5.4.280-rc1 review
Greg Kroah-Hartman
maintainercover 5.4.280-rc1 review
This is the start of the stable review cycle for the 5.4.280 release. There are 78 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 18 Jul 2024 15:27:21 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.280-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.280-rc1
Wolfram Sang <[email protected]>
i2c: rcar: bring hardware to known state when probing
Ryusuke Konishi <[email protected]>
nilfs2: fix kernel bug on rename operation of broken directory
Eric Dumazet <[email protected]>
tcp: avoid too many retransmit packets
Eric Dumazet <[email protected]>
tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
Menglong Dong <[email protected]>
net: tcp: fix unexcepted socket die when snd_wnd is 0
Eric Dumazet <[email protected]>
tcp: refactor tcp_retransmit_timer()
felix <[email protected]>
SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
Ilya Dryomov <[email protected]>
libceph: fix race between delayed_work() and ceph_monc_stop()
Edson Juliano Drosdeck <[email protected]>
ALSA: hda/realtek: Limit mic boost on VAIO PRO PX
Joy Chakraborty <[email protected]>
nvmem: meson-efuse: Fix return value of nvmem callbacks
He Zhe <[email protected]>
hpet: Support 32-bit userspace
Alan Stern <[email protected]>
USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
Lee Jones <[email protected]>
usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
WangYuli <[email protected]>
USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k
Vanillan Wang <[email protected]>
USB: serial: option: add Rolling RW350-GL variants
Mank Wang <[email protected]>
USB: serial: option: add Netprisma LCUK54 series modules
Slark Xiao <[email protected]>
USB: serial: option: add support for Foxconn T99W651
Bjørn Mork <[email protected]>
USB: serial: option: add Fibocom FM350-GL
Daniele Palmas <[email protected]>
USB: serial: option: add Telit FN912 rmnet compositions
Daniele Palmas <[email protected]>
USB: serial: option: add Telit generic core-dump composition
Michal Mazur <[email protected]>
octeontx2-af: fix detection of IP layer
Chen Ni <[email protected]>
ARM: davinci: Convert comma to semicolon
Sven Schnelle <[email protected]>
s390: Mark psw in __load_psw_mask() as __unitialized
Kuniyuki Iwashima <[email protected]>
udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
Dmitry Antipov <[email protected]>
ppp: reject claimed-as-LCP but actually malformed packets
Aleksander Jan Bajkowski <[email protected]>
net: ethernet: lantiq_etop: fix double free in detach
Aleksander Jan Bajkowski <[email protected]>
net: lantiq_etop: add blank line after declaration
Aleksandr Mishin <[email protected]>
octeontx2-af: Fix incorrect value output on error path in rvu_check_rsrc_availability()
Neal Cardwell <[email protected]>
tcp: fix incorrect undo caused by DSACK of TLP retransmit
Jason Baron <[email protected]>
tcp: add TCP_INFO status for failed client TFO
Brian Foster <[email protected]>
vfs: don't mod negative dentry count when on shrinker list
linke li <[email protected]>
fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading
Jeff Layton <[email protected]>
filelock: fix potential use-after-free in posix_lock_inode
Ryusuke Konishi <[email protected]>
nilfs2: fix incorrect inode allocation from reserved inodes
Nilay Shroff <[email protected]>
nvme-multipath: find NUMA path only for online numa-node
Jian-Hong Pan <[email protected]>
ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897
Piotr Wojtaszczyk <[email protected]>
i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
Mauro Carvalho Chehab <[email protected]>
media: dw2102: fix a potential buffer overflow
Ghadi Elie Rahme <[email protected]>
bnx2x: Fix multiple UBSAN array-index-out-of-bounds
Alex Deucher <[email protected]>
drm/amdgpu/atomfirmware: silence UBSAN warning
Ma Ke <[email protected]>
drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
Jan Kara <[email protected]>
Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
Jan Kara <[email protected]>
fsnotify: Do not generate events for O_PATH file descriptors
Jimmy Assarsson <[email protected]>
can: kvaser_usb: Explicitly initialize family in leafimx driver_info struct
Jinliang Zheng <[email protected]>
mm: optimize the redundant loop of mm_update_owner_next()
Ryusuke Konishi <[email protected]>
nilfs2: add missing check for inode numbers on directory entries
Ryusuke Konishi <[email protected]>
nilfs2: fix inode number range checks
Shigeru Yoshida <[email protected]>
inet_diag: Initialize pad field in struct inet_diag_req_v2
Zijian Zhang <[email protected]>
selftests: make order checking verbose in msg_zerocopy selftest
Zijian Zhang <[email protected]>
selftests: fix OOM in msg_zerocopy selftest
Sam Sun <[email protected]>
bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
Jozef Hopko <[email protected]>
wifi: wilc1000: fix ies_len type in connect path
Jakub Kicinski <[email protected]>
tcp_metrics: validate source addr length
Neal Cardwell <[email protected]>
UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()
Yuchung Cheng <[email protected]>
net: tcp better handling of reordering then loss cases
Yousuk Seung <[email protected]>
tcp: add ece_ack flag to reno sack functions
zhang kai <[email protected]>
tcp: tcp_mark_head_lost is only valid for sack-tcp
Holger Dengler <[email protected]>
s390/pkey: Wipe sensitive data on failure
Wang Yong <[email protected]>
jffs2: Fix potential illegal address access in jffs2_free_inode
Greg Kurz <[email protected]>
powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"
Mike Marshall <[email protected]>
orangefs: fix out-of-bounds fsid access
Michael Ellerman <[email protected]>
powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n
Heiner Kallweit <[email protected]>
i2c: i801: Annotate apanel_addr as __ro_after_init
Ricardo Ribalda <[email protected]>
media: dvb-frontends: tda10048: Fix integer overflow
Ricardo Ribalda <[email protected]>
media: s2255: Use refcount_t instead of atomic_t for num_channels
Ricardo Ribalda <[email protected]>
media: dvb-frontends: tda18271c2dd: Remove casting during div
Simon Horman <[email protected]>
net: dsa: mv88e6xxx: Correct check for empty list
Erick Archer <[email protected]>
Input: ff-core - prefer struct_size over open coded arithmetic
Jean Delvare <[email protected]>
firmware: dmi: Stop decoding on broken entry
Erick Archer <[email protected]>
sctp: prefer struct_size over open coded arithmetic
Michael Bunk <[email protected]>
media: dw2102: Don't translate i2c read into write
Alex Hung <[email protected]>
drm/amd/display: Skip finding free audio for unknown engine_id
Ma Jun <[email protected]>
drm/amdgpu: Initialize timestamp for some legacy SOCs
John Meneghini <[email protected]>
scsi: qedf: Make qedf_execute_tmf() non-preemptible
Michael Guralnik <[email protected]>
IB/core: Implement a limit on UMAD receive List
Ricardo Ribalda <[email protected]>
media: dvb-usb: dib0700_devices: Add missing release_firmware()
Ricardo Ribalda <[email protected]>
media: dvb: as102-fe: Fix as10x_register_addr packing
Erico Nunes <[email protected]>
drm/lima: fix shared irq handling on driver remove
-------------
Diffstat:
Makefile | 4 +- arch/arm/mach-davinci/pm.c | 2 +- arch/powerpc/include/asm/io.h | 2 +- arch/powerpc/xmon/xmon.c | 6 +- arch/s390/include/asm/processor.h | 2 +- drivers/char/hpet.c | 34 +++++- drivers/firmware/dmi_scan.c | 11 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 8 ++ drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 + drivers/gpu/drm/amd/include/atomfirmware.h | 2 +- drivers/gpu/drm/lima/lima_gp.c | 2 + drivers/gpu/drm/lima/lima_mmu.c | 5 + drivers/gpu/drm/lima/lima_pp.c | 4 + drivers/gpu/drm/nouveau/nouveau_connector.c | 3 + drivers/i2c/busses/i2c-i801.c | 2 +- drivers/i2c/busses/i2c-pnx.c | 48 ++------- drivers/i2c/busses/i2c-rcar.c | 17 ++- drivers/infiniband/core/user_mad.c | 21 ++-- drivers/input/ff-core.c | 7 +- drivers/media/dvb-frontends/as102_fe_types.h | 2 +- drivers/media/dvb-frontends/tda10048.c | 9 +- drivers/media/dvb-frontends/tda18271c2dd.c | 4 +- drivers/media/usb/dvb-usb/dib0700_devices.c | 18 +++- drivers/media/usb/dvb-usb/dw2102.c | 120 +++++++++++++--------- drivers/media/usb/s2255/s2255drv.c | 20 ++-- drivers/net/bonding/bond_options.c | 6 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 1 + drivers/net/dsa/mv88e6xxx/chip.c | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 2 +- drivers/net/ethernet/lantiq_etop.c | 5 +- drivers/net/ethernet/marvell/octeontx2/af/npc.h | 8 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- drivers/net/ppp/ppp_generic.c | 15 +++ drivers/nvme/host/multipath.c | 2 +- drivers/nvmem/meson-efuse.c | 14 ++- drivers/s390/crypto/pkey_api.c | 4 +- drivers/scsi/qedf/qedf_io.c | 6 +- drivers/staging/wilc1000/wilc_hif.c | 3 +- drivers/usb/core/config.c | 18 +++- drivers/usb/core/quirks.c | 3 + drivers/usb/gadget/configfs.c | 3 + drivers/usb/serial/option.c | 38 +++++++ fs/dcache.c | 12 ++- fs/jffs2/super.c | 1 + fs/locks.c | 2 +- fs/nilfs2/alloc.c | 18 +++- fs/nilfs2/alloc.h | 4 +- fs/nilfs2/dat.c | 2 +- fs/nilfs2/dir.c | 38 ++++++- fs/nilfs2/ifile.c | 7 +- fs/nilfs2/nilfs.h | 10 +- fs/nilfs2/the_nilfs.c | 6 ++ fs/nilfs2/the_nilfs.h | 2 +- fs/orangefs/super.c | 3 +- include/linux/fsnotify.h | 8 +- include/linux/sunrpc/clnt.h | 1 + include/linux/tcp.h | 2 +- include/uapi/linux/tcp.h | 10 +- kernel/exit.c | 2 + mm/page-writeback.c | 2 +- net/ceph/mon_client.c | 14 ++- net/ipv4/inet_diag.c | 2 + net/ipv4/tcp.c | 2 + net/ipv4/tcp_fastopen.c | 5 +- net/ipv4/tcp_input.c | 112 ++++++++++---------- net/ipv4/tcp_metrics.c | 1 + net/ipv4/tcp_timer.c | 45 +++++++- net/ipv4/udp.c | 4 +- net/sctp/socket.c | 7 +- net/sunrpc/clnt.c | 5 +- sound/pci/hda/patch_realtek.c | 11 ++ tools/testing/selftests/net/msg_zerocopy.c | 14 ++- 72 files changed, 590 insertions(+), 252 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/78 drm/lima: fix shared irq handling on driver remove
5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erico Nunes <[email protected]>
[ Upstream commit a6683c690bbfd1f371510cb051e8fa49507f3f5e ]
lima uses a shared interrupt, so the interrupt handlers must be prepared to be called at any time. At driver removal time, the clocks are disabled early and the interrupts stay registered until the very end of the remove process due to the devm usage.
This is potentially a bug as the interrupts access device registers which assumes clocks are enabled. A crash can be triggered by removing the driver in a kernel with CONFIG_DEBUG_SHIRQ enabled.
This patch frees the interrupts at each lima device finishing callback so that the handlers are already unregistered by the time we fully disable clocks.
--- drivers/gpu/drm/lima/lima_gp.c | 2 ++ drivers/gpu/drm/lima/lima_mmu.c | 5 +++++ drivers/gpu/drm/lima/lima_pp.c | 4 ++++ 3 files changed, 11 insertions(+)
drivers/gpu/drm/lima/lima_gp.c +2 -0
@@ -244,7 +244,9 @@ int lima_gp_init(struct lima_ip *ip)void lima_gp_fini (struct lima_ip *ip) { +struct lima_device *dev = ip->dev; +devm_free_irq (dev->dev, ip->irq, ip); }int lima_gp_pipe_init (struct lima_device *dev)
drivers/gpu/drm/lima/lima_mmu.c +5 -0
@@ -97,7 +97,12 @@ int lima_mmu_init(struct lima_ip *ip)void lima_mmu_fini (struct lima_ip *ip) { +struct lima_device *dev = ip->dev; + +if (ip->id == lima_ip_ppmmu_bcast) +return ; +devm_free_irq (dev->dev, ip->irq, ip); }void lima_mmu_switch_vm (struct lima_ip *ip,struct lima_vm *vm)
drivers/gpu/drm/lima/lima_pp.c +4 -0
@@ -251,7 +251,9 @@ int lima_pp_init(struct lima_ip *ip)void lima_pp_fini (struct lima_ip *ip) { +struct lima_device *dev = ip->dev; +devm_free_irq (dev->dev, ip->irq, ip); }int lima_pp_bcast_init (struct lima_ip *ip)
@@ -272,7 +274,9 @@ int lima_pp_bcast_init(struct lima_ip *ip)void lima_pp_bcast_fini (struct lima_ip *ip) { +struct lima_device *dev = ip->dev; +devm_free_irq (dev->dev, ip->irq, ip); } static int lima_pp_task_validate(struct lima_sched_pipe *pipe,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/78 media: dvb: as102-fe: Fix as10x_register_addr packing
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 309422d280748c74f57f471559980268ac27732a ]
This structure is embedded in multiple other structures that are packed, which conflicts with it being aligned.
drivers/media/usb/as102/as10x_cmd.h:379:30: warning: field reg_addr within 'struct as10x_dump_memory::(unnamed at drivers/media/usb/as102/as10x_cmd.h:373:2)' is less aligned than 'struct as10x_register_addr' and is usually due to 'struct as10x_dump_memory::(unnamed at drivers/media/usb/as102/as10x_cmd.h:373:2)' being packed, which can lead to unaligned accesses [-Wunaligned-access]
Mark it as being packed.
Marking the inner struct as 'packed' does not change the layout, since the whole struct is already packed, it just silences the clang warning. See also this llvm discussion:
https://github.com/llvm/llvm-project/issues/55520
--- drivers/media/dvb-frontends/as102_fe_types.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/dvb-frontends/as102_fe_types.h +1 -1
@@ -174,6 +174,6 @@ struct as10x_register_addr {uint32_t addr;/* register mode access */ uint8_t mode; -}; +} __packed;#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/78 media: dvb-usb: dib0700_devices: Add missing release_firmware()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 4b267c23ee064bd24c6933df0588ad1b6e111145 ]
Add missing release_firmware on the error paths.
drivers/media/usb/dvb-usb/dib0700_devices.c:2415 stk9090m_frontend_attach() warn: 'state->frontend_firmware' from request_firmware() not released on lines: 2415. drivers/media/usb/dvb-usb/dib0700_devices.c:2497 nim9090md_frontend_attach() warn: 'state->frontend_firmware' from request_firmware() not released on lines: 2489,2497.
--- drivers/media/usb/dvb-usb/dib0700_devices.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
drivers/media/usb/dvb-usb/dib0700_devices.c +15 -3
@@ -2424,7 +2424,12 @@ static int stk9090m_frontend_attach(struct dvb_usb_adapter *adap) adap->fe_adap[0 ].fe =dvb_attach (dib9000_attach, &adap->dev->i2c_adap,0x80 , &stk9090m_config); -return adap->fe_adap[0 ].fe ==NULL ? -ENODEV :0 ; +if (!adap->fe_adap[0 ].fe) { +release_firmware (state->frontend_firmware); +return -ENODEV ; + } + +return 0 ; }static int dib9090_tuner_attach (struct dvb_usb_adapter *adap)
@@ -2497,8 +2502,10 @@ static int nim9090md_frontend_attach(struct dvb_usb_adapter *adap)dib9000_i2c_enumeration (&adap->dev->i2c_adap,1 ,0x20 ,0x80 ); adap->fe_adap[0 ].fe =dvb_attach (dib9000_attach, &adap->dev->i2c_adap,0x80 , &nim9090md_config[0 ]); -if (adap->fe_adap[0 ].fe ==NULL ) +if (!adap->fe_adap[0 ].fe) { +release_firmware (state->frontend_firmware);return -ENODEV ; + } i2c =dib9000_get_i2c_master (adap->fe_adap[0 ].fe,DIBX000_I2C_INTERFACE_GPIO_3_4 ,0 );dib9000_i2c_enumeration (i2c,1 ,0x12 ,0x82 );
@@ -2506,7 +2513,12 @@ static int nim9090md_frontend_attach(struct dvb_usb_adapter *adap) fe_slave =dvb_attach (dib9000_attach, i2c,0x82 , &nim9090md_config[1 ]);dib9000_set_slave_frontend (adap->fe_adap[0 ].fe, fe_slave); -return fe_slave ==NULL ? -ENODEV :0 ; +if (!fe_slave) { +release_firmware (state->frontend_firmware); +return -ENODEV ; + } + +return 0 ; }static int nim9090md_tuner_attach (struct dvb_usb_adapter *adap)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/78 IB/core: Implement a limit on UMAD receive List
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Guralnik <[email protected]>
[ Upstream commit ca0b44e20a6f3032224599f02e7c8fb49525c894 ]
The existing behavior of ib_umad, which maintains received MAD packets in an unbounded list, poses a risk of uncontrolled growth. As user-space applications extract packets from this list, the rate of extraction may not match the rate of incoming packets, leading to potential list overflow.
To address this, we introduce a limit to the size of the list. After considering typical scenarios, such as OpenSM processing, which can handle approximately 100k packets per second, and the 1-second retry timeout for most packets, we set the list size limit to 200k. Packets received beyond this limit are dropped, assuming they are likely timed out by the time they are handled by user-space.
Notably, packets queued on the receive list due to reasons like timed-out sends are preserved even when the list is full.
--- drivers/infiniband/core/user_mad.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-)
drivers/infiniband/core/user_mad.c +15 -6
@@ -63,6 +63,8 @@ MODULE_AUTHOR("Roland Dreier");MODULE_DESCRIPTION ("InfiniBand userspace MAD packet access" );MODULE_LICENSE ("Dual BSD/GPL" ); +#define MAX_UMAD_RECV_LIST_SIZE 200000 +enum {IB_UMAD_MAX_PORTS =RDMA_MAX_PORTS ,IB_UMAD_MAX_AGENTS =32 ,
@@ -113,6 +115,7 @@ struct ib_umad_file {struct mutex mutex;struct ib_umad_port *port;struct list_head recv_list; +atomic_t recv_list_size;struct list_head send_list;struct list_head port_list;spinlock_t send_lock;
@@ -180,24 +183,28 @@ static struct ib_mad_agent *__get_agent(struct ib_umad_file *file, int id)return file->agents_dead ?NULL : file->agent[id]; } -static int queue_packet (struct ib_umad_file *file, -struct ib_mad_agent *agent, -struct ib_umad_packet *packet) +static int queue_packet (struct ib_umad_file *file,struct ib_mad_agent *agent, +struct ib_umad_packet *packet,bool is_recv_mad) {int ret =1 ;mutex_lock (&file->mutex); +if (is_recv_mad && +atomic_read (&file->recv_list_size) >MAX_UMAD_RECV_LIST_SIZE ) + goto unlock; +for (packet->mad.hdr.id =0 ; packet->mad.hdr.id <IB_UMAD_MAX_AGENTS ; packet->mad.hdr.id++)if (agent ==__get_agent (file, packet->mad.hdr.id)) {list_add_tail (&packet->list, &file->recv_list); +atomic_inc (&file->recv_list_size);wake_up_interruptible (&file->recv_wait); ret =0 ;break ; } - +unlock:mutex_unlock (&file->mutex);return ret;
@@ -224,7 +231,7 @@ static void send_handler(struct ib_mad_agent *agent,if (send_wc->status ==IB_WC_RESP_TIMEOUT_ERR ) { packet->length =IB_MGMT_MAD_HDR ; packet->mad.hdr.status =ETIMEDOUT ; -if (!queue_packet (file, agent, packet)) +if (!queue_packet (file, agent, packet, false))return ; }kfree (packet);
@@ -284,7 +291,7 @@ static void recv_handler(struct ib_mad_agent *agent,rdma_destroy_ah_attr (&ah_attr); } -if (queue_packet (file, agent, packet)) +if (queue_packet (file, agent, packet, true)) goto err2;return ;
@@ -409,6 +416,7 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf, packet = list_entry(file->recv_list.next, struct ib_umad_packet, list);list_del (&packet->list); +atomic_dec (&file->recv_list_size);mutex_unlock (&file->mutex);
@@ -421,6 +429,7 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf,/* Requeue packet */ mutex_lock (&file->mutex);list_add (&packet->list, &file->recv_list); +atomic_inc (&file->recv_list_size);mutex_unlock (&file->mutex); }else {if (packet->recv_wc)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/78 scsi: qedf: Make qedf_execute_tmf() non-preemptible
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Meneghini <[email protected]>
[ Upstream commit 0d8b637c9c5eeaa1a4e3dfb336f3ff918eb64fec ]
Stop calling smp_processor_id() from preemptible code in qedf_execute_tmf90. This results in BUG_ON() when running an RT kernel.
[ 659.343280] BUG: using smp_processor_id() in preemptible [00000000] code: sg_reset/3646 [ 659.343282] caller is qedf_execute_tmf+0x8b/0x360 [qedf]
--- drivers/scsi/qedf/qedf_io.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/scsi/qedf/qedf_io.c +3 -3
@@ -2330,9 +2330,6 @@ static int qedf_execute_tmf(struct qedf_rport *fcport, struct scsi_cmnd *sc_cmd, io_req->fcport = fcport; io_req->cmd_type =QEDF_TASK_MGMT_CMD ; -/* Record which cpu this request is associated with */ - io_req->cpu =smp_processor_id (); -/* Set TM flags */ io_req->io_req_flags =QEDF_READ ; io_req->data_xfer_len =0 ;
@@ -2354,6 +2351,9 @@ static int qedf_execute_tmf(struct qedf_rport *fcport, struct scsi_cmnd *sc_cmd,spin_lock_irqsave (&fcport->rport_lock, flags); +/* Record which cpu this request is associated with */ + io_req->cpu =smp_processor_id (); + sqe_idx =qedf_get_sqe_idx (fcport); sqe = &fcport->sq[sqe_idx];memset (sqe,0 ,sizeof (struct fcoe_wqe ));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/78 drm/amdgpu: Initialize timestamp for some legacy SOCs
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit 2e55bcf3d742a4946d862b86e39e75a95cc6f1c0 ]
Initialize the interrupt timestamp for some legacy SOCs to fix the coverity issue "Uninitialized scalar variable"
--- drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c +8 -0
@@ -384,6 +384,14 @@ void amdgpu_irq_dispatch(struct amdgpu_device *adev,int r; entry.iv_entry = (const uint32_t *)&ih->ring[ring_index]; + +/* +* timestamp is not supported on some legacy SOCs (cik, cz, iceland, +* si and tonga), so initialize timestamp and timestamp_src to 0 +*/ + entry.timestamp =0 ; + entry.timestamp_src =0 ; +amdgpu_ih_decode_iv (adev, &entry);trace_amdgpu_iv (ih - &adev->irq.ih, &entry);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/78 drm/amd/display: Skip finding free audio for unknown engine_id
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 1357b2165d9ad94faa4c4a20d5e2ce29c2ff29c3 ]
[WHY]ENGINE_ID_UNKNOWN = -1 and can not be used as an array index. Plus, it also means it is uninitialized and does not need free audio.
[HOW]
Skip and return NULL.
