))) + rc = -EFAULT ; +memzero_explicit (&ktp,sizeof (ktp));break ; }case PKEY_APQNS4K : {
@@ -1673,7 +1667,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, rc =pkey_apqns4key (kkey, kak.keylen, kak.flags, apqns, &nr_apqns);pr_debug ("%s pkey_apqns4key()=%d\n" , __func__, rc); -kfree (kkey); +kfree_sensitive (kkey);if (rc && rc != -ENOSPC ) {kfree (apqns);break ;
@@ -1759,7 +1753,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, protkey =kmalloc (protkeylen,GFP_KERNEL );if (!protkey) {kfree (apqns); -kfree (kkey); +kfree_sensitive (kkey);return -ENOMEM ; } rc = pkey_keyblob2pkey3(apqns, ktp.apqn_entries,
@@ -1769,20 +1763,20 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,kfree (apqns);kfree_sensitive (kkey);if (rc) { -kfree (protkey); +kfree_sensitive (protkey);break ; }if (ktp.pkey && ktp.pkeylen) {if (protkeylen > ktp.pkeylen) { -kfree (protkey); +kfree_sensitive (protkey);return -EINVAL ; }if (copy_to_user (ktp.pkey, protkey, protkeylen)) { -kfree (protkey); +kfree_sensitive (protkey);return -EFAULT ; } } -kfree (protkey); +kfree_sensitive (protkey); ktp.pkeylen = protkeylen;if (copy_to_user (utp, &ktp,sizeof (ktp)))return -EFAULT ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/197 btrfs: scrub: initialize ret in scrub_simple_mirror() to fix compilation warning
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Yao <[email protected]>
[ Upstream commit b4e585fffc1cf877112ed231a91f089e85688c2a ]
The following error message is displayed:
../fs/btrfs/scrub.c:2152:9: error: ‘ret’ may be used uninitialized in this function [-Werror=maybe-uninitialized]"
Compiler version: gcc version: (Debian 10.2.1-6) 10.2.1 20210110
--- fs/btrfs/scrub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/scrub.c +1 -1
@@ -2100,7 +2100,7 @@ static int scrub_simple_mirror(struct scrub_ctx *sctx,struct btrfs_fs_info *fs_info = sctx->fs_info;const u64 logical_end = logical_start + logical_length;u64 cur_logical = logical_start; -int ret; +int ret =0 ;/* The range must be inside the bg */ ASSERT (logical_start >= bg->start && logical_end <= bg->start + bg->length);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/197 cdrom: rearrange last_media_change check to avoid unintentional overflow
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Stitt <[email protected]>
[ Upstream commit efb905aeb44b0e99c0e6b07865b1885ae0471ebf ]
When running syzkaller with the newly reintroduced signed integer wrap sanitizer we encounter this splat:
[ 366.015950] UBSAN: signed-integer-overflow in ../drivers/cdrom/cdrom.c:2361:33 [ 366.021089] -9223372036854775808 - 346321 cannot be represented in type '__s64' (aka 'long long') [ 366.025894] program syz-executor.4 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 366.027502] CPU: 5 PID: 28472 Comm: syz-executor.7 Not tainted 6.8.0-rc2-00035-gb3ef86b5a957 #1 [ 366.027512] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 366.027518] Call Trace: [ 366.027523] <TASK> [ 366.027533] dump_stack_lvl+0x93/0xd0 [ 366.027899] handle_overflow+0x171/0x1b0 [ 366.038787] ata1.00: invalid multi_count 32 ignored [ 366.043924] cdrom_ioctl+0x2c3f/0x2d10 [ 366.063932] ? __pm_runtime_resume+0xe6/0x130 [ 366.071923] sr_block_ioctl+0x15d/0x1d0 [ 366.074624] ? __pfx_sr_block_ioctl+0x10/0x10 [ 366.077642] blkdev_ioctl+0x419/0x500 [ 366.080231] ? __pfx_blkdev_ioctl+0x10/0x10
...
Historically, the signed integer overflow sanitizer did not work in the kernel due to its interaction with -fwrapv but this has since been changed [1] in the newest version of Clang. It was re-enabled in the kernel with Commit 557f8c582a9ba8ab ("ubsan: Reintroduce signed overflow sanitizer").
Let's rearrange the check to not perform any arithmetic, thus not tripping the sanitizer.
--- drivers/cdrom/cdrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cdrom/cdrom.c +1 -1
@@ -2358,7 +2358,7 @@ static int cdrom_ioctl_timed_media_change(struct cdrom_device_info *cdi,return -EFAULT ; tmp_info.media_flags =0 ; -if (tmp_info.last_media_change - cdi->last_media_change_ms <0 ) +if (cdi->last_media_change_ms > tmp_info.last_media_change) tmp_info.media_flags |=MEDIA_CHANGED_FLAG ; tmp_info.last_media_change = cdi->last_media_change_ms;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/197 tools/power turbostat: Remember global max_die_id
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Len Brown <[email protected]>
[ Upstream commit cda203388687aa075db6f8996c3c4549fa518ea8 ]
This is necessary to gracefully handle sparse die_id's.
no functional change
Stable-dep-of: 3559ea813ad3 ("tools/power turbostat: Avoid possible memory corruption due to sparse topology IDs")
--- tools/power/x86/turbostat/turbostat.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
tools/power/x86/turbostat/turbostat.c +5 -5
@@ -1415,6 +1415,7 @@ struct topo_params {int allowed_cpus;int allowed_cores;int max_cpu_num; +int max_die_id;int max_node_num;int nodes_per_pkg;int cores_per_node;
@@ -6967,7 +6968,6 @@ void topology_probe(bool startup)int i;int max_core_id =0 ;int max_package_id =0 ; -int max_die_id =0 ;int max_siblings =0 ;/* Initialize num_cpus, max_cpu_num */
@@ -7084,8 +7084,8 @@ void topology_probe(bool startup)/* get die information */ cpus[i].die_id =get_die_id (i); -if (cpus[i].die_id > max_die_id) - max_die_id = cpus[i].die_id; +if (cpus[i].die_id > topo.max_die_id) + topo.max_die_id = cpus[i].die_id;/* get numa node information */ cpus[i].physical_node_id =get_physical_node_id (&cpus[i]);
@@ -7111,9 +7111,9 @@ void topology_probe(bool startup)if (!summary_only && topo.cores_per_node >1 )BIC_PRESENT (BIC_Core); - topo.num_die = max_die_id +1 ; + topo.num_die = topo.max_die_id +1 ;if (debug >1 ) -fprintf (outf,"max_die_id %d, sizing for %d die\n" , max_die_id, topo.num_die); +fprintf (outf,"max_die_id %d, sizing for %d die\n" , topo.max_die_id, topo.num_die);if (!summary_only && topo.num_die >1 )BIC_PRESENT (BIC_Die);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/197 tools/power turbostat: Avoid possible memory corruption due to sparse topology IDs
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patryk Wlazlyn <[email protected]>
[ Upstream commit 3559ea813ad3a9627934325c68ad05b18008a077 ]
Save the highest core and package id when parsing topology to allocate enough memory when get_rapl_counters() is called with a core or a package id as a domain.
Note that RAPL domains are per-package on Intel, but per-core on AMD. Thus, the RAPL code effectively runs in different modes on those two product lines.
--- tools/power/x86/turbostat/turbostat.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-)
tools/power/x86/turbostat/turbostat.c +19 -6
@@ -1022,6 +1022,7 @@ struct rapl_counter_info_t {/* struct rapl_counter_info_t for each RAPL domain */ struct rapl_counter_info_t *rapl_counter_info_perdomain; +unsigned int rapl_counter_info_perdomain_size;#define RAPL_COUNTER_FLAG_USE_MSR_SUM (1u << 1)
@@ -1415,6 +1416,8 @@ struct topo_params {int allowed_cpus;int allowed_cores;int max_cpu_num; +int max_core_id; +int max_package_id;int max_die_id;int max_node_num;int nodes_per_pkg;
@@ -3369,15 +3372,18 @@ void write_rapl_counter(struct rapl_counter *rc, struct rapl_counter_info_t *rci rc->scale = rci->scale[idx]; } -int get_rapl_counters (int cpu,int domain,struct core_data *c,struct pkg_data *p) +int get_rapl_counters (int cpu,unsigned int domain,struct core_data *c,struct pkg_data *p) {unsigned long long perf_data[NUM_RAPL_COUNTERS +1 ]; -struct rapl_counter_info_t *rci = &rapl_counter_info_perdomain[domain]; +struct rapl_counter_info_t *rci;if (debug)fprintf (stderr,"%s: cpu%d domain%d\n" , __func__, cpu, domain);assert (rapl_counter_info_perdomain); +assert (domain < rapl_counter_info_perdomain_size); + + rci = &rapl_counter_info_perdomain[domain];/* * If we have any perf counters to read, read them all now, in bulk
@@ -4181,7 +4187,7 @@ void free_fd_rapl_percpu(void)if (!rapl_counter_info_perdomain)return ; -const int num_domains = platform->has_per_core_rapl ? topo.num_cores : topo.num_packages; +const int num_domains = rapl_counter_info_perdomain_size;for (int domain_id =0 ; domain_id < num_domains; ++domain_id) {if (rapl_counter_info_perdomain[domain_id].fd_perf !=-1 )
@@ -4189,6 +4195,8 @@ void free_fd_rapl_percpu(void) }free (rapl_counter_info_perdomain); + rapl_counter_info_perdomain =NULL ; + rapl_counter_info_perdomain_size =0 ; }void free_all_buffers (void )
@@ -6479,17 +6487,18 @@ void linux_perf_init(void)void rapl_perf_init (void ) { -const int num_domains = platform->has_per_core_rapl ? topo.num_cores : topo.num_packages; +const unsigned int num_domains = (platform->has_per_core_rapl ? topo.max_core_id : topo.max_package_id) +1 ;bool *domain_visited =calloc (num_domains,sizeof (bool )); rapl_counter_info_perdomain =calloc (num_domains,sizeof (*rapl_counter_info_perdomain));if (rapl_counter_info_perdomain ==NULL )err (-1 ,"calloc rapl_counter_info_percpu" ); + rapl_counter_info_perdomain_size = num_domains;/* * Initialize rapl_counter_info_percpu */ -for (int domain_id =0 ; domain_id < num_domains; ++domain_id) { +for (unsigned int domain_id =0 ; domain_id < num_domains; ++domain_id) {struct rapl_counter_info_t *rci = &rapl_counter_info_perdomain[domain_id]; rci->fd_perf =-1 ;
@@ -6509,7 +6518,7 @@ void rapl_perf_init(void)bool has_counter =0 ;double scale;enum rapl_unit unit; -int next_domain; +unsigned int next_domain;memset (domain_visited,0 , num_domains *sizeof (*domain_visited));
@@ -6522,6 +6531,8 @@ void rapl_perf_init(void) next_domain = platform->has_per_core_rapl ? cpus[cpu].physical_core_id : cpus[cpu].physical_package_id; +assert (next_domain < num_domains); +if (domain_visited[next_domain])continue ;
@@ -7104,6 +7115,8 @@ void topology_probe(bool startup)if (cpus[i].thread_id ==0 ) topo.num_cores++; } + topo.max_core_id = max_core_id; + topo.max_package_id = max_package_id; topo.cores_per_node = max_core_id +1 ;if (debug >1 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/197 vhost: Use virtqueue mutex for swapping worker
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Christie <[email protected]>
[ Upstream commit 34cf9ba5f00a222dddd9fc71de7c68fdaac7fb97 ]
__vhost_vq_attach_worker uses the vhost_dev mutex to serialize the swapping of a virtqueue's worker. This was done for simplicity because we are already holding that mutex.
In the next patches where the worker can be killed while in use, we need finer grained locking because some drivers will hold the vhost_dev mutex while flushing. However in the SIGKILL handler in the next patches, we will need to be able to swap workers (set current one to NULL), kill queued works and stop new flushes while flushes are in progress.
To prepare us, this has us use the virtqueue mutex for swapping workers instead of the vhost_dev one.
Message-Id: <[email protected]>
Stable-dep-of: db5247d9bf5c ("vhost_task: Handle SIGKILL by flushing work and exiting")
--- drivers/vhost/vhost.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
drivers/vhost/vhost.c +12 -6
@@ -664,16 +664,22 @@ static void __vhost_vq_attach_worker(struct vhost_virtqueue *vq, {struct vhost_worker *old_worker; - old_worker =rcu_dereference_check (vq->worker, -lockdep_is_held (&vq->dev->mutex)); -mutex_lock (&worker->mutex); - worker->attachment_cnt++; -mutex_unlock (&worker->mutex); +mutex_lock (&vq->mutex); + + old_worker =rcu_dereference_check (vq->worker, +lockdep_is_held (&vq->mutex));rcu_assign_pointer (vq->worker, worker); + worker->attachment_cnt++; -if (!old_worker) +if (!old_worker) { +mutex_unlock (&vq->mutex); +mutex_unlock (&worker->mutex);return ; + } +mutex_unlock (&vq->mutex); +mutex_unlock (&worker->mutex); +/* * Take the worker mutex to make sure we see the work queued from * device wide flushes which doesn't use RCU for execution.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/197 vhost: Release worker mutex during flushes
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Christie <[email protected]>
[ Upstream commit ba704ff4e142fd3cfaf3379dd3b3b946754e06e3 ]
In the next patches where the worker can be killed while in use, we need to be able to take the worker mutex and kill queued works for new IO and flushes, and set some new flags to prevent new __vhost_vq_attach_worker calls from swapping in/out killed workers.
If we are holding the worker mutex during a flush and the flush's work is still in the queue, the worker code that will handle the SIGKILL cleanup won't be able to take the mutex and perform it's cleanup. So this patch has us drop the worker mutex while waiting for the flush to complete.
Message-Id: <[email protected]>
Stable-dep-of: db5247d9bf5c ("vhost_task: Handle SIGKILL by flushing work and exiting")
--- drivers/vhost/vhost.c | 44 +++++++++++++++++++++++++++++-------------- 1 file changed, 30 insertions(+), 14 deletions(-)
drivers/vhost/vhost.c +30 -14
@@ -276,21 +276,36 @@ void vhost_vq_flush(struct vhost_virtqueue *vq)EXPORT_SYMBOL_GPL (vhost_vq_flush);/** -* vhost_worker_flush - flush a worker +* __vhost_worker_flush - flush a worker * @worker: worker to flush * -* This does not use RCU to protect the worker, so the device or worker -* mutex must be held. +* The worker's flush_mutex must be held. */ -static void vhost_worker_flush (struct vhost_worker *worker) +static void __vhost_worker_flush (struct vhost_worker *worker) {struct vhost_flush_struct flush; +if (!worker->attachment_cnt) +return ; +init_completion (&flush.wait_event);vhost_work_init (&flush.work, vhost_flush_work);vhost_worker_queue (worker, &flush.work); +/* +* Drop mutex in case our worker is killed and it needs to take the +* mutex to force cleanup. +*/ +mutex_unlock (&worker->mutex);wait_for_completion (&flush.wait_event); +mutex_lock (&worker->mutex); +} + +static void vhost_worker_flush (struct vhost_worker *worker) +{ +mutex_lock (&worker->mutex); +__vhost_worker_flush (worker); +mutex_unlock (&worker->mutex); }void vhost_dev_flush (struct vhost_dev *dev)
@@ -298,15 +313,8 @@ void vhost_dev_flush(struct vhost_dev *dev)struct vhost_worker *worker;unsigned long i; -xa_for_each (&dev->worker_xa, i, worker) { -mutex_lock (&worker->mutex); -if (!worker->attachment_cnt) { -mutex_unlock (&worker->mutex); -continue ; - } +xa_for_each (&dev->worker_xa, i, worker)vhost_worker_flush (worker); -mutex_unlock (&worker->mutex); - } }EXPORT_SYMBOL_GPL (vhost_dev_flush);
@@ -685,7 +693,6 @@ static void __vhost_vq_attach_worker(struct vhost_virtqueue *vq,* device wide flushes which doesn't use RCU for execution. */ mutex_lock (&old_worker->mutex); - old_worker->attachment_cnt--;/* * We don't want to call synchronize_rcu for every vq during setup * because it will slow down VM startup. If we haven't done
@@ -696,6 +703,8 @@ static void __vhost_vq_attach_worker(struct vhost_virtqueue *vq,mutex_lock (&vq->mutex);if (!vhost_vq_get_backend (vq) && !vq->kick) {mutex_unlock (&vq->mutex); + + old_worker->attachment_cnt--;mutex_unlock (&old_worker->mutex);/* * vsock can queue anytime after VHOST_VSOCK_SET_GUEST_CID.
@@ -711,7 +720,8 @@ static void __vhost_vq_attach_worker(struct vhost_virtqueue *vq,/* Make sure new vq queue/flush/poll calls see the new worker */ synchronize_rcu ();/* Make sure whatever was queued gets run */ -vhost_worker_flush (old_worker); +__vhost_worker_flush (old_worker); + old_worker->attachment_cnt--;mutex_unlock (&old_worker->mutex); }
@@ -764,6 +774,12 @@ static int vhost_free_worker(struct vhost_dev *dev,mutex_unlock (&worker->mutex);return -EBUSY ; } +/* +* A flush might have raced and snuck in before attachment_cnt was set +* to zero. Make sure flushes are flushed from the queue before +* freeing. +*/ +__vhost_worker_flush (worker);mutex_unlock (&worker->mutex);vhost_worker_destroy (dev, worker);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/197 vhost_task: Handle SIGKILL by flushing work and exiting
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Christie <[email protected]>
[ Upstream commit db5247d9bf5c6ade9fd70b4e4897441e0269b233 ]
Instead of lingering until the device is closed, this has us handle SIGKILL by:
1. marking the worker as killed so we no longer try to use it with new virtqueues and new flush operations.
2. setting the virtqueue to worker mapping so no new works are queued.
3. running all the exiting works.
Message-Id: <[email protected]>
Message-Id: <[email protected]>
--- drivers/vhost/vhost.c | 54 +++++++++++++++++++++++++++++--- drivers/vhost/vhost.h | 2 ++ include/linux/sched/vhost_task.h | 3 +- kernel/vhost_task.c | 53 ++++++++++++++++++++----------- 4 files changed, 88 insertions(+), 24 deletions(-)
drivers/vhost/vhost.c +50 -4
@@ -285,7 +285,7 @@ static void __vhost_worker_flush(struct vhost_worker *worker) {struct vhost_flush_struct flush; -if (!worker->attachment_cnt) +if (!worker->attachment_cnt || worker->killed)return ;init_completion (&flush.wait_event);
@@ -400,7 +400,7 @@ static void vhost_vq_reset(struct vhost_dev *dev,__vhost_vq_meta_reset (vq); } -static bool vhost_worker (void *data) +static bool vhost_run_work_list (void *data) {struct vhost_worker *worker = data;struct vhost_work *work, *work_next;
@@ -425,6 +425,40 @@ static bool vhost_worker(void *data)return !!node; } +static void vhost_worker_killed (void *data) +{ +struct vhost_worker *worker = data; +struct vhost_dev *dev = worker->dev; +struct vhost_virtqueue *vq; +int i, attach_cnt =0 ; + +mutex_lock (&worker->mutex); + worker->killed = true; + +for (i =0 ; i < dev->nvqs; i++) { + vq = dev->vqs[i]; + +mutex_lock (&vq->mutex); +if (worker == +rcu_dereference_check (vq->worker, +lockdep_is_held (&vq->mutex))) { +rcu_assign_pointer (vq->worker,NULL ); + attach_cnt++; + } +mutex_unlock (&vq->mutex); + } + + worker->attachment_cnt -= attach_cnt; +if (attach_cnt) +synchronize_rcu (); +/* +* Finish vhost_worker_flush calls and any other works that snuck in +* before the synchronize_rcu. +*/ +vhost_run_work_list (worker); +mutex_unlock (&worker->mutex); +} +static void vhost_vq_free_iovecs (struct vhost_virtqueue *vq) {kfree (vq->indirect);
@@ -639,9 +673,11 @@ static struct vhost_worker *vhost_worker_create(struct vhost_dev *dev)if (!worker)return NULL ; + worker->dev = dev;snprintf (name,sizeof (name),"vhost-%d" , current->pid); - vtsk =vhost_task_create (vhost_worker, worker, name); + vtsk =vhost_task_create (vhost_run_work_list, vhost_worker_killed, + worker, name);if (!vtsk) goto free_worker;
@@ -673,6 +709,11 @@ static void __vhost_vq_attach_worker(struct vhost_virtqueue *vq,struct vhost_worker *old_worker;mutex_lock (&worker->mutex); +if (worker->killed) { +mutex_unlock (&worker->mutex); +return ; + } +mutex_lock (&vq->mutex); old_worker = rcu_dereference_check(vq->worker,
@@ -693,6 +734,11 @@ static void __vhost_vq_attach_worker(struct vhost_virtqueue *vq,* device wide flushes which doesn't use RCU for execution. */ mutex_lock (&old_worker->mutex); +if (old_worker->killed) { +mutex_unlock (&old_worker->mutex); +return ; + } +/* * We don't want to call synchronize_rcu for every vq during setup * because it will slow down VM startup. If we haven't done
@@ -770,7 +816,7 @@ static int vhost_free_worker(struct vhost_dev *dev,return -ENODEV ;mutex_lock (&worker->mutex); -if (worker->attachment_cnt) { +if (worker->attachment_cnt || worker->killed) {mutex_unlock (&worker->mutex);return -EBUSY ; }
drivers/vhost/vhost.h +2 -0
@@ -28,12 +28,14 @@ struct vhost_work {struct vhost_worker {struct vhost_task *vtsk; +struct vhost_dev *dev;/* Used to serialize device wide flushing with worker swapping. */ struct mutex mutex;struct llist_head work_list;u64 kcov_handle;u32 id;int attachment_cnt; +bool killed; };/* Poll a file (eventfd or socket) */
include/linux/sched/vhost_task.h +2 -1
@@ -4,7 +4,8 @@struct vhost_task ; -struct vhost_task *vhost_task_create (bool (*fn)(void *),void *arg, +struct vhost_task *vhost_task_create (bool (*fn)(void *), +void (*handle_kill)(void *),void *arg,const char *name);void vhost_task_start (struct vhost_task *vtsk);void vhost_task_stop (struct vhost_task *vtsk);
kernel/vhost_task.c +34 -19
113 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/197 virtio-pci: Check if is_avq is NULL
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zhang <[email protected]>
[ Upstream commit c8fae27d141a32a1624d0d0d5419d94252824498 ]
[bug]
In the virtio_pci_common.c function vp_del_vqs, vp_dev->is_avq is involved to determine whether it is admin virtqueue, but this function vp_dev->is_avq
may be empty. For installations, virtio_pci_legacy does not assign a value to vp_dev->is_avq.