This fixes 2 OVERRUN issues reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +3 -0
@@ -1646,6 +1646,9 @@ static struct audio *find_first_free_audio( {int i, available_audio_count; +if (id ==ENGINE_ID_UNKNOWN ) +return NULL ; + available_audio_count = pool->audio_count;for (i =0 ; i < available_audio_count; i++) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/78 media: dw2102: Dont translate i2c read into write
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bunk <[email protected]>
[ Upstream commit 0e148a522b8453115038193e19ec7bea71403e4a ]
The code ignored the I2C_M_RD flag on I2C messages. Instead it assumed an i2c transaction with a single message must be a write operation and a transaction with two messages would be a read operation.
Though this works for the driver code, it leads to problems once the i2c device is exposed to code not knowing this convention. For example, I did "insmod i2c-dev" and issued read requests from userspace, which were translated into write requests and destroyed the EEPROM of my device.
So, just check and respect the I2C_M_READ flag, which indicates a read when set on a message. If it is absent, it is a write message.
Incidentally, changing from the case statement to a while loop allows the code to lift the limitation to two i2c messages per transaction.
There are 4 more *_i2c_transfer functions affected by the same behaviour and limitation that should be fixed in the same way.
--- drivers/media/usb/dvb-usb/dw2102.c | 120 ++++++++++++++++++----------- 1 file changed, 73 insertions(+), 47 deletions(-)
drivers/media/usb/dvb-usb/dw2102.c +73 -47
@@ -716,6 +716,7 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], {struct dvb_usb_device *d =i2c_get_adapdata (adap);struct dw2102_state *state; +int j;if (!d)return -ENODEV ;
@@ -729,11 +730,11 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],return -EAGAIN ; } -switch (num) { -case 1 : -switch (msg[0 ].addr) { + j =0 ; +while (j < num) { +switch (msg[j].addr) {case SU3000_STREAM_CTRL : - state->data[0 ] = msg[0 ].buf[0 ] +0x36 ; + state->data[0 ] = msg[j].buf[0 ] +0x36 ; state->data[1 ] =3 ; state->data[2 ] =0 ; if (dvb_usb_generic_rw(d, state->data, 3,
@@ -745,61 +746,86 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],if (dvb_usb_generic_rw (d, state->data,1 , state->data,2 ,0 ) <0 )err ("i2c transfer failed." ); - msg[0 ].buf[1 ] = state->data[0 ]; - msg[0 ].buf[0 ] = state->data[1 ]; + msg[j].buf[1 ] = state->data[0 ]; + msg[j].buf[0 ] = state->data[1 ];break ;default : -if (3 + msg[0 ].len >sizeof (state->data)) { -warn ("i2c wr: len=%d is too big!\n" , - msg[0 ].len); +/* if the current write msg is followed by a another +* read msg to/from the same address +*/ +if ((j+1 < num) && (msg[j+1 ].flags &I2C_M_RD ) && + (msg[j].addr == msg[j+1 ].addr)) { +/* join both i2c msgs to one usb read command */ +if (4 + msg[j].len >sizeof (state->data)) { +warn ("i2c combined wr/rd: write len=%d is too big!\n" , + msg[j].len); + num = -EOPNOTSUPP ; +break ; + } +if (1 + msg[j+1 ].len >sizeof (state->data)) { +warn ("i2c combined wr/rd: read len=%d is too big!\n" , + msg[j+1 ].len); + num = -EOPNOTSUPP ; +break ; + } + + state->data[0 ] =0x09 ; + state->data[1 ] = msg[j].len; + state->data[2 ] = msg[j+1 ].len; + state->data[3 ] = msg[j].addr; +memcpy (&state->data[4 ], msg[j].buf, msg[j].len); + +if (dvb_usb_generic_rw (d, state->data, msg[j].len +4 , + state->data, msg[j+1 ].len +1 ,0 ) <0 ) +err ("i2c transfer failed." ); + +memcpy (msg[j+1 ].buf, &state->data[1 ], msg[j+1 ].len); + j++; +break ; + } + +if (msg[j].flags &I2C_M_RD ) { +/* single read */ +if (1 + msg[j].len >sizeof (state->data)) { +warn ("i2c rd: len=%d is too big!\n" , msg[j].len); + num = -EOPNOTSUPP ; +break ; + } + + state->data[0 ] =0x09 ; + state->data[1 ] =0 ; + state->data[2 ] = msg[j].len; + state->data[3 ] = msg[j].addr; +memcpy (&state->data[4 ], msg[j].buf, msg[j].len); + +if (dvb_usb_generic_rw (d, state->data,4 , + state->data, msg[j].len +1 ,0 ) <0 ) +err ("i2c transfer failed." ); + +memcpy (msg[j].buf, &state->data[1 ], msg[j].len); +break ; + } + +/* single write */ +if (3 + msg[j].len >sizeof (state->data)) { +warn ("i2c wr: len=%d is too big!\n" , msg[j].len); num = -EOPNOTSUPP ;break ; } -/* always i2c write*/ state->data[0 ] =0x08 ; - state->data[1 ] = msg[0 ].addr; - state->data[2 ] = msg[0 ].len; + state->data[1 ] = msg[j].addr; + state->data[2 ] = msg[j].len; -memcpy (&state->data[3 ], msg[0 ].buf, msg[0 ].len); +memcpy (&state->data[3 ], msg[j].buf, msg[j].len); -if (dvb_usb_generic_rw (d, state->data, msg[0 ].len +3 , +if (dvb_usb_generic_rw (d, state->data, msg[j].len +3 , state->data,1 ,0 ) <0 )err ("i2c transfer failed." ); + }// switch + j++; - } -break ; -case 2 : -/* always i2c read */ -if (4 + msg[0 ].len >sizeof (state->data)) { -warn ("i2c rd: len=%d is too big!\n" , - msg[0 ].len); - num = -EOPNOTSUPP ; -break ; - } -if (1 + msg[1 ].len >sizeof (state->data)) { -warn ("i2c rd: len=%d is too big!\n" , - msg[1 ].len); - num = -EOPNOTSUPP ; -break ; - } - - state->data[0 ] =0x09 ; - state->data[1 ] = msg[0 ].len; - state->data[2 ] = msg[1 ].len; - state->data[3 ] = msg[0 ].addr; -memcpy (&state->data[4 ], msg[0 ].buf, msg[0 ].len); - -if (dvb_usb_generic_rw (d, state->data, msg[0 ].len +4 , - state->data, msg[1 ].len +1 ,0 ) <0 ) -err ("i2c transfer failed." ); - -memcpy (msg[1 ].buf, &state->data[1 ], msg[1 ].len); -break ; -default : -warn ("more than 2 i2c messages at a time is not handled yet." ); -break ; - } + }// while mutex_unlock (&d->data_mutex);mutex_unlock (&d->i2c_mutex);return num;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/78 sctp: prefer struct_size over open coded arithmetic
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erick Archer <[email protected]>
[ Upstream commit e5c5f3596de224422561d48eba6ece5210d967b3 ]
This is an effort to get rid of all multiplications from allocation functions in order to prevent integer overflows [1][2].
As the "ids" variable is a pointer to "struct sctp_assoc_ids" and this structure ends in a flexible array:
struct sctp_assoc_ids {
[...]
sctp_assoc_t gaids_assoc_id[];
};the preferred way in the kernel is to use the struct_size() helper to do the arithmetic instead of the calculation "size + size * count" in the kmalloc() function.
Also, refactor the code adding the "ids_size" variable to avoid sizing twice.
This way, the code is more readable and safer.
This code was detected with the help of Coccinelle, and audited and modified manually.
--- net/sctp/socket.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/sctp/socket.c +4 -3
@@ -7158,6 +7158,7 @@ static int sctp_getsockopt_assoc_ids(struct sock *sk, int len,struct sctp_sock *sp =sctp_sk (sk);struct sctp_association *asoc;struct sctp_assoc_ids *ids; +size_t ids_size;u32 num =0 ;if (sctp_style (sk,TCP ))
@@ -7170,11 +7171,11 @@ static int sctp_getsockopt_assoc_ids(struct sock *sk, int len, num++; } -if (len <sizeof (struct sctp_assoc_ids ) +sizeof (sctp_assoc_t) * num) + ids_size =struct_size (ids, gaids_assoc_id, num); +if (len < ids_size)return -EINVAL ; - len =sizeof (struct sctp_assoc_ids ) +sizeof (sctp_assoc_t) * num; - + len = ids_size; ids =kmalloc (len,GFP_USER | __GFP_NOWARN);if (unlikely (!ids))return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/78 firmware: dmi: Stop decoding on broken entry
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean Delvare <[email protected]>
[ Upstream commit 0ef11f604503b1862a21597436283f158114d77e ]
If a DMI table entry is shorter than 4 bytes, it is invalid. Due to how DMI table parsing works, it is impossible to safely recover from such an error, so we have to stop decoding the table.
--- drivers/firmware/dmi_scan.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/firmware/dmi_scan.c +11 -0
@@ -96,6 +96,17 @@ static void dmi_decode_table(u8 *buf, (data - buf + sizeof(struct dmi_header)) <= dmi_len) {const struct dmi_header *dm = (const struct dmi_header *)data; +/* +* If a short entry is found (less than 4 bytes), not only it +* is invalid, but we cannot reliably locate the next entry. +*/ +if (dm->length <sizeof (struct dmi_header )) { +pr_warn (FW_BUG +"Corrupted DMI table, offset %zd (only %d entries processed)\n" , + data - buf, i); +break ; + } +/* * We want to know the total length (formatted area and * strings) before decoding to make sure we won't run off the
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/78 Input: ff-core - prefer struct_size over open coded arithmetic
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erick Archer <[email protected]>
[ Upstream commit a08b8f8557ad88ffdff8905e5da972afe52e3307 ]
This is an effort to get rid of all multiplications from allocation functions in order to prevent integer overflows [1][2].
As the "ff" variable is a pointer to "struct ff_device" and this structure ends in a flexible array:
struct ff_device {
[...]
struct file *effect_owners[] __counted_by(max_effects);
};the preferred way in the kernel is to use the struct_size() helper to do the arithmetic instead of the calculation "size + count * size" in the kzalloc() function.
The struct_size() helper returns SIZE_MAX on overflow. So, refactor the comparison to take advantage of this.
This way, the code is more readable and safer.
This code was detected with the help of Coccinelle, and audited and modified manually.
--- drivers/input/ff-core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/input/ff-core.c +4 -3
@@ -12,8 +12,10 @@/* #define DEBUG */ #include <linux/input.h> +#include <linux/limits.h> #include <linux/module.h> #include <linux/mutex.h> +#include <linux/overflow.h> #include <linux/sched.h> #include <linux/slab.h>
@@ -318,9 +320,8 @@ int input_ff_create(struct input_dev *dev, unsigned int max_effects)return -EINVAL ; } - ff_dev_size =sizeof (struct ff_device ) + - max_effects *sizeof (struct file *); -if (ff_dev_size < max_effects)/* overflow */ + ff_dev_size =struct_size (ff, effect_owners, max_effects); +if (ff_dev_size ==SIZE_MAX )/* overflow */ return -EINVAL ; ff =kzalloc (ff_dev_size,GFP_KERNEL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/78 net: dsa: mv88e6xxx: Correct check for empty list
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit 4c7f3950a9fd53a62b156c0fe7c3a2c43b0ba19b ]
Since commit a3c53be55c95 ("net: dsa: mv88e6xxx: Support multiple MDIO busses") mv88e6xxx_default_mdio_bus() has checked that the return value of list_first_entry() is non-NULL.
This appears to be intended to guard against the list chip->mdios being empty. However, it is not the correct check as the implementation of list_first_entry is not designed to return NULL for empty lists.
Instead, use list_first_entry_or_null() which does return NULL if the list is empty.
Flagged by Smatch.
Compile tested only.
--- drivers/net/dsa/mv88e6xxx/chip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/dsa/mv88e6xxx/chip.c +2 -2
@@ -115,8 +115,8 @@ struct mii_bus *mv88e6xxx_default_mdio_bus(struct mv88e6xxx_chip *chip) {struct mv88e6xxx_mdio_bus *mdio_bus; - mdio_bus = list_first_entry(&chip->mdios, struct mv88e6xxx_mdio_bus, - list); + mdio_bus =list_first_entry_or_null (&chip->mdios, + struct mv88e6xxx_mdio_bus, list);if (!mdio_bus)return NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/78 media: dvb-frontends: tda18271c2dd: Remove casting during div
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit e9a844632630e18ed0671a7e3467431bd719952e ]
do_div() divides 64 bits by 32. We were adding a casting to the divider to 64 bits, for a number that fits perfectly in 32 bits. Remove it.
Found by cocci:
drivers/media/dvb-frontends/tda18271c2dd.c:355:1-7: WARNING: do_div() does a 64-by-32 division, please consider using div64_u64 instead. drivers/media/dvb-frontends/tda18271c2dd.c:331:1-7: WARNING: do_div() does a 64-by-32 division, please consider using div64_u64 instead.
--- drivers/media/dvb-frontends/tda18271c2dd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/dvb-frontends/tda18271c2dd.c +2 -2
@@ -331,7 +331,7 @@ static int CalcMainPLL(struct tda_state *state, u32 freq) OscFreq = (u64 ) freq * (u64 ) Div; OscFreq *= (u64 )16384 ; -do_div (OscFreq, (u64 )16000000 ); +do_div (OscFreq,16000000 ); MainDiv = OscFreq; state->m_Regs[MPD ] = PostDiv &0x77 ;
@@ -355,7 +355,7 @@ static int CalcCalPLL(struct tda_state *state, u32 freq) OscFreq = (u64 )freq * (u64 )Div;/* CalDiv = u32( OscFreq * 16384 / 16000000 ); */ OscFreq *= (u64 )16384 ; -do_div (OscFreq, (u64 )16000000 ); +do_div (OscFreq,16000000 ); CalDiv = OscFreq; state->m_Regs[CPD ] = PostDiv;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/78 media: s2255: Use refcount_t instead of atomic_t for num_channels
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 6cff72f6bcee89228a662435b7c47e21a391c8d0 ]
Use an API that resembles more the actual use of num_channels.
Found by cocci:
drivers/media/usb/s2255/s2255drv.c:2362:5-24: WARNING: atomic_dec_and_test variation before object free at line 2363. drivers/media/usb/s2255/s2255drv.c:1557:5-24: WARNING: atomic_dec_and_test variation before object free at line 1558.
--- drivers/media/usb/s2255/s2255drv.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
drivers/media/usb/s2255/s2255drv.c +10 -10
@@ -247,7 +247,7 @@ struct s2255_vc {struct s2255_dev {struct s2255_vc vc[MAX_CHANNELS ];struct v4l2_device v4l2_dev; -atomic_t num_channels; +refcount_t num_channels;int frames;struct mutex lock;/* channels[].vdev.lock */ struct mutex cmdlock;/* protects cmdbuf */
@@ -1552,11 +1552,11 @@ static void s2255_video_device_release(struct video_device *vdev) container_of(vdev, struct s2255_vc, vdev);dprintk (dev,4 ,"%s, chnls: %d\n" , __func__, -atomic_read (&dev->num_channels)); +refcount_read (&dev->num_channels));v4l2_ctrl_handler_free (&vc->hdl); -if (atomic_dec_and_test (&dev->num_channels)) +if (refcount_dec_and_test (&dev->num_channels))s2255_destroy (dev);return ; }
@@ -1661,7 +1661,7 @@ static int s2255_probe_v4l(struct s2255_dev *dev) "failed to register video device!\n");break ; } -atomic_inc (&dev->num_channels); +refcount_inc (&dev->num_channels);v4l2_info (&dev->v4l2_dev,"V4L2 device registered as %s\n" ,video_device_node_name (&vc->vdev));
@@ -1669,11 +1669,11 @@ static int s2255_probe_v4l(struct s2255_dev *dev)pr_info ("Sensoray 2255 V4L driver Revision: %s\n" ,S2255_VERSION );/* if no channels registered, return error and probe will fail*/ -if (atomic_read (&dev->num_channels) ==0 ) { +if (refcount_read (&dev->num_channels) ==0 ) {v4l2_device_unregister (&dev->v4l2_dev);return ret; } -if (atomic_read (&dev->num_channels) !=MAX_CHANNELS ) +if (refcount_read (&dev->num_channels) !=MAX_CHANNELS )pr_warn ("s2255: Not all channels available.\n" );return 0 ; }
@@ -2222,7 +2222,7 @@ static int s2255_probe(struct usb_interface *interface, goto errorFWDATA1; } -atomic_set (&dev->num_channels,0 ); +refcount_set (&dev->num_channels,0 ); dev->pid = id->idProduct; dev->fw_data =kzalloc (sizeof (struct s2255_fw ),GFP_KERNEL );if (!dev->fw_data)
@@ -2342,12 +2342,12 @@ static void s2255_disconnect(struct usb_interface *interface) {struct s2255_dev *dev =to_s2255_dev (usb_get_intfdata (interface));int i; -int channels =atomic_read (&dev->num_channels); +int channels =refcount_read (&dev->num_channels);mutex_lock (&dev->lock);v4l2_device_disconnect (&dev->v4l2_dev);mutex_unlock (&dev->lock);/*see comments in the uvc_driver.c usb disconnect function */ -atomic_inc (&dev->num_channels); +refcount_inc (&dev->num_channels);/* unregister each video device. */ for (i =0 ; i < channels; i++)video_unregister_device (&dev->vc[i].vdev);
@@ -2360,7 +2360,7 @@ static void s2255_disconnect(struct usb_interface *interface) dev->vc[i].vidstatus_ready =1 ;wake_up (&dev->vc[i].wait_vidstatus); } -if (atomic_dec_and_test (&dev->num_channels)) +if (refcount_dec_and_test (&dev->num_channels))s2255_destroy (dev);dev_info (&interface->dev,"%s\n" , __func__); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/78 media: dvb-frontends: tda10048: Fix integer overflow
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 1aa1329a67cc214c3b7bd2a14d1301a795760b07 ]
state->xtal_hz can be up to 16M, so it can overflow a 32 bit integer when multiplied by pll_mfactor.
Create a new 64 bit variable to hold the calculations.
--- drivers/media/dvb-frontends/tda10048.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/media/dvb-frontends/tda10048.c +6 -3
@@ -410,6 +410,7 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw)struct tda10048_config *config = &state->config;int i;u32 if_freq_khz; +u64 sample_freq;dprintk (1 ,"%s(bw = %d)\n" , __func__, bw);
@@ -451,9 +452,11 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw)dprintk (1 ,"- pll_pfactor = %d\n" , state->pll_pfactor);/* Calculate the sample frequency */ - state->sample_freq = state->xtal_hz * (state->pll_mfactor +45 ); - state->sample_freq /= (state->pll_nfactor +1 ); - state->sample_freq /= (state->pll_pfactor +4 ); + sample_freq = state->xtal_hz; + sample_freq *= state->pll_mfactor +45 ; +do_div (sample_freq, state->pll_nfactor +1 ); +do_div (sample_freq, state->pll_pfactor +4 ); + state->sample_freq = sample_freq;dprintk (1 ,"- sample_freq = %d\n" , state->sample_freq);/* Update the I/F */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/78 i2c: i801: Annotate apanel_addr as __ro_after_init
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
[ Upstream commit 355b1513b1e97b6cef84b786c6480325dfd3753d ]
Annotate this variable as __ro_after_init to protect it from being overwritten later.
--- drivers/i2c/busses/i2c-i801.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-i801.c +1 -1
@@ -1057,7 +1057,7 @@ static const struct pci_device_id i801_ids[] = {MODULE_DEVICE_TABLE (pci, i801_ids);#if definedCONFIG_X86 && definedCONFIG_DMI -static unsigned char apanel_addr; +static unsigned char apanel_addr__ro_after_init ;/* Scan the system ROM for the signature "FJKEYINF" */ static __init const void __iomem *bios_signature (const void __iomem *bios)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/78 powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit be140f1732b523947425aaafbe2e37b41b622d96 ]
There is code that builds with calls to IO accessors even when CONFIG_PCI=n, but the actual calls are guarded by runtime checks.
If not those calls would be faulting, because the page at virtual address zero is (usually) not mapped into the kernel. As Arnd pointed out, it is possible a large port value could cause the address to be above mmap_min_addr which would then access userspace, which would be a bug.
To avoid any such issues, set _IO_BASE to POISON_POINTER_DELTA. That is a value chosen to point into unmapped space between the kernel and userspace, so any access will always fault.
Note that on 32-bit POISON_POINTER_DELTA is 0, so the patch only has an effect on 64-bit.
--- arch/powerpc/include/asm/io.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/include/asm/io.h +1 -1
@@ -46,7 +46,7 @@ extern struct pci_dev *isa_bridge_pcidev;* define properly based on the platform */ #ifndef CONFIG_PCI -#define _IO_BASE 0 +#define _IO_BASE POISON_POINTER_DELTA#define _ISA_MEM_BASE 0#define PCI_DRAM_OFFSET 0#elif defined(CONFIG_PPC32 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/78 orangefs: fix out-of-bounds fsid access
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marshall <[email protected]>
[ Upstream commit 53e4efa470d5fc6a96662d2d3322cfc925818517 ]
Arnd Bergmann sent a patch to fsdevel, he says:
"orangefs_statfs() copies two consecutive fields of the superblock into the statfs structure, which triggers a warning from the string fortification helpers"
Jan Kara suggested an alternate way to do the patch to make it more readable.
I ran both ideas through xfstests and both seem fine. This patch is based on Jan Kara's suggestion.
--- fs/orangefs/super.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/orangefs/super.c +2 -1
@@ -200,7 +200,8 @@ static int orangefs_statfs(struct dentry *dentry, struct kstatfs *buf) (long)new_op->downcall.resp.statfs.files_avail); buf->f_type = sb->s_magic; -memcpy (&buf->f_fsid, &ORANGEFS_SB (sb)->fs_id,sizeof (buf->f_fsid)); + buf->f_fsid.val[0 ] =ORANGEFS_SB (sb)->fs_id; + buf->f_fsid.val[1 ] =ORANGEFS_SB (sb)->id; buf->f_bsize = new_op->downcall.resp.statfs.block_size; buf->f_namelen =ORANGEFS_NAME_MAX ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/78 powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kurz <[email protected]>
[ Upstream commit 8873aab8646194a4446117bb617cc71bddda2dee ]
All these commands end up peeking into the PACA using the user originated cpu id as an index. Check the cpu id is valid in order to prevent xmon to crash. Instead of printing an error, this follows the same behavior as the "lp s #" command : ignore the buggy cpu id parameter and fall back to the #-less version of the command.
--- arch/powerpc/xmon/xmon.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/powerpc/xmon/xmon.c +3 -3
@@ -1214,7 +1214,7 @@ static int cpu_cmd(void)unsigned long cpu, first_cpu, last_cpu;int timeout; -if (!scanhex (&cpu)) { +if (!scanhex (&cpu) || cpu >=num_possible_cpus ()) {/* print cpus waiting or in xmon */ printf ("cpus stopped:" ); last_cpu = first_cpu =NR_CPUS ;
@@ -2571,7 +2571,7 @@ static void dump_pacas(void) termch = c;/* Put c back, it wasn't 'a' */ -if (scanhex (&num)) +if (scanhex (&num) && num <num_possible_cpus ())dump_one_paca (num);else dump_one_paca (xmon_owner);
@@ -2668,7 +2668,7 @@ static void dump_xives(void) termch = c;/* Put c back, it wasn't 'a' */ -if (scanhex (&num)) +if (scanhex (&num) && num <num_possible_cpus ())dump_one_xive (num);else dump_one_xive (xmon_owner);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/78 jffs2: Fix potential illegal address access in jffs2_free_inode
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Yong <[email protected]>
[ Upstream commit af9a8730ddb6a4b2edd779ccc0aceb994d616830 ]
During the stress testing of the jffs2 file system,the following abnormal printouts were found:
[ 2430.649000] Unable to handle kernel paging request at virtual address 0069696969696948 [ 2430.649622] Mem abort info: [ 2430.649829] ESR = 0x96000004 [ 2430.650115] EC = 0x25: DABT (current EL), IL = 32 bits [ 2430.650564] SET = 0, FnV = 0 [ 2430.650795] EA = 0, S1PTW = 0 [ 2430.651032] FSC = 0x04: level 0 translation fault [ 2430.651446] Data abort info: [ 2430.651683] ISV = 0, ISS = 0x00000004 [ 2430.652001] CM = 0, WnR = 0 [ 2430.652558] [0069696969696948] address between user and kernel address ranges [ 2430.653265] Internal error: Oops: 96000004 [#1] PREEMPT SMP [ 2430.654512] CPU: 2 PID: 20919 Comm: cat Not tainted 5.15.25-g512f31242bf6 #33 [ 2430.655008] Hardware name: linux,dummy-virt (DT) [ 2430.655517] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 2430.656142] pc : kfree+0x78/0x348 [ 2430.656630] lr : jffs2_free_inode+0x24/0x48 [ 2430.657051] sp : ffff800009eebd10 [ 2430.657355] x29: ffff800009eebd10 x28: 0000000000000001 x27: 0000000000000000 [ 2430.658327] x26: ffff000038f09d80 x25: 0080000000000000 x24: ffff800009d38000 [ 2430.658919] x23: 5a5a5a5a5a5a5a5a x22: ffff000038f09d80 x21: ffff8000084f0d14 [ 2430.659434] x20: ffff0000bf9a6ac0 x19: 0169696969696940 x18: 0000000000000000 [ 2430.659969] x17: ffff8000b6506000 x16: ffff800009eec000 x15: 0000000000004000 [ 2430.660637] x14: 0000000000000000 x13: 00000001000820a1 x12: 00000000000d1b19 [ 2430.661345] x11: 0004000800000000 x10: 0000000000000001 x9 : ffff8000084f0d14 [ 2430.662025] x8 : ffff0000bf9a6b40 x7 : ffff0000bf9a6b48 x6 : 0000000003470302 [ 2430.662695] x5 : ffff00002e41dcc0 x4 : ffff0000bf9aa3b0 x3 : 0000000003470342 [ 2430.663486] x2 : 0000000000000000 x1 : ffff8000084f0d14 x0 : fffffc0000000000 [ 2430.664217] Call trace: [ 2430.664528] kfree+0x78/0x348 [ 2430.664855] jffs2_free_inode+0x24/0x48 [ 2430.665233] i_callback+0x24/0x50 [ 2430.665528] rcu_do_batch+0x1ac/0x448 [ 2430.665892] rcu_core+0x28c/0x3c8 [ 2430.666151] rcu_core_si+0x18/0x28 [ 2430.666473] __do_softirq+0x138/0x3cc [ 2430.666781] irq_exit+0xf0/0x110 [ 2430.667065] handle_domain_irq+0x6c/0x98 [ 2430.667447] gic_handle_irq+0xac/0xe8 [ 2430.667739] call_on_irq_stack+0x28/0x54
The parameter passed to kfree was 5a5a5a5a, which corresponds to the target field of the jffs_inode_info structure. It was found that all variables in the jffs_inode_info structure were 5a5a5a5a, except for the first member sem. It is suspected that these variables are not initialized because they were set to 5a5a5a5a during memory testing, which is meant to detect uninitialized memory.The sem variable is initialized in the function jffs2_i_init_once, while other members are initialized in
the function jffs2_init_inode_info.
The function jffs2_init_inode_info is called after iget_locked, but in the iget_locked function, the destroy_inode process is triggered, which releases the inode and consequently, the target member of the inode is not initialized.In concurrent high pressure scenarios, iget_locked may enter the destroy_inode branch as described in the code.
Since the destroy_inode functionality of jffs2 only releases the target, the fix method is to set target to NULL in jffs2_i_init_once.
--- fs/jffs2/super.c | 1 + 1 file changed, 1 insertion(+)
fs/jffs2/super.c +1 -0
@@ -58,6 +58,7 @@ static void jffs2_i_init_once(void *foo)struct jffs2_inode_info *f = foo;mutex_init (&f->sem); + f->target =NULL ;inode_init_once (&f->vfs_inode); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/78 s390/pkey: Wipe sensitive data on failure
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Holger Dengler <[email protected]>
[ Upstream commit 1d8c270de5eb74245d72325d285894a577a945d9 ]
Wipe sensitive data from stack also if the copy_to_user() fails.
--- drivers/s390/crypto/pkey_api.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/s390/crypto/pkey_api.c +2 -2
@@ -784,7 +784,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,if (rc)break ;if (copy_to_user (ucs, &kcs,sizeof (kcs))) -return -EFAULT ; + rc = -EFAULT ;memzero_explicit (&kcs,sizeof (kcs));break ; }
@@ -816,7 +816,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,if (rc)break ;if (copy_to_user (ucp, &kcp,sizeof (kcp))) -return -EFAULT ; + rc = -EFAULT ;memzero_explicit (&kcp,sizeof (kcp));break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/78 tcp: tcp_mark_head_lost is only valid for sack-tcp
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhang kai <[email protected]>
[ Upstream commit 636ef28d6e4d174e424102466caf572b0406fb0e ]
so tcp_is_sack/reno checks are removed from tcp_mark_head_lost.
Stable-dep-of: a6458ab7fd4f ("UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()")
--- net/ipv4/tcp_input.c | 32 +++++++------------------------- 1 file changed, 7 insertions(+), 25 deletions(-)
net/ipv4/tcp_input.c +7 -25
@@ -2202,8 +2202,7 @@ static bool tcp_time_to_recover(struct sock *sk, int flag) }/* Detect loss in event "A" above by marking head of queue up as lost. -* For non-SACK(Reno) senders, the first "packets" number of segments -* are considered lost. For RFC3517 SACK, a segment is considered lost if it +* For RFC3517 SACK, a segment is considered lost if it * has at least tp->reordering SACKed seqments above it; "packets" refers to * the maximum SACKed segments to pass before reaching this limit. */
@@ -2211,10 +2210,9 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head) {struct tcp_sock *tp =tcp_sk (sk);struct sk_buff *skb; -int cnt, oldcnt, lost; -unsigned int mss; +int cnt;/* Use SACK to deduce losses of new sequences sent during recovery */ -const u32 loss_high =tcp_is_sack (tp) ? tp->snd_nxt : tp->high_seq; +const u32 loss_high = tp->snd_nxt;WARN_ON (packets > tp->packets_out); skb = tp->lost_skb_hint;
@@ -2237,26 +2235,11 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)if (after (TCP_SKB_CB (skb)->end_seq, loss_high))break ; - oldcnt = cnt; -if (tcp_is_reno (tp) || - (TCP_SKB_CB (skb)->sacked &TCPCB_SACKED_ACKED )) +if (TCP_SKB_CB (skb)->sacked &TCPCB_SACKED_ACKED ) cnt +=tcp_skb_pcount (skb); -if (cnt > packets) { -if (tcp_is_sack (tp) || - (TCP_SKB_CB (skb)->sacked &TCPCB_SACKED_ACKED ) || - (oldcnt >= packets)) -break ; - - mss =tcp_skb_mss (skb); -/* If needed, chop off the prefix to mark as lost. */ - lost = (packets - oldcnt) * mss; -if (lost < skb->len && -tcp_fragment (sk,TCP_FRAG_IN_RTX_QUEUE , skb, - lost, mss,GFP_ATOMIC ) <0 ) -break ; - cnt = packets; - } +if (cnt > packets) +break ;tcp_skb_mark_lost (tp, skb);
@@ -2883,8 +2866,7 @@ static void tcp_fastretrans_alert(struct sock *sk, const u32 prior_snd_una,if (tcp_try_undo_partial (sk, prior_snd_una))return ;/* Partial ACK arrived. Force fast retransmit. */ - do_lost =tcp_is_reno (tp) || -tcp_force_fast_retransmit (sk); + do_lost =tcp_force_fast_retransmit (sk); }if (tcp_try_undo_dsack (sk)) {tcp_try_keep_open (sk);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/78 tcp: add ece_ack flag to reno sack functions
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousuk Seung <[email protected]>
[ Upstream commit c634e34f6ebfb75259e6ce467523fd3adf30d3d2 ]
Pass a boolean flag that tells the ECE state of the current ack to reno sack functions. This is pure refactor for future patches to improve tracking delivered counts.
Stable-dep-of: a6458ab7fd4f ("UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()")
--- net/ipv4/tcp_input.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
net/ipv4/tcp_input.c +12 -10
@@ -1905,7 +1905,7 @@ static void tcp_check_reno_reordering(struct sock *sk, const int addend)/* Emulate SACKs for SACKless connection: account for a new dupack. */ -static void tcp_add_reno_sack (struct sock *sk,int num_dupack) +static void tcp_add_reno_sack (struct sock *sk,int num_dupack,bool ece_ack) {if (num_dupack) {struct tcp_sock *tp =tcp_sk (sk);
@@ -1923,7 +1923,7 @@ static void tcp_add_reno_sack(struct sock *sk, int num_dupack)/* Account for ACK, ACKing some data in Reno Recovery phase. */ -static void tcp_remove_reno_sacks (struct sock *sk,int acked) +static void tcp_remove_reno_sacks (struct sock *sk,int acked,bool ece_ack) {struct tcp_sock *tp =tcp_sk (sk);
@@ -2729,7 +2729,7 @@ static void tcp_process_loss(struct sock *sk, int flag, int num_dupack,* delivered. Lower inflight to clock out (re)tranmissions. */ if (after (tp->snd_nxt, tp->high_seq) && num_dupack) -tcp_add_reno_sack (sk, num_dupack); +tcp_add_reno_sack (sk, num_dupack, flag &FLAG_ECE );else if (flag &FLAG_SND_UNA_ADVANCED )tcp_reset_reno_sack (tp); }
@@ -2812,6 +2812,7 @@ static void tcp_fastretrans_alert(struct sock *sk, const u32 prior_snd_una,struct inet_connection_sock *icsk =inet_csk (sk);struct tcp_sock *tp =tcp_sk (sk);int fast_rexmit =0 , flag = *ack_flag; +bool ece_ack = flag &FLAG_ECE ;bool do_lost = num_dupack || ((flag &FLAG_DATA_SACKED ) &&tcp_force_fast_retransmit (sk));
@@ -2820,7 +2821,7 @@ static void tcp_fastretrans_alert(struct sock *sk, const u32 prior_snd_una,/* Now state machine starts. * A. ECE, hence prohibit cwnd undoing, the reduction is required. */ -if (flag &FLAG_ECE ) +if (ece_ack) tp->prior_ssthresh =0 ;/* B. In all the states check for reneging SACKs. */
@@ -2861,7 +2862,7 @@ static void tcp_fastretrans_alert(struct sock *sk, const u32 prior_snd_una,case TCP_CA_Recovery:if (!(flag &FLAG_SND_UNA_ADVANCED )) {if (tcp_is_reno (tp)) -tcp_add_reno_sack (sk, num_dupack); +tcp_add_reno_sack (sk, num_dupack, ece_ack); }else {if (tcp_try_undo_partial (sk, prior_snd_una))return ;
@@ -2886,7 +2887,7 @@ static void tcp_fastretrans_alert(struct sock *sk, const u32 prior_snd_una,if (tcp_is_reno (tp)) {if (flag &FLAG_SND_UNA_ADVANCED )tcp_reset_reno_sack (tp); -tcp_add_reno_sack (sk, num_dupack); +tcp_add_reno_sack (sk, num_dupack, ece_ack); }if (icsk->icsk_ca_state <= TCP_CA_Disorder)
@@ -2910,7 +2911,7 @@ static void tcp_fastretrans_alert(struct sock *sk, const u32 prior_snd_una, }/* Otherwise enter Recovery state */ -tcp_enter_recovery (sk, (flag &FLAG_ECE )); +tcp_enter_recovery (sk, ece_ack); fast_rexmit =1 ; }
@@ -3088,7 +3089,7 @@ static void tcp_ack_tstamp(struct sock *sk, struct sk_buff *skb,*/ static int tcp_clean_rtx_queue (struct sock *sk,u32 prior_fack,u32 prior_snd_una, -struct tcp_sacktag_state *sack) +struct tcp_sacktag_state *sack,bool ece_ack) {const struct inet_connection_sock *icsk =inet_csk (sk);u64 first_ackt, last_ackt;
@@ -3226,7 +3227,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, u32 prior_fack, }if (tcp_is_reno (tp)) { -tcp_remove_reno_sacks (sk, pkts_acked); +tcp_remove_reno_sacks (sk, pkts_acked, ece_ack);/* If any of the cumulatively ACKed segments was * retransmitted, non-SACK case cannot confirm that
@@ -3735,7 +3736,8 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) goto no_queue;/* See if we can take anything off of the retransmit queue. */ - flag |=tcp_clean_rtx_queue (sk, prior_fack, prior_snd_una, &sack_state); + flag |=tcp_clean_rtx_queue (sk, prior_fack, prior_snd_una, &sack_state, + flag &FLAG_ECE );tcp_rack_update_reo_wnd (sk, &rs);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/78 net: tcp better handling of reordering then loss cases
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuchung Cheng <[email protected]>
[ Upstream commit a29cb6914681a55667436a9eb7a42e28da8cf387 ]
This patch aims to improve the situation when reordering and loss are ocurring in the same flight of packets.
Previously the reordering would first induce a spurious recovery, then the subsequent ACK may undo the cwnd (based on the timestamps e.g.). However the current loss recovery does not proceed to invoke RACK to install a reordering timer. If some packets are also lost, this may lead to a long RTO-based recovery. An example is
https://groups.google.com/g/bbr-dev/c/OFHADvJbTEI
The solution is to after reverting the recovery, always invoke RACK to either mount the RACK timer to fast retransmit after the reordering window, or restarts the recovery if new loss is identified. Hence it is possible the sender may go from Recovery to Disorder/Open to Recovery again in one ACK.
Stable-dep-of: a6458ab7fd4f ("UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()")
--- net/ipv4/tcp_input.c | 45 +++++++++++++++++++++++++------------------- 1 file changed, 26 insertions(+), 19 deletions(-)
net/ipv4/tcp_input.c +26 -19
@@ -2736,8 +2736,17 @@ static void tcp_process_loss(struct sock *sk, int flag, int num_dupack, *rexmit =REXMIT_LOST ; } +static bool tcp_force_fast_retransmit (struct sock *sk) +{ +struct tcp_sock *tp =tcp_sk (sk); + +return after (tcp_highest_sack_seq (tp), + tp->snd_una + tp->reordering * tp->mss_cache); +} +/* Undo during fast recovery after partial ACK. */ -static bool tcp_try_undo_partial (struct sock *sk,u32 prior_snd_una) +static bool tcp_try_undo_partial (struct sock *sk,u32 prior_snd_una, +bool *do_lost) {struct tcp_sock *tp =tcp_sk (sk);
@@ -2762,7 +2771,9 @@ static bool tcp_try_undo_partial(struct sock *sk, u32 prior_snd_una)tcp_undo_cwnd_reduction (sk, true);NET_INC_STATS (sock_net (sk),LINUX_MIB_TCPPARTIALUNDO );tcp_try_keep_open (sk); -return true; + }else { +/* Partial ACK arrived. Force fast retransmit. */ + *do_lost =tcp_force_fast_retransmit (sk); }return false; }
@@ -2786,14 +2797,6 @@ static void tcp_identify_packet_loss(struct sock *sk, int *ack_flag) } } -static bool tcp_force_fast_retransmit (struct sock *sk) -{ -struct tcp_sock *tp =tcp_sk (sk); - -return after (tcp_highest_sack_seq (tp), - tp->snd_una + tp->reordering * tp->mss_cache); -} -/* Process an event, which can update packets-in-flight not trivially. * Main goal of this function is to calculate new estimate for left_out, * taking into account both packets sitting in receiver's buffer and
@@ -2863,17 +2866,21 @@ static void tcp_fastretrans_alert(struct sock *sk, const u32 prior_snd_una,if (!(flag &FLAG_SND_UNA_ADVANCED )) {if (tcp_is_reno (tp))tcp_add_reno_sack (sk, num_dupack, ece_ack); - }else { -if (tcp_try_undo_partial (sk, prior_snd_una)) -return ; -/* Partial ACK arrived. Force fast retransmit. */ - do_lost =tcp_force_fast_retransmit (sk); - } -if (tcp_try_undo_dsack (sk)) { -tcp_try_keep_open (sk); + }else if (tcp_try_undo_partial (sk, prior_snd_una, &do_lost))return ; - } + +if (tcp_try_undo_dsack (sk)) +tcp_try_keep_open (sk); +tcp_identify_packet_loss (sk, ack_flag); +if (icsk->icsk_ca_state != TCP_CA_Recovery) { +if (!tcp_time_to_recover (sk, flag)) +return ; +/* Undo reverts the recovery state. If loss is evident, +* starts a new recovery (e.g. reordering then loss); +*/ +tcp_enter_recovery (sk, ece_ack); + }break ;case TCP_CA_Loss:tcp_process_loss (sk, flag, num_dupack, rexmit);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/78 UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neal Cardwell <[email protected]>
[ Upstream commit a6458ab7fd4f427d4f6f54380453ad255b7fde83 ]
In some production workloads we noticed that connections could sometimes close extremely prematurely with ETIMEDOUT after transmitting only 1 TLP and RTO retransmission (when we would normally expect roughly tcp_retries2 = TCP_RETR2 = 15 RTOs before a connection closes with ETIMEDOUT).
Quoted 1 line
From tracing we determined that these workloads can suffer from a
scenario where in fast recovery, after some retransmits, a DSACK undo can happen at a point where the scoreboard is totally clear (we have retrans_out == sacked_out == lost_out == 0). In such cases, calling tcp_try_keep_open() means that we do not execute any code path that clears tp->retrans_stamp to 0. That means that tp->retrans_stamp can remain erroneously set to the start time of the undone fast recovery, even after the fast recovery is undone. If minutes or hours elapse, and then a TLP/RTO/RTO sequence occurs, then the start_ts value in retransmits_timed_out() (which is from tp->retrans_stamp) will be erroneously ancient (left over from the fast recovery undone via DSACKs). Thus this ancient tp->retrans_stamp value can cause the connection to die very prematurely with ETIMEDOUT via tcp_write_err().
The fix: we change DSACK undo in fast recovery (TCP_CA_Recovery) to call tcp_try_to_open() instead of tcp_try_keep_open(). This ensures that if no retransmits are in flight at the time of DSACK undo in fast recovery then we properly zero retrans_stamp. Note that calling tcp_try_to_open() is more consistent with other loss recovery behavior, since normal fast recovery (CA_Recovery) and RTO recovery (CA_Loss) both normally end when tp->snd_una meets or exceeds tp->high_seq and then in tcp_fastretrans_alert() the "default" switch case executes tcp_try_to_open(). Also note that by inspection this change to call tcp_try_to_open() implies at least one other nice bug fix, where now an ECE-marked DSACK that causes an undo will properly invoke tcp_enter_cwr() rather than ignoring the ECE mark.
--- net/ipv4/tcp_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/tcp_input.c +1 -1
@@ -2870,7 +2870,7 @@ static void tcp_fastretrans_alert(struct sock *sk, const u32 prior_snd_una,return ;if (tcp_try_undo_dsack (sk)) -tcp_try_keep_open (sk); +tcp_try_to_open (sk, flag);tcp_identify_packet_loss (sk, ack_flag);if (icsk->icsk_ca_state != TCP_CA_Recovery) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/78 tcp_metrics: validate source addr length
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 66be40e622e177316ae81717aa30057ba9e61dff ]
I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4 is at least 4 bytes long, and the policy doesn't have an entry for this attribute at all (neither does it for IPv6 but v6 is manually validated).
--- net/ipv4/tcp_metrics.c | 1 + 1 file changed, 1 insertion(+)
net/ipv4/tcp_metrics.c +1 -0
@@ -614,6 +614,7 @@ static const struct nla_policy tcp_metrics_nl_policy[TCP_METRICS_ATTR_MAX + 1] = [TCP_METRICS_ATTR_ADDR_IPV4] = { .type = NLA_U32, }, [TCP_METRICS_ATTR_ADDR_IPV6] = { .type = NLA_BINARY, .len = sizeof(struct in6_addr), }, + [TCP_METRICS_ATTR_SADDR_IPV4] = { .type = NLA_U32, },/* Following attributes are not received for GET/DEL, * we keep them for reference */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/78 wifi: wilc1000: fix ies_len type in connect path
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jozef Hopko <[email protected]>
[ Upstream commit 39ab8fff623053a50951b659e5f6b72343d7d78c ]
Commit 205c50306acf ("wifi: wilc1000: fix RCU usage in connect path") made sure that the IEs data was manipulated under the relevant RCU section. Unfortunately, while doing so, the commit brought a faulty implicit cast from int to u8 on the ies_len variable, making the parsing fail to be performed correctly if the IEs block is larger than 255 bytes. This failure can be observed with Access Points appending a lot of IEs TLVs in their beacon frames (reproduced with a Pixel phone acting as an Access Point, which brough 273 bytes of IE data in my testing environment).
Fix IEs parsing by removing this undesired implicit cast.
--- drivers/staging/wilc1000/wilc_hif.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/staging/wilc1000/wilc_hif.c +2 -1
@@ -446,7 +446,8 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,struct ieee80211_p2p_noa_attr noa_attr;const struct cfg80211_bss_ies *ies;struct wilc_join_bss_param *param; -u8 rates_len =0 , ies_len; +u8 rates_len =0 ; +int ies_len;int ret; param =kzalloc (sizeof (*param),GFP_KERNEL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/78 bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sam Sun <[email protected]>
[ Upstream commit e271ff53807e8f2c628758290f0e499dbe51cb3d ]
In function bond_option_arp_ip_targets_set(), if newval->string is an empty string, newval->string+1 will point to the byte after the string, causing an out-of-bound read.
BUG: KASAN: slab-out-of-bounds in strlen+0x7d/0xa0 lib/string.c:418 Read of size 1 at addr ffff8881119c4781 by task syz-executor665/8107 CPU: 1 PID: 8107 Comm: syz-executor665 Not tainted 6.7.0-rc7 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0xc1/0x5e0 mm/kasan/report.c:475 kasan_report+0xbe/0xf0 mm/kasan/report.c:588 strlen+0x7d/0xa0 lib/string.c:418 __fortify_strlen include/linux/fortify-string.h:210 [inline] in4_pton+0xa3/0x3f0 net/core/utils.c:130 bond_option_arp_ip_targets_set+0xc2/0x910 drivers/net/bonding/bond_options.c:1201 __bond_opt_set+0x2a4/0x1030 drivers/net/bonding/bond_options.c:767 __bond_opt_set_notify+0x48/0x150 drivers/net/bonding/bond_options.c:792 bond_opt_tryset_rtnl+0xda/0x160 drivers/net/bonding/bond_options.c:817 bonding_sysfs_store_option+0xa1/0x120 drivers/net/bonding/bond_sysfs.c:156 dev_attr_store+0x54/0x80 drivers/base/core.c:2366 sysfs_kf_write+0x114/0x170 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x337/0x500 fs/kernfs/file.c:334 call_write_iter include/linux/fs.h:2020 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x96a/0xd80 fs/read_write.c:584 ksys_write+0x122/0x250 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b ---[ end trace ]---
Fix it by adding a check of string length before using it.