[fix]
Check whether it is vp_dev->is_avq before use.
[test]
Test with virsh Attach device
Before this patch, the following command would crash the guest system
After applying the patch, everything seems to be working fine.
Message-Id: <[email protected]>
--- drivers/virtio/virtio_pci_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/virtio/virtio_pci_common.c +1 -1
@@ -236,7 +236,7 @@ void vp_del_vqs(struct virtio_device *vdev)int i;list_for_each_entry_safe (vq, n, &vdev->vqs, list) { -if (vp_dev->is_avq (vdev, vq->index)) +if (vp_dev->is_avq && vp_dev->is_avq (vdev, vq->index))continue ;if (vp_dev->per_vq_vectors) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/197 mac802154: fix time calculation in ieee802154_configure_durations()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 07aa33988ad92fef79056f5ec30b9a0e4364b616 ]
Since 'symbol_duration' of 'struct wpan_phy' is in nanoseconds but 'lifs_period' and 'sifs_period' are both in microseconds, fix time calculation in 'ieee802154_configure_durations()' and use convenient 'NSEC_PER_USEC' in 'ieee802154_setup_wpan_phy_pib()' as well. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Message-ID: <[email protected]>
--- net/mac802154/main.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
net/mac802154/main.c +8 -6
@@ -161,8 +161,10 @@ void ieee802154_configure_durations(struct wpan_phy *phy, } phy->symbol_duration = duration; - phy->lifs_period = (IEEE802154_LIFS_PERIOD * phy->symbol_duration) /NSEC_PER_SEC ; - phy->sifs_period = (IEEE802154_SIFS_PERIOD * phy->symbol_duration) /NSEC_PER_SEC ; + phy->lifs_period = + (IEEE802154_LIFS_PERIOD * phy->symbol_duration) /NSEC_PER_USEC ; + phy->sifs_period = + (IEEE802154_SIFS_PERIOD * phy->symbol_duration) /NSEC_PER_USEC ; }EXPORT_SYMBOL (ieee802154_configure_durations);
@@ -184,10 +186,10 @@ static void ieee802154_setup_wpan_phy_pib(struct wpan_phy *wpan_phy)* Should be done when all drivers sets this value. */ - wpan_phy->lifs_period = - (IEEE802154_LIFS_PERIOD * wpan_phy->symbol_duration) /1000 ; - wpan_phy->sifs_period = - (IEEE802154_SIFS_PERIOD * wpan_phy->symbol_duration) /1000 ; + wpan_phy->lifs_period = (IEEE802154_LIFS_PERIOD * + wpan_phy->symbol_duration) /NSEC_PER_USEC ; + wpan_phy->sifs_period = (IEEE802154_SIFS_PERIOD * + wpan_phy->symbol_duration) /NSEC_PER_USEC ; }int ieee802154_register_hw (struct ieee802154_hw *hw)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/197 wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit d1cba2ea8121e7fdbe1328cea782876b1dd80993 ]
syzbot is able to trigger softlockups, setting NL80211_ATTR_TXQ_QUANTUM to 2^31.
We had a similar issue in sch_fq, fixed with commit d9e15a273306 ("pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM")
watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [kworker/1:0:24] Modules linked in: irq event stamp: 131135 hardirqs last enabled at (131134): [<ffff80008ae8778c>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:85 [inline] hardirqs last enabled at (131134): [<ffff80008ae8778c>] exit_to_kernel_mode+0xdc/0x10c arch/arm64/kernel/entry-common.c:95 hardirqs last disabled at (131135): [<ffff80008ae85378>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline] hardirqs last disabled at (131135): [<ffff80008ae85378>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551 softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_hh_init net/core/neighbour.c:1538 [inline] softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_resolve_output+0x268/0x658 net/core/neighbour.c:1553 softirqs last disabled at (125896): [<ffff80008904166c>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 CPU: 1 PID: 24 Comm: kworker/1:0 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: mld mld_ifc_work pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __list_del include/linux/list.h:195 [inline] pc : __list_del_entry include/linux/list.h:218 [inline] pc : list_move_tail include/linux/list.h:310 [inline] pc : fq_tin_dequeue include/net/fq_impl.h:112 [inline] pc : ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854 lr : __list_del_entry include/linux/list.h:218 [inline] lr : list_move_tail include/linux/list.h:310 [inline] lr : fq_tin_dequeue include/net/fq_impl.h:112 [inline] lr : ieee80211_tx_dequeue+0x67c/0x3b4c net/mac80211/tx.c:3854
sp : ffff800093d36700
x29: ffff800093d36a60 x28: ffff800093d36960 x27: dfff800000000000
x26: ffff0000d800ad50 x25: ffff0000d800abe0 x24: ffff0000d800abf0
x23: ffff0000e0032468 x22: ffff0000e00324d4 x21: ffff0000d800abf0
x20: ffff0000d800abf8 x19: ffff0000d800abf0 x18: ffff800093d363c0
x17: 000000000000d476 x16: ffff8000805519dc x15: ffff7000127a6cc8
x14: 1ffff000127a6cc8 x13: 0000000000000004 x12: ffffffffffffffff
x11: ffff7000127a6cc8 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffff80009287aa08 x4 : 0000000000000008 x3 : ffff80008034c7fc x2 : ffff0000e0032468 x1 : 00000000da0e46b8 x0 : ffff0000e0032470
Call trace: __list_del include/linux/list.h:195 [inline] __list_del_entry include/linux/list.h:218 [inline] list_move_tail include/linux/list.h:310 [inline] fq_tin_dequeue include/net/fq_impl.h:112 [inline] ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854 wake_tx_push_queue net/mac80211/util.c:294 [inline] ieee80211_handle_wake_tx_queue+0x118/0x274 net/mac80211/util.c:315 drv_wake_tx_queue net/mac80211/driver-ops.h:1350 [inline] schedule_and_wake_txq net/mac80211/driver-ops.h:1357 [inline] ieee80211_queue_skb+0x18e8/0x2244 net/mac80211/tx.c:1664 ieee80211_tx+0x260/0x400 net/mac80211/tx.c:1966 ieee80211_xmit+0x278/0x354 net/mac80211/tx.c:2062 __ieee80211_subif_start_xmit+0xab8/0x122c net/mac80211/tx.c:4338 ieee80211_subif_start_xmit+0xe0/0x438 net/mac80211/tx.c:4532 __netdev_start_xmit include/linux/netdevice.h:4903 [inline] netdev_start_xmit include/linux/netdevice.h:4917 [inline] xmit_one net/core/dev.c:3531 [inline] dev_hard_start_xmit+0x27c/0x938 net/core/dev.c:3547 __dev_queue_xmit+0x1678/0x33fc net/core/dev.c:4341 dev_queue_xmit include/linux/netdevice.h:3091 [inline] neigh_resolve_output+0x558/0x658 net/core/neighbour.c:1563 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x104c/0x1ee8 net/ipv6/ip6_output.c:137 ip6_finish_output+0x428/0x7a0 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x270/0x594 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:450 [inline] NF_HOOK+0x160/0x4f0 include/linux/netfilter.h:314 mld_sendpack+0x7b4/0x10f4 net/ipv6/mcast.c:1818 mld_send_cr net/ipv6/mcast.c:2119 [inline] mld_ifc_work+0x840/0xd0c net/ipv6/mcast.c:2650 process_one_work+0x7b8/0x15d4 kernel/workqueue.c:3267 process_scheduled_works kernel/workqueue.c:3348 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:3429 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
--- net/wireless/nl80211.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/wireless/nl80211.c +5 -1
@@ -468,6 +468,10 @@ static const struct netlink_range_validation nl80211_punct_bitmap_range = { .max = 0xffff, }; +static const struct netlink_range_validation q_range = { + .max =INT_MAX , +}; +static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR ] = { [0 ] = { .strict_start_type =NL80211_ATTR_HE_OBSS_PD }, [NL80211_ATTR_WIPHY ] = { .type =NLA_U32 },
@@ -754,7 +758,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 }, [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 }, - [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 }, + [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range), [NL80211_ATTR_HE_CAPABILITY ] =NLA_POLICY_VALIDATE_FN (NLA_BINARY , validate_he_capa, NL80211_HE_MAX_CAPABILITY_LEN),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/197 net: phy: phy_device: Fix PHY LED blinking code comment
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit d3dcb084c70727be4a2f61bd94796e66147cfa35 ]
Fix copy-paste error in the code comment. The code refers to LED blinking configuration, not brightness configuration. It was likely copied from comment above this one which does refer to brightness configuration.
--- include/linux/phy.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/phy.h +1 -1
@@ -1121,7 +1121,7 @@ struct phy_driver { u8 index, enum led_brightness value);/** -* @led_blink_set: Set a PHY LED brightness. Index indicates +* @led_blink_set: Set a PHY LED blinking. Index indicates * which of the PHYs led should be configured to blink. Delays * are in milliseconds and if both are zero then a sensible * default should be chosen. The call should adjust the
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/197 wifi: mac80211: fix BSS_CHANGED_UNSOL_BCAST_PROBE_RESP
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 816c6bec09ed5b90a58a1e12d5a606c5b6e23f47 ]
Fix the definition of BSS_CHANGED_UNSOL_BCAST_PROBE_RESP so that not all higher bits get set, 1<<31 is a signed variable, so when we do
u64 changed = BSS_CHANGED_UNSOL_BCAST_PROBE_RESP;
we get sign expansion, so the value is 0xffff'ffff'8000'0000 and that's clearly not desired. Use BIT_ULL() to make it unsigned as well as the right type for the change flags.
--- include/net/mac80211.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/mac80211.h +1 -1
@@ -395,7 +395,7 @@ enum ieee80211_bss_change {BSS_CHANGED_HE_OBSS_PD =1 <<28 ,BSS_CHANGED_HE_BSS_COLOR =1 <<29 ,BSS_CHANGED_FILS_DISCOVERY =1 <<30 , -BSS_CHANGED_UNSOL_BCAST_PROBE_RESP =1 <<31 , +BSS_CHANGED_UNSOL_BCAST_PROBE_RESP =BIT_ULL (31 ),BSS_CHANGED_MLD_VALID_LINKS =BIT_ULL (33 ), BSS_CHANGED_MLD_TTLM = BIT_ULL(34),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/197 UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neal Cardwell <[email protected]>
[ Upstream commit a6458ab7fd4f427d4f6f54380453ad255b7fde83 ]
In some production workloads we noticed that connections could sometimes close extremely prematurely with ETIMEDOUT after transmitting only 1 TLP and RTO retransmission (when we would normally expect roughly tcp_retries2 = TCP_RETR2 = 15 RTOs before a connection closes with ETIMEDOUT).
Quoted 1 line
From tracing we determined that these workloads can suffer from a
scenario where in fast recovery, after some retransmits, a DSACK undo can happen at a point where the scoreboard is totally clear (we have retrans_out == sacked_out == lost_out == 0). In such cases, calling tcp_try_keep_open() means that we do not execute any code path that clears tp->retrans_stamp to 0. That means that tp->retrans_stamp can remain erroneously set to the start time of the undone fast recovery, even after the fast recovery is undone. If minutes or hours elapse, and then a TLP/RTO/RTO sequence occurs, then the start_ts value in retransmits_timed_out() (which is from tp->retrans_stamp) will be erroneously ancient (left over from the fast recovery undone via DSACKs). Thus this ancient tp->retrans_stamp value can cause the connection to die very prematurely with ETIMEDOUT via tcp_write_err().
The fix: we change DSACK undo in fast recovery (TCP_CA_Recovery) to call tcp_try_to_open() instead of tcp_try_keep_open(). This ensures that if no retransmits are in flight at the time of DSACK undo in fast recovery then we properly zero retrans_stamp. Note that calling tcp_try_to_open() is more consistent with other loss recovery behavior, since normal fast recovery (CA_Recovery) and RTO recovery (CA_Loss) both normally end when tp->snd_una meets or exceeds tp->high_seq and then in tcp_fastretrans_alert() the "default" switch case executes tcp_try_to_open(). Also note that by inspection this change to call tcp_try_to_open() implies at least one other nice bug fix, where now an ECE-marked DSACK that causes an undo will properly invoke tcp_enter_cwr() rather than ignoring the ECE mark.
--- net/ipv4/tcp_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/tcp_input.c +1 -1
@@ -3074,7 +3074,7 @@ static void tcp_fastretrans_alert(struct sock *sk, const u32 prior_snd_una,return ;if (tcp_try_undo_dsack (sk)) -tcp_try_keep_open (sk); +tcp_try_to_open (sk, flag);tcp_identify_packet_loss (sk, ack_flag);if (icsk->icsk_ca_state != TCP_CA_Recovery) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/197 net/mlx5: E-switch, Create ingress ACL when needed
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mi <[email protected]>
[ Upstream commit b20c2fb45470d0c7a603613c9cfa5d45720e17f2 ]
Currently, ingress acl is used for three features. It is created only when vport metadata match and prio tag are enabled. But active-backup lag mode also uses it. It is independent of vport metadata match and prio tag. And vport metadata match can be disabled using the following devlink command:
# devlink dev param set pci/0000:08:00.0 name esw_port_metadata \ value false cmode runtime
If ingress acl is not created, will hit panic when creating drop rule for active-backup lag mode. If always create it, there will be about 5% performance degradation.
Fix it by creating ingress acl when needed. If esw_port_metadata is true, ingress acl exists, then create drop rule using existing ingress acl. If esw_port_metadata is false, create ingress acl and then create drop rule.
--- .../mellanox/mlx5/core/esw/acl/ingress_ofld.c | 37 +++++++++++++++---- 1 file changed, 29 insertions(+), 8 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_ofld.c +29 -8
@@ -6,6 +6,9 @@#include "helper.h" #include "ofld.h" +static int +acl_ingress_ofld_setup (struct mlx5_eswitch *esw,struct mlx5_vport *vport); +static bool esw_acl_ingress_prio_tag_enabled (struct mlx5_eswitch *esw,const struct mlx5_vport *vport)
@@ -123,18 +126,31 @@ static int esw_acl_ingress_src_port_drop_create(struct mlx5_eswitch *esw, {struct mlx5_flow_act flow_act = {};struct mlx5_flow_handle *flow_rule; +bool created = false;int err =0 ; +if (!vport->ingress.acl) { + err =acl_ingress_ofld_setup (esw, vport); +if (err) +return err; + created = true; + } + flow_act.action =MLX5_FLOW_CONTEXT_ACTION_DROP ; flow_act.fg = vport->ingress.offloads.drop_grp; flow_rule =mlx5_add_flow_rules (vport->ingress.acl,NULL , &flow_act,NULL ,0 );if (IS_ERR (flow_rule)) { err =PTR_ERR (flow_rule); - goto out; + goto err_out; } vport->ingress.offloads.drop_rule = flow_rule; -out: + +return 0 ; +err_out: +/* Only destroy ingress acl created in this function. */ +if (created) +esw_acl_ingress_ofld_cleanup (esw, vport);return err; }
@@ -299,16 +315,12 @@ static void esw_acl_ingress_ofld_groups_destroy(struct mlx5_vport *vport) } } -int esw_acl_ingress_ofld_setup (struct mlx5_eswitch *esw, -struct mlx5_vport *vport) +static int +acl_ingress_ofld_setup (struct mlx5_eswitch *esw,struct mlx5_vport *vport) {int num_ftes =0 ;int err; -if (!mlx5_eswitch_vport_match_metadata_enabled (esw) && - !esw_acl_ingress_prio_tag_enabled (esw, vport)) -return 0 ; -esw_acl_ingress_allow_rule_destroy (vport);if (mlx5_eswitch_vport_match_metadata_enabled (esw))
@@ -347,6 +359,15 @@ int esw_acl_ingress_ofld_setup(struct mlx5_eswitch *esw,return err; } +int esw_acl_ingress_ofld_setup (struct mlx5_eswitch *esw,struct mlx5_vport *vport) +{ +if (!mlx5_eswitch_vport_match_metadata_enabled (esw) && + !esw_acl_ingress_prio_tag_enabled (esw, vport)) +return 0 ; + +return acl_ingress_ofld_setup (esw, vport); +} +void esw_acl_ingress_ofld_cleanup (struct mlx5_eswitch *esw,struct mlx5_vport *vport) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/197 net/mlx5e: Add mqprio_rl cleanup and free in mlx5e_priv_cleanup()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <[email protected]>
[ Upstream commit 1da839eab6dbc26b95bfcd1ed1a4d1aaa5c144a3 ]
In the cited commit, mqprio_rl cleanup and free are mistakenly removed in mlx5e_priv_cleanup(), and it causes the leakage of host memory and firmware SCHEDULING_ELEMENT objects while changing eswitch mode. So, add them back.
--- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +5 -0
@@ -5732,6 +5732,11 @@ void mlx5e_priv_cleanup(struct mlx5e_priv *priv)kfree (priv->htb_qos_sq_stats[i]);kvfree (priv->htb_qos_sq_stats); +if (priv->mqprio_rl) { +mlx5e_mqprio_rl_cleanup (priv->mqprio_rl); +mlx5e_mqprio_rl_free (priv->mqprio_rl); + } +memset (priv,0 ,sizeof (*priv)); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/197 net/mlx5e: Present succeeded IPsec SA bytes and packet
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 2d9dac5559f8cc4318e6b0d3c5b71984f462620b ]
IPsec SA statistics presents successfully decrypted and encrypted packet and bytes, and not total handled by this SA. So update the calculation logic to take into account failures.
--- .../mellanox/mlx5/core/en_accel/ipsec.c | 36 ++++++++++++------- 1 file changed, 23 insertions(+), 13 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +23 -13
@@ -989,6 +989,10 @@ static void mlx5e_xfrm_update_stats(struct xfrm_state *x)struct mlx5e_ipsec_sa_entry *sa_entry =to_ipsec_sa_entry (x);struct mlx5e_ipsec_rule *ipsec_rule = &sa_entry->ipsec_rule;struct net *net =dev_net (x->xso.dev); +u64 trailer_packets =0 , trailer_bytes =0 ; +u64 replay_packets =0 , replay_bytes =0 ; +u64 auth_packets =0 , auth_bytes =0 ; +u64 success_packets, success_bytes;u64 packets, bytes, lastuse; lockdep_assert(lockdep_is_held(&x->lock) ||
@@ -999,26 +1003,32 @@ static void mlx5e_xfrm_update_stats(struct xfrm_state *x)return ;if (sa_entry->attrs.dir ==XFRM_DEV_OFFLOAD_IN ) { -mlx5_fc_query_cached (ipsec_rule->auth.fc, &bytes, &packets, &lastuse); - x->stats.integrity_failed += packets; -XFRM_ADD_STATS (net,LINUX_MIB_XFRMINSTATEPROTOERROR , packets); - -mlx5_fc_query_cached (ipsec_rule->trailer.fc, &bytes, &packets, &lastuse); -XFRM_ADD_STATS (net,LINUX_MIB_XFRMINHDRERROR , packets); +mlx5_fc_query_cached (ipsec_rule->auth.fc, &auth_bytes, + &auth_packets, &lastuse); + x->stats.integrity_failed += auth_packets; +XFRM_ADD_STATS (net,LINUX_MIB_XFRMINSTATEPROTOERROR , auth_packets); + +mlx5_fc_query_cached (ipsec_rule->trailer.fc, &trailer_bytes, + &trailer_packets, &lastuse); +XFRM_ADD_STATS (net,LINUX_MIB_XFRMINHDRERROR , trailer_packets); }if (x->xso.type !=XFRM_DEV_OFFLOAD_PACKET )return ; -mlx5_fc_query_cached (ipsec_rule->fc, &bytes, &packets, &lastuse); - x->curlft.packets += packets; - x->curlft.bytes += bytes; -if (sa_entry->attrs.dir ==XFRM_DEV_OFFLOAD_IN ) { -mlx5_fc_query_cached (ipsec_rule->replay.fc, &bytes, &packets, &lastuse); - x->stats.replay += packets; -XFRM_ADD_STATS (net,LINUX_MIB_XFRMINSTATESEQERROR , packets); +mlx5_fc_query_cached (ipsec_rule->replay.fc, &replay_bytes, + &replay_packets, &lastuse); + x->stats.replay += replay_packets; +XFRM_ADD_STATS (net,LINUX_MIB_XFRMINSTATESEQERROR , replay_packets); } + +mlx5_fc_query_cached (ipsec_rule->fc, &bytes, &packets, &lastuse); + success_packets = packets - auth_packets - trailer_packets - replay_packets; + x->curlft.packets += success_packets; + + success_bytes = bytes - auth_bytes - trailer_bytes - replay_bytes; + x->curlft.bytes += success_bytes; } static int mlx5e_xfrm_validate_policy(struct mlx5_core_dev *mdev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/197 net/mlx5e: Approximate IPsec per-SA payload data bytes count
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit e562f2d46d27576dd4108c1c4a67d501a5936e31 ]
ConnectX devices lack ability to count payload data byte size which is needed for SA to return to libreswan for rekeying.
As a solution let's approximate that by decreasing headers size from total size counted by flow steering. The calculation doesn't take into account any other headers which can be in the packet (e.g. IP extensions).