--- drivers/net/bonding/bond_options.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/bonding/bond_options.c +3 -3
@@ -1084,9 +1084,9 @@ static int bond_option_arp_ip_targets_set(struct bonding *bond,__be32 target;if (newval->string) { -if (!in4_pton (newval->string+1 ,-1 , (u8 *)&target,-1 ,NULL )) { -netdev_err (bond->dev,"invalid ARP target %pI4 specified\n" , - &target); +if (strlen (newval->string) <1 || + !in4_pton (newval->string +1 ,-1 , (u8 *)&target,-1 ,NULL )) { +netdev_err (bond->dev,"invalid ARP target specified\n" );return ret; }if (newval->string[0 ] =='+' )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/78 selftests: fix OOM in msg_zerocopy selftest
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit af2b7e5b741aaae9ffbba2c660def434e07aa241 ]
In selftests/net/msg_zerocopy.c, it has a while loop keeps calling sendmsg on a socket with MSG_ZEROCOPY flag, and it will recv the notifications until the socket is not writable. Typically, it will start the receiving process after around 30+ sendmsgs. However, as the introduction of commit dfa2f0483360 ("tcp: get rid of sysctl_tcp_adv_win_scale"), the sender is always writable and does not get any chance to run recv notifications. The selftest always exits with OUT_OF_MEMORY because the memory used by opt_skb exceeds the net.core.optmem_max. Meanwhile, it could be set to a different value to trigger OOM on older kernels too.
Thus, we introduce "cfg_notification_limit" to force sender to receive notifications after some number of sendmsgs.
--- tools/testing/selftests/net/msg_zerocopy.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
tools/testing/selftests/net/msg_zerocopy.c +11 -1
@@ -85,6 +85,7 @@ static bool cfg_rx;static int cfg_runtime_ms =4200 ;static int cfg_verbose;static int cfg_waittime_ms =500 ; +static int cfg_notification_limit =32 ;static bool cfg_zerocopy;static socklen_t cfg_alen;
@@ -95,6 +96,7 @@ static char payload[IP_MAXPACKET];static long packets, bytes, completions, expected_completions;static int zerocopied =-1 ;static uint32_t next_completion; +static uint32_t sends_since_notify;static unsigned long gettimeofday_ms (void ) {
@@ -208,6 +210,7 @@ static bool do_sendmsg(int fd, struct msghdr *msg, bool do_zerocopy, int domain)error (1 , errno,"send" );if (cfg_verbose && ret != len)fprintf (stderr,"send: ret=%u != %u\n" , ret, len); + sends_since_notify++;if (len) { packets++;
@@ -460,6 +463,7 @@ static bool do_recv_completion(int fd, int domain)static void do_recv_completions (int fd,int domain) {while (do_recv_completion (fd, domain)) {} + sends_since_notify =0 ; }/* Wait for all remaining completions on the errqueue */
@@ -549,6 +553,9 @@ static void do_tx(int domain, int type, int protocol)else do_sendmsg (fd, &msg, cfg_zerocopy, domain); +if (cfg_zerocopy && sends_since_notify >= cfg_notification_limit) +do_recv_completions (fd, domain); +while (!do_poll (fd,POLLOUT )) {if (cfg_zerocopy)do_recv_completions (fd, domain);
@@ -708,7 +715,7 @@ static void parse_opts(int argc, char **argv) cfg_payload_len = max_payload_len; -while ((c =getopt (argc, argv,"46c:C:D:i:mp:rs:S:t:vz" )) !=-1 ) { +while ((c =getopt (argc, argv,"46c:C:D:i:l:mp:rs:S:t:vz" )) !=-1 ) {switch (c) {case '4' :if (cfg_family !=PF_UNSPEC )
@@ -736,6 +743,9 @@ static void parse_opts(int argc, char **argv)if (cfg_ifindex ==0 )error (1 , errno,"invalid iface: %s" , optarg);break ; +case 'l' : + cfg_notification_limit =strtoul (optarg,NULL ,0 ); +break ;case 'm' : cfg_cork_mixed = true;break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/78 selftests: make order checking verbose in msg_zerocopy selftest
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 7d6d8f0c8b700c9493f2839abccb6d29028b4219 ]
We find that when lock debugging is on, notifications may not come in order. Thus, we have order checking outputs managed by cfg_verbose, to avoid too many outputs in this case.
--- tools/testing/selftests/net/msg_zerocopy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/msg_zerocopy.c +1 -1
@@ -438,7 +438,7 @@ static bool do_recv_completion(int fd, int domain)/* Detect notification gaps. These should not happen often, if at all. * Gaps can occur due to drops, reordering and retransmissions. */ -if (lo != next_completion) +if (cfg_verbose && lo != next_completion)fprintf (stderr,"gap: %u..%u does not append to %u\n" , lo, hi, next_completion); next_completion = hi +1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/78 inet_diag: Initialize pad field in struct inet_diag_req_v2
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <[email protected]>
[ Upstream commit 61cf1c739f08190a4cbf047b9fbb192a94d87e3f ]
KMSAN reported uninit-value access in raw_lookup() [1]. Diag for raw sockets uses the pad field in struct inet_diag_req_v2 for the underlying protocol. This field corresponds to the sdiag_raw_protocol field in struct inet_diag_req_raw.
inet_diag_get_exact_compat() converts inet_diag_req to inet_diag_req_v2, but leaves the pad field uninitialized. So the issue occurs when raw_lookup() accesses the sdiag_raw_protocol field.
Fix this by initializing the pad field in inet_diag_get_exact_compat(). Also, do the same fix in inet_diag_dump_compat() to avoid the similar issue in the future.
[1]
BUG: KMSAN: uninit-value in raw_lookup net/ipv4/raw_diag.c:49 [inline] BUG: KMSAN: uninit-value in raw_sock_get+0x657/0x800 net/ipv4/raw_diag.c:71 raw_lookup net/ipv4/raw_diag.c:49 [inline] raw_sock_get+0x657/0x800 net/ipv4/raw_diag.c:71 raw_diag_dump_one+0xa1/0x660 net/ipv4/raw_diag.c:99 inet_diag_cmd_exact+0x7d9/0x980 inet_diag_get_exact_compat net/ipv4/inet_diag.c:1404 [inline] inet_diag_rcv_msg_compat+0x469/0x530 net/ipv4/inet_diag.c:1426 sock_diag_rcv_msg+0x23d/0x740 net/core/sock_diag.c:282 netlink_rcv_skb+0x537/0x670 net/netlink/af_netlink.c:2564 sock_diag_rcv+0x35/0x40 net/core/sock_diag.c:297 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0xe74/0x1240 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x10c6/0x1260 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x332/0x3d0 net/socket.c:745 ____sys_sendmsg+0x7f0/0xb70 net/socket.c:2585 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2639 __sys_sendmsg net/socket.c:2668 [inline] __do_sys_sendmsg net/socket.c:2677 [inline] __se_sys_sendmsg net/socket.c:2675 [inline] __x64_sys_sendmsg+0x27e/0x4a0 net/socket.c:2675 x64_sys_call+0x135e/0x3ce0 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd9/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was stored to memory at:
raw_sock_get+0x650/0x800 net/ipv4/raw_diag.c:71 raw_diag_dump_one+0xa1/0x660 net/ipv4/raw_diag.c:99 inet_diag_cmd_exact+0x7d9/0x980 inet_diag_get_exact_compat net/ipv4/inet_diag.c:1404 [inline] inet_diag_rcv_msg_compat+0x469/0x530 net/ipv4/inet_diag.c:1426 sock_diag_rcv_msg+0x23d/0x740 net/core/sock_diag.c:282 netlink_rcv_skb+0x537/0x670 net/netlink/af_netlink.c:2564 sock_diag_rcv+0x35/0x40 net/core/sock_diag.c:297 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0xe74/0x1240 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x10c6/0x1260 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x332/0x3d0 net/socket.c:745 ____sys_sendmsg+0x7f0/0xb70 net/socket.c:2585 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2639 __sys_sendmsg net/socket.c:2668 [inline] __do_sys_sendmsg net/socket.c:2677 [inline] __se_sys_sendmsg net/socket.c:2675 [inline] __x64_sys_sendmsg+0x27e/0x4a0 net/socket.c:2675 x64_sys_call+0x135e/0x3ce0 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd9/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable req.i created at:
inet_diag_get_exact_compat net/ipv4/inet_diag.c:1396 [inline] inet_diag_rcv_msg_compat+0x2a6/0x530 net/ipv4/inet_diag.c:1426 sock_diag_rcv_msg+0x23d/0x740 net/core/sock_diag.c:282 CPU: 1 PID: 8888 Comm: syz-executor.6 Not tainted 6.10.0-rc4-00217-g35bb670d65fc #32 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014
--- net/ipv4/inet_diag.c | 2 ++ 1 file changed, 2 insertions(+)
net/ipv4/inet_diag.c +2 -0
@@ -1088,6 +1088,7 @@ static int inet_diag_dump_compat(struct sk_buff *skb, req.sdiag_family =AF_UNSPEC ;/* compatibility */ req.sdiag_protocol =inet_diag_type2proto (cb->nlh->nlmsg_type); req.idiag_ext = rc->idiag_ext; + req.pad =0 ; req.idiag_states = rc->idiag_states; req.id = rc->id;
@@ -1106,6 +1107,7 @@ static int inet_diag_get_exact_compat(struct sk_buff *in_skb, req.sdiag_family = rc->idiag_family; req.sdiag_protocol =inet_diag_type2proto (nlh->nlmsg_type); req.idiag_ext = rc->idiag_ext; + req.pad =0 ; req.idiag_states = rc->idiag_states; req.id = rc->id;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/78 nilfs2: fix inode number range checks
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit e2fec219a36e0993642844be0f345513507031f4 upstream.
Patch series "nilfs2: fix potential issues related to reserved inodes".
This series fixes one use-after-free issue reported by syzbot, caused by nilfs2's internal inode being exposed in the namespace on a corrupted filesystem, and a couple of flaws that cause problems if the starting number of non-reserved inodes written in the on-disk super block is intentionally (or corruptly) changed from its default value.
This patch (of 3):
In the current implementation of nilfs2, "nilfs->ns_first_ino", which gives the first non-reserved inode number, is read from the superblock, but its lower limit is not checked.
As a result, if a number that overlaps with the inode number range of reserved inodes such as the root directory or metadata files is set in the super block parameter, the inode number test macros (NILFS_MDT_INODE and NILFS_VALID_INODE) will not function properly.
In addition, these test macros use left bit-shift calculations using with the inode number as the shift count via the BIT macro, but the result of a shift calculation that exceeds the bit width of an integer is undefined in the C specification, so if "ns_first_ino" is set to a large value other than the default value NILFS_USER_INO (=11), the macros may potentially malfunction depending on the environment.
Fix these issues by checking the lower bound of "nilfs->ns_first_ino" and by preventing bit shifts equal to or greater than the NILFS_USER_INO constant in the inode number test macros.
Also, change the type of "ns_first_ino" from signed integer to unsigned integer to avoid the need for type casting in comparisons such as the lower bound check introduced this time.
--- fs/nilfs2/nilfs.h | 5 +++-- fs/nilfs2/the_nilfs.c | 6 ++++++ fs/nilfs2/the_nilfs.h | 2 +- 3 files changed, 10 insertions(+), 3 deletions(-)
fs/nilfs2/nilfs.h +3 -2
@@ -116,9 +116,10 @@ enum {#define NILFS_FIRST_INO (sb) (((struct the_nilfs *)sb->s_fs_info)->ns_first_ino)#define NILFS_MDT_INODE (sb, ino) \ - ((ino) < NILFS_FIRST_INO(sb) && (NILFS_MDT_INO_BITS & BIT(ino))) + ((ino) < NILFS_USER_INO && (NILFS_MDT_INO_BITS & BIT(ino)))#define NILFS_VALID_INODE (sb, ino) \ - ((ino) >= NILFS_FIRST_INO(sb) || (NILFS_SYS_INO_BITS & BIT(ino))) + ((ino) >= NILFS_FIRST_INO(sb) || \ + ((ino) < NILFS_USER_INO && (NILFS_SYS_INO_BITS & BIT(ino))))/** * struct nilfs_transaction_info: context information for synchronization
fs/nilfs2/the_nilfs.c +6 -0
@@ -420,6 +420,12 @@ static int nilfs_store_disk_layout(struc } nilfs->ns_first_ino =le32_to_cpu (sbp->s_first_ino); +if (nilfs->ns_first_ino <NILFS_USER_INO ) { +nilfs_err (nilfs->ns_sb, +"too small lower limit for non-reserved inode numbers: %u" , + nilfs->ns_first_ino); +return -EINVAL ; + } nilfs->ns_blocks_per_segment =le32_to_cpu (sbp->s_blocks_per_segment);if (nilfs->ns_blocks_per_segment <NILFS_SEG_MIN_BLOCKS ) {
fs/nilfs2/the_nilfs.h +1 -1
@@ -182,7 +182,7 @@ struct the_nilfs {unsigned long ns_nrsvsegs;unsigned long ns_first_data_block;int ns_inode_size; -int ns_first_ino; +unsigned int ns_first_ino;u32 ns_crc_seed;/* /sys/fs/<nilfs>/<device> */
Greg Kroah-Hartman
maintainerPATCH 33/78 nilfs2: add missing check for inode numbers on directory entries
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit bb76c6c274683c8570ad788f79d4b875bde0e458 upstream.
Syzbot reported that mounting and unmounting a specific pattern of corrupted nilfs2 filesystem images causes a use-after-free of metadata file inodes, which triggers a kernel bug in lru_add_fn().
As Jan Kara pointed out, this is because the link count of a metadata file gets corrupted to 0, and nilfs_evict_inode(), which is called from iput(), tries to delete that inode (ifile inode in this case).
The inconsistency occurs because directories containing the inode numbers of these metadata files that should not be visible in the namespace are read without checking.
Fix this issue by treating the inode numbers of these internal files as errors in the sanity check helper when reading directory folios/pages.
Also thanks to Hillf Danton and Matthew Wilcox for their initial mm-layer analysis.
--- fs/nilfs2/dir.c | 6 ++++++ fs/nilfs2/nilfs.h | 5 +++++ 2 files changed, 11 insertions(+)
fs/nilfs2/dir.c +6 -0
@@ -143,6 +143,9 @@ static bool nilfs_check_page(struct page goto Enamelen;if (((offs + rec_len -1 ) ^ offs) & ~(chunk_size-1 )) goto Espan; +if (unlikely (p->inode && +NILFS_PRIVATE_INODE (le64_to_cpu (p->inode)))) + goto Einumber; }if (offs != limit) goto Eend;
@@ -168,6 +171,9 @@ Enamelen: goto bad_entry; Espan: error ="directory entry across blocks" ; + goto bad_entry; +Einumber: + error ="disallowed inode number" ; bad_entry: nilfs_error(sb, "bad entry in directory #%lu: %s - offset=%lu, inode=%lu, rec_len=%d, name_len=%d",
fs/nilfs2/nilfs.h +5 -0
@@ -121,6 +121,11 @@ enum { ((ino) >=NILFS_FIRST_INO (sb) || \ ((ino) < NILFS_USER_INO && (NILFS_SYS_INO_BITS & BIT(ino)))) +#define NILFS_PRIVATE_INODE (ino) ({ \ + ino_t __ino = (ino); \ + ((__ino) < NILFS_USER_INO && (__ino) != NILFS_ROOT_INO && \ + (__ino) != NILFS_SKETCH_INO); }) +/** * struct nilfs_transaction_info: context information for synchronization * @ti_magic: Magic number
Greg Kroah-Hartman
maintainerPATCH 34/78 mm: optimize the redundant loop of mm_update_owner_next()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinliang Zheng <[email protected]>
commit cf3f9a593dab87a032d2b6a6fb205e7f3de4f0a1 upstream.
When mm_update_owner_next() is racing with swapoff (try_to_unuse()) or /proc or ptrace or page migration (get_task_mm()), it is impossible to find an appropriate task_struct in the loop whose mm_struct is the same as the target mm_struct.
If the above race condition is combined with the stress-ng-zombie and stress-ng-dup tests, such a long loop can easily cause a Hard Lockup in write_lock_irq() for tasklist_lock.
Recognize this situation in advance and exit early.
--- kernel/exit.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/exit.c +2 -0
@@ -433,6 +433,8 @@ retry:* Search through everything else, we should not get here often. */ for_each_process (g) { +if (atomic_read (&mm->mm_users) <=1 ) +break ;if (g->flags &PF_KTHREAD )continue ;for_each_thread (g, c) {
Greg Kroah-Hartman
maintainerPATCH 35/78 can: kvaser_usb: Explicitly initialize family in leafimx driver_info struct
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jimmy Assarsson <[email protected]>
commit 19d5b2698c35b2132a355c67b4d429053804f8cc upstream.
Explicitly set the 'family' driver_info struct member for leafimx. Previously, the correct operation relied on KVASER_LEAF being the first defined value in enum kvaser_usb_leaf_family.
--- drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +1 -0
@@ -114,6 +114,7 @@ static const struct kvaser_usb_driver_instatic const struct kvaser_usb_driver_info kvaser_usb_driver_info_leafimx = { .quirks =0 , + .family =KVASER_LEAF , .ops = &kvaser_usb_leaf_dev_ops, };
Greg Kroah-Hartman
maintainerPATCH 36/78 fsnotify: Do not generate events for O_PATH file descriptors
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 702eb71fd6501b3566283f8c96d7ccc6ddd662e9 upstream.
Currently we will not generate FS_OPEN events for O_PATH file descriptors but we will generate FS_CLOSE events for them. This is asymmetry is confusing. Arguably no fsnotify events should be generated for O_PATH file descriptors as they cannot be used to access or modify file content, they are just convenient handles to file objects like paths. So fix the asymmetry by stopping to generate FS_CLOSE for O_PATH file descriptors.
--- include/linux/fsnotify.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
include/linux/fsnotify.h +7 -1
@@ -62,7 +62,13 @@ static inline int fsnotify_perm(struct fstruct inode *inode =file_inode (file);__u32 fsnotify_mask =0 ; -if (file->f_mode &FMODE_NONOTIFY ) +/* +* FMODE_NONOTIFY are fds generated by fanotify itself which should not +* generate new events. We also don't want to generate events for +* FMODE_PATH fds (involves open & close events) as they are just +* handle creation / destruction events and not "real" file events. +*/ +if (file->f_mode & (FMODE_NONOTIFY |FMODE_PATH ))return 0 ;if (!(mask & (MAY_READ |MAY_OPEN )))return 0 ;
Greg Kroah-Hartman
maintainerPATCH 37/78 Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 30139c702048f1097342a31302cbd3d478f50c63 upstream.
Patch series "mm: Avoid possible overflows in dirty throttling".
Dirty throttling logic assumes dirty limits in page units fit into 32-bits. This patch series makes sure this is true (see patch 2/2 for more details).
This patch (of 2):
This reverts commit 9319b647902cbd5cc884ac08a8a6d54ce111fc78.
The commit is broken in several ways. Firstly, the removed (u64) cast from the multiplication will introduce a multiplication overflow on 32-bit archs if wb_thresh * bg_thresh >= 1<<32 (which is actually common - the default settings with 4GB of RAM will trigger this). Secondly, the div64_u64() is unnecessarily expensive on 32-bit archs. We have div64_ul() in case we want to be safe & cheap. Thirdly, if dirty thresholds are larger than 1<<32 pages, then dirty balancing is going to blow up in many other spectacular ways anyway so trying to fix one possible overflow is just moot.
--- mm/page-writeback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/page-writeback.c +1 -1
@@ -1530,7 +1530,7 @@ static inline void wb_dirty_limits(struc*/ dtc->wb_thresh =__wb_calc_thresh (dtc); dtc->wb_bg_thresh = dtc->thresh ? -div64_u64 (dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) :0 ; +div_u64 ((u64 )dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) :0 ;/* * In order to avoid the stacked BDI deadlock we need
Greg Kroah-Hartman
maintainerPATCH 38/78 drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 80bec6825b19d95ccdfd3393cf8ec15ff2a749b4 upstream.
In nouveau_connector_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a possible NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd.
--- drivers/gpu/drm/nouveau/nouveau_connector.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/nouveau/nouveau_connector.c +3 -0
@@ -968,6 +968,9 @@ nouveau_connector_get_modes(struct drm_cstruct drm_display_mode *mode; mode =drm_mode_duplicate (dev, nv_connector->native_mode); +if (!mode) +return 0 ; +drm_mode_probed_add (connector, mode); ret =1 ; }
Greg Kroah-Hartman
maintainerPATCH 39/78 drm/amdgpu/atomfirmware: silence UBSAN warning
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit d0417264437a8fa05f894cabba5a26715b32d78e upstream.
This is a variable sized array.
--- drivers/gpu/drm/amd/include/atomfirmware.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/include/atomfirmware.h +1 -1
@@ -653,7 +653,7 @@ struct atom_gpio_pin_lut_v2_1 {struct atom_common_table_header table_header;/*the real number of this included in the structure is calcualted by using the (whole structure size - the header size)/size of atom_gpio_pin_lut */ -struct atom_gpio_pin_assignment gpio_pin[8 ]; +struct atom_gpio_pin_assignment gpio_pin[]; };
Greg Kroah-Hartman
maintainerPATCH 40/78 bnx2x: Fix multiple UBSAN array-index-out-of-bounds
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ghadi Elie Rahme <[email protected]>
commit 134061163ee5ca4759de5c24ca3bd71608891ba7 upstream.
Fix UBSAN warnings that occur when using a system with 32 physical cpu cores or more, or when the user defines a number of Ethernet queues greater than or equal to FP_SB_MAX_E1x using the num_queues module parameter.
Currently there is a read/write out of bounds that occurs on the array "struct stats_query_entry query" present inside the "bnx2x_fw_stats_req" struct in "drivers/net/ethernet/broadcom/bnx2x/bnx2x.h". Looking at the definition of the "struct stats_query_entry query" array:
struct stats_query_entry query[FP_SB_MAX_E1x+
BNX2X_FIRST_QUEUE_QUERY_IDX];
FP_SB_MAX_E1x is defined as the maximum number of fast path interrupts and has a value of 16, while BNX2X_FIRST_QUEUE_QUERY_IDX has a value of 3 meaning the array has a total size of 19.
Since accesses to "struct stats_query_entry query" are offset-ted by BNX2X_FIRST_QUEUE_QUERY_IDX, that means that the total number of Ethernet queues should not exceed FP_SB_MAX_E1x (16). However one of these queues is reserved for FCOE and thus the number of Ethernet queues should be set to [FP_SB_MAX_E1x -1] (15) if FCOE is enabled or [FP_SB_MAX_E1x] (16) if it is not.
This is also described in a comment in the source code in drivers/net/ethernet/broadcom/bnx2x/bnx2x.h just above the Macro definition of FP_SB_MAX_E1x. Below is the part of this explanation that it important for this patch
/*
* The total number of L2 queues, MSIX vectors and HW contexts (CIDs) is
* control by the number of fast-path status blocks supported by the
* device (HW/FW). Each fast-path status block (FP-SB) aka non-default
* status block represents an independent interrupts context that can
* serve a regular L2 networking queue. However special L2 queues such
* as the FCoE queue do not require a FP-SB and other components like
* the CNIC may consume FP-SB reducing the number of possible L2 queues *
* If the maximum number of FP-SB available is X then:
* a. If CNIC is supported it consumes 1 FP-SB thus the max number of
* regular L2 queues is Y=X-1
* b. In MF mode the actual number of L2 queues is Y= (X-1/MF_factor)
* c. If the FCoE L2 queue is supported the actual number of L2 queues
* is Y+1
* d. The number of irqs (MSIX vectors) is either Y+1 (one extra for
* slow-path interrupts) or Y+2 if CNIC is supported (one additional
* FP interrupt context for the CNIC).
* e. The number of HW context (CID count) is always X or X+1 if FCoE
* L2 queue is supported. The cid for the FCoE L2 queue is always X.
*/
However this driver also supports NICs that use the E2 controller which can handle more queues due to having more FP-SB represented by FP_SB_MAX_E2. Looking at the commits when the E2 support was added, it was originally using the E1x parameters: commit f2e0899f0f27 ("bnx2x: Add 57712 support"). Back then FP_SB_MAX_E2 was set to 16 the same as E1x. However the driver was later updated to take full advantage of the E2 instead of having it be limited to the capabilities of the E1x. But as far as we can tell, the array "stats_query_entry query" was still limited to using the FP-SB available to the E1x cards as part of an oversignt when the driver was updated to take full advantage of the E2, and now with the driver being aware of the greater queue size supported by E2 NICs, it causes the UBSAN warnings seen in the stack traces below.
This patch increases the size of the "stats_query_entry query" array by replacing FP_SB_MAX_E1x with FP_SB_MAX_E2 to be large enough to handle both types of NICs.
Stack traces:
UBSAN: array-index-out-of-bounds in
drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c:1529:11
index 20 is out of range for type 'stats_query_entry [19]'
CPU: 12 PID: 858 Comm: systemd-network Not tainted 6.9.0-060900rc7-generic
#202405052133
Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9,
BIOS P89 10/21/2019
Call Trace:
<TASK>
dump_stack_lvl+0x76/0xa0
dump_stack+0x10/0x20
__ubsan_handle_out_of_bounds+0xcb/0x110
bnx2x_prep_fw_stats_req+0x2e1/0x310 [bnx2x]
bnx2x_stats_init+0x156/0x320 [bnx2x]
bnx2x_post_irq_nic_init+0x81/0x1a0 [bnx2x]
bnx2x_nic_load+0x8e8/0x19e0 [bnx2x]
bnx2x_open+0x16b/0x290 [bnx2x]
__dev_open+0x10e/0x1d0
RIP: 0033:0x736223927a0a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca
64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00
f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
RSP: 002b:00007ffc0bb2ada8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000583df50f9c78 RCX: 0000736223927a0a
RDX: 0000000000000020 RSI: 0000583df50ee510 RDI: 0000000000000003
RBP: 0000583df50d4940 R08: 00007ffc0bb2adb0 R09: 0000000000000080
R10: 0000000000000000 R11: 0000000000000246 R12: 0000583df5103ae0
R13: 000000000000035a R14: 0000583df50f9c30 R15: 0000583ddddddf00
</TASK>
---[ end trace ]---
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in
drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c:1546:11
index 28 is out of range for type 'stats_query_entry [19]'
CPU: 12 PID: 858 Comm: systemd-network Not tainted 6.9.0-060900rc7-generic
#202405052133
Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9,
BIOS P89 10/21/2019
Call Trace:
<TASK>
dump_stack_lvl+0x76/0xa0
dump_stack+0x10/0x20
__ubsan_handle_out_of_bounds+0xcb/0x110
bnx2x_prep_fw_stats_req+0x2fd/0x310 [bnx2x]
bnx2x_stats_init+0x156/0x320 [bnx2x]
bnx2x_post_irq_nic_init+0x81/0x1a0 [bnx2x]
bnx2x_nic_load+0x8e8/0x19e0 [bnx2x]
bnx2x_open+0x16b/0x290 [bnx2x]
__dev_open+0x10e/0x1d0
RIP: 0033:0x736223927a0a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca
64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00
f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
RSP: 002b:00007ffc0bb2ada8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000583df50f9c78 RCX: 0000736223927a0a
RDX: 0000000000000020 RSI: 0000583df50ee510 RDI: 0000000000000003
RBP: 0000583df50d4940 R08: 00007ffc0bb2adb0 R09: 0000000000000080
R10: 0000000000000000 R11: 0000000000000246 R12: 0000583df5103ae0
R13: 000000000000035a R14: 0000583df50f9c30 R15: 0000583ddddddf00
</TASK>
---[ end trace ]---
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in
drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c:1895:8
index 29 is out of range for type 'stats_query_entry [19]'
CPU: 13 PID: 163 Comm: kworker/u96:1 Not tainted 6.9.0-060900rc7-generic
#202405052133
Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9,
BIOS P89 10/21/2019
Workqueue: bnx2x bnx2x_sp_task [bnx2x]
Call Trace:
<TASK>
dump_stack_lvl+0x76/0xa0
dump_stack+0x10/0x20
__ubsan_handle_out_of_bounds+0xcb/0x110
bnx2x_iov_adjust_stats_req+0x3c4/0x3d0 [bnx2x]
bnx2x_storm_stats_post.part.0+0x4a/0x330 [bnx2x]
? bnx2x_hw_stats_post+0x231/0x250 [bnx2x]
bnx2x_stats_start+0x44/0x70 [bnx2x]
bnx2x_stats_handle+0x149/0x350 [bnx2x]
bnx2x_attn_int_asserted+0x998/0x9b0 [bnx2x]
bnx2x_sp_task+0x491/0x5c0 [bnx2x]
process_one_work+0x18d/0x3f0
</TASK>
---[ end trace ]------ drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnx2x/bnx2x.h +1 -1
@@ -1256,7 +1256,7 @@ enum {struct bnx2x_fw_stats_req {struct stats_query_header hdr; -struct stats_query_entry query[FP_SB_MAX_E1x+ +struct stats_query_entry query[FP_SB_MAX_E2 +BNX2X_FIRST_QUEUE_QUERY_IDX ]; };
Greg Kroah-Hartman
maintainerPATCH 41/78 media: dw2102: fix a potential buffer overflow
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
commit 1c73d0b29d04bf4082e7beb6a508895e118ee30d upstream.
As pointed by smatch:
drivers/media/usb/dvb-usb/dw2102.c:802 su3000_i2c_transfer() error: __builtin_memcpy() '&state->data[4]' too small (64 vs 67)
That seemss to be due to a wrong copy-and-paste.
--- drivers/media/usb/dvb-usb/dw2102.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/dvb-usb/dw2102.c +1 -1
@@ -786,7 +786,7 @@ static int su3000_i2c_transfer(struct i2if (msg[j].flags &I2C_M_RD ) {/* single read */ -if (1 + msg[j].len >sizeof (state->data)) { +if (4 + msg[j].len >sizeof (state->data)) {warn ("i2c rd: len=%d is too big!\n" , msg[j].len); num = -EOPNOTSUPP ;break ;
Greg Kroah-Hartman
maintainerPATCH 42/78 i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Piotr Wojtaszczyk <[email protected]>
[ Upstream commit f63b94be6942ba82c55343e196bd09b53227618e ]
When del_timer_sync() is called in an interrupt context it throws a warning because of potential deadlock. The timer is used only to exit from wait_for_completion() after a timeout so replacing the call with wait_for_completion_timeout() allows to remove the problematic timer and its related functions altogether.
--- drivers/i2c/busses/i2c-pnx.c | 48 ++++++++---------------------------- 1 file changed, 10 insertions(+), 38 deletions(-)
drivers/i2c/busses/i2c-pnx.c +10 -38
@@ -15,7 +15,6 @@#include <linux/ioport.h> #include <linux/delay.h> #include <linux/i2c.h> -#include <linux/timer.h> #include <linux/completion.h> #include <linux/platform_device.h> #include <linux/io.h>
@@ -32,7 +31,6 @@ struct i2c_pnx_mif {int ret;/* Return value */ int mode;/* Interface mode */ struct completion complete;/* I/O completion */ -struct timer_list timer;/* Timeout */ u8 * buf;/* Data buffer */ int len;/* Length of data buffer */ int order;/* RX Bytes to order via TX */
@@ -117,24 +115,6 @@ static inline int wait_reset(struct i2c_pnx_algo_data *data)return (timeout <=0 ); } -static inline void i2c_pnx_arm_timer (struct i2c_pnx_algo_data *alg_data) -{ -struct timer_list *timer = &alg_data->mif.timer; -unsigned long expires =msecs_to_jiffies (alg_data->timeout); - -if (expires <=1 ) - expires =2 ; - -del_timer_sync (timer); - -dev_dbg (&alg_data->adapter.dev,"Timer armed at %lu plus %lu jiffies.\n" , - jiffies, expires); - - timer->expires = jiffies + expires; - -add_timer (timer); -} -/** * i2c_pnx_start - start a device * @slave_addr: slave address
@@ -259,8 +239,6 @@ static int i2c_pnx_master_xmit(struct i2c_pnx_algo_data *alg_data) ~(mcntrl_afie | mcntrl_naie | mcntrl_drmie), I2C_REG_CTL(alg_data)); -del_timer_sync (&alg_data->mif.timer); -dev_dbg (&alg_data->adapter.dev,"%s(): Waking up xfer routine.\n" , __func__);
@@ -276,8 +254,6 @@ static int i2c_pnx_master_xmit(struct i2c_pnx_algo_data *alg_data) ~(mcntrl_afie | mcntrl_naie | mcntrl_drmie), I2C_REG_CTL(alg_data)); -/* Stop timer. */ -del_timer_sync (&alg_data->mif.timer);dev_dbg (&alg_data->adapter.dev,"%s(): Waking up xfer routine after zero-xfer.\n" , __func__);
@@ -364,8 +340,6 @@ static int i2c_pnx_master_rcv(struct i2c_pnx_algo_data *alg_data) mcntrl_drmie | mcntrl_daie);iowrite32 (ctl,I2C_REG_CTL (alg_data)); -/* Kill timer. */ -del_timer_sync (&alg_data->mif.timer);complete (&alg_data->mif.complete); } }
@@ -400,8 +374,6 @@ static irqreturn_t i2c_pnx_interrupt(int irq, void *dev_id) mcntrl_drmie);iowrite32 (ctl,I2C_REG_CTL (alg_data)); -/* Stop timer, to prevent timeout. */ -del_timer_sync (&alg_data->mif.timer);complete (&alg_data->mif.complete); }else if (stat & mstatus_nai) {/* Slave did not acknowledge, generate a STOP */
@@ -419,8 +391,6 @@ static irqreturn_t i2c_pnx_interrupt(int irq, void *dev_id)/* Our return value. */ alg_data->mif.ret = -EIO ; -/* Stop timer, to prevent timeout. */ -del_timer_sync (&alg_data->mif.timer);complete (&alg_data->mif.complete); }else {/*
@@ -453,9 +423,8 @@ static irqreturn_t i2c_pnx_interrupt(int irq, void *dev_id)return IRQ_HANDLED ; } -static void i2c_pnx_timeout (struct timer_list *t) +static void i2c_pnx_timeout (struct i2c_pnx_algo_data *alg_data) { -struct i2c_pnx_algo_data *alg_data =from_timer (alg_data, t, mif.timer);u32 ctl; dev_err(&alg_data->adapter.dev,
@@ -472,7 +441,6 @@ static void i2c_pnx_timeout(struct timer_list *t)iowrite32 (ctl,I2C_REG_CTL (alg_data));wait_reset (alg_data); alg_data->mif.ret = -EIO ; -complete (&alg_data->mif.complete); }static inline void bus_reset_if_active (struct i2c_pnx_algo_data *alg_data)
@@ -514,6 +482,7 @@ i2c_pnx_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)struct i2c_msg *pmsg;int rc =0 , completed =0 , i;struct i2c_pnx_algo_data *alg_data = adap->algo_data; +unsigned long time_left;u32 stat; dev_dbg(&alg_data->adapter.dev,
@@ -548,7 +517,6 @@ i2c_pnx_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)dev_dbg (&alg_data->adapter.dev,"%s(): mode %d, %d bytes\n" , __func__, alg_data->mif.mode, alg_data->mif.len); -i2c_pnx_arm_timer (alg_data);/* initialize the completion var */ init_completion (&alg_data->mif.complete);
@@ -564,7 +532,10 @@ i2c_pnx_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)break ;/* Wait for completion */ -wait_for_completion (&alg_data->mif.complete); + time_left =wait_for_completion_timeout (&alg_data->mif.complete, + alg_data->timeout); +if (time_left ==0 ) +i2c_pnx_timeout (alg_data);if (!(rc = alg_data->mif.ret)) completed++;
@@ -657,7 +628,10 @@ static int i2c_pnx_probe(struct platform_device *pdev) alg_data->adapter.algo_data = alg_data; alg_data->adapter.nr = pdev->id; - alg_data->timeout =I2C_PNX_TIMEOUT_DEFAULT ; + alg_data->timeout =msecs_to_jiffies (I2C_PNX_TIMEOUT_DEFAULT ); +if (alg_data->timeout <=1 ) + alg_data->timeout =2 ; +#ifdef CONFIG_OF alg_data->adapter.dev.of_node =of_node_get (pdev->dev.of_node);if (pdev->dev.of_node) {
@@ -677,8 +651,6 @@ static int i2c_pnx_probe(struct platform_device *pdev)if (IS_ERR (alg_data->clk))return PTR_ERR (alg_data->clk); -timer_setup (&alg_data->mif.timer, i2c_pnx_timeout,0 ); -snprintf (alg_data->adapter.name,sizeof (alg_data->adapter.name),"%s" , pdev->name);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/78 ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jian-Hong Pan <[email protected]>
[ Upstream commit 45e37f9ce28d248470bab4376df2687a215d1b22 ]
JP-IK LEAP W502 laptop's headset mic is not enabled until ALC897_FIXUP_HEADSET_MIC_PIN3 quirk is applied.
Here is the original pin node values:
0x11 0x400000000x12 0xb7a601300x14 0x901701100x15 0x411111f00x16 0x411111f00x17 0x411111f00x18 0x411111f00x19 0x411111f00x1a 0x411111f00x1b 0x032110200x1c 0x411111f00x1d 0x4026892d0x1e 0x411111f00x1f 0x411111f0
--- sound/pci/hda/patch_realtek.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/pci/hda/patch_realtek.c +9 -0
@@ -9909,6 +9909,7 @@ enum {ALC897_FIXUP_LENOVO_HEADSET_MODE ,ALC897_FIXUP_HEADSET_MIC_PIN2 ,ALC897_FIXUP_UNIS_H3C_X500S , + ALC897_FIXUP_HEADSET_MIC_PIN3, }; static const struct hda_fixup alc662_fixups[] = {
@@ -10355,10 +10356,18 @@ static const struct hda_fixup alc662_fixups[] = { {} }, }, + [ALC897_FIXUP_HEADSET_MIC_PIN3 ] = { + .type =HDA_FIXUP_PINS , + .v.pins = (const struct hda_pintbl []) { + {0x19 ,0x03a11050 },/* use as headset mic */ + { } + }, + }, };static const struct snd_pci_quirk alc662_fixup_tbl[] = {SND_PCI_QUIRK (0x1019 ,0x9087 ,"ECS" ,ALC662_FIXUP_ASUS_MODE2 ), +SND_PCI_QUIRK (0x1019 ,0x9859 ,"JP-IK LEAP W502" ,ALC897_FIXUP_HEADSET_MIC_PIN3 ),SND_PCI_QUIRK (0x1025 ,0x022f ,"Acer Aspire One" ,ALC662_FIXUP_INV_DMIC ),SND_PCI_QUIRK (0x1025 ,0x0241 ,"Packard Bell DOTS" ,ALC662_FIXUP_INV_DMIC ),SND_PCI_QUIRK (0x1025 ,0x0308 ,"Acer Aspire 8942G" ,ALC662_FIXUP_ASPIRE ),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/78 nvme-multipath: find NUMA path only for online numa-node
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilay Shroff <[email protected]>
[ Upstream commit d3a043733f25d743f3aa617c7f82dbcb5ee2211a ]
In current native multipath design when a shared namespace is created, we loop through each possible numa-node, calculate the NUMA distance of that node from each nvme controller and then cache the optimal IO path for future reference while sending IO. The issue with this design is that we may refer to the NUMA distance table for an offline node which may not be populated at the time and so we may inadvertently end up finding and caching a non-optimal path for IO. Then latter when the corresponding numa-node becomes online and hence the NUMA distance table entry for that node is created, ideally we should re-calculate the multipath node distance for the newly added node however that doesn't happen unless we rescan/reset the controller. So essentially, we may keep using non-optimal IO path for a node which is made online after namespace is created.
This patch helps fix this issue ensuring that when a shared namespace is created, we calculate the multipath node distance for each online numa-node instead of each possible numa-node. Then latter when a node becomes online and we receive any IO on that newly added node, we would calculate the multipath node distance for newly added node but this time NUMA distance table would have been already populated for newly added node. Hence we would be able to correctly calculate the multipath node distance and choose the optimal path for the IO.
--- drivers/nvme/host/multipath.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/multipath.c +1 -1
@@ -437,7 +437,7 @@ static void nvme_mpath_set_live(struct nvme_ns *ns)int node, srcu_idx; srcu_idx =srcu_read_lock (&head->srcu); -for_each_node (node) +for_each_online_node (node)__nvme_find_path (head, node);srcu_read_unlock (&head->srcu, srcu_idx); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/78 nilfs2: fix incorrect inode allocation from reserved inodes
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit 93aef9eda1cea9e84ab2453fcceb8addad0e46f1 upstream.
If the bitmap block that manages the inode allocation status is corrupted, nilfs_ifile_create_inode() may allocate a new inode from the reserved inode area where it should not be allocated.
Previous fix commit d325dc6eb763 ("nilfs2: fix use-after-free bug of struct nilfs_root"), fixed the problem that reserved inodes with inode numbers less than NILFS_USER_INO (=11) were incorrectly reallocated due to bitmap corruption, but since the start number of non-reserved inodes is read from the super block and may change, in which case inode allocation may occur from the extended reserved inode area.
If that happens, access to that inode will cause an IO error, causing the file system to degrade to an error state.
Fix this potential issue by adding a wraparound option to the common metadata object allocation routine and by modifying nilfs_ifile_create_inode() to disable the option so that it only allocates inodes with inode numbers greater than or equal to the inode number read in "nilfs->ns_first_ino", regardless of the bitmap status of reserved inodes.
--- fs/nilfs2/alloc.c | 18 ++++++++++++++---- fs/nilfs2/alloc.h | 4 ++-- fs/nilfs2/dat.c | 2 +- fs/nilfs2/ifile.c | 7 ++----- 4 files changed, 19 insertions(+), 12 deletions(-)
fs/nilfs2/alloc.c +14 -4
@@ -377,11 +377,12 @@ void *nilfs_palloc_block_get_entry(const* @target: offset number of an entry in the group (start point) * @bsize: size in bits * @lock: spin lock protecting @bitmap +* @wrap: whether to wrap around */ static int nilfs_palloc_find_available_slot (unsigned char *bitmap,unsigned long target,unsigned int bsize, -spinlock_t *lock) +spinlock_t *lock,bool wrap) {int pos, end = bsize;
@@ -397,6 +398,8 @@ static int nilfs_palloc_find_available_s end = target; } +if (!wrap) +return -ENOSPC ;/* wrap around */ for (pos =0 ; pos < end; pos++) {
@@ -495,9 +498,10 @@ int nilfs_palloc_count_max_entries(struc* nilfs_palloc_prepare_alloc_entry - prepare to allocate a persistent object * @inode: inode of metadata file using this allocator * @req: nilfs_palloc_req structure exchanged for the allocation +* @wrap: whether to wrap around */ int nilfs_palloc_prepare_alloc_entry (struct inode *inode, -struct nilfs_palloc_req *req) +struct nilfs_palloc_req *req,bool wrap) {struct buffer_head *desc_bh, *bitmap_bh;struct nilfs_palloc_group_desc *desc;
@@ -516,7 +520,7 @@ int nilfs_palloc_prepare_alloc_entry(str entries_per_group =nilfs_palloc_entries_per_group (inode);for (i =0 ; i < ngroups; i += n) { -if (group >= ngroups) { +if (group >= ngroups && wrap) {/* wrap around */ group =0 ; maxgroup = nilfs_palloc_group(inode, req->pr_entry_nr,
@@ -541,7 +545,13 @@ int nilfs_palloc_prepare_alloc_entry(str bitmap = bitmap_kaddr +bh_offset (bitmap_bh); pos =nilfs_palloc_find_available_slot ( bitmap, group_offset, - entries_per_group, lock); + entries_per_group, lock, wrap); +/* +* Since the search for a free slot in the +* second and subsequent bitmap blocks always +* starts from the beginning, the wrap flag +* only has an effect on the first search. +*/ if (pos >=0 ) {/* found a free entry */ nilfs_palloc_group_desc_add_entries(
fs/nilfs2/alloc.h +2 -2
@@ -50,8 +50,8 @@ struct nilfs_palloc_req {struct buffer_head *pr_entry_bh; }; -int nilfs_palloc_prepare_alloc_entry (struct inode *, -struct nilfs_palloc_req *); +int nilfs_palloc_prepare_alloc_entry (struct inode *inode, +struct nilfs_palloc_req *req,bool wrap);void nilfs_palloc_commit_alloc_entry (struct inode *,struct nilfs_palloc_req *);void nilfs_palloc_abort_alloc_entry (struct inode *,struct nilfs_palloc_req *);
fs/nilfs2/dat.c +1 -1
@@ -75,7 +75,7 @@ int nilfs_dat_prepare_alloc(struct inode {int ret; - ret =nilfs_palloc_prepare_alloc_entry (dat, req); + ret =nilfs_palloc_prepare_alloc_entry (dat, req, true);if (ret <0 )return ret;
fs/nilfs2/ifile.c +2 -5
@@ -55,13 +55,10 @@ int nilfs_ifile_create_inode(struct inodstruct nilfs_palloc_req req;int ret; - req.pr_entry_nr =0 ;/* -* 0 says find free inode from beginning -* of a group. dull code!! -*/ + req.pr_entry_nr =NILFS_FIRST_INO (ifile->i_sb); req.pr_entry_bh =NULL ; - ret =nilfs_palloc_prepare_alloc_entry (ifile, &req); + ret =nilfs_palloc_prepare_alloc_entry (ifile, &req, false);if (!ret) { ret =nilfs_palloc_get_entry_block (ifile, req.pr_entry_nr,1 , &req.pr_entry_bh);
Greg Kroah-Hartman
maintainerPATCH 46/78 filelock: fix potential use-after-free in posix_lock_inode
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit 1b3ec4f7c03d4b07bad70697d7e2f4088d2cfe92 ]
Light Hsieh reported a KASAN UAF warning in trace_posix_lock_inode(). The request pointer had been changed earlier to point to a lock entry that was added to the inode's list. However, before the tracepoint could fire, another task raced in and freed that lock.
Fix this by moving the tracepoint inside the spinlock, which should ensure that this doesn't happen.
--- fs/locks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/locks.c +1 -1
@@ -1336,9 +1336,9 @@ static int posix_lock_inode(struct inode *inode, struct file_lock *request,locks_wake_up_blocks (left); } out: +trace_posix_lock_inode (inode, request, error);spin_unlock (&ctx->flc_lock);percpu_up_read (&file_rwsem); -trace_posix_lock_inode (inode, request, error);/* * Free any unused locks. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/78 fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: linke li <[email protected]>
[ Upstream commit 8bfb40be31ddea0cb4664b352e1797cfe6c91976 ]
Currently, the __d_clear_type_and_inode() writes the value flags to dentry->d_flags, then immediately re-reads it in order to use it in a if statement. This re-read is useless because no other update to dentry->d_flags can occur at this point.