--- .../ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +13 -1
@@ -994,6 +994,7 @@ static void mlx5e_xfrm_update_stats(struct xfrm_state *x)u64 auth_packets =0 , auth_bytes =0 ;u64 success_packets, success_bytes;u64 packets, bytes, lastuse; +size_t headers; lockdep_assert(lockdep_is_held(&x->lock) || lockdep_is_held(&dev_net(x->xso.real_dev)->xfrm.xfrm_cfg_mutex) ||
@@ -1026,9 +1027,20 @@ static void mlx5e_xfrm_update_stats(struct xfrm_state *x)mlx5_fc_query_cached (ipsec_rule->fc, &bytes, &packets, &lastuse); success_packets = packets - auth_packets - trailer_packets - replay_packets; x->curlft.packets += success_packets; +/* NIC counts all bytes passed through flow steering and doesn't have +* an ability to count payload data size which is needed for SA. +* +* To overcome HW limitestion, let's approximate the payload size +* by removing always available headers. +*/ + headers =sizeof (struct ethhdr ); +if (sa_entry->attrs.family ==AF_INET ) + headers +=sizeof (struct iphdr ); +else + headers +=sizeof (struct ipv6hdr ); success_bytes = bytes - auth_bytes - trailer_bytes - replay_bytes; - x->curlft.bytes += success_bytes; + x->curlft.bytes += success_bytes - headers * success_packets; } static int mlx5e_xfrm_validate_policy(struct mlx5_core_dev *mdev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/197 Bluetooth: hci_event: Fix setting of unicast qos interval
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit ac65ecccae802417ce42e857defacad60e4b8329 ]
qos->ucast interval reffers to the SDU interval, and should not be set to the interval value reported by the LE CIS Established event since the latter reffers to the ISO interval. These two interval are not the same thing:
BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 6, Part G
Isochronous interval:
The time between two consecutive BIS or CIS events (designated ISO_Interval in the Link Layer)
SDU interval:
The nominal time between two consecutive SDUs that are sent or received by the upper layer.
So this instead uses the following formula from the spec to calculate the resulting SDU interface:
BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 6, Part G page 3075:
Transport_Latency_C_To_P = CIG_Sync_Delay + (FT_C_To_P) × ISO_Interval + SDU_Interval_C_To_P Transport_Latency_P_To_C = CIG_Sync_Delay + (FT_P_To_C) × ISO_Interval + SDU_Interval_P_To_C
--- net/bluetooth/hci_event.c | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-)
net/bluetooth/hci_event.c +19 -3
@@ -6661,6 +6661,7 @@ static void hci_le_cis_estabilished_evt(struct hci_dev *hdev, void *data,struct bt_iso_qos *qos;bool pending = false;u16 handle =__le16_to_cpu (ev->handle); +u32 c_sdu_interval, p_sdu_interval;bt_dev_dbg (hdev,"status 0x%2.2x" , ev->status);
@@ -6685,12 +6686,25 @@ static void hci_le_cis_estabilished_evt(struct hci_dev *hdev, void *data, pending =test_and_clear_bit (HCI_CONN_CREATE_CIS , &conn->flags); -/* Convert ISO Interval (1.25 ms slots) to SDU Interval (us) */ - qos->ucast.in.interval =le16_to_cpu (ev->interval) *1250 ; - qos->ucast.out.interval = qos->ucast.in.interval; +/* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 6, Part G +* page 3075: +* Transport_Latency_C_To_P = CIG_Sync_Delay + (FT_C_To_P) × +* ISO_Interval + SDU_Interval_C_To_P +* ... +* SDU_Interval = (CIG_Sync_Delay + (FT) x ISO_Interval) - +* Transport_Latency +*/ + c_sdu_interval = (get_unaligned_le24 (ev->cig_sync_delay) + + (ev->c_ft *le16_to_cpu (ev->interval) *1250 )) - +get_unaligned_le24 (ev->c_latency); + p_sdu_interval = (get_unaligned_le24 (ev->cig_sync_delay) + + (ev->p_ft *le16_to_cpu (ev->interval) *1250 )) - +get_unaligned_le24 (ev->p_latency);switch (conn->role) {case HCI_ROLE_SLAVE : + qos->ucast.in.interval = c_sdu_interval; + qos->ucast.out.interval = p_sdu_interval;/* Convert Transport Latency (us) to Latency (msec) */ qos->ucast.in.latency = DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency),
@@ -6704,6 +6718,8 @@ static void hci_le_cis_estabilished_evt(struct hci_dev *hdev, void *data, qos->ucast.out.phy = ev->p_phy;break ;case HCI_ROLE_MASTER : + qos->ucast.in.interval = p_sdu_interval; + qos->ucast.out.interval = c_sdu_interval;/* Convert Transport Latency (us) to Latency (msec) */ qos->ucast.out.latency = DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/197 Bluetooth: Ignore too large handle values in BIG
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit 015d79c96d62cd8a4a359fcf5be40d58088c936b ]
hci_le_big_sync_established_evt is necessary to filter out cases where the handle value is belonging to ida id range, otherwise ida will be erroneously released in hci_conn_cleanup.
--- net/bluetooth/hci_event.c | 4 ++++ 1 file changed, 4 insertions(+)
net/bluetooth/hci_event.c +4 -0
@@ -6910,6 +6910,10 @@ static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data, bis =hci_conn_hash_lookup_handle (hdev, handle);if (!bis) { +if (handle >HCI_CONN_HANDLE_MAX ) { +bt_dev_dbg (hdev,"ignore too large handle %u" , handle); +continue ; + } bis =hci_conn_add (hdev,ISO_LINK ,BDADDR_ANY ,HCI_ROLE_SLAVE , handle);if (IS_ERR (bis))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/197 Bluetooth: ISO: Check socket flag instead of hcon
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Iulia Tanasescu <[email protected]>
[ Upstream commit 596b6f081336e77764ca35cfeab66d0fcdbe544e ]
This fixes the following Smatch static checker warning:
net/bluetooth/iso.c:1364 iso_sock_recvmsg()
error: we previously assumed 'pi->conn->hcon' could be null (line 1359)
net/bluetooth/iso.c
1347 static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg,
1348 size_t len, int flags)
1349 {
1350 struct sock *sk = sock->sk;
1351 struct iso_pinfo *pi = iso_pi(sk);
1352
1353 BT_DBG("sk %p", sk);
1354
1355 if (test_and_clear_bit(BT_SK_DEFER_SETUP,
&bt_sk(sk)->flags)) {
1356 lock_sock(sk);
1357 switch (sk->sk_state) {
1358 case BT_CONNECT2:
1359 if (pi->conn->hcon &&
^^^^^^^^^^^^^^ If ->hcon is NULL1360 test_bit(HCI_CONN_PA_SYNC,
&pi->conn->hcon->flags)) {1361 iso_conn_big_sync(sk);
1362 sk->sk_state = BT_LISTEN;
1363 } else {
--> 1364 iso_conn_defer_accept(pi->conn->hcon);
^^^^^^^^^^^^^^ then we're toast
1365 sk->sk_state = BT_CONFIG;
1366 } 1367 release_sock(sk); 1368 return 0;
1369 case BT_CONNECTED:
1370 if (test_bit(BT_SK_PA_SYNC,
--- net/bluetooth/iso.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/bluetooth/iso.c +1 -2
@@ -1356,8 +1356,7 @@ static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg,lock_sock (sk);switch (sk->sk_state) {case BT_CONNECT2 : -if (pi->conn->hcon && -test_bit (HCI_CONN_PA_SYNC , &pi->conn->hcon->flags)) { +if (test_bit (BT_SK_PA_SYNC , &pi->flags)) {iso_conn_big_sync (sk); sk->sk_state =BT_LISTEN ; }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/197 bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Skripkin <[email protected]>
[ Upstream commit 1cc18c2ab2e8c54c355ea7c0423a636e415a0c23 ]
Syzbot hit warning in hci_conn_del() caused by freeing handle that was not allocated using ida allocator.
This is caused by handle bigger than HCI_CONN_HANDLE_MAX passed by hci_le_big_sync_established_evt(), which makes code think it's unset connection.
Add same check for handle upper bound as in hci_conn_set_handle() to prevent warning.
--- net/bluetooth/hci_conn.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
net/bluetooth/hci_conn.c +12 -3
@@ -904,8 +904,8 @@ static int hci_conn_hash_alloc_unset(struct hci_dev *hdev) U16_MAX, GFP_ATOMIC); } -struct hci_conn *hci_conn_add (struct hci_dev *hdev,int type,bdaddr_t *dst, -u8 role,u16 handle) +static struct hci_conn *__hci_conn_add (struct hci_dev *hdev,int type,bdaddr_t *dst, +u8 role,u16 handle) {struct hci_conn *conn;
@@ -1046,7 +1046,16 @@ struct hci_conn *hci_conn_add_unset(struct hci_dev *hdev, int type,if (unlikely (handle <0 ))return ERR_PTR (-ECONNREFUSED ); -return hci_conn_add (hdev, type, dst, role, handle); +return __hci_conn_add (hdev, type, dst, role, handle); +} + +struct hci_conn *hci_conn_add (struct hci_dev *hdev,int type,bdaddr_t *dst, +u8 role,u16 handle) +{ +if (handle >HCI_CONN_HANDLE_MAX ) +return ERR_PTR (-EINVAL ); + +return __hci_conn_add (hdev, type, dst, role, handle); }static void hci_conn_cleanup_child (struct hci_conn *conn,u8 reason)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/197 tcp_metrics: validate source addr length
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 66be40e622e177316ae81717aa30057ba9e61dff ]
I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4 is at least 4 bytes long, and the policy doesn't have an entry for this attribute at all (neither does it for IPv6 but v6 is manually validated).
--- net/ipv4/tcp_metrics.c | 1 + 1 file changed, 1 insertion(+)
net/ipv4/tcp_metrics.c +1 -0
@@ -619,6 +619,7 @@ static const struct nla_policy tcp_metrics_nl_policy[TCP_METRICS_ATTR_MAX + 1] = [TCP_METRICS_ATTR_ADDR_IPV4] = { .type = NLA_U32, }, [TCP_METRICS_ATTR_ADDR_IPV6] = { .type = NLA_BINARY, .len = sizeof(struct in6_addr), }, + [TCP_METRICS_ATTR_SADDR_IPV4] = { .type = NLA_U32, },/* Following attributes are not received for GET/DEL, * we keep them for reference */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/197 KVM: s390: fix LPSWEY handling
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Borntraeger <[email protected]>
[ Upstream commit 4c6abb7f7b349f00c0f7ed5045bf67759c012892 ]
in rare cases, e.g. for injecting a machine check we do intercept all load PSW instructions via ICTL_LPSW. With facility 193 a new variant LPSWEY was added. KVM needs to handle that as well.
Message-ID: <[email protected]>
--- arch/s390/include/asm/kvm_host.h | 1 + arch/s390/kvm/kvm-s390.c | 1 + arch/s390/kvm/kvm-s390.h | 15 +++++++++++++++ arch/s390/kvm/priv.c | 32 ++++++++++++++++++++++++++++++++ 4 files changed, 49 insertions(+)
arch/s390/include/asm/kvm_host.h +1 -0
@@ -427,6 +427,7 @@ struct kvm_vcpu_stat {u64 instruction_io_other;u64 instruction_lpsw;u64 instruction_lpswe; +u64 instruction_lpswey;u64 instruction_pfmf;u64 instruction_ptff;u64 instruction_sck;
arch/s390/kvm/kvm-s390.c +1 -0
@@ -132,6 +132,7 @@ const struct _kvm_stats_desc kvm_vcpu_stats_desc[] = {STATS_DESC_COUNTER (VCPU , instruction_io_other),STATS_DESC_COUNTER (VCPU , instruction_lpsw),STATS_DESC_COUNTER (VCPU , instruction_lpswe), +STATS_DESC_COUNTER (VCPU , instruction_lpswey),STATS_DESC_COUNTER (VCPU , instruction_pfmf),STATS_DESC_COUNTER (VCPU , instruction_ptff), STATS_DESC_COUNTER(VCPU, instruction_sck),
arch/s390/kvm/kvm-s390.h +15 -0
@@ -138,6 +138,21 @@ static inline u64 kvm_s390_get_base_disp_s(struct kvm_vcpu *vcpu, u8 *ar)return (base2 ? vcpu->run->s.regs.gprs[base2] :0 ) + disp2; } +static inline u64 kvm_s390_get_base_disp_siy (struct kvm_vcpu *vcpu,u8 *ar) +{ +u32 base1 = vcpu->arch.sie_block->ipb >>28 ; +s64 disp1; + +/* The displacement is a 20bit _SIGNED_ value */ + disp1 =sign_extend64 (((vcpu->arch.sie_block->ipb &0x0fff0000 ) >>16 ) + + ((vcpu->arch.sie_block->ipb &0xff00 ) <<4 ),19 ); + +if (ar) + *ar = base1; + +return (base1 ? vcpu->run->s.regs.gprs[base1] :0 ) + disp1; +} +static inline void kvm_s390_get_base_disp_sse (struct kvm_vcpu *vcpu,u64 *address1,u64 *address2,u8 *ar_b1,u8 *ar_b2)
arch/s390/kvm/priv.c +32 -0
@@ -797,6 +797,36 @@ static int handle_lpswe(struct kvm_vcpu *vcpu)return 0 ; } +static int handle_lpswey (struct kvm_vcpu *vcpu) +{ +psw_t new_psw; +u64 addr; +int rc; +u8 ar; + + vcpu->stat.instruction_lpswey++; + +if (!test_kvm_facility (vcpu->kvm,193 )) +return kvm_s390_inject_program_int (vcpu,PGM_OPERATION ); + +if (vcpu->arch.sie_block->gpsw.mask &PSW_MASK_PSTATE ) +return kvm_s390_inject_program_int (vcpu,PGM_PRIVILEGED_OP ); + + addr =kvm_s390_get_base_disp_siy (vcpu, &ar); +if (addr &7 ) +return kvm_s390_inject_program_int (vcpu,PGM_SPECIFICATION ); + + rc =read_guest (vcpu, addr, ar, &new_psw,sizeof (new_psw)); +if (rc) +return kvm_s390_inject_prog_cond (vcpu, rc); + + vcpu->arch.sie_block->gpsw = new_psw; +if (!is_valid_psw (&vcpu->arch.sie_block->gpsw)) +return kvm_s390_inject_program_int (vcpu,PGM_SPECIFICATION ); + +return 0 ; +} +static int handle_stidp (struct kvm_vcpu *vcpu) {u64 stidp_data = vcpu->kvm->arch.model.cpuid;
@@ -1462,6 +1492,8 @@ int kvm_s390_handle_eb(struct kvm_vcpu *vcpu)case 0x61 :case 0x62 :return handle_ri (vcpu); +case 0x71 : +return handle_lpswey (vcpu);default :return -EOPNOTSUPP ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/197 e1000e: Fix S0ix residency on corporate systems
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dima Ruinskiy <[email protected]>
[ Upstream commit c93a6f62cb1bd097aef2e4588648a420d175eee2 ]
On vPro systems, the configuration of the I219-LM to achieve power gating and S0ix residency is split between the driver and the CSME FW. It was discovered that in some scenarios, where the network cable is connected and then disconnected, S0ix residency is not always reached. This was root-caused to a subset of I219-LM register writes that are not performed by the CSME FW. Therefore, the driver should perform these register writes on corporate setups, regardless of the CSME FW state.
This was discovered on Meteor Lake systems; however it is likely to appear on other platforms as well.
--- drivers/net/ethernet/intel/e1000e/netdev.c | 132 ++++++++++----------- 1 file changed, 66 insertions(+), 66 deletions(-)
drivers/net/ethernet/intel/e1000e/netdev.c +66 -66
@@ -6363,49 +6363,49 @@ static void e1000e_s0ix_entry_flow(struct e1000_adapter *adapter) mac_data |=E1000_EXTCNF_CTRL_GATE_PHY_CFG ;ew32 (EXTCNF_CTRL , mac_data); -/* Enable the Dynamic Power Gating in the MAC */ - mac_data =er32 (FEXTNVM7 ); - mac_data |=BIT (22 ); -ew32 (FEXTNVM7 , mac_data); -/* Disable disconnected cable conditioning for Power Gating */ mac_data =er32 (DPGFR ); mac_data |=BIT (2 );ew32 (DPGFR , mac_data); -/* Don't wake from dynamic Power Gating with clock request */ - mac_data =er32 (FEXTNVM12 ); - mac_data |=BIT (12 ); -ew32 (FEXTNVM12 , mac_data); - -/* Ungate PGCB clock */ - mac_data =er32 (FEXTNVM9 ); - mac_data &= ~BIT (28 ); -ew32 (FEXTNVM9 , mac_data); - -/* Enable K1 off to enable mPHY Power Gating */ - mac_data =er32 (FEXTNVM6 ); - mac_data |=BIT (31 ); -ew32 (FEXTNVM6 , mac_data); - -/* Enable mPHY power gating for any link and speed */ - mac_data =er32 (FEXTNVM8 ); - mac_data |=BIT (9 ); -ew32 (FEXTNVM8 , mac_data); -/* Enable the Dynamic Clock Gating in the DMA and MAC */ mac_data =er32 (CTRL_EXT ); mac_data |=E1000_CTRL_EXT_DMA_DYN_CLK_EN ;ew32 (CTRL_EXT , mac_data); - -/* No MAC DPG gating SLP_S0 in modern standby -* Switch the logic of the lanphypc to use PMC counter -*/ - mac_data =er32 (FEXTNVM5 ); - mac_data |=BIT (7 ); -ew32 (FEXTNVM5 , mac_data); } +/* Enable the Dynamic Power Gating in the MAC */ + mac_data =er32 (FEXTNVM7 ); + mac_data |=BIT (22 ); +ew32 (FEXTNVM7 , mac_data); + +/* Don't wake from dynamic Power Gating with clock request */ + mac_data =er32 (FEXTNVM12 ); + mac_data |=BIT (12 ); +ew32 (FEXTNVM12 , mac_data); + +/* Ungate PGCB clock */ + mac_data =er32 (FEXTNVM9 ); + mac_data &= ~BIT (28 ); +ew32 (FEXTNVM9 , mac_data); + +/* Enable K1 off to enable mPHY Power Gating */ + mac_data =er32 (FEXTNVM6 ); + mac_data |=BIT (31 ); +ew32 (FEXTNVM6 , mac_data); + +/* Enable mPHY power gating for any link and speed */ + mac_data =er32 (FEXTNVM8 ); + mac_data |=BIT (9 ); +ew32 (FEXTNVM8 , mac_data); + +/* No MAC DPG gating SLP_S0 in modern standby +* Switch the logic of the lanphypc to use PMC counter +*/ + mac_data =er32 (FEXTNVM5 ); + mac_data |=BIT (7 ); +ew32 (FEXTNVM5 , mac_data); +/* Disable the time synchronization clock */ mac_data =er32 (FEXTNVM7 ); mac_data |=BIT (31 );
@@ -6498,33 +6498,6 @@ static void e1000e_s0ix_exit_flow(struct e1000_adapter *adapter) }else {/* Request driver unconfigure the device from S0ix */ -/* Disable the Dynamic Power Gating in the MAC */ - mac_data =er32 (FEXTNVM7 ); - mac_data &=0xFFBFFFFF ; -ew32 (FEXTNVM7 , mac_data); - -/* Disable mPHY power gating for any link and speed */ - mac_data =er32 (FEXTNVM8 ); - mac_data &= ~BIT (9 ); -ew32 (FEXTNVM8 , mac_data); - -/* Disable K1 off */ - mac_data =er32 (FEXTNVM6 ); - mac_data &= ~BIT (31 ); -ew32 (FEXTNVM6 , mac_data); - -/* Disable Ungate PGCB clock */ - mac_data =er32 (FEXTNVM9 ); - mac_data |=BIT (28 ); -ew32 (FEXTNVM9 , mac_data); - -/* Cancel not waking from dynamic -* Power Gating with clock request -*/ - mac_data =er32 (FEXTNVM12 ); - mac_data &= ~BIT (12 ); -ew32 (FEXTNVM12 , mac_data); -/* Cancel disable disconnected cable conditioning * for Power Gating */
@@ -6537,13 +6510,6 @@ static void e1000e_s0ix_exit_flow(struct e1000_adapter *adapter) mac_data &=0xFFF7FFFF ;ew32 (CTRL_EXT , mac_data); -/* Revert the lanphypc logic to use the internal Gbe counter -* and not the PMC counter -*/ - mac_data =er32 (FEXTNVM5 ); - mac_data &=0xFFFFFF7F ; -ew32 (FEXTNVM5 , mac_data); -/* Enable the periodic inband message, * Request PCIe clock in K1 page770_17[10:9] =01b */
@@ -6581,6 +6547,40 @@ static void e1000e_s0ix_exit_flow(struct e1000_adapter *adapter) mac_data &= ~BIT (31 ); mac_data |=BIT (0 );ew32 (FEXTNVM7 , mac_data); + +/* Disable the Dynamic Power Gating in the MAC */ + mac_data =er32 (FEXTNVM7 ); + mac_data &=0xFFBFFFFF ; +ew32 (FEXTNVM7 , mac_data); + +/* Disable mPHY power gating for any link and speed */ + mac_data =er32 (FEXTNVM8 ); + mac_data &= ~BIT (9 ); +ew32 (FEXTNVM8 , mac_data); + +/* Disable K1 off */ + mac_data =er32 (FEXTNVM6 ); + mac_data &= ~BIT (31 ); +ew32 (FEXTNVM6 , mac_data); + +/* Disable Ungate PGCB clock */ + mac_data =er32 (FEXTNVM9 ); + mac_data |=BIT (28 ); +ew32 (FEXTNVM9 , mac_data); + +/* Cancel not waking from dynamic +* Power Gating with clock request +*/ + mac_data =er32 (FEXTNVM12 ); + mac_data &= ~BIT (12 ); +ew32 (FEXTNVM12 , mac_data); + +/* Revert the lanphypc logic to use the internal Gbe counter +* and not the PMC counter +*/ + mac_data =er32 (FEXTNVM5 ); + mac_data &=0xFFFFFF7F ; +ew32 (FEXTNVM5 , mac_data); }static int e1000e_pm_freeze (struct device *dev)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/197 gpiolib: of: fix lookup quirk for MIPS Lantiq
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit 3645ffaf2b334abaf5f53e5ca0f47465d91e69d2 ]
As it turns out, there is a large number of out-of-tree DTSes (in OpenWrt project) that used to specify incorrect (active high) polarity for the Lantiq reset GPIO, so to keep compatibility while they are being updated a quirk for force the polarity low is needed. Luckily these old DTSes used nonstandard name for the property ("gpio-reset" vs "reset-gpios") so the quirk will not hurt if there are any new devices that need inverted polarity as they can specify the right polarity in their DTS when using the standard "reset-gpios" property.