This commit therefore re-use flags in the if statement instead of re-reading dentry->d_flags.
Stable-dep-of: aabfe57ebaa7 ("vfs: don't mod negative dentry count when on shrinker list")
--- fs/dcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/dcache.c +1 -1
@@ -329,7 +329,7 @@ static inline void __d_clear_type_and_inode(struct dentry *dentry) flags &= ~(DCACHE_ENTRY_TYPE |DCACHE_FALLTHRU );WRITE_ONCE (dentry->d_flags, flags); dentry->d_inode =NULL ; -if (dentry->d_flags &DCACHE_LRU_LIST ) +if (flags &DCACHE_LRU_LIST )this_cpu_inc (nr_dentry_negative); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/78 vfs: dont mod negative dentry count when on shrinker list
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Foster <[email protected]>
[ Upstream commit aabfe57ebaa75841db47ea59091ec3c5a06d2f52 ]
The nr_dentry_negative counter is intended to only account negative dentries that are present on the superblock LRU. Therefore, the LRU add, remove and isolate helpers modify the counter based on whether the dentry is negative, but the shrinker list related helpers do not modify the counter, and the paths that change a dentry between positive and negative only do so if DCACHE_LRU_LIST is set.
The problem with this is that a dentry on a shrinker list still has DCACHE_LRU_LIST set to indicate ->d_lru is in use. The additional DCACHE_SHRINK_LIST flag denotes whether the dentry is on LRU or a shrink related list. Therefore if a relevant operation (i.e. unlink) occurs while a dentry is present on a shrinker list, and the associated codepath only checks for DCACHE_LRU_LIST, then it is technically possible to modify the negative dentry count for a dentry that is off the LRU. Since the shrinker list related helpers do not modify the negative dentry count (because non-LRU dentries should not be included in the count) when the dentry is ultimately removed from the shrinker list, this can cause the negative dentry count to become permanently inaccurate.
This problem can be reproduced via a heavy file create/unlink vs. drop_caches workload. On an 80xcpu system, I start 80 tasks each running a 1k file create/delete loop, and one task spinning on drop_caches. After 10 minutes or so of runtime, the idle/clean cache negative dentry count increases from somewhere in the range of 5-10 entries to several hundred (and increasingly grows beyond nr_dentry_unused).
Tweak the logic in the paths that turn a dentry negative or positive to filter out the case where the dentry is present on a shrink related list. This allows the above workload to maintain an accurate negative dentry count.
--- fs/dcache.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
fs/dcache.c +9 -3
@@ -329,7 +329,11 @@ static inline void __d_clear_type_and_inode(struct dentry *dentry) flags &= ~(DCACHE_ENTRY_TYPE |DCACHE_FALLTHRU );WRITE_ONCE (dentry->d_flags, flags); dentry->d_inode =NULL ; -if (flags &DCACHE_LRU_LIST ) +/* +* The negative counter only tracks dentries on the LRU. Don't inc if +* d_lru is on another list. +*/ +if ((flags & (DCACHE_LRU_LIST |DCACHE_SHRINK_LIST )) ==DCACHE_LRU_LIST )this_cpu_inc (nr_dentry_negative); }
@@ -1921,9 +1925,11 @@ static void __d_instantiate(struct dentry *dentry, struct inode *inode)spin_lock (&dentry->d_lock);/* -* Decrement negative dentry count if it was in the LRU list. +* The negative counter only tracks dentries on the LRU. Don't dec if +* d_lru is on another list. */ -if (dentry->d_flags &DCACHE_LRU_LIST ) +if ((dentry->d_flags & + (DCACHE_LRU_LIST |DCACHE_SHRINK_LIST )) ==DCACHE_LRU_LIST )this_cpu_dec (nr_dentry_negative);hlist_add_head (&dentry->d_u.d_alias, &inode->i_dentry);raw_write_seqcount_begin (&dentry->d_seq);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/78 tcp: add TCP_INFO status for failed client TFO
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Baron <[email protected]>
[ Upstream commit 480274787d7e3458bc5a7cfbbbe07033984ad711 ]
The TCPI_OPT_SYN_DATA bit as part of tcpi_options currently reports whether or not data-in-SYN was ack'd on both the client and server side. We'd like to gather more information on the client-side in the failure case in order to indicate the reason for the failure. This can be useful for not only debugging TFO, but also for creating TFO socket policies. For example, if a middle box removes the TFO option or drops a data-in-SYN, we can can detect this case, and turn off TFO for these connections saving the extra retransmits.
The newly added tcpi_fastopen_client_fail status is 2 bits and has the following 4 states:
1) TFO_STATUS_UNSPEC
Catch-all state which includes when TFO is disabled via black hole detection, which is indicated via LINUX_MIB_TCPFASTOPENBLACKHOLE.
2) TFO_COOKIE_UNAVAILABLE
If TFO_CLIENT_NO_COOKIE mode is off, this state indicates that no cookie is available in the cache.
3) TFO_DATA_NOT_ACKED
Data was sent with SYN, we received a SYN/ACK but it did not cover the data portion. Cookie is not accepted by server because the cookie may be invalid or the server may be overloaded.
4) TFO_SYN_RETRANSMITTED
Data was sent with SYN, we received a SYN/ACK which did not cover the data after at least 1 additional SYN was sent (without data). It may be the case that a middle-box is dropping data-in-SYN packets. Thus, it would be more efficient to not use TFO on this connection to avoid extra retransmits during connection establishment.
These new fields do not cover all the cases where TFO may fail, but other failures, such as SYN/ACK + data being dropped, will result in the connection not becoming established. And a connection blackhole after session establishment shows up as a stalled connection.
Stable-dep-of: 0ec986ed7bab ("tcp: fix incorrect undo caused by DSACK of TLP retransmit")
--- include/linux/tcp.h | 2 +- include/uapi/linux/tcp.h | 10 +++++++++- net/ipv4/tcp.c | 2 ++ net/ipv4/tcp_fastopen.c | 5 ++++- net/ipv4/tcp_input.c | 4 ++++ 5 files changed, 20 insertions(+), 3 deletions(-)
include/linux/tcp.h +1 -1
@@ -225,7 +225,7 @@ struct tcp_sock { fastopen_connect:1, /* FASTOPEN_CONNECT sockopt */ fastopen_no_cookie:1, /* Allow send/recv SYN+data without a cookie */ is_sack_reneg:1, /* in recovery from loss with SACK reneg? */ - unused:2; + fastopen_client_fail:2; /* reason why fastopen failed */ u8 nonagle : 4,/* Disable Nagle algorithm? */ thin_lto : 1,/* Use linear timeouts for thin streams */ recvmsg_inq : 1,/* Indicate # of bytes in queue upon recvmsg */
include/uapi/linux/tcp.h +9 -1
@@ -155,6 +155,14 @@ enum { TCP_QUEUES_NR, }; +/* why fastopen failed from client perspective */ +enum tcp_fastopen_client_fail { +TFO_STATUS_UNSPEC ,/* catch-all */ +TFO_COOKIE_UNAVAILABLE ,/* if not in TFO_CLIENT_NO_COOKIE mode */ +TFO_DATA_NOT_ACKED ,/* SYN-ACK did not ack SYN data */ +TFO_SYN_RETRANSMITTED ,/* SYN-ACK did not ack SYN data after timeout */ +}; +/* for TCP_INFO socket option */ #define TCPI_OPT_TIMESTAMPS 1#define TCPI_OPT_SACK 2
@@ -211,7 +219,7 @@ struct tcp_info {__u8 tcpi_backoff;__u8 tcpi_options; __u8 tcpi_snd_wscale : 4, tcpi_rcv_wscale : 4; - __u8 tcpi_delivery_rate_app_limited:1; + __u8 tcpi_delivery_rate_app_limited:1, tcpi_fastopen_client_fail:2;__u32 tcpi_rto;__u32 tcpi_ato;
net/ipv4/tcp.c +2 -0
@@ -2713,6 +2713,7 @@ int tcp_disconnect(struct sock *sk, int flags)/* Clean up fastopen related fields */ tcp_free_fastopen_req (tp); inet->defer_connect =0 ; + tp->fastopen_client_fail =0 ;WARN_ON (inet->inet_num && !icsk->icsk_bind_hash);
@@ -3360,6 +3361,7 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info) info->tcpi_reord_seen = tp->reord_seen; info->tcpi_rcv_ooopack = tp->rcv_ooopack; info->tcpi_snd_wnd = tp->snd_wnd; + info->tcpi_fastopen_client_fail = tp->fastopen_client_fail;unlock_sock_fast (sk, slow); }EXPORT_SYMBOL_GPL (tcp_get_info);
net/ipv4/tcp_fastopen.c +4 -1
@@ -446,7 +446,10 @@ bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss, cookie->len =-1 ;return true; } -return cookie->len >0 ; +if (cookie->len >0 ) +return true; +tcp_sk (sk)->fastopen_client_fail =TFO_COOKIE_UNAVAILABLE ; +return false; }/* This function checks if we want to defer sending SYN until the first
net/ipv4/tcp_input.c +4 -0
@@ -5896,6 +5896,10 @@ static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack,tcp_fastopen_cache_set (sk, mss, cookie, syn_drop, try_exp);if (data) {/* Retransmit unacked data in SYN */ +if (tp->total_retrans) + tp->fastopen_client_fail =TFO_SYN_RETRANSMITTED ; +else + tp->fastopen_client_fail =TFO_DATA_NOT_ACKED ;skb_rbtree_walk_from (data) {if (__tcp_retransmit_skb (sk, data,1 ))break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/78 tcp: fix incorrect undo caused by DSACK of TLP retransmit
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neal Cardwell <[email protected]>
[ Upstream commit 0ec986ed7bab6801faed1440e8839dcc710331ff ]
Loss recovery undo_retrans bookkeeping had a long-standing bug where a DSACK from a spurious TLP retransmit packet could cause an erroneous undo of a fast recovery or RTO recovery that repaired a single really-lost packet (in a sequence range outside that of the TLP retransmit). Basically, because the loss recovery state machine didn't account for the fact that it sent a TLP retransmit, the DSACK for the TLP retransmit could erroneously be implicitly be interpreted as corresponding to the normal fast recovery or RTO recovery retransmit that plugged a real hole, thus resulting in an improper undo.
For example, consider the following buggy scenario where there is a real packet loss but the congestion control response is improperly undone because of this bug:
+ send packets P1, P2, P3, P4
+ P1 is really lost
+ send TLP retransmit of P4
+ receive SACK for original P2, P3, P4
+ enter fast recovery, fast-retransmit P1, increment undo_retrans to 1
+ receive DSACK for TLP P4, decrement undo_retrans to 0, undo (bug!)
+ receive cumulative ACK for P1-P4 (fast retransmit plugged real hole)
The fix: when we initialize undo machinery in tcp_init_undo(), if there is a TLP retransmit in flight, then increment tp->undo_retrans so that we make sure that we receive a DSACK corresponding to the TLP retransmit, as well as DSACKs for all later normal retransmits, before triggering a loss recovery undo. Note that we also have to move the line that clears tp->tlp_high_seq for RTO recovery, so that upon RTO we remember the tp->tlp_high_seq value until tcp_init_undo() and clear it only afterward.
Also note that the bug dates back to the original 2013 TLP implementation, commit 6ba8a3b19e76 ("tcp: Tail loss probe (TLP)").
However, this patch will only compile and work correctly with kernels that have tp->tlp_retrans, which was added only in v5.8 in 2020 in commit 76be93fc0702 ("tcp: allow at most one TLP probe per flight"). So we associate this fix with that later commit.
--- net/ipv4/tcp_input.c | 11 ++++++++++- net/ipv4/tcp_timer.c | 2 -- 2 files changed, 10 insertions(+), 3 deletions(-)
net/ipv4/tcp_input.c +10 -1
@@ -1956,8 +1956,16 @@ void tcp_clear_retrans(struct tcp_sock *tp)static inline void tcp_init_undo (struct tcp_sock *tp) { tp->undo_marker = tp->snd_una; +/* Retransmission still in flight may cause DSACKs later. */ - tp->undo_retrans = tp->retrans_out ? :-1 ; +/* First, account for regular retransmits in flight: */ + tp->undo_retrans = tp->retrans_out; +/* Next, account for TLP retransmits in flight: */ +if (tp->tlp_high_seq && tp->tlp_retrans) + tp->undo_retrans++; +/* Finally, avoid 0, because undo_retrans==0 means "can undo now": */ +if (!tp->undo_retrans) + tp->undo_retrans =-1 ; }static bool tcp_is_rack (const struct sock *sk)
@@ -2036,6 +2044,7 @@ void tcp_enter_loss(struct sock *sk)tcp_set_ca_state (sk, TCP_CA_Loss); tp->high_seq = tp->snd_nxt; + tp->tlp_high_seq =0 ;tcp_ecn_queue_cwr (tp);/* F-RTO RFC5682 sec 3.1 step 1: retransmit SND.UNA if no previous
net/ipv4/tcp_timer.c +0 -2
@@ -467,8 +467,6 @@ void tcp_retransmit_timer(struct sock *sk)if (!tp->packets_out ||WARN_ON_ONCE (tcp_rtx_queue_empty (sk)))return ; - tp->tlp_high_seq =0 ; -if (!tp->snd_wnd && !sock_flag (sk,SOCK_DEAD ) && !((1 << sk->sk_state) & (TCPF_SYN_SENT |TCPF_SYN_RECV ))) {/* Receiver dastardly shrinks window. Our retransmits
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/78 octeontx2-af: Fix incorrect value output on error path in rvu_check_rsrc_availability()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit 442e26af9aa8115c96541026cbfeaaa76c85d178 ]
In rvu_check_rsrc_availability() in case of invalid SSOW req, an incorrect data is printed to error log. 'req->sso' value is printed instead of 'req->ssow'. Looks like "copy-paste" mistake.
Fix this mistake by replacing 'req->sso' with 'req->ssow'.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu.c +1 -1
@@ -1124,7 +1124,7 @@ static int rvu_check_rsrc_availability(struct rvu *rvu,if (req->ssow > block->lf.max) {dev_err (&rvu->pdev->dev,"Func 0x%x: Invalid SSOW req, %d > max %d\n" , - pcifunc, req->sso, block->lf.max); + pcifunc, req->ssow, block->lf.max);return -EINVAL ; } mappedlfs =rvu_get_rsrc_mapcount (pfvf, block->type);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/78 net: lantiq_etop: add blank line after declaration
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit 4c46625bb586a741b8d0e6bdbddbcb2549fa1d36 ]
This patch adds a missing line after the declaration and fixes the checkpatch warning:
WARNING: Missing a blank line after declarations
+ int desc;
+ for (desc = 0; desc < LTQ_DESC_NUM; desc++)
Stable-dep-of: e1533b6319ab ("net: ethernet: lantiq_etop: fix double free in detach")
--- drivers/net/ethernet/lantiq_etop.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/lantiq_etop.c +1 -0
@@ -214,6 +214,7 @@ ltq_etop_free_channel(struct net_device *dev, struct ltq_etop_chan *ch)free_irq (ch->dma.irq, priv);if (IS_RX (ch->idx)) {int desc; +for (desc =0 ; desc <LTQ_DESC_NUM ; desc++)dev_kfree_skb_any (ch->skb[ch->dma.desc]); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/78 net: ethernet: lantiq_etop: fix double free in detach
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit e1533b6319ab9c3a97dad314dd88b3783bc41b69 ]
The number of the currently released descriptor is never incremented which results in the same skb being released multiple times.
--- drivers/net/ethernet/lantiq_etop.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/lantiq_etop.c +2 -2
@@ -213,9 +213,9 @@ ltq_etop_free_channel(struct net_device *dev, struct ltq_etop_chan *ch)if (ch->dma.irq)free_irq (ch->dma.irq, priv);if (IS_RX (ch->idx)) { -int desc; +struct ltq_dma_channel *dma = &ch->dma; -for (desc =0 ; desc <LTQ_DESC_NUM ; desc++) +for (dma->desc =0 ; dma->desc <LTQ_DESC_NUM ; dma->desc++)dev_kfree_skb_any (ch->skb[ch->dma.desc]); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/78 ppp: reject claimed-as-LCP but actually malformed packets
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit f2aeb7306a898e1cbd03963d376f4b6656ca2b55 ]
Since 'ppp_async_encode()' assumes valid LCP packets (with code from 1 to 7 inclusive), add 'ppp_check_packet()' to ensure that LCP packet has an actual body beyond PPP_LCP header bytes, and reject claimed-as-LCP but actually malformed data otherwise.
--- drivers/net/ppp/ppp_generic.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/net/ppp/ppp_generic.c +15 -0
@@ -70,6 +70,7 @@#define MPHDRLEN_SSN 4/* ditto with short sequence numbers */ #define PPP_PROTO_LEN 2 +#define PPP_LCP_HDRLEN 4/* * An instance of /dev/ppp can be associated with either a ppp
@@ -491,6 +492,15 @@ static ssize_t ppp_read(struct file *file, char __user *buf,return ret; } +static bool ppp_check_packet (struct sk_buff *skb,size_t count) +{ +/* LCP packets must include LCP header which 4 bytes long: +* 1-byte code, 1-byte identifier, and 2-byte length. +*/ +return get_unaligned_be16 (skb->data) !=PPP_LCP || + count >=PPP_PROTO_LEN +PPP_LCP_HDRLEN ; +} +static ssize_t ppp_write (struct file *file,const char __user *buf,size_t count,loff_t *ppos) {
@@ -513,6 +523,11 @@ static ssize_t ppp_write(struct file *file, const char __user *buf,kfree_skb (skb); goto out; } + ret = -EINVAL ; +if (unlikely (!ppp_check_packet (skb, count))) { +kfree_skb (skb); + goto out; + }switch (pf->kind) {case INTERFACE :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/78 udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 5c0b485a8c6116516f33925b9ce5b6104a6eadfd ]
syzkaller triggered the warning [0] in udp_v4_early_demux().
In udp_v[46]_early_demux() and sk_lookup(), we do not touch the refcount of the looked-up sk and use sock_pfree() as skb->destructor, so we check SOCK_RCU_FREE to ensure that the sk is safe to access during the RCU grace period.
Currently, SOCK_RCU_FREE is flagged for a bound socket after being put into the hash table. Moreover, the SOCK_RCU_FREE check is done too early in udp_v[46]_early_demux() and sk_lookup(), so there could be a small race window:
CPU1 CPU2
---- ----
udp_v4_early_demux() udp_lib_get_port()
| |- hlist_add_head_rcu()
|- sk = __udp4_lib_demux_lookup() |
|- DEBUG_NET_WARN_ON_ONCE(sk_is_refcounted(sk));
`- sock_set_flag(sk, SOCK_RCU_FREE)We had the same bug in TCP and fixed it in commit 871019b22d1b ("net:
set SOCK_RCU_FREE before inserting socket into hashtable").
Let's apply the same fix for UDP.
[0]:
WARNING: CPU: 0 PID: 11198 at net/ipv4/udp.c:2599 udp_v4_early_demux+0x481/0xb70 net/ipv4/udp.c:2599 Modules linked in: CPU: 0 PID: 11198 Comm: syz-executor.1 Not tainted 6.9.0-g93bda33046e7 #13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:udp_v4_early_demux+0x481/0xb70 net/ipv4/udp.c:2599 Code: c5 7a 15 fe bb 01 00 00 00 44 89 e9 31 ff d3 e3 81 e3 bf ef ff ff 89 de e8 2c 74 15 fe 85 db 0f 85 02 06 00 00 e8 9f 7a 15 fe <0f> 0b e8 98 7a 15 fe 49 8d 7e 60 e8 4f 39 2f fe 49 c7 46 60 20 52 RSP: 0018:ffffc9000ce3fa58 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8318c92c RDX: ffff888036ccde00 RSI: ffffffff8318c2f1 RDI: 0000000000000001 RBP: ffff88805a2dd6e0 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0001ffffffffffff R12: ffff88805a2dd680 R13: 0000000000000007 R14: ffff88800923f900 R15: ffff88805456004e FS: 00007fc449127640(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc449126e38 CR3: 000000003de4b002 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 PKRU: 55555554 Call Trace: <TASK> ip_rcv_finish_core.constprop.0+0xbdd/0xd20 net/ipv4/ip_input.c:349 ip_rcv_finish+0xda/0x150 net/ipv4/ip_input.c:447 NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ip_rcv+0x16c/0x180 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core+0xb3/0xe0 net/core/dev.c:5624 __netif_receive_skb+0x21/0xd0 net/core/dev.c:5738 netif_receive_skb_internal net/core/dev.c:5824 [inline] netif_receive_skb+0x271/0x300 net/core/dev.c:5884 tun_rx_batched drivers/net/tun.c:1549 [inline] tun_get_user+0x24db/0x2c50 drivers/net/tun.c:2002 tun_chr_write_iter+0x107/0x1a0 drivers/net/tun.c:2048 new_sync_write fs/read_write.c:497 [inline] vfs_write+0x76f/0x8d0 fs/read_write.c:590 ksys_write+0xbf/0x190 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0x41/0x50 fs/read_write.c:652 x64_sys_call+0xe66/0x1990 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x4b/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7fc44a68bc1f Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 e9 cf f5 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 3c d0 f5 ff 48 RSP: 002b:00007fc449126c90 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00000000004bc050 RCX: 00007fc44a68bc1f RDX: 0000000000000032 RSI: 00000000200000c0 RDI: 00000000000000c8 RBP: 00000000004bc050 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000032 R11: 0000000000000293 R12: 0000000000000000 R13: 000000000000000b R14: 00007fc44a5ec530 R15: 0000000000000000 </TASK>
--- net/ipv4/udp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ipv4/udp.c +3 -1
@@ -313,6 +313,8 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum, goto fail_unlock; } +sock_set_flag (sk,SOCK_RCU_FREE ); +sk_add_node_rcu (sk, &hslot->head); hslot->count++;sock_prot_inuse_add (sock_net (sk), sk->sk_prot,1 );
@@ -329,7 +331,7 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum, hslot2->count++;spin_unlock (&hslot2->lock); } -sock_set_flag (sk,SOCK_RCU_FREE ); + error =0 ; fail_unlock:spin_unlock_bh (&hslot->lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/78 s390: Mark psw in __load_psw_mask() as __unitialized
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Schnelle <[email protected]>
[ Upstream commit 7278a8fb8d032dfdc03d9b5d17e0bc451cdc1492 ]
Without __unitialized, the following code is generated when INIT_STACK_ALL_ZERO is enabled:
86: d7 0f f0 a0 f0 a0 xc 160(16,%r15), 160(%r15) 8c: e3 40 f0 a0 00 24 stg %r4, 160(%r15) 92: c0 10 00 00 00 08 larl %r1, 0xa2 98: e3 10 f0 a8 00 24 stg %r1, 168(%r15) 9e: b2 b2 f0 a0 lpswe 160(%r15)
The xc is not adding any security because psw is fully initialized with the following instructions. Add __unitialized to the psw definitiation to avoid the superfluous clearing of psw.
--- arch/s390/include/asm/processor.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/include/asm/processor.h +1 -1
@@ -256,8 +256,8 @@ static inline void __load_psw(psw_t psw)*/ static __always_inline void __load_psw_mask(unsigned long mask) { + psw_t psw __uninitialized;unsigned long addr; -psw_t psw; psw.mask = mask;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/78 ARM: davinci: Convert comma to semicolon
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit acc3815db1a02d654fbc19726ceaadca0d7dd81c ]
Replace a comma between expression statements by a semicolon.
--- arch/arm/mach-davinci/pm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mach-davinci/pm.c +1 -1
@@ -62,7 +62,7 @@ static void davinci_pm_suspend(void)/* Configure sleep count in deep sleep register */ val =__raw_readl (pm_config.deepsleep_reg); - val &= ~DEEPSLEEP_SLEEPCOUNT_MASK , + val &= ~DEEPSLEEP_SLEEPCOUNT_MASK ; val |= pm_config.sleepcount;__raw_writel (val, pm_config.deepsleep_reg);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/78 octeontx2-af: fix detection of IP layer
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Mazur <[email protected]>
[ Upstream commit 404dc0fd6fb0bb942b18008c6f8c0320b80aca20 ]
Checksum and length checks are not enabled for IPv4 header with options and IPv6 with extension headers.
To fix this a change in enum npc_kpu_lc_ltype is required which will allow adjustment of LTYPE_MASK to detect all types of IP headers.
--- drivers/net/ethernet/marvell/octeontx2/af/npc.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/npc.h +6 -2
@@ -38,14 +38,18 @@ enum npc_kpu_lb_ltype { NPC_LT_LB_ITAG, }; +/* Don't modify ltypes up to IP6_EXT, otherwise length and checksum of IP +* headers may not be checked correctly. IPv4 ltypes and IPv6 ltypes must +* differ only at bit 0 so mask 0xE can be used to detect extended headers. +*/ enum npc_kpu_lc_ltype { -NPC_LT_LC_IP =1 , +NPC_LT_LC_PTP =1 , +NPC_LT_LC_IP ,NPC_LT_LC_IP6 ,NPC_LT_LC_ARP ,NPC_LT_LC_RARP ,NPC_LT_LC_MPLS ,NPC_LT_LC_NSH , -NPC_LT_LC_PTP ,NPC_LT_LC_FCOE , };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/78 USB: serial: option: add Telit generic core-dump composition
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Palmas <[email protected]>
commit 4298e400dbdbf259549d69c349e060652ad53611 upstream.
Add the following core-dump composition, used in different Telit modems:
0x9000: tty (sahara)
T: Bus=03 Lev=01 Prnt=03 Port=07 Cnt=01 Dev#= 41 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=9000 Rev=00.00 S: Manufacturer=Telit Cinterion S: Product=FN990-dump S: SerialNumber=e815bdde C: #Ifs= 1 Cfg#= 1 Atr=a0 MxPwr=2mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=10 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -1433,6 +1433,8 @@ static const struct usb_device_id option .driver_info = NCTRL(2) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x701b, 0xff), /* Telit LE910R1 (ECM) */ .driver_info = NCTRL(2) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x9000, 0xff), /* Telit generic core-dump device */ + .driver_info = NCTRL(0) }, { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */ .driver_info = NCTRL(0) | ZLP }, { USB_DEVICE(TELIT_VENDOR_ID, 0x9200), /* Telit LE910S1 flashing device */
Greg Kroah-Hartman
maintainerPATCH 60/78 USB: serial: option: add Telit FN912 rmnet compositions
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Palmas <[email protected]>
commit 9a590ff283421b71560deded2110dbdcbe1f7d1d upstream.
Add the following Telit FN912 compositions:
0x3000: rmnet + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=03 Lev=01 Prnt=03 Port=07 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=3000 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN912 S: SerialNumber=92c4c4d8 C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x3001: rmnet + tty (AT) + tty (diag) + DPL (data packet logging) + adb
T: Bus=03 Lev=01 Prnt=03 Port=07 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=3001 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN912 S: SerialNumber=92c4c4d8 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/serial/option.c +4 -0
@@ -1425,6 +1425,10 @@ static const struct usb_device_id option .driver_info = NCTRL(0) | RSVD(1) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */ .driver_info = NCTRL(0) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x3000, 0xff), /* Telit FN912 */ + .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x3001, 0xff), /* Telit FN912 */ + .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7010, 0xff), /* Telit LE910-S1 (RNDIS) */ .driver_info = NCTRL(2) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7011, 0xff), /* Telit LE910-S1 (ECM) */
Greg Kroah-Hartman
maintainerPATCH 61/78 USB: serial: option: add Fibocom FM350-GL
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjørn Mork <[email protected]>
commit 2604e08ff251dba330e16b65e80074c9c540aad7 upstream.
FM350-GL is 5G Sub-6 WWAN module which uses M.2 form factor interface. It is based on Mediatek's MTK T700 CPU. The module supports PCIe Gen3 x1 and USB 2.0 and 3.0 interfaces.
The manufacturer states that USB is "for debug" but it has been confirmed to be fully functional, except for modem-control requests on some of the interfaces.
USB device composition is controlled by AT+GTUSBMODE=<mode> command. Two values are currently supported for the <mode>:
40: RNDIS+AT+AP(GNSS)+META+DEBUG+NPT+ADB
41: RNDIS+AT+AP(GNSS)+META+DEBUG+NPT+ADB+AP(LOG)+AP(META) (default value)
[ Note that the functions above are not ordered by interface number. ]
Mode 40 corresponds to:
T: Bus=03 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 22 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0e8d ProdID=7126 Rev= 0.01 S: Manufacturer=Fibocom Wireless Inc. S: Product=FM350-GL
C:* #Ifs= 8 Cfg#= 1 Atr=a0 MxPwr=500mA
A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03
I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=02 Prot=ff Driver=rndis_host
E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=125us
I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Mode 41 corresponds to:
T: Bus=03 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0e8d ProdID=7127 Rev= 0.01 S: Manufacturer=Fibocom Wireless Inc. S: Product=FM350-GL
C:* #Ifs=10 Cfg#= 1 Atr=a0 MxPwr=500mA
A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03
I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=02 Prot=ff Driver=rndis_host
E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=125us
I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/serial/option.c +4 -0
@@ -2230,6 +2230,10 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_7106_2COM, 0x02, 0x02, 0x01) }, { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x02, 0x01) }, { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x7126, 0xff, 0x00, 0x00), + .driver_info = NCTRL(2) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x7127, 0xff, 0x00, 0x00), + .driver_info = NCTRL(2) | NCTRL(3) | NCTRL(4) }, { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) }, { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MPL200), .driver_info = RSVD(1) | RSVD(4) },
Greg Kroah-Hartman
maintainerPATCH 62/78 USB: serial: option: add support for Foxconn T99W651
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Slark Xiao <[email protected]>
commit 3c841d54b63e4446383de3238399a3910e47d8e2 upstream.
T99W651 is a RNDIS based modem device. There are 3 serial ports need to be enumerated: Diag, NMEA and AT.
Test evidence as below:
T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 6 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e145 Rev=05.15 S: Manufacturer=QCOM S: Product=SDXPINN-IDP _SN:93B562B2 S: SerialNumber=82e6fe26 C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host I: If#=0x1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option I: If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option I: If#=0x5 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) I: If#=0x6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
0&1: RNDIS, 2:AT, 3:NMEA, 4:DIAG, 5:QDSS, 6:ADB
QDSS is not a serial port.
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -2294,6 +2294,8 @@ static const struct usb_device_id option .driver_info = RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0f0, 0xff), /* Foxconn T99W373 MBIM */ .driver_info = RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe145, 0xff), /* Foxconn T99W651 RNDIS */ + .driver_info = RSVD(5) | RSVD(6) }, { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, { USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */
Greg Kroah-Hartman
maintainerPATCH 63/78 USB: serial: option: add Netprisma LCUK54 series modules
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mank Wang <[email protected]>
commit dc6dbe3ed28795b01c712ad8f567728f9c14b01d upstream.
Add support for Netprisma LCUK54 series modules.
LCUK54-WRD-LWW(0x3731/0x0100): NetPrisma LCUK54-WWD for Global LCUK54-WRD-LWW(0x3731/0x0101): NetPrisma LCUK54-WRD for Global SKU LCUK54-WRD-LCN(0x3731/0x0106): NetPrisma LCUK54-WRD for China SKU LCUK54-WRD-LWW(0x3731/0x0111): NetPrisma LCUK54-WWD for SA LCUK54-WRD-LWW(0x3731/0x0112): NetPrisma LCUK54-WWD for EU LCUK54-WRD-LWW(0x3731/0x0113): NetPrisma LCUK54-WWD for NA LCUK54-WWD-LCN(0x3731/0x0115): NetPrisma LCUK54-WWD for China EDU LCUK54-WWD-LWW(0x3731/0x0116): NetPrisma LCUK54-WWD for Golbal EDU
Above products use the exact same interface layout and option driver:
MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL
T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=3731 ProdID=0101 Rev= 5.04 S: Manufacturer=NetPrisma S: Product=LCUK54-WRD S: SerialNumber=b6250c36 C:* #Ifs= 8 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E: Ad=8f(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
drivers/usb/serial/option.c +24 -0
@@ -2333,6 +2333,30 @@ static const struct usb_device_id option .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */ .driver_info = RSVD(5) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Global */ + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0101, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WRD for Global SKU */ + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0101, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0101, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0106, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WRD for China SKU */ + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0106, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0106, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0111, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for SA */ + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0111, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0111, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0112, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for EU */ + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0112, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0112, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0113, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for NA */ + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0113, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0113, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0115, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for China EDU */ + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0115, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0115, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Golbal EDU */ + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 64/78 USB: serial: option: add Rolling RW350-GL variants
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vanillan Wang <[email protected]>
commit ae420771551bd9f04347c59744dd062332bdec3e upstream.
Update the USB serial option driver support for the Rolling RW350-GL
- VID:PID 33f8:0802, RW350-GL are laptop M.2 cards (with MBIM interfaces for /Linux/Chrome OS)
Here are the outputs of usb-devices:
usbmode=63: mbim, pipe
T: Bus=02 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 P: Vendor=33f8 ProdID=0802 Rev=00.01 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=USB DATA CARD C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
usbmode=64: mbim, others at (If#= 5 adb)
MBIM(MI0) + GNSS(MI2) + AP log(MI3) + AP META(MI4) + ADB(MI5) + MD AT(MI6) + MD META(MI7) + NPT(MI8) + Debug(MI9)
T: Bus=02 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 5 Spd=5000 MxCh= 0 D: Ver= 3.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 P: Vendor=33f8 ProdID=0802 Rev=00.01 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=USB DATA CARD C: #Ifs=10 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=07(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=08(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=09(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=8a(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -2333,6 +2333,8 @@ static const struct usb_device_id option .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */ .driver_info = RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0802, 0xff), /* Rolling RW350-GL (laptop MBIM) */ + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Global */ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0x00, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 65/78 USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: WangYuli <[email protected]>
commit 3859e85de30815a20bce7db712ce3d94d40a682d upstream.
START BP-850K is a dot matrix printer that crashes when it receives a Set-Interface request and needs USB_QUIRK_NO_SET_INTF to work properly.
--- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/core/quirks.c +3 -0
@@ -504,6 +504,9 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x1b1c, 0x1b38), .driver_info = USB_QUIRK_DELAY_INIT | USB_QUIRK_DELAY_CTRL_MSG }, + /* START BP-850k Printer */ + { USB_DEVICE(0x1bc3, 0x0003), .driver_info = USB_QUIRK_NO_SET_INTF }, + /* MIDI keyboard WORLDE MINI */ { USB_DEVICE(0x1c75, 0x0204), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS },
Greg Kroah-Hartman
maintainerPATCH 66/78 usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <[email protected]>
commit 6d3c721e686ea6c59e18289b400cc95c76e927e0 upstream.
Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form if (str[0 - 1] == '\n') followed closely by an OOB write in the form str[0 - 1] = '\0'`.
There is already a validating check to catch strings that are too long. Let's supply an additional check for invalid strings that are too short.
--- drivers/usb/gadget/configfs.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/gadget/configfs.c +3 -0
@@ -116,9 +116,12 @@ static int usb_string_copy(const char *sint ret;char *str;char *copy = *s_copy; + ret =strlen (s);if (ret >USB_MAX_STRING_LEN )return -EOVERFLOW ; +if (ret <1 ) +return -EINVAL ;if (copy) { str = copy;
Greg Kroah-Hartman
maintainerPATCH 67/78 USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit a368ecde8a5055b627749b09c6218ef793043e47 upstream.
Syzbot has identified a bug in usbcore (see the Closes: tag below) caused by our assumption that the reserved bits in an endpoint descriptor's bEndpointAddress field will always be 0. As a result of the bug, the endpoint_is_duplicate() routine in config.c (and possibly other routines as well) may believe that two descriptors are for distinct endpoints, even though they have the same direction and endpoint number. This can lead to confusion, including the bug identified by syzbot (two descriptors with matching endpoint numbers and directions, where one was interrupt and the other was bulk).
To fix the bug, we will clear the reserved bits in bEndpointAddress when we parse the descriptor. (Note that both the USB-2.0 and USB-3.1 specs say these bits are "Reserved, reset to zero".) This requires us to make a copy of the descriptor earlier in usb_parse_endpoint() and use the copy instead of the original when checking for duplicates.
--- drivers/usb/core/config.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
drivers/usb/core/config.c +15 -3
@@ -291,6 +291,20 @@ static int usb_parse_endpoint(struct devif (ifp->desc.bNumEndpoints >= num_ep) goto skip_to_next_endpoint_or_interface_descriptor; +/* Save a copy of the descriptor and use it instead of the original */ + endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints]; +memcpy (&endpoint->desc, d, n); + d = &endpoint->desc; + +/* Clear the reserved bits in bEndpointAddress */ + i = d->bEndpointAddress & + (USB_ENDPOINT_DIR_MASK |USB_ENDPOINT_NUMBER_MASK ); +if (i != d->bEndpointAddress) { +dev_notice (ddev,"config %d interface %d altsetting %d has an endpoint descriptor with address 0x%X, changing to 0x%X\n" , + cfgno, inum, asnum, d->bEndpointAddress, i); + endpoint->desc.bEndpointAddress = i; + } +/* Check for duplicate endpoint addresses */ if (config_endpoint_is_duplicate (config, inum, asnum, d)) { dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n",
@@ -308,10 +322,8 @@ static int usb_parse_endpoint(struct dev } } - endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints]; +/* Accept this endpoint */ ++ifp->desc.bNumEndpoints; - -memcpy (&endpoint->desc, d, n);INIT_LIST_HEAD (&endpoint->urb_list);/*
Greg Kroah-Hartman
maintainerPATCH 68/78 hpet: Support 32-bit userspace
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: He Zhe <[email protected]>
commit 4e60131d0d36af65ab9c9144f4f163fe97ae36e8 upstream.
hpet_compat_ioctl and read file operations failed to handle parameters from 32-bit userspace and thus samples/timers/hpet_example.c fails as below.
root@intel-x86-64:~# ./hpet_example-32.out poll /dev/hpet 1 2 -hpet: executing poll hpet_poll: HPET_IRQFREQ failed
This patch fixes cmd and arg handling in hpet_compat_ioctl and adds compat handling for 32-bit userspace in hpet_read.
hpet_example now shows that it works for both 64-bit and 32-bit.
root@intel-x86-64:~# ./hpet_example-32.out poll /dev/hpet 1 2 -hpet: executing poll hpet_poll: info.hi_flags 0x0 hpet_poll: expired time = 0xf4298 hpet_poll: revents = 0x1 hpet_poll: data 0x1 hpet_poll: expired time = 0xf4235 hpet_poll: revents = 0x1 hpet_poll: data 0x1 root@intel-x86-64:~# ./hpet_example-64.out poll /dev/hpet 1 2 -hpet: executing poll hpet_poll: info.hi_flags 0x0 hpet_poll: expired time = 0xf42a1 hpet_poll: revents = 0x1 hpet_poll: data 0x1 hpet_poll: expired time = 0xf4232 hpet_poll: revents = 0x1 hpet_poll: data 0x1
--- drivers/char/hpet.c | 34 +++++++++++++++++++++++++++++----- 1 file changed, 29 insertions(+), 5 deletions(-)
drivers/char/hpet.c +29 -5
@@ -304,8 +304,13 @@ hpet_read(struct file *file, char __userif (!devp->hd_ireqfreq)return -EIO ; -if (count <sizeof (unsigned long )) -return -EINVAL ; +if (in_compat_syscall ()) { +if (count <sizeof (compat_ulong_t)) +return -EINVAL ; + }else { +if (count <sizeof (unsigned long )) +return -EINVAL ; + }add_wait_queue (&devp->hd_waitqueue, &wait);
@@ -329,9 +334,16 @@ hpet_read(struct file *file, char __userschedule (); } - retval =put_user (data, (unsigned long __user *)buf); -if (!retval) - retval =sizeof (unsigned long ); +if (in_compat_syscall ()) { + retval =put_user (data, (compat_ulong_t __user *)buf); +if (!retval) + retval =sizeof (compat_ulong_t); + }else { + retval =put_user (data, (unsigned long __user *)buf); +if (!retval) + retval =sizeof (unsigned long ); + } + out:__set_current_state (TASK_RUNNING );remove_wait_queue (&devp->hd_waitqueue, &wait);
@@ -686,12 +698,24 @@ struct compat_hpet_info {unsigned short hi_timer; }; +/* 32-bit types would lead to different command codes which should be +* translated into 64-bit ones before passed to hpet_ioctl_common +*/ +#define COMPAT_HPET_INFO _IOR('h', 0x03, struct compat_hpet_info) +#define COMPAT_HPET_IRQFREQ _IOW('h', 0x6, compat_ulong_t) +static long hpet_compat_ioctl (struct file *file,unsigned int cmd,unsigned long arg) {struct hpet_info info;int err; +if (cmd ==COMPAT_HPET_INFO ) + cmd =HPET_INFO ; + +if (cmd ==COMPAT_HPET_IRQFREQ ) + cmd =HPET_IRQFREQ ; +mutex_lock (&hpet_mutex); err =hpet_ioctl_common (file->private_data, cmd, arg, &info);mutex_unlock (&hpet_mutex);
Greg Kroah-Hartman
maintainerPATCH 69/78 nvmem: meson-efuse: Fix return value of nvmem callbacks
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joy Chakraborty <[email protected]>
commit 7a0a6d0a7c805f9380381f4deedffdf87b93f408 upstream.
Read/write callbacks registered with nvmem core expect 0 to be returned on success and a negative value to be returned on failure.
meson_efuse_read() and meson_efuse_write() call into meson_sm_call_read() and meson_sm_call_write() respectively which return the number of bytes read or written on success as per their api description.
Fix to return error if meson_sm_call_read()/meson_sm_call_write() returns an error else return 0.
--- drivers/nvmem/meson-efuse.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/nvmem/meson-efuse.c +10 -4
@@ -18,18 +18,24 @@ static int meson_efuse_read(void *contex void *val, size_t bytes) {struct meson_sm_firmware *fw = context; +int ret; -return meson_sm_call_read (fw, (u8 *)val, bytes,SM_EFUSE_READ , offset, - bytes,0 ,0 ,0 ); + ret =meson_sm_call_read (fw, (u8 *)val, bytes,SM_EFUSE_READ , offset, + bytes,0 ,0 ,0 ); + +return ret <0 ? ret :0 ; }static int meson_efuse_write (void *context,unsigned int offset,void *val,size_t bytes) {struct meson_sm_firmware *fw = context; +int ret; + + ret =meson_sm_call_write (fw, (u8 *)val, bytes,SM_EFUSE_WRITE , offset, + bytes,0 ,0 ,0 ); -return meson_sm_call_write (fw, (u8 *)val, bytes,SM_EFUSE_WRITE , offset, - bytes,0 ,0 ,0 ); +return ret <0 ? ret :0 ; }static const struct of_device_id meson_efuse_match[] = {
Greg Kroah-Hartman
maintainerPATCH 70/78 ALSA: hda/realtek: Limit mic boost on VAIO PRO PX
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edson Juliano Drosdeck <[email protected]>
commit 6db03b1929e207d2c6e84e75a9cd78124b3d6c6d upstream.
The internal mic boost on the VAIO models VJFE-CL and VJFE-IL is too high. Fix this by applying the ALC269_FIXUP_LIMIT_INT_MIC_BOOST fixup to the machine to limit the gain.
--- sound/pci/hda/patch_realtek.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/patch_realtek.c +2 -0
@@ -8331,6 +8331,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x10cf ,0x1845 ,"Lifebook U904" ,ALC269_FIXUP_LIFEBOOK_EXTMIC ),SND_PCI_QUIRK (0x10ec ,0x10f2 ,"Intel Reference board" ,ALC700_FIXUP_INTEL_REFERENCE ),SND_PCI_QUIRK (0x10ec ,0x118c ,"Medion EE4254 MD62100" ,ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE ), +SND_PCI_QUIRK (0x10ec ,0x11bc ,"VAIO VJFE-IL" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ),SND_PCI_QUIRK (0x10ec ,0x1230 ,"Intel Reference board" ,ALC295_FIXUP_CHROME_BOOK ),SND_PCI_QUIRK (0x10ec ,0x124c ,"Intel Reference board" ,ALC295_FIXUP_CHROME_BOOK ), SND_PCI_QUIRK(0x10ec, 0x1252, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK),
@@ -8494,6 +8495,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1d72 ,0x1901 ,"RedmiBook 14" ,ALC256_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1d72 ,0x1945 ,"Redmi G" ,ALC256_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1d72 ,0x1947 ,"RedmiBook Air" ,ALC255_FIXUP_XIAOMI_HEADSET_MIC ), +SND_PCI_QUIRK (0x2782 ,0x0214 ,"VAIO VJFE-CL" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ),SND_PCI_QUIRK (0x2782 ,0x0232 ,"CHUWI CoreBook XPro" ,ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO ),SND_PCI_QUIRK (0x2782 ,0x1707 ,"Vaio VJFE-ADL" ,ALC298_FIXUP_SPK_VOLUME ), SND_PCI_QUIRK(0x8086, 0x2074, "Intel NUC 8", ALC233_FIXUP_INTEL_NUC8_DMIC),
Greg Kroah-Hartman
maintainerPATCH 71/78 libceph: fix race between delayed_work() and ceph_monc_stop()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <[email protected]>
commit 69c7b2fe4c9cc1d3b1186d1c5606627ecf0de883 upstream.
The way the delayed work is handled in ceph_monc_stop() is prone to races with mon_fault() and possibly also finish_hunting(). Both of these can requeue the delayed work which wouldn't be canceled by any of the following code in case that happens after cancel_delayed_work_sync() runs -- __close_session() doesn't mess with the delayed work in order to avoid interfering with the hunting interval logic. This part was missed in commit b5d91704f53e ("libceph: behave in mon_fault() if cur_mon < 0") and use-after-free can still ensue on monc and objects that hang off of it, with monc->auth and monc->monmap being particularly susceptible to quickly being reused.