Additionally the condition to enable the transition from standard to non-standard reset GPIO property name was inverted and the replacement name for the property was not correct. Fix this as well.
--- drivers/gpio/gpiolib-of.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/gpio/gpiolib-of.c +12 -2
@@ -202,6 +202,16 @@ static void of_gpio_try_fixup_polarity(const struct device_node *np, * helper, and be consistent with what other drivers do. */ { "qi,lb60", "rb-gpios", true }, +#endif +#if IS_ENABLED(CONFIG_PCI_LANTIQ) + /* + * According to the PCI specification, the RST# pin is an + * active-low signal. However, most of the device trees that + * have been widely used for a long time incorrectly describe + * reset GPIO as active-high, and were also using wrong name + * for the property. + */ + { "lantiq,pci-xway", "gpio-reset", false }, #endif }; unsigned int i;
@@ -504,9 +514,9 @@ static struct gpio_desc *of_find_gpio_rename(struct device_node *np, { "reset", "reset-n-io", "marvell,nfc-uart" }, { "reset", "reset-n-io", "mrvl,nfc-uart" }, #endif -#if !IS_ENABLED(CONFIG_PCI_LANTIQ) +#if IS_ENABLED(CONFIG_PCI_LANTIQ) /* MIPS Lantiq PCI */ - { "reset", "gpios-reset", "lantiq,pci-xway" }, + { "reset", "gpio-reset", "lantiq,pci-xway" }, #endif /*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/197 net: allow skb_datagram_iter to be called from any context
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Grimberg <[email protected]>
[ Upstream commit d2d30a376d9cc94c6fb730c58b3e5b7426ecb6de ]
We only use the mapping in a single context, so kmap_local is sufficient and cheaper. Make sure to use skb_frag_foreach_page as skb frags may contain compound pages and we need to map page by page.
--- net/core/datagram.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
net/core/datagram.c +13 -6
@@ -435,15 +435,22 @@ static int __skb_datagram_iter(const struct sk_buff *skb, int offset, end = start +skb_frag_size (frag);if ((copy = end - offset) >0 ) { -struct page *page =skb_frag_page (frag); -u8 *vaddr =kmap (page); +u32 p_off, p_len, copied; +struct page *p; +u8 *vaddr;if (copy > len) copy = len; - n =INDIRECT_CALL_1 (cb, simple_copy_to_iter, - vaddr +skb_frag_off (frag) + offset - start, - copy, data, to); -kunmap (page); + +skb_frag_foreach_page (frag, +skb_frag_off (frag) + offset - start, + copy, p, p_off, p_len, copied) { + vaddr =kmap_local_page (p); + n =INDIRECT_CALL_1 (cb, simple_copy_to_iter, + vaddr + p_off, p_len, data, to); +kunmap_local (vaddr); + } + offset += n;if (n != copy) goto short_copy;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/197 net: txgbe: initialize num_q_vectors for MSI/INTx interrupts
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawen Wu <[email protected]>
[ Upstream commit 7c36711a2cd8059c2d24f5e5c1d76e8ea2d5613c ]
When using MSI/INTx interrupts, wx->num_q_vectors is uninitialized. Thus there will be kernel panic in wx_alloc_q_vectors() to allocate queue vectors.
--- drivers/net/ethernet/wangxun/libwx/wx_lib.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/wangxun/libwx/wx_lib.c +1 -0
@@ -1686,6 +1686,7 @@ static int wx_set_interrupt_capability(struct wx *wx) } pdev->irq =pci_irq_vector (pdev,0 ); + wx->num_q_vectors =1 ;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/197 net: txgbe: remove separate irq request for MSI and INTx
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawen Wu <[email protected]>
[ Upstream commit bd07a98178462e7a02ed2bf7dec90a00944c1da5 ]
When using MSI or INTx interrupts, request_irq() for pdev->irq will conflict with request_threaded_irq() for txgbe->misc.irq, to cause system crash. So remove txgbe_request_irq() for MSI/INTx case, and rename txgbe_request_msix_irqs() since it only request for queue irqs.
Add wx->misc_irq_domain to determine whether the driver creates an IRQ domain and threaded request the IRQs.
--- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 1 + drivers/net/ethernet/wangxun/libwx/wx_lib.c | 5 +- drivers/net/ethernet/wangxun/libwx/wx_type.h | 1 + .../net/ethernet/wangxun/txgbe/txgbe_irq.c | 80 ++----------------- .../net/ethernet/wangxun/txgbe/txgbe_irq.h | 2 +- .../net/ethernet/wangxun/txgbe/txgbe_main.c | 2 +- 6 files changed, 15 insertions(+), 76 deletions(-)
drivers/net/ethernet/wangxun/libwx/wx_hw.c +1 -0
@@ -1959,6 +1959,7 @@ int wx_sw_init(struct wx *wx) }bitmap_zero (wx->state,WX_STATE_NBITS ); + wx->misc_irq_domain = false;return 0 ; }
drivers/net/ethernet/wangxun/libwx/wx_lib.c +3 -2
@@ -1997,7 +1997,8 @@ void wx_free_irq(struct wx *wx)int vector;if (!(pdev->msix_enabled)) { -free_irq (pdev->irq, wx); +if (!wx->misc_irq_domain) +free_irq (pdev->irq, wx);return ; }
@@ -2012,7 +2013,7 @@ void wx_free_irq(struct wx *wx)free_irq (entry->vector, q_vector); } -if (wx->mac.type == wx_mac_em) +if (!wx->misc_irq_domain)free_irq (wx->msix_entry->vector, wx); }EXPORT_SYMBOL (wx_free_irq);
drivers/net/ethernet/wangxun/libwx/wx_type.h +1 -0
@@ -1058,6 +1058,7 @@ struct wx {dma_addr_t isb_dma;u32 *isb_mem;u32 isb_tag[WX_ISB_MAX ]; +bool misc_irq_domain;#define WX_MAX_RETA_ENTRIES 128#define WX_RSS_INDIR_TBL_MAX 64
drivers/net/ethernet/wangxun/txgbe/txgbe_irq.c +8 -72
105 lines not on this page · raw message
drivers/net/ethernet/wangxun/txgbe/txgbe_irq.h +1 -1
@@ -2,6 +2,6 @@/* Copyright (c) 2015 - 2024 Beijing WangXun Technology Co., Ltd. */ void txgbe_irq_enable (struct wx *wx,bool queues); -int txgbe_request_irq (struct wx *wx); +int txgbe_request_queue_irqs (struct wx *wx);void txgbe_free_misc_irq (struct txgbe *txgbe);int txgbe_setup_misc_irq (struct txgbe *txgbe);
drivers/net/ethernet/wangxun/txgbe/txgbe_main.c +1 -1
@@ -294,7 +294,7 @@ static int txgbe_open(struct net_device *netdev)wx_configure (wx); - err =txgbe_request_irq (wx); + err =txgbe_request_queue_irqs (wx);if (err) goto err_free_isb;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/197 net: txgbe: add extra handle for MSI/INTx into thread irq handle
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawen Wu <[email protected]>
[ Upstream commit 1e1fa1723eb3a293d7d0b1c1a9ad8774c1ef0aa0 ]
Rename original txgbe_misc_irq_handle() to txgbe_misc_irq_thread_fn() since it is the handle thread to wake up. And add the primary handler to deal the case of MSI/INTx, because there is a schedule NAPI poll.
--- .../net/ethernet/wangxun/txgbe/txgbe_irq.c | 44 ++++++++++++++++--- 1 file changed, 39 insertions(+), 5 deletions(-)
drivers/net/ethernet/wangxun/txgbe/txgbe_irq.c +39 -5
@@ -111,6 +111,36 @@ static const struct irq_domain_ops txgbe_misc_irq_domain_ops = { };static irqreturn_t txgbe_misc_irq_handle (int irq,void *data) +{ +struct wx_q_vector *q_vector; +struct txgbe *txgbe = data; +struct wx *wx = txgbe->wx; +u32 eicr; + +if (wx->pdev->msix_enabled) +return IRQ_WAKE_THREAD ; + + eicr =wx_misc_isb (wx,WX_ISB_VEC0 ); +if (!eicr) { +/* shared interrupt alert! +* the interrupt that we masked before the ICR read. +*/ +if (netif_running (wx->netdev)) +txgbe_irq_enable (wx, true); +return IRQ_NONE ;/* Not our interrupt */ + } + wx->isb_mem[WX_ISB_VEC0 ] =0 ; +if (!(wx->pdev->msi_enabled)) +wr32 (wx,WX_PX_INTA ,1 ); + +/* would disable interrupts here but it is auto disabled */ + q_vector = wx->q_vector[0 ]; +napi_schedule_irqoff (&q_vector->napi); + +return IRQ_WAKE_THREAD ; +} + +static irqreturn_t txgbe_misc_irq_thread_fn (int irq,void *data) {struct txgbe *txgbe = data;struct wx *wx = txgbe->wx;
@@ -157,6 +187,7 @@ void txgbe_free_misc_irq(struct txgbe *txgbe)int txgbe_setup_misc_irq (struct txgbe *txgbe) { +unsigned long flags =IRQF_ONESHOT ;struct wx *wx = txgbe->wx;int hwirq, err;
@@ -170,14 +201,17 @@ int txgbe_setup_misc_irq(struct txgbe *txgbe)irq_create_mapping (txgbe->misc.domain, hwirq); txgbe->misc.chip = txgbe_irq_chip; -if (wx->pdev->msix_enabled) +if (wx->pdev->msix_enabled) { txgbe->misc.irq = wx->msix_entry->vector; -else + }else { txgbe->misc.irq = wx->pdev->irq; +if (!wx->pdev->msi_enabled) + flags |=IRQF_SHARED ; + } - err =request_threaded_irq (txgbe->misc.irq,NULL , - txgbe_misc_irq_handle, -IRQF_ONESHOT , + err =request_threaded_irq (txgbe->misc.irq, txgbe_misc_irq_handle, + txgbe_misc_irq_thread_fn, + flags, wx->netdev->name, txgbe);if (err) goto del_misc_irq;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/197 net: txgbe: free isb resources at the right time
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawen Wu <[email protected]>
[ Upstream commit 935124dd5883b5de68dc5a94f582480a10643dc9 ]
When using MSI/INTx interrupt, the shared interrupts are still being handled in the device remove routine, before free IRQs. So isb memory is still read after it is freed. Thus move wx_free_isb_resources() from txgbe_close() to txgbe_remove(). And fix the improper isb free action in txgbe_open() error handling path.
--- drivers/net/ethernet/wangxun/libwx/wx_lib.c | 4 +++- drivers/net/ethernet/wangxun/ngbe/ngbe_main.c | 2 ++ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 7 ++++--- 3 files changed, 9 insertions(+), 4 deletions(-)
drivers/net/ethernet/wangxun/libwx/wx_lib.c +3 -1
@@ -2028,6 +2028,9 @@ int wx_setup_isb_resources(struct wx *wx) {struct pci_dev *pdev = wx->pdev; +if (wx->isb_mem) +return 0 ; + wx->isb_mem = dma_alloc_coherent(&pdev->dev, sizeof(u32) * 4, &wx->isb_dma,
@@ -2387,7 +2390,6 @@ static void wx_free_all_tx_resources(struct wx *wx)void wx_free_resources (struct wx *wx) { -wx_free_isb_resources (wx);wx_free_all_rx_resources (wx);wx_free_all_tx_resources (wx); }
drivers/net/ethernet/wangxun/ngbe/ngbe_main.c +2 -0
@@ -387,6 +387,7 @@ static int ngbe_open(struct net_device *netdev) err_free_irq:wx_free_irq (wx); err_free_resources: +wx_free_isb_resources (wx);wx_free_resources (wx);return err; }
@@ -408,6 +409,7 @@ static int ngbe_close(struct net_device *netdev)ngbe_down (wx);wx_free_irq (wx); +wx_free_isb_resources (wx);wx_free_resources (wx);phylink_disconnect_phy (wx->phylink);wx_control_hw (wx, false);
drivers/net/ethernet/wangxun/txgbe/txgbe_main.c +4 -3
@@ -296,7 +296,7 @@ static int txgbe_open(struct net_device *netdev) err =txgbe_request_queue_irqs (wx);if (err) - goto err_free_isb; + goto err_free_resources;/* Notify the stack of the actual queue counts. */ err =netif_set_real_num_tx_queues (netdev, wx->num_tx_queues);
@@ -313,8 +313,8 @@ static int txgbe_open(struct net_device *netdev) err_free_irq:wx_free_irq (wx); -err_free_isb: -wx_free_isb_resources (wx); +err_free_resources: +wx_free_resources (wx); err_reset:txgbe_reset (wx);
@@ -729,6 +729,7 @@ static void txgbe_remove(struct pci_dev *pdev)txgbe_remove_phy (txgbe);txgbe_free_misc_irq (txgbe); +wx_free_isb_resources (wx);pci_release_selected_regions (pdev,pci_select_bars (pdev,IORESOURCE_MEM ));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/197 btrfs: always do the basic checks for btrfs_qgroup_inherit structure
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
[ Upstream commit 724d8042cef84496ddb4492dc120291f997ae26b ]
[BUG]
Syzbot reports the following regression detected by KASAN:
BUG: KASAN: slab-out-of-bounds in btrfs_qgroup_inherit+0x42e/0x2e20 fs/btrfs/qgroup.c:3277 Read of size 8 at addr ffff88814628ca50 by task syz-executor318/5171 CPU: 0 PID: 5171 Comm: syz-executor318 Not tainted 6.10.0-rc2-syzkaller-00010-g2ab795141095 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 btrfs_qgroup_inherit+0x42e/0x2e20 fs/btrfs/qgroup.c:3277 create_pending_snapshot+0x1359/0x29b0 fs/btrfs/transaction.c:1854 create_pending_snapshots+0x195/0x1d0 fs/btrfs/transaction.c:1922 btrfs_commit_transaction+0xf20/0x3740 fs/btrfs/transaction.c:2382 create_snapshot+0x6a1/0x9e0 fs/btrfs/ioctl.c:875 btrfs_mksubvol+0x58f/0x710 fs/btrfs/ioctl.c:1029 btrfs_mksnapshot+0xb5/0xf0 fs/btrfs/ioctl.c:1075 __btrfs_ioctl_snap_create+0x387/0x4b0 fs/btrfs/ioctl.c:1340 btrfs_ioctl_snap_create_v2+0x1f2/0x3a0 fs/btrfs/ioctl.c:1422 btrfs_ioctl+0x99e/0xc60 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fcbf1992509 RSP: 002b:00007fcbf1928218 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fcbf1a1f618 RCX: 00007fcbf1992509 RDX: 0000000020000280 RSI: 0000000050009417 RDI: 0000000000000003 RBP: 00007fcbf1a1f610 R08: 00007ffea1298e97 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcbf19eb660 R13: 00000000200002b8 R14: 00007fcbf19e60c0 R15: 0030656c69662f2e </TASK>
And it also pinned it down to commit b5357cb268c4 ("btrfs: qgroup: do not check qgroup inherit if qgroup is disabled").
[CAUSE]
That offending commit skips the whole qgroup inherit check if qgroup is not enabled.
But that also skips the very basic checks like num_ref_copies/num_excl_copies and the structure size checks.
Meaning if a qgroup enable/disable race is happening at the background, and we pass a btrfs_qgroup_inherit structure when the qgroup is disabled, the check would be completely skipped.
Then at the time of transaction commitment, qgroup is re-enabled and btrfs_qgroup_inherit() is going to use the incorrect structure and causing the above KASAN error.
[FIX]
Make btrfs_qgroup_check_inherit() only skip the source qgroup checks. So that even if invalid btrfs_qgroup_inherit structure is passed in, we can still reject invalid ones no matter if qgroup is enabled or not.
Furthermore we do already have an extra safety inside btrfs_qgroup_inherit(), which would just ignore invalid qgroup sources, so even if we only skip the qgroup source check we're still safe.
--- fs/btrfs/qgroup.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/btrfs/qgroup.c +8 -2
@@ -3065,8 +3065,6 @@ int btrfs_qgroup_check_inherit(struct btrfs_fs_info *fs_info, struct btrfs_qgroup_inherit *inherit, size_t size) { -if (!btrfs_qgroup_enabled (fs_info)) -return 0 ;if (inherit->flags & ~BTRFS_QGROUP_INHERIT_FLAGS_SUPP )return -EOPNOTSUPP ;if (size <sizeof (*inherit) || size >PAGE_SIZE )
@@ -3090,6 +3088,14 @@ int btrfs_qgroup_check_inherit(struct btrfs_fs_info *fs_info,if (size !=struct_size (inherit, qgroups, inherit->num_qgroups))return -EINVAL ; +/* +* Skip the inherit source qgroups check if qgroup is not enabled. +* Qgroup can still be later enabled causing problems, but in that case +* btrfs_qgroup_inherit() would just ignore those invalid ones. +*/ +if (!btrfs_qgroup_enabled (fs_info)) +return 0 ; +/* * Now check all the remaining qgroups, they should all: *
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/197 net: phy: aquantia: add missing include guards
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit 219343755eae6536d1fcb9184e6253ade4906aac ]
The header is missing the include guards so add them.
--- drivers/net/phy/aquantia/aquantia.h | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/phy/aquantia/aquantia.h +5 -0
@@ -6,6 +6,9 @@* Author: Heiner Kallweit <[email protected]> */ +#ifndef AQUANTIA_H +#define AQUANTIA_H +#include <linux/device.h> #include <linux/phy.h>
@@ -120,3 +123,5 @@ static inline int aqr_hwmon_probe(struct phy_device *phydev) { return 0; }#endif int aqr_firmware_load (struct phy_device *phydev); + +#endif /* AQUANTIA_H */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/197 net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <[email protected]>
[ Upstream commit e15a5d821e5192a3769d846079bc9aa380139baf ]
The following is emitted when using idxd (DSA) dmanegine as the data mover for ntb_transport that ntb_netdev uses.
[74412.546922] BUG: using smp_processor_id() in preemptible [00000000] code: irq/52-idxd-por/14526 [74412.556784] caller is netif_rx_internal+0x42/0x130 [74412.562282] CPU: 6 PID: 14526 Comm: irq/52-idxd-por Not tainted 6.9.5 #5 [74412.569870] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.E9I.1752.P05.2402080856 02/08/2024 [74412.581699] Call Trace: [74412.584514] <TASK> [74412.586933] dump_stack_lvl+0x55/0x70 [74412.591129] check_preemption_disabled+0xc8/0xf0 [74412.596374] netif_rx_internal+0x42/0x130 [74412.600957] __netif_rx+0x20/0xd0 [74412.604743] ntb_netdev_rx_handler+0x66/0x150 [ntb_netdev] [74412.610985] ntb_complete_rxc+0xed/0x140 [ntb_transport] [74412.617010] ntb_rx_copy_callback+0x53/0x80 [ntb_transport] [74412.623332] idxd_dma_complete_txd+0xe3/0x160 [idxd] [74412.628963] idxd_wq_thread+0x1a6/0x2b0 [idxd] [74412.634046] irq_thread_fn+0x21/0x60 [74412.638134] ? irq_thread+0xa8/0x290 [74412.642218] irq_thread+0x1a0/0x290 [74412.646212] ? __pfx_irq_thread_fn+0x10/0x10 [74412.651071] ? __pfx_irq_thread_dtor+0x10/0x10 [74412.656117] ? __pfx_irq_thread+0x10/0x10 [74412.660686] kthread+0x100/0x130 [74412.664384] ? __pfx_kthread+0x10/0x10 [74412.668639] ret_from_fork+0x31/0x50 [74412.672716] ? __pfx_kthread+0x10/0x10 [74412.676978] ret_from_fork_asm+0x1a/0x30 [74412.681457] </TASK>
The cause is due to the idxd driver interrupt completion handler uses threaded interrupt and the threaded handler is not hard or soft interrupt context. However __netif_rx() can only be called from interrupt context. Change the call to netif_rx() in order to allow completion via normal context for dmaengine drivers that utilize threaded irq handling.
While the following commit changed from netif_rx() to __netif_rx(), baebdf48c360 ("net: dev: Makes sure netif_rx() can be invoked in any context."), the change should've been a noop instead. However, the code precedes this fix should've been using netif_rx_ni() or netif_rx_any_context().
--- drivers/net/ntb_netdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ntb_netdev.c +1 -1
@@ -119,7 +119,7 @@ static void ntb_netdev_rx_handler(struct ntb_transport_qp *qp, void *qp_data, skb->protocol =eth_type_trans (skb, ndev); skb->ip_summed =CHECKSUM_NONE ; -if (__netif_rx (skb) ==NET_RX_DROP ) { +if (netif_rx (skb) ==NET_RX_DROP ) { ndev->stats.rx_errors++; ndev->stats.rx_dropped++; }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/197 drm/fbdev-generic: Fix framebuffer on big endian devices
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Huth <[email protected]>
[ Upstream commit 740b8dad05bee39e1e3b926f05bb4a8274b8ba49 ]
Starting with kernel 6.7, the framebuffer text console is not working anymore with the virtio-gpu device on s390x hosts. Such big endian fb devices are usinga different pixel ordering than little endian devices, e.g. DRM_FORMAT_BGRX8888 instead of DRM_FORMAT_XRGB8888.
This used to work fine as long as drm_client_buffer_addfb() was still calling drm_mode_addfb() which called drm_driver_legacy_fb_format() internally to get the right format. But drm_client_buffer_addfb() has recently been reworked to call drm_mode_addfb2() instead with the format value that has been passed to it as a parameter (see commit 6ae2ff23aa43 ("drm/client: Convert drm_client_buffer_addfb() to drm_mode_addfb2()").
That format parameter is determined in drm_fbdev_generic_helper_fb_probe() via the drm_mode_legacy_fb_format() function - which only generates formats suitable for little endian devices. So to fix this issue switch to drm_driver_legacy_fb_format() here instead to take the device endianness into consideration.
--- drivers/gpu/drm/drm_fbdev_generic.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/drm_fbdev_generic.c +2 -1
@@ -84,7 +84,8 @@ static int drm_fbdev_generic_helper_fb_probe(struct drm_fb_helper *fb_helper, sizes->surface_width, sizes->surface_height, sizes->surface_bpp); - format =drm_mode_legacy_fb_format (sizes->surface_bpp, sizes->surface_depth); + format =drm_driver_legacy_fb_format (dev, sizes->surface_bpp, + sizes->surface_depth); buffer =drm_client_framebuffer_create (client, sizes->surface_width, sizes->surface_height, format);if (IS_ERR (buffer))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/197 net: stmmac: enable HW-accelerated VLAN stripping for gmac4 only
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Furong Xu <[email protected]>
[ Upstream commit 8eb301bd7b0f45d36e663ecbe59b7c80b9863950 ]
Commit 750011e239a5 ("net: stmmac: Add support for HW-accelerated VLAN stripping") enables MAC level VLAN tag stripping for all MAC cores, but leaves set_hw_vlan_mode() and rx_hw_vlan() un-implemented for both gmac and xgmac.
On gmac and xgmac, ethtool reports rx-vlan-offload is on, both MAC and driver do nothing about VLAN packets actually, although VLAN works well.
Driver level stripping should be used on gmac and xgmac for now.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +4 -3
@@ -7662,9 +7662,10 @@ int stmmac_dvr_probe(struct device *device,#ifdef STMMAC_VLAN_TAG_USED /* Both mac100 and gmac support receive VLAN tag detection */ ndev->features |=NETIF_F_HW_VLAN_CTAG_RX |NETIF_F_HW_VLAN_STAG_RX ; - ndev->hw_features |=NETIF_F_HW_VLAN_CTAG_RX ; - priv->hw->hw_vlan_en = true; - +if (priv->plat->has_gmac4) { + ndev->hw_features |=NETIF_F_HW_VLAN_CTAG_RX ; + priv->hw->hw_vlan_en = true; + }if (priv->dma_cap.vlhash) { ndev->features |=NETIF_F_HW_VLAN_CTAG_FILTER ; ndev->features |=NETIF_F_HW_VLAN_STAG_FILTER ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/197 s390/vfio_ccw: Fix target addresses of TIC CCWs
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Farman <[email protected]>
[ Upstream commit 2ae157ec497d93c639a60e730e21ec9c66fa9a6e ]
The processing of a Transfer-In-Channel (TIC) CCW requires locating the target of the CCW in the channel program, and updating the address to reflect what will actually be sent to hardware.
An error exists where the 64-bit virtual address is truncated to 32-bits (variable "cda") when performing this math. Since s390 addresses of that size are 31-bits, this leaves that additional bit enabled such that the resulting I/O triggers a channel program check. This shows up occasionally when booting a KVM guest from a passthrough DASD device:
..snip...
Interrupt Response Block Data:
: 0x0000000000003990
Function Ctrl : [Start]
Activity Ctrl :
Status Ctrl : [Alert] [Primary] [Secondary] [Status-Pending] Device Status :
Channel Status : [Program-Check]
cpa=: 0x00000000008d0018
prev_ccw=: 0x0000000000000000
this_ccw=: 0x0000000000000000
...snip...
dasd-ipl: Failed to run IPL1 channel program
The channel program address of "0x008d0018" in the IRB doesn't look wrong, but tracing the CCWs shows the offending bit enabled:
ccw=0x0000012e808d0000 cda=00a0b030
ccw=0x0000012e808d0008 cda=00a0b038
ccw=0x0000012e808d0010 cda=808d0008
ccw=0x0000012e808d0018 cda=00a0b040
Fix the calculation of the TIC CCW's data address such that it points to a valid 31-bit address regardless of the input address.
--- drivers/s390/cio/vfio_ccw_cp.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/s390/cio/vfio_ccw_cp.c +5 -4
@@ -490,13 +490,14 @@ static int ccwchain_fetch_tic(struct ccw1 *ccw, struct channel_program *cp) {struct ccwchain *iter; -u32 cda, ccw_head; +u32 offset, ccw_head;list_for_each_entry (iter, &cp->ccwchain_list, next) { ccw_head = iter->ch_iova;if (is_cpa_within_range (ccw->cda, ccw_head, iter->ch_len)) { - cda = (u64 )iter->ch_ccw +dma32_to_u32 (ccw->cda) - ccw_head; - ccw->cda =u32_to_dma32 (cda); +/* Calculate offset of TIC target */ + offset =dma32_to_u32 (ccw->cda) - ccw_head; + ccw->cda =virt_to_dma32 ((void *)iter->ch_ccw + offset);return 0 ; } }
@@ -914,7 +915,7 @@ void cp_update_scsw(struct channel_program *cp, union scsw *scsw)* in the ioctl directly. Path status changes etc. */ list_for_each_entry (chain, &cp->ccwchain_list, next) { - ccw_head = (u32 )(u64 )chain->ch_ccw; + ccw_head =dma32_to_u32 (virt_to_dma32 (chain->ch_ccw));/* * On successful execution, cpa points just beyond the end * of the chain.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/197 gpio: mmio: do not calculate bgpio_bits via "ngpios"
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shiji Yang <[email protected]>
[ Upstream commit f07798d7bb9c46d17d80103fb772fd2c75d47919 ]
bgpio_bits must be aligned with the data bus width. For example, on a 32 bit big endian system and we only have 16 GPIOs. If we only assume bgpio_bits=16 we can never control the GPIO because the base address is the lowest address.
low address high address
-------------------------------------------------
| byte3 | byte2 | byte1 | byte0 |
-------------------------------------------------
| NaN | NaN | gpio8-15 | gpio0-7 |
-------------------------------------------------
--- drivers/gpio/gpio-mmio.c | 2 -- 1 file changed, 2 deletions(-)
drivers/gpio/gpio-mmio.c +0 -2
@@ -619,8 +619,6 @@ int bgpio_init(struct gpio_chip *gc, struct device *dev, ret =gpiochip_get_ngpios (gc, dev);if (ret) gc->ngpio = gc->bgpio_bits; -else - gc->bgpio_bits =roundup_pow_of_two (round_up (gc->ngpio,8 )); ret =bgpio_setup_io (gc, dat, set, clr, flags);if (ret)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/197 wifi: wilc1000: fix ies_len type in connect path
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jozef Hopko <[email protected]>
[ Upstream commit 39ab8fff623053a50951b659e5f6b72343d7d78c ]
Commit 205c50306acf ("wifi: wilc1000: fix RCU usage in connect path") made sure that the IEs data was manipulated under the relevant RCU section. Unfortunately, while doing so, the commit brought a faulty implicit cast from int to u8 on the ies_len variable, making the parsing fail to be performed correctly if the IEs block is larger than 255 bytes. This failure can be observed with Access Points appending a lot of IEs TLVs in their beacon frames (reproduced with a Pixel phone acting as an Access Point, which brough 273 bytes of IE data in my testing environment).
Fix IEs parsing by removing this undesired implicit cast.
--- drivers/net/wireless/microchip/wilc1000/hif.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/microchip/wilc1000/hif.c +2 -1
@@ -382,7 +382,8 @@ wilc_parse_join_bss_param(struct cfg80211_bss *bss,struct ieee80211_p2p_noa_attr noa_attr;const struct cfg80211_bss_ies *ies;struct wilc_join_bss_param *param; -u8 rates_len =0 , ies_len; +u8 rates_len =0 ; +int ies_len;int ret; param =kzalloc (sizeof (*param),GFP_KERNEL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/197 riscv: kexec: Avoid deadlock in kexec crash path
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Song Shuai <[email protected]>
[ Upstream commit c562ba719df570c986caf0941fea2449150bcbc4 ]
If the kexec crash code is called in the interrupt context, the machine_kexec_mask_interrupts() function will trigger a deadlock while trying to acquire the irqdesc spinlock and then deactivate irqchip in irq_set_irqchip_state() function.
Unlike arm64, riscv only requires irq_eoi handler to complete EOI and keeping irq_set_irqchip_state() will only leave this possible deadlock without any use. So we simply remove it.
--- arch/riscv/kernel/machine_kexec.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-)
arch/riscv/kernel/machine_kexec.c +1 -9
@@ -121,20 +121,12 @@ static void machine_kexec_mask_interrupts(void)for_each_irq_desc (i, desc) {struct irq_chip *chip; -int ret; chip =irq_desc_get_chip (desc);if (!chip)continue ; -/* -* First try to remove the active state. If this -* fails, try to EOI the interrupt. -*/ - ret =irq_set_irqchip_state (i,IRQCHIP_STATE_ACTIVE , false); - -if (ret &&irqd_irq_inprogress (&desc->irq_data) && - chip->irq_eoi) +if (chip->irq_eoi &&irqd_irq_inprogress (&desc->irq_data)) chip->irq_eoi (&desc->irq_data);if (chip->irq_mask)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/197 netfilter: nf_tables: unconditionally flush pending work before notifier
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 9f6958ba2e902f9820c594869bd710ba74b7c4c0 ]
syzbot reports:
KASAN: slab-uaf in nft_ctx_update include/net/netfilter/nf_tables.h:1831 KASAN: slab-uaf in nft_commit_release net/netfilter/nf_tables_api.c:9530 KASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597 Read of size 2 at addr ffff88802b0051c4 by task kworker/1:1/45 [..] Workqueue: events nf_tables_trans_destroy_work Call Trace: nft_ctx_update include/net/netfilter/nf_tables.h:1831 [inline] nft_commit_release net/netfilter/nf_tables_api.c:9530 [inline] nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597
Problem is that the notifier does a conditional flush, but its possible that the table-to-be-removed is still referenced by transactions being processed by the worker, so we need to flush unconditionally.
We could make the flush_work depend on whether we found a table to delete in nf-next to avoid the flush for most cases.
AFAICS this problem is only exposed in nf-next, with
commit e169285f8c56 ("netfilter: nf_tables: do not store nft_ctx in transaction objects"), with this commit applied there is an unconditional fetch oftable->family which is whats triggering the above splat.
--- net/netfilter/nf_tables_api.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +1 -2
@@ -11479,8 +11479,7 @@ static int nft_rcv_nl_event(struct notifier_block *this, unsigned long event, gc_seq =nft_gc_seq_begin (nft_net); -if (!list_empty (&nf_tables_destroy_list)) -nf_tables_trans_destroy_flush_work (); +nf_tables_trans_destroy_flush_work (); again:list_for_each_entry (table, &nft_net->tables, list) { if (nft_table_has_owner(table) &&
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/197 net: rswitch: Avoid use-after-free in rswitch_poll()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radu Rendec <[email protected]>
[ Upstream commit 9a0c28efeec6383ef22e97437616b920e7320b67 ]
The use-after-free is actually in rswitch_tx_free(), which is inlined in rswitch_poll(). Since skb and gq->skbs[gq->dirty] are in fact the same pointer, the skb is first freed using dev_kfree_skb_any(), then the value in skb->len is used to update the interface statistics.
Let's move around the instructions to use skb->len before the skb is freed.
This bug is trivial to reproduce using KFENCE. It will trigger a splat every few packets. A simple ARP request or ICMP echo request is enough.
--- drivers/net/ethernet/renesas/rswitch.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/renesas/rswitch.c +2 -2
@@ -871,13 +871,13 @@ static void rswitch_tx_free(struct net_device *ndev)dma_rmb (); skb = gq->skbs[gq->dirty];if (skb) { + rdev->ndev->stats.tx_packets++; + rdev->ndev->stats.tx_bytes += skb->len;dma_unmap_single (ndev->dev.parent, gq->unmap_addrs[gq->dirty], skb->len,DMA_TO_DEVICE );dev_kfree_skb_any (gq->skbs[gq->dirty]); gq->skbs[gq->dirty] =NULL ; - rdev->ndev->stats.tx_packets++; - rdev->ndev->stats.tx_bytes += skb->len; } desc->desc.die_dt =DT_EEMPTY ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/197 bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sam Sun <[email protected]>
[ Upstream commit e271ff53807e8f2c628758290f0e499dbe51cb3d ]
In function bond_option_arp_ip_targets_set(), if newval->string is an empty string, newval->string+1 will point to the byte after the string, causing an out-of-bound read.
BUG: KASAN: slab-out-of-bounds in strlen+0x7d/0xa0 lib/string.c:418 Read of size 1 at addr ffff8881119c4781 by task syz-executor665/8107 CPU: 1 PID: 8107 Comm: syz-executor665 Not tainted 6.7.0-rc7 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0xc1/0x5e0 mm/kasan/report.c:475 kasan_report+0xbe/0xf0 mm/kasan/report.c:588 strlen+0x7d/0xa0 lib/string.c:418 __fortify_strlen include/linux/fortify-string.h:210 [inline] in4_pton+0xa3/0x3f0 net/core/utils.c:130 bond_option_arp_ip_targets_set+0xc2/0x910 drivers/net/bonding/bond_options.c:1201 __bond_opt_set+0x2a4/0x1030 drivers/net/bonding/bond_options.c:767 __bond_opt_set_notify+0x48/0x150 drivers/net/bonding/bond_options.c:792 bond_opt_tryset_rtnl+0xda/0x160 drivers/net/bonding/bond_options.c:817 bonding_sysfs_store_option+0xa1/0x120 drivers/net/bonding/bond_sysfs.c:156 dev_attr_store+0x54/0x80 drivers/base/core.c:2366 sysfs_kf_write+0x114/0x170 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x337/0x500 fs/kernfs/file.c:334 call_write_iter include/linux/fs.h:2020 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x96a/0xd80 fs/read_write.c:584 ksys_write+0x122/0x250 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b ---[ end trace ]---
Fix it by adding a check of string length before using it.
--- drivers/net/bonding/bond_options.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/bonding/bond_options.c +3 -3
@@ -1214,9 +1214,9 @@ static int bond_option_arp_ip_targets_set(struct bonding *bond,__be32 target;if (newval->string) { -if (!in4_pton (newval->string+1 ,-1 , (u8 *)&target,-1 ,NULL )) { -netdev_err (bond->dev,"invalid ARP target %pI4 specified\n" , - &target); +if (strlen (newval->string) <1 || + !in4_pton (newval->string +1 ,-1 , (u8 *)&target,-1 ,NULL )) { +netdev_err (bond->dev,"invalid ARP target specified\n" );return ret; }if (newval->string[0 ] =='+' )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/197 ice: Fix improper extts handling
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Milena Olech <[email protected]>
[ Upstream commit 00d3b4f54582d4e4a02cda5886bb336eeab268cc ]
Extts events are disabled and enabled by the application ts2phc. However, in case where the driver is removed when the application is running, a specific extts event remains enabled and can cause a kernel crash.
As a side effect, when the driver is reloaded and application is started again, remaining extts event for the channel from a previous run will keep firing and the message "extts on unexpected channel" might be printed to the user.
To avoid that, extts events shall be disabled when PTP is released.
--- drivers/net/ethernet/intel/ice/ice_ptp.c | 105 ++++++++++++++++++----- drivers/net/ethernet/intel/ice/ice_ptp.h | 8 ++ 2 files changed, 91 insertions(+), 22 deletions(-)
drivers/net/ethernet/intel/ice/ice_ptp.c +83 -22
@@ -1603,27 +1603,24 @@ void ice_ptp_extts_event(struct ice_pf *pf)/** * ice_ptp_cfg_extts - Configure EXTTS pin and channel * @pf: Board private structure -* @ena: true to enable; false to disable * @chan: GPIO channel (0-3) -* @gpio_pin: GPIO pin -* @extts_flags: request flags from the ptp_extts_request.flags +* @config: desired EXTTS configuration. +* @store: If set to true, the values will be stored +* +* Configure an external timestamp event on the requested channel. */ -static int -ice_ptp_cfg_extts (struct ice_pf *pf,bool ena,unsigned int chan,u32 gpio_pin, -unsigned int extts_flags) +static void ice_ptp_cfg_extts (struct ice_pf *pf,unsigned int chan, +struct ice_extts_channel *config,bool store) {u32 func, aux_reg, gpio_reg, irq_reg;struct ice_hw *hw = &pf->hw;u8 tmr_idx; -if (chan > (unsigned int )pf->ptp.info.n_ext_ts) -return -EINVAL ; - tmr_idx = hw->func_caps.ts_func_info.tmr_index_owned; irq_reg =rd32 (hw,PFINT_OICR_ENA ); -if (ena) { +if (config->ena) {/* Enable the interrupt */ irq_reg |=PFINT_OICR_TSYN_EVNT_M ; aux_reg =GLTSYN_AUX_IN_0_INT_ENA_M ;
@@ -1632,9 +1629,9 @@ ice_ptp_cfg_extts(struct ice_pf *pf, bool ena, unsigned int chan, u32 gpio_pin,#define GLTSYN_AUX_IN_0_EVNTLVL_FALLING_EDGE BIT(1)/* set event level to requested edge */ -if (extts_flags &PTP_FALLING_EDGE ) +if (config->flags &PTP_FALLING_EDGE ) aux_reg |=GLTSYN_AUX_IN_0_EVNTLVL_FALLING_EDGE ; -if (extts_flags &PTP_RISING_EDGE ) +if (config->flags &PTP_RISING_EDGE ) aux_reg |=GLTSYN_AUX_IN_0_EVNTLVL_RISING_EDGE ;/* Write GPIO CTL reg.
@@ -1655,9 +1652,47 @@ ice_ptp_cfg_extts(struct ice_pf *pf, bool ena, unsigned int chan, u32 gpio_pin,wr32 (hw,PFINT_OICR_ENA , irq_reg);wr32 (hw,GLTSYN_AUX_IN (chan, tmr_idx), aux_reg); -wr32 (hw,GLGEN_GPIO_CTL (gpio_pin), gpio_reg); +wr32 (hw,GLGEN_GPIO_CTL (config->gpio_pin), gpio_reg); -return 0 ; +if (store) +memcpy (&pf->ptp.extts_channels[chan], config,sizeof (*config)); +} + +/** +* ice_ptp_disable_all_extts - Disable all EXTTS channels +* @pf: Board private structure +*/ +static void ice_ptp_disable_all_extts (struct ice_pf *pf) +{ +struct ice_extts_channel extts_cfg = {}; +int i; + +for (i =0 ; i < pf->ptp.info.n_ext_ts; i++) { +if (pf->ptp.extts_channels[i].ena) { + extts_cfg.gpio_pin = pf->ptp.extts_channels[i].gpio_pin; + extts_cfg.ena = false; +ice_ptp_cfg_extts (pf, i, &extts_cfg, false); + } + } + +synchronize_irq (pf->oicr_irq.virq); +} + +/** +* ice_ptp_enable_all_extts - Enable all EXTTS channels +* @pf: Board private structure +* +* Called during reset to restore user configuration. +*/ +static void ice_ptp_enable_all_extts (struct ice_pf *pf) +{ +int i; + +for (i =0 ; i < pf->ptp.info.n_ext_ts; i++) { +if (pf->ptp.extts_channels[i].ena) +ice_ptp_cfg_extts (pf, i, &pf->ptp.extts_channels[i], + false); + } }/**
@@ -1814,7 +1849,6 @@ ice_ptp_gpio_enable_e810(struct ptp_clock_info *info, struct ptp_clock_request *rq, int on) {struct ice_pf *pf =ptp_info_to_pf (info); -struct ice_perout_channel clk_cfg = {0 };bool sma_pres = false;unsigned int chan;u32 gpio_pin;
@@ -1825,6 +1859,9 @@ ice_ptp_gpio_enable_e810(struct ptp_clock_info *info,switch (rq->type) {case PTP_CLK_REQ_PEROUT : + { +struct ice_perout_channel clk_cfg = {}; + chan = rq->perout.index;if (sma_pres) {if (chan == ice_pin_desc_e810t[SMA1 ].chan)
@@ -1852,7 +1889,11 @@ ice_ptp_gpio_enable_e810(struct ptp_clock_info *info, err =ice_ptp_cfg_clkout (pf, chan, &clk_cfg, true);break ; + }case PTP_CLK_REQ_EXTTS : + { +struct ice_extts_channel extts_cfg = {}; + chan = rq->extts.index;if (sma_pres) {if (chan < ice_pin_desc_e810t[SMA2 ].chan)
@@ -1868,9 +1909,13 @@ ice_ptp_gpio_enable_e810(struct ptp_clock_info *info, gpio_pin = chan; } - err =ice_ptp_cfg_extts (pf, !!on, chan, gpio_pin, - rq->extts.flags); -break ; + extts_cfg.flags = rq->extts.flags; + extts_cfg.gpio_pin = gpio_pin; + extts_cfg.ena = !!on; + +ice_ptp_cfg_extts (pf, chan, &extts_cfg, true); +return 0 ; + }default :return -EOPNOTSUPP ; }
@@ -1888,21 +1933,31 @@ static int ice_ptp_gpio_enable_e823(struct ptp_clock_info *info, struct ptp_clock_request *rq, int on) {struct ice_pf *pf =ptp_info_to_pf (info); -struct ice_perout_channel clk_cfg = {0 };int err;switch (rq->type) {case PTP_CLK_REQ_PPS : + { +struct ice_perout_channel clk_cfg = {}; + clk_cfg.gpio_pin =PPS_PIN_INDEX ; clk_cfg.period =NSEC_PER_SEC ; clk_cfg.ena = !!on; err =ice_ptp_cfg_clkout (pf,PPS_CLK_GEN_CHAN , &clk_cfg, true);break ; + }case PTP_CLK_REQ_EXTTS : - err =ice_ptp_cfg_extts (pf, !!on, rq->extts.index, -TIME_SYNC_PIN_INDEX , rq->extts.flags); -break ; + { +struct ice_extts_channel extts_cfg = {}; + + extts_cfg.flags = rq->extts.flags; + extts_cfg.gpio_pin =TIME_SYNC_PIN_INDEX ; + extts_cfg.ena = !!on; + +ice_ptp_cfg_extts (pf, rq->extts.index, &extts_cfg, true); +return 0 ; + }default :return -EOPNOTSUPP ; }
@@ -2745,6 +2800,10 @@ static int ice_ptp_rebuild_owner(struct ice_pf *pf)ice_ptp_restart_all_phy (pf); } +/* Re-enable all periodic outputs and external timestamp events */ +ice_ptp_enable_all_clkout (pf); +ice_ptp_enable_all_extts (pf); +return 0 ; }
@@ -3300,6 +3359,8 @@ void ice_ptp_release(struct ice_pf *pf)ice_ptp_release_tx_tracker (pf, &pf->ptp.port.tx); +ice_ptp_disable_all_extts (pf); +kthread_cancel_delayed_work_sync (&pf->ptp.work);ice_ptp_port_phy_stop (&pf->ptp.port);
drivers/net/ethernet/intel/ice/ice_ptp.h +8 -0
@@ -33,6 +33,12 @@ struct ice_perout_channel {u64 start_time; }; +struct ice_extts_channel { +bool ena; +u32 gpio_pin; +u32 flags; +}; +/* The ice hardware captures Tx hardware timestamps in the PHY. The timestamp * is stored in a buffer of registers. Depending on the specific hardware, * this buffer might be shared across multiple PHY ports.
@@ -226,6 +232,7 @@ enum ice_ptp_state {* @ext_ts_irq: the external timestamp IRQ in use * @kworker: kwork thread for handling periodic work * @perout_channels: periodic output data +* @extts_channels: channels for external timestamps * @info: structure defining PTP hardware capabilities * @clock: pointer to registered PTP clock device * @tstamp_config: hardware timestamping configuration
@@ -249,6 +256,7 @@ struct ice_ptp {u8 ext_ts_irq;struct kthread_worker *kworker;struct ice_perout_channel perout_channels[GLTSYN_TGT_H_IDX_MAX ]; +struct ice_extts_channel extts_channels[GLTSYN_TGT_H_IDX_MAX ];struct ptp_clock_info info;struct ptp_clock *clock;struct hwtstamp_config tstamp_config;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/197 ice: Dont process extts if PTP is disabled
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <[email protected]>
[ Upstream commit 996422e3230e41468f652d754fefd1bdbcd4604e ]
The ice_ptp_extts_event() function can race with ice_ptp_release() and result in a NULL pointer dereference which leads to a kernel panic.
Panic occurs because the ice_ptp_extts_event() function calls ptp_clock_event() with a NULL pointer. The ice driver has already released the PTP clock by the time the interrupt for the next external timestamp event occurs.
To fix this, modify the ice_ptp_extts_event() function to check the PTP state and bail early if PTP is not ready.
--- drivers/net/ethernet/intel/ice/ice_ptp.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/intel/ice/ice_ptp.c +4 -0
@@ -1578,6 +1578,10 @@ void ice_ptp_extts_event(struct ice_pf *pf)u8 chan, tmr_idx;u32 hi, lo; +/* Don't process timestamp events if PTP is not ready */ +if (pf->ptp.state !=ICE_PTP_READY ) +return ; + tmr_idx = hw->func_caps.ts_func_info.tmr_index_owned;/* Event time is captured by one of the two matched registers * GLTSYN_EVNT_L: 32 LSB of sampled time event
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/197 ice: Reject pin requests with unsupported flags
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <[email protected]>
[ Upstream commit be2a9d12e6dad894b27361c06ea3752d67a45b49 ]
The driver receives requests for configuring pins via the .enable callback of the PTP clock object. These requests come into the driver with flags which modify the requested behavior from userspace. Current implementation in ice does not reject flags that it doesn't support. This causes the driver to incorrectly apply requests with such flags as PTP_PEROUT_DUTY_CYCLE, or any future flags added by the kernel which it is not yet aware of.
Fix this by properly validating flags in both ice_ptp_cfg_perout and ice_ptp_cfg_extts. Ensure that we check by bit-wise negating supported flags rather than just checking and rejecting known un-supported flags. This is preferable, as it ensures better compatibility with future kernels.
--- drivers/net/ethernet/intel/ice/ice_ptp.c | 38 ++++++++++++++---------- drivers/net/ethernet/intel/ice/ice_ptp.h | 1 + 2 files changed, 23 insertions(+), 16 deletions(-)
drivers/net/ethernet/intel/ice/ice_ptp.c +22 -16
@@ -1612,14 +1612,23 @@ void ice_ptp_extts_event(struct ice_pf *pf)* @store: If set to true, the values will be stored * * Configure an external timestamp event on the requested channel. +* +* Return: 0 on success, -EOPNOTUSPP on unsupported flags */ -static void ice_ptp_cfg_extts (struct ice_pf *pf,unsigned int chan, -struct ice_extts_channel *config,bool store) +static int ice_ptp_cfg_extts (struct ice_pf *pf,unsigned int chan, +struct ice_extts_channel *config,bool store) {u32 func, aux_reg, gpio_reg, irq_reg;struct ice_hw *hw = &pf->hw;u8 tmr_idx; +/* Reject requests with unsupported flags */ +if (config->flags & ~(PTP_ENABLE_FEATURE | +PTP_RISING_EDGE | +PTP_FALLING_EDGE | +PTP_STRICT_FLAGS )) +return -EOPNOTSUPP ; + tmr_idx = hw->func_caps.ts_func_info.tmr_index_owned; irq_reg =rd32 (hw,PFINT_OICR_ENA );
@@ -1660,6 +1669,8 @@ static void ice_ptp_cfg_extts(struct ice_pf *pf, unsigned int chan,if (store)memcpy (&pf->ptp.extts_channels[chan], config,sizeof (*config)); + +return 0 ; }/**
@@ -1717,6 +1728,9 @@ static int ice_ptp_cfg_clkout(struct ice_pf *pf, unsigned int chan,u32 func, val, gpio_pin;u8 tmr_idx; +if (config && config->flags & ~PTP_PEROUT_PHASE ) +return -EOPNOTSUPP ; + tmr_idx = hw->func_caps.ts_func_info.tmr_index_owned;/* 0. Reset mode & out_en in AUX_OUT */
@@ -1856,7 +1870,6 @@ ice_ptp_gpio_enable_e810(struct ptp_clock_info *info,bool sma_pres = false;unsigned int chan;u32 gpio_pin; -int err;if (ice_is_feature_supported (pf,ICE_F_SMA_CTRL )) sma_pres = true;
@@ -1885,14 +1898,14 @@ ice_ptp_gpio_enable_e810(struct ptp_clock_info *info, clk_cfg.gpio_pin = chan; } + clk_cfg.flags = rq->perout.flags; clk_cfg.period = ((rq->perout.period.sec *NSEC_PER_SEC ) + rq->perout.period.nsec); clk_cfg.start_time = ((rq->perout.start.sec *NSEC_PER_SEC ) + rq->perout.start.nsec); clk_cfg.ena = !!on; - err =ice_ptp_cfg_clkout (pf, chan, &clk_cfg, true); -break ; +return ice_ptp_cfg_clkout (pf, chan, &clk_cfg, true); }case PTP_CLK_REQ_EXTTS : {
@@ -1917,14 +1930,11 @@ ice_ptp_gpio_enable_e810(struct ptp_clock_info *info, extts_cfg.gpio_pin = gpio_pin; extts_cfg.ena = !!on; -ice_ptp_cfg_extts (pf, chan, &extts_cfg, true); -return 0 ; +return ice_ptp_cfg_extts (pf, chan, &extts_cfg, true); }default :return -EOPNOTSUPP ; } - -return err; }/**
@@ -1937,19 +1947,18 @@ static int ice_ptp_gpio_enable_e823(struct ptp_clock_info *info, struct ptp_clock_request *rq, int on) {struct ice_pf *pf =ptp_info_to_pf (info); -int err;switch (rq->type) {case PTP_CLK_REQ_PPS : {struct ice_perout_channel clk_cfg = {}; + clk_cfg.flags = rq->perout.flags; clk_cfg.gpio_pin =PPS_PIN_INDEX ; clk_cfg.period =NSEC_PER_SEC ; clk_cfg.ena = !!on; - err =ice_ptp_cfg_clkout (pf,PPS_CLK_GEN_CHAN , &clk_cfg, true); -break ; +return ice_ptp_cfg_clkout (pf,PPS_CLK_GEN_CHAN , &clk_cfg, true); }case PTP_CLK_REQ_EXTTS : {
@@ -1959,14 +1968,11 @@ static int ice_ptp_gpio_enable_e823(struct ptp_clock_info *info, extts_cfg.gpio_pin =TIME_SYNC_PIN_INDEX ; extts_cfg.ena = !!on; -ice_ptp_cfg_extts (pf, rq->extts.index, &extts_cfg, true); -return 0 ; +return ice_ptp_cfg_extts (pf, rq->extts.index, &extts_cfg, true); }default :return -EOPNOTSUPP ; } - -return err; }/**
drivers/net/ethernet/intel/ice/ice_ptp.h +1 -0
@@ -29,6 +29,7 @@ enum ice_ptp_pin_e810t {struct ice_perout_channel {bool ena;u32 gpio_pin; +u32 flags;u64 period;u64 start_time; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/197 ice: use proper macro for testing bit
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Oros <[email protected]>
[ Upstream commit 7829ee78490ddb29993cc7893384a04b8cc7436c ]
Do not use _test_bit() macro for testing bit. The proper macro for this is one without underline.
_test_bit() is what test_bit() was prior to const-optimization. It directly calls arch_test_bit(), i.e. the arch-specific implementation (or the generic one). It's strictly _internal_ and shouldn't be used anywhere outside the actual test_bit() macro.
test_bit() is a wrapper which checks whether the bitmap and the bit number are compile-time constants and if so, it calls the optimized function which evaluates this call to a compile-time constant as well. If either of them is not a compile-time constant, it just calls _test_bit(). test_bit() is the actual function to use anywhere in the kernel.
IOW, calling _test_bit() avoids potential compile-time optimizations.
The sensors is not a compile-time constant, thus most probably there are no object code changes before and after the patch. But anyway, we shouldn't call internal wrappers instead of the actual API.
--- drivers/net/ethernet/intel/ice/ice_hwmon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_hwmon.c +1 -1
@@ -96,7 +96,7 @@ static bool ice_is_internal_reading_supported(struct ice_pf *pf)unsigned long sensors = pf->hw.dev_caps.supported_sensors; -return _test_bit (ICE_SENSOR_SUPPORT_E810_INT_TEMP_BIT , &sensors); +return test_bit (ICE_SENSOR_SUPPORT_E810_INT_TEMP_BIT , &sensors); };void ice_hwmon_init (struct ice_pf *pf)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/197 selftests: fix OOM in msg_zerocopy selftest
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit af2b7e5b741aaae9ffbba2c660def434e07aa241 ]
In selftests/net/msg_zerocopy.c, it has a while loop keeps calling sendmsg on a socket with MSG_ZEROCOPY flag, and it will recv the notifications until the socket is not writable. Typically, it will start the receiving process after around 30+ sendmsgs. However, as the introduction of commit dfa2f0483360 ("tcp: get rid of sysctl_tcp_adv_win_scale"), the sender is always writable and does not get any chance to run recv notifications. The selftest always exits with OUT_OF_MEMORY because the memory used by opt_skb exceeds the net.core.optmem_max. Meanwhile, it could be set to a different value to trigger OOM on older kernels too.
Thus, we introduce "cfg_notification_limit" to force sender to receive notifications after some number of sendmsgs.
--- tools/testing/selftests/net/msg_zerocopy.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
tools/testing/selftests/net/msg_zerocopy.c +11 -1
@@ -85,6 +85,7 @@ static bool cfg_rx;static int cfg_runtime_ms =4200 ;static int cfg_verbose;static int cfg_waittime_ms =500 ; +static int cfg_notification_limit =32 ;static bool cfg_zerocopy;static socklen_t cfg_alen;
@@ -95,6 +96,7 @@ static char payload[IP_MAXPACKET];static long packets, bytes, completions, expected_completions;static int zerocopied =-1 ;static uint32_t next_completion; +static uint32_t sends_since_notify;static unsigned long gettimeofday_ms (void ) {
@@ -208,6 +210,7 @@ static bool do_sendmsg(int fd, struct msghdr *msg, bool do_zerocopy, int domain)error (1 , errno,"send" );if (cfg_verbose && ret != len)fprintf (stderr,"send: ret=%u != %u\n" , ret, len); + sends_since_notify++;if (len) { packets++;
@@ -460,6 +463,7 @@ static bool do_recv_completion(int fd, int domain)static void do_recv_completions (int fd,int domain) {while (do_recv_completion (fd, domain)) {} + sends_since_notify =0 ; }/* Wait for all remaining completions on the errqueue */
@@ -549,6 +553,9 @@ static void do_tx(int domain, int type, int protocol)else do_sendmsg (fd, &msg, cfg_zerocopy, domain); +if (cfg_zerocopy && sends_since_notify >= cfg_notification_limit) +do_recv_completions (fd, domain); +while (!do_poll (fd,POLLOUT )) {if (cfg_zerocopy)do_recv_completions (fd, domain);
@@ -708,7 +715,7 @@ static void parse_opts(int argc, char **argv) cfg_payload_len = max_payload_len; -while ((c =getopt (argc, argv,"46c:C:D:i:mp:rs:S:t:vz" )) !=-1 ) { +while ((c =getopt (argc, argv,"46c:C:D:i:l:mp:rs:S:t:vz" )) !=-1 ) {switch (c) {case '4' :if (cfg_family !=PF_UNSPEC )
@@ -736,6 +743,9 @@ static void parse_opts(int argc, char **argv)if (cfg_ifindex ==0 )error (1 , errno,"invalid iface: %s" , optarg);break ; +case 'l' : + cfg_notification_limit =strtoul (optarg,NULL ,0 ); +break ;case 'm' : cfg_cork_mixed = true;break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/197 selftests: make order checking verbose in msg_zerocopy selftest
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 7d6d8f0c8b700c9493f2839abccb6d29028b4219 ]
We find that when lock debugging is on, notifications may not come in order. Thus, we have order checking outputs managed by cfg_verbose, to avoid too many outputs in this case.
--- tools/testing/selftests/net/msg_zerocopy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/msg_zerocopy.c +1 -1
@@ -438,7 +438,7 @@ static bool do_recv_completion(int fd, int domain)/* Detect notification gaps. These should not happen often, if at all. * Gaps can occur due to drops, reordering and retransmissions. */ -if (lo != next_completion) +if (cfg_verbose && lo != next_completion)fprintf (stderr,"gap: %u..%u does not append to %u\n" , lo, hi, next_completion); next_completion = hi +1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/197 drm/xe/mcr: Avoid clobbering DSS steering
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Roper <[email protected]>
[ Upstream commit 1f006470284598060ca1307355352934400b37ca ]
A couple copy/paste mistakes in the code that selects steering targets for OADDRM and INSTANCE0 unintentionally clobbered the steering target for DSS ranges in some cases.
The OADDRM/INSTANCE0 values were also not assigned as intended, although that mistake wound up being harmless since the desired values for those specific ranges were '0' which the kzalloc of the GT structure should have already taken care of implicitly.
--- drivers/gpu/drm/xe/xe_gt_mcr.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/xe/xe_gt_mcr.c +3 -3
@@ -315,7 +315,7 @@ static void init_steering_oaddrm(struct xe_gt *gt)else gt->steering[OADDRM ].group_target =1 ; - gt->steering[DSS ].instance_target =0 ;/* unused */ + gt->steering[OADDRM ].instance_target =0 ;/* unused */ }static void init_steering_sqidi_psmi (struct xe_gt *gt)
@@ -330,8 +330,8 @@ static void init_steering_sqidi_psmi(struct xe_gt *gt)static void init_steering_inst0 (struct xe_gt *gt) { - gt->steering[DSS ].group_target =0 ;/* unused */ - gt->steering[DSS ].instance_target =0 ;/* unused */ + gt->steering[INSTANCE0 ].group_target =0 ;/* unused */ + gt->steering[INSTANCE0 ].instance_target =0 ;/* unused */ } static const struct {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/197 tcp: Dont flag tcp_sk(sk)->rx_opt.saw_unknown for TCP AO.
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 4b74726c01b7a0b5e1029e1e9247fd81590da726 ]
When we process segments with TCP AO, we don't check it in tcp_parse_options(). Thus, opt_rx->saw_unknown is set to 1, which unconditionally triggers the BPF TCP option parser.
Let's avoid the unnecessary BPF invocation.
--- net/ipv4/tcp_input.c | 7 +++++++ 1 file changed, 7 insertions(+)
net/ipv4/tcp_input.c +7 -0
@@ -4220,6 +4220,13 @@ void tcp_parse_options(const struct net *net,* checked (see tcp_v{4,6}_rcv()). */ break ; +#endif +#ifdef CONFIG_TCP_AO +case TCPOPT_AO : +/* TCP AO has already been checked +* (see tcp_inbound_ao_hash()). +*/ +break ;#endif case TCPOPT_FASTOPEN : tcp_parse_fastopen_option(
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/197 inet_diag: Initialize pad field in struct inet_diag_req_v2
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <[email protected]>
[ Upstream commit 61cf1c739f08190a4cbf047b9fbb192a94d87e3f ]
KMSAN reported uninit-value access in raw_lookup() [1]. Diag for raw sockets uses the pad field in struct inet_diag_req_v2 for the underlying protocol. This field corresponds to the sdiag_raw_protocol field in struct inet_diag_req_raw.
inet_diag_get_exact_compat() converts inet_diag_req to inet_diag_req_v2, but leaves the pad field uninitialized. So the issue occurs when raw_lookup() accesses the sdiag_raw_protocol field.
Fix this by initializing the pad field in inet_diag_get_exact_compat(). Also, do the same fix in inet_diag_dump_compat() to avoid the similar issue in the future.
[1]
BUG: KMSAN: uninit-value in raw_lookup net/ipv4/raw_diag.c:49 [inline] BUG: KMSAN: uninit-value in raw_sock_get+0x657/0x800 net/ipv4/raw_diag.c:71 raw_lookup net/ipv4/raw_diag.c:49 [inline] raw_sock_get+0x657/0x800 net/ipv4/raw_diag.c:71 raw_diag_dump_one+0xa1/0x660 net/ipv4/raw_diag.c:99 inet_diag_cmd_exact+0x7d9/0x980 inet_diag_get_exact_compat net/ipv4/inet_diag.c:1404 [inline] inet_diag_rcv_msg_compat+0x469/0x530 net/ipv4/inet_diag.c:1426 sock_diag_rcv_msg+0x23d/0x740 net/core/sock_diag.c:282 netlink_rcv_skb+0x537/0x670 net/netlink/af_netlink.c:2564 sock_diag_rcv+0x35/0x40 net/core/sock_diag.c:297 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0xe74/0x1240 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x10c6/0x1260 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x332/0x3d0 net/socket.c:745 ____sys_sendmsg+0x7f0/0xb70 net/socket.c:2585 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2639 __sys_sendmsg net/socket.c:2668 [inline] __do_sys_sendmsg net/socket.c:2677 [inline] __se_sys_sendmsg net/socket.c:2675 [inline] __x64_sys_sendmsg+0x27e/0x4a0 net/socket.c:2675 x64_sys_call+0x135e/0x3ce0 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd9/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was stored to memory at:
raw_sock_get+0x650/0x800 net/ipv4/raw_diag.c:71 raw_diag_dump_one+0xa1/0x660 net/ipv4/raw_diag.c:99 inet_diag_cmd_exact+0x7d9/0x980 inet_diag_get_exact_compat net/ipv4/inet_diag.c:1404 [inline] inet_diag_rcv_msg_compat+0x469/0x530 net/ipv4/inet_diag.c:1426 sock_diag_rcv_msg+0x23d/0x740 net/core/sock_diag.c:282 netlink_rcv_skb+0x537/0x670 net/netlink/af_netlink.c:2564 sock_diag_rcv+0x35/0x40 net/core/sock_diag.c:297 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0xe74/0x1240 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x10c6/0x1260 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x332/0x3d0 net/socket.c:745 ____sys_sendmsg+0x7f0/0xb70 net/socket.c:2585 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2639 __sys_sendmsg net/socket.c:2668 [inline] __do_sys_sendmsg net/socket.c:2677 [inline] __se_sys_sendmsg net/socket.c:2675 [inline] __x64_sys_sendmsg+0x27e/0x4a0 net/socket.c:2675 x64_sys_call+0x135e/0x3ce0 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd9/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable req.i created at:
inet_diag_get_exact_compat net/ipv4/inet_diag.c:1396 [inline] inet_diag_rcv_msg_compat+0x2a6/0x530 net/ipv4/inet_diag.c:1426 sock_diag_rcv_msg+0x23d/0x740 net/core/sock_diag.c:282 CPU: 1 PID: 8888 Comm: syz-executor.6 Not tainted 6.10.0-rc4-00217-g35bb670d65fc #32 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014
--- net/ipv4/inet_diag.c | 2 ++ 1 file changed, 2 insertions(+)
net/ipv4/inet_diag.c +2 -0
@@ -1383,6 +1383,7 @@ static int inet_diag_dump_compat(struct sk_buff *skb, req.sdiag_family =AF_UNSPEC ;/* compatibility */ req.sdiag_protocol =inet_diag_type2proto (cb->nlh->nlmsg_type); req.idiag_ext = rc->idiag_ext; + req.pad =0 ; req.idiag_states = rc->idiag_states; req.id = rc->id;
@@ -1398,6 +1399,7 @@ static int inet_diag_get_exact_compat(struct sk_buff *in_skb, req.sdiag_family = rc->idiag_family; req.sdiag_protocol =inet_diag_type2proto (nlh->nlmsg_type); req.idiag_ext = rc->idiag_ext; + req.pad =0 ; req.idiag_states = rc->idiag_states; req.id = rc->id;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/197 mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit 8ce34dccbe8fa7d2ef86f2d8e7db2a9b67cabfc3 ]
In case of invalid INI file mlxsw_linecard_types_init() deallocates memory but doesn't reset pointer to NULL and returns 0. In case of any error occurred after mlxsw_linecard_types_init() call, mlxsw_linecards_init() calls mlxsw_linecard_types_fini() which performs memory deallocation again.
Add pointer reset to NULL.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/ethernet/mellanox/mlxsw/core_linecards.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/mellanox/mlxsw/core_linecards.c +1 -0
@@ -1484,6 +1484,7 @@ static int mlxsw_linecard_types_init(struct mlxsw_core *mlxsw_core,vfree (types_info->data); err_data_alloc:kfree (types_info); + linecards->types_info =NULL ;return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/197 bnxt_en: Fix the resource check condition for RSS contexts
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavan Chebbi <[email protected]>
[ Upstream commit 5d350dc3429b3eb6f2b1b8ccb78ed4ec6c4d4a4f ]
While creating a new RSS context, bnxt_rfs_capable() currently makes a strict check to see if the required VNICs are already available. If the current VNICs are not what is required, either too many or not enough, it will call the firmware to reserve the exact number required.
There is a bug in the firmware when the driver tries to relinquish some reserved VNICs and RSS contexts. It will cause the default VNIC to lose its RSS configuration and cause receive packets to be placed incorrectly.
Workaround this problem by skipping the resource reduction. The driver will not reduce the VNIC and RSS context reservations when a context is deleted. The resources will be available for use when new contexts are created later.
Potentially, this workaround can cause us to run out of VNIC and RSS contexts if there are a lot of VF functions creating and deleting RSS contexts. In the future, we will conditionally disable this workaround when the firmware fix is available.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +5 -1
@@ -12436,7 +12436,11 @@ static bool bnxt_rfs_capable(struct bnxt *bp)if (!BNXT_NEW_RM (bp))return true; -if (hwr.vnic == bp->hw_resc.resv_vnics && +/* Do not reduce VNIC and RSS ctx reservations. There is a FW +* issue that will mess up the default VNIC if we reduce the +* reservations. +*/ +if (hwr.vnic <= bp->hw_resc.resv_vnics && hwr.rss_ctx <= bp->hw_resc.resv_rsscos_ctxs)return true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/197 gpiolib: of: add polarity quirk for TSC2005
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit f8d76c2c313c56d5cb894a243dff4550f048278d ]
DTS for Nokia N900 incorrectly specifies "active high" polarity for the reset line, while the chip documentation actually specifies it as "active low". In the past the driver fudged gpiod API and inverted the logic internally, but it was changed in d0d89493bff8.
--- drivers/gpio/gpiolib-of.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpio/gpiolib-of.c +8 -0
@@ -212,6 +212,14 @@ static void of_gpio_try_fixup_polarity(const struct device_node *np, * for the property. */ { "lantiq,pci-xway", "gpio-reset", false }, +#endif +#if IS_ENABLED(CONFIG_TOUCHSCREEN_TSC2005) + /* + * DTS for Nokia N900 incorrectly specified "active high" + * polarity for the reset line, while the chip actually + * treats it as "active low". + */ + { "ti,tsc2005", "reset-gpios", false }, #endif }; unsigned int i;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/197 platform/x86: toshiba_acpi: Fix quickstart quirk handling
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
commit e527a6127223b644e0a27b44f4b16e16eb6c7f0a upstream.
The global hci_hotkey_quickstart quirk flag is tested in toshiba_acpi_enable_hotkeys() before the quirk flag is properly initialized based on SMBIOS data. This causes the quirk to be applied to all models, some of which behave erratically as a result.
Fix this by initializing the global quirk flags during module initialization before registering the ACPI driver. This also allows us to mark toshiba_dmi_quirks[] as __initconst.
--- drivers/platform/x86/toshiba_acpi.c | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-)
drivers/platform/x86/toshiba_acpi.c +18 -13
@@ -3276,7 +3276,7 @@ static const char *find_hci_method(acpi_*/ #define QUIRK_HCI_HOTKEY_QUICKSTART BIT(1) -static const struct dmi_system_id toshiba_dmi_quirks[] = { +static const struct dmi_system_id toshiba_dmi_quirks[]__initconst = { {/* Toshiba Portégé R700 */ /* https://bugzilla.kernel.org/show_bug.cgi?id=21012 */
@@ -3311,8 +3311,6 @@ static int toshiba_acpi_add(struct acpi_struct toshiba_acpi_dev *dev;const char *hci_method;u32 dummy; -const struct dmi_system_id *dmi_id; -long quirks =0 ;int ret =0 ;if (toshiba_acpi)
@@ -3465,16 +3463,6 @@ iio_error: }#endif - dmi_id =dmi_first_match (toshiba_dmi_quirks); -if (dmi_id) - quirks = (long )dmi_id->driver_data; - -if (turn_on_panel_on_resume ==-1 ) - turn_on_panel_on_resume = !!(quirks &QUIRK_TURN_ON_PANEL_ON_RESUME ); - -if (hci_hotkey_quickstart ==-1 ) - hci_hotkey_quickstart = !!(quirks &QUIRK_HCI_HOTKEY_QUICKSTART ); -toshiba_wwan_available (dev);if (dev->wwan_supported)toshiba_acpi_setup_wwan_rfkill (dev);
@@ -3624,10 +3612,27 @@ static struct acpi_driver toshiba_acpi_d .drv.pm = &toshiba_acpi_pm, }; +static void __init toshiba_dmi_init (void ) +{ +const struct dmi_system_id *dmi_id; +long quirks =0 ; + + dmi_id =dmi_first_match (toshiba_dmi_quirks); +if (dmi_id) + quirks = (long )dmi_id->driver_data; + +if (turn_on_panel_on_resume ==-1 ) + turn_on_panel_on_resume = !!(quirks &QUIRK_TURN_ON_PANEL_ON_RESUME ); + +if (hci_hotkey_quickstart ==-1 ) + hci_hotkey_quickstart = !!(quirks &QUIRK_HCI_HOTKEY_QUICKSTART ); +} +static int __init toshiba_acpi_init (void ) {int ret; +toshiba_dmi_init (); toshiba_proc_dir =proc_mkdir (PROC_TOSHIBA , acpi_root_dir);if (!toshiba_proc_dir) {pr_err ("Unable to create proc dir " PROC_TOSHIBA "\n" );
Greg Kroah-Hartman
maintainerPATCH 132/197 Revert "igc: fix a log entry using uninitialized netdev"
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sasha Neftin <[email protected]>
commit 8eef5c3cea65f248c99cd9dcb3f84c6509b78162 upstream.
This reverts commit 86167183a17e03ec77198897975e9fdfbd53cb0b.
igc_ptp_init() needs to be called before igc_reset(), otherwise kernel crash could be observed. Following the corresponding discussion [1] and
[2] revert this commit.
--- drivers/net/ethernet/intel/igc/igc_main.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/intel/igc/igc_main.c +2 -3
@@ -6932,6 +6932,8 @@ static int igc_probe(struct pci_dev *pdedevice_set_wakeup_enable (&adapter->pdev->dev, adapter->flags &IGC_FLAG_WOL_SUPPORTED ); +igc_ptp_init (adapter); +igc_tsn_clear_schedule (adapter);/* reset the hardware with the new settings */
@@ -6953,9 +6955,6 @@ static int igc_probe(struct pci_dev *pde/* Check if Media Autosense is enabled */ adapter->ei = *ei; -/* do hw tstamp init after resetting */ -igc_ptp_init (adapter); -/* print pcie link status and MAC address */ pcie_print_link_status (pdev);netdev_info (netdev,"MAC: %pM\n" , netdev->dev_addr);
Greg Kroah-Hartman
maintainerPATCH 133/197 nilfs2: fix inode number range checks
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit e2fec219a36e0993642844be0f345513507031f4 upstream.
Patch series "nilfs2: fix potential issues related to reserved inodes".
This series fixes one use-after-free issue reported by syzbot, caused by nilfs2's internal inode being exposed in the namespace on a corrupted filesystem, and a couple of flaws that cause problems if the starting number of non-reserved inodes written in the on-disk super block is intentionally (or corruptly) changed from its default value.
This patch (of 3):
In the current implementation of nilfs2, "nilfs->ns_first_ino", which gives the first non-reserved inode number, is read from the superblock, but its lower limit is not checked.
As a result, if a number that overlaps with the inode number range of reserved inodes such as the root directory or metadata files is set in the super block parameter, the inode number test macros (NILFS_MDT_INODE and NILFS_VALID_INODE) will not function properly.
In addition, these test macros use left bit-shift calculations using with the inode number as the shift count via the BIT macro, but the result of a shift calculation that exceeds the bit width of an integer is undefined in the C specification, so if "ns_first_ino" is set to a large value other than the default value NILFS_USER_INO (=11), the macros may potentially malfunction depending on the environment.
Fix these issues by checking the lower bound of "nilfs->ns_first_ino" and by preventing bit shifts equal to or greater than the NILFS_USER_INO constant in the inode number test macros.
Also, change the type of "ns_first_ino" from signed integer to unsigned integer to avoid the need for type casting in comparisons such as the lower bound check introduced this time.
--- fs/nilfs2/nilfs.h | 5 +++-- fs/nilfs2/the_nilfs.c | 6 ++++++ fs/nilfs2/the_nilfs.h | 2 +- 3 files changed, 10 insertions(+), 3 deletions(-)
fs/nilfs2/nilfs.h +3 -2
@@ -116,9 +116,10 @@ enum {#define NILFS_FIRST_INO (sb) (((struct the_nilfs *)sb->s_fs_info)->ns_first_ino)#define NILFS_MDT_INODE (sb, ino) \ - ((ino) < NILFS_FIRST_INO(sb) && (NILFS_MDT_INO_BITS & BIT(ino))) + ((ino) < NILFS_USER_INO && (NILFS_MDT_INO_BITS & BIT(ino)))#define NILFS_VALID_INODE (sb, ino) \ - ((ino) >= NILFS_FIRST_INO(sb) || (NILFS_SYS_INO_BITS & BIT(ino))) + ((ino) >= NILFS_FIRST_INO(sb) || \ + ((ino) < NILFS_USER_INO && (NILFS_SYS_INO_BITS & BIT(ino))))/** * struct nilfs_transaction_info: context information for synchronization
fs/nilfs2/the_nilfs.c +6 -0
@@ -452,6 +452,12 @@ static int nilfs_store_disk_layout(struc } nilfs->ns_first_ino =le32_to_cpu (sbp->s_first_ino); +if (nilfs->ns_first_ino <NILFS_USER_INO ) { +nilfs_err (nilfs->ns_sb, +"too small lower limit for non-reserved inode numbers: %u" , + nilfs->ns_first_ino); +return -EINVAL ; + } nilfs->ns_blocks_per_segment =le32_to_cpu (sbp->s_blocks_per_segment);if (nilfs->ns_blocks_per_segment <NILFS_SEG_MIN_BLOCKS ) {
fs/nilfs2/the_nilfs.h +1 -1
@@ -182,7 +182,7 @@ struct the_nilfs {unsigned long ns_nrsvsegs;unsigned long ns_first_data_block;int ns_inode_size; -int ns_first_ino; +unsigned int ns_first_ino;u32 ns_crc_seed;/* /sys/fs/<nilfs>/<device> */
Greg Kroah-Hartman
maintainerPATCH 134/197 nilfs2: add missing check for inode numbers on directory entries
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit bb76c6c274683c8570ad788f79d4b875bde0e458 upstream.
Syzbot reported that mounting and unmounting a specific pattern of corrupted nilfs2 filesystem images causes a use-after-free of metadata file inodes, which triggers a kernel bug in lru_add_fn().
As Jan Kara pointed out, this is because the link count of a metadata file gets corrupted to 0, and nilfs_evict_inode(), which is called from iput(), tries to delete that inode (ifile inode in this case).
The inconsistency occurs because directories containing the inode numbers of these metadata files that should not be visible in the namespace are read without checking.
Fix this issue by treating the inode numbers of these internal files as errors in the sanity check helper when reading directory folios/pages.
Also thanks to Hillf Danton and Matthew Wilcox for their initial mm-layer analysis.
--- fs/nilfs2/dir.c | 6 ++++++ fs/nilfs2/nilfs.h | 5 +++++ 2 files changed, 11 insertions(+)
fs/nilfs2/dir.c +6 -0
@@ -135,6 +135,9 @@ static bool nilfs_check_folio(struct fol goto Enamelen;if (((offs + rec_len -1 ) ^ offs) & ~(chunk_size-1 )) goto Espan; +if (unlikely (p->inode && +NILFS_PRIVATE_INODE (le64_to_cpu (p->inode)))) + goto Einumber; }if (offs != limit) goto Eend;
@@ -160,6 +163,9 @@ Enamelen: goto bad_entry; Espan: error ="directory entry across blocks" ; + goto bad_entry; +Einumber: + error ="disallowed inode number" ; bad_entry: nilfs_error(sb, "bad entry in directory #%lu: %s - offset=%lu, inode=%lu, rec_len=%zd, name_len=%d",
fs/nilfs2/nilfs.h +5 -0
@@ -121,6 +121,11 @@ enum { ((ino) >=NILFS_FIRST_INO (sb) || \ ((ino) < NILFS_USER_INO && (NILFS_SYS_INO_BITS & BIT(ino)))) +#define NILFS_PRIVATE_INODE (ino) ({ \ + ino_t __ino = (ino); \ + ((__ino) < NILFS_USER_INO && (__ino) != NILFS_ROOT_INO && \ + (__ino) != NILFS_SKETCH_INO); }) +/** * struct nilfs_transaction_info: context information for synchronization * @ti_magic: Magic number
Greg Kroah-Hartman
maintainerPATCH 135/197 nilfs2: fix incorrect inode allocation from reserved inodes
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit 93aef9eda1cea9e84ab2453fcceb8addad0e46f1 upstream.
If the bitmap block that manages the inode allocation status is corrupted, nilfs_ifile_create_inode() may allocate a new inode from the reserved inode area where it should not be allocated.
Previous fix commit d325dc6eb763 ("nilfs2: fix use-after-free bug of struct nilfs_root"), fixed the problem that reserved inodes with inode numbers less than NILFS_USER_INO (=11) were incorrectly reallocated due to bitmap corruption, but since the start number of non-reserved inodes is read from the super block and may change, in which case inode allocation may occur from the extended reserved inode area.
If that happens, access to that inode will cause an IO error, causing the file system to degrade to an error state.
Fix this potential issue by adding a wraparound option to the common metadata object allocation routine and by modifying nilfs_ifile_create_inode() to disable the option so that it only allocates inodes with inode numbers greater than or equal to the inode number read in "nilfs->ns_first_ino", regardless of the bitmap status of reserved inodes.
--- fs/nilfs2/alloc.c | 19 +++++++++++++++---- fs/nilfs2/alloc.h | 4 ++-- fs/nilfs2/dat.c | 2 +- fs/nilfs2/ifile.c | 7 ++----- 4 files changed, 20 insertions(+), 12 deletions(-)
fs/nilfs2/alloc.c +15 -4
@@ -377,11 +377,12 @@ void *nilfs_palloc_block_get_entry(const* @target: offset number of an entry in the group (start point) * @bsize: size in bits * @lock: spin lock protecting @bitmap +* @wrap: whether to wrap around */ static int nilfs_palloc_find_available_slot (unsigned char *bitmap,unsigned long target,unsigned int bsize, -spinlock_t *lock) +spinlock_t *lock,bool wrap) {int pos, end = bsize;
@@ -397,6 +398,8 @@ static int nilfs_palloc_find_available_s end = target; } +if (!wrap) +return -ENOSPC ;/* wrap around */ for (pos =0 ; pos < end; pos++) {
@@ -495,9 +498,10 @@ int nilfs_palloc_count_max_entries(struc* nilfs_palloc_prepare_alloc_entry - prepare to allocate a persistent object * @inode: inode of metadata file using this allocator * @req: nilfs_palloc_req structure exchanged for the allocation +* @wrap: whether to wrap around */ int nilfs_palloc_prepare_alloc_entry (struct inode *inode, -struct nilfs_palloc_req *req) +struct nilfs_palloc_req *req,bool wrap) {struct buffer_head *desc_bh, *bitmap_bh;struct nilfs_palloc_group_desc *desc;
@@ -516,7 +520,7 @@ int nilfs_palloc_prepare_alloc_entry(str entries_per_group =nilfs_palloc_entries_per_group (inode);for (i =0 ; i < ngroups; i += n) { -if (group >= ngroups) { +if (group >= ngroups && wrap) {/* wrap around */ group =0 ; maxgroup = nilfs_palloc_group(inode, req->pr_entry_nr,
@@ -550,7 +554,14 @@ int nilfs_palloc_prepare_alloc_entry(str bitmap_kaddr =kmap_local_page (bitmap_bh->b_page); bitmap = bitmap_kaddr +bh_offset (bitmap_bh); pos =nilfs_palloc_find_available_slot ( - bitmap, group_offset, entries_per_group, lock); + bitmap, group_offset, entries_per_group, lock, + wrap); +/* +* Since the search for a free slot in the second and +* subsequent bitmap blocks always starts from the +* beginning, the wrap flag only has an effect on the +* first search. +*/ kunmap_local (bitmap_kaddr);if (pos >=0 ) goto found;
fs/nilfs2/alloc.h +2 -2
@@ -50,8 +50,8 @@ struct nilfs_palloc_req {struct buffer_head *pr_entry_bh; }; -int nilfs_palloc_prepare_alloc_entry (struct inode *, -struct nilfs_palloc_req *); +int nilfs_palloc_prepare_alloc_entry (struct inode *inode, +struct nilfs_palloc_req *req,bool wrap);void nilfs_palloc_commit_alloc_entry (struct inode *,struct nilfs_palloc_req *);void nilfs_palloc_abort_alloc_entry (struct inode *,struct nilfs_palloc_req *);
fs/nilfs2/dat.c +1 -1
@@ -75,7 +75,7 @@ int nilfs_dat_prepare_alloc(struct inode {int ret; - ret =nilfs_palloc_prepare_alloc_entry (dat, req); + ret =nilfs_palloc_prepare_alloc_entry (dat, req, true);if (ret <0 )return ret;
fs/nilfs2/ifile.c +2 -5
@@ -56,13 +56,10 @@ int nilfs_ifile_create_inode(struct inodstruct nilfs_palloc_req req;int ret; - req.pr_entry_nr =0 ;/* -* 0 says find free inode from beginning -* of a group. dull code!! -*/ + req.pr_entry_nr =NILFS_FIRST_INO (ifile->i_sb); req.pr_entry_bh =NULL ; - ret =nilfs_palloc_prepare_alloc_entry (ifile, &req); + ret =nilfs_palloc_prepare_alloc_entry (ifile, &req, false);if (!ret) { ret =nilfs_palloc_get_entry_block (ifile, req.pr_entry_nr,1 , &req.pr_entry_bh);
Greg Kroah-Hartman
maintainerPATCH 136/197 mm: optimize the redundant loop of mm_update_owner_next()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinliang Zheng <[email protected]>
commit cf3f9a593dab87a032d2b6a6fb205e7f3de4f0a1 upstream.
When mm_update_owner_next() is racing with swapoff (try_to_unuse()) or /proc or ptrace or page migration (get_task_mm()), it is impossible to find an appropriate task_struct in the loop whose mm_struct is the same as the target mm_struct.
If the above race condition is combined with the stress-ng-zombie and stress-ng-dup tests, such a long loop can easily cause a Hard Lockup in write_lock_irq() for tasklist_lock.
Recognize this situation in advance and exit early.
--- kernel/exit.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/exit.c +2 -0
@@ -488,6 +488,8 @@ retry:* Search through everything else, we should not get here often. */ for_each_process (g) { +if (atomic_read (&mm->mm_users) <=1 ) +break ;if (g->flags &PF_KTHREAD )continue ;for_each_thread (g, c) {
Greg Kroah-Hartman
maintainerPATCH 137/197 mm: avoid overflows in dirty throttling logic
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 385d838df280eba6c8680f9777bfa0d0bfe7e8b2 upstream.
The dirty throttling logic is interspersed with assumptions that dirty limits in PAGE_SIZE units fit into 32-bit (so that various multiplications fit into 64-bits). If limits end up being larger, we will hit overflows, possible divisions by 0 etc. Fix these problems by never allowing so large dirty limits as they have dubious practical value anyway. For dirty_bytes / dirty_background_bytes interfaces we can just refuse to set so large limits. For dirty_ratio / dirty_background_ratio it isn't so simple as the dirty limit is computed from the amount of available memory which can change due to memory hotplug etc. So when converting dirty limits from ratios to numbers of pages, we just don't allow the result to exceed UINT_MAX.
This is root-only triggerable problem which occurs when the operator sets dirty limits to >16 TB.
--- mm/page-writeback.c | 30 ++++++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-)
mm/page-writeback.c +26 -4
@@ -415,13 +415,20 @@ static void domain_dirty_limits(struct delse bg_thresh = (bg_ratio * available_memory) /PAGE_SIZE ; -if (bg_thresh >= thresh) - bg_thresh = thresh /2 ; tsk = current;if (rt_task (tsk)) { bg_thresh += bg_thresh /4 + global_wb_domain.dirty_limit /32 ; thresh += thresh /4 + global_wb_domain.dirty_limit /32 ; } +/* +* Dirty throttling logic assumes the limits in page units fit into +* 32-bits. This gives 16TB dirty limits max which is hopefully enough. +*/ +if (thresh >UINT_MAX ) + thresh =UINT_MAX ; +/* This makes sure bg_thresh is within 32-bits as well */ +if (bg_thresh >= thresh) + bg_thresh = thresh /2 ; dtc->thresh = thresh; dtc->bg_thresh = bg_thresh;
@@ -471,7 +478,11 @@ static unsigned long node_dirty_limit(stif (rt_task (tsk)) dirty += dirty /4 ; -return dirty; +/* +* Dirty throttling logic assumes the limits in page units fit into +* 32-bits. This gives 16TB dirty limits max which is hopefully enough. +*/ + return min_t(unsigned long, dirty, UINT_MAX); }/**
@@ -508,10 +519,17 @@ static int dirty_background_bytes_handle void *buffer, size_t *lenp, loff_t *ppos) { int ret; +unsigned long old_bytes = dirty_background_bytes; ret =proc_doulongvec_minmax (table, write, buffer, lenp, ppos); -if (ret ==0 && write) +if (ret ==0 && write) { +if (DIV_ROUND_UP (dirty_background_bytes,PAGE_SIZE ) > +UINT_MAX ) { + dirty_background_bytes = old_bytes; +return -ERANGE ; + } dirty_background_ratio =0 ; + }return ret; }
@@ -537,6 +555,10 @@ static int dirty_bytes_handler(struct ct ret =proc_doulongvec_minmax (table, write, buffer, lenp, ppos);if (ret ==0 && write && vm_dirty_bytes != old_bytes) { +if (DIV_ROUND_UP (vm_dirty_bytes,PAGE_SIZE ) >UINT_MAX ) { + vm_dirty_bytes = old_bytes; +return -ERANGE ; + }writeback_set_ratelimit (); vm_dirty_ratio =0 ; }
Greg Kroah-Hartman
maintainerPATCH 138/197 btrfs: zoned: fix calc_available_free_space() for zoned mode
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiro Aota <[email protected]>
commit 64d2c847ba380e07b9072d65a50aa6469d2aa43f upstream.
calc_available_free_space() returns the total size of metadata (or system) block groups, which can be allocated from unallocated disk space. The logic is wrong on zoned mode in two places.
First, the calculation of data_chunk_size is wrong. We always allocate one zone as one chunk, and no partial allocation of a zone. So, we should use zone_size (= data_sinfo->chunk_size) as it is.
Second, the result "avail" may not be zone aligned. Since we always allocate one zone as one chunk on zoned mode, returning non-zone size aligned bytes will result in less pressure on the async metadata reclaim process.
This is serious for the nearly full state with a large zone size device. Allowing over-commit too much will result in less async reclaim work and end up in ENOSPC. We can align down to the zone size to avoid that.
--- fs/btrfs/space-info.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-)
fs/btrfs/space-info.c +21 -3
@@ -373,11 +373,18 @@ static u64 calc_available_free_space(struct btrfs_fs_info *fs_info,* "optimal" chunk size based on the fs size. However when we actually * allocate the chunk we will strip this down further, making it no more * than 10% of the disk or 1G, whichever is smaller. +* +* On the zoned mode, we need to use zone_size (= +* data_sinfo->chunk_size) as it is. */ data_sinfo =btrfs_find_space_info (fs_info,BTRFS_BLOCK_GROUP_DATA ); - data_chunk_size =min (data_sinfo->chunk_size, -mult_perc (fs_info->fs_devices->total_rw_bytes,10 )); - data_chunk_size =min_t (u64, data_chunk_size,SZ_1G ); +if (!btrfs_is_zoned (fs_info)) { + data_chunk_size =min (data_sinfo->chunk_size, +mult_perc (fs_info->fs_devices->total_rw_bytes,10 )); + data_chunk_size =min_t (u64, data_chunk_size,SZ_1G ); + }else { + data_chunk_size = data_sinfo->chunk_size; + }/* * Since data allocations immediately use block groups as part of the
@@ -405,6 +412,17 @@ static u64 calc_available_free_space(struct btrfs_fs_info *fs_info, avail >>=3 ; else avail >>= 1; + +/* +* On the zoned mode, we always allocate one zone as one chunk. +* Returning non-zone size alingned bytes here will result in +* less pressure for the async metadata reclaim process, and it +* will over-commit too much leading to ENOSPC. Align down to the +* zone size to avoid that. +*/ +if (btrfs_is_zoned (fs_info)) + avail =ALIGN_DOWN (avail, fs_info->zone_size); +return avail; }
Signature · 1 line
2.45.2
Greg Kroah-Hartman
maintainerPATCH 139/197 btrfs: fix adding block group to a reclaim list and the unused list during reclaim
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiro Aota <[email protected]>
commit 48f091fd50b2eb33ae5eaea9ed3c4f81603acf38 upstream.
There is a potential parallel list adding for retrying in btrfs_reclaim_bgs_work and adding to the unused list. Since the block group is removed from the reclaim list and it is on a relocation work, it can be added into the unused list in parallel. When that happens, adding it to the reclaim list will corrupt the list head and trigger list corruption like below.
Fix it by taking fs_info->unused_bgs_lock.
[177.504][T2585409] BTRFS error (device nullb1): error relocating ch= unk 2415919104 [177.514][T2585409] list_del corruption. next->prev should be ff1100= 0344b119c0, but was ff11000377e87c70. (next=3Dff110002390cd9c0) [177.529][T2585409] ------------[ cut here ]------------ [177.537][T2585409] kernel BUG at lib/list_debug.c:65! [177.545][T2585409] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI [177.555][T2585409] CPU: 9 PID: 2585409 Comm: kworker/u128:2 Tainted: G W 6.10.0-rc5-kts #1 [177.568][T2585409] Hardware name: Supermicro SYS-520P-WTR/X12SPW-TF, BIOS 1.2 02/14/2022 [177.579][T2585409] Workqueue: events_unbound btrfs_reclaim_bgs_work[btrfs] [177.589][T2585409] RIP: 0010:__list_del_entry_valid_or_report.cold+0x70/0x72 [177.624][T2585409] RSP: 0018:ff11000377e87a70 EFLAGS: 00010286 [177.633][T2585409] RAX: 000000000000006d RBX: ff11000344b119c0 RCX:0000000000000000 [177.644][T2585409] RDX: 000000000000006d RSI: 0000000000000008 RDI:ffe21c006efd0f40 [177.655][T2585409] RBP: ff110002e0509f78 R08: 0000000000000001 R09:ffe21c006efd0f08 [177.665][T2585409] R10: ff11000377e87847 R11: 0000000000000000 R12:ff110002390cd9c0 [177.676][T2585409] R13: ff11000344b119c0 R14: ff110002e0508000 R15:dffffc0000000000 [177.687][T2585409] FS: 0000000000000000(0000) GS:ff11000fec880000(0000) knlGS:0000000000000000 [177.700][T2585409] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [177.709][T2585409] CR2: 00007f06bc7b1978 CR3: 0000001021e86005 CR4:0000000000771ef0 [177.720][T2585409] DR0: 0000000000000000 DR1: 0000000000000000 DR2:0000000000000000 [177.731][T2585409] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:0000000000000400 [177.742][T2585409] PKRU: 55555554 [177.748][T2585409] Call Trace: [177.753][T2585409] <TASK> [177.759][T2585409] ? __die_body.cold+0x19/0x27 [177.766][T2585409] ? die+0x2e/0x50 [177.772][T2585409] ? do_trap+0x1ea/0x2d0 [177.779][T2585409] ? __list_del_entry_valid_or_report.cold+0x70/0x72 [177.788][T2585409] ? do_error_trap+0xa3/0x160 [177.795][T2585409] ? __list_del_entry_valid_or_report.cold+0x70/0x72 [177.805][T2585409] ? handle_invalid_op+0x2c/0x40 [177.812][T2585409] ? __list_del_entry_valid_or_report.cold+0x70/0x72 [177.820][T2585409] ? exc_invalid_op+0x2d/0x40 [177.827][T2585409] ? asm_exc_invalid_op+0x1a/0x20 [177.834][T2585409] ? __list_del_entry_valid_or_report.cold+0x70/0x72 [177.843][T2585409] btrfs_delete_unused_bgs+0x3d9/0x14c0 [btrfs]
There is a similar retry_list code in btrfs_delete_unused_bgs(), but it is safe, AFAICS. Since the block group was in the unused list, the used bytes should be 0 when it was added to the unused list. Then, it checks block_group->{used,reserved,pinned} are still 0 under the block_group->lock. So, they should be still eligible for the unused list, not the reclaim list.
The reason it is safe there it's because because we're holding space_info->groups_sem in write mode.
That means no other task can allocate from the block group, so while we are at deleted_unused_bgs() it's not possible for other tasks to allocate and deallocate extents from the block group, so it can't be added to the unused list or the reclaim list by anyone else.
The bug can be reproduced by btrfs/166 after a few rounds. In practice this can be hit when relocation cannot find more chunk space and ends with ENOSPC.
--- fs/btrfs/block-group.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
fs/btrfs/block-group.c +11 -2
@@ -1924,8 +1924,17 @@ void btrfs_reclaim_bgs_work(struct work_ next:if (ret) {/* Refcount held by the reclaim_bgs list after splice. */ -btrfs_get_block_group (bg); -list_add_tail (&bg->bg_list, &retry_list); +spin_lock (&fs_info->unused_bgs_lock); +/* +* This block group might be added to the unused list +* during the above process. Move it back to the +* reclaim list otherwise. +*/ +if (list_empty (&bg->bg_list)) { +btrfs_get_block_group (bg); +list_add_tail (&bg->bg_list, &retry_list); + } +spin_unlock (&fs_info->unused_bgs_lock); }btrfs_put_block_group (bg);
Greg Kroah-Hartman
maintainerPATCH 140/197 btrfs: fix folio refcount in __alloc_dummy_extent_buffer()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
commit a56c85fa2d59ab0780514741550edf87989a66e9 upstream.
Another improper use of __folio_put() in an error path after freshly allocating pages/folios which returns them with the refcount initialized to 1. The refactor from __free_pages() -> __folio_put() (instead of folio_put) removed a refcount decrement found in __free_pages() and folio_put but absent from __folio_put().
--- fs/btrfs/extent_io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/extent_io.c +1 -1
@@ -3526,7 +3526,7 @@ err:for (int i =0 ; i < num_folios; i++) {if (eb->folios[i]) {detach_extent_buffer_folio (eb, eb->folios[i]); -__folio_put (eb->folios[i]); +folio_put (eb->folios[i]); } }__free_extent_buffer (eb);
Greg Kroah-Hartman
maintainerPATCH 141/197 f2fs: Add inline to f2fs_build_fault_attr() stub
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit 0d8968287a1cf7b03d07387dc871de3861b9f6b9 upstream.
When building without CONFIG_F2FS_FAULT_INJECTION, there is a warning from each file that includes f2fs.h because the stub for f2fs_build_fault_attr() is missing inline:
In file included from fs/f2fs/segment.c:21:
fs/f2fs/f2fs.h:4605:12: warning: 'f2fs_build_fault_attr' defined but not used [-Wunused-function]
4605 | static int f2fs_build_fault_attr(struct f2fs_sb_info *sbi, unsigned long rate,
| ^~~~~~~~~~~~~~~~~~~~~
Add the missing inline to resolve all of the warnings for this configuration.
--- fs/f2fs/f2fs.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/f2fs/f2fs.h +2 -2
@@ -4600,8 +4600,8 @@ static inline bool f2fs_need_verity(consextern int f2fs_build_fault_attr (struct f2fs_sb_info *sbi,unsigned long rate,unsigned long type);#else -static int f2fs_build_fault_attr (struct f2fs_sb_info *sbi,unsigned long rate, -unsigned long type) +static inline int f2fs_build_fault_attr (struct f2fs_sb_info *sbi, +unsigned long rate,unsigned long type) {return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 142/197 scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add()
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit 9f365cb8bbd0162963d6852651d7c9e30adcb7b5 upstream.
When building for a 32-bit platform such as ARM or i386, for which size_t is unsigned int, there is a warning due to using an unsigned long format specifier:
drivers/scsi/mpi3mr/mpi3mr_transport.c:1370:11: error: format specifies type 'unsigned long' but the argument has type 'unsigned int' [-Werror,-Wformat]
1369 | ioc_warn(mrioc, "skipping port %u, max allowed value is %lu\n",
| ~~~
| %u
1370 | i, sizeof(mr_sas_port->phy_mask) * 8);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Use the proper format specifier for size_t, %zu, to resolve the warning for all platforms.
--- drivers/scsi/mpi3mr/mpi3mr_transport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/mpi3mr/mpi3mr_transport.c +1 -1
@@ -1366,7 +1366,7 @@ static struct mpi3mr_sas_port *mpi3mr_sacontinue ;if (i >sizeof (mr_sas_port->phy_mask) *8 ) { -ioc_warn (mrioc,"skipping port %u, max allowed value is %lu\n" , +ioc_warn (mrioc,"skipping port %u, max allowed value is %zu\n" , i,sizeof (mr_sas_port->phy_mask) *8 ); goto out_fail; }
Greg Kroah-Hartman
maintainerPATCH 143/197 Bluetooth: hci_bcm4377: Fix msgid release
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hector Martin <[email protected]>
commit 897e6120566f1c108b85fefe78d1c1bddfbd5988 upstream.
We are releasing a single msgid, so the order argument to bitmap_release_region must be zero.
--- drivers/bluetooth/hci_bcm4377.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/bluetooth/hci_bcm4377.c +1 -1
@@ -716,7 +716,7 @@ static void bcm4377_handle_ack(struct bc ring->events[msgid] =NULL ; } -bitmap_release_region (ring->msgids, msgid, ring->n_entries); +bitmap_release_region (ring->msgids, msgid,0 ); unlock:spin_unlock_irqrestore (&ring->lock, flags);
Greg Kroah-Hartman
maintainerPATCH 144/197 Bluetooth: Add quirk to ignore reserved PHY bits in LE Extended Adv Report
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Peter <[email protected]>
commit ed2a2ef16a6b9197a0e452308bf6acee6e01f709 upstream.
Some Broadcom controllers found on Apple Silicon machines abuse the reserved bits inside the PHY fields of LE Extended Advertising Report events for additional flags. Add a quirk to drop these and correctly extract the Primary/Secondary_PHY field.
The following excerpt from a btmon trace shows a report received with "Reserved" for "Primary PHY" on a 4388 controller:
Quoted 1 line
HCI Event: LE Meta Event (
0x3e) plen 26
LE Extended Advertising Report (0x0d)
Num reports: 1
Entry 0
Event type: 0x2515
Props: 0x0015
Connectable
Directed
Use legacy advertising PDUs
Data status: Complete
Reserved (0x2500)
Legacy PDU Type: Reserved (0x2515)
Address type: Random (0x01)
Address: 00:00:00:00:00:00 (Static)
Primary PHY: Reserved
Secondary PHY: No packets
SID: no ADI field (0xff)
TX power: 127 dBm
RSSI: -60 dBm (0xc4)
Periodic advertising interval: 0.00 msec (0x0000)
Direct address type: Public (0x00)
Direct address: 00:00:00:00:00:00 (Apple, Inc.)
Data length: 0x00--- drivers/bluetooth/hci_bcm4377.c | 8 ++++++++ include/net/bluetooth/hci.h | 11 +++++++++++ net/bluetooth/hci_event.c | 7 +++++++ 3 files changed, 26 insertions(+)
drivers/bluetooth/hci_bcm4377.c +8 -0
@@ -495,6 +495,10 @@ struct bcm4377_data;* extended scanning * broken_mws_transport_config: Set to true if the chip erroneously claims to * support MWS Transport Configuration +* broken_le_ext_adv_report_phy: Set to true if this chip stuffs flags inside +* reserved bits of Primary/Secondary_PHY inside +* LE Extended Advertising Report events which +* have to be ignored * send_calibration: Optional callback to send calibration data * send_ptb: Callback to send "PTB" regulatory/calibration data */
@@ -513,6 +517,7 @@ struct bcm4377_hw { unsigned long broken_ext_scan : 1; unsigned long broken_mws_transport_config : 1; unsigned long broken_le_coded : 1; + unsigned long broken_le_ext_adv_report_phy : 1;int (*send_calibration)(struct bcm4377_data *bcm4377); int (*send_ptb)(struct bcm4377_data *bcm4377,
@@ -2373,6 +2378,8 @@ static int bcm4377_probe(struct pci_devset_bit (HCI_QUIRK_BROKEN_EXT_SCAN , &hdev->quirks);if (bcm4377->hw->broken_le_coded)set_bit (HCI_QUIRK_BROKEN_LE_CODED , &hdev->quirks); +if (bcm4377->hw->broken_le_ext_adv_report_phy) +set_bit (HCI_QUIRK_FIXUP_LE_EXT_ADV_REPORT_PHY , &hdev->quirks);pci_set_drvdata (pdev, bcm4377);hci_set_drvdata (hdev, bcm4377);
@@ -2477,6 +2484,7 @@ static const struct bcm4377_hw bcm4377_h .clear_pciecfg_subsystem_ctrl_bit19 = true, .broken_mws_transport_config = true, .broken_le_coded = true, + .broken_le_ext_adv_report_phy = true, .send_calibration = bcm4387_send_calibration, .send_ptb = bcm4378_send_ptb, },
include/net/bluetooth/hci.h +11 -0
@@ -324,6 +324,17 @@ enum {* claim to support it. */ HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE , + +/* +* When this quirk is set, the reserved bits of Primary/Secondary_PHY +* inside the LE Extended Advertising Report events are discarded. +* This is required for some Apple/Broadcom controllers which +* abuse these reserved bits for unrelated flags. +* +* This quirk can be set before hci_register_dev is called or +* during the hdev->setup vendor callback. +*/ + HCI_QUIRK_FIXUP_LE_EXT_ADV_REPORT_PHY, };/* HCI device flags */
net/bluetooth/hci_event.c +7 -0
@@ -6312,6 +6312,13 @@ static void hci_le_ext_adv_report_evt(st evt_type =__le16_to_cpu (info->type) &LE_EXT_ADV_EVT_TYPE_MASK ; legacy_evt_type =ext_evt_type_to_legacy (hdev, evt_type); + +if (test_bit (HCI_QUIRK_FIXUP_LE_EXT_ADV_REPORT_PHY , + &hdev->quirks)) { + info->primary_phy &=0x1f ; + info->secondary_phy &=0x1f ; + } +if (legacy_evt_type !=LE_ADV_INVALID ) { process_adv_report(hdev, legacy_evt_type, &info->bdaddr, info->bdaddr_type, NULL, 0,
Greg Kroah-Hartman
maintainerPATCH 145/197 Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
commit 88e72239ead9814b886db54fc4ee39ef3c2b8f26 upstream.
Commit 272970be3dab ("Bluetooth: hci_qca: Fix driver shutdown on closed serdev") will cause below regression issue:
BT can't be enabled after below steps:
cold boot -> enable BT -> disable BT -> warm reboot -> BT enable failure if property enable-gpios is not configured within DT|ACPI for QCA6390.
The commit is to fix a use-after-free issue within qca_serdev_shutdown() by adding condition to avoid the serdev is flushed or wrote after closed but also introduces this regression issue regarding above steps since the VSC is not sent to reset controller during warm reboot.
Fixed by sending the VSC to reset controller within qca_serdev_shutdown() once BT was ever enabled, and the use-after-free issue is also fixed by this change since the serdev is still opened before it is flushed or wrote.
Verified by the reported machine Dell XPS 13 9310 laptop over below two kernel commits:
commit e00fc2700a3f ("Bluetooth: btusb: Fix triggering coredump implementation for QCA") of bluetooth-next tree.
commit b23d98d46d28 ("Bluetooth: btusb: Fix triggering coredump implementation for QCA") of linus mainline tree.
--- drivers/bluetooth/hci_qca.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
drivers/bluetooth/hci_qca.c +15 -3
@@ -2450,15 +2450,27 @@ static void qca_serdev_shutdown(struct dstruct qca_serdev *qcadev =serdev_device_get_drvdata (serdev);struct hci_uart *hu = &qcadev->serdev_hu;struct hci_dev *hdev = hu->hdev; -struct qca_data *qca = hu->priv;const u8 ibs_wake_cmd[] = {0xFD };const u8 edl_reset_soc_cmd[] = {0x01 ,0x00 ,0xFC ,0x01 ,0x05 };if (qcadev->btsoc_type ==QCA_QCA6390 ) { -if (test_bit (QCA_BT_OFF , &qca->flags) || - !test_bit (HCI_RUNNING , &hdev->flags)) +/* The purpose of sending the VSC is to reset SOC into a initial +* state and the state will ensure next hdev->setup() success. +* if HCI_QUIRK_NON_PERSISTENT_SETUP is set, it means that +* hdev->setup() can do its job regardless of SoC state, so +* don't need to send the VSC. +* if HCI_SETUP is set, it means that hdev->setup() was never +* invoked and the SOC is already in the initial state, so +* don't also need to send the VSC. +*/ +if (test_bit (HCI_QUIRK_NON_PERSISTENT_SETUP , &hdev->quirks) || +hci_dev_test_flag (hdev,HCI_SETUP ))return ; +/* The serdev must be in open state when conrol logic arrives +* here, so also fix the use-after-free issue caused by that +* the serdev is flushed or wrote after it is closed. +*/ serdev_device_write_flush (serdev); ret =serdev_device_write_buf (serdev, ibs_wake_cmd,sizeof (ibs_wake_cmd));
Greg Kroah-Hartman
maintainerPATCH 146/197 can: kvaser_usb: Explicitly initialize family in leafimx driver_info struct
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jimmy Assarsson <[email protected]>
commit 19d5b2698c35b2132a355c67b4d429053804f8cc upstream.
Explicitly set the 'family' driver_info struct member for leafimx. Previously, the correct operation relied on KVASER_LEAF being the first defined value in enum kvaser_usb_leaf_family.
--- drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +1 -0
@@ -125,6 +125,7 @@ static const struct kvaser_usb_driver_instatic const struct kvaser_usb_driver_info kvaser_usb_driver_info_leafimx = { .quirks =0 , + .family =KVASER_LEAF , .ops = &kvaser_usb_leaf_dev_ops, };
Greg Kroah-Hartman
maintainerPATCH 147/197 fsnotify: Do not generate events for O_PATH file descriptors
In reply to Greg Kroah-Hartman6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 702eb71fd6501b3566283f8c96d7ccc6ddd662e9 upstream.
Currently we will not generate FS_OPEN events for O_PATH file descriptors but we will generate FS_CLOSE events for them. This is asymmetry is confusing. Arguably no fsnotify events should be generated for O_PATH file descriptors as they cannot be used to access or modify file content, they are just convenient handles to file objects like paths. So fix the asymmetry by stopping to generate FS_CLOSE for O_PATH file descriptors.
--- include/linux/fsnotify.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
include/linux/fsnotify.h +7 -1
@@ -99,7 +99,13 @@ static inline int fsnotify_file(struct f {const struct path *path; -if (file->f_mode &FMODE_NONOTIFY ) +/* +* FMODE_NONOTIFY are fds generated by fanotify itself which should not +* generate new events. We also don't want to generate events for +* FMODE_PATH fds (involves open & close events) as they are just +* handle creation / destruction events and not "real" file events. +*/ +if (file->f_mode & (FMODE_NONOTIFY |FMODE_PATH ))return 0 ; path = &file->f_path;