To fix this:
- clear monc->cur_mon and monc->hunting as part of closing the session in ceph_monc_stop()
- bail from delayed_work() if monc->cur_mon is cleared, similar to how it's done in mon_fault() and finish_hunting() (based on monc->hunting)
- call cancel_delayed_work_sync() after the session is closed
--- net/ceph/mon_client.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
net/ceph/mon_client.c +12 -2
@@ -975,13 +975,19 @@ static void delayed_work(struct work_strstruct ceph_mon_client *monc = container_of(work, struct ceph_mon_client, delayed_work.work); -dout ("monc delayed_work\n" );mutex_lock (&monc->mutex); +dout ("%s mon%d\n" , __func__, monc->cur_mon); +if (monc->cur_mon <0 ) { + goto out; + } +if (monc->hunting) {dout ("%s continuing hunt\n" , __func__);reopen_session (monc); }else {int is_auth =ceph_auth_is_authenticated (monc->auth); + +dout ("%s is_authed %d\n" , __func__, is_auth);if (ceph_con_keepalive_expired (&monc->con,CEPH_MONC_PING_TIMEOUT )) {dout ("monc keepalive timeout\n" );
@@ -1006,6 +1012,8 @@ static void delayed_work(struct work_str } }__schedule_delayed (monc); + +out:mutex_unlock (&monc->mutex); }
@@ -1118,13 +1126,15 @@ EXPORT_SYMBOL(ceph_monc_init);void ceph_monc_stop (struct ceph_mon_client *monc) {dout ("stop\n" ); -cancel_delayed_work_sync (&monc->delayed_work);mutex_lock (&monc->mutex);__close_session (monc); + monc->hunting = false; monc->cur_mon =-1 ;mutex_unlock (&monc->mutex); +cancel_delayed_work_sync (&monc->delayed_work); +/* * flush msgr queue before we destroy ourselves to ensure that: * - any work that references our embedded con is finished.
Greg Kroah-Hartman
maintainerPATCH 72/78 SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: felix <[email protected]>
commit bfca5fb4e97c46503ddfc582335917b0cc228264 upstream.
RPC client pipefs dentries cleanup is in separated rpc_remove_pipedir() workqueue,which takes care about pipefs superblock locking. In some special scenarios, when kernel frees the pipefs sb of the current client and immediately alloctes a new pipefs sb, rpc_remove_pipedir function would misjudge the existence of pipefs sb which is not the one it used to hold. As a result,
the rpc_remove_pipedir would clean the released freed pipefs dentries.
To fix this issue, rpc_remove_pipedir should check whether the current pipefs sb is consistent with the original pipefs sb.
This error can be catched by KASAN:
=========================================================
[ 250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200 [ 250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503 [ 250.500549] Workqueue: events rpc_free_client_work [ 250.501001] Call Trace: [ 250.502880] kasan_report+0xb6/0xf0 [ 250.503209] ? dget_parent+0x195/0x200 [ 250.503561] dget_parent+0x195/0x200 [ 250.503897] ? __pfx_rpc_clntdir_depopulate+0x10/0x10 [ 250.504384] rpc_rmdir_depopulate+0x1b/0x90 [ 250.504781] rpc_remove_client_dir+0xf5/0x150 [ 250.505195] rpc_free_client_work+0xe4/0x230 [ 250.505598] process_one_work+0x8ee/0x13b0 ... [ 22.039056] Allocated by task 244: [ 22.039390] kasan_save_stack+0x22/0x50 [ 22.039758] kasan_set_track+0x25/0x30 [ 22.040109] __kasan_slab_alloc+0x59/0x70 [ 22.040487] kmem_cache_alloc_lru+0xf0/0x240 [ 22.040889] __d_alloc+0x31/0x8e0 [ 22.041207] d_alloc+0x44/0x1f0 [ 22.041514] __rpc_lookup_create_exclusive+0x11c/0x140 [ 22.041987] rpc_mkdir_populate.constprop.0+0x5f/0x110 [ 22.042459] rpc_create_client_dir+0x34/0x150 [ 22.042874] rpc_setup_pipedir_sb+0x102/0x1c0 [ 22.043284] rpc_client_register+0x136/0x4e0 [ 22.043689] rpc_new_client+0x911/0x1020 [ 22.044057] rpc_create_xprt+0xcb/0x370 [ 22.044417] rpc_create+0x36b/0x6c0 ... [ 22.049524] Freed by task 0: [ 22.049803] kasan_save_stack+0x22/0x50 [ 22.050165] kasan_set_track+0x25/0x30 [ 22.050520] kasan_save_free_info+0x2b/0x50 [ 22.050921] __kasan_slab_free+0x10e/0x1a0 [ 22.051306] kmem_cache_free+0xa5/0x390 [ 22.051667] rcu_core+0x62c/0x1930 [ 22.051995] __do_softirq+0x165/0x52a [ 22.052347] [ 22.052503] Last potentially related work creation: [ 22.052952] kasan_save_stack+0x22/0x50 [ 22.053313] __kasan_record_aux_stack+0x8e/0xa0 [ 22.053739] __call_rcu_common.constprop.0+0x6b/0x8b0 [ 22.054209] dentry_free+0xb2/0x140 [ 22.054540] __dentry_kill+0x3be/0x540 [ 22.054900] shrink_dentry_list+0x199/0x510 [ 22.055293] shrink_dcache_parent+0x190/0x240 [ 22.055703] do_one_tree+0x11/0x40 [ 22.056028] shrink_dcache_for_umount+0x61/0x140 [ 22.056461] generic_shutdown_super+0x70/0x590 [ 22.056879] kill_anon_super+0x3a/0x60 [ 22.057234] rpc_kill_sb+0x121/0x200
--- include/linux/sunrpc/clnt.h | 1 + net/sunrpc/clnt.c | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-)
include/linux/sunrpc/clnt.h +1 -0
@@ -73,6 +73,7 @@ struct rpc_clnt {#endif struct rpc_xprt_iter cl_xpi;const struct cred *cl_cred; +struct super_block *pipefs_sb; };/*
net/sunrpc/clnt.c +4 -1
@@ -113,7 +113,8 @@ static void rpc_clnt_remove_pipedir(stru pipefs_sb =rpc_get_sb_net (net);if (pipefs_sb) { -__rpc_clnt_remove_pipedir (clnt); +if (pipefs_sb == clnt->pipefs_sb) +__rpc_clnt_remove_pipedir (clnt);rpc_put_sb_net (net); } }
@@ -153,6 +154,8 @@ rpc_setup_pipedir(struct super_block *pi {struct dentry *dentry; + clnt->pipefs_sb = pipefs_sb; +if (clnt->cl_program->pipe_dir_name !=NULL ) { dentry =rpc_setup_pipedir_sb (pipefs_sb, clnt);if (IS_ERR (dentry))
Greg Kroah-Hartman
maintainerPATCH 73/78 tcp: refactor tcp_retransmit_timer()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 0d580fbd2db084a5c96ee9c00492236a279d5e0f upstream.
It appears linux-4.14 stable needs a backport of commit 88f8598d0a30 ("tcp: exit if nothing to retransmit on RTO timeout")
Since tcp_rtx_queue_empty() is not in pre 4.15 kernels, let's refactor tcp_retransmit_timer() to only use tcp_rtx_queue_head()
I will provide to stable teams the squashed patches.
--- net/ipv4/tcp_timer.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
net/ipv4/tcp_timer.c +8 -2
@@ -452,6 +452,7 @@ void tcp_retransmit_timer(struct sock *sstruct net *net =sock_net (sk);struct inet_connection_sock *icsk =inet_csk (sk);struct request_sock *req; +struct sk_buff *skb; req =rcu_dereference_protected (tp->fastopen_rsk,lockdep_sock_is_held (sk));
@@ -464,7 +465,12 @@ void tcp_retransmit_timer(struct sock *s*/ return ; } -if (!tp->packets_out ||WARN_ON_ONCE (tcp_rtx_queue_empty (sk))) + +if (!tp->packets_out) +return ; + + skb =tcp_rtx_queue_head (sk); +if (WARN_ON_ONCE (!skb))return ; if (!tp->snd_wnd && !sock_flag(sk, SOCK_DEAD) &&
@@ -496,7 +502,7 @@ void tcp_retransmit_timer(struct sock *s goto out; }tcp_enter_loss (sk); -tcp_retransmit_skb (sk,tcp_rtx_queue_head (sk),1 ); +tcp_retransmit_skb (sk, skb,1 );__sk_dst_reset (sk); goto out_reset_timer; }
Greg Kroah-Hartman
maintainerPATCH 74/78 net: tcp: fix unexcepted socket die when snd_wnd is 0
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Menglong Dong <[email protected]>
commit e89688e3e97868451a5d05b38a9d2633d6785cd4 upstream.
In tcp_retransmit_timer(), a window shrunk connection will be regarded as timeout if 'tcp_jiffies32 - tp->rcv_tstamp > TCP_RTO_MAX'. This is not right all the time.
The retransmits will become zero-window probes in tcp_retransmit_timer() if the 'snd_wnd==0'. Therefore, the icsk->icsk_rto will come up to TCP_RTO_MAX sooner or later.
However, the timer can be delayed and be triggered after 122877ms, not TCP_RTO_MAX, as I tested.
Therefore, 'tcp_jiffies32 - tp->rcv_tstamp > TCP_RTO_MAX' is always true once the RTO come up to TCP_RTO_MAX, and the socket will die.
Fix this by replacing the 'tcp_jiffies32' with '(u32)icsk->icsk_timeout', which is exact the timestamp of the timeout.
However, "tp->rcv_tstamp" can restart from idle, then tp->rcv_tstamp could already be a long time (minutes or hours) in the past even on the first RTO. So we double check the timeout with the duration of the retransmission.
Meanwhile, making "2 * TCP_RTO_MAX" as the timeout to avoid the socket dying too soon.
--- net/ipv4/tcp_timer.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
net/ipv4/tcp_timer.c +17 -1
@@ -434,6 +434,22 @@ static void tcp_fastopen_synack_timer(st TCP_TIMEOUT_INIT << req->num_timeout, TCP_RTO_MAX); } +static bool tcp_rtx_probe0_timed_out (const struct sock *sk, +const struct sk_buff *skb) +{ +const struct tcp_sock *tp =tcp_sk (sk); +const int timeout =TCP_RTO_MAX *2 ; +u32 rcv_delta, rtx_delta; + + rcv_delta =inet_csk (sk)->icsk_timeout - tp->rcv_tstamp; +if (rcv_delta <= timeout) +return false; + + rtx_delta = (u32 )msecs_to_jiffies (tcp_time_stamp (tp) - + (tp->retrans_stamp ?:tcp_skb_timestamp (skb))); + +return rtx_delta > timeout; +}/** * tcp_retransmit_timer() - The TCP retransmit timeout handler
@@ -497,7 +513,7 @@ void tcp_retransmit_timer(struct sock *s tp->snd_una, tp->snd_nxt); }#endif -if (tcp_jiffies32 - tp->rcv_tstamp >TCP_RTO_MAX ) { +if (tcp_rtx_probe0_timed_out (sk, skb)) {tcp_write_err (sk); goto out; }
Greg Kroah-Hartman
maintainerPATCH 75/78 tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 36534d3c54537bf098224a32dc31397793d4594d upstream.
Due to timer wheel implementation, a timer will usually fire after its schedule.
For instance, for HZ=1000, a timeout between 512ms and 4s has a granularity of 64ms.
For this range of values, the extra delay could be up to 63ms.
For TCP, this means that tp->rcv_tstamp may be after inet_csk(sk)->icsk_timeout whenever the timer interrupt finally triggers, if one packet came during the extra delay.
We need to make sure tcp_rtx_probe0_timed_out() handles this case.
--- net/ipv4/tcp_timer.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/ipv4/tcp_timer.c +6 -1
@@ -439,8 +439,13 @@ static bool tcp_rtx_probe0_timed_out(con {const struct tcp_sock *tp =tcp_sk (sk);const int timeout =TCP_RTO_MAX *2 ; -u32 rcv_delta, rtx_delta; +u32 rtx_delta; +s32 rcv_delta; +/* Note: timer interrupt might have been delayed by at least one jiffy, +* and tp->rcv_tstamp might very well have been written recently. +* rcv_delta can thus be negative. +*/ rcv_delta =inet_csk (sk)->icsk_timeout - tp->rcv_tstamp;if (rcv_delta <= timeout)return false;
Greg Kroah-Hartman
maintainerPATCH 76/78 tcp: avoid too many retransmit packets
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 97a9063518f198ec0adb2ecb89789de342bb8283 upstream.
If a TCP socket is using TCP_USER_TIMEOUT, and the other peer retracted its window to zero, tcp_retransmit_timer() can retransmit a packet every two jiffies (2 ms for HZ=1000), for about 4 minutes after TCP_USER_TIMEOUT has 'expired'.
The fix is to make sure tcp_rtx_probe0_timed_out() takes icsk->icsk_user_timeout into account.
Before blamed commit, the socket would not timeout after icsk->icsk_user_timeout, but would use standard exponential backoff for the retransmits.
Also worth noting that before commit e89688e3e978 ("net: tcp:
fix unexcepted socket die when snd_wnd is 0"), the issue would last 2 minutes instead of 4.
--- net/ipv4/tcp_timer.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-)
net/ipv4/tcp_timer.c +17 -5
@@ -437,22 +437,34 @@ static void tcp_fastopen_synack_timer(ststatic bool tcp_rtx_probe0_timed_out (const struct sock *sk,const struct sk_buff *skb) { +const struct inet_connection_sock *icsk =inet_csk (sk); +u32 user_timeout =READ_ONCE (icsk->icsk_user_timeout);const struct tcp_sock *tp =tcp_sk (sk); -const int timeout =TCP_RTO_MAX *2 ; +int timeout =TCP_RTO_MAX *2 ;u32 rtx_delta;s32 rcv_delta; + rtx_delta = (u32 )msecs_to_jiffies (tcp_time_stamp (tp) - + (tp->retrans_stamp ?:tcp_skb_timestamp (skb))); + +if (user_timeout) { +/* If user application specified a TCP_USER_TIMEOUT, +* it does not want win 0 packets to 'reset the timer' +* while retransmits are not making progress. +*/ +if (rtx_delta > user_timeout) +return true; + timeout =min_t (u32, timeout,msecs_to_jiffies (user_timeout)); + } +/* Note: timer interrupt might have been delayed by at least one jiffy, * and tp->rcv_tstamp might very well have been written recently. * rcv_delta can thus be negative. */ - rcv_delta =inet_csk (sk)->icsk_timeout - tp->rcv_tstamp; + rcv_delta = icsk->icsk_timeout - tp->rcv_tstamp;if (rcv_delta <= timeout)return false; - rtx_delta = (u32 )msecs_to_jiffies (tcp_time_stamp (tp) - - (tp->retrans_stamp ?:tcp_skb_timestamp (skb))); -return rtx_delta > timeout; }
Greg Kroah-Hartman
maintainerPATCH 77/78 nilfs2: fix kernel bug on rename operation of broken directory
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit a9e1ddc09ca55746079cc479aa3eb6411f0d99d4 upstream.
Syzbot reported that in rename directory operation on broken directory on nilfs2, __block_write_begin_int() called to prepare block write may fail BUG_ON check for access exceeding the folio/page size.
This is because nilfs_dotdot(), which gets parent directory reference entry ("..") of the directory to be moved or renamed, does not check consistency enough, and may return location exceeding folio/page size for broken directories.
Fix this issue by checking required directory entries ("." and "..") in the first chunk of the directory in nilfs_dotdot().
--- fs/nilfs2/dir.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-)
fs/nilfs2/dir.c +30 -2
@@ -396,11 +396,39 @@ found:struct nilfs_dir_entry *nilfs_dotdot (struct inode *dir,struct page **p) { -struct nilfs_dir_entry *de =nilfs_get_page (dir,0 , p); +struct page *page; +struct nilfs_dir_entry *de, *next_de; +size_t limit; +char *msg; + de =nilfs_get_page (dir,0 , &page);if (IS_ERR (de))return NULL ; -return nilfs_next_entry (de); + + limit =nilfs_last_byte (dir,0 );/* is a multiple of chunk size */ +if (unlikely (!limit ||le64_to_cpu (de->inode) != dir->i_ino || + !nilfs_match (1 ,"." , de))) { + msg ="missing '.'" ; + goto fail; + } + + next_de =nilfs_next_entry (de); +/* +* If "next_de" has not reached the end of the chunk, there is +* at least one more record. Check whether it matches "..". +*/ +if (unlikely ((char *)next_de == (char *)de +nilfs_chunk_size (dir) || + !nilfs_match (2 ,".." , next_de))) { + msg ="missing '..'" ; + goto fail; + } + *p = page; +return next_de; + +fail: +nilfs_error (dir->i_sb,"directory #%lu %s" , dir->i_ino, msg); +nilfs_put_page (page); +return NULL ; }ino_t nilfs_inode_by_name (struct inode *dir,const struct qstr *qstr)
Greg Kroah-Hartman
maintainerPATCH 78/78 i2c: rcar: bring hardware to known state when probing
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit 4e36c0f20cb1c74c7bd7ea31ba432c1c4a989031 ]
When probing, the hardware is not brought into a known state. This may be a problem when a hypervisor restarts Linux without resetting the hardware, leaving an old state running. Make sure the hardware gets initialized, especially interrupts should be cleared and disabled.
--- drivers/i2c/busses/i2c-rcar.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
drivers/i2c/busses/i2c-rcar.c +12 -5
@@ -218,6 +218,14 @@ static void rcar_i2c_init(struct rcar_i2c_priv *priv) } +static void rcar_i2c_reset_slave (struct rcar_i2c_priv *priv) +{ +rcar_i2c_write (priv,ICSIER ,0 ); +rcar_i2c_write (priv,ICSSR ,0 ); +rcar_i2c_write (priv,ICSCR ,SDBS ); +rcar_i2c_write (priv,ICSAR ,0 );/* Gen2: must be 0 if not using slave */ +} +static int rcar_i2c_bus_barrier (struct rcar_i2c_priv *priv) {int i;
@@ -863,11 +871,8 @@ static int rcar_unreg_slave(struct i2c_client *slave)/* ensure no irq is running before clearing ptr */ disable_irq (priv->irq); -rcar_i2c_write (priv,ICSIER ,0 ); -rcar_i2c_write (priv,ICSSR ,0 ); +rcar_i2c_reset_slave (priv);enable_irq (priv->irq); -rcar_i2c_write (priv,ICSCR ,SDBS ); -rcar_i2c_write (priv,ICSAR ,0 );/* Gen2: must be 0 if not using slave */ priv->slave =NULL ;
@@ -973,7 +978,9 @@ static int rcar_i2c_probe(struct platform_device *pdev)if (ret <0 ) goto out_pm_put; -rcar_i2c_write (priv,ICSAR ,0 );/* Gen2: must be 0 if not using slave */ +/* Bring hardware to known state */ +rcar_i2c_init (priv); +rcar_i2c_reset_slave (priv);if (priv->devtype ==I2C_RCAR_GEN3 ) { priv->rstc =devm_reset_control_get_exclusive (&pdev->dev,NULL );
Signature · 1 line
2.43.0
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.280 release. There are 78 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 18 Jul 2024 15:27:21 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.280-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.280 release. There are 78 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 18 Jul 2024 15:27:21 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.280-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
The 390 builds failed on stable-rc 5.10.222-rc1 review; it has been reported on 6.6, 6.1, 5.15, 5.10 and now on 5.4.
Started from this round of stable rc on 5.4.280-rc1.
Good:eee0f6627f74 ("Linux 5.4.279-rc2")
BAD: 51945679d212 ("Linux 5.4.280-rc1")
* s390, build
- clang-18-allnoconfig
- clang-18-defconfig
- clang-18-tinyconfig
- clang-nightly-allnoconfig
- clang-nightly-defconfig
- clang-nightly-tinyconfig
- gcc-12-allnoconfig
- gcc-12-defconfig
- gcc-12-tinyconfig
- gcc-8-allnoconfig
- gcc-8-defconfig-fe40093d
- gcc-8-tinyconfig
Build log:
-------
arch/s390/include/asm/processor.h: In function '__load_psw_mask':arch/s390/include/asm/processor.h:259:19: error: expected '=', ',', ';', 'asm' or '__attribute__' before '__uninitialized'
259 | psw_t psw __uninitialized;
| ^~~~~~~~~~~~~~~
arch/s390/include/asm/processor.h:259:19: error: '__uninitialized'
undeclared (first use in this function); did you mean
'uninitialized_var'?
259 | psw_t psw __uninitialized;
| ^~~~~~~~~~~~~~~
| uninitialized_vararch/s390/include/asm/processor.h:259:19: note: each undeclared identifier is reported only once for each function it appears in arch/s390/include/asm/processor.h:260:9: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement]
260 | unsigned long addr;
| ^~~~~~~~
arch/s390/include/asm/processor.h:262:9: error: 'psw' undeclared
(first use in this function); did you mean 'psw_t'?
262 | psw.mask = mask;
| ^~~
| psw_tmetadata:
-----
config: https://storage.tuxsuite.com/public/linaro/lkft/builds/2jKrMGFV9tK3IYnSE2ntEa22g0J/config
download_url:
https://storage.tuxsuite.com/public/linaro/lkft/builds/2jKrMGFV9tK3IYnSE2ntEa22g0J/
git_describe: v5.4.279-79-g51945679d212
git_repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git_sha: 51945679d212aae61a418eff41370c13da94f94d
git_short_log: 51945679d212 ("Linux 5.4.280-rc1")
arch: s390
toolchain: gcc-12 and clang
Steps to reproduce:
----------
# tuxmake --runtime podman --target-arch s390 --toolchain gcc-12 --kconfig tinyconfig
--
Linaro LKFT
https://lkft.linaro.org
Greg Kroah-Hartman
maintainerQuoted 85 lines · Naresh Kamboju
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.280 release. There are 78 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 18 Jul 2024 15:27:21 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.280-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
The 390 builds failed on stable-rc 5.10.222-rc1 review; it has been reported on 6.6, 6.1, 5.15, 5.10 and now on 5.4.
Started from this round of stable rc on 5.4.280-rc1.
Good:eee0f6627f74 ("Linux 5.4.279-rc2")
BAD:51945679d212("Linux 5.4.280-rc1")* s390, build
- clang-18-allnoconfig
- clang-18-defconfig
- clang-18-tinyconfig
- clang-nightly-allnoconfig
- clang-nightly-defconfig
- clang-nightly-tinyconfig
- gcc-12-allnoconfig
- gcc-12-defconfig
- gcc-12-tinyconfig
- gcc-8-allnoconfig
- gcc-8-defconfig-fe40093d
- gcc-8-tinyconfigBuild log:
-------
arch/s390/include/asm/processor.h: In function '__load_psw_mask':arch/s390/include/asm/processor.h:259:19: error: expected '=', ',', ';', 'asm' or '__attribute__' before '__uninitialized'259 | psw_t psw __uninitialized; | ^~~~~~~~~~~~~~~ arch/s390/include/asm/processor.h:259:19: error: '__uninitialized' undeclared (first use in this function); did you mean 'uninitialized_var'? 259 | psw_t psw __uninitialized; | ^~~~~~~~~~~~~~~ | uninitialized_var
arch/s390/include/asm/processor.h:259:19: note: each undeclared identifier is reported only once for each function it appears inarch/s390/include/asm/processor.h:260:9: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement]260 | unsigned long addr; | ^~~~~~~~ arch/s390/include/asm/processor.h:262:9: error: 'psw' undeclared (first use in this function); did you mean 'psw_t'? 262 | psw.mask = mask; | ^~~ | psw_tmetadata:
-----
config: https://storage.tuxsuite.com/public/linaro/lkft/builds/2jKrMGFV9tK3IYnSE2ntEa22g0J/config
download_url:
https://storage.tuxsuite.com/public/linaro/lkft/builds/2jKrMGFV9tK3IYnSE2ntEa22g0J/
git_describe: v5.4.279-79-g51945679d212
git_repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git_sha:51945679d212aae61a418eff41370c13da94f94d
git_short_log:51945679d212("Linux 5.4.280-rc1")
arch: s390
toolchain: gcc-12 and clang
Quoted 4 lines
Steps to reproduce:
----------# tuxmake --runtime podman --target-arch s390 --toolchain gcc-12 --kconfig tinyconfig
Should now be fixed, thanks.
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.280 release. There are 78 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 18 Jul 2024 15:27:21 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.280-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah