5.10.224-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 5.10.224-rc1 review
This is the start of the stable review cycle for the 5.10.224 release. There are 352 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 17 Aug 2024 13:18:17 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.224-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.224-rc1
Michael Walle <[email protected]>
ARM: dts: imx6qdl-kontron-samx6i: fix phy-mode
Eric Dumazet <[email protected]>
wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
Jason Wang <[email protected]>
vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler
Cai Huoqing <[email protected]>
vdpa: Make use of PFN_PHYS/PFN_UP/PFN_DOWN helper macro
WangYuli <[email protected]>
nvme/pci: Add APST quirk for Lenovo N60z laptop
Kees Cook <[email protected]>
exec: Fix ToCToU between perm check and set-uid/gid usage
Yunke Cao <[email protected]>
media: uvcvideo: Use entity get_cur in uvc_ctrl_set
Amit Daniel Kachhap <[email protected]>
arm64: cpufeature: Fix the visibility of compat hwcaps
Mahesh Salgaonkar <[email protected]>
powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
Andi Shyti <[email protected]>
drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
Florian Westphal <[email protected]>
netfilter: nf_tables: prefer nft_chain_validate
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: allow clone callbacks to sleep
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: use timestamp to check for set element timeout
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: set element extended ACK reporting support
Lukas Wunner <[email protected]>
PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal
Jari Ruusu <[email protected]>
Fix gcc 4.9 build issue in 5.10.y
Linus Torvalds <[email protected]>
Add gitignore file for samples/fanotify/ subdirectory
Gabriel Krisman Bertazi <[email protected]>
samples: Make fs-monitor depend on libc and headers
Gabriel Krisman Bertazi <[email protected]>
samples: Add fs error monitoring example
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: fix backup support in signal endpoints
Geliang Tang <[email protected]>
mptcp: export local_address
Matthieu Baerts (NGI0) <[email protected]>
mptcp: mib: count MPJ with backup flag
Paolo Abeni <[email protected]>
mptcp: fix NL PM announced address accounting
Matthieu Baerts (NGI0) <[email protected]>
mptcp: distinguish rcv vs sent backup flag in requests
Matthieu Baerts (NGI0) <[email protected]>
mptcp: sched: check both directions for backup
Thomas Zimmermann <[email protected]>
drm/mgag200: Set DDC timeout in milliseconds
Lucas Stach <[email protected]>
drm/bridge: analogix_dp: properly handle zero sized AUX transactions
Andi Kleen <[email protected]>
x86/mtrr: Check if fixed MTRRs exist before saving them
Waiman Long <[email protected]>
padata: Fix possible divide-by-0 panic in padata_mt_helper()
Tze-nan Wu <[email protected]>
tracing: Fix overflow in get_free_elt()
Hans de Goede <[email protected]>
power: supply: axp288_charger: Round constant_charge_voltage writes down
Hans de Goede <[email protected]>
power: supply: axp288_charger: Fix constant_charge_voltage writes
Shay Drory <[email protected]>
genirq/irqdesc: Honor caller provided affinity in alloc_desc()
Radhey Shyam Pandey <[email protected]>
irqchip/xilinx: Fix shift out of bounds
George Kennedy <[email protected]>
serial: core: check uartclk for zero to avoid divide by zero
Arseniy Krasnov <[email protected]>
irqchip/meson-gpio: Convert meson_gpio_irq_controller::lock to 'raw_spinlock_t'
Qianggui Song <[email protected]>
irqchip/meson-gpio: support more than 8 channels gpio irq
Damien Le Moal <[email protected]>
scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
Sreekanth Reddy <[email protected]>
scsi: mpt3sas: Remove scsi_dma_map() error messages
Justin Stitt <[email protected]>
ntp: Safeguard against time_constant overflow
Dan Williams <[email protected]>
driver core: Fix uevent_show() vs driver detach race
Justin Stitt <[email protected]>
ntp: Clamp maxerror and esterror to operating range
Thomas Gleixner <[email protected]>
tick/broadcast: Move per CPU pointer access into the atomic section
Vamshi Gajjela <[email protected]>
scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic
Prashanth K <[email protected]>
usb: gadget: u_serial: Set start_delayed during suspend
Chris Wulff <[email protected]>
usb: gadget: core: Check for unset descriptor
Marek Marczykowski-Górecki <[email protected]>
USB: serial: debug: do not echo input by default
Oliver Neukum <[email protected]>
usb: vhci-hcd: Do not drop references before new references are gained
Takashi Iwai <[email protected]>
ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4
Steven 'Steve' Kendall <[email protected]>
ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list
Takashi Iwai <[email protected]>
ALSA: line6: Fix racy access to midibuf
Ma Ke <[email protected]>
drm/client: fix null pointer dereference in drm_client_modeset_probe
Takashi Iwai <[email protected]>
ALSA: usb-audio: Re-add ScratchAmp quirk entries
Stefan Wahren <[email protected]>
spi: spi-fsl-lpspi: Fix scldiv calculation
Masami Hiramatsu (Google) <[email protected]>
kprobes: Fix to check symbol prefixes correctly
Menglong Dong <[email protected]>
bpf: kprobe: remove unused declaring of bpf_kprobe_override
Guenter Roeck <[email protected]>
i2c: smbus: Send alert notifications to all devices if source not found
Krzysztof Kozlowski <[email protected]>
ASoC: codecs: wsa881x: Correct Soundwire ports mask
Guenter Roeck <[email protected]>
i2c: smbus: Improve handling of stuck alerts
Mark Rutland <[email protected]>
arm64: errata: Expand speculative SSBS workaround (again)
Mark Rutland <[email protected]>
arm64: cputype: Add Cortex-A725 definitions
Mark Rutland <[email protected]>
arm64: cputype: Add Cortex-X1C definitions
Mark Rutland <[email protected]>
arm64: errata: Expand speculative SSBS workaround
Mark Rutland <[email protected]>
arm64: errata: Unify speculative SSBS errata logic
Mark Rutland <[email protected]>
arm64: cputype: Add Cortex-X925 definitions
Mark Rutland <[email protected]>
arm64: cputype: Add Cortex-A720 definitions
Mark Rutland <[email protected]>
arm64: cputype: Add Cortex-X3 definitions
Mark Rutland <[email protected]>
arm64: errata: Add workaround for Arm errata 3194386 and 3312417
Mark Rutland <[email protected]>
arm64: cputype: Add Neoverse-V3 definitions
Mark Rutland <[email protected]>
arm64: cputype: Add Cortex-X4 definitions
Besar Wicaksono <[email protected]>
arm64: Add Neoverse-V2 part
James Morse <[email protected]>
arm64: cpufeature: Force HWCAP to be based on the sysreg visible to user-space
Kemeng Shi <[email protected]>
ext4: fix wrong unit use in ext4_mb_find_by_goal
Zheng Zucheng <[email protected]>
sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
Benjamin Coddington <[email protected]>
SUNRPC: Fix a race to wake a sync task
Peter Oberparleiter <[email protected]>
s390/sclp: Prevent release of buffer in I/O
Kemeng Shi <[email protected]>
jbd2: avoid memleak in jbd2_journal_write_metadata_buffer
Michal Pecio <[email protected]>
media: uvcvideo: Fix the bandwdith quirk on USB 3.x
Ricardo Ribalda <[email protected]>
media: uvcvideo: Ignore empty TS packets
Ma Jun <[email protected]>
drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules
Ma Jun <[email protected]>
drm/amdgpu: Fix the null pointer dereference to ras_manager
Filipe Manana <[email protected]>
btrfs: fix bitmap leak when loading free space cache on duplicate entry
Johannes Berg <[email protected]>
wifi: nl80211: don't give key data to userspace
Roman Smirnov <[email protected]>
udf: prevent integer overflow in udf_bitmap_free_blocks()
FUJITA Tomonori <[email protected]>
PCI: Add Edimax Vendor ID to pci_ids.h
Yonghong Song <[email protected]>
selftests/bpf: Fix send_signal test with nested CONFIG_PARAVIRT
Thomas Weißschuh <[email protected]>
ACPI: SBS: manage alarm sysfs attribute through psy core
Thomas Weißschuh <[email protected]>
ACPI: battery: create alarm sysfs attribute atomically
Niklas Söderlund <[email protected]>
clocksource/drivers/sh_cmt: Address race condition for clock events
Yu Kuai <[email protected]>
md/raid5: avoid BUG_ON() while continue reshape after reassembling
Li Nan <[email protected]>
md: do not delete safemode_timer in mddev_suspend
Paul E. McKenney <[email protected]>
rcutorture: Fix rcu_torture_fwd_cb_cr() data race
Csókás, Bence <[email protected]>
net: fec: Stop PPS on driver remove
James Chapman <[email protected]>
l2tp: fix lockdep splat
Joe Hattori <[email protected]>
net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
Dmitry Antipov <[email protected]>
Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()
Eric Dumazet <[email protected]>
net: linkwatch: use system_unbound_wq
Daniele Palmas <[email protected]>
net: usb: qmi_wwan: fix memory leak for not ip packets
Kuniyuki Iwashima <[email protected]>
sctp: Fix null-ptr-deref in reuseport_add_sock().
Xin Long <[email protected]>
sctp: move hlist_node and hashent out of sctp_ep_common
Peter Zijlstra <[email protected]>
x86/mm: Fix pti_clone_entry_text() for i386
Peter Zijlstra <[email protected]>
x86/mm: Fix pti_clone_pgtable() alignment assumption
Yipeng Zou <[email protected]>
irqchip/mbigen: Fix mbigen node address layout
Marc Zyngier <[email protected]>
genirq: Allow irq_chip registration functions to take a const irq_chip
Alexander Maltsev <[email protected]>
netfilter: ipset: Add list flush to cancel_gc
Paolo Abeni <[email protected]>
mptcp: fix duplicate data handling
Heiner Kallweit <[email protected]>
r8169: don't increment tx_dropped in case of NETDEV_TX_BUSY
Ma Ke <[email protected]>
net: usb: sr9700: fix uninitialized variable use in sr_mdio_read
Mavroudis Chatzilazaridis <[email protected]>
ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G
Takashi Iwai <[email protected]>
ALSA: usb-audio: Correct surround channels in UAC1 channel map
Al Viro <[email protected]>
protect the fetch of ->fd[fd] in do_dup2() from mispredictions
Tatsunosuke Tobita <[email protected]>
HID: wacom: Modify pen IDs
Patryk Duda <[email protected]>
platform/chrome: cros_ec_proto: Lock device when updating MKBP version
Zhe Qiao <[email protected]>
riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()
Maciej Żenczykowski <[email protected]>
ipv6: fix ndisc_is_useropt() handling for PIO
Shahar Shitrit <[email protected]>
net/mlx5e: Add a check for the return value from mlx5_port_set_eth_ptys
Alexandra Winter <[email protected]>
net/iucv: fix use after free in iucv_sock_close()
Eric Dumazet <[email protected]>
sched: act_ct: take care of padding in struct zones_ht_key
Ian Forbes <[email protected]>
drm/vmwgfx: Fix overlay when using Screen Targets
Danilo Krummrich <[email protected]>
drm/nouveau: prime: fix refcount underflow
Aleksandr Mishin <[email protected]>
remoteproc: imx_rproc: Skip over memory region when node value is NULL
Dong Aisheng <[email protected]>
remoteproc: imx_rproc: Fix ignoring mapping vdev regions
Peng Fan <[email protected]>
remoteproc: imx_rproc: ignore mapping vdev regions
Shenwei Wang <[email protected]>
irqchip/imx-irqsteer: Handle runtime power management correctly
Lucas Stach <[email protected]>
irqchip/imx-irqsteer: Add runtime PM support
Lucas Stach <[email protected]>
irqchip/imx-irqsteer: Constify irq_chip struct
Marc Zyngier <[email protected]>
genirq: Allow the PM device to originate from irq domain
Zijun Hu <[email protected]>
devres: Fix memory leakage caused by driver API devm_free_percpu()
Andy Shevchenko <[email protected]>
driver core: Cast to (void *) with __force for __percpu pointer
Jay Buddhabhatti <[email protected]>
drivers: soc: xilinx: check return status of get_api_version()
Michael Tretter <[email protected]>
soc: xilinx: move PM_INIT_FINALIZE to zynqmp_pm_domains driver
Zhang Yi <[email protected]>
ext4: check the extent status again before inserting delalloc block
Zhang Yi <[email protected]>
ext4: factor out a common helper to query extent map
Thomas Weißschuh <[email protected]>
sysctl: always initialize i_uid/i_gid
Eric Sandeen <[email protected]>
fuse: verify {g,u}id mount options correctly
Miklos Szeredi <[email protected]>
fuse: name fs_context consistently
Esben Haabendal <[email protected]>
powerpc/configs: Update defconfig with now user-visible CONFIG_FSL_IFC
Seth Forshee (DigitalOcean) <[email protected]>
fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT
Leon Romanovsky <[email protected]>
nvme-pci: add missing condition check for existence of mapped data
Jens Axboe <[email protected]>
nvme: split command copy into a helper
Gerd Bayer <[email protected]>
s390/pci: Allow allocation of more than 1 MSI interrupt
Gerd Bayer <[email protected]>
s390/pci: Refactor arch_setup_msi_irqs()
Thomas Gleixner <[email protected]>
s390/pci: Rework MSI descriptor walk
Thomas Gleixner <[email protected]>
s390/pci: Do not mask MSI[-X] entries on teardown
ethanwu <[email protected]>
ceph: fix incorrect kmalloc size of pagevec mempool
Pierre-Louis Bossart <[email protected]>
ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable
Al Viro <[email protected]>
lirc: rc_dev_get_from_fd(): fix file leak
Al Viro <[email protected]>
powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap()
Xiao Liang <[email protected]>
apparmor: Fix null pointer deref when receiving skb during sock creation
Dan Carpenter <[email protected]>
mISDN: Fix a use after free in hfcmulti_tx()
Fred Li <[email protected]>
bpf: Fix a segment issue when downgrading gso_size
Petr Machata <[email protected]>
net: nexthop: Initialize all fields in dumped nexthops
Simon Horman <[email protected]>
net: stmmac: Correct byte order of perfect_match
Shigeru Yoshida <[email protected]>
tipc: Return non-zero value from tipc_udp_addr2str() on error
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo_avx2: disable softinterrupts
Johannes Berg <[email protected]>
net: bonding: correctly annotate RCU in bond_should_notify_peers()
Ido Schimmel <[email protected]>
ipv4: Fix incorrect source address in Record Route option
Gregory CLEMENT <[email protected]>
MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later
Lance Richardson <[email protected]>
dma: fix call order in dmam_free_coherent
Andrii Nakryiko <[email protected]>
libbpf: Fix no-args func prototype BTF dumping syntax
Sheng Yong <[email protected]>
f2fs: fix start segno of large section
Johannes Berg <[email protected]>
um: time-travel: fix time-travel-start option
Jeongjun Park <[email protected]>
jfs: Fix array-index-out-of-bounds in diFree
Douglas Anderson <[email protected]>
kdb: Use the passed prompt in kdb_position_cursor()
Arnd Bergmann <[email protected]>
kdb: address -Wformat-security warnings
Pavel Begunkov <[email protected]>
kernel: rerun task_work while freezing in get_signal()
Pavel Begunkov <[email protected]>
io_uring/io-wq: limit retrying worker initialisation
Ryusuke Konishi <[email protected]>
nilfs2: handle inconsistent state in nilfs_btnode_create_block()
WangYuli <[email protected]>
Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591
Hilda Wu <[email protected]>
Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables
Ilya Dryomov <[email protected]>
rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings
Ilya Dryomov <[email protected]>
rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait
Dragan Simic <[email protected]>
drm/panfrost: Mark simple_ondemand governor as softdep
Jiaxun Yang <[email protected]>
MIPS: Loongson64: env: Hook up Loongsson-2K
Jiaxun Yang <[email protected]>
MIPS: ip30: ip30-console: Add missing include
Ilya Dryomov <[email protected]>
rbd: don't assume rbd_is_lock_owner() for exclusive mappings
Michael Ellerman <[email protected]>
selftests/sigaltstack: Fix ppc64 GCC build
Bart Van Assche <[email protected]>
RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
Jiaxun Yang <[email protected]>
platform: mips: cpu_hwmon: Disable driver on unsupported hardware
Thomas Gleixner <[email protected]>
watchdog/perf: properly initialize the turbo mode timestamp and rearm counter
Joy Chakraborty <[email protected]>
rtc: isl1208: Fix return value of nvmem callbacks
Adrian Hunter <[email protected]>
perf/x86/intel/pt: Fix a topa_entry base address calculation
Marco Cavenati <[email protected]>
perf/x86/intel/pt: Fix topa_entry base length
Nilesh Javali <[email protected]>
scsi: qla2xxx: validate nvme_local_port correctly
Shreyas Deodhar <[email protected]>
scsi: qla2xxx: Complete command early within lock
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix flash read failure
Shreyas Deodhar <[email protected]>
scsi: qla2xxx: Fix for possible memory corruption
Manish Rangankar <[email protected]>
scsi: qla2xxx: During vport delete send async logout explicitly
Joy Chakraborty <[email protected]>
rtc: cmos: Fix return value of nvmem callbacks
Zijun Hu <[email protected]>
devres: Fix devm_krealloc() wasting memory
Zijun Hu <[email protected]>
kobject_uevent: Fix OOB access within zap_modalias_env()
Nathan Chancellor <[email protected]>
kbuild: Fix '-S -c' in x86 stack protector scripts
Ross Lagerwall <[email protected]>
decompress_bunzip2: fix rare decompression failure
Fedor Pchelkin <[email protected]>
ubi: eba: properly rollback inside self_check_eba
Bastien Curutchet <[email protected]>
clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use
Chao Yu <[email protected]>
f2fs: fix to don't dirty inode for readonly filesystem
Saurav Kashyap <[email protected]>
scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds
tuhaowen <[email protected]>
dev/parport: fix the array out-of-bounds risk
Carlos Llamas <[email protected]>
binder: fix hang of unregistered readers
Manivannan Sadhasivam <[email protected]>
PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio
Wei Liu <[email protected]>
PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN
Ilpo Järvinen <[email protected]>
hwrng: amd - Convert PCIBIOS_* return codes to errnos
Alan Stern <[email protected]>
tools/memory-model: Fix bug in lock.cat
Sean Christopherson <[email protected]>
KVM: VMX: Split out the non-virtualization part of vmx_interrupt_blocked()
Jan Kara <[email protected]>
jbd2: make jbd2_journal_get_max_txn_bufs() internal
Ilpo Järvinen <[email protected]>
leds: ss4200: Convert PCIBIOS_* return codes to errnos
Rafael Beims <[email protected]>
wifi: mwifiex: Fix interface type change
Baokun Li <[email protected]>
ext4: make sure the first directory block is not a hole
Baokun Li <[email protected]>
ext4: check dot and dotdot of dx_root before making dir indexed
Paolo Pisati <[email protected]>
m68k: amiga: Turn off Warp1260 interrupts during boot
Jan Kara <[email protected]>
udf: Avoid using corrupted block bitmap buffer
Frederic Weisbecker <[email protected]>
task_work: Introduce task_work_cancel() again
Frederic Weisbecker <[email protected]>
task_work: s/task_work_cancel()/task_work_cancel_func()/
Fedor Pchelkin <[email protected]>
apparmor: use kvfree_sensitive to free data->data
Pierre Gondois <[email protected]>
sched/fair: Use all little CPUs for CPU-bound workloads
Sung Joon Kim <[email protected]>
drm/amd/display: Check for NULL pointer
Shreyas Deodhar <[email protected]>
scsi: qla2xxx: Fix optrom version displayed in FDMI
Ma Ke <[email protected]>
drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
Ma Ke <[email protected]>
drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
Jan Kara <[email protected]>
ext2: Verify bitmap and itable block numbers before using them
Chao Yu <[email protected]>
hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
Dikshita Agarwal <[email protected]>
media: venus: fix use after free in vdec_close
Joe Hattori <[email protected]>
char: tpm: Fix possible memory leak in tpm_bios_measurements_open()
Tejun Heo <[email protected]>
sched/fair: set_load_weight() must also call reweight_task() for SCHED_IDLE tasks
Nicolas Dichtel <[email protected]>
ipv6: take care of scope when choosing the src addr
Chengen Du <[email protected]>
af_packet: Handle outgoing VLAN packets without hardware offloading
Breno Leitao <[email protected]>
net: netconsole: Disable target before netpoll cleanup
Yu Liao <[email protected]>
tick/broadcast: Make takeover of broadcast hrtimer reliable
Krzysztof Kozlowski <[email protected]>
dt-bindings: thermal: correct thermal zone node name limit
Csókás, Bence <[email protected]>
rtc: interface: Add RTC offset to alarm after fix-up
Ryusuke Konishi <[email protected]>
nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro
Alex Shi <[email protected]>
fs/nilfs2: remove some unused macros to tame gcc
David Hildenbrand <[email protected]>
fs/proc/task_mmu: indicate PM_FILE for PMD-mapped file THP
Peng Fan <[email protected]>
pinctrl: freescale: mxs: Fix refcount of child
Yang Yingliang <[email protected]>
pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails
Uwe Kleine-König <[email protected]>
pinctrl: ti: ti-iodelay: Drop if block with always false condition
Yang Yingliang <[email protected]>
pinctrl: single: fix possible memory leak when pinctrl_enable() fails
Yang Yingliang <[email protected]>
pinctrl: core: fix possible memory leak when pinctrl_enable() fails
Dmitry Yashin <[email protected]>
pinctrl: rockchip: update rk3308 iomux routes
Martin Willi <[email protected]>
net: dsa: b53: Limit chip-wide jumbo frame config to CPU ports
Martin Willi <[email protected]>
net: dsa: mv88e6xxx: Limit chip-wide frame size config to CPU ports
Pablo Neira Ayuso <[email protected]>
netfilter: ctnetlink: use helper function to calculate expect ID
Jack Wang <[email protected]>
bnxt_re: Fix imm_data endianness
Chengchang Tang <[email protected]>
RDMA/hns: Fix missing pagesize and alignment check in FRMR
Nick Bowler <[email protected]>
macintosh/therm_windtunnel: fix module unload.
Michael Ellerman <[email protected]>
powerpc/xmon: Fix disassembly CPU feature checks
Dominique Martinet <[email protected]>
MIPS: Octeron: remove source file executable bit
Dmitry Torokhov <[email protected]>
Input: elan_i2c - do not leave interrupt disabled on suspend failure
Leon Romanovsky <[email protected]>
RDMA/device: Return error earlier if port in not valid
Arnd Bergmann <[email protected]>
mtd: make mtd_test.c a separate module
Chen Ni <[email protected]>
ASoC: max98088: Check for clk_prepare_enable() error
Honggang LI <[email protected]>
RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs
Leon Romanovsky <[email protected]>
RDMA/mlx4: Fix truncated output warning in alias_GUID.c
Leon Romanovsky <[email protected]>
RDMA/mlx4: Fix truncated output warning in mad.c
Andrei Lalaev <[email protected]>
Input: qt1050 - handle CHIP_ID reading error
James Clark <[email protected]>
coresight: Fix ref leak when of_coresight_parse_endpoint() fails
Ilpo Järvinen <[email protected]>
PCI: Fix resource double counting on remove & rescan
Benjamin Coddington <[email protected]>
SUNRPC: Fixup gss_status tracepoint error output
Andreas Larsson <[email protected]>
sparc64: Fix incorrect function signature and add prototype for prom_cif_init
Jan Kara <[email protected]>
ext4: avoid writing unitialized memory to disk in EA inodes
NeilBrown <[email protected]>
SUNRPC: avoid soft lockup when transmitting UDP to reachable server.
Chuck Lever <[email protected]>
xprtrdma: Fix rpcrdma_reqs_reset()
Chuck Lever <[email protected]>
xprtrdma: Rename frwr_release_mr()
Javier Carrasco <[email protected]>
mfd: omap-usb-tll: Use struct_size to allocate tll
Dikshita Agarwal <[email protected]>
media: venus: flush all buffers in output plane streamoff
Luis Henriques (SUSE) <[email protected]>
ext4: fix infinite loop when replaying fast_commit
Luca Ceresoli <[email protected]>
Revert "leds: led-core: Fix refcount leak in of_led_get()"
Chen Ni <[email protected]>
drm/qxl: Add check for drm_cvt_mode
Lucas Stach <[email protected]>
drm/etnaviv: fix DMA direction handling for cached RW buffers
Namhyung Kim <[email protected]>
perf report: Fix condition in sort__sym_cmp()
Hans de Goede <[email protected]>
leds: trigger: Unregister sysfs attributes before calling deactivate()
Laurent Pinchart <[email protected]>
media: renesas: vsp1: Store RPF partition configuration per RPF instance
Laurent Pinchart <[email protected]>
media: renesas: vsp1: Fix _irqsave and _irq mix
Daniel Schaefer <[email protected]>
media: uvcvideo: Override default flags
Ricardo Ribalda <[email protected]>
media: uvcvideo: Allow entity-defined get_info and get_cur
Aleksandr Burakov <[email protected]>
saa7134: Unchecked i2c_transfer function result fixed
David Hildenbrand <[email protected]>
s390/uv: Don't call folio_wait_writeback() without a folio reference
Matthew Wilcox (Oracle) <[email protected]>
s390/mm: Convert gmap_make_secure to use a folio
Matthew Wilcox (Oracle) <[email protected]>
s390/mm: Convert make_page_secure to use a folio
Claudio Imbrenda <[email protected]>
KVM: s390: fix race in gmap_make_secure()
Claudio Imbrenda <[email protected]>
KVM: s390: pv: add export before import
Claudio Imbrenda <[email protected]>
KVM: s390: pv: properly handle page flags for protected guests
Claudio Imbrenda <[email protected]>
KVM: s390: pv: avoid stalls when making pages secure
Ricardo Ribalda <[email protected]>
media: imon: Fix race getting ictx->lock
Zheng Yejian <[email protected]>
media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
Douglas Anderson <[email protected]>
drm/panel: boe-tv101wum-nl6: Check for errors on the NOP in prepare()
Douglas Anderson <[email protected]>
drm/panel: boe-tv101wum-nl6: If prepare fails, disable GPIO before regulators
Taehee Yoo <[email protected]>
xdp: fix invalid wait context of page_pool_destroy()
Amit Cohen <[email protected]>
selftests: forwarding: devlink_lib: Wait for udev events after reloading
Alan Maguire <[email protected]>
bpf: Eliminate remaining "make W=1" warnings in kernel/bpf/btf.o
Alexey Kodanev <[email protected]>
bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
Alan Maguire <[email protected]>
bpf: annotate BTF show functions with __printf
Geliang Tang <[email protected]>
selftests/bpf: Close fd in error path in drop_on_reuseport
Johannes Berg <[email protected]>
wifi: virt_wifi: don't use strlen() in const context
Gaosheng Cui <[email protected]>
gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey
En-Wei Wu <[email protected]>
wifi: virt_wifi: avoid reporting connection success with wrong SSID
Shai Malin <[email protected]>
qed: Improve the stack space of filter_config()
Adrian Hunter <[email protected]>
perf: Prevent passing zero nr_pages to rb_alloc_aux()
Adrian Hunter <[email protected]>
perf: Fix perf_aux_size() for greater-than 32-bit size
Adrian Hunter <[email protected]>
perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: rise cap on SELinux secmark context
Ismael Luceno <[email protected]>
ipvs: Avoid unnecessary calls to skb_is_gso_sctp
Csókás, Bence <[email protected]>
net: fec: Fix FEC_ECR_EN1588 being cleared on link-down
Csókás Bence <[email protected]>
net: fec: Refactor: #define magic constants
Baochen Qiang <[email protected]>
wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
Baochen Qiang <[email protected]>
wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he()
Baochen Qiang <[email protected]>
wifi: ath11k: fix wrong handling of CCMP256 and GCMP ciphers
Carl Huang <[email protected]>
ath11k: dp: stop rx pktlog before suspend
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl: Fix ACL scale regression and firmware errors
Amit Cohen <[email protected]>
mlxsw: spectrum_acl_bloom_filter: Make mlxsw_sp_acl_bf_key_encode() more flexible
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_erp: Fix object nesting warning
Ido Schimmel <[email protected]>
lib: objagg: Fix general protection fault
Geliang Tang <[email protected]>
selftests/bpf: Check length of recv in test_sockmap
Guangguan Wang <[email protected]>
net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined
Stefan Raspl <[email protected]>
net/smc: Allow SMC-D 1MB DMB allocations
Hagar Hemdan <[email protected]>
net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP
Geliang Tang <[email protected]>
selftests/bpf: Fix prog numbers in test_sockmap
Samasth Norway Ananda <[email protected]>
wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device
Marek Behún <[email protected]>
firmware: turris-mox-rwtm: Initialize completion before mailbox
Marek Behún <[email protected]>
firmware: turris-mox-rwtm: Fix checking return value of wait_for_completion_timeout()
Dmitry Torokhov <[email protected]>
ARM: spitz: fix GPIO assignment for backlight
Arnd Bergmann <[email protected]>
ARM: pxa: spitz: use gpio descriptors for audio
Thorsten Blum <[email protected]>
m68k: cmpxchg: Fix return value for default case in __arch_xchg()
Chen Ni <[email protected]>
x86/xen: Convert comma to semicolon
Eero Tamminen <[email protected]>
m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages
Jerome Brunet <[email protected]>
arm64: dts: amlogic: gx: correct hdmi clocks
Rafał Miłecki <[email protected]>
arm64: dts: mediatek: mt7622: fix "emmc" pinctrl mux
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8183-kukui: Drop bogus output-enable property
Michael Walle <[email protected]>
ARM: dts: imx6qdl-kontron-samx6i: fix PCIe reset polarity
Michael Walle <[email protected]>
ARM: dts: imx6qdl-kontron-samx6i: fix SPI0 chip selects
Michael Walle <[email protected]>
ARM: dts: imx6qdl-kontron-samx6i: fix board reset
Michael Walle <[email protected]>
ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset
Marco Felsch <[email protected]>
ARM: dts: imx6qdl-kontron-samx6i: move phy reset into phy-node
Jonas Karlman <[email protected]>
arm64: dts: rockchip: Increase VOP clk rate on RK3328
Dmitry Baryshkov <[email protected]>
soc: qcom: pdr: fix parsing of domains lists
Dmitry Baryshkov <[email protected]>
soc: qcom: pdr: protect locator_addr with the main mutex
Esben Haabendal <[email protected]>
memory: fsl_ifc: Make FSL_IFC config visible and selectable
Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: msm8996: specify UFS core_clk frequencies
Stephen Boyd <[email protected]>
soc: qcom: rpmh-rsc: Ensure irqs aren't disabled by rpmh_rsc_send_data() callers
Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sdm845: add power-domain to UFS PHY
Guenter Roeck <[email protected]>
hwmon: (max6697) Fix swapped temp{1,8} critical alarms
Guenter Roeck <[email protected]>
hwmon: (max6697) Fix underflow when writing limit attributes
Uwe Kleine-König <[email protected]>
pwm: stm32: Always do lazy disabling
Wayne Tung <[email protected]>
hwmon: (adt7475) Fix default duty on fan is disabled
Ilpo Järvinen <[email protected]>
x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos
Ilpo Järvinen <[email protected]>
x86/pci/xen: Fix PCIBIOS_* return code handling
Ilpo Järvinen <[email protected]>
x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling
Ilpo Järvinen <[email protected]>
x86/of: Return consistent error type from x86_of_pci_irq_enable()
Chao Yu <[email protected]>
hfsplus: fix to avoid false alarm of circular locking
Tzung-Bi Shih <[email protected]>
platform/chrome: cros_ec_debugfs: fix wrong EC message version
Arnd Bergmann <[email protected]>
EDAC, i10nm: make skx_common.o a separate module
Qiuxu Zhuo <[email protected]>
EDAC/skx_common: Add new ADXL components for 2-level memory
-------------
Diffstat:
Documentation/arm64/cpu-feature-registers.rst | 38 ++++-
Documentation/arm64/silicon-errata.rst | 36 +++++
.../devicetree/bindings/thermal/thermal-zones.yaml | 5 +-
Makefile | 4 +-
arch/arm/boot/dts/imx6q-kontron-samx6i.dtsi | 23 ---
arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 26 +++-
arch/arm/mach-pxa/spitz.c | 39 +++--
arch/arm/mach-pxa/{include/mach => }/spitz.h | 2 +-
arch/arm/mach-pxa/spitz_pm.c | 2 +-
arch/arm64/Kconfig | 38 +++++
arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi | 4 +-
arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 4 +-
.../boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts | 4 +-
arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts | 4 +-
arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 2 -
arch/arm64/boot/dts/qcom/msm8996.dtsi | 2 +-
arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +
arch/arm64/boot/dts/rockchip/rk3328.dtsi | 4 +-
arch/arm64/include/asm/cpucaps.h | 3 +-
arch/arm64/include/asm/cputype.h | 16 ++
arch/arm64/kernel/cpu_errata.c | 31 ++++
arch/arm64/kernel/cpufeature.c | 94 +++++++++---
arch/arm64/kernel/proton-pack.c | 12 ++
arch/m68k/amiga/config.c | 9 ++
arch/m68k/atari/ataints.c | 6 +-
arch/m68k/include/asm/cmpxchg.h | 2 +-
arch/mips/include/asm/mach-loongson64/boot_param.h | 2 +
arch/mips/include/asm/mips-cm.h | 4 +
arch/mips/kernel/smp-cps.c | 5 +-
arch/mips/loongson64/env.c | 8 +
arch/mips/pci/pcie-octeon.c | 0
arch/mips/sgi-ip30/ip30-console.c | 1 +
arch/powerpc/configs/85xx-hw.config | 2 +
arch/powerpc/include/asm/percpu.h | 10 ++
arch/powerpc/kernel/mce.c | 14 +-
arch/powerpc/kernel/setup_64.c | 2 +
arch/powerpc/kernel/traps.c | 8 +-
arch/powerpc/kvm/powerpc.c | 4 +-
arch/powerpc/xmon/ppc-dis.c | 33 ++---
arch/riscv/mm/fault.c | 17 ++-
arch/s390/include/asm/pgtable.h | 9 +-
arch/s390/include/asm/uv.h | 10 +-
arch/s390/kernel/uv.c | 163 +++++++++++++++------
arch/s390/kvm/intercept.c | 5 +
arch/s390/mm/gmap.c | 4 +-
arch/s390/pci/pci_irq.c | 120 +++++++++------
arch/sparc/include/asm/oplib_64.h | 1 +
arch/sparc/prom/init_64.c | 3 -
arch/sparc/prom/p1275.c | 2 +-
arch/um/kernel/time.c | 4 +-
arch/x86/events/intel/pt.c | 4 +-
arch/x86/events/intel/pt.h | 4 +-
arch/x86/kernel/cpu/mtrr/mtrr.c | 2 +-
arch/x86/kernel/devicetree.c | 2 +-
arch/x86/kvm/vmx/vmx.c | 11 +-
arch/x86/kvm/vmx/vmx.h | 1 +
arch/x86/mm/pti.c | 8 +-
arch/x86/pci/intel_mid_pci.c | 4 +-
arch/x86/pci/xen.c | 4 +-
arch/x86/platform/intel/iosf_mbi.c | 4 +-
arch/x86/xen/p2m.c | 4 +-
drivers/acpi/battery.c | 16 +-
drivers/acpi/sbs.c | 23 +--
drivers/android/binder.c | 4 +-
drivers/base/core.c | 13 +-
drivers/base/devres.c | 13 +-
drivers/base/module.c | 4 +
drivers/block/rbd.c | 35 ++---
drivers/bluetooth/btusb.c | 4 +
drivers/char/hw_random/amd-rng.c | 4 +-
drivers/char/tpm/eventlog/common.c | 2 +
drivers/clk/davinci/da8xx-cfgchip.c | 4 +-
drivers/clocksource/sh_cmt.c | 13 +-
drivers/edac/Makefile | 10 +-
drivers/edac/skx_common.c | 88 +++++++++--
drivers/edac/skx_common.h | 15 +-
drivers/firmware/turris-mox-rwtm.c | 18 +--
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 7 +-
drivers/gpu/drm/amd/display/dc/core/dc_surface.c | 3 +-
.../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 7 +-
.../gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c | 14 +-
.../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 7 +-
drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c | 5 +-
drivers/gpu/drm/drm_client_modeset.c | 5 +
drivers/gpu/drm/etnaviv/etnaviv_gem.c | 6 +-
drivers/gpu/drm/gma500/cdv_intel_lvds.c | 3 +
drivers/gpu/drm/gma500/psb_intel_lvds.c | 3 +
drivers/gpu/drm/i915/gem/i915_gem_mman.c | 53 ++++++-
drivers/gpu/drm/mgag200/mgag200_i2c.c | 2 +-
drivers/gpu/drm/nouveau/nouveau_prime.c | 3 +-
drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 8 +-
drivers/gpu/drm/panfrost/panfrost_drv.c | 1 +
drivers/gpu/drm/qxl/qxl_display.c | 3 +
drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c | 2 +-
drivers/hid/wacom_wac.c | 3 +-
drivers/hwmon/adt7475.c | 2 +-
drivers/hwmon/max6697.c | 5 +-
drivers/hwtracing/coresight/coresight-platform.c | 4 +-
drivers/i2c/i2c-smbus.c | 64 +++++++-
drivers/infiniband/core/device.c | 6 +-
drivers/infiniband/core/iwcm.c | 11 +-
drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 +-
drivers/infiniband/hw/bnxt_re/qplib_fp.h | 6 +-
drivers/infiniband/hw/hns/hns_roce_device.h | 4 +
drivers/infiniband/hw/hns/hns_roce_mr.c | 5 +
drivers/infiniband/hw/mlx4/alias_GUID.c | 2 +-
drivers/infiniband/hw/mlx4/mad.c | 2 +-
drivers/infiniband/sw/rxe/rxe_req.c | 7 +-
drivers/input/keyboard/qt1050.c | 7 +-
drivers/input/mouse/elan_i2c_core.c | 2 +
drivers/irqchip/irq-imx-irqsteer.c | 40 ++++-
drivers/irqchip/irq-mbigen.c | 20 ++-
drivers/irqchip/irq-meson-gpio.c | 35 +++--
drivers/irqchip/irq-xilinx-intc.c | 2 +-
drivers/isdn/hardware/mISDN/hfcmulti.c | 7 +-
drivers/leds/led-class.c | 1 -
drivers/leds/led-triggers.c | 2 +-
drivers/leds/leds-ss4200.c | 7 +-
drivers/macintosh/therm_windtunnel.c | 2 +-
drivers/md/md.c | 1 -
drivers/md/raid5.c | 20 ++-
drivers/media/pci/saa7134/saa7134-dvb.c | 8 +-
drivers/media/platform/qcom/venus/vdec.c | 3 +-
drivers/media/platform/vsp1/vsp1_histo.c | 20 +--
drivers/media/platform/vsp1/vsp1_pipe.h | 2 +-
drivers/media/platform/vsp1/vsp1_rpf.c | 8 +-
drivers/media/rc/imon.c | 5 +-
drivers/media/rc/lirc_dev.c | 4 +-
drivers/media/usb/dvb-usb/dvb-usb-init.c | 35 ++++-
drivers/media/usb/uvc/uvc_ctrl.c | 90 ++++++++----
drivers/media/usb/uvc/uvc_video.c | 37 ++++-
drivers/media/usb/uvc/uvcvideo.h | 5 +
drivers/memory/Kconfig | 2 +-
drivers/mfd/omap-usb-tll.c | 3 +-
drivers/mtd/nand/raw/Kconfig | 3 +-
drivers/mtd/tests/Makefile | 34 ++---
drivers/mtd/tests/mtd_test.c | 9 ++
drivers/mtd/ubi/eba.c | 3 +-
drivers/net/bonding/bond_main.c | 7 +-
drivers/net/dsa/b53/b53_common.c | 3 +
drivers/net/dsa/bcm_sf2.c | 4 +-
drivers/net/dsa/mv88e6xxx/chip.c | 3 +-
drivers/net/ethernet/brocade/bna/bna_types.h | 2 +-
drivers/net/ethernet/brocade/bna/bnad.c | 11 +-
drivers/net/ethernet/freescale/fec_main.c | 52 +++++--
drivers/net/ethernet/freescale/fec_ptp.c | 3 +
.../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 7 +-
.../ethernet/mellanox/mlxsw/spectrum_acl_atcam.c | 18 +--
.../mellanox/mlxsw/spectrum_acl_bloom_filter.c | 38 +++--
.../net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c | 13 --
.../ethernet/mellanox/mlxsw/spectrum_acl_tcam.h | 9 +-
drivers/net/ethernet/qlogic/qed/qed_l2.c | 23 +--
drivers/net/ethernet/qlogic/qede/qede_filter.c | 47 +++---
drivers/net/ethernet/realtek/r8169_main.c | 8 +-
drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 +-
.../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 2 +-
drivers/net/ethernet/stmicro/stmmac/hwif.h | 2 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 +-
drivers/net/netconsole.c | 2 +-
drivers/net/usb/qmi_wwan.c | 1 +
drivers/net/usb/sr9700.c | 11 +-
drivers/net/wireless/ath/ath11k/dp.h | 1 +
drivers/net/wireless/ath/ath11k/dp_rx.c | 51 ++++++-
drivers/net/wireless/ath/ath11k/dp_rx.h | 6 +
drivers/net/wireless/ath/ath11k/mac.c | 19 ++-
.../broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | 18 +--
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 2 +
drivers/net/wireless/virt_wifi.c | 20 ++-
drivers/nvme/host/pci.c | 36 +++--
drivers/parport/procfs.c | 24 +--
drivers/pci/controller/pci-hyperv.c | 4 +-
drivers/pci/controller/pcie-rockchip.c | 2 +-
drivers/pci/msi.c | 4 +-
drivers/pci/pci.c | 19 ++-
drivers/pci/setup-bus.c | 6 +-
drivers/pinctrl/core.c | 12 +-
drivers/pinctrl/freescale/pinctrl-mxs.c | 4 +-
drivers/pinctrl/pinctrl-rockchip.c | 17 +--
drivers/pinctrl/pinctrl-single.c | 7 +-
drivers/pinctrl/ti/pinctrl-ti-iodelay.c | 14 +-
drivers/platform/chrome/cros_ec_debugfs.c | 1 +
drivers/platform/chrome/cros_ec_proto.c | 2 +
drivers/platform/mips/cpu_hwmon.c | 3 +
drivers/power/supply/axp288_charger.c | 24 +--
drivers/pwm/pwm-stm32.c | 5 +-
drivers/remoteproc/imx_rproc.c | 5 +
drivers/rtc/interface.c | 9 +-
drivers/rtc/rtc-cmos.c | 10 +-
drivers/rtc/rtc-isl1208.c | 11 +-
drivers/s390/char/sclp_sd.c | 10 +-
drivers/scsi/mpt3sas/mpt3sas_base.c | 38 ++---
drivers/scsi/qla2xxx/qla_bsg.c | 2 +-
drivers/scsi/qla2xxx/qla_gs.c | 2 +-
drivers/scsi/qla2xxx/qla_init.c | 63 ++++++--
drivers/scsi/qla2xxx/qla_mid.c | 2 +-
drivers/scsi/qla2xxx/qla_nvme.c | 5 +-
drivers/scsi/qla2xxx/qla_os.c | 7 +-
drivers/scsi/qla2xxx/qla_sup.c | 108 +++++++++-----
drivers/scsi/ufs/ufshcd.c | 11 +-
drivers/soc/qcom/pdr_interface.c | 8 +-
drivers/soc/qcom/rpmh-rsc.c | 7 +-
drivers/soc/qcom/rpmh.c | 1 -
drivers/soc/xilinx/zynqmp_pm_domains.c | 16 ++
drivers/soc/xilinx/zynqmp_power.c | 5 +-
drivers/spi/spi-fsl-lpspi.c | 6 +-
drivers/tty/serial/serial_core.c | 8 +
drivers/usb/gadget/function/u_serial.c | 1 +
drivers/usb/gadget/udc/core.c | 10 +-
drivers/usb/serial/usb_debug.c | 7 +
drivers/usb/usbip/vhci_hcd.c | 9 +-
drivers/vhost/vdpa.c | 30 ++--
fs/btrfs/free-space-cache.c | 1 +
fs/ceph/super.c | 3 +-
fs/exec.c | 8 +-
fs/ext2/balloc.c | 11 +-
fs/ext4/extents_status.c | 2 +
fs/ext4/inode.c | 78 ++++++----
fs/ext4/mballoc.c | 3 +-
fs/ext4/namei.c | 73 +++++++--
fs/ext4/xattr.c | 6 +
fs/f2fs/inode.c | 3 +
fs/f2fs/segment.h | 3 +-
fs/file.c | 1 +
fs/fuse/control.c | 10 +-
fs/fuse/inode.c | 80 ++++++----
fs/fuse/virtio_fs.c | 12 +-
fs/hfs/inode.c | 3 +
fs/hfsplus/bfind.c | 15 +-
fs/hfsplus/extents.c | 9 +-
fs/hfsplus/hfsplus_fs.h | 21 +++
fs/jbd2/commit.c | 2 +-
fs/jbd2/journal.c | 6 +
fs/jfs/jfs_imap.c | 5 +-
fs/nilfs2/btnode.c | 25 +++-
fs/nilfs2/btree.c | 4 +-
fs/nilfs2/segment.c | 7 +-
fs/proc/proc_sysctl.c | 6 +-
fs/proc/task_mmu.c | 2 +
fs/super.c | 11 ++
fs/udf/balloc.c | 51 +++----
fs/udf/super.c | 3 +-
include/linux/compiler_attributes.h | 1 +
include/linux/irq.h | 7 +-
include/linux/irqdomain.h | 10 ++
include/linux/jbd2.h | 5 -
include/linux/msi.h | 2 -
include/linux/objagg.h | 1 -
include/linux/pci_ids.h | 2 +
include/linux/qed/qed_eth_if.h | 21 +--
include/linux/sched/signal.h | 6 +
include/linux/task_work.h | 3 +-
include/linux/trace_events.h | 1 -
include/net/netfilter/nf_tables.h | 25 +++-
include/net/sctp/sctp.h | 4 +-
include/net/sctp/structs.h | 8 +-
include/trace/events/rpcgss.h | 2 +-
include/uapi/linux/netfilter/nf_tables.h | 2 +-
include/uapi/linux/zorro_ids.h | 3 +
io_uring/io-wq.c | 10 +-
kernel/bpf/btf.c | 10 +-
kernel/debug/kdb/kdb_io.c | 6 +-
kernel/dma/mapping.c | 2 +-
kernel/events/core.c | 2 +
kernel/events/internal.h | 2 +-
kernel/irq/chip.c | 32 ++--
kernel/irq/irqdesc.c | 1 +
kernel/irq/manage.c | 2 +-
kernel/kprobes.c | 4 +-
kernel/padata.c | 7 +
kernel/rcu/rcutorture.c | 2 +-
kernel/sched/core.c | 23 ++-
kernel/sched/cputime.c | 6 +
kernel/sched/fair.c | 9 +-
kernel/sched/sched.h | 2 +-
kernel/signal.c | 8 +
kernel/task_work.c | 34 ++++-
kernel/time/ntp.c | 9 +-
kernel/time/tick-broadcast.c | 24 +++
kernel/trace/tracing_map.c | 6 +-
kernel/watchdog_hld.c | 11 +-
lib/decompress_bunzip2.c | 3 +-
lib/kobject_uevent.c | 17 ++-
lib/objagg.c | 18 +--
net/bluetooth/l2cap_core.c | 1 +
net/core/filter.c | 15 +-
net/core/link_watch.c | 4 +-
net/core/xdp.c | 4 +-
net/ipv4/esp4.c | 3 +-
net/ipv4/nexthop.c | 7 +-
net/ipv4/route.c | 2 +-
net/ipv6/addrconf.c | 3 +-
net/ipv6/esp6.c | 3 +-
net/ipv6/ndisc.c | 34 +++--
net/iucv/af_iucv.c | 4 +-
net/l2tp/l2tp_core.c | 15 +-
net/mptcp/mib.c | 2 +
net/mptcp/mib.h | 2 +
net/mptcp/options.c | 2 +-
net/mptcp/pm.c | 9 ++
net/mptcp/pm_netlink.c | 30 +++-
net/mptcp/protocol.c | 10 +-
net/mptcp/protocol.h | 6 +-
net/mptcp/subflow.c | 24 ++-
net/netfilter/ipset/ip_set_list_set.c | 3 +
net/netfilter/ipvs/ip_vs_proto_sctp.c | 4 +-
net/netfilter/nf_conntrack_netlink.c | 3 +-
net/netfilter/nf_tables_api.c | 149 ++++---------------
net/netfilter/nft_connlimit.c | 2 +-
net/netfilter/nft_counter.c | 4 +-
net/netfilter/nft_dynset.c | 2 +-
net/netfilter/nft_set_hash.c | 8 +-
net/netfilter/nft_set_pipapo.c | 18 ++-
net/netfilter/nft_set_pipapo_avx2.c | 12 +-
net/netfilter/nft_set_rbtree.c | 6 +-
net/packet/af_packet.c | 86 ++++++++++-
net/sched/act_ct.c | 4 +-
net/sctp/input.c | 48 +++---
net/sctp/proc.c | 10 +-
net/sctp/socket.c | 6 +-
net/smc/smc_core.c | 32 ++--
net/sunrpc/auth_gss/gss_krb5_keys.c | 2 +-
net/sunrpc/clnt.c | 3 +-
net/sunrpc/sched.c | 4 +-
net/sunrpc/xprtrdma/frwr_ops.c | 9 +-
net/sunrpc/xprtrdma/verbs.c | 20 ++-
net/sunrpc/xprtrdma/xprt_rdma.h | 2 +-
net/tipc/udp_media.c | 5 +-
net/wireless/nl80211.c | 16 +-
net/wireless/util.c | 8 +-
samples/Kconfig | 8 +
samples/Makefile | 1 +
samples/fanotify/.gitignore | 1 +
samples/fanotify/Makefile | 5 +
samples/fanotify/fs-monitor.c | 142 ++++++++++++++++++
scripts/gcc-x86_32-has-stack-protector.sh | 2 +-
scripts/gcc-x86_64-has-stack-protector.sh | 2 +-
security/apparmor/lsm.c | 7 +
security/apparmor/policy.c | 2 +-
security/apparmor/policy_unpack.c | 1 +
security/keys/keyctl.c | 2 +-
sound/pci/hda/patch_hdmi.c | 2 +
sound/pci/hda/patch_realtek.c | 1 +
sound/soc/codecs/max98088.c | 10 +-
sound/soc/codecs/wsa881x.c | 2 +-
sound/soc/intel/common/soc-intel-quirks.h | 2 +-
sound/soc/pxa/spitz.c | 58 +++-----
sound/usb/line6/driver.c | 5 +
sound/usb/quirks-table.h | 4 +
sound/usb/stream.c | 4 +-
tools/lib/bpf/btf_dump.c | 8 +-
tools/memory-model/lock.cat | 20 +--
tools/perf/util/sort.c | 2 +-
.../testing/selftests/bpf/prog_tests/send_signal.c | 3 +-
tools/testing/selftests/bpf/prog_tests/sk_lookup.c | 2 +-
.../bpf/progs/btf_dump_test_case_multidim.c | 4 +-
.../bpf/progs/btf_dump_test_case_syntax.c | 4 +-
tools/testing/selftests/bpf/test_sockmap.c | 9 +-
.../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 55 ++++++-
.../selftests/net/forwarding/devlink_lib.sh | 2 +
.../selftests/sigaltstack/current_stack_pointer.h | 2 +-
360 files changed, 3135 insertions(+), 1499 deletions(-)Greg Kroah-Hartman
maintainerPATCH 1/352 EDAC/skx_common: Add new ADXL components for 2-level memory
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit 2f4348e5a86198704368a699a7c4cdeb21d569f5 ]
Some Intel servers may configure memory in 2 levels, using fast "near" memory (e.g. DDR) as a cache for larger, slower, "far" memory (e.g. 3D X-point).
In these configurations the BIOS ADXL address translation for an address in a 2-level memory range will provide details of both the "near" and far components.
Current exported ADXL components are only for 1-level memory system or for 2nd level memory of 2-level memory system. So add new ADXL components for 1st level memory of 2-level memory system to fully support 2-level memory system and the detection of memory error source(1st level memory or 2nd level memory).
Stable-dep-of: 123b15863550 ("EDAC, i10nm: make skx_common.o a separate module")
--- drivers/edac/skx_common.c | 67 ++++++++++++++++++++++++++++++++------- drivers/edac/skx_common.h | 11 +++++++ 2 files changed, 67 insertions(+), 11 deletions(-)
drivers/edac/skx_common.c +56 -11
@@ -23,10 +23,13 @@#include "skx_common.h" static const char *const component_names[] = { - [INDEX_SOCKET ] ="ProcessorSocketId" , - [INDEX_MEMCTRL ] ="MemoryControllerId" , - [INDEX_CHANNEL ] ="ChannelId" , - [INDEX_DIMM ] ="DimmSlotId" , + [INDEX_SOCKET ] ="ProcessorSocketId" , + [INDEX_MEMCTRL ] ="MemoryControllerId" , + [INDEX_CHANNEL ] ="ChannelId" , + [INDEX_DIMM ] ="DimmSlotId" , + [INDEX_NM_MEMCTRL ] ="NmMemoryControllerId" , + [INDEX_NM_CHANNEL ] ="NmChannelId" , + [INDEX_NM_DIMM ] ="NmDimmSlotId" , };static int component_indices[ARRAY_SIZE (component_names)];
@@ -34,12 +37,14 @@ static int adxl_component_count;static const char *const *adxl_component_names;static u64 *adxl_values;static char *adxl_msg; +static unsigned long adxl_nm_bitmap;static char skx_msg[MSG_SIZE ];static skx_decode_f skx_decode;static skx_show_retry_log_f skx_show_retry_rd_err_log;static u64 skx_tolm, skx_tohm;static LIST_HEAD (dev_edac_list); +static bool skx_mem_cfg_2lm;int __init skx_adxl_get (void ) {
@@ -56,14 +61,25 @@ int __init skx_adxl_get(void)for (j =0 ; names[j]; j++) {if (!strcmp (component_names[i], names[j])) { component_indices[i] = j; + +if (i >=INDEX_NM_FIRST ) + adxl_nm_bitmap |=1 << i; +break ; } } -if (!names[j]) +if (!names[j] && i <INDEX_NM_FIRST ) goto err; } +if (skx_mem_cfg_2lm) { +if (!adxl_nm_bitmap) +skx_printk (KERN_NOTICE ,"Not enough ADXL components for 2-level memory.\n" ); +else +edac_dbg (2 ,"adxl_nm_bitmap: 0x%lx\n" , adxl_nm_bitmap); + } + adxl_component_names = names;while (*names++) adxl_component_count++;
@@ -99,7 +115,7 @@ void __exit skx_adxl_put(void)kfree (adxl_msg); } -static bool skx_adxl_decode (struct decoded_addr *res) +static bool skx_adxl_decode (struct decoded_addr *res,bool error_in_1st_level_mem) {struct skx_dev *d;int i, len =0 ;
@@ -116,11 +132,20 @@ static bool skx_adxl_decode(struct decoded_addr *res) } res->socket = (int )adxl_values[component_indices[INDEX_SOCKET ]]; - res->imc = (int )adxl_values[component_indices[INDEX_MEMCTRL ]]; - res->channel = (int )adxl_values[component_indices[INDEX_CHANNEL ]]; - res->dimm = (int )adxl_values[component_indices[INDEX_DIMM ]]; +if (error_in_1st_level_mem) { + res->imc = (adxl_nm_bitmap &BIT_NM_MEMCTRL ) ? + (int )adxl_values[component_indices[INDEX_NM_MEMCTRL ]] :-1 ; + res->channel = (adxl_nm_bitmap &BIT_NM_CHANNEL ) ? + (int )adxl_values[component_indices[INDEX_NM_CHANNEL ]] :-1 ; + res->dimm = (adxl_nm_bitmap &BIT_NM_DIMM ) ? + (int )adxl_values[component_indices[INDEX_NM_DIMM ]] :-1 ; + }else { + res->imc = (int )adxl_values[component_indices[INDEX_MEMCTRL ]]; + res->channel = (int )adxl_values[component_indices[INDEX_CHANNEL ]]; + res->dimm = (int )adxl_values[component_indices[INDEX_DIMM ]]; + } -if (res->imc >NUM_IMC -1 ) { +if (res->imc >NUM_IMC -1 || res->imc <0 ) {skx_printk (KERN_ERR ,"Bad imc %d\n" , res->imc);return false; }
@@ -151,6 +176,11 @@ static bool skx_adxl_decode(struct decoded_addr *res)return true; } +void skx_set_mem_cfg (bool mem_cfg_2lm) +{ + skx_mem_cfg_2lm = mem_cfg_2lm; +} +void skx_set_decode (skx_decode_f decode,skx_show_retry_log_f show_retry_log) { skx_decode = decode;
@@ -565,6 +595,21 @@ static void skx_mce_output_error(struct mem_ctl_info *mci, optype, skx_msg); } +static bool skx_error_in_1st_level_mem (const struct mce *m) +{ +u32 errcode; + +if (!skx_mem_cfg_2lm) +return false; + + errcode =GET_BITFIELD (m->status,0 ,15 ); + +if ((errcode &0xef80 ) !=0x280 ) +return false; + +return true; +} +int skx_mce_check_error (struct notifier_block *nb,unsigned long val,void *data) {
@@ -584,7 +629,7 @@ int skx_mce_check_error(struct notifier_block *nb, unsigned long val, res.addr = mce->addr;if (adxl_component_count) { -if (!skx_adxl_decode (&res)) +if (!skx_adxl_decode (&res,skx_error_in_1st_level_mem (mce)))return NOTIFY_DONE ; }else if (!skx_decode || !skx_decode (&res)) {return NOTIFY_DONE ;
drivers/edac/skx_common.h +11 -0
@@ -9,6 +9,8 @@#ifndef _SKX_COMM_EDAC_H#define _SKX_COMM_EDAC_H +#include <linux/bits.h> +#define MSG_SIZE 1024/*
@@ -90,9 +92,17 @@ enum { INDEX_MEMCTRL,INDEX_CHANNEL ,INDEX_DIMM , +INDEX_NM_FIRST , +INDEX_NM_MEMCTRL =INDEX_NM_FIRST , +INDEX_NM_CHANNEL , +INDEX_NM_DIMM ,INDEX_MAX }; +#define BIT_NM_MEMCTRL BIT_ULL(INDEX_NM_MEMCTRL) +#define BIT_NM_CHANNEL BIT_ULL(INDEX_NM_CHANNEL) +#define BIT_NM_DIMM BIT_ULL(INDEX_NM_DIMM) +struct decoded_addr {struct skx_dev *dev;u64 addr;
@@ -127,6 +137,7 @@ typedef void (*skx_show_retry_log_f)(struct decoded_addr *res, char *msg, int leint __init skx_adxl_get (void ); void __exit skx_adxl_put(void);void skx_set_decode (skx_decode_f decode,skx_show_retry_log_f show_retry_log); +void skx_set_mem_cfg (bool mem_cfg_2lm);int skx_get_src_id (struct skx_dev *d,int off,u8 *id);int skx_get_node_id (struct skx_dev *d,u8 *id);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/352 EDAC, i10nm: make skx_common.o a separate module
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 123b158635505c89ed0d3ef45c5845ff9030a466 ]
Commit 598afa050403 ("kbuild: warn objects shared among multiple modules") was added to track down cases where the same object is linked into multiple modules. This can cause serious problems if some modules are builtin while others are not.
That test triggers this warning:
scripts/Makefile.build:236: drivers/edac/Makefile: skx_common.o is added to multiple modules: i10nm_edac skx_edac
Make this a separate module instead.
[Tony: Added more background details to commit message]
--- drivers/edac/Makefile | 10 ++++++---- drivers/edac/skx_common.c | 21 +++++++++++++++++++-- drivers/edac/skx_common.h | 4 ++-- 3 files changed, 27 insertions(+), 8 deletions(-)
drivers/edac/Makefile +6 -4
@@ -58,11 +58,13 @@ obj-$(CONFIG_EDAC_MPC85XX) += mpc85xx_edac_mod.o layerscape_edac_mod-y := fsl_ddr_edac.o layerscape_edac.o obj-$(CONFIG_EDAC_LAYERSCAPE) += layerscape_edac_mod.o -skx_edac-y := skx_common.o skx_base.o -obj-$(CONFIG_EDAC_SKX) += skx_edac.o +skx_edac_common-y := skx_common.o -i10nm_edac-y := skx_common.o i10nm_base.o -obj-$(CONFIG_EDAC_I10NM) += i10nm_edac.o +skx_edac-y := skx_base.o +obj-$(CONFIG_EDAC_SKX) += skx_edac.o skx_edac_common.o + +i10nm_edac-y := i10nm_base.o +obj-$(CONFIG_EDAC_I10NM) += i10nm_edac.o skx_edac_common.o obj-$(CONFIG_EDAC_MV64X60) += mv64x60_edac.o obj-$(CONFIG_EDAC_CELL) += cell_edac.o
drivers/edac/skx_common.c +19 -2
@@ -46,7 +46,7 @@ static u64 skx_tolm, skx_tohm;static LIST_HEAD (dev_edac_list);static bool skx_mem_cfg_2lm; -int __init skx_adxl_get (void ) +int skx_adxl_get (void ) {const char *const *names;int i, j;
@@ -108,12 +108,14 @@ int __init skx_adxl_get(void)return -ENODEV ; } +EXPORT_SYMBOL_GPL (skx_adxl_get); -void __exit skx_adxl_put(void) +void skx_adxl_put (void ) {kfree (adxl_values);kfree (adxl_msg); } +EXPORT_SYMBOL_GPL (skx_adxl_put);static bool skx_adxl_decode (struct decoded_addr *res,bool error_in_1st_level_mem) {
@@ -180,12 +182,14 @@ void skx_set_mem_cfg(bool mem_cfg_2lm) { skx_mem_cfg_2lm = mem_cfg_2lm; } +EXPORT_SYMBOL_GPL (skx_set_mem_cfg);void skx_set_decode (skx_decode_f decode,skx_show_retry_log_f show_retry_log) { skx_decode = decode; skx_show_retry_rd_err_log = show_retry_log; } +EXPORT_SYMBOL_GPL (skx_set_decode);int skx_get_src_id (struct skx_dev *d,int off,u8 *id) {
@@ -199,6 +203,7 @@ int skx_get_src_id(struct skx_dev *d, int off, u8 *id) *id =GET_BITFIELD (reg,12 ,14 );return 0 ; } +EXPORT_SYMBOL_GPL (skx_get_src_id);int skx_get_node_id (struct skx_dev *d,u8 *id) {
@@ -212,6 +217,7 @@ int skx_get_node_id(struct skx_dev *d, u8 *id) *id =GET_BITFIELD (reg,0 ,2 );return 0 ; } +EXPORT_SYMBOL_GPL (skx_get_node_id);static int get_width (u32 mtr) {
@@ -277,6 +283,7 @@ int skx_get_all_bus_mappings(struct res_config *cfg, struct list_head **list) *list = &dev_edac_list;return ndev; } +EXPORT_SYMBOL_GPL (skx_get_all_bus_mappings);int skx_get_hi_lo (unsigned int did,int off[],u64 *tolm,u64 *tohm) {
@@ -316,6 +323,7 @@ int skx_get_hi_lo(unsigned int did, int off[], u64 *tolm, u64 *tohm)pci_dev_put (pdev);return -ENODEV ; } +EXPORT_SYMBOL_GPL (skx_get_hi_lo);static int skx_get_dimm_attr (u32 reg,int lobit,int hibit,int add,int minval,int maxval,const char *name)
@@ -369,6 +377,7 @@ int skx_get_dimm_info(u32 mtr, u32 mcmtr, u32 amap, struct dimm_info *dimm,return 1 ; } +EXPORT_SYMBOL_GPL (skx_get_dimm_info);int skx_get_nvdimm_info (struct dimm_info *dimm,struct skx_imc *imc,int chan,int dimmno,const char *mod_str)
@@ -417,6 +426,7 @@ int skx_get_nvdimm_info(struct dimm_info *dimm, struct skx_imc *imc,return (size ==0 || size == ~0ull ) ?0 :1 ; } +EXPORT_SYMBOL_GPL (skx_get_nvdimm_info); int skx_register_mci(struct skx_imc *imc, struct pci_dev *pdev, const char *ctl_name, const char *mod_str,
@@ -484,6 +494,7 @@ int skx_register_mci(struct skx_imc *imc, struct pci_dev *pdev, imc->mci =NULL ;return rc; } +EXPORT_SYMBOL_GPL (skx_register_mci);static void skx_unregister_mci (struct skx_imc *imc) {
@@ -663,6 +674,7 @@ int skx_mce_check_error(struct notifier_block *nb, unsigned long val, mce->kflags |=MCE_HANDLED_EDAC ;return NOTIFY_DONE ; } +EXPORT_SYMBOL_GPL (skx_mce_check_error);void skx_remove (void ) {
@@ -698,3 +710,8 @@ void skx_remove(void)kfree (d); } } +EXPORT_SYMBOL_GPL (skx_remove); + +MODULE_LICENSE ("GPL v2" ); +MODULE_AUTHOR ("Tony Luck" ); +MODULE_DESCRIPTION ("MC Driver for Intel server processors" );
drivers/edac/skx_common.h +2 -2
@@ -134,8 +134,8 @@ typedef int (*get_dimm_config_f)(struct mem_ctl_info *mci);typedef bool (*skx_decode_f )(struct decoded_addr *res);typedef void (*skx_show_retry_log_f )(struct decoded_addr *res,char *msg,int len); -int __init skx_adxl_get (void ); -void __exit skx_adxl_put(void); +int skx_adxl_get (void ); +void skx_adxl_put (void );void skx_set_decode (skx_decode_f decode,skx_show_retry_log_f show_retry_log);void skx_set_mem_cfg (bool mem_cfg_2lm);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/352 platform/chrome: cros_ec_debugfs: fix wrong EC message version
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <[email protected]>
[ Upstream commit c2a28647bbb4e0894e8824362410f72b06ac57a4 ]
ec_read_version_supported() uses ec_params_get_cmd_versions_v1 but it wrongly uses message version 0.
Fix it.
--- drivers/platform/chrome/cros_ec_debugfs.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/chrome/cros_ec_debugfs.c +1 -0
@@ -326,6 +326,7 @@ static int ec_read_version_supported(struct cros_ec_dev *ec)if (!msg)return 0 ; + msg->version =1 ; msg->command =EC_CMD_GET_CMD_VERSIONS + ec->cmd_offset; msg->outsize =sizeof (*params); msg->insize =sizeof (*response);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/352 hfsplus: fix to avoid false alarm of circular locking
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit be4edd1642ee205ed7bbf66edc0453b1be1fb8d7 ]
Syzbot report potential ABBA deadlock as below:
loop0: detected capacity change from 0 to 1024
======================================================
WARNING: possible circular locking dependency detected
6.9.0-syzkaller-10323-g8f6a15f095a6 #0 Not tainted
------------------------------------------------------
syz-executor171/5344 is trying to acquire lock:ffff88807cb980b0 (&tree->tree_lock){+.+.}-{3:3}, at: hfsplus_file_truncate+0x811/0xb50 fs/hfsplus/extents.c:595
but task is already holding lock:ffff88807a930108 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_truncate+0x2da/0xb50 fs/hfsplus/extents.c:576
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752
hfsplus_file_extend+0x21b/0x1b70 fs/hfsplus/extents.c:457
hfsplus_bmap_reserve+0x105/0x4e0 fs/hfsplus/btree.c:358
hfsplus_rename_cat+0x1d0/0x1050 fs/hfsplus/catalog.c:456
hfsplus_rename+0x12e/0x1c0 fs/hfsplus/dir.c:552
vfs_rename+0xbdb/0xf00 fs/namei.c:4887
do_renameat2+0xd94/0x13f0 fs/namei.c:5044
__do_sys_rename fs/namei.c:5091 [inline]
__se_sys_rename fs/namei.c:5089 [inline]
__x64_sys_rename+0x86/0xa0 fs/namei.c:5089
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f-> #0 (&tree->tree_lock){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869
__lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752
hfsplus_file_truncate+0x811/0xb50 fs/hfsplus/extents.c:595
hfsplus_setattr+0x1ce/0x280 fs/hfsplus/inode.c:265
notify_change+0xb9d/0xe70 fs/attr.c:497
do_truncate+0x220/0x310 fs/open.c:65
handle_truncate fs/namei.c:3308 [inline]
do_open fs/namei.c:3654 [inline]
path_openat+0x2a3d/0x3280 fs/namei.c:3807
do_filp_open+0x235/0x490 fs/namei.c:3834
do_sys_openat2+0x13e/0x1d0 fs/open.c:1406
do_sys_open fs/open.c:1421 [inline]
__do_sys_creat fs/open.c:1497 [inline]
__se_sys_creat fs/open.c:1491 [inline]
__x64_sys_creat+0x123/0x170 fs/open.c:1491
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7fother info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&HFSPLUS_I(inode)->extents_lock);
lock(&tree->tree_lock);
lock(&HFSPLUS_I(inode)->extents_lock); lock(&tree->tree_lock);
This is a false alarm as tree_lock mutex are different, one is from sbi->cat_tree, and another is from sbi->ext_tree:
Thread A Thread B
- hfsplus_rename
- hfsplus_rename_cat
- hfs_find_init
- mutext_lock(cat_tree->tree_lock)
- hfsplus_setattr
- hfsplus_file_truncate
- mutex_lock(hip->extents_lock)
- hfs_find_init
- mutext_lock(ext_tree->tree_lock)
- hfs_bmap_reserve
- hfsplus_file_extend
- mutex_lock(hip->extents_lock)
So, let's call mutex_lock_nested for tree_lock mutex lock, and pass correct lock class for it.
--- fs/hfsplus/bfind.c | 15 ++------------- fs/hfsplus/extents.c | 9 ++++++--- fs/hfsplus/hfsplus_fs.h | 21 +++++++++++++++++++++ 3 files changed, 29 insertions(+), 16 deletions(-)
fs/hfsplus/bfind.c +2 -13
@@ -25,19 +25,8 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) fd->key = ptr + tree->max_key_len +2 ;hfs_dbg (BNODE_REFS ,"find_init: %d (%p)\n" , tree->cnid,__builtin_return_address (0 )); -switch (tree->cnid) { -case HFSPLUS_CAT_CNID : -mutex_lock_nested (&tree->tree_lock,CATALOG_BTREE_MUTEX ); -break ; -case HFSPLUS_EXT_CNID : -mutex_lock_nested (&tree->tree_lock,EXTENTS_BTREE_MUTEX ); -break ; -case HFSPLUS_ATTR_CNID : -mutex_lock_nested (&tree->tree_lock,ATTR_BTREE_MUTEX ); -break ; -default : -BUG (); - } +mutex_lock_nested (&tree->tree_lock, +hfsplus_btree_lock_class (tree));return 0 ; }
fs/hfsplus/extents.c +6 -3
@@ -430,7 +430,8 @@ int hfsplus_free_fork(struct super_block *sb, u32 cnid,hfsplus_free_extents (sb, ext_entry, total_blocks - start, total_blocks); total_blocks = start; -mutex_lock (&fd.tree->tree_lock); +mutex_lock_nested (&fd.tree->tree_lock, +hfsplus_btree_lock_class (fd.tree)); }while (total_blocks > blocks);hfs_find_exit (&fd);
@@ -592,7 +593,8 @@ void hfsplus_file_truncate(struct inode *inode) alloc_cnt, alloc_cnt - blk_cnt);hfsplus_dump_extent (hip->first_extents); hip->first_blocks = blk_cnt; -mutex_lock (&fd.tree->tree_lock); +mutex_lock_nested (&fd.tree->tree_lock, +hfsplus_btree_lock_class (fd.tree));break ; } res =__hfsplus_ext_cache_extent (&fd, inode, alloc_cnt);
@@ -606,7 +608,8 @@ void hfsplus_file_truncate(struct inode *inode)hfsplus_free_extents (sb, hip->cached_extents, alloc_cnt - start, alloc_cnt - blk_cnt);hfsplus_dump_extent (hip->cached_extents); -mutex_lock (&fd.tree->tree_lock); +mutex_lock_nested (&fd.tree->tree_lock, +hfsplus_btree_lock_class (fd.tree));if (blk_cnt > start) { hip->extent_state |=HFSPLUS_EXT_DIRTY ;break ;
fs/hfsplus/hfsplus_fs.h +21 -0
@@ -557,6 +557,27 @@ static inline __be32 __hfsp_ut2mt(time64_t ut)return cpu_to_be32 (lower_32_bits (ut) +HFSPLUS_UTC_OFFSET ); } +static inline enum hfsplus_btree_mutex_classes +hfsplus_btree_lock_class (struct hfs_btree *tree) +{ +enum hfsplus_btree_mutex_classes class; + +switch (tree->cnid) { +case HFSPLUS_CAT_CNID : + class =CATALOG_BTREE_MUTEX ; +break ; +case HFSPLUS_EXT_CNID : + class =EXTENTS_BTREE_MUTEX ; +break ; +case HFSPLUS_ATTR_CNID : + class =ATTR_BTREE_MUTEX ; +break ; +default : +BUG (); + } +return class; +} +/* compatibility */ #define hfsp_mt2ut (t) (struct timespec64){ .tv_sec = __hfsp_mt2ut(t) }#define hfsp_ut2mt (t) __hfsp_ut2mt((t).tv_sec)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/352 x86/of: Return consistent error type from x86_of_pci_irq_enable()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit ec0b4c4d45cf7cf9a6c9626a494a89cb1ae7c645 ]
x86_of_pci_irq_enable() returns PCIBIOS_* code received from pci_read_config_byte() directly and also -EINVAL which are not compatible error types. x86_of_pci_irq_enable() is used as (*pcibios_enable_irq) function which should not return PCIBIOS_* codes.
Convert the PCIBIOS_* return code from pci_read_config_byte() into normal errno using pcibios_err_to_errno().
--- arch/x86/kernel/devicetree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/devicetree.c +1 -1
@@ -92,7 +92,7 @@ static int x86_of_pci_irq_enable(struct pci_dev *dev) ret =pci_read_config_byte (dev,PCI_INTERRUPT_PIN , &pin);if (ret) -return ret; +return pcibios_err_to_errno (ret);if (!pin)return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/352 x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 724852059e97c48557151b3aa4af424614819752 ]
intel_mid_pci_irq_enable() uses pci_read_config_byte() that returns PCIBIOS_* codes. The error handling, however, assumes the codes are normal errnos because it checks for < 0.
intel_mid_pci_irq_enable() also returns the PCIBIOS_* code back to the caller but the function is used as the (*pcibios_enable_irq) function which should return normal errnos.
Convert the error check to plain non-zero check which works for PCIBIOS_* return codes and convert the PCIBIOS_* return code using pcibios_err_to_errno() into normal errno before returning it.
--- arch/x86/pci/intel_mid_pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/pci/intel_mid_pci.c +2 -2
@@ -223,9 +223,9 @@ static int intel_mid_pci_irq_enable(struct pci_dev *dev)return 0 ; ret =pci_read_config_byte (dev,PCI_INTERRUPT_LINE , &gsi); -if (ret <0 ) { +if (ret) {dev_warn (&dev->dev,"Failed to read interrupt line: %d\n" , ret); -return ret; +return pcibios_err_to_errno (ret); }switch (intel_mid_identify_cpu ()) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/352 x86/pci/xen: Fix PCIBIOS_* return code handling
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit e9d7b435dfaec58432f4106aaa632bf39f52ce9f ]
xen_pcifront_enable_irq() uses pci_read_config_byte() that returns PCIBIOS_* codes. The error handling, however, assumes the codes are normal errnos because it checks for < 0.
xen_pcifront_enable_irq() also returns the PCIBIOS_* code back to the caller but the function is used as the (*pcibios_enable_irq) function which should return normal errnos.
Convert the error check to plain non-zero check which works for PCIBIOS_* return codes and convert the PCIBIOS_* return code using pcibios_err_to_errno() into normal errno before returning it.
--- arch/x86/pci/xen.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/pci/xen.c +2 -2
@@ -37,10 +37,10 @@ static int xen_pcifront_enable_irq(struct pci_dev *dev)u8 gsi; rc =pci_read_config_byte (dev,PCI_INTERRUPT_LINE , &gsi); -if (rc <0 ) { +if (rc) {dev_warn (&dev->dev,"Xen PCI: failed to read interrupt line: %d\n" , rc); -return rc; +return pcibios_err_to_errno (rc); }/* In PV DomU the Xen PCI backend puts the PIRQ in the interrupt line.*/ pirq = gsi;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/352 x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 7821fa101eab529521aa4b724bf708149d70820c ]
iosf_mbi_pci_{read,write}_mdr() use pci_{read,write}_config_dword() that return PCIBIOS_* codes but functions also return -ENODEV which are not compatible error codes. As neither of the functions are related to PCI read/write functions, they should return normal errnos.
Convert PCIBIOS_* returns code using pcibios_err_to_errno() into normal errno before returning it.
--- arch/x86/platform/intel/iosf_mbi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/platform/intel/iosf_mbi.c +2 -2
@@ -62,7 +62,7 @@ static int iosf_mbi_pci_read_mdr(u32 mcrx, u32 mcr, u32 *mdr) fail_read:dev_err (&mbi_pdev->dev,"PCI config access failed with %d\n" , result); -return result; +return pcibios_err_to_errno (result); }static int iosf_mbi_pci_write_mdr (u32 mcrx,u32 mcr,u32 mdr)
@@ -91,7 +91,7 @@ static int iosf_mbi_pci_write_mdr(u32 mcrx, u32 mcr, u32 mdr) fail_write:dev_err (&mbi_pdev->dev,"PCI config access failed with %d\n" , result); -return result; +return pcibios_err_to_errno (result); }int iosf_mbi_read (u8 port,u8 opcode,u32 offset,u32 *mdr)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/352 hwmon: (adt7475) Fix default duty on fan is disabled
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Tung <[email protected]>
[ Upstream commit 39b24cced70fdc336dbc0070f8b3bde61d8513a8 ]
According to the comments on fan is disabled, we change to manual mode and set the duty cycle to 0.
For setting the duty cycle part, the register is wrong. Fix it.
--- drivers/hwmon/adt7475.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/adt7475.c +1 -1
@@ -1770,7 +1770,7 @@ static void adt7475_read_pwm(struct i2c_client *client, int index) data->pwm[CONTROL ][index] &= ~0xE0 ; data->pwm[CONTROL ][index] |= (7 <<5 ); -i2c_smbus_write_byte_data (client,PWM_CONFIG_REG (index), +i2c_smbus_write_byte_data (client,PWM_REG (index), data->pwm[INPUT ][index]); i2c_smbus_write_byte_data(client, PWM_CONFIG_REG(index),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/352 pwm: stm32: Always do lazy disabling
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 7346e7a058a2c9aa9ff1cc699c7bf18a402d9f84 ]
When the state changes from enabled to disabled, polarity, duty_cycle and period are not configured in hardware and TIM_CCER_CCxE is just cleared. However if the state changes from one disabled state to another, all parameters are written to hardware because the early exit from stm32_pwm_apply() is only taken if the pwm is currently enabled.
This yields surprises like: Applying
{ .period = 1, .duty_cycle = 0, .enabled = false }succeeds if the pwm is initially on, but fails if it's already off because 1 is a too small period.
Update the check for lazy disable to always exit early if the target state is disabled, no matter what is currently configured.
--- drivers/pwm/pwm-stm32.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/pwm/pwm-stm32.c +3 -2
@@ -452,8 +452,9 @@ static int stm32_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, enabled = pwm->state.enabled; -if (enabled && !state->enabled) { -stm32_pwm_disable (priv, pwm->hwpwm); +if (!state->enabled) { +if (enabled) +stm32_pwm_disable (priv, pwm->hwpwm);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/352 hwmon: (max6697) Fix underflow when writing limit attributes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit cbf7467828cd4ec7ceac7a8b5b5ddb2f69f07b0e ]
Using DIV_ROUND_CLOSEST() on an unbound value can result in underflows. Indeed, module test scripts report:
temp1_max: Suspected underflow: [min=0, read 255000, written -9223372036854775808]temp1_crit: Suspected underflow: [min=0, read 255000, written -9223372036854775808]
Fix by introducing an extra set of clamping.
--- drivers/hwmon/max6697.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/max6697.c +1 -0
@@ -312,6 +312,7 @@ static ssize_t temp_store(struct device *dev,return ret;mutex_lock (&data->update_lock); + temp =clamp_val (temp,-1000000 ,1000000 );/* prevent underflow */ temp =DIV_ROUND_CLOSEST (temp,1000 ) + data->temp_offset; temp =clamp_val (temp,0 , data->type == max6581 ?255 :127 ); data->temp[nr][index] = temp;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/352 hwmon: (max6697) Fix swapped temp{1,8} critical alarms
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 1ea3fd1eb9869fcdcbc9c68f9728bfc47b9503f1 ]
The critical alarm bit for the local temperature sensor (temp1) is in bit 7 of register 0x45 (not bit 6), and the critical alarm bit for remote temperature sensor 7 (temp8) is in bit 6 (not bit 7).
This only affects MAX6581 since all other chips supported by this driver do not support those critical alarms.
--- drivers/hwmon/max6697.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/max6697.c +2 -2
@@ -430,14 +430,14 @@ static SENSOR_DEVICE_ATTR_RO(temp6_max_alarm, alarm, 20); static SENSOR_DEVICE_ATTR_RO(temp7_max_alarm, alarm, 21); static SENSOR_DEVICE_ATTR_RO(temp8_max_alarm, alarm, 23); -static SENSOR_DEVICE_ATTR_RO(temp1_crit_alarm, alarm, 14); +static SENSOR_DEVICE_ATTR_RO(temp1_crit_alarm, alarm, 15); static SENSOR_DEVICE_ATTR_RO(temp2_crit_alarm, alarm, 8); static SENSOR_DEVICE_ATTR_RO(temp3_crit_alarm, alarm, 9); static SENSOR_DEVICE_ATTR_RO(temp4_crit_alarm, alarm, 10); static SENSOR_DEVICE_ATTR_RO(temp5_crit_alarm, alarm, 11); static SENSOR_DEVICE_ATTR_RO(temp6_crit_alarm, alarm, 12); static SENSOR_DEVICE_ATTR_RO(temp7_crit_alarm, alarm, 13); -static SENSOR_DEVICE_ATTR_RO(temp8_crit_alarm, alarm, 15); +static SENSOR_DEVICE_ATTR_RO(temp8_crit_alarm, alarm, 14); static SENSOR_DEVICE_ATTR_RO(temp2_fault, alarm, 1); static SENSOR_DEVICE_ATTR_RO(temp3_fault, alarm, 2);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/352 arm64: dts: qcom: sdm845: add power-domain to UFS PHY
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit fd39ae8b9bc10419b1e4b849cdbc6755a967ade1 ]
The UFS PHY is powered on via the UFS_PHY_GDSC power domain. Add corresponding power-domain the the PHY node.
--- arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/qcom/sdm845.dtsi +2 -0
@@ -2125,6 +2125,8 @@ ufs_mem_phy: phy@1d87000 { clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>, <&gcc GCC_UFS_PHY_PHY_AUX_CLK>; + power-domains = <&gcc UFS_PHY_GDSC>; + resets = <&ufs_mem_hc 0>; reset-names = "ufsphy"; status = "disabled";
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/352 soc: qcom: rpmh-rsc: Ensure irqs arent disabled by rpmh_rsc_send_data() callers
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit e43111f52b9ec5c2d700f89a1d61c8d10dc2d9e9 ]
Dan pointed out that Smatch is concerned about this code because it uses spin_lock_irqsave() and then calls wait_event_lock_irq() which enables irqs before going to sleep. The comment above the function says it should be called with interrupts enabled, but we simply hope that's true without really confirming that. Let's add a might_sleep() here to confirm that interrupts and preemption aren't disabled. Once we do that, we can change the lock to be non-saving, spin_lock_irq(), to clarify that we don't expect irqs to be disabled. If irqs are disabled by callers they're going to be enabled anyway in the wait_event_lock_irq() call which would be bad.
This should make Smatch happier and find bad callers faster with the might_sleep(). We can drop the WARN_ON() in the caller because we have the might_sleep() now, simplifying the code.
--- drivers/soc/qcom/rpmh-rsc.c | 7 ++++--- drivers/soc/qcom/rpmh.c | 1 - 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/soc/qcom/rpmh-rsc.c +4 -3
@@ -629,13 +629,14 @@ int rpmh_rsc_send_data(struct rsc_drv *drv, const struct tcs_request *msg) {struct tcs_group *tcs;int tcs_id; -unsigned long flags; + +might_sleep (); tcs =get_tcs_for_msg (drv, msg);if (IS_ERR (tcs))return PTR_ERR (tcs); -spin_lock_irqsave (&drv->lock, flags); +spin_lock_irq (&drv->lock);/* Wait forever for a free tcs. It better be there eventually! */ wait_event_lock_irq(drv->tcs_wait,
@@ -654,7 +655,7 @@ int rpmh_rsc_send_data(struct rsc_drv *drv, const struct tcs_request *msg)write_tcs_reg_sync (drv,RSC_DRV_CMD_WAIT_FOR_CMPL , tcs_id,0 );enable_tcs_irq (drv, tcs_id, true); } -spin_unlock_irqrestore (&drv->lock, flags); +spin_unlock_irq (&drv->lock);/* * These two can be done after the lock is released because:
drivers/soc/qcom/rpmh.c +0 -1
@@ -193,7 +193,6 @@ static int __rpmh_write(const struct device *dev, enum rpmh_state state, rpm_msg->msg.state = state;if (state ==RPMH_ACTIVE_ONLY_STATE ) { -WARN_ON (irqs_disabled ()); ret =rpmh_rsc_send_data (ctrlr_to_drv (ctrlr), &rpm_msg->msg); }else {/* Clean up our call by spoofing tx_done */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/352 arm64: dts: qcom: msm8996: specify UFS core_clk frequencies
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 02f838b7f8cdfb7a96b7f08e7f6716f230bdecba ]
Follow the example of other platforms and specify core_clk frequencies in the frequency table in addition to the core_clk_src frequencies. The driver should be setting the leaf frequency instead of some interim clock freq.
--- arch/arm64/boot/dts/qcom/msm8996.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/msm8996.dtsi +1 -1
@@ -927,7 +927,7 @@ ufshc: ufshc@624000 { <&gcc GCC_UFS_RX_SYMBOL_0_CLK>; freq-table-hz = <100000000 200000000>, - <0 0>, + <100000000 200000000>, <0 0>, <0 0>, <0 0>,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/352 memory: fsl_ifc: Make FSL_IFC config visible and selectable
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Esben Haabendal <[email protected]>
[ Upstream commit 9ba0cae3cac07c21c583f9ff194f74043f90d29c ]
While use of fsl_ifc driver with NAND flash is fine, as the fsl_ifc_nand driver selects FSL_IFC automatically, we need the CONFIG_FSL_IFC option to be selectable for platforms using fsl_ifc with NOR flash.
--- drivers/memory/Kconfig | 2 +- drivers/mtd/nand/raw/Kconfig | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-)
drivers/memory/Kconfig +1 -1
@@ -159,7 +159,7 @@ config FSL_CORENET_CF represents a coherency violation. config FSL_IFC - bool "Freescale IFC driver" if COMPILE_TEST + bool "Freescale IFC driver" depends on FSL_SOC || ARCH_LAYERSCAPE || SOC_LS1021A || COMPILE_TEST depends on HAS_IOMEM
drivers/mtd/nand/raw/Kconfig +1 -2
@@ -282,8 +282,7 @@ config MTD_NAND_FSL_IFC tristate "Freescale IFC NAND controller" depends on FSL_SOC || ARCH_LAYERSCAPE || SOC_LS1021A || COMPILE_TEST depends on HAS_IOMEM - select FSL_IFC - select MEMORY + depends on FSL_IFC help Various Freescale chips e.g P1010, include a NAND Flash machine with built-in hardware ECC capabilities.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/352 soc: qcom: pdr: protect locator_addr with the main mutex
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 107924c14e3ddd85119ca43c26a4ee1056fa9b84 ]
If the service locator server is restarted fast enough, the PDR can rewrite locator_addr fields concurrently. Protect them by placing modification of those fields under the main pdr->lock.
--- drivers/soc/qcom/pdr_interface.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/soc/qcom/pdr_interface.c +4 -2
@@ -76,12 +76,12 @@ static int pdr_locator_new_server(struct qmi_handle *qmi, locator_hdl);struct pdr_service *pds; +mutex_lock (&pdr->lock);/* Create a local client port for QMI communication */ pdr->locator_addr.sq_family =AF_QIPCRTR ; pdr->locator_addr.sq_node = svc->node; pdr->locator_addr.sq_port = svc->port; -mutex_lock (&pdr->lock); pdr->locator_init_complete = true;mutex_unlock (&pdr->lock);
@@ -104,10 +104,10 @@ static void pdr_locator_del_server(struct qmi_handle *qmi,mutex_lock (&pdr->lock); pdr->locator_init_complete = false; -mutex_unlock (&pdr->lock); pdr->locator_addr.sq_node =0 ; pdr->locator_addr.sq_port =0 ; +mutex_unlock (&pdr->lock); }static struct qmi_ops pdr_locator_ops = {
@@ -366,12 +366,14 @@ static int pdr_get_domain_list(struct servreg_get_domain_list_req *req,if (ret <0 )return ret; +mutex_lock (&pdr->lock); ret =qmi_send_request (&pdr->locator_hdl, &pdr->locator_addr, &txn,SERVREG_GET_DOMAIN_LIST_REQ ,SERVREG_GET_DOMAIN_LIST_REQ_MAX_LEN , servreg_get_domain_list_req_ei, req); +mutex_unlock (&pdr->lock);if (ret <0 ) {qmi_txn_cancel (&txn);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/352 soc: qcom: pdr: fix parsing of domains lists
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 57f20d51f35780f240ecf39d81cda23612800a92 ]
While parsing the domains list, start offsets from 0 rather than from domains_read. The domains_read is equal to the total count of the domains we have seen, while the domains list in the message starts from offset 0.
--- drivers/soc/qcom/pdr_interface.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/qcom/pdr_interface.c +1 -1
@@ -418,7 +418,7 @@ static int pdr_locate_service(struct pdr_handle *pdr, struct pdr_service *pds)if (ret <0 ) goto out; -for (i = domains_read; i < resp->domain_list_len; i++) { +for (i =0 ; i < resp->domain_list_len; i++) { entry = &resp->domain_list[i];if (strnlen (entry->name,sizeof (entry->name)) ==sizeof (entry->name))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/352 arm64: dts: rockchip: Increase VOP clk rate on RK3328
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <[email protected]>
[ Upstream commit 0f2ddb128fa20f8441d903285632f2c69e90fae1 ]
The VOP on RK3328 needs to run at a higher rate in order to produce a proper 3840x2160 signal.
Change to use 300MHz for VIO clk and 400MHz for VOP clk, same rates used by vendor 4.4 kernel.
--- arch/arm64/boot/dts/rockchip/rk3328.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/rockchip/rk3328.dtsi +2 -2
@@ -811,8 +811,8 @@ cru: clock-controller@ff440000 { <0>, <24000000>, <24000000>, <24000000>, <15000000>, <15000000>, - <100000000>, <100000000>, - <100000000>, <100000000>, + <300000000>, <100000000>, + <400000000>, <100000000>, <50000000>, <100000000>, <100000000>, <100000000>, <50000000>, <50000000>,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/352 ARM: dts: imx6qdl-kontron-samx6i: move phy reset into phy-node
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Felsch <[email protected]>
[ Upstream commit 5694eed98cca5c164ebb5b831b65b4c9eee4b2d5 ]
Add ethernet-phy node so we can drop the deprecated fec phy-reset-gpios property. The reset-assert-us value is taken from the existing logic since the fec driver will add an 1ms assert delay per default if phy-reset-gpios is used and phy-reset-duration is not specified.
Stable-dep-of: edfea889a049 ("ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset")
--- arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +13 -1
@@ -260,7 +260,19 @@ &fec { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_enet>; phy-mode = "rgmii"; - phy-reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>; + phy-handle = <ðphy>; + + mdio { + #address-cells = <1>; + #size-cells = <0>; + + ethphy: ethernet-phy@1 { + compatible = "ethernet-phy-ieee802.3-c22"; + reg = <1>; + reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>; + reset-assert-us = <1000>; + }; + }; }; &i2c_intern {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/352 ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit edfea889a049abe80f0d55c0365bf60fbade272f ]
The PHY reset line is connected to both the SoC (GPIO1_25) and the CPLD. We must not use the GPIO1_25 as it will drive against the output buffer of the CPLD. Instead there is another GPIO (GPIO2_01), an input to the CPLD, which will tell the CPLD to assert the PHY reset line.
--- arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +2 -2
@@ -269,7 +269,7 @@ mdio { ethphy: ethernet-phy@1 { compatible = "ethernet-phy-ieee802.3-c22"; reg = <1>; - reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>; + reset-gpios = <&gpio2 1 GPIO_ACTIVE_LOW>; reset-assert-us = <1000>; }; };
@@ -512,7 +512,7 @@ MX6QDL_PAD_RGMII_RX_CTL__RGMII_RX_CTL 0x1b0b0 MX6QDL_PAD_ENET_MDIO__ENET_MDIO 0x1b0b0 MX6QDL_PAD_ENET_MDC__ENET_MDC 0x1b0b0 MX6QDL_PAD_ENET_REF_CLK__ENET_TX_CLK 0x1b0b0 - MX6QDL_PAD_ENET_CRS_DV__GPIO1_IO25 0x1b0b0 /* RST_GBE0_PHY# */ + MX6QDL_PAD_NANDF_D1__GPIO2_IO01 0x1b0b0 /* RST_GBE0_PHY# */ >; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/352 ARM: dts: imx6qdl-kontron-samx6i: fix board reset
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit b972d6b3b46345023aee56a95df8e2c137aa4ee4 ]
On i.MX6 the board is reset by the watchdog. But in turn to do a complete board reset, we have to assert the WDOG_B output which is routed also to the CPLD which then do a complete power-cycle of the board.
--- arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +1 -0
@@ -813,5 +813,6 @@ &wdog1 { /* CPLD is feeded by watchdog (hardwired) */ pinctrl-names = "default"; pinctrl-0 = <&pinctrl_wdog1>; + fsl,ext-reset-output; status = "okay"; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/352 ARM: dts: imx6qdl-kontron-samx6i: fix SPI0 chip selects
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit 74e1c956a68a65d642447d852e95b3fbb69bebaa ]
There is a comment in the imx6q variant dtsi claiming that these modules will have one more chip select than the imx6dl variant. This is wrong. Ordinary GPIOs are used for chip selects and both variants of the module share the very same PCB and both have this GPIO routed to the SPI0_CS1# pin of the SMARC connector.
Fix it by moving the third chip select description to the common dtsi.
--- arch/arm/boot/dts/imx6q-kontron-samx6i.dtsi | 23 ------------------- arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 5 +++- 2 files changed, 4 insertions(+), 24 deletions(-)
arch/arm/boot/dts/imx6q-kontron-samx6i.dtsi +0 -23
@@ -5,31 +5,8 @@ #include "imx6q.dtsi" #include "imx6qdl-kontron-samx6i.dtsi" -#include <dt-bindings/gpio/gpio.h> / { model = "Kontron SMARC sAMX6i Quad/Dual"; compatible = "kontron,imx6q-samx6i", "fsl,imx6q"; }; - -/* Quad/Dual SoMs have 3 chip-select signals */ -&ecspi4 { - cs-gpios = <&gpio3 24 GPIO_ACTIVE_LOW>, - <&gpio3 29 GPIO_ACTIVE_LOW>, - <&gpio3 25 GPIO_ACTIVE_LOW>; -}; - -&pinctrl_ecspi4 { - fsl,pins = < - MX6QDL_PAD_EIM_D21__ECSPI4_SCLK 0x100b1 - MX6QDL_PAD_EIM_D28__ECSPI4_MOSI 0x100b1 - MX6QDL_PAD_EIM_D22__ECSPI4_MISO 0x100b1 - - /* SPI4_IMX_CS2# - connected to internal flash */ - MX6QDL_PAD_EIM_D24__GPIO3_IO24 0x1b0b0 - /* SPI4_IMX_CS0# - connected to SMARC SPI0_CS0# */ - MX6QDL_PAD_EIM_D29__GPIO3_IO29 0x1b0b0 - /* SPI4_CS3# - connected to SMARC SPI0_CS1# */ - MX6QDL_PAD_EIM_D25__GPIO3_IO25 0x1b0b0 - >; -};
arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +4 -1
@@ -244,7 +244,8 @@ &ecspi4 { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_ecspi4>; cs-gpios = <&gpio3 24 GPIO_ACTIVE_LOW>, - <&gpio3 29 GPIO_ACTIVE_LOW>; + <&gpio3 29 GPIO_ACTIVE_LOW>, + <&gpio3 25 GPIO_ACTIVE_LOW>; status = "okay"; /* default boot source: workaround #1 for errata ERR006282 */
@@ -460,6 +461,8 @@ MX6QDL_PAD_EIM_D22__ECSPI4_MISO 0x100b1 MX6QDL_PAD_EIM_D24__GPIO3_IO24 0x1b0b0 /* SPI_IMX_CS0# - connected to SMARC SPI0_CS0# */ MX6QDL_PAD_EIM_D29__GPIO3_IO29 0x1b0b0 + /* SPI4_CS3# - connected to SMARC SPI0_CS1# */ + MX6QDL_PAD_EIM_D25__GPIO3_IO25 0x1b0b0 >; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/352 ARM: dts: imx6qdl-kontron-samx6i: fix PCIe reset polarity
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit df35c6e9027cf9affe699e632a48082ab1bbba4c ]
The PCIe reset line is active low. Fix it.
--- arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +1 -1
@@ -728,7 +728,7 @@ &pcie { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_pcie>; wake-up-gpio = <&gpio6 18 GPIO_ACTIVE_HIGH>; - reset-gpio = <&gpio3 13 GPIO_ACTIVE_HIGH>; + reset-gpio = <&gpio3 13 GPIO_ACTIVE_LOW>; }; /* LCD_BKLT_PWM */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/352 arm64: dts: mediatek: mt8183-kukui: Drop bogus output-enable property
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit e9a9055fdcdc1e5a27cef118c5b4f09cdd2fa28e ]
The "output-enable" property is set on uart1's RTS pin. This is bogus because the hardware does not actually have a controllable output buffer. Secondly, the implementation incorrectly treats this property as a request to switch the pin to GPIO output. This does not fit the intended semantic of "output-enable" and it does not have any affect either because the pin is muxed to the UART function, not the GPIO function.
Drop the property.
--- arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 2 -- 1 file changed, 2 deletions(-)
arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi +0 -2
@@ -628,7 +628,6 @@ pins_tx { }; pins_rts { pinmux = <PINMUX_GPIO47__FUNC_URTS1>; - output-enable; }; pins_cts { pinmux = <PINMUX_GPIO46__FUNC_UCTS1>;
@@ -647,7 +646,6 @@ pins_tx { }; pins_rts { pinmux = <PINMUX_GPIO47__FUNC_URTS1>; - output-enable; }; pins_cts { pinmux = <PINMUX_GPIO46__FUNC_UCTS1>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/352 arm64: dts: mediatek: mt7622: fix "emmc" pinctrl mux
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit aebba1030a5766cdf894ed4ab0cac7aed5aee9c1 ]
Value "emmc_rst" is a group name and should be part of the "groups" property.
This fixes:arch/arm64/boot/dts/mediatek/mt7622-rfb1.dtb: pinctrl@10211000: emmc-pins-default:mux:function: ['emmc', 'emmc_rst'] is too long
from schema $id: http://devicetree.org/schemas/pinctrl/mediatek,mt7622-pinctrl.yaml#arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dtb: pinctrl@10211000: emmc-pins-default:mux:function: ['emmc', 'emmc_rst'] is too long
from schema $id: http://devicetree.org/schemas/pinctrl/mediatek,mt7622-pinctrl.yaml#
--- arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts | 4 ++-- arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts +2 -2
@@ -285,8 +285,8 @@ asm_sel { /* eMMC is shared pin with parallel NAND */ emmc_pins_default: emmc-pins-default { mux { - function = "emmc", "emmc_rst"; - groups = "emmc"; + function = "emmc"; + groups = "emmc", "emmc_rst"; }; /* "NDL0","NDL1","NDL2","NDL3","NDL4","NDL5","NDL6","NDL7",
arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts +2 -2
@@ -249,8 +249,8 @@ &pio { /* eMMC is shared pin with parallel NAND */ emmc_pins_default: emmc-pins-default { mux { - function = "emmc", "emmc_rst"; - groups = "emmc"; + function = "emmc"; + groups = "emmc", "emmc_rst"; }; /* "NDL0","NDL1","NDL2","NDL3","NDL4","NDL5","NDL6","NDL7",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/352 arm64: dts: amlogic: gx: correct hdmi clocks
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 0602ba0dcd0e76067a0b7543e92b2de3fb231073 ]
The clocks provided to HDMI tx are not consistent between gx and g12:
* gx receives the peripheral clock as 'isfr' while g12 receives it as 'iahb'
* g12 gets the HDMI system clock as 'isfr' but gx does not even get it. It surely needs that clock since the driver is directly poking around the clock controller's registers for that clock.
Align gx SoCs with g12 and provide:
* the HDMI peripheral clock as 'iahb'
* the HDMI system clock as 'isfr'
--- arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi | 4 ++-- arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi +2 -2
@@ -311,8 +311,8 @@ &hdmi_tx { <&reset RESET_HDMI_SYSTEM_RESET>, <&reset RESET_HDMI_TX>; reset-names = "hdmitx_apb", "hdmitx", "hdmitx_phy"; - clocks = <&clkc CLKID_HDMI_PCLK>, - <&clkc CLKID_CLK81>, + clocks = <&clkc CLKID_HDMI>, + <&clkc CLKID_HDMI_PCLK>, <&clkc CLKID_GCLK_VENCI_INT0>; clock-names = "isfr", "iahb", "venci"; };
arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +2 -2
@@ -323,8 +323,8 @@ &hdmi_tx { <&reset RESET_HDMI_SYSTEM_RESET>, <&reset RESET_HDMI_TX>; reset-names = "hdmitx_apb", "hdmitx", "hdmitx_phy"; - clocks = <&clkc CLKID_HDMI_PCLK>, - <&clkc CLKID_CLK81>, + clocks = <&clkc CLKID_HDMI>, + <&clkc CLKID_HDMI_PCLK>, <&clkc CLKID_GCLK_VENCI_INT0>; clock-names = "isfr", "iahb", "venci"; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/352 m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eero Tamminen <[email protected]>
[ Upstream commit f70065a9fd988983b2c693631b801f25a615fc04 ]
Avoid freeze on Atari TT / MegaSTe boot with continuous messages of:
unexpected interrupt from 112
Which was due to VBL interrupt being enabled in SCU sys mask, but there being no handler for that any more.
(Bug and fix were first verified on real Atari TT HW by Christian,
this patch later on in Hatari emulator.)
--- arch/m68k/atari/ataints.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
arch/m68k/atari/ataints.c +1 -5
@@ -302,11 +302,7 @@ void __init atari_init_IRQ(void)if (ATARIHW_PRESENT (SCU )) {/* init the SCU if present */ - tt_scu.sys_mask =0x10 ;/* enable VBL (for the cursor) and -* disable HSYNC interrupts (who -* needs them?) MFP and SCC are -* enabled in VME mask -*/ + tt_scu.sys_mask =0x0 ;/* disable all interrupts */ tt_scu.vme_mask =0x60 ;/* enable MFP and SCC ints */ }else {/* If no SCU and no Hades, the HSYNC interrupt needs to be
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/352 x86/xen: Convert comma to semicolon
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit 349d271416c61f82b853336509b1d0dc04c1fcbb ]
Replace a comma between expression statements by a semicolon.
--- arch/x86/xen/p2m.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/xen/p2m.c +2 -2
@@ -736,7 +736,7 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,* immediate unmapping. */ map_ops[i].status = GNTST_general_error; - unmap[0 ].host_addr = map_ops[i].host_addr, + unmap[0 ].host_addr = map_ops[i].host_addr; unmap[0 ].handle = map_ops[i].handle; map_ops[i].handle = ~0 ;if (map_ops[i].flags & GNTMAP_device_map)
@@ -746,7 +746,7 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,if (kmap_ops) { kmap_ops[i].status = GNTST_general_error; - unmap[1 ].host_addr = kmap_ops[i].host_addr, + unmap[1 ].host_addr = kmap_ops[i].host_addr; unmap[1 ].handle = kmap_ops[i].handle; kmap_ops[i].handle = ~0 ;if (kmap_ops[i].flags & GNTMAP_device_map)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/352 m68k: cmpxchg: Fix return value for default case in __arch_xchg()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
[ Upstream commit 21b9e722ad28c19c2bc83f18f540b3dbd89bf762 ]
The return value of __invalid_xchg_size() is assigned to tmp instead of the return variable x. Assign it to x instead.
--- arch/m68k/include/asm/cmpxchg.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/m68k/include/asm/cmpxchg.h +1 -1
@@ -33,7 +33,7 @@ static inline unsigned long __xchg(unsigned long x, volatile void * ptr, int siz x = tmp;break ;default : - tmp =__invalid_xchg_size (x, ptr, size); + x =__invalid_xchg_size (x, ptr, size);break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/352 ARM: pxa: spitz: use gpio descriptors for audio
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 726d8c965bae2d7468445d990849e281dca8cbf7 ]
The audio driver should not use a hardwired gpio number from the header. Change it to use a lookup table.
Stable-dep-of: 78ab3d352f29 ("ARM: spitz: fix GPIO assignment for backlight")
---
arch/arm/mach-pxa/spitz.c | 33 ++++++++++-
arch/arm/mach-pxa/{include/mach => }/spitz.h | 2 +-
arch/arm/mach-pxa/spitz_pm.c | 2 +-
sound/soc/pxa/spitz.c | 58 ++++++++------------
4 files changed, 57 insertions(+), 38 deletions(-)
rename arch/arm/mach-pxa/{include/mach => }/spitz.h (99%)arch/arm/mach-pxa/spitz.c +32 -1
@@ -43,7 +43,7 @@#include <linux/platform_data/mmc-pxamci.h> #include <linux/platform_data/usb-ohci-pxa27x.h> #include <linux/platform_data/video-pxafb.h> -#include <mach/spitz.h> +#include "spitz.h" #include "sharpsl_pm.h" #include <mach/smemc.h>
@@ -954,11 +954,42 @@ static void __init spitz_i2c_init(void)static inline void spitz_i2c_init (void ) {}#endif +static struct gpiod_lookup_table spitz_audio_gpio_table = { + .dev_id ="spitz-audio" , + .table = { +GPIO_LOOKUP ("sharp-scoop.0" ,SPITZ_GPIO_MUTE_L -SPITZ_SCP_GPIO_BASE , +"mute-l" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("sharp-scoop.0" ,SPITZ_GPIO_MUTE_R -SPITZ_SCP_GPIO_BASE , +"mute-r" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("sharp-scoop.1" ,SPITZ_GPIO_MIC_BIAS -SPITZ_SCP2_GPIO_BASE , +"mic" ,GPIO_ACTIVE_HIGH ), + { }, + }, +}; + +static struct gpiod_lookup_table akita_audio_gpio_table = { + .dev_id ="spitz-audio" , + .table = { +GPIO_LOOKUP ("sharp-scoop.0" ,SPITZ_GPIO_MUTE_L -SPITZ_SCP_GPIO_BASE , +"mute-l" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("sharp-scoop.0" ,SPITZ_GPIO_MUTE_R -SPITZ_SCP_GPIO_BASE , +"mute-r" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("i2c-max7310" ,AKITA_GPIO_MIC_BIAS -AKITA_IOEXP_GPIO_BASE , +"mic" ,GPIO_ACTIVE_HIGH ), + { }, + }, +}; +/****************************************************************************** * Audio devices ******************************************************************************/ static inline void spitz_audio_init (void ) { +if (machine_is_akita ()) +gpiod_add_lookup_table (&akita_audio_gpio_table); +else +gpiod_add_lookup_table (&spitz_audio_gpio_table); +platform_device_register_simple ("spitz-audio" ,-1 ,NULL ,0 ); }
arch/arm/mach-pxa/spitz.h renamed from arch/arm/mach-pxa/include/mach/spitz.h +1 -1
@@ -11,7 +11,7 @@#define __ASM_ARCH_SPITZ_H 1#endif -#include "irqs.h" /* PXA_NR_BUILTIN_GPIO, PXA_GPIO_TO_IRQ */ +#include <mach/irqs.h> /* PXA_NR_BUILTIN_GPIO, PXA_GPIO_TO_IRQ */ #include <linux/fb.h> /* Spitz/Akita GPIOs */
arch/arm/mach-pxa/spitz_pm.c +1 -1
@@ -20,7 +20,7 @@#include <asm/mach-types.h> #include <mach/hardware.h> -#include <mach/spitz.h> +#include "spitz.h" #include "pxa27x.h" #include "sharpsl_pm.h"
sound/soc/pxa/spitz.c +23 -35
129 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/352 ARM: spitz: fix GPIO assignment for backlight
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit 78ab3d352f2982bf3f7e506bfbaba7afee1ed8a9 ]
GPIOs controlling backlight on Spitz and Akita are coming from GPIO expanders, not the pxa27xx-gpio block, correct it.
Additionally GPIO lookup tables operate with pin numbers rather than legacy GPIO numbers, fix that as well. Use raw numbers instead of legacy GPIO names to avoid confusion.
--- arch/arm/mach-pxa/spitz.c | 30 ++++++++++-------------------- 1 file changed, 10 insertions(+), 20 deletions(-)
arch/arm/mach-pxa/spitz.c +10 -20
@@ -516,10 +516,8 @@ static struct pxa2xx_spi_chip spitz_ads7846_chip = {static struct gpiod_lookup_table spitz_lcdcon_gpio_table = { .dev_id ="spi2.1" , .table = { -GPIO_LOOKUP ("gpio-pxa" ,SPITZ_GPIO_BACKLIGHT_CONT , -"BL_CONT" ,GPIO_ACTIVE_LOW ), -GPIO_LOOKUP ("gpio-pxa" ,SPITZ_GPIO_BACKLIGHT_ON , -"BL_ON" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("sharp-scoop.1" ,6 ,"BL_CONT" ,GPIO_ACTIVE_LOW ), +GPIO_LOOKUP ("sharp-scoop.1" ,7 ,"BL_ON" ,GPIO_ACTIVE_HIGH ), { }, }, };
@@ -527,10 +525,8 @@ static struct gpiod_lookup_table spitz_lcdcon_gpio_table = {static struct gpiod_lookup_table akita_lcdcon_gpio_table = { .dev_id ="spi2.1" , .table = { -GPIO_LOOKUP ("gpio-pxa" ,AKITA_GPIO_BACKLIGHT_CONT , -"BL_CONT" ,GPIO_ACTIVE_LOW ), -GPIO_LOOKUP ("gpio-pxa" ,AKITA_GPIO_BACKLIGHT_ON , -"BL_ON" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("i2c-max7310" ,3 ,"BL_ON" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("i2c-max7310" ,4 ,"BL_CONT" ,GPIO_ACTIVE_LOW ), { }, }, };
@@ -957,12 +953,9 @@ static inline void spitz_i2c_init(void) {}static struct gpiod_lookup_table spitz_audio_gpio_table = { .dev_id ="spitz-audio" , .table = { -GPIO_LOOKUP ("sharp-scoop.0" ,SPITZ_GPIO_MUTE_L -SPITZ_SCP_GPIO_BASE , -"mute-l" ,GPIO_ACTIVE_HIGH ), -GPIO_LOOKUP ("sharp-scoop.0" ,SPITZ_GPIO_MUTE_R -SPITZ_SCP_GPIO_BASE , -"mute-r" ,GPIO_ACTIVE_HIGH ), -GPIO_LOOKUP ("sharp-scoop.1" ,SPITZ_GPIO_MIC_BIAS -SPITZ_SCP2_GPIO_BASE , -"mic" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("sharp-scoop.0" ,3 ,"mute-l" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("sharp-scoop.0" ,4 ,"mute-r" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("sharp-scoop.1" ,8 ,"mic" ,GPIO_ACTIVE_HIGH ), { }, }, };
@@ -970,12 +963,9 @@ static struct gpiod_lookup_table spitz_audio_gpio_table = {static struct gpiod_lookup_table akita_audio_gpio_table = { .dev_id ="spitz-audio" , .table = { -GPIO_LOOKUP ("sharp-scoop.0" ,SPITZ_GPIO_MUTE_L -SPITZ_SCP_GPIO_BASE , -"mute-l" ,GPIO_ACTIVE_HIGH ), -GPIO_LOOKUP ("sharp-scoop.0" ,SPITZ_GPIO_MUTE_R -SPITZ_SCP_GPIO_BASE , -"mute-r" ,GPIO_ACTIVE_HIGH ), -GPIO_LOOKUP ("i2c-max7310" ,AKITA_GPIO_MIC_BIAS -AKITA_IOEXP_GPIO_BASE , -"mic" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("sharp-scoop.0" ,3 ,"mute-l" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("sharp-scoop.0" ,4 ,"mute-r" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("i2c-max7310" ,2 ,"mic" ,GPIO_ACTIVE_HIGH ), { }, }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/352 firmware: turris-mox-rwtm: Fix checking return value of wait_for_completion_timeout()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Behún <[email protected]>
[ Upstream commit 8467cfe821ac3526f7598682ad5f90689fa8cc49 ]
The wait_for_completion_timeout() function returns 0 if timed out, and a positive value if completed. Fix the usage of this function.
--- drivers/firmware/turris-mox-rwtm.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
drivers/firmware/turris-mox-rwtm.c +6 -9
@@ -199,9 +199,8 @@ static int mox_get_board_info(struct mox_rwtm *rwtm)if (ret <0 )return ret; - ret =wait_for_completion_timeout (&rwtm->cmd_done,HZ /2 ); -if (ret <0 ) -return ret; +if (!wait_for_completion_timeout (&rwtm->cmd_done,HZ /2 )) +return -ETIMEDOUT ; ret =mox_get_status (MBOX_CMD_BOARD_INFO , reply->retval);if (ret == -ENODATA ) {
@@ -235,9 +234,8 @@ static int mox_get_board_info(struct mox_rwtm *rwtm)if (ret <0 )return ret; - ret =wait_for_completion_timeout (&rwtm->cmd_done,HZ /2 ); -if (ret <0 ) -return ret; +if (!wait_for_completion_timeout (&rwtm->cmd_done,HZ /2 )) +return -ETIMEDOUT ; ret =mox_get_status (MBOX_CMD_ECDSA_PUB_KEY , reply->retval);if (ret == -ENODATA ) {
@@ -274,9 +272,8 @@ static int check_get_random_support(struct mox_rwtm *rwtm)if (ret <0 )return ret; - ret =wait_for_completion_timeout (&rwtm->cmd_done,HZ /2 ); -if (ret <0 ) -return ret; +if (!wait_for_completion_timeout (&rwtm->cmd_done,HZ /2 )) +return -ETIMEDOUT ;return mox_get_status (MBOX_CMD_GET_RANDOM , rwtm->reply.retval); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/352 firmware: turris-mox-rwtm: Initialize completion before mailbox
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Behún <[email protected]>
[ Upstream commit 49e24c80d3c81c43e2a56101449e1eea32fcf292 ]
Initialize the completion before the mailbox channel is requested.
--- drivers/firmware/turris-mox-rwtm.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/firmware/turris-mox-rwtm.c +1 -2
@@ -496,6 +496,7 @@ static int turris_mox_rwtm_probe(struct platform_device *pdev)platform_set_drvdata (pdev, rwtm);mutex_init (&rwtm->busy); +init_completion (&rwtm->cmd_done); rwtm->mbox_client.dev = dev; rwtm->mbox_client.rx_callback = mox_rwtm_rx_callback;
@@ -509,8 +510,6 @@ static int turris_mox_rwtm_probe(struct platform_device *pdev) goto remove_files; } -init_completion (&rwtm->cmd_done); - ret =mox_get_board_info (rwtm);if (ret <0 )dev_warn (dev,"Cannot read board information: %i\n" , ret);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/352 wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samasth Norway Ananda <[email protected]>
[ Upstream commit c636fa85feb450ca414a10010ed05361a73c93a6 ]
The band_idx variable in the function wlc_lcnphy_tx_iqlo_cal() will never be set to 1 as BCM4313 is the only device for which the LCN PHY code is used. This is a 2G-only device.
--- .../broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c +9 -9
@@ -2567,7 +2567,6 @@ wlc_lcnphy_tx_iqlo_cal(struct brcms_phy *pi,struct lcnphy_txgains cal_gains, temp_gains;u16 hash; -u8 band_idx;int j;u16 ncorr_override[5 ];u16 syst_coeffs[] = {0x0000 ,0x0000 ,0x0000 ,0x0000 ,0x0000 ,0x0000 ,
@@ -2599,6 +2598,9 @@ wlc_lcnphy_tx_iqlo_cal(struct brcms_phy *pi,u16 *values_to_save;struct brcms_phy_lcnphy *pi_lcn = pi->u.pi_lcnphy; +if (WARN_ON (CHSPEC_IS5G (pi->radio_chanspec))) +return ; + values_to_save =kmalloc_array (20 ,sizeof (u16),GFP_ATOMIC );if (NULL == values_to_save)return ;
@@ -2662,20 +2664,18 @@ wlc_lcnphy_tx_iqlo_cal(struct brcms_phy *pi, hash = (target_gains->gm_gain <<8 ) | (target_gains->pga_gain <<4 ) | (target_gains->pad_gain); - band_idx = (CHSPEC_IS5G (pi->radio_chanspec) ?1 :0 ); - cal_gains = *target_gains;memset (ncorr_override,0 ,sizeof (ncorr_override)); -for (j =0 ; j < iqcal_gainparams_numgains_lcnphy[band_idx]; j++) { -if (hash == tbl_iqcal_gainparams_lcnphy[band_idx][j][0 ]) { +for (j =0 ; j < iqcal_gainparams_numgains_lcnphy[0 ]; j++) { +if (hash == tbl_iqcal_gainparams_lcnphy[0 ][j][0 ]) { cal_gains.gm_gain = - tbl_iqcal_gainparams_lcnphy[band_idx][j][1 ]; + tbl_iqcal_gainparams_lcnphy[0 ][j][1 ]; cal_gains.pga_gain = - tbl_iqcal_gainparams_lcnphy[band_idx][j][2 ]; + tbl_iqcal_gainparams_lcnphy[0 ][j][2 ]; cal_gains.pad_gain = - tbl_iqcal_gainparams_lcnphy[band_idx][j][3 ]; + tbl_iqcal_gainparams_lcnphy[0 ][j][3 ];memcpy (ncorr_override, - &tbl_iqcal_gainparams_lcnphy[band_idx][j][3 ], + &tbl_iqcal_gainparams_lcnphy[0 ][j][3 ],sizeof (ncorr_override));break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/352 selftests/bpf: Fix prog numbers in test_sockmap
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
[ Upstream commit 6c8d7598dfed759bf1d9d0322b4c2b42eb7252d8 ]
bpf_prog5 and bpf_prog7 are removed from progs/test_sockmap_kern.h in commit d79a32129b21 ("bpf: Selftests, remove prints from sockmap tests"), now there are only 9 progs in it, not 11:
SEC("sk_skb1")
int bpf_prog1(struct __sk_buff *skb)
SEC("sk_skb2")
int bpf_prog2(struct __sk_buff *skb)
SEC("sk_skb3")
int bpf_prog3(struct __sk_buff *skb)
SEC("sockops")
int bpf_sockmap(struct bpf_sock_ops *skops)
SEC("sk_msg1")
int bpf_prog4(struct sk_msg_md *msg)
SEC("sk_msg2")
int bpf_prog6(struct sk_msg_md *msg)
SEC("sk_msg3")
int bpf_prog8(struct sk_msg_md *msg)
SEC("sk_msg4")
int bpf_prog9(struct sk_msg_md *msg)
SEC("sk_msg5")
int bpf_prog10(struct sk_msg_md *msg)This patch updates the array sizes of prog_fd[], prog_attach_type[] and prog_type[] from 11 to 9 accordingly.
--- tools/testing/selftests/bpf/test_sockmap.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
tools/testing/selftests/bpf/test_sockmap.c +1 -5
@@ -65,7 +65,7 @@ int passed;int failed;int map_fd[9 ];struct bpf_map *maps[9 ]; -int prog_fd[11 ]; +int prog_fd[9 ];int txmsg_pass;int txmsg_redir;
@@ -1708,8 +1708,6 @@ int prog_attach_type[] = {BPF_SK_MSG_VERDICT ,BPF_SK_MSG_VERDICT , BPF_SK_MSG_VERDICT, -BPF_SK_MSG_VERDICT , - BPF_SK_MSG_VERDICT, }; int prog_type[] = {
@@ -1722,8 +1720,6 @@ int prog_type[] = {BPF_PROG_TYPE_SK_MSG ,BPF_PROG_TYPE_SK_MSG , BPF_PROG_TYPE_SK_MSG, -BPF_PROG_TYPE_SK_MSG , - BPF_PROG_TYPE_SK_MSG, };static int populate_progs (char *bpf_file)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/352 net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hagar Hemdan <[email protected]>
[ Upstream commit 96f887a612e4cda89efc3f54bc10c1997e3ab0e9 ]
xmit() functions should consume skb or return error codes in error paths.
When the configuration "CONFIG_INET_ESPINTCP" is not set, the implementation of the function "esp_output_tail_tcp" violates this rule. The function frees the skb and returns the error code.
This change removes the kfree_skb from both functions, for both esp4 and esp6.WARN_ON is added because esp_output_tail_tcp() should never be called if CONFIG_INET_ESPINTCP is not set.
This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc.
--- net/ipv4/esp4.c | 3 +-- net/ipv6/esp6.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-)
net/ipv4/esp4.c +1 -2
@@ -239,8 +239,7 @@ static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb)#else static int esp_output_tail_tcp (struct xfrm_state *x,struct sk_buff *skb) { -kfree_skb (skb); - +WARN_ON (1 );return -EOPNOTSUPP ; }#endif
net/ipv6/esp6.c +1 -2
@@ -255,8 +255,7 @@ static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb)#else static int esp_output_tail_tcp (struct xfrm_state *x,struct sk_buff *skb) { -kfree_skb (skb); - +WARN_ON (1 );return -EOPNOTSUPP ; }#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/352 net/smc: Allow SMC-D 1MB DMB allocations
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Raspl <[email protected]>
[ Upstream commit 67161779a9ea926fccee8de047ae66cbd3482b91 ]
Commit a3fe3d01bd0d7 ("net/smc: introduce sg-logic for RMBs") introduced a restriction for RMB allocations as used by SMC-R. However, SMC-D does not use scatter-gather lists to back its DMBs, yet it was limited by this restriction, still.
This patch exempts SMC, but limits allocations to the maximum RMB/DMB size respectively.
Stable-dep-of: 3ac14b9dfbd3 ("net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined")
--- net/smc/smc_core.c | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-)
net/smc/smc_core.c +16 -15
@@ -1375,21 +1375,30 @@ int smc_conn_create(struct smc_sock *smc, struct smc_init_info *ini)return rc; } -/* convert the RMB size into the compressed notation - minimum 16K. +#define SMCD_DMBE_SIZES 6/* 0 -> 16KB, 1 -> 32KB, .. 6 -> 1MB */ +#define SMCR_RMBE_SIZES 5/* 0 -> 16KB, 1 -> 32KB, .. 5 -> 512KB */ + +/* convert the RMB size into the compressed notation (minimum 16K, see +* SMCD/R_DMBE_SIZES. * In contrast to plain ilog2, this rounds towards the next power of 2, * so the socket application gets at least its desired sndbuf / rcvbuf size. */ -static u8 smc_compress_bufsize (int size) +static u8 smc_compress_bufsize (int size,bool is_smcd,bool is_rmb) { +const unsigned int max_scat =SG_MAX_SINGLE_ALLOC *PAGE_SIZE ;u8 compressed;if (size <=SMC_BUF_MIN_SIZE )return 0 ; - size = (size -1 ) >>14 ; - compressed =ilog2 (size) +1 ; -if (compressed >=SMC_RMBE_SIZES ) - compressed =SMC_RMBE_SIZES -1 ; + size = (size -1 ) >>14 ;/* convert to 16K multiple */ + compressed =min_t (u8,ilog2 (size) +1 , + is_smcd ?SMCD_DMBE_SIZES :SMCR_RMBE_SIZES ); + +if (!is_smcd && is_rmb) +/* RMBs are backed by & limited to max size of scatterlists */ + compressed =min_t (u8, compressed,ilog2 (max_scat >>14 )); +return compressed; }
@@ -1608,17 +1617,12 @@ static int smcr_buf_map_usable_links(struct smc_link_group *lgr,return rc; } -#define SMCD_DMBE_SIZES 6/* 0 -> 16KB, 1 -> 32KB, .. 6 -> 1MB */ -static struct smc_buf_desc *smcd_new_buf_create (struct smc_link_group *lgr,bool is_dmb,int bufsize) {struct smc_buf_desc *buf_desc;int rc; -if (smc_compress_bufsize (bufsize) >SMCD_DMBE_SIZES ) -return ERR_PTR (-EAGAIN ); -/* try to alloc a new DMB */ buf_desc =kzalloc (sizeof (*buf_desc),GFP_KERNEL );if (!buf_desc)
@@ -1666,9 +1670,8 @@ static int __smc_buf_create(struct smc_sock *smc, bool is_smcd, bool is_rmb)/* use socket send buffer size (w/o overhead) as start value */ sk_buf_size = smc->sk.sk_sndbuf /2 ; -for (bufsize_short =smc_compress_bufsize (sk_buf_size); +for (bufsize_short =smc_compress_bufsize (sk_buf_size, is_smcd, is_rmb); bufsize_short >=0 ; bufsize_short--) { -if (is_rmb) { lock = &lgr->rmbs_lock; buf_list = &lgr->rmbs[bufsize_short];
@@ -1677,8 +1680,6 @@ static int __smc_buf_create(struct smc_sock *smc, bool is_smcd, bool is_rmb) buf_list = &lgr->sndbufs[bufsize_short]; } bufsize =smc_uncompress_bufsize (bufsize_short); -if ((1 <<get_order (bufsize)) >SG_MAX_SINGLE_ALLOC ) -continue ;/* check for reusable slot in the link group */ buf_desc =smc_buf_get_slot (bufsize_short, lock, buf_list);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/352 net/smc: set rmbs SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangguan Wang <[email protected]>
[ Upstream commit 3ac14b9dfbd345e891d48d89f6c2fa519848f0f4 ]
SG_MAX_SINGLE_ALLOC is used to limit maximum number of entries that will be allocated in one piece of scatterlist. When the entries of scatterlist exceeds SG_MAX_SINGLE_ALLOC, sg chain will be used. From commit 7c703e54cc71 ("arch: switch the default on ARCH_HAS_SG_CHAIN"), we can know that the macro CONFIG_ARCH_NO_SG_CHAIN is used to identify whether sg chain is supported. So, SMC-R's rmb buffer should be limited by SG_MAX_SINGLE_ALLOC only when the macro CONFIG_ARCH_NO_SG_CHAIN is defined.
--- net/smc/smc_core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/smc/smc_core.c +3 -2
@@ -1385,7 +1385,6 @@ int smc_conn_create(struct smc_sock *smc, struct smc_init_info *ini)*/ static u8 smc_compress_bufsize (int size,bool is_smcd,bool is_rmb) { -const unsigned int max_scat =SG_MAX_SINGLE_ALLOC *PAGE_SIZE ;u8 compressed;if (size <=SMC_BUF_MIN_SIZE )
@@ -1395,9 +1394,11 @@ static u8 smc_compress_bufsize(int size, bool is_smcd, bool is_rmb) compressed =min_t (u8,ilog2 (size) +1 , is_smcd ?SMCD_DMBE_SIZES :SMCR_RMBE_SIZES ); +#ifdef CONFIG_ARCH_NO_SG_CHAIN if (!is_smcd && is_rmb)/* RMBs are backed by & limited to max size of scatterlists */ - compressed =min_t (u8, compressed,ilog2 (max_scat >>14 )); + compressed =min_t (u8, compressed,ilog2 ((SG_MAX_SINGLE_ALLOC *PAGE_SIZE ) >>14 )); +#endif return compressed; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/352 selftests/bpf: Check length of recv in test_sockmap
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
[ Upstream commit de1b5ea789dc28066cc8dc634b6825bd6148f38b ]
The value of recv in msg_loop may be negative, like EWOULDBLOCK, so it's necessary to check if it is positive before accumulating it to bytes_recvd.
--- tools/testing/selftests/bpf/test_sockmap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/bpf/test_sockmap.c +2 -1
@@ -663,7 +663,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, } } - s->bytes_recvd += recv; +if (recv >0 ) + s->bytes_recvd += recv;if (data) { int chunk_sz = opt->sendpage ?
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/352 lib: objagg: Fix general protection fault
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit b4a3a89fffcdf09702b1f161b914e52abca1894d ]
The library supports aggregation of objects into other objects only if the parent object does not have a parent itself. That is, nesting is not supported.
Aggregation happens in two cases: Without and with hints, where hints are a pre-computed recommendation on how to aggregate the provided objects.
Nesting is not possible in the first case due to a check that prevents it, but in the second case there is no check because the assumption is that nesting cannot happen when creating objects based on hints. The violation of this assumption leads to various warnings and eventually to a general protection fault [1].
Before fixing the root cause, error out when nesting happens and warn.
[1]
general protection fault, probably for non-canonical address 0xdead000000000d90: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 1083 Comm: kworker/1:9 Tainted: G W 6.9.0-rc6-custom-gd9b4f1cca7fb #7 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:mlxsw_sp_acl_erp_bf_insert+0x25/0x80 [...] Call Trace: <TASK> mlxsw_sp_acl_atcam_entry_add+0x256/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK>
--- lib/objagg.c | 3 +++ 1 file changed, 3 insertions(+)
lib/objagg.c +3 -0
@@ -167,6 +167,9 @@ static int objagg_obj_parent_assign(struct objagg *objagg, {void *delta_priv; +if (WARN_ON (!objagg_obj_is_root (parent))) +return -EINVAL ; + delta_priv = objagg->ops->delta_create (objagg->priv, parent->obj, objagg_obj->obj);if (IS_ERR (delta_priv))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/352 mlxsw: spectrum_acl_erp: Fix object nesting warning
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 97d833ceb27dc19f8777d63f90be4a27b5daeedf ]
ACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM (A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former can contain more ACLs (i.e., tc filters), but the number of masks in each region (i.e., tc chain) is limited.
In order to mitigate the effects of the above limitation, the device allows filters to share a single mask if their masks only differ in up to 8 consecutive bits. For example, dst_ip/25 can be represented using dst_ip/24 with a delta of 1 bit. The C-TCAM does not have a limit on the number of masks being used (and therefore does not support mask aggregation), but can contain a limited number of filters.
The driver uses the "objagg" library to perform the mask aggregation by passing it objects that consist of the filter's mask and whether the filter is to be inserted into the A-TCAM or the C-TCAM since filters in different TCAMs cannot share a mask.
The set of created objects is dependent on the insertion order of the filters and is not necessarily optimal. Therefore, the driver will periodically ask the library to compute a more optimal set ("hints") by looking at all the existing objects.
When the library asks the driver whether two objects can be aggregated the driver only compares the provided masks and ignores the A-TCAM / C-TCAM indication. This is the right thing to do since the goal is to move as many filters as possible to the A-TCAM. The driver also forbids two identical masks from being aggregated since this can only happen if one was intentionally put in the C-TCAM to avoid a conflict in the A-TCAM.
The above can result in the following set of hints:
H1: {mask X, A-TCAM} -> H2: {mask Y, A-TCAM} // X is Y + delta
H3: {mask Y, C-TCAM} -> H4: {mask Z, A-TCAM} // Y is Z + delta
After getting the hints from the library the driver will start migrating filters from one region to another while consulting the computed hints and instructing the device to perform a lookup in both regions during the transition.
Assuming a filter with mask X is being migrated into the A-TCAM in the new region, the hints lookup will return H1. Since H2 is the parent of H1, the library will try to find the object associated with it and create it if necessary in which case another hints lookup (recursive) will be performed. This hints lookup for {mask Y, A-TCAM} will either return H2 or H3 since the driver passes the library an object comparison function that ignores the A-TCAM / C-TCAM indication.
This can eventually lead to nested objects which are not supported by the library [1].
Fix by removing the object comparison function from both the driver and the library as the driver was the only user. That way the lookup will only return exact matches.
I do not have a reliable reproducer that can reproduce the issue in a timely manner, but before the fix the issue would reproduce in several minutes and with the fix it does not reproduce in over an hour.
Note that the current usefulness of the hints is limited because they include the C-TCAM indication and represent aggregation that cannot actually happen. This will be addressed in net-next.
[1]
WARNING: CPU: 0 PID: 153 at lib/objagg.c:170 objagg_obj_parent_assign+0xb5/0xd0 Modules linked in: CPU: 0 PID: 153 Comm: kworker/0:18 Not tainted 6.9.0-rc6-custom-g70fbc2c1c38b #42 Hardware name: Mellanox Technologies Ltd. MSN3700C/VMOD0008, BIOS 5.11 10/10/2018 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:objagg_obj_parent_assign+0xb5/0xd0 [...] Call Trace: <TASK> __objagg_obj_get+0x2bb/0x580 objagg_obj_get+0xe/0x80 mlxsw_sp_acl_erp_mask_get+0xb5/0xf0 mlxsw_sp_acl_atcam_entry_add+0xe8/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 process_one_work+0x151/0x370
--- .../ethernet/mellanox/mlxsw/spectrum_acl_erp.c | 13 ------------- include/linux/objagg.h | 1 - lib/objagg.c | 15 --------------- 3 files changed, 29 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c +0 -13
@@ -1217,18 +1217,6 @@ static bool mlxsw_sp_acl_erp_delta_check(void *priv, const void *parent_obj,return err ? false : true; } -static int mlxsw_sp_acl_erp_hints_obj_cmp (const void *obj1,const void *obj2) -{ -const struct mlxsw_sp_acl_erp_key *key1 = obj1; -const struct mlxsw_sp_acl_erp_key *key2 = obj2; - -/* For hints purposes, two objects are considered equal -* in case the masks are the same. Does not matter what -* the "ctcam" value is. -*/ -return memcmp (key1->mask, key2->mask,sizeof (key1->mask)); -} -static void *mlxsw_sp_acl_erp_delta_create (void *priv,void *parent_obj,void *obj) {
@@ -1308,7 +1296,6 @@ static void mlxsw_sp_acl_erp_root_destroy(void *priv, void *root_priv)static const struct objagg_ops mlxsw_sp_acl_erp_objagg_ops = { .obj_size =sizeof (struct mlxsw_sp_acl_erp_key ), .delta_check = mlxsw_sp_acl_erp_delta_check, - .hints_obj_cmp = mlxsw_sp_acl_erp_hints_obj_cmp, .delta_create = mlxsw_sp_acl_erp_delta_create, .delta_destroy = mlxsw_sp_acl_erp_delta_destroy, .root_create = mlxsw_sp_acl_erp_root_create,
include/linux/objagg.h +0 -1
@@ -8,7 +8,6 @@ struct objagg_ops {size_t obj_size;bool (*delta_check)(void *priv,const void *parent_obj,const void *obj); -int (*hints_obj_cmp)(const void *obj1,const void *obj2);void * (*delta_create)(void *priv,void *parent_obj,void *obj);void (*delta_destroy)(void *priv,void *delta_priv);void * (*root_create)(void *priv,void *obj,unsigned int root_id);
lib/objagg.c +0 -15
@@ -909,20 +909,6 @@ static const struct objagg_opt_algo *objagg_opt_algos[] = { [OBJAGG_OPT_ALGO_SIMPLE_GREEDY] = &objagg_opt_simple_greedy, }; -static int objagg_hints_obj_cmp (struct rhashtable_compare_arg *arg, -const void *obj) -{ -struct rhashtable *ht = arg->ht; -struct objagg_hints *objagg_hints = - container_of(ht, struct objagg_hints, node_ht); -const struct objagg_ops *ops = objagg_hints->ops; -const char *ptr = obj; - - ptr += ht->p.key_offset; -return ops->hints_obj_cmp ? ops->hints_obj_cmp (ptr, arg->key) : -memcmp (ptr, arg->key, ht->p.key_len); -} -/** * objagg_hints_get - obtains hints instance * @objagg: objagg instance
@@ -961,7 +947,6 @@ struct objagg_hints *objagg_hints_get(struct objagg *objagg, offsetof(struct objagg_hints_node , obj); objagg_hints->ht_params.head_offset = offsetof(struct objagg_hints_node , ht_node); - objagg_hints->ht_params.obj_cmpfn = objagg_hints_obj_cmp; err =rhashtable_init (&objagg_hints->node_ht, &objagg_hints->ht_params);if (err)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/352 mlxsw: spectrum_acl_bloom_filter: Make mlxsw_sp_acl_bf_key_encode() more flexible
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Cohen <[email protected]>
[ Upstream commit 5d5c3ba9e4121b7738d10be3825f4d9a5a1d80ef ]
Spectrum-4 will calculate hash function for bloom filter differently from the existing ASICs.
One of the changes is related to the way that the chunks will be build - without padding.
As preparation for support of Spectrum-4 bloom filter, make mlxsw_sp_acl_bf_key_encode() more flexible, so it will be able to use it for Spectrum-4 as well.
Stable-dep-of: 75d8d7a63065 ("mlxsw: spectrum_acl: Fix ACL scale regression and firmware errors")
--- .../mlxsw/spectrum_acl_bloom_filter.c | 36 +++++++++++++------ 1 file changed, 25 insertions(+), 11 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c +25 -11
@@ -116,9 +116,10 @@ static u16 mlxsw_sp_acl_bf_crc(const u8 *buffer, size_t len) }static void -mlxsw_sp_acl_bf_key_encode (struct mlxsw_sp_acl_atcam_region *aregion, -struct mlxsw_sp_acl_atcam_entry *aentry, -char *output,u8 *len) +__mlxsw_sp_acl_bf_key_encode (struct mlxsw_sp_acl_atcam_region *aregion, +struct mlxsw_sp_acl_atcam_entry *aentry, +char *output,u8 *len,u8 max_chunks,u8 pad_bytes, +u8 key_offset,u8 chunk_key_len,u8 chunk_len) {struct mlxsw_afk_key_info *key_info = aregion->region->key_info;u8 chunk_index, chunk_count, block_count;
@@ -129,17 +130,30 @@ mlxsw_sp_acl_bf_key_encode(struct mlxsw_sp_acl_atcam_region *aregion, chunk_count =1 + ((block_count -1 ) >>2 ); erp_region_id =cpu_to_be16 (aentry->ht_key.erp_id | (aregion->region->id <<4 )); -for (chunk_index =MLXSW_BLOOM_KEY_CHUNKS - chunk_count; - chunk_index <MLXSW_BLOOM_KEY_CHUNKS ; chunk_index++) { -memset (chunk,0 ,MLXSW_BLOOM_CHUNK_PAD_BYTES ); -memcpy (chunk +MLXSW_BLOOM_CHUNK_PAD_BYTES , &erp_region_id, +for (chunk_index = max_chunks - chunk_count; chunk_index < max_chunks; + chunk_index++) { +memset (chunk,0 , pad_bytes); +memcpy (chunk + pad_bytes, &erp_region_id,sizeof (erp_region_id)); -memcpy (chunk +MLXSW_BLOOM_CHUNK_KEY_OFFSET , +memcpy (chunk + key_offset, &aentry->enc_key[chunk_key_offsets[chunk_index]], -MLXSW_BLOOM_CHUNK_KEY_BYTES ); - chunk +=MLXSW_BLOOM_KEY_CHUNK_BYTES ; + chunk_key_len); + chunk += chunk_len; } - *len = chunk_count *MLXSW_BLOOM_KEY_CHUNK_BYTES ; + *len = chunk_count * chunk_len; +} + +static void +mlxsw_sp_acl_bf_key_encode (struct mlxsw_sp_acl_atcam_region *aregion, +struct mlxsw_sp_acl_atcam_entry *aentry, +char *output,u8 *len) +{ +__mlxsw_sp_acl_bf_key_encode (aregion, aentry, output, len, +MLXSW_BLOOM_KEY_CHUNKS , +MLXSW_BLOOM_CHUNK_PAD_BYTES , +MLXSW_BLOOM_CHUNK_KEY_OFFSET , +MLXSW_BLOOM_CHUNK_KEY_BYTES , +MLXSW_BLOOM_KEY_CHUNK_BYTES ); } static unsigned int
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/352 mlxsw: spectrum_acl: Fix ACL scale regression and firmware errors
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 75d8d7a63065b18df9555dbaab0b42d4c6f20943 ]
ACLs that reside in the algorithmic TCAM (A-TCAM) in Spectrum-2 and newer ASICs can share the same mask if their masks only differ in up to 8 consecutive bits. For example, consider the following filters:
# tc filter add dev swp1 ingress pref 1 proto ip flower dst_ip 192.0.2.0/24 action drop # tc filter add dev swp1 ingress pref 1 proto ip flower dst_ip 198.51.100.128/25 action drop
The second filter can use the same mask as the first (dst_ip/24) with a delta of 1 bit.
However, the above only works because the two filters have different values in the common unmasked part (dst_ip/24). When entries have the same value in the common unmasked part they create undesired collisions in the device since many entries now have the same key. This leads to firmware errors such as [1] and to a reduced scale.
Fix by adjusting the hash table key to only include the value in the common unmasked part. That is, without including the delta bits. That way the driver will detect the collision during filter insertion and spill the filter into the circuit TCAM (C-TCAM).
Add a test case that fails without the fix and adjust existing cases that check C-TCAM spillage according to the above limitation.
[1]mlxsw_spectrum2 0000:06:00.0: EMAD reg access failed (tid=3379b18a00003394,reg_id=3027(ptce3),type=write,status=8(resource not available))
--- .../mellanox/mlxsw/spectrum_acl_atcam.c | 18 +++--- .../mlxsw/spectrum_acl_bloom_filter.c | 2 +- .../mellanox/mlxsw/spectrum_acl_tcam.h | 9 +-- .../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 55 +++++++++++++++++-- 4 files changed, 63 insertions(+), 21 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_atcam.c +8 -10
@@ -391,7 +391,8 @@ mlxsw_sp_acl_atcam_region_entry_insert(struct mlxsw_sp *mlxsw_sp,if (err)return err; - lkey_id = aregion->ops->lkey_id_get (aregion, aentry->enc_key, erp_id); + lkey_id = aregion->ops->lkey_id_get (aregion, aentry->ht_key.enc_key, + erp_id);if (IS_ERR (lkey_id))return PTR_ERR (lkey_id); aentry->lkey_id = lkey_id;
@@ -399,7 +400,7 @@ mlxsw_sp_acl_atcam_region_entry_insert(struct mlxsw_sp *mlxsw_sp, kvdl_index =mlxsw_afa_block_first_kvdl_index (rulei->act_block); mlxsw_reg_ptce3_pack(ptce3_pl, true, MLXSW_REG_PTCE3_OP_WRITE_WRITE, priority, region->tcam_region_info, - aentry->enc_key, erp_id, + aentry->ht_key.enc_key, erp_id, aentry->delta_info.start, aentry->delta_info.mask, aentry->delta_info.value,
@@ -428,7 +429,7 @@ mlxsw_sp_acl_atcam_region_entry_remove(struct mlxsw_sp *mlxsw_sp, mlxsw_reg_ptce3_pack(ptce3_pl, false, MLXSW_REG_PTCE3_OP_WRITE_WRITE, 0, region->tcam_region_info, - aentry->enc_key, erp_id, + aentry->ht_key.enc_key, erp_id, aentry->delta_info.start, aentry->delta_info.mask, aentry->delta_info.value,
@@ -457,7 +458,7 @@ mlxsw_sp_acl_atcam_region_entry_action_replace(struct mlxsw_sp *mlxsw_sp, kvdl_index =mlxsw_afa_block_first_kvdl_index (rulei->act_block); mlxsw_reg_ptce3_pack(ptce3_pl, true, MLXSW_REG_PTCE3_OP_WRITE_UPDATE, priority, region->tcam_region_info, - aentry->enc_key, erp_id, + aentry->ht_key.enc_key, erp_id, aentry->delta_info.start, aentry->delta_info.mask, aentry->delta_info.value,
@@ -480,15 +481,13 @@ __mlxsw_sp_acl_atcam_entry_add(struct mlxsw_sp *mlxsw_sp,int err;mlxsw_afk_encode (afk, region->key_info, &rulei->values, - aentry->ht_key.full_enc_key, mask); + aentry->ht_key.enc_key, mask); erp_mask =mlxsw_sp_acl_erp_mask_get (aregion, mask, false);if (IS_ERR (erp_mask))return PTR_ERR (erp_mask); aentry->erp_mask = erp_mask; aentry->ht_key.erp_id =mlxsw_sp_acl_erp_mask_erp_id (erp_mask); -memcpy (aentry->enc_key, aentry->ht_key.full_enc_key, -sizeof (aentry->enc_key));/* Compute all needed delta information and clear the delta bits * from the encrypted key.
@@ -497,9 +496,8 @@ __mlxsw_sp_acl_atcam_entry_add(struct mlxsw_sp *mlxsw_sp, aentry->delta_info.start =mlxsw_sp_acl_erp_delta_start (delta); aentry->delta_info.mask =mlxsw_sp_acl_erp_delta_mask (delta); aentry->delta_info.value = -mlxsw_sp_acl_erp_delta_value (delta, - aentry->ht_key.full_enc_key); -mlxsw_sp_acl_erp_delta_clear (delta, aentry->enc_key); +mlxsw_sp_acl_erp_delta_value (delta, aentry->ht_key.enc_key); +mlxsw_sp_acl_erp_delta_clear (delta, aentry->ht_key.enc_key);/* Add rule to the list of A-TCAM rules, assuming this * rule is intended to A-TCAM. In case this rule does
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c +1 -1
@@ -136,7 +136,7 @@ __mlxsw_sp_acl_bf_key_encode(struct mlxsw_sp_acl_atcam_region *aregion,memcpy (chunk + pad_bytes, &erp_region_id,sizeof (erp_region_id));memcpy (chunk + key_offset, - &aentry->enc_key[chunk_key_offsets[chunk_index]], + &aentry->ht_key.enc_key[chunk_key_offsets[chunk_index]], chunk_key_len); chunk += chunk_len; }
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.h +3 -6
@@ -171,9 +171,9 @@ struct mlxsw_sp_acl_atcam_region { };struct mlxsw_sp_acl_atcam_entry_ht_key { -char full_enc_key[MLXSW_REG_PTCEX_FLEX_KEY_BLOCKS_LEN ];/* Encoded -* key. -*/ +char enc_key[MLXSW_REG_PTCEX_FLEX_KEY_BLOCKS_LEN ];/* Encoded key, minus +* delta bits. +*/ u8 erp_id; };
@@ -185,9 +185,6 @@ struct mlxsw_sp_acl_atcam_entry {struct rhash_head ht_node;struct list_head list;/* Member in entries_list */ struct mlxsw_sp_acl_atcam_entry_ht_key ht_key; -char enc_key[MLXSW_REG_PTCEX_FLEX_KEY_BLOCKS_LEN ];/* Encoded key, -* minus delta bits. -*/ struct {u16 start;u8 mask;
tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh +51 -4
79 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/352 ath11k: dp: stop rx pktlog before suspend
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carl Huang <[email protected]>
[ Upstream commit 840c36fa727aea13a2401a5d1d33b722b79df5af ]
Stop dp rx pktlog when entering suspend and reap the mon_status buffer to keep it empty. During resume restart the reap timer.
Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
Stable-dep-of: d2b0ca38d362 ("wifi: ath11k: fix wrong handling of CCMP256 and GCMP ciphers")
--- drivers/net/wireless/ath/ath11k/dp.h | 1 + drivers/net/wireless/ath/ath11k/dp_rx.c | 48 +++++++++++++++++++++++++ drivers/net/wireless/ath/ath11k/dp_rx.h | 3 ++ drivers/net/wireless/ath/ath11k/mac.c | 4 +++ 4 files changed, 56 insertions(+)
drivers/net/wireless/ath/ath11k/dp.h +1 -0
@@ -40,6 +40,7 @@ struct dp_rx_tid {#define DP_REO_DESC_FREE_THRESHOLD 64#define DP_REO_DESC_FREE_TIMEOUT_MS 1000 +#define DP_MON_PURGE_TIMEOUT_MS 100#define DP_MON_SERVICE_BUDGET 128struct dp_reo_cache_flush_elem {
drivers/net/wireless/ath/ath11k/dp_rx.c +48 -0
57 lines not on this page · raw message
drivers/net/wireless/ath/ath11k/dp_rx.h +3 -0
@@ -92,4 +92,7 @@ int ath11k_dp_rx_pdev_mon_detach(struct ath11k *ar);int ath11k_dp_rx_pdev_mon_attach (struct ath11k *ar);int ath11k_peer_rx_frag_setup (struct ath11k *ar,const u8 *peer_mac,int vdev_id); +int ath11k_dp_rx_pktlog_start (struct ath11k_base *ab); +int ath11k_dp_rx_pktlog_stop (struct ath11k_base *ab,bool stop_timer); +#endif /* ATH11K_DP_RX_H */
drivers/net/wireless/ath/ath11k/mac.c +4 -0
@@ -4149,6 +4149,10 @@ static int ath11k_mac_config_mon_status_default(struct ath11k *ar, bool enable) &tlv_filter); } +if (enable && !ar->ab->hw_params.rxdma1_enable) +mod_timer (&ar->ab->mon_reap_timer, jiffies + +msecs_to_jiffies (ATH11K_MON_TIMER_INTERVAL )); +return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/352 wifi: ath11k: fix wrong handling of CCMP256 and GCMP ciphers
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit d2b0ca38d362ebf16ca79cd7f309d5bb8b581deb ]
Currently for CCMP256, GCMP128 and GCMP256 ciphers, in ath11k_install_key() IEEE80211_KEY_FLAG_GENERATE_IV_MGMT is not set. And in ath11k_mac_mgmt_tx_wmi() a length of IEEE80211_CCMP_MIC_LEN is reserved for all ciphers.
This results in unexpected management frame drop in case either of above 3 ciphers is used. The reason is, without IEEE80211_KEY_FLAG_GENERATE_IV_MGMT set, mac80211 will not generate CCMP/GCMP headers in frame for ath11k. Also MIC length reserved is wrong. Such frame is dropped later by hardware:
ath11k_pci 0000:5a:00.0: mac tx mgmt frame, buf id 0 ath11k_pci 0000:5a:00.0: mgmt tx compl ev pdev_id 1, desc_id 0, status 1
Quoted 1 line
From user point of view, we have observed very low throughput due to this issue:
action frames are all dropped so ADDBA response from DUT never reaches AP. AP can not use aggregation thus throughput is low.
Fix this by setting IEEE80211_KEY_FLAG_GENERATE_IV_MGMT flag and by reserving proper MIC length for those ciphers.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath11k/dp_rx.c | 3 +-- drivers/net/wireless/ath/ath11k/dp_rx.h | 3 +++ drivers/net/wireless/ath/ath11k/mac.c | 15 +++++++++++---- 3 files changed, 15 insertions(+), 6 deletions(-)
drivers/net/wireless/ath/ath11k/dp_rx.c +1 -2
@@ -1852,8 +1852,7 @@ static void ath11k_dp_rx_h_csum_offload(struct sk_buff *msdu) CHECKSUM_NONE :CHECKSUM_UNNECESSARY ; } -static int ath11k_dp_rx_crypto_mic_len (struct ath11k *ar, -enum hal_encrypt_type enctype) +int ath11k_dp_rx_crypto_mic_len (struct ath11k *ar,enum hal_encrypt_type enctype) {switch (enctype) {case HAL_ENCRYPT_TYPE_OPEN :
drivers/net/wireless/ath/ath11k/dp_rx.h +3 -0
@@ -1,6 +1,7 @@/* SPDX-License-Identifier: BSD-3-Clause-Clear */ /* * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved. +* Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved. */ #ifndef ATH11K_DP_RX_H #define ATH11K_DP_RX_H
@@ -95,4 +96,6 @@ int ath11k_peer_rx_frag_setup(struct ath11k *ar, const u8 *peer_mac, int vdev_idint ath11k_dp_rx_pktlog_start (struct ath11k_base *ab);int ath11k_dp_rx_pktlog_stop (struct ath11k_base *ab,bool stop_timer); +int ath11k_dp_rx_crypto_mic_len (struct ath11k *ar,enum hal_encrypt_type enctype); +#endif /* ATH11K_DP_RX_H */
drivers/net/wireless/ath/ath11k/mac.c +11 -4
@@ -2410,6 +2410,7 @@ static int ath11k_install_key(struct ath11k_vif *arvif,switch (key->cipher) {case WLAN_CIPHER_SUITE_CCMP : +case WLAN_CIPHER_SUITE_CCMP_256 : arg.key_cipher =WMI_CIPHER_AES_CCM ;/* TODO: Re-check if flag is valid */ key->flags |=IEEE80211_KEY_FLAG_GENERATE_IV_MGMT ;
@@ -2419,12 +2420,10 @@ static int ath11k_install_key(struct ath11k_vif *arvif, arg.key_txmic_len =8 ; arg.key_rxmic_len =8 ;break ; -case WLAN_CIPHER_SUITE_CCMP_256 : - arg.key_cipher =WMI_CIPHER_AES_CCM ; -break ;case WLAN_CIPHER_SUITE_GCMP :case WLAN_CIPHER_SUITE_GCMP_256 : arg.key_cipher =WMI_CIPHER_AES_GCM ; + key->flags |=IEEE80211_KEY_FLAG_GENERATE_IV_MGMT ;break ;default :ath11k_warn (ar->ab,"cipher %d is not supported\n" , key->cipher);
@@ -3946,7 +3945,10 @@ static int ath11k_mac_mgmt_tx_wmi(struct ath11k *ar, struct ath11k_vif *arvif, {struct ath11k_base *ab = ar->ab;struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; +struct ath11k_skb_cb *skb_cb =ATH11K_SKB_CB (skb);struct ieee80211_tx_info *info; +enum hal_encrypt_type enctype; +unsigned int mic_len;dma_addr_t paddr;int buf_id;int ret;
@@ -3966,7 +3968,12 @@ static int ath11k_mac_mgmt_tx_wmi(struct ath11k *ar, struct ath11k_vif *arvif, ieee80211_is_deauth(hdr->frame_control) || ieee80211_is_disassoc(hdr->frame_control)) && ieee80211_has_protected(hdr->frame_control)) { -skb_put (skb,IEEE80211_CCMP_MIC_LEN ); +if (!(skb_cb->flags &ATH11K_SKB_CIPHER_SET )) +ath11k_warn (ab,"WMI management tx frame without ATH11K_SKB_CIPHER_SET" ); + + enctype =ath11k_dp_tx_get_encrypt_type (skb_cb->cipher); + mic_len =ath11k_dp_rx_crypto_mic_len (ar, enctype); +skb_put (skb, mic_len); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/352 wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit 9ee0d44f055276fe2802b2f65058e920853f4f99 ]
rates_996 is mistakenly written as rates_969, fix it.
--- net/wireless/util.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/wireless/util.c +2 -2
@@ -1334,7 +1334,7 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate) 2048, /* 1.000000... */ };u32 rates_160M[3 ] = {960777777 ,907400000 ,816666666 }; -u32 rates_969[3 ] = {480388888 ,453700000 ,408333333 }; +u32 rates_996[3 ] = {480388888 ,453700000 ,408333333 };u32 rates_484[3 ] = {229411111 ,216666666 ,195000000 };u32 rates_242[3 ] = {114711111 ,108333333 ,97500000 };u32 rates_106[3 ] = {40000000 ,37777777 ,34000000 };
@@ -1359,7 +1359,7 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate)else if (rate->bw ==RATE_INFO_BW_80 || (rate->bw ==RATE_INFO_BW_HE_RU && rate->he_ru_alloc ==NL80211_RATE_INFO_HE_RU_ALLOC_996 )) - result = rates_969[rate->he_gi]; + result = rates_996[rate->he_gi];else if (rate->bw ==RATE_INFO_BW_40 || (rate->bw ==RATE_INFO_BW_HE_RU && rate->he_ru_alloc ==NL80211_RATE_INFO_HE_RU_ALLOC_484 ))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/352 wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit bcbd771cd5d68c0c52567556097d75f9fc4e7cd6 ]
Currently NL80211_RATE_INFO_HE_RU_ALLOC_2x996 is not handled in cfg80211_calculate_bitrate_he(), leading to below warning:
kernel: invalid HE MCS: bw:6, ru:6
kernel: WARNING: CPU: 0 PID: 2312 at net/wireless/util.c:1501 cfg80211_calculate_bitrate_he+0x22b/0x270 [cfg80211]
Fix it by handling 2x996 RU allocation in the same way as 160 MHz bandwidth.
--- net/wireless/util.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/wireless/util.c +3 -1
@@ -1354,7 +1354,9 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate)if (WARN_ON_ONCE (rate->nss <1 || rate->nss >8 ))return 0 ; -if (rate->bw ==RATE_INFO_BW_160 ) +if (rate->bw ==RATE_INFO_BW_160 || + (rate->bw ==RATE_INFO_BW_HE_RU && + rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_2x996)) result = rates_160M[rate->he_gi]; else if (rate->bw == RATE_INFO_BW_80 || (rate->bw == RATE_INFO_BW_HE_RU &&
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/352 net: fec: Refactor: #define magic constants
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Csókás Bence <[email protected]>
[ Upstream commit ff049886671ccd4e624a30ec464cb20e4c39a313 ]
Add defines for bits of ECR, RCR control registers, TX watermark etc.
Stable-dep-of: c32fe1986f27 ("net: fec: Fix FEC_ECR_EN1588 being cleared on link-down")
--- drivers/net/ethernet/freescale/fec_main.c | 46 +++++++++++++++-------- 1 file changed, 30 insertions(+), 16 deletions(-)
drivers/net/ethernet/freescale/fec_main.c +30 -16
@@ -220,8 +220,8 @@ MODULE_PARM_DESC(macaddr, "FEC Ethernet MAC address");#define PKT_MINBUF_SIZE 64/* FEC receive acceleration */ -#define FEC_RACC_IPDIS (1 << 1) -#define FEC_RACC_PRODIS (1 << 2) +#define FEC_RACC_IPDIS BIT(1) +#define FEC_RACC_PRODIS BIT(2)#define FEC_RACC_SHIFT16 BIT(7)#define FEC_RACC_OPTIONS (FEC_RACC_IPDIS | FEC_RACC_PRODIS)
@@ -253,8 +253,23 @@ MODULE_PARM_DESC(macaddr, "FEC Ethernet MAC address");#define FEC_MMFR_TA (2 << 16)#define FEC_MMFR_DATA (v) (v & 0xffff)/* FEC ECR bits definition */ -#define FEC_ECR_MAGICEN (1 << 2) -#define FEC_ECR_SLEEP (1 << 3) +#define FEC_ECR_RESET BIT(0) +#define FEC_ECR_ETHEREN BIT(1) +#define FEC_ECR_MAGICEN BIT(2) +#define FEC_ECR_SLEEP BIT(3) +#define FEC_ECR_EN1588 BIT(4) +#define FEC_ECR_BYTESWP BIT(8) +/* FEC RCR bits definition */ +#define FEC_RCR_LOOP BIT(0) +#define FEC_RCR_HALFDPX BIT(1) +#define FEC_RCR_MII BIT(2) +#define FEC_RCR_PROMISC BIT(3) +#define FEC_RCR_BC_REJ BIT(4) +#define FEC_RCR_FLOWCTL BIT(5) +#define FEC_RCR_RMII BIT(8) +#define FEC_RCR_10BASET BIT(9) +/* TX WMARK bits */ +#define FEC_TXWMRK_STRFWD BIT(8)#define FEC_MII_TIMEOUT 30000/* us */
@@ -949,7 +964,7 @@ fec_restart(struct net_device *ndev)u32 val;u32 temp_mac[2 ];u32 rcntl =OPT_FRAME_SIZE |0x04 ; -u32 ecntl =0x2 ;/* ETHEREN */ +u32 ecntl =FEC_ECR_ETHEREN ;/* Whack a reset. We should wait for this. * For i.MX6SX SOC, enet use AXI bus, we use disable MAC
@@ -1025,18 +1040,18 @@ fec_restart(struct net_device *ndev) fep->phy_interface == PHY_INTERFACE_MODE_RGMII_TXID) rcntl |= (1 <<6 ); else if (fep->phy_interface == PHY_INTERFACE_MODE_RMII) - rcntl |= (1 << 8); + rcntl |= FEC_RCR_RMII; else - rcntl &= ~(1 << 8); + rcntl &= ~FEC_RCR_RMII;/* 1G, 100M or 10M */ if (ndev->phydev) {if (ndev->phydev->speed ==SPEED_1000 ) ecntl |= (1 <<5 );else if (ndev->phydev->speed ==SPEED_100 ) - rcntl &= ~(1 <<9 ); + rcntl &= ~FEC_RCR_10BASET ;else - rcntl |= (1 <<9 ); + rcntl |=FEC_RCR_10BASET ; } }else {#ifdef FEC_MIIGSK_ENR
@@ -1095,13 +1110,13 @@ fec_restart(struct net_device *ndev)if (fep->quirks &FEC_QUIRK_ENET_MAC ) {/* enable ENET endian swap */ - ecntl |= (1 <<8 ); + ecntl |=FEC_ECR_BYTESWP ;/* enable ENET store and forward mode */ -writel (1 <<8 , fep->hwp +FEC_X_WMRK ); +writel (FEC_TXWMRK_STRFWD , fep->hwp +FEC_X_WMRK ); }if (fep->bufdesc_ex) - ecntl |= (1 <<4 ); + ecntl |=FEC_ECR_EN1588 ;#ifndef CONFIG_M5272 /* Enable the MIB statistic event counters */
@@ -1148,7 +1163,7 @@ static void fec_stop(struct net_device *ndev) {struct fec_enet_private *fep =netdev_priv (ndev); -u32 rmii_mode =readl (fep->hwp +FEC_R_CNTRL ) & (1 <<8 ); +u32 rmii_mode =readl (fep->hwp +FEC_R_CNTRL ) &FEC_RCR_RMII ;u32 val;/* We cannot expect a graceful transmit stop without link !!! */
@@ -1167,7 +1182,7 @@ fec_stop(struct net_device *ndev)if (fep->quirks &FEC_QUIRK_HAS_AVB ) {writel (0 , fep->hwp +FEC_ECNTRL ); }else { -writel (1 , fep->hwp +FEC_ECNTRL ); +writel (FEC_ECR_RESET , fep->hwp +FEC_ECNTRL );udelay (10 ); }writel (FEC_DEFAULT_IMASK , fep->hwp +FEC_IMASK );
@@ -1183,12 +1198,11 @@ fec_stop(struct net_device *ndev)/* We have to keep ENET enabled to have MII interrupt stay working */ if (fep->quirks &FEC_QUIRK_ENET_MAC && !(fep->wol_flag &FEC_WOL_FLAG_SLEEP_ON )) { -writel (2 , fep->hwp +FEC_ECNTRL ); +writel (FEC_ECR_ETHEREN , fep->hwp +FEC_ECNTRL );writel (rmii_mode, fep->hwp +FEC_R_CNTRL ); } } -static void fec_timeout (struct net_device *ndev,unsigned int txqueue) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/352 net: fec: Fix FEC_ECR_EN1588 being cleared on link-down
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Csókás, Bence <[email protected]>
[ Upstream commit c32fe1986f27cac329767d3497986e306cad1d5e ]
FEC_ECR_EN1588 bit gets cleared after MAC reset in fec_stop(), which makes all 1588 functionality shut down, and all the extended registers disappear, on link-down, making the adapter fall back to compatibility "dumb mode". However, some functionality needs to be retained (e.g. PPS) even without link.
--- drivers/net/ethernet/freescale/fec_main.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/ethernet/freescale/fec_main.c +6 -0
@@ -1201,6 +1201,12 @@ fec_stop(struct net_device *ndev)writel (FEC_ECR_ETHEREN , fep->hwp +FEC_ECNTRL );writel (rmii_mode, fep->hwp +FEC_R_CNTRL ); } + +if (fep->bufdesc_ex) { + val =readl (fep->hwp +FEC_ECNTRL ); + val |=FEC_ECR_EN1588 ; +writel (val, fep->hwp +FEC_ECNTRL ); + } } static void
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/352 ipvs: Avoid unnecessary calls to skb_is_gso_sctp
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ismael Luceno <[email protected]>
[ Upstream commit 53796b03295cf7ab1fc8600016fa6dfbf4a494a0 ]
In the context of the SCTP SNAT/DNAT handler, these calls can only return true.
--- net/netfilter/ipvs/ip_vs_proto_sctp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/netfilter/ipvs/ip_vs_proto_sctp.c +2 -2
@@ -126,7 +126,7 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,if (sctph->source != cp->vport || payload_csum || skb->ip_summed ==CHECKSUM_PARTIAL ) { sctph->source = cp->vport; -if (!skb_is_gso (skb) || !skb_is_gso_sctp (skb)) +if (!skb_is_gso (skb))sctp_nat_csum (skb, sctph, sctphoff); }else { skb->ip_summed =CHECKSUM_UNNECESSARY ;
@@ -175,7 +175,7 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, (skb->ip_summed == CHECKSUM_PARTIAL && !(skb_dst(skb)->dev->features & NETIF_F_SCTP_CRC))) { sctph->dest = cp->dport; -if (!skb_is_gso (skb) || !skb_is_gso_sctp (skb)) +if (!skb_is_gso (skb))sctp_nat_csum (skb, sctph, sctphoff); } else if (skb->ip_summed != CHECKSUM_PARTIAL) { skb->ip_summed =CHECKSUM_UNNECESSARY ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/352 netfilter: nf_tables: rise cap on SELinux secmark context
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit e29630247be24c3987e2b048f8e152771b32d38b ]
secmark context is artificially limited 256 bytes, rise it to 4Kbytes.
--- include/uapi/linux/netfilter/nf_tables.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/netfilter/nf_tables.h +1 -1
@@ -1284,7 +1284,7 @@ enum nft_secmark_attributes {#define NFTA_SECMARK_MAX (__NFTA_SECMARK_MAX - 1)/* Max security context length */ -#define NFT_SECMARK_CTX_MAXLEN 256 +#define NFT_SECMARK_CTX_MAXLEN 4096/** * enum nft_reject_types - nf_tables reject expression reject types
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/352 perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit 3520b251dcae2b4a27b95cd6f745c54fd658bda5 ]
Currently, perf allocates an array of page pointers which is limited in size by MAX_PAGE_ORDER. That in turn limits the maximum Intel PT buffer size to 2GiB. Should that limitation be lifted, the Intel PT driver can support larger sizes, except for one calculation in pt_topa_entry_for_page(), which is limited to 32-bits.
Fix pt_topa_entry_for_page() address calculation by adding a cast.
--- arch/x86/events/intel/pt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/events/intel/pt.c +1 -1
@@ -973,7 +973,7 @@ pt_topa_entry_for_page(struct pt_buffer *buf, unsigned int pg)* order allocations, there shouldn't be many of these. */ list_for_each_entry (topa, &buf->tables, list) { -if (topa->offset + topa->size > pg <<PAGE_SHIFT ) +if (topa->offset + topa->size > (unsigned long )pg <<PAGE_SHIFT ) goto found; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/352 perf: Fix perf_aux_size() for greater-than 32-bit size
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit 3df94a5b1078dfe2b0c03f027d018800faf44c82 ]
perf_buffer->aux_nr_pages uses a 32-bit type, so a cast is needed to calculate a 64-bit size.
--- kernel/events/internal.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/internal.h +1 -1
@@ -128,7 +128,7 @@ static inline unsigned long perf_data_size(struct perf_buffer *rb)static inline unsigned long perf_aux_size (struct perf_buffer *rb) { -return rb->aux_nr_pages <<PAGE_SHIFT ; +return (unsigned long )rb->aux_nr_pages <<PAGE_SHIFT ; }#define __DEFINE_OUTPUT_COPY_BODY (advance_buf, memcpy_func, ...) \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/352 perf: Prevent passing zero nr_pages to rb_alloc_aux()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit dbc48c8f41c208082cfa95e973560134489e3309 ]
nr_pages is unsigned long but gets passed to rb_alloc_aux() as an int, and is stored as an int.
Only power-of-2 values are accepted, so if nr_pages is a 64_bit value, it will be passed to rb_alloc_aux() as zero.
That is not ideal because:
1. the value is incorrect
2. rb_alloc_aux() is at risk of misbehaving, although it manages to return -ENOMEM in that case, it is a result of passing zero to get_order() even though the get_order() result is documented to be undefined in that case.
Fix by simply validating the maximum supported value in the first place. Use -ENOMEM error code for consistency with the current error code that is returned in that case.
--- kernel/events/core.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/events/core.c +2 -0
@@ -6239,6 +6239,8 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma)return -EINVAL ; nr_pages = vma_size /PAGE_SIZE ; +if (nr_pages >INT_MAX ) +return -ENOMEM ;mutex_lock (&event->mmap_mutex); ret = -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/352 qed: Improve the stack space of filter_config()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shai Malin <[email protected]>
[ Upstream commit f55e36d5ab76c3097ff36ecea60b91c6b0d80fc8 ]
As it was reported and discussed in: https://lore.kernel.org/lkml/CAHk-=whF9F89vsfH8E9TGc0tZA-yhzi2Di8wOtquNB5vRkFX5w@mail.gmail.com/
This patch improves the stack space of qede_config_rx_mode() by
splitting filter_config() to 3 functions and removing the
union qed_filter_type_params.
Stable-dep-of: b5d14b0c6716 ("wifi: virt_wifi: avoid reporting connection success with wrong SSID")
--- drivers/net/ethernet/qlogic/qed/qed_l2.c | 23 ++------- .../net/ethernet/qlogic/qede/qede_filter.c | 47 ++++++++----------- include/linux/qed/qed_eth_if.h | 21 ++++----- 3 files changed, 30 insertions(+), 61 deletions(-)
drivers/net/ethernet/qlogic/qed/qed_l2.c +3 -20
@@ -2762,25 +2762,6 @@ static int qed_configure_filter_mcast(struct qed_dev *cdev,return qed_filter_mcast_cmd (cdev, &mcast,QED_SPQ_MODE_CB ,NULL ); } -static int qed_configure_filter (struct qed_dev *cdev, -struct qed_filter_params *params) -{ -enum qed_filter_rx_mode_type accept_flags; - -switch (params->type) { -case QED_FILTER_TYPE_UCAST : -return qed_configure_filter_ucast (cdev, ¶ms->filter.ucast); -case QED_FILTER_TYPE_MCAST : -return qed_configure_filter_mcast (cdev, ¶ms->filter.mcast); -case QED_FILTER_TYPE_RX_MODE : - accept_flags = params->filter.accept_flags; -return qed_configure_filter_rx_mode (cdev, accept_flags); -default : -DP_NOTICE (cdev,"Unknown filter type %d\n" , (int )params->type); -return -EINVAL ; - } -} -static int qed_configure_arfs_searcher (struct qed_dev *cdev,enum qed_filter_config_mode mode) {
@@ -2903,7 +2884,9 @@ static const struct qed_eth_ops qed_eth_ops_pass = { .q_rx_stop = &qed_stop_rxq, .q_tx_start = &qed_start_txq, .q_tx_stop = &qed_stop_txq, - .filter_config = &qed_configure_filter, + .filter_config_rx_mode = &qed_configure_filter_rx_mode, + .filter_config_ucast = &qed_configure_filter_ucast, + .filter_config_mcast = &qed_configure_filter_mcast, .fastpath_stop = &qed_fastpath_stop, .eth_cqe_completion = &qed_fp_cqe_completion, .get_vport_stats = &qed_get_vport_stats,
drivers/net/ethernet/qlogic/qede/qede_filter.c +19 -28
92 lines not on this page · raw message
include/linux/qed/qed_eth_if.h +8 -13
@@ -145,12 +145,6 @@ struct qed_filter_mcast_params {unsigned char mac[64 ][ETH_ALEN ]; }; -union qed_filter_type_params { -enum qed_filter_rx_mode_type accept_flags; -struct qed_filter_ucast_params ucast; -struct qed_filter_mcast_params mcast; -}; -enum qed_filter_type {QED_FILTER_TYPE_UCAST ,QED_FILTER_TYPE_MCAST ,
@@ -158,11 +152,6 @@ enum qed_filter_type { QED_MAX_FILTER_TYPES, }; -struct qed_filter_params { -enum qed_filter_type type; -union qed_filter_type_params filter; -}; -struct qed_tunn_params {u16 vxlan_port;u8 update_vxlan_port;
@@ -314,8 +303,14 @@ struct qed_eth_ops {int (*q_tx_stop)(struct qed_dev *cdev,u8 rss_id,void *handle); -int (*filter_config)(struct qed_dev *cdev, -struct qed_filter_params *params); +int (*filter_config_rx_mode)(struct qed_dev *cdev, +enum qed_filter_rx_mode_type type); + +int (*filter_config_ucast)(struct qed_dev *cdev, +struct qed_filter_ucast_params *params); + +int (*filter_config_mcast)(struct qed_dev *cdev, +struct qed_filter_mcast_params *params);int (*fastpath_stop)(struct qed_dev *cdev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/352 wifi: virt_wifi: avoid reporting connection success with wrong SSID
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: En-Wei Wu <[email protected]>
[ Upstream commit b5d14b0c6716fad7f0c94ac6e1d6f60a49f985c7 ]
When user issues a connection with a different SSID than the one virt_wifi has advertised, the __cfg80211_connect_result() will trigger the warning: WARN_ON(bss_not_found).
The issue is because the connection code in virt_wifi does not check the SSID from user space (it only checks the BSSID), and virt_wifi will call cfg80211_connect_result() with WLAN_STATUS_SUCCESS even if the SSID is different from the one virt_wifi has advertised. Eventually cfg80211 won't be able to find the cfg80211_bss and generate the warning.
Fixed it by checking the SSID (from user space) in the connection code.
--- drivers/net/wireless/virt_wifi.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
drivers/net/wireless/virt_wifi.c +16 -3
@@ -136,6 +136,8 @@ static struct ieee80211_supported_band band_5ghz = {/* Assigned at module init. Guaranteed locally-administered and unicast. */ static u8 fake_router_bssid[ETH_ALEN ]__ro_after_init = {}; +#define VIRT_WIFI_SSID "VirtWifi" +static void virt_wifi_inform_bss (struct wiphy *wiphy) {u64 tsf =div_u64 (ktime_get_boottime_ns (),1000 );
@@ -146,8 +148,8 @@ static void virt_wifi_inform_bss(struct wiphy *wiphy)u8 ssid[8 ]; }__packed ssid = { .tag =WLAN_EID_SSID , - .len =8 , - .ssid ="VirtWifi" , + .len =strlen (VIRT_WIFI_SSID ), + .ssid =VIRT_WIFI_SSID , }; informed_bss = cfg80211_inform_bss(wiphy, &channel_5ghz,
@@ -213,6 +215,8 @@ struct virt_wifi_netdev_priv {struct net_device *upperdev;u32 tx_packets;u32 tx_failed; +u32 connect_requested_ssid_len; +u8 connect_requested_ssid[IEEE80211_MAX_SSID_LEN ];u8 connect_requested_bss[ETH_ALEN ];bool is_up;bool is_connected;
@@ -229,6 +233,12 @@ static int virt_wifi_connect(struct wiphy *wiphy, struct net_device *netdev,if (priv->being_deleted || !priv->is_up)return -EBUSY ; +if (!sme->ssid) +return -EINVAL ; + + priv->connect_requested_ssid_len = sme->ssid_len; +memcpy (priv->connect_requested_ssid, sme->ssid, sme->ssid_len); + could_schedule =schedule_delayed_work (&priv->connect,HZ *2 );if (!could_schedule)return -EBUSY ;
@@ -252,12 +262,15 @@ static void virt_wifi_connect_complete(struct work_struct *work) container_of(work, struct virt_wifi_netdev_priv, connect.work);u8 *requested_bss = priv->connect_requested_bss;bool right_addr =ether_addr_equal (requested_bss, fake_router_bssid); +bool right_ssid = priv->connect_requested_ssid_len ==strlen (VIRT_WIFI_SSID ) && + !memcmp (priv->connect_requested_ssid,VIRT_WIFI_SSID , + priv->connect_requested_ssid_len);u16 status =WLAN_STATUS_SUCCESS ;if (is_zero_ether_addr (requested_bss)) requested_bss =NULL ; -if (!priv->is_up || (requested_bss && !right_addr)) +if (!priv->is_up || (requested_bss && !right_addr) || !right_ssid) status =WLAN_STATUS_UNSPECIFIED_FAILURE ;else priv->is_connected = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/352 gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaosheng Cui <[email protected]>
[ Upstream commit a3123341dc358952ce2bf8067fbdfb7eaadf71bb ]
If we fail to call crypto_sync_skcipher_setkey, we should free the memory allocation for cipher, replace err_return with err_free_cipher to free the memory of cipher.
--- net/sunrpc/auth_gss/gss_krb5_keys.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sunrpc/auth_gss/gss_krb5_keys.c +1 -1
@@ -161,7 +161,7 @@ u32 krb5_derive_key(const struct gss_krb5_enctype *gk5e,if (IS_ERR (cipher)) goto err_return;if (crypto_sync_skcipher_setkey (cipher, inkey->data, inkey->len)) - goto err_return; + goto err_free_cipher;/* allocate and set up buffers */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/352 wifi: virt_wifi: dont use strlen() in const context
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 6e909f489191b365364e9d636dec33b5dfd4e5eb ]
Looks like not all compilers allow strlen(constant) as a constant, so don't do that. Instead, revert back to defining the length as the first submission had it.
--- drivers/net/wireless/virt_wifi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/virt_wifi.c +3 -2
@@ -137,6 +137,7 @@ static struct ieee80211_supported_band band_5ghz = {static u8 fake_router_bssid[ETH_ALEN ]__ro_after_init = {};#define VIRT_WIFI_SSID "VirtWifi" +#define VIRT_WIFI_SSID_LEN 8static void virt_wifi_inform_bss (struct wiphy *wiphy) {
@@ -148,7 +149,7 @@ static void virt_wifi_inform_bss(struct wiphy *wiphy)u8 ssid[8 ]; }__packed ssid = { .tag =WLAN_EID_SSID , - .len =strlen (VIRT_WIFI_SSID ), + .len =VIRT_WIFI_SSID_LEN , .ssid =VIRT_WIFI_SSID , };
@@ -262,7 +263,7 @@ static void virt_wifi_connect_complete(struct work_struct *work) container_of(work, struct virt_wifi_netdev_priv, connect.work);u8 *requested_bss = priv->connect_requested_bss;bool right_addr =ether_addr_equal (requested_bss, fake_router_bssid); -bool right_ssid = priv->connect_requested_ssid_len ==strlen (VIRT_WIFI_SSID ) && +bool right_ssid = priv->connect_requested_ssid_len ==VIRT_WIFI_SSID_LEN && !memcmp (priv->connect_requested_ssid,VIRT_WIFI_SSID , priv->connect_requested_ssid_len);u16 status =WLAN_STATUS_SUCCESS ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/352 selftests/bpf: Close fd in error path in drop_on_reuseport
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
[ Upstream commit adae187ebedcd95d02f045bc37dfecfd5b29434b ]
In the error path when update_lookup_map() fails in drop_on_reuseport in prog_tests/sk_lookup.c, "server1", the fd of server 1, should be closed. This patch fixes this by using "goto close_srv1" lable instead of "detach" to close "server1" in this case.
--- tools/testing/selftests/bpf/prog_tests/sk_lookup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/prog_tests/sk_lookup.c +1 -1
@@ -964,7 +964,7 @@ static void drop_on_reuseport(const struct test *t) err =update_lookup_map (t->sock_map,SERVER_A , server1);if (err) - goto detach; + goto close_srv1;/* second server on destination address we should never reach */ server2 = make_server(t->sotype, t->connect_to.ip, t->connect_to.port,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/352 bpf: annotate BTF show functions with __printf
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Maguire <[email protected]>
[ Upstream commit b3470da314fd8018ee237e382000c4154a942420 ]
-Werror=suggest-attribute=format warns about two functions in kernel/bpf/btf.c [1]; add __printf() annotations to silence these warnings since for CONFIG_WERROR=y they will trigger build failures.
[1] https://lore.kernel.org/bpf/[email protected]/
--- kernel/bpf/btf.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
kernel/bpf/btf.c +4 -4
@@ -5344,8 +5344,8 @@ static void btf_type_show(const struct btf *btf, u32 type_id, void *obj,btf_type_ops (t)->show (btf, t, type_id, obj,0 , show); } -static void btf_seq_show (struct btf_show *show,const char *fmt, -va_list args) +__printf(2, 0) static void btf_seq_show(struct btf_show *show, const char *fmt, +va_list args) {seq_vprintf ((struct seq_file *)show->target, fmt, args); }
@@ -5378,8 +5378,8 @@ struct btf_show_snprintf {int len;/* length we would have written */ }; -static void btf_snprintf_show (struct btf_show *show,const char *fmt, -va_list args) +__printf(2, 0) static void btf_snprintf_show(struct btf_show *show, const char *fmt, +va_list args) {struct btf_show_snprintf *ssnprintf = (struct btf_show_snprintf *)show;int len;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/352 bna: adjust name buf size of bna_tcb and bna_ccb structures
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Kodanev <[email protected]>
[ Upstream commit c9741a03dc8e491e57b95fba0058ab46b7e506da ]
To have enough space to write all possible sprintf() args. Currently 'name' size is 16, but the first '%s' specifier may already need at least 16 characters, since 'bnad->netdev->name' is used there.
For '%d' specifiers, assume that they require:
* 1 char for 'tx_id + tx_info->tcb[i]->id' sum, BNAD_MAX_TXQ_PER_TX is 8
* 2 chars for 'rx_id + rx_info->rx_ctrl[i].ccb->id', BNAD_MAX_RXP_PER_RX is 16
And replace sprintf with snprintf.
Detected using the static analysis tool - Svace.
--- drivers/net/ethernet/brocade/bna/bna_types.h | 2 +- drivers/net/ethernet/brocade/bna/bnad.c | 11 ++++++----- 2 files changed, 7 insertions(+), 6 deletions(-)
drivers/net/ethernet/brocade/bna/bna_types.h +1 -1
@@ -410,7 +410,7 @@ struct bna_ib {/* Tx object */ /* Tx datapath control structure */ -#define BNA_Q_NAME_SIZE 16 +#define BNA_Q_NAME_SIZE (IFNAMSIZ + 6)struct bna_tcb {/* Fast path */ void **sw_qpt;
drivers/net/ethernet/brocade/bna/bnad.c +6 -5
@@ -1535,8 +1535,9 @@ bnad_tx_msix_register(struct bnad *bnad, struct bnad_tx_info *tx_info,for (i =0 ; i < num_txqs; i++) { vector_num = tx_info->tcb[i]->intr_vector; -sprintf (tx_info->tcb[i]->name,"%s TXQ %d" , bnad->netdev->name, - tx_id + tx_info->tcb[i]->id); +snprintf (tx_info->tcb[i]->name,BNA_Q_NAME_SIZE ,"%s TXQ %d" , + bnad->netdev->name, + tx_id + tx_info->tcb[i]->id); err = request_irq(bnad->msix_table[vector_num].vector, (irq_handler_t)bnad_msix_tx, 0, tx_info->tcb[i]->name,
@@ -1586,9 +1587,9 @@ bnad_rx_msix_register(struct bnad *bnad, struct bnad_rx_info *rx_info,for (i =0 ; i < num_rxps; i++) { vector_num = rx_info->rx_ctrl[i].ccb->intr_vector; -sprintf (rx_info->rx_ctrl[i].ccb->name,"%s CQ %d" , - bnad->netdev->name, - rx_id + rx_info->rx_ctrl[i].ccb->id); +snprintf (rx_info->rx_ctrl[i].ccb->name,BNA_Q_NAME_SIZE , +"%s CQ %d" , bnad->netdev->name, + rx_id + rx_info->rx_ctrl[i].ccb->id); err = request_irq(bnad->msix_table[vector_num].vector, (irq_handler_t)bnad_msix_rx, 0, rx_info->rx_ctrl[i].ccb->name,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/352 bpf: Eliminate remaining "make W=1" warnings in kernel/bpf/btf.o
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Maguire <[email protected]>
[ Upstream commit 2454075f8e2915cebbe52a1195631bc7efe2b7e1 ]
As reported by Mirsad [1] we still see format warnings in kernel/bpf/btf.o at W=1 warning level:
CC kernel/bpf/btf.o./kernel/bpf/btf.c: In function ‘btf_type_seq_show_flags’:./kernel/bpf/btf.c:7553:21: warning: assignment left-hand side might be a candidate for a format attribute [-Wsuggest-attribute=format]
7553 | sseq.showfn = btf_seq_show;
| ^./kernel/bpf/btf.c: In function ‘btf_type_snprintf_show’:./kernel/bpf/btf.c:7604:31: warning: assignment left-hand side might be a candidate for a format attribute [-Wsuggest-attribute=format]
7604 | ssnprintf.show.showfn = btf_snprintf_show;
| ^
Combined with CONFIG_WERROR=y these can halt the build.
The fix (annotating the structure field with __printf()) suggested by Mirsad resolves these. Apologies I missed this last time. No other W=1 warnings were observed in kernel/bpf after this fix.
[1] https://lore.kernel.org/bpf/[email protected]/
--- kernel/bpf/btf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/bpf/btf.c +1 -1
@@ -340,7 +340,7 @@ static const char *btf_type_str(const struct btf_type *t)struct btf_show {u64 flags;void *target;/* target of show operation (seq file, buffer) */ -void (*showfn)(struct btf_show *show,const char *fmt,va_list args); + __printf(2, 0) void (*showfn)(struct btf_show *show, const char *fmt, va_list args);const struct btf *btf;/* below are used during iteration */ struct {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/352 selftests: forwarding: devlink_lib: Wait for udev events after reloading
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Cohen <[email protected]>
[ Upstream commit f67a90a0c8f5b3d0acc18f10650d90fec44775f9 ]
Lately, an additional locking was added by commit c0a40097f0bc ("drivers: core: synchronize really_probe() and dev_uevent()"). The locking protects dev_uevent() calling. This function is used to send messages from the kernel to user space. Uevent messages notify user space about changes in device states, such as when a device is added, removed, or changed. These messages are used by udev (or other similar user-space tools) to apply device-specific rules.
After reloading devlink instance, udev events should be processed. This locking causes a short delay of udev events handling.
One example for useful udev rule is renaming ports. 'forwading.config' can be configured to use names after udev rules are applied. Some tests run devlink_reload() and immediately use the updated names. This worked before the above mentioned commit was pushed, but now the delay of uevent messages causes that devlink_reload() returns before udev events are handled and tests fail.
Adjust devlink_reload() to not assume that udev events are already processed when devlink reload is done, instead, wait for udev events to ensure they are processed before returning from the function.
Without this patch:
TESTS='rif_mac_profile' ./resource_scale.sh
TEST: 'rif_mac_profile' 4 [ OK ]
sysctl: cannot stat /proc/sys/net/ipv6/conf/swp1/disable_ipv6: No such file or directory
sysctl: cannot stat /proc/sys/net/ipv6/conf/swp1/disable_ipv6: No such file or directory
sysctl: cannot stat /proc/sys/net/ipv6/conf/swp2/disable_ipv6: No such file or directory
sysctl: cannot stat /proc/sys/net/ipv6/conf/swp2/disable_ipv6: No such file or directory Cannot find device "swp1"
Cannot find device "swp2"
TEST: setup_wait_dev (: Interface swp1 does not come up.) [FAIL]
With this patch:
$ TESTS='rif_mac_profile' ./resource_scale.sh TEST: 'rif_mac_profile' 4 [ OK ] TEST: 'rif_mac_profile' overflow 5 [ OK ]
This is relevant not only for this test.
--- tools/testing/selftests/net/forwarding/devlink_lib.sh | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/net/forwarding/devlink_lib.sh +2 -0
@@ -113,6 +113,8 @@ devlink_reload() still_pending=$(devlink resource show "$DEVLINK_DEV" | \ grep -c "size_new") check_err $still_pending "Failed reload - There are still unset sizes" + + udevadm settle } declare -A DEVLINK_ORIG
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/352 xdp: fix invalid wait context of page_pool_destroy()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <[email protected]>
[ Upstream commit 59a931c5b732ca5fc2ca727f5a72aeabaafa85ec ]
If the driver uses a page pool, it creates a page pool with page_pool_create().
The reference count of page pool is 1 as default.
A page pool will be destroyed only when a reference count reaches 0. page_pool_destroy() is used to destroy page pool, it decreases a reference count.
When a page pool is destroyed, ->disconnect() is called, which is mem_allocator_disconnect().
This function internally acquires mutex_lock().
If the driver uses XDP, it registers a memory model with xdp_rxq_info_reg_mem_model().
The xdp_rxq_info_reg_mem_model() internally increases a page pool reference count if a memory model is a page pool.
Now the reference count is 2.
To destroy a page pool, the driver should call both page_pool_destroy() and xdp_unreg_mem_model().
The xdp_unreg_mem_model() internally calls page_pool_destroy(). Only page_pool_destroy() decreases a reference count.
If a driver calls page_pool_destroy() then xdp_unreg_mem_model(), we will face an invalid wait context warning.
Because xdp_unreg_mem_model() calls page_pool_destroy() with rcu_read_lock().
The page_pool_destroy() internally acquires mutex_lock().
Splat looks like:
=============================
[ BUG: Invalid wait context ]
6.10.0-rc6+ #4 Tainted: G W
-----------------------------
ethtool/1806 is trying to lock:ffffffff90387b90 (mem_id_lock){+.+.}-{4:4}, at: mem_allocator_disconnect+0x73/0x150 other info that might help us debug this:
context-{5:5}
3 locks held by ethtool/1806:
stack backtrace: CPU: 0 PID: 1806 Comm: ethtool Tainted: G W 6.10.0-rc6+ #4 f916f41f172891c800f2fed Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 Call Trace: <TASK> dump_stack_lvl+0x7e/0xc0 __lock_acquire+0x1681/0x4de0 ? _printk+0x64/0xe0 ? __pfx_mark_lock.part.0+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 lock_acquire+0x1b3/0x580 ? mem_allocator_disconnect+0x73/0x150 ? __wake_up_klogd.part.0+0x16/0xc0 ? __pfx_lock_acquire+0x10/0x10 ? dump_stack_lvl+0x91/0xc0 __mutex_lock+0x15c/0x1690 ? mem_allocator_disconnect+0x73/0x150 ? __pfx_prb_read_valid+0x10/0x10 ? mem_allocator_disconnect+0x73/0x150 ? __pfx_llist_add_batch+0x10/0x10 ? console_unlock+0x193/0x1b0 ? lockdep_hardirqs_on+0xbe/0x140 ? __pfx___mutex_lock+0x10/0x10 ? tick_nohz_tick_stopped+0x16/0x90 ? __irq_work_queue_local+0x1e5/0x330 ? irq_work_queue+0x39/0x50 ? __wake_up_klogd.part.0+0x79/0xc0 ? mem_allocator_disconnect+0x73/0x150 mem_allocator_disconnect+0x73/0x150 ? __pfx_mem_allocator_disconnect+0x10/0x10 ? mark_held_locks+0xa5/0xf0 ? rcu_is_watching+0x11/0xb0 page_pool_release+0x36e/0x6d0 page_pool_destroy+0xd7/0x440 xdp_unreg_mem_model+0x1a7/0x2a0 ? __pfx_xdp_unreg_mem_model+0x10/0x10 ? kfree+0x125/0x370 ? bnxt_free_ring.isra.0+0x2eb/0x500 ? bnxt_free_mem+0x5ac/0x2500 xdp_rxq_info_unreg+0x4a/0xd0 bnxt_free_mem+0x1356/0x2500 bnxt_close_nic+0xf0/0x3b0 ? __pfx_bnxt_close_nic+0x10/0x10 ? ethnl_parse_bit+0x2c6/0x6d0 ? __pfx___nla_validate_parse+0x10/0x10 ? __pfx_ethnl_parse_bit+0x10/0x10 bnxt_set_features+0x2a8/0x3e0 __netdev_update_features+0x4dc/0x1370 ? ethnl_parse_bitset+0x4ff/0x750 ? __pfx_ethnl_parse_bitset+0x10/0x10 ? __pfx___netdev_update_features+0x10/0x10 ? mark_held_locks+0xa5/0xf0 ? _raw_spin_unlock_irqrestore+0x42/0x70 ? __pm_runtime_resume+0x7d/0x110 ethnl_set_features+0x32d/0xa20
To fix this problem, it uses rhashtable_lookup_fast() instead of rhashtable_lookup() with rcu_read_lock().
Using xa without rcu_read_lock() here is safe.
xa is freed by __xdp_mem_allocator_rcu_free() and this is called by call_rcu() of mem_xa_remove().
The mem_xa_remove() is called by page_pool_destroy() if a reference count reaches 0.
The xa is already protected by the reference count mechanism well in the control plane.
So removing rcu_read_lock() for page_pool_destroy() is safe.
--- net/core/xdp.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
net/core/xdp.c +1 -3
@@ -124,10 +124,8 @@ void xdp_unreg_mem_model(struct xdp_mem_info *mem)return ;if (type ==MEM_TYPE_PAGE_POOL ) { -rcu_read_lock (); - xa =rhashtable_lookup (mem_id_ht, &id, mem_id_rht_params); + xa =rhashtable_lookup_fast (mem_id_ht, &id, mem_id_rht_params);page_pool_destroy (xa->page_pool); -rcu_read_unlock (); } }EXPORT_SYMBOL_GPL (xdp_unreg_mem_model);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/352 drm/panel: boe-tv101wum-nl6: If prepare fails, disable GPIO before regulators
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 587c48f622374e5d47b1d515c6006a4df4dee882 ]
The enable GPIO should clearly be set low before turning off regulators. That matches both the inverse order that things were enabled and also the order in unprepare().
--- drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c +1 -1
@@ -574,13 +574,13 @@ static int boe_panel_prepare(struct drm_panel *panel)return 0 ; poweroff: +gpiod_set_value (boe->enable_gpio,0 );regulator_disable (boe->avee); poweroffavdd:regulator_disable (boe->avdd); poweroff1v8:usleep_range (5000 ,7000 );regulator_disable (boe->pp1800); -gpiod_set_value (boe->enable_gpio,0 );return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/352 drm/panel: boe-tv101wum-nl6: Check for errors on the NOP in prepare()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 6320b9199dd99622668649c234d4e8a99e44a9c8 ]
The mipi_dsi_dcs_nop() function returns an error but we weren't checking it in boe_panel_prepare(). Add a check. This is highly unlikely to matter in practice. If the NOP failed then likely later MIPI commands would fail too.
Found by code inspection.
--- drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c +5 -1
@@ -553,7 +553,11 @@ static int boe_panel_prepare(struct drm_panel *panel)usleep_range (5000 ,10000 );if (boe->desc->lp11_before_reset) { -mipi_dsi_dcs_nop (boe->dsi); + ret =mipi_dsi_dcs_nop (boe->dsi); +if (ret <0 ) { +dev_err (&boe->dsi->dev,"Failed to send NOP: %d\n" , ret); + goto poweroff; + }usleep_range (1000 ,2000 ); }gpiod_set_value (boe->enable_gpio,1 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/352 media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
[ Upstream commit 2052138b7da52ad5ccaf74f736d00f39a1c9198c ]
Infinite log printing occurs during fuzz test:
rc rc1: DViCO FusionHDTV DVB-T USB (LGZ201) as ...
...
dvb-usb: schedule remote query interval to 100 msecs.
dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized ...
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
...
dvb-usb: bulk message failed: -22 (1/0)
Looking into the codes, there is a loop in dvb_usb_read_remote_control(), that is in rc_core_dvb_usb_remote_init() create a work that will call dvb_usb_read_remote_control(), and this work will reschedule itself at 'rc_interval' intervals to recursively call dvb_usb_read_remote_control(), see following code snippet:
rc_core_dvb_usb_remote_init() {
...
INIT_DELAYED_WORK(&d->rc_query_work, dvb_usb_read_remote_control);
schedule_delayed_work(&d->rc_query_work,
msecs_to_jiffies(rc_interval));
...
}
dvb_usb_read_remote_control() {
...
err = d->props.rc.core.rc_query(d);
if (err)
err(...) // Did not return even if query failed
schedule_delayed_work(&d->rc_query_work,
msecs_to_jiffies(rc_interval));
}When the infinite log printing occurs, the query callback 'd->props.rc.core.rc_query' is cxusb_rc_query(). And the log is due to the failure of finding a valid 'generic_bulk_ctrl_endpoint' in usb_bulk_msg(), see following code snippet:
cxusb_rc_query() {
cxusb_ctrl_msg() {
dvb_usb_generic_rw() {
ret = usb_bulk_msg(d->udev, usb_sndbulkpipe(d->udev,
d->props.generic_bulk_ctrl_endpoint),...);
if (ret)
err("bulk message failed: %d (%d/%d)",ret,wlen,actlen);
...
}
...
}By analyzing the corresponding USB descriptor, it shows that the bNumEndpoints is 0 in its interface descriptor, but
the 'generic_bulk_ctrl_endpoint' is 1, that means user don't configure a valid endpoint for 'generic_bulk_ctrl_endpoint', therefore this 'invalid' USB device should be rejected before it calls into dvb_usb_read_remote_control().
To fix it, we need to add endpoint check for 'generic_bulk_ctrl_endpoint'. And as Sean suggested, the same check and clear halts should be done for 'generic_bulk_ctrl_endpoint_response'. So introduce dvb_usb_check_bulk_endpoint() to do it for both of them.
--- drivers/media/usb/dvb-usb/dvb-usb-init.c | 35 +++++++++++++++++++++--- 1 file changed, 31 insertions(+), 4 deletions(-)
drivers/media/usb/dvb-usb/dvb-usb-init.c +31 -4
@@ -23,11 +23,40 @@ static int dvb_usb_force_pid_filter_usage;module_param_named (force_pid_filter_usage, dvb_usb_force_pid_filter_usage, int,0444 );MODULE_PARM_DESC (force_pid_filter_usage,"force all dvb-usb-devices to use a PID filter, if any (default: 0)." ); +static int dvb_usb_check_bulk_endpoint (struct dvb_usb_device *d,u8 endpoint) +{ +if (endpoint) { +int ret; + + ret =usb_pipe_type_check (d->udev,usb_sndbulkpipe (d->udev, endpoint)); +if (ret) +return ret; + ret =usb_pipe_type_check (d->udev,usb_rcvbulkpipe (d->udev, endpoint)); +if (ret) +return ret; + } +return 0 ; +} + +static void dvb_usb_clear_halt (struct dvb_usb_device *d,u8 endpoint) +{ +if (endpoint) { +usb_clear_halt (d->udev,usb_sndbulkpipe (d->udev, endpoint)); +usb_clear_halt (d->udev,usb_rcvbulkpipe (d->udev, endpoint)); + } +} +static int dvb_usb_adapter_init (struct dvb_usb_device *d,short *adapter_nrs) {struct dvb_usb_adapter *adap;int ret, n, o; + ret =dvb_usb_check_bulk_endpoint (d, d->props.generic_bulk_ctrl_endpoint); +if (ret) +return ret; + ret =dvb_usb_check_bulk_endpoint (d, d->props.generic_bulk_ctrl_endpoint_response); +if (ret) +return ret;for (n =0 ; n < d->props.num_adapters; n++) { adap = &d->adapter[n]; adap->dev = d;
@@ -103,10 +132,8 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs)* when reloading the driver w/o replugging the device * sometimes a timeout occurs, this helps */ -if (d->props.generic_bulk_ctrl_endpoint !=0 ) { -usb_clear_halt (d->udev,usb_sndbulkpipe (d->udev, d->props.generic_bulk_ctrl_endpoint)); -usb_clear_halt (d->udev,usb_rcvbulkpipe (d->udev, d->props.generic_bulk_ctrl_endpoint)); - } +dvb_usb_clear_halt (d, d->props.generic_bulk_ctrl_endpoint); +dvb_usb_clear_halt (d, d->props.generic_bulk_ctrl_endpoint_response);return 0 ;
Signature · 1 line
2.43.0
Re: [PATCH 5.10 068/352] media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
Quoted 20 lines · Greg Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
[ Upstream commit
2052138b7da52ad5ccaf74f736d00f39a1c9198c]Infinite log printing occurs during fuzz test:
rc rc1: DViCO FusionHDTV DVB-T USB (LGZ201) as ...
...
dvb-usb: schedule remote query interval to 100 msecs.
dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized ...
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
...
dvb-usb: bulk message failed: -22 (1/0)
Quoted 5 lines
Looking into the codes, there is a loop in
dvb_usb_read_remote_control(), that is inrc_core_dvb_usb_remote_init()create a work that will calldvb_usb_read_remote_control(), and this work will reschedule itself at 'rc_interval' intervals to recursively calldvb_usb_read_remote_control(), see following code snippet:
This commit causes problems and has been reverted upstream.
https://git.linuxtv.org/media_stage.git/commit/?h=fixes&id=0c84bde4f37ba27d50e4c70ecacd33fe4a57030d
Please don't apply.
Thanks,
Sean
Greg Kroah-Hartman
maintainerPATCH 69/352 media: imon: Fix race getting ictx->lock
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 24147897507cd3a7d63745d1518a638bf4132238 ]
Lets fix a race between mutex_is_lock() and mutex_lock().
<-mutex is not locked
if (!mutex_is_locked(&ictx->lock)) {
unlock = true; <- mutex is locked externaly
mutex_lock(&ictx->lock);
}Let's use mutex_trylock() that does mutex_is_lock() and mutex_lock() atomically.
Fix the following cocci warning:
drivers/media/rc/imon.c:1167:1-7: preceding lock on line 1153
--- drivers/media/rc/imon.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/media/rc/imon.c +1 -4
@@ -1153,10 +1153,7 @@ static int imon_ir_change_protocol(struct rc_dev *rc, u64 *rc_proto)memcpy (ictx->usb_tx_buf, &ir_proto_packet,sizeof (ir_proto_packet)); -if (!mutex_is_locked (&ictx->lock)) { - unlock = true; -mutex_lock (&ictx->lock); - } + unlock =mutex_trylock (&ictx->lock); retval =send_packet (ictx);if (retval)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/352 KVM: s390: pv: avoid stalls when making pages secure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudio Imbrenda <[email protected]>
[ Upstream commit f0a1a0615a6ff6d38af2c65a522698fb4bb85df6 ]
Improve make_secure_pte to avoid stalls when the system is heavily overcommitted. This was especially problematic in kvm_s390_pv_unpack, because of the loop over all pages that needed unpacking.
Due to the locks being held, it was not possible to simply replace uv_call with uv_call_sched. A more complex approach was needed, in which uv_call is replaced with __uv_call, which does not loop. When the UVC needs to be executed again, -EAGAIN is returned, and the caller (or its caller) will try again.
When -EAGAIN is returned, the path is the same as when the page is in writeback (and the writeback check is also performed, which is harmless).
Stable-dep-of: 3f29f6537f54 ("s390/uv: Don't call folio_wait_writeback() without a folio reference")
--- arch/s390/kernel/uv.c | 29 +++++++++++++++++++++++------ arch/s390/kvm/intercept.c | 5 +++++ 2 files changed, 28 insertions(+), 6 deletions(-)
arch/s390/kernel/uv.c +23 -6
@@ -186,7 +186,7 @@ static int make_secure_pte(pte_t *ptep, unsigned long addr, {pte_t entry =READ_ONCE (*ptep);struct page *page; -int expected, rc =0 ; +int expected, cc =0 ;if (!pte_present (entry))return -ENXIO ;
@@ -202,12 +202,25 @@ static int make_secure_pte(pte_t *ptep, unsigned long addr,if (!page_ref_freeze (page, expected))return -EBUSY ;set_bit (PG_arch_1, &page->flags); - rc =uv_call (0 , (u64 )uvcb); +/* +* If the UVC does not succeed or fail immediately, we don't want to +* loop for long, or we might get stall notifications. +* On the other hand, this is a complex scenario and we are holding a lot of +* locks, so we can't easily sleep and reschedule. We try only once, +* and if the UVC returned busy or partial completion, we return +* -EAGAIN and we let the callers deal with it. +*/ + cc =__uv_call (0 , (u64 )uvcb);page_ref_unfreeze (page, expected); -/* Return -ENXIO if the page was not mapped, -EINVAL otherwise */ -if (rc) - rc = uvcb->rc ==0x10a ? -ENXIO : -EINVAL ; -return rc; +/* +* Return -ENXIO if the page was not mapped, -EINVAL for other errors. +* If busy or partially completed, return -EAGAIN. +*/ +if (cc ==UVC_CC_OK ) +return 0 ; +else if (cc ==UVC_CC_BUSY || cc ==UVC_CC_PARTIAL ) +return -EAGAIN ; +return uvcb->rc ==0x10a ? -ENXIO : -EINVAL ; }/*
@@ -260,6 +273,10 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb)mmap_read_unlock (gmap->mm);if (rc == -EAGAIN ) { +/* +* If we are here because the UVC returned busy or partial +* completion, this is just a useless check, but it is safe. +*/ wait_on_page_writeback (page); }else if (rc == -EBUSY ) {/*
arch/s390/kvm/intercept.c +5 -0
@@ -535,6 +535,11 @@ static int handle_pv_uvc(struct kvm_vcpu *vcpu)*/ if (rc == -EINVAL )return 0 ; +/* +* If we got -EAGAIN here, we simply return it. It will eventually +* get propagated all the way to userspace, which should then try +* again. +*/ return rc; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/352 KVM: s390: pv: properly handle page flags for protected guests
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudio Imbrenda <[email protected]>
[ Upstream commit 380d97bd02fca7b9b41aec2d1c767874d602bc78 ]
Introduce variants of the convert and destroy page functions that also clear the PG_arch_1 bit used to mark them as secure pages.
The PG_arch_1 flag is always allowed to overindicate; using the new functions introduced here allows to reduce the extent of overindication and thus improve performance.
These new functions can only be called on pages for which a reference is already being held.
Stable-dep-of: 3f29f6537f54 ("s390/uv: Don't call folio_wait_writeback() without a folio reference")
--- arch/s390/include/asm/pgtable.h | 9 ++++++--- arch/s390/include/asm/uv.h | 10 ++++++++-- arch/s390/kernel/uv.c | 34 ++++++++++++++++++++++++++++++++- arch/s390/mm/gmap.c | 4 +++- 4 files changed, 50 insertions(+), 7 deletions(-)
arch/s390/include/asm/pgtable.h +6 -3
@@ -1080,8 +1080,9 @@ static inline pte_t ptep_get_and_clear(struct mm_struct *mm,pte_t res; res =ptep_xchg_lazy (mm, addr, ptep,__pte (_PAGE_INVALID)); +/* At this point the reference through the mapping is still present */ if (mm_is_protected (mm) &&pte_present (res)) -uv_convert_from_secure (pte_val (res) &PAGE_MASK ); +uv_convert_owned_from_secure (pte_val (res) &PAGE_MASK );return res; }
@@ -1097,8 +1098,9 @@ static inline pte_t ptep_clear_flush(struct vm_area_struct *vma,pte_t res; res =ptep_xchg_direct (vma->vm_mm, addr, ptep,__pte (_PAGE_INVALID)); +/* At this point the reference through the mapping is still present */ if (mm_is_protected (vma->vm_mm) &&pte_present (res)) -uv_convert_from_secure (pte_val (res) &PAGE_MASK ); +uv_convert_owned_from_secure (pte_val (res) &PAGE_MASK );return res; }
@@ -1122,8 +1124,9 @@ static inline pte_t ptep_get_and_clear_full(struct mm_struct *mm, }else { res =ptep_xchg_lazy (mm, addr, ptep,__pte (_PAGE_INVALID)); } +/* At this point the reference through the mapping is still present */ if (mm_is_protected (mm) &&pte_present (res)) -uv_convert_from_secure (pte_val (res) &PAGE_MASK ); +uv_convert_owned_from_secure (pte_val (res) &PAGE_MASK );return res; }
arch/s390/include/asm/uv.h +8 -2
@@ -351,8 +351,9 @@ static inline int is_prot_virt_host(void) }int gmap_make_secure (struct gmap *gmap,unsigned long gaddr,void *uvcb); -int uv_destroy_page (unsigned long paddr); +int uv_destroy_owned_page (unsigned long paddr);int uv_convert_from_secure (unsigned long paddr); +int uv_convert_owned_from_secure (unsigned long paddr);int gmap_convert_to_secure (struct gmap *gmap,unsigned long gaddr);void setup_uv (void );
@@ -362,7 +363,7 @@ void adjust_to_uv_max(unsigned long *vmax);static inline void setup_uv (void ) {}static inline void adjust_to_uv_max (unsigned long *vmax) {} -static inline int uv_destroy_page (unsigned long paddr) +static inline int uv_destroy_owned_page (unsigned long paddr) {return 0 ; }
@@ -371,6 +372,11 @@ static inline int uv_convert_from_secure(unsigned long paddr) {return 0 ; } + +static inline int uv_convert_owned_from_secure (unsigned long paddr) +{ +return 0 ; +}#endif #if defined(CONFIG_PROTECTED_VIRTUALIZATION_GUEST ) ||IS_ENABLED (CONFIG_KVM )
arch/s390/kernel/uv.c +33 -1
@@ -121,7 +121,7 @@ static int uv_pin_shared(unsigned long paddr)* * @paddr: Absolute host address of page to be destroyed */ -int uv_destroy_page (unsigned long paddr) +static int uv_destroy_page (unsigned long paddr) {struct uv_cb_cfs uvcb = { .header.cmd =UVC_CMD_DESTR_SEC_STOR ,
@@ -141,6 +141,22 @@ int uv_destroy_page(unsigned long paddr)return 0 ; } +/* +* The caller must already hold a reference to the page +*/ +int uv_destroy_owned_page (unsigned long paddr) +{ +struct page *page =phys_to_page (paddr); +int rc; + +get_page (page); + rc =uv_destroy_page (paddr); +if (!rc) +clear_bit (PG_arch_1, &page->flags); +put_page (page); +return rc; +} +/* * Requests the Ultravisor to encrypt a guest page and make it * accessible to the host for paging (export).
@@ -160,6 +176,22 @@ int uv_convert_from_secure(unsigned long paddr)return 0 ; } +/* +* The caller must already hold a reference to the page +*/ +int uv_convert_owned_from_secure (unsigned long paddr) +{ +struct page *page =phys_to_page (paddr); +int rc; + +get_page (page); + rc =uv_convert_from_secure (paddr); +if (!rc) +clear_bit (PG_arch_1, &page->flags); +put_page (page); +return rc; +} +/* * Calculate the expected ref_count for a page that would otherwise have no * further pins. This was cribbed from similar functions in other places in
arch/s390/mm/gmap.c +3 -1
@@ -2693,8 +2693,10 @@ static int __s390_reset_acc(pte_t *ptep, unsigned long addr, {pte_t pte =READ_ONCE (*ptep); +/* There is a reference through the mapping */ if (pte_present (pte)) -WARN_ON_ONCE (uv_destroy_page (pte_val (pte) &PAGE_MASK )); +WARN_ON_ONCE (uv_destroy_owned_page (pte_val (pte) &PAGE_MASK )); +return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/352 KVM: s390: pv: add export before import
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudio Imbrenda <[email protected]>
[ Upstream commit 72b1daff2671cef2c8cccc6c4e52f8d5ce4ebe58 ]
Due to upcoming changes, it will be possible to temporarily have multiple protected VMs in the same address space, although only one will be actually active.
In that scenario, it is necessary to perform an export of every page that is to be imported, since the hardware does not allow a page belonging to a protected guest to be imported into a different protected guest.
This also applies to pages that are shared, and thus accessible by the host.
Message-Id: <[email protected]>
Stable-dep-of: 3f29f6537f54 ("s390/uv: Don't call folio_wait_writeback() without a folio reference")
--- arch/s390/kernel/uv.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
arch/s390/kernel/uv.c +28 -0
@@ -255,6 +255,32 @@ static int make_secure_pte(pte_t *ptep, unsigned long addr,return uvcb->rc ==0x10a ? -ENXIO : -EINVAL ; } +/** +* should_export_before_import - Determine whether an export is needed +* before an import-like operation +* @uvcb: the Ultravisor control block of the UVC to be performed +* @mm: the mm of the process +* +* Returns whether an export is needed before every import-like operation. +* This is needed for shared pages, which don't trigger a secure storage +* exception when accessed from a different guest. +* +* Although considered as one, the Unpin Page UVC is not an actual import, +* so it is not affected. +* +* No export is needed also when there is only one protected VM, because the +* page cannot belong to the wrong VM in that case (there is no "other VM" +* it can belong to). +* +* Return: true if an export is needed before every import, otherwise false. +*/ +static bool should_export_before_import (struct uv_cb_header *uvcb,struct mm_struct *mm) +{ +if (uvcb->cmd ==UVC_CMD_UNPIN_PAGE_SHARED ) +return false; +return atomic_read (&mm->context.protected_count) >1 ; +} +/* * Requests the Ultravisor to make a page accessible to a guest. * If it's brought in the first time, it will be cleared. If
@@ -298,6 +324,8 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb)lock_page (page); ptep =get_locked_pte (gmap->mm, uaddr, &ptelock); +if (should_export_before_import (uvcb, gmap->mm)) +uv_convert_from_secure (page_to_phys (page)); rc =make_secure_pte (ptep, uaddr, page, uvcb);pte_unmap_unlock (ptep, ptelock);unlock_page (page);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/352 KVM: s390: fix race in gmap_make_secure()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudio Imbrenda <[email protected]>
[ Upstream commit c148dc8e2fa403be501612ee409db866eeed35c0 ]
Fix a potential race in gmap_make_secure() and remove the last user of follow_page() without FOLL_GET.
The old code is locking something it doesn't have a reference to, and as explained by Jason and David in this discussion:
https://lore.kernel.org/linux-mm/Y9J4P%[email protected]/
it can lead to all kind of bad things, including the page getting unmapped (MADV_DONTNEED), freed, reallocated as a larger folio and the unlock_page() would target the wrong bit.
There is also another race with the FOLL_WRITE, which could race between the follow_page() and the get_locked_pte().
The main point is to remove the last use of follow_page() without FOLL_GET or FOLL_PIN, removing the races can be considered a nice bonus.
Message-Id: <[email protected]>
Stable-dep-of: 3f29f6537f54 ("s390/uv: Don't call folio_wait_writeback() without a folio reference")
--- arch/s390/kernel/uv.c | 32 +++++++++++--------------------- 1 file changed, 11 insertions(+), 21 deletions(-)
arch/s390/kernel/uv.c +11 -21
@@ -213,21 +213,10 @@ static int expected_page_refs(struct page *page)return res; } -static int make_secure_pte (pte_t *ptep,unsigned long addr, -struct page *exp_page,struct uv_cb_header *uvcb) +static int make_page_secure (struct page *page,struct uv_cb_header *uvcb) { -pte_t entry =READ_ONCE (*ptep); -struct page *page;int expected, cc =0 ; -if (!pte_present (entry)) -return -ENXIO ; -if (pte_val (entry) & _PAGE_INVALID) -return -ENXIO ; - - page =pte_page (entry); -if (page != exp_page) -return -ENXIO ;if (PageWriteback (page))return -EAGAIN ; expected =expected_page_refs (page);
@@ -318,17 +307,18 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb) goto out; rc = -ENXIO ; - page =follow_page (vma, uaddr,FOLL_WRITE ); -if (IS_ERR_OR_NULL (page)) - goto out; - -lock_page (page); ptep =get_locked_pte (gmap->mm, uaddr, &ptelock); -if (should_export_before_import (uvcb, gmap->mm)) -uv_convert_from_secure (page_to_phys (page)); - rc =make_secure_pte (ptep, uaddr, page, uvcb); +if (pte_present (*ptep) && !(pte_val (*ptep) & _PAGE_INVALID) &&pte_write (*ptep)) { + page =pte_page (*ptep); + rc = -EAGAIN ; +if (trylock_page (page)) { +if (should_export_before_import (uvcb, gmap->mm)) +uv_convert_from_secure (page_to_phys (page)); + rc =make_page_secure (page, uvcb); +unlock_page (page); + } + }pte_unmap_unlock (ptep, ptelock); -unlock_page (page); out:mmap_read_unlock (gmap->mm);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/352 s390/mm: Convert make_page_secure to use a folio
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit 259e660d91d0e7261ae0ee37bb37266d6006a546 ]
These page APIs are deprecated, so convert the incoming page to a folio and use the folio APIs instead. The ultravisor API cannot handle large folios, so return -EINVAL if one has slipped through.
Stable-dep-of: 3f29f6537f54 ("s390/uv: Don't call folio_wait_writeback() without a folio reference")
--- arch/s390/kernel/uv.c | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-)
arch/s390/kernel/uv.c +16 -13
@@ -193,21 +193,21 @@ int uv_convert_owned_from_secure(unsigned long paddr) }/* -* Calculate the expected ref_count for a page that would otherwise have no +* Calculate the expected ref_count for a folio that would otherwise have no * further pins. This was cribbed from similar functions in other places in * the kernel, but with some slight modifications. We know that a secure -* page can not be a huge page for example. +* folio can not be a large folio, for example. */ -static int expected_page_refs (struct page *page) +static int expected_folio_refs (struct folio *folio) {int res; - res =page_mapcount (page); -if (PageSwapCache (page)) { + res =folio_mapcount (folio); +if (folio_test_swapcache (folio)) { res++; - }else if (page_mapping (page)) { + }else if (folio_mapping (folio)) { res++; -if (page_has_private (page)) +if (folio->private) res++; }return res;
@@ -215,14 +215,17 @@ static int expected_page_refs(struct page *page)static int make_page_secure (struct page *page,struct uv_cb_header *uvcb) { +struct folio *folio =page_folio (page);int expected, cc =0 ; -if (PageWriteback (page)) +if (folio_test_large (folio)) +return -EINVAL ; +if (folio_test_writeback (folio))return -EAGAIN ; - expected =expected_page_refs (page); -if (!page_ref_freeze (page, expected)) + expected =expected_folio_refs (folio); +if (!folio_ref_freeze (folio, expected))return -EBUSY ; -set_bit (PG_arch_1, &page->flags); +set_bit (PG_arch_1, &folio->flags);/* * If the UVC does not succeed or fail immediately, we don't want to * loop for long, or we might get stall notifications.
@@ -232,9 +235,9 @@ static int make_page_secure(struct page *page, struct uv_cb_header *uvcb)* -EAGAIN and we let the callers deal with it. */ cc =__uv_call (0 , (u64 )uvcb); -page_ref_unfreeze (page, expected); +folio_ref_unfreeze (folio, expected);/* -* Return -ENXIO if the page was not mapped, -EINVAL for other errors. +* Return -ENXIO if the folio was not mapped, -EINVAL for other errors. * If busy or partially completed, return -EAGAIN. */ if (cc ==UVC_CC_OK )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/352 s390/mm: Convert gmap_make_secure to use a folio
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit d35c34bb32f2cc4ec0b52e91ad7a8fcab55d7856 ]
Remove uses of deprecated page APIs, and move the check for large folios to here to avoid taking the folio lock if the folio is too large. We could do better here by attempting to split the large folio, but I'll leave that improvement for someone who can test it.
Stable-dep-of: 3f29f6537f54 ("s390/uv: Don't call folio_wait_writeback() without a folio reference")
--- arch/s390/kernel/uv.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-)
arch/s390/kernel/uv.c +14 -13
@@ -213,13 +213,10 @@ static int expected_folio_refs(struct folio *folio)return res; } -static int make_page_secure (struct page *page,struct uv_cb_header *uvcb) +static int make_folio_secure (struct folio *folio,struct uv_cb_header *uvcb) { -struct folio *folio =page_folio (page);int expected, cc =0 ; -if (folio_test_large (folio)) -return -EINVAL ;if (folio_test_writeback (folio))return -EAGAIN ; expected =expected_folio_refs (folio);
@@ -285,7 +282,7 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb)bool local_drain = false;spinlock_t *ptelock;unsigned long uaddr; -struct page *page; +struct folio *folio;pte_t *ptep;int rc;
@@ -312,15 +309,19 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb) rc = -ENXIO ; ptep =get_locked_pte (gmap->mm, uaddr, &ptelock);if (pte_present (*ptep) && !(pte_val (*ptep) & _PAGE_INVALID) &&pte_write (*ptep)) { - page =pte_page (*ptep); + folio =page_folio (pte_page (*ptep)); + rc = -EINVAL ; +if (folio_test_large (folio)) + goto unlock; rc = -EAGAIN ; -if (trylock_page (page)) { +if (folio_trylock (folio)) {if (should_export_before_import (uvcb, gmap->mm)) -uv_convert_from_secure (page_to_phys (page)); - rc =make_page_secure (page, uvcb); -unlock_page (page); +uv_convert_from_secure (PFN_PHYS (folio_pfn (folio))); + rc =make_folio_secure (folio, uvcb); +folio_unlock (folio); } } +unlock:pte_unmap_unlock (ptep, ptelock); out:mmap_read_unlock (gmap->mm);
@@ -330,10 +331,10 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb)* If we are here because the UVC returned busy or partial * completion, this is just a useless check, but it is safe. */ -wait_on_page_writeback (page); +folio_wait_writeback (folio); }else if (rc == -EBUSY ) {/* -* If we have tried a local drain and the page refcount +* If we have tried a local drain and the folio refcount * still does not match our expected safe value, try with a * system wide drain. This is needed if the pagevecs holding * the page are on a different CPU.
@@ -344,7 +345,7 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb)return -EAGAIN ; }/* -* We are here if the page refcount does not match the +* We are here if the folio refcount does not match the * expected safe value. The main culprits are usually * pagevecs. With lru_add_drain() we drain the pagevecs * on the local CPU so that hopefully the refcount will
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/352 s390/uv: Dont call folio_wait_writeback() without a folio reference
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
[ Upstream commit 3f29f6537f54d74e64bac0a390fb2e26da25800d ]
folio_wait_writeback() requires that no spinlocks are held and that a folio reference is held, as documented. After we dropped the PTL, the folio could get freed concurrently. So grab a temporary reference.
--- arch/s390/kernel/uv.c | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/s390/kernel/uv.c +8 -0
@@ -320,6 +320,13 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb) rc =make_folio_secure (folio, uvcb);folio_unlock (folio); } + +/* +* Once we drop the PTL, the folio may get unmapped and +* freed immediately. We need a temporary reference. +*/ +if (rc == -EAGAIN ) +folio_get (folio); } unlock:pte_unmap_unlock (ptep, ptelock);
@@ -332,6 +339,7 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb)* completion, this is just a useless check, but it is safe. */ folio_wait_writeback (folio); +folio_put (folio); }else if (rc == -EBUSY ) {/* * If we have tried a local drain and the folio refcount
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/352 saa7134: Unchecked i2c_transfer function result fixed
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Burakov <[email protected]>
[ Upstream commit 9d8683b3fd93f0e378f24dc3d9604e5d7d3e0a17 ]
Return value of function 'i2c_transfer' is not checked that may cause undefined behaviour.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/media/pci/saa7134/saa7134-dvb.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/media/pci/saa7134/saa7134-dvb.c +6 -2
@@ -466,7 +466,9 @@ static int philips_europa_tuner_sleep(struct dvb_frontend *fe)/* switch the board to analog mode */ if (fe->ops.i2c_gate_ctrl) fe->ops.i2c_gate_ctrl (fe,1 ); -i2c_transfer (&dev->i2c_adap, &analog_msg,1 ); +if (i2c_transfer (&dev->i2c_adap, &analog_msg,1 ) !=1 ) +return -EIO ; +return 0 ; }
@@ -1018,7 +1020,9 @@ static int md8800_set_voltage2(struct dvb_frontend *fe,else wbuf[1 ] = rbuf &0xef ; msg[0 ].len =2 ; -i2c_transfer (&dev->i2c_adap, msg,1 ); +if (i2c_transfer (&dev->i2c_adap, msg,1 ) !=1 ) +return -EIO ; +return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/352 media: uvcvideo: Allow entity-defined get_info and get_cur
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 65900c581d014499f0f8ceabfc02c652e9a88771 ]
Allows controls to get their properties and current value from an entity-defined function instead of via a query to the USB device.
Stable-dep-of: 86419686e66d ("media: uvcvideo: Override default flags")
--- drivers/media/usb/uvc/uvc_ctrl.c | 22 ++++++++++++++++++---- drivers/media/usb/uvc/uvcvideo.h | 5 +++++ 2 files changed, 23 insertions(+), 4 deletions(-)
drivers/media/usb/uvc/uvc_ctrl.c +18 -4
@@ -1002,10 +1002,20 @@ static int __uvc_ctrl_get(struct uvc_video_chain *chain,return -EACCES ;if (!ctrl->loaded) { - ret =uvc_query_ctrl (chain->dev,UVC_GET_CUR , ctrl->entity->id, - chain->dev->intfnum, ctrl->info.selector, +if (ctrl->entity->get_cur) { + ret = ctrl->entity->get_cur (chain->dev, + ctrl->entity, + ctrl->info.selector,uvc_ctrl_data (ctrl,UVC_CTRL_DATA_CURRENT ), ctrl->info.size); + }else { + ret =uvc_query_ctrl (chain->dev,UVC_GET_CUR , + ctrl->entity->id, + chain->dev->intfnum, + ctrl->info.selector, +uvc_ctrl_data (ctrl,UVC_CTRL_DATA_CURRENT ), + ctrl->info.size); + }if (ret <0 )return ret;
@@ -1718,8 +1728,12 @@ static int uvc_ctrl_get_flags(struct uvc_device *dev,if (data ==NULL )return -ENOMEM ; - ret =uvc_query_ctrl (dev,UVC_GET_INFO , ctrl->entity->id, dev->intfnum, - info->selector, data,1 ); +if (ctrl->entity->get_info) + ret = ctrl->entity->get_info (dev, ctrl->entity, + ctrl->info.selector, data); +else + ret =uvc_query_ctrl (dev,UVC_GET_INFO , ctrl->entity->id, + dev->intfnum, info->selector, data,1 );if (!ret) info->flags |= (data[0 ] &UVC_CONTROL_CAP_GET ?UVC_CTRL_FLAG_GET_CUR :0 )
drivers/media/usb/uvc/uvcvideo.h +5 -0
@@ -354,6 +354,11 @@ struct uvc_entity {u8 bNrInPins;u8 *baSourceID; +int (*get_info)(struct uvc_device *dev,struct uvc_entity *entity, +u8 cs,u8 *caps); +int (*get_cur)(struct uvc_device *dev,struct uvc_entity *entity, +u8 cs,void *data,u16 size); +unsigned int ncontrols;struct uvc_control *controls; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/352 media: uvcvideo: Override default flags
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Schaefer <[email protected]>
[ Upstream commit 86419686e66da5b90a07fb8a40ab138fe97189b5 ]
When the UVC device has a control that is readonly it doesn't set the SET_CUR flag. For example the privacy control has SET_CUR flag set in the defaults in the uvc_ctrls variable. Even if the device does not have it set, it's not cleared by uvc_ctrl_get_flags().
Originally written with assignment in commit 859086ae3636 ("media:
uvcvideo: Apply flags from device to actual properties"). But changed to |= in commit 0dc68cabdb62 ("media: uvcvideo: Prevent setting unavailable flags"). It would not clear the default flags.
With this patch applied the correct flags are reported to user space. Tested with:
``` > v4l2-ctl --list-ctrls | grep privacy privacy 0x009a0910 (bool) : default=0 value=0 flags=read-only ```
--- drivers/media/usb/uvc/uvc_ctrl.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/media/usb/uvc/uvc_ctrl.c +8 -1
@@ -1734,7 +1734,13 @@ static int uvc_ctrl_get_flags(struct uvc_device *dev,else ret =uvc_query_ctrl (dev,UVC_GET_INFO , ctrl->entity->id, dev->intfnum, info->selector, data,1 ); -if (!ret) + +if (!ret) { + info->flags &= ~(UVC_CTRL_FLAG_GET_CUR | +UVC_CTRL_FLAG_SET_CUR | +UVC_CTRL_FLAG_AUTO_UPDATE | +UVC_CTRL_FLAG_ASYNCHRONOUS ); + info->flags |= (data[0 ] &UVC_CONTROL_CAP_GET ?UVC_CTRL_FLAG_GET_CUR :0 ) | (data[0] & UVC_CONTROL_CAP_SET ?
@@ -1743,6 +1749,7 @@ static int uvc_ctrl_get_flags(struct uvc_device *dev, UVC_CTRL_FLAG_AUTO_UPDATE : 0) | (data[0 ] &UVC_CONTROL_CAP_ASYNCHRONOUS ?UVC_CTRL_FLAG_ASYNCHRONOUS :0 ); + }kfree (data);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/352 media: renesas: vsp1: Fix _irqsave and _irq mix
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <[email protected]>
[ Upstream commit 57edbbcf5258c378a9b9d0c80d33b03a010b22c8 ]
The histogram support mixes _irqsave and _irq, causing the following smatch warning:
drivers/media/platform/renesas/vsp1/vsp1_histo.c:153 histo_stop_streaming()
warn: mixing irqsave and irq
The histo_stop_streaming() calls spin_lock_irqsave() followed by wait_event_lock_irq(). The former hints that interrupts may be disabled by the caller, while the latter reenables interrupts unconditionally. This doesn't cause any real bug, as the function is always called with interrupts enabled, but the pattern is still incorrect.
Fix the problem by using spin_lock_irq() instead of spin_lock_irqsave() in histo_stop_streaming(). While at it, switch to spin_lock_irq() and spin_lock() as appropriate elsewhere.
--- drivers/media/platform/vsp1/vsp1_histo.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-)
drivers/media/platform/vsp1/vsp1_histo.c +8 -12
@@ -36,9 +36,8 @@ struct vsp1_histogram_buffer * vsp1_histogram_buffer_get(struct vsp1_histogram *histo) {struct vsp1_histogram_buffer *buf =NULL ; -unsigned long flags; -spin_lock_irqsave (&histo->irqlock, flags); +spin_lock (&histo->irqlock);if (list_empty (&histo->irqqueue)) goto done;
@@ -49,7 +48,7 @@ vsp1_histogram_buffer_get(struct vsp1_histogram *histo) histo->readout = true; done: -spin_unlock_irqrestore (&histo->irqlock, flags); +spin_unlock (&histo->irqlock);return buf; }
@@ -58,7 +57,6 @@ void vsp1_histogram_buffer_complete(struct vsp1_histogram *histo, size_t size) {struct vsp1_pipeline *pipe = histo->entity.pipe; -unsigned long flags;/* * The pipeline pointer is guaranteed to be valid as this function is
@@ -70,10 +68,10 @@ void vsp1_histogram_buffer_complete(struct vsp1_histogram *histo,vb2_set_plane_payload (&buf->buf.vb2_buf,0 , size);vb2_buffer_done (&buf->buf.vb2_buf,VB2_BUF_STATE_DONE ); -spin_lock_irqsave (&histo->irqlock, flags); +spin_lock (&histo->irqlock); histo->readout = false;wake_up (&histo->wait_queue); -spin_unlock_irqrestore (&histo->irqlock, flags); +spin_unlock (&histo->irqlock); }/* -----------------------------------------------------------------------------
@@ -124,11 +122,10 @@ static void histo_buffer_queue(struct vb2_buffer *vb)struct vb2_v4l2_buffer *vbuf =to_vb2_v4l2_buffer (vb);struct vsp1_histogram *histo =vb2_get_drv_priv (vb->vb2_queue);struct vsp1_histogram_buffer *buf =to_vsp1_histogram_buffer (vbuf); -unsigned long flags; -spin_lock_irqsave (&histo->irqlock, flags); +spin_lock_irq (&histo->irqlock);list_add_tail (&buf->queue, &histo->irqqueue); -spin_unlock_irqrestore (&histo->irqlock, flags); +spin_unlock_irq (&histo->irqlock); }static int histo_start_streaming (struct vb2_queue *vq,unsigned int count)
@@ -140,9 +137,8 @@ static void histo_stop_streaming(struct vb2_queue *vq) {struct vsp1_histogram *histo =vb2_get_drv_priv (vq);struct vsp1_histogram_buffer *buffer; -unsigned long flags; -spin_lock_irqsave (&histo->irqlock, flags); +spin_lock_irq (&histo->irqlock);/* Remove all buffers from the IRQ queue. */ list_for_each_entry (buffer, &histo->irqqueue, queue)
@@ -152,7 +148,7 @@ static void histo_stop_streaming(struct vb2_queue *vq)/* Wait for the buffer being read out (if any) to complete. */ wait_event_lock_irq (histo->wait_queue, !histo->readout, histo->irqlock); -spin_unlock_irqrestore (&histo->irqlock, flags); +spin_unlock_irq (&histo->irqlock); }static const struct vb2_ops histo_video_queue_qops = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/352 media: renesas: vsp1: Store RPF partition configuration per RPF instance
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <[email protected]>
[ Upstream commit a213bc09b1025c771ee722ee341af1d84375db8a ]
The vsp1_partition structure stores the RPF partition configuration in a single field for all RPF instances, while each RPF can have its own configuration. Fix it by storing the configuration separately for each RPF instance.
--- drivers/media/platform/vsp1/vsp1_pipe.h | 2 +- drivers/media/platform/vsp1/vsp1_rpf.c | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-)
drivers/media/platform/vsp1/vsp1_pipe.h +1 -1
@@ -73,7 +73,7 @@ struct vsp1_partition_window {* @wpf: The WPF partition window configuration */ struct vsp1_partition { -struct vsp1_partition_window rpf; +struct vsp1_partition_window rpf[VSP1_MAX_RPF ];struct vsp1_partition_window uds_sink;struct vsp1_partition_window uds_source;struct vsp1_partition_window sru;
drivers/media/platform/vsp1/vsp1_rpf.c +5 -3
@@ -271,8 +271,8 @@ static void rpf_configure_partition(struct vsp1_entity *entity,* 'width' need to be adjusted. */ if (pipe->partitions >1 ) { - crop.width = pipe->partition->rpf.width; - crop.left += pipe->partition->rpf.left; + crop.width = pipe->partition->rpf[rpf->entity.index].width; + crop.left += pipe->partition->rpf[rpf->entity.index].left; }if (pipe->interlaced) {
@@ -327,7 +327,9 @@ static void rpf_partition(struct vsp1_entity *entity,unsigned int partition_idx, struct vsp1_partition_window *window) { - partition->rpf = *window; + struct vsp1_rwpf *rpf = to_rwpf(&entity->subdev); + + partition->rpf[rpf->entity.index] = *window; } static const struct vsp1_entity_operations rpf_entity_ops = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/352 leds: trigger: Unregister sysfs attributes before calling deactivate()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit c0dc9adf9474ecb7106e60e5472577375aedaed3 ]
Triggers which have trigger specific sysfs attributes typically store related data in trigger-data allocated by the activate() callback and freed by the deactivate() callback.
Calling device_remove_groups() after calling deactivate() leaves a window where the sysfs attributes show/store functions could be called after deactivation and then operate on the just freed trigger-data.
Move the device_remove_groups() call to before deactivate() to close this race window.
This also makes the deactivation path properly do things in reverse order of the activation path which calls the activate() callback before calling device_add_groups().
--- drivers/leds/led-triggers.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/leds/led-triggers.c +1 -1
@@ -177,9 +177,9 @@ int led_trigger_set(struct led_classdev *led_cdev, struct led_trigger *trig) flags);cancel_work_sync (&led_cdev->set_brightness_work);led_stop_software_blink (led_cdev); +device_remove_groups (led_cdev->dev, led_cdev->trigger->groups);if (led_cdev->trigger->deactivate) led_cdev->trigger->deactivate (led_cdev); -device_remove_groups (led_cdev->dev, led_cdev->trigger->groups); led_cdev->trigger =NULL ; led_cdev->trigger_data =NULL ; led_cdev->activated = false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/352 perf report: Fix condition in sort__sym_cmp()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit cb39d05e67dc24985ff9f5150e71040fa4d60ab8 ]
It's expected that both hist entries are in the same hists when comparing two. But the current code in the function checks one without dso sort key and other with the key. This would make the condition true in any case.
I guess the intention of the original commit was to add '!' for the right side too. But as it should be the same, let's just remove it.
--- tools/perf/util/sort.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/sort.c +1 -1
@@ -272,7 +272,7 @@ sort__sym_cmp(struct hist_entry *left, struct hist_entry *right)* comparing symbol address alone is not enough since it's a * relative address within a dso. */ -if (!hists__has (left->hists, dso) ||hists__has (right->hists, dso)) { +if (!hists__has (left->hists, dso)) { ret =sort__dso_cmp (left, right);if (ret !=0 )return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/352 drm/etnaviv: fix DMA direction handling for cached RW buffers
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Stach <[email protected]>
[ Upstream commit 58979ad6330a70450ed78837be3095107d022ea9 ]
The dma sync operation needs to be done with DMA_BIDIRECTIONAL when the BO is prepared for both read and write operations.
--- drivers/gpu/drm/etnaviv/etnaviv_gem.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/etnaviv/etnaviv_gem.c +4 -2
@@ -364,9 +364,11 @@ static void *etnaviv_gem_vmap_impl(struct etnaviv_gem_object *obj)static inline enum dma_data_direction etnaviv_op_to_dma_dir (u32 op) { -if (op &ETNA_PREP_READ ) + op &=ETNA_PREP_READ |ETNA_PREP_WRITE ; + +if (op ==ETNA_PREP_READ )return DMA_FROM_DEVICE ; -else if (op &ETNA_PREP_WRITE ) +else if (op ==ETNA_PREP_WRITE )return DMA_TO_DEVICE ;else return DMA_BIDIRECTIONAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/352 drm/qxl: Add check for drm_cvt_mode
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit 7bd09a2db0f617377027a2bb0b9179e6959edff3 ]
Add check for the return value of drm_cvt_mode() and return the error if it fails in order to avoid NULL pointer dereference.
--- drivers/gpu/drm/qxl/qxl_display.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/qxl/qxl_display.c +3 -0
@@ -232,6 +232,9 @@ static int qxl_add_mode(struct drm_connector *connector,return 0 ; mode =drm_cvt_mode (dev, width, height,60 , false, false, false); +if (!mode) +return 0 ; +if (preferred) mode->type |=DRM_MODE_TYPE_PREFERRED ; mode->hdisplay = width;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/352 Revert "leds: led-core: Fix refcount leak in of_led_get()"
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Ceresoli <[email protected]>
[ Upstream commit 940b27161afc6ec53fc66245a4fb3518394cdc92 ]
This reverts commit da1afe8e6099980fe1e2fd7436dca284af9d3f29.
Commit 699a8c7c4bd3 ("leds: Add of_led_get() and led_put()"), introduced in 5.5, added of_led_get() and led_put() but missed a put_device() in led_put(), thus creating a leak in case the consumer device is removed.
Arguably device removal was not very popular, so this went apparently unnoticed until 2022. In January 2023 two different patches got merged to fix the same bug:
- commit da1afe8e6099 ("leds: led-core: Fix refcount leak in of_led_get()")
- commit 445110941eb9 ("leds: led-class: Add missing put_device() to led_put()")
They fix the bug in two different ways, which creates no patch conflicts, and both were merged in v6.2. The result is that now there is one more put_device() than get_device()s, instead of one less.
Arguably device removal is not very popular yet, so this apparently hasn't been noticed as well up to now. But it blew up here while I'm working with device tree overlay insertion and removal. The symptom is an apparently unrelated list of oopses on device removal, with reasons:
kernfs: can not remove 'uevent', no directory
kernfs: can not remove 'brightness', no directory
kernfs: can not remove 'max_brightness', no directory
...
Here sysfs fails removing attribute files, which is because the device name changed and so the sysfs path. This is because the device name string got corrupted, which is because it got freed too early and its memory reused.
Different symptoms could appear in different use cases.
Fix by removing one of the two fixes.
The choice was to remove commit da1afe8e6099 because:
* it is calling put_device() inside of_led_get() just after getting the device, thus it is basically not refcounting the LED device at all during its entire lifetime
* it does not add a corresponding put_device() in led_get(), so it fixes only the OF case
The other fix (445110941eb9) is adding the put_device() in led_put() so it covers the entire lifetime, and it works even in the non-DT case.
--- drivers/leds/led-class.c | 1 - 1 file changed, 1 deletion(-)
drivers/leds/led-class.c +0 -1
@@ -236,7 +236,6 @@ struct led_classdev *of_led_get(struct device_node *np, int index) led_dev =class_find_device_by_of_node (leds_class, led_node);of_node_put (led_node); -put_device (led_dev);if (!led_dev)return ERR_PTR (-EPROBE_DEFER );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/352 ext4: fix infinite loop when replaying fast_commit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luis Henriques (SUSE) <[email protected]>
[ Upstream commit 907c3fe532253a6ef4eb9c4d67efb71fab58c706 ]
When doing fast_commit replay an infinite loop may occur due to an uninitialized extent_status struct. ext4_ext_determine_insert_hole() does not detect the replay and calls ext4_es_find_extent_range(), which will return immediately without initializing the 'es' variable.
Because 'es' contains garbage, an integer overflow may happen causing an infinite loop in this function, easily reproducible using fstest generic/039.
This commit fixes this issue by unconditionally initializing the structure in function ext4_es_find_extent_range().
Thanks to Zhang Yi, for figuring out the real problem!
--- fs/ext4/extents_status.c | 2 ++ 1 file changed, 2 insertions(+)
fs/ext4/extents_status.c +2 -0
@@ -312,6 +312,8 @@ void ext4_es_find_extent_range(struct inode *inode, ext4_lblk_t lblk, ext4_lblk_t end, struct extent_status *es) { + es->es_lblk = es->es_len = es->es_pblk = 0; +if (EXT4_SB (inode->i_sb)->s_mount_state &EXT4_FC_REPLAY )return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/352 media: venus: flush all buffers in output plane streamoff
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dikshita Agarwal <[email protected]>
[ Upstream commit e750a4b1224142bd8dd057b0d5adf8a5608b7e77 ]
For scenarios, when source change is followed by VIDIOC_STREAMOFF on output plane, driver should discard any queued OUTPUT buffers, which are not decoded or dequeued.
Flush with HFI_FLUSH_INPUT does not have any actual impact. So, fix it, by invoking HFI_FLUSH_ALL, which will flush all queued buffers.
--- drivers/media/platform/qcom/venus/vdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/qcom/venus/vdec.c +1 -1
@@ -1142,7 +1142,7 @@ static int vdec_stop_output(struct venus_inst *inst)break ;case VENUS_DEC_STATE_INIT :case VENUS_DEC_STATE_CAPTURE_SETUP : - ret =hfi_session_flush (inst,HFI_FLUSH_INPUT , true); + ret =hfi_session_flush (inst,HFI_FLUSH_ALL , true);break ;default :break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/352 mfd: omap-usb-tll: Use struct_size to allocate tll
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
[ Upstream commit 40176714c818b0b6a2ca8213cdb7654fbd49b742 ]
Commit 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once") changed the memory allocation of 'tll' to consolidate it into a single allocation, introducing an incorrect size calculation.
In particular, the allocation for the array of pointers was converted into a single-pointer allocation.
The memory allocation used to occur in two steps:
tll = devm_kzalloc(dev, sizeof(struct usbtll_omap), GFP_KERNEL); tll->ch_clk = devm_kzalloc(dev, sizeof(struct clk *) * tll->nch,
GFP_KERNEL);
And it turned that into the following allocation:
tll = devm_kzalloc(dev, sizeof(*tll) + sizeof(tll->ch_clk[nch]),
GFP_KERNEL);
sizeof(tll->ch_clk[nch]) returns the size of a single pointer instead of the expected nch pointers.
This bug went unnoticed because the allocation size was small enough to fit within the minimum size of a memory allocation for this particular case [1].
The complete allocation can still be done at once with the struct_size macro, which comes in handy for structures with a trailing flexible array.
Fix the memory allocation to obtain the original size again.
--- drivers/mfd/omap-usb-tll.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/mfd/omap-usb-tll.c +1 -2
@@ -237,8 +237,7 @@ static int usbtll_omap_probe(struct platform_device *pdev)break ; } - tll =devm_kzalloc (dev,sizeof (*tll) +sizeof (tll->ch_clk[nch]), -GFP_KERNEL ); + tll =devm_kzalloc (dev,struct_size (tll, ch_clk, nch),GFP_KERNEL );if (!tll) {pm_runtime_put_sync (dev);pm_runtime_disable (dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/352 xprtrdma: Rename frwr_release_mr()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit f912af77e2c1ba25bd40534668b10da5b20f686a ]
Clean up: To be consistent with other functions in this source file, follow the naming convention of putting the object being acted upon before the action itself.
Stable-dep-of: acd9f2dd23c6 ("xprtrdma: Fix rpcrdma_reqs_reset()")
--- net/sunrpc/xprtrdma/frwr_ops.c | 6 +++--- net/sunrpc/xprtrdma/verbs.c | 4 ++-- net/sunrpc/xprtrdma/xprt_rdma.h | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-)
net/sunrpc/xprtrdma/frwr_ops.c +3 -3
@@ -50,11 +50,11 @@#endif /** -* frwr_release_mr - Destroy one MR +* frwr_mr_release - Destroy one MR * @mr: MR allocated by frwr_mr_init * */ -void frwr_release_mr (struct rpcrdma_mr *mr) +void frwr_mr_release (struct rpcrdma_mr *mr) {int rc;
@@ -83,7 +83,7 @@ static void frwr_mr_recycle(struct rpcrdma_mr *mr) r_xprt->rx_stats.mrs_recycled++;spin_unlock (&r_xprt->rx_buf.rb_lock); -frwr_release_mr (mr); +frwr_mr_release (mr); }/* frwr_reset - Place MRs back on the free list
net/sunrpc/xprtrdma/verbs.c +2 -2
@@ -1100,7 +1100,7 @@ void rpcrdma_req_destroy(struct rpcrdma_req *req)list_del (&mr->mr_all);spin_unlock (&buf->rb_lock); -frwr_release_mr (mr); +frwr_mr_release (mr); }rpcrdma_regbuf_free (req->rl_recvbuf);
@@ -1131,7 +1131,7 @@ static void rpcrdma_mrs_destroy(struct rpcrdma_xprt *r_xprt)list_del (&mr->mr_all);spin_unlock (&buf->rb_lock); -frwr_release_mr (mr); +frwr_mr_release (mr);spin_lock (&buf->rb_lock); }
net/sunrpc/xprtrdma/xprt_rdma.h +1 -1
@@ -520,7 +520,7 @@ rpcrdma_data_dir(bool writing)void frwr_reset (struct rpcrdma_req *req);int frwr_query_device (struct rpcrdma_ep *ep,const struct ib_device *device);int frwr_mr_init (struct rpcrdma_xprt *r_xprt,struct rpcrdma_mr *mr); -void frwr_release_mr (struct rpcrdma_mr *mr); +void frwr_mr_release (struct rpcrdma_mr *mr); struct rpcrdma_mr_seg *frwr_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg, int nsegs, bool writing, __be32 xid,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/352 xprtrdma: Fix rpcrdma_reqs_reset()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit acd9f2dd23c632568156217aac7a05f5a0313152 ]
Avoid FastReg operations getting MW_BIND_ERR after a reconnect.
rpcrdma_reqs_reset() is called on transport tear-down to get each rpcrdma_req back into a clean state.
MRs on req->rl_registered are waiting for a FastReg, are already registered, or are waiting for invalidation. If the transport is being torn down when reqs_reset() is called, the matching LocalInv might never be posted. That leaves these MR registered /and/ on req->rl_free_mrs, where they can be re-used for the next connection.
Since xprtrdma does not keep specific track of the MR state, it's not possible to know what state these MRs are in, so the only safe thing to do is release them immediately.
--- net/sunrpc/xprtrdma/frwr_ops.c | 3 ++- net/sunrpc/xprtrdma/verbs.c | 16 +++++++++++++++- 2 files changed, 17 insertions(+), 2 deletions(-)
net/sunrpc/xprtrdma/frwr_ops.c +2 -1
@@ -86,7 +86,8 @@ static void frwr_mr_recycle(struct rpcrdma_mr *mr)frwr_mr_release (mr); } -/* frwr_reset - Place MRs back on the free list +/** +* frwr_reset - Place MRs back on @req's free list * @req: request to reset * * Used after a failed marshal. For FRWR, this means the MRs
net/sunrpc/xprtrdma/verbs.c +15 -1
@@ -932,6 +932,8 @@ static int rpcrdma_reqs_setup(struct rpcrdma_xprt *r_xprt)static void rpcrdma_req_reset (struct rpcrdma_req *req) { +struct rpcrdma_mr *mr; +/* Credits are valid for only one connection */ req->rl_slot.rq_cong =0 ;
@@ -941,7 +943,19 @@ static void rpcrdma_req_reset(struct rpcrdma_req *req)rpcrdma_regbuf_dma_unmap (req->rl_sendbuf);rpcrdma_regbuf_dma_unmap (req->rl_recvbuf); -frwr_reset (req); +/* The verbs consumer can't know the state of an MR on the +* req->rl_registered list unless a successful completion +* has occurred, so they cannot be re-used. +*/ +while ((mr =rpcrdma_mr_pop (&req->rl_registered))) { +struct rpcrdma_buffer *buf = &mr->mr_xprt->rx_buf; + +spin_lock (&buf->rb_lock); +list_del (&mr->mr_all); +spin_unlock (&buf->rb_lock); + +frwr_mr_release (mr); + } }/* ASSUMPTION: the rb_allreqs list is stable for the duration,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/352 SUNRPC: avoid soft lockup when transmitting UDP to reachable server.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
[ Upstream commit 6258cf25d5e3155c3219ab5a79b970eef7996356 ]
Prior to the commit identified below, call_transmit_status() would handle -EPERM and other errors related to an unreachable server by falling through to call_status() which added a 3-second delay and handled the failure as a timeout.
Since that commit, call_transmit_status() falls through to handle_bind(). For UDP this moves straight on to handle_connect() and handle_transmit() so we immediately retransmit - and likely get the same error.
This results in an indefinite loop in __rpc_execute() which triggers a soft-lockup warning.
For the errors that indicate an unreachable server, call_transmit_status() should fall back to call_status() as it did before. This cannot cause the thundering herd that the previous patch was avoiding, as the call_status() will insert a delay.
--- net/sunrpc/clnt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sunrpc/clnt.c +2 -1
@@ -2188,12 +2188,13 @@ call_transmit_status(struct rpc_task *task) task->tk_action = call_transmit; task->tk_status =0 ;break ; -case -ECONNREFUSED :case -EHOSTDOWN :case -ENETDOWN :case -EHOSTUNREACH :case -ENETUNREACH :case -EPERM : +break ; +case -ECONNREFUSED :if (RPC_IS_SOFTCONN (task)) {if (!task->tk_msg.rpc_proc->p_proc) trace_xprt_ping(task->tk_xprt,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/352 ext4: avoid writing unitialized memory to disk in EA inodes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 65121eff3e4c8c90f8126debf3c369228691c591 ]
If the extended attribute size is not a multiple of block size, the last block in the EA inode will have uninitialized tail which will get written to disk. We will never expose the data to userspace but still this is not a good practice so just zero out the tail of the block as it isn't going to cause a noticeable performance overhead.
--- fs/ext4/xattr.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ext4/xattr.c +6 -0
@@ -1377,6 +1377,12 @@ static int ext4_xattr_inode_write(handle_t *handle, struct inode *ea_inode, goto out;memcpy (bh->b_data, buf, csize); +/* +* Zero out block tail to avoid writing uninitialized memory +* to disk. +*/ +if (csize < blocksize) +memset (bh->b_data + csize,0 , blocksize - csize);set_buffer_uptodate (bh);ext4_handle_dirty_metadata (handle, ea_inode, bh);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/352 sparc64: Fix incorrect function signature and add prototype for prom_cif_init
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Larsson <[email protected]>
[ Upstream commit a6c3ea1ec96307dbfbb2f16d96c674c5cc80f445 ]
Remove the unused cif_stack argument and add a protype in oplib_64.h Commit ef3e035c3a9b ("sparc64: Fix register corruption in top-most kernel stack frame during boot.") removed the cif_stack argument to prom_cif init in the declaration at the caller site and the usage of it within prom_cif_init, but not in the function signature of the function itself.
This also fixes the following warning:arch/sparc/prom/p1275.c:52:6: warning: no previous prototype for ‘prom_cif_init’
--- arch/sparc/include/asm/oplib_64.h | 1 + arch/sparc/prom/init_64.c | 3 --- arch/sparc/prom/p1275.c | 2 +- 3 files changed, 2 insertions(+), 4 deletions(-)
arch/sparc/include/asm/oplib_64.h +1 -0
@@ -247,6 +247,7 @@ void prom_sun4v_guest_soft_state(void);int prom_ihandle2path (int handle,char *buffer,int bufsize);/* Client interface level routines. */ +void prom_cif_init (void *cif_handler);void p1275_cmd_direct (unsigned long *);#endif /* !(__SPARC64_OPLIB_H) */
arch/sparc/prom/init_64.c +0 -3
@@ -26,9 +26,6 @@ phandle prom_chosen_node;* routines in the prom library. * It gets passed the pointer to the PROM vector. */ - -extern void prom_cif_init (void *); -void __init prom_init (void *cif_handler) {phandle node;
arch/sparc/prom/p1275.c +1 -1
@@ -49,7 +49,7 @@ void p1275_cmd_direct(unsigned long *args)local_irq_restore (flags); } -void prom_cif_init (void *cif_handler,void *cif_stack) +void prom_cif_init (void *cif_handler) { p1275buf.prom_cif_handler = (void (*)(long *))cif_handler; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/352 SUNRPC: Fixup gss_status tracepoint error output
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <[email protected]>
[ Upstream commit b9fae9f06d84ffab0f3f9118f3a96bbcdc528bf6 ]
The GSS routine errors are values, not flags.
--- include/trace/events/rpcgss.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/trace/events/rpcgss.h +1 -1
@@ -52,7 +52,7 @@ TRACE_DEFINE_ENUM(GSS_S_UNSEQ_TOKEN);TRACE_DEFINE_ENUM (GSS_S_GAP_TOKEN );#define show_gss_status (x) \ - __print_flags(x, "|", \ + __print_symbolic(x, \ { GSS_S_BAD_MECH, "GSS_S_BAD_MECH" }, \ { GSS_S_BAD_NAME, "GSS_S_BAD_NAME" }, \ { GSS_S_BAD_NAMETYPE, "GSS_S_BAD_NAMETYPE" }, \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/352 PCI: Fix resource double counting on remove & rescan
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 903534fa7d30214d8ba840ab1cd9e917e0c88e41 ]
pbus_size_mem() keeps the size of the optional resources in children_add_size. When calculating the PCI bridge window size, calculate_memsize() lower bounds size by old_size before adding children_add_size and performing the window size alignment. This results in double counting for the resources in children_add_size because old_size may be based on the previous size of the bridge window after it has already included children_add_size (that is, size1 in pbus_size_mem() from an earlier invocation of that function).
As a result, on repeated remove of the bus & rescan cycles the resource size keeps increasing when children_add_size is non-zero as can be seen from this extract:
iomem0: 23fffd00000-23fffdfffff : PCI Bus 0000:03 # 1MiB iomem1: 20000000000-200001fffff : PCI Bus 0000:03 # 2MiB iomem2: 20000000000-200002fffff : PCI Bus 0000:03 # 3MiB iomem3: 20000000000-200003fffff : PCI Bus 0000:03 # 4MiB iomem4: 20000000000-200004fffff : PCI Bus 0000:03 # 5MiB
Solve the double counting by moving old_size check later in calculate_memsize() so that children_add_size is already accounted for.
After the patch, the bridge window retains its size as expected:
iomem0: 23fffd00000-23fffdfffff : PCI Bus 0000:03 # 1MiB iomem1: 20000000000-200000fffff : PCI Bus 0000:03 # 1MiB iomem2: 20000000000-200000fffff : PCI Bus 0000:03 # 1MiB
--- drivers/pci/setup-bus.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/pci/setup-bus.c +2 -4
@@ -824,11 +824,9 @@ static resource_size_t calculate_memsize(resource_size_t size, size = min_size;if (old_size ==1 ) old_size =0 ; -if (size < old_size) - size = old_size; - size =ALIGN (max (size, add_size) + children_add_size, align); -return size; + size =max (size, add_size) + children_add_size; +return ALIGN (max (size, old_size), align); } resource_size_t __weak pcibios_window_alignment(struct pci_bus *bus,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/352 coresight: Fix ref leak when of_coresight_parse_endpoint() fails
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <[email protected]>
[ Upstream commit 7fcb9cb2fe47294e16067c3cfd25332c8662a115 ]
of_graph_get_next_endpoint() releases the reference to the previous endpoint on each iteration, but when parsing fails the loop exits early meaning the last reference is never dropped.
Fix it by dropping the refcount in the exit condition.
--- drivers/hwtracing/coresight/coresight-platform.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/hwtracing/coresight/coresight-platform.c +3 -1
@@ -323,8 +323,10 @@ static int of_get_coresight_platform_data(struct device *dev,continue ; ret =of_coresight_parse_endpoint (dev, ep, pdata); -if (ret) +if (ret) { +of_node_put (ep);return ret; + } }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/352 Input: qt1050 - handle CHIP_ID reading error
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Lalaev <[email protected]>
[ Upstream commit 866a5c7e2781cf1b019072288f1f5c64186dcb63 ]
If the device is missing, we get the following error:
qt1050 3-0041: ID -1340767592 not supported
Let's handle this situation and print more informative error when reading of CHIP_ID fails:
qt1050 3-0041: Failed to read chip ID: -6
--- drivers/input/keyboard/qt1050.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/input/keyboard/qt1050.c +6 -1
@@ -226,7 +226,12 @@ static bool qt1050_identify(struct qt1050_priv *ts)int err;/* Read Chip ID */ -regmap_read (ts->regmap,QT1050_CHIP_ID , &val); + err =regmap_read (ts->regmap,QT1050_CHIP_ID , &val); +if (err) { +dev_err (&ts->client->dev,"Failed to read chip ID: %d\n" , err); +return false; + } +if (val !=QT1050_CHIP_ID_VER ) {dev_err (&ts->client->dev,"ID %d not supported\n" , val);return false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/352 RDMA/mlx4: Fix truncated output warning in mad.c
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 0d2e6992fc956e3308cd5376c18567def4cb3967 ]
Increase size of the name array to avoid truncated output warning.
drivers/infiniband/hw/mlx4/mad.c: In function ‘mlx4_ib_alloc_demux_ctx’:drivers/infiniband/hw/mlx4/mad.c:2197:47: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 4 [-Werror=format-truncation=]
2197 | snprintf(name, sizeof(name), "mlx4_ibt%d", port);
| ^~drivers/infiniband/hw/mlx4/mad.c:2197:38: note: directive argument in the range [-2147483645, 2147483647]
2197 | snprintf(name, sizeof(name), "mlx4_ibt%d", port);
| ^~~~~~~~~~~~
drivers/infiniband/hw/mlx4/mad.c:2197:9: note: ‘snprintf’ output between
10 and 20 bytes into a destination of size 12
2197 | snprintf(name, sizeof(name), "mlx4_ibt%d", port);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~drivers/infiniband/hw/mlx4/mad.c:2205:48: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 3 [-Werror=format-truncation=]
2205 | snprintf(name, sizeof(name), "mlx4_ibwi%d", port);
| ^~drivers/infiniband/hw/mlx4/mad.c:2205:38: note: directive argument in the range [-2147483645, 2147483647]
2205 | snprintf(name, sizeof(name), "mlx4_ibwi%d", port);
| ^~~~~~~~~~~~~
drivers/infiniband/hw/mlx4/mad.c:2205:9: note: ‘snprintf’ output between
11 and 21 bytes into a destination of size 12
2205 | snprintf(name, sizeof(name), "mlx4_ibwi%d", port);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~drivers/infiniband/hw/mlx4/mad.c:2213:48: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 3 [-Werror=format-truncation=]
2213 | snprintf(name, sizeof(name), "mlx4_ibud%d", port);
| ^~drivers/infiniband/hw/mlx4/mad.c:2213:38: note: directive argument in the range [-2147483645, 2147483647]
2213 | snprintf(name, sizeof(name), "mlx4_ibud%d", port);
| ^~~~~~~~~~~~~
drivers/infiniband/hw/mlx4/mad.c:2213:9: note: ‘snprintf’ output between
11 and 21 bytes into a destination of size 12
2213 | snprintf(name, sizeof(name), "mlx4_ibud%d", port);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~cc1: all warnings being treated as errors
make[6]: *** [scripts/Makefile.build:244: drivers/infiniband/hw/mlx4/mad.o] Error 1
--- drivers/infiniband/hw/mlx4/mad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/mlx4/mad.c +1 -1
@@ -2155,7 +2155,7 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev,struct mlx4_ib_demux_ctx *ctx, int port) { - char name[12]; + char name[21];int ret =0 ;int i;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/352 RDMA/mlx4: Fix truncated output warning in alias_GUID.c
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 5953e0647cec703ef436ead37fed48943507b433 ]
drivers/infiniband/hw/mlx4/alias_GUID.c: In function ‘mlx4_ib_init_alias_guid_service’:drivers/infiniband/hw/mlx4/alias_GUID.c:878:74: error: ‘%d’ directive
output may be truncated writing between 1 and 11 bytes into a region of
size 5 [-Werror=format-truncation=]
878 | snprintf(alias_wq_name, sizeof alias_wq_name, "alias_guid%d", i);
| ^~drivers/infiniband/hw/mlx4/alias_GUID.c:878:63: note: directive argument in the range [-2147483641, 2147483646]
878 | snprintf(alias_wq_name, sizeof alias_wq_name, "alias_guid%d", i);
| ^~~~~~~~~~~~~~drivers/infiniband/hw/mlx4/alias_GUID.c:878:17: note: ‘snprintf’ output
between 12 and 22 bytes into a destination of size 15
878 | snprintf(alias_wq_name, sizeof alias_wq_name, "alias_guid%d", i);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~cc1: all warnings being treated as errors
--- drivers/infiniband/hw/mlx4/alias_GUID.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/mlx4/alias_GUID.c +1 -1
@@ -832,7 +832,7 @@ void mlx4_ib_destroy_alias_guid_service(struct mlx4_ib_dev *dev)int mlx4_ib_init_alias_guid_service (struct mlx4_ib_dev *dev) { -char alias_wq_name[15 ]; +char alias_wq_name[22 ];int ret =0 ;int i, j;union ib_gid gid;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/352 RDMA/rxe: Dont set BTH_ACK_MASK for UC or UD QPs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Honggang LI <[email protected]>
[ Upstream commit 4adcaf969d77d3d3aa3871bbadc196258a38aec6 ]
BTH_ACK_MASK bit is used to indicate that an acknowledge (for this packet) should be scheduled by the responder. Both UC and UD QPs are unacknowledged, so don't set BTH_ACK_MASK for UC or UD QPs.
--- drivers/infiniband/sw/rxe/rxe_req.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/infiniband/sw/rxe/rxe_req.c +4 -3
@@ -362,7 +362,7 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp,int solicited;u16 pkey;u32 qp_num; -int ack_req; +int ack_req =0 ;/* length from start of bth to end of icrc */ paylen = rxe_opcode[opcode].length + payload + pad +RXE_ICRC_SIZE ;
@@ -396,8 +396,9 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp, qp_num = (pkt->mask &RXE_DETH_MASK ) ? ibwr->wr.ud.remote_qpn : qp->attr.dest_qp_num; - ack_req = ((pkt->mask &RXE_END_MASK ) || - (qp->req.noack_pkts++ >RXE_MAX_PKT_PER_ACK )); +if (qp_type (qp) !=IB_QPT_UD &&qp_type (qp) !=IB_QPT_UC ) + ack_req = ((pkt->mask &RXE_END_MASK ) || + (qp->req.noack_pkts++ >RXE_MAX_PKT_PER_ACK ));if (ack_req) qp->req.noack_pkts =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/352 ASoC: max98088: Check for clk_prepare_enable() error
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit 1a70579723fde3624a72dfea6e79e55be6e36659 ]
clk_prepare_enable() may fail, so we should better check its return value and propagate it in the case of error.
--- sound/soc/codecs/max98088.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
sound/soc/codecs/max98088.c +7 -3
@@ -1319,6 +1319,7 @@ static int max98088_set_bias_level(struct snd_soc_component *component, enum snd_soc_bias_level level) {struct max98088_priv *max98088 =snd_soc_component_get_drvdata (component); +int ret;switch (level) {case SND_SOC_BIAS_ON :
@@ -1334,10 +1335,13 @@ static int max98088_set_bias_level(struct snd_soc_component *component,*/ if (!IS_ERR (max98088->mclk)) {if (snd_soc_component_get_bias_level (component) == -SND_SOC_BIAS_ON ) +SND_SOC_BIAS_ON ) {clk_disable_unprepare (max98088->mclk); -else -clk_prepare_enable (max98088->mclk); + }else { + ret =clk_prepare_enable (max98088->mclk); +if (ret) +return ret; + } }break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/352 mtd: make mtd_test.c a separate module
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit a5cf054d325e6f362e82fe6d124a1871a4af8174 ]
This file gets linked into nine different modules, which causes a warning:
scripts/Makefile.build:236: drivers/mtd/tests/Makefile: mtd_test.o is added to multiple modules: mtd_nandbiterrs mtd_oobtest mtd_pagetest mtd_readtest mtd_speedtest mtd_stresstest mtd_subpagetest mtd_torturetest
Make it a separate module instead.
--- drivers/mtd/tests/Makefile | 34 +++++++++++++++++----------------- drivers/mtd/tests/mtd_test.c | 9 +++++++++ 2 files changed, 26 insertions(+), 17 deletions(-)
drivers/mtd/tests/Makefile +17 -17
@@ -1,19 +1,19 @@ # SPDX-License-Identifier: GPL-2.0 -obj-$(CONFIG_MTD_TESTS) += mtd_oobtest.o -obj-$(CONFIG_MTD_TESTS) += mtd_pagetest.o -obj-$(CONFIG_MTD_TESTS) += mtd_readtest.o -obj-$(CONFIG_MTD_TESTS) += mtd_speedtest.o -obj-$(CONFIG_MTD_TESTS) += mtd_stresstest.o -obj-$(CONFIG_MTD_TESTS) += mtd_subpagetest.o -obj-$(CONFIG_MTD_TESTS) += mtd_torturetest.o -obj-$(CONFIG_MTD_TESTS) += mtd_nandecctest.o -obj-$(CONFIG_MTD_TESTS) += mtd_nandbiterrs.o +obj-$(CONFIG_MTD_TESTS) += mtd_oobtest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_pagetest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_readtest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_speedtest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_stresstest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_subpagetest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_torturetest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_nandecctest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_nandbiterrs.o mtd_test.o -mtd_oobtest-objs := oobtest.o mtd_test.o -mtd_pagetest-objs := pagetest.o mtd_test.o -mtd_readtest-objs := readtest.o mtd_test.o -mtd_speedtest-objs := speedtest.o mtd_test.o -mtd_stresstest-objs := stresstest.o mtd_test.o -mtd_subpagetest-objs := subpagetest.o mtd_test.o -mtd_torturetest-objs := torturetest.o mtd_test.o -mtd_nandbiterrs-objs := nandbiterrs.o mtd_test.o +mtd_oobtest-objs := oobtest.o +mtd_pagetest-objs := pagetest.o +mtd_readtest-objs := readtest.o +mtd_speedtest-objs := speedtest.o +mtd_stresstest-objs := stresstest.o +mtd_subpagetest-objs := subpagetest.o +mtd_torturetest-objs := torturetest.o +mtd_nandbiterrs-objs := nandbiterrs.o
drivers/mtd/tests/mtd_test.c +9 -0
@@ -25,6 +25,7 @@ int mtdtest_erase_eraseblock(struct mtd_info *mtd, unsigned int ebnum)return 0 ; } +EXPORT_SYMBOL_GPL (mtdtest_erase_eraseblock);static int is_block_bad (struct mtd_info *mtd,unsigned int ebnum) {
@@ -57,6 +58,7 @@ int mtdtest_scan_for_bad_eraseblocks(struct mtd_info *mtd, unsigned char *bbt,return 0 ; } +EXPORT_SYMBOL_GPL (mtdtest_scan_for_bad_eraseblocks);int mtdtest_erase_good_eraseblocks (struct mtd_info *mtd,unsigned char *bbt,unsigned int eb,int ebcnt)
@@ -75,6 +77,7 @@ int mtdtest_erase_good_eraseblocks(struct mtd_info *mtd, unsigned char *bbt,return 0 ; } +EXPORT_SYMBOL_GPL (mtdtest_erase_good_eraseblocks);int mtdtest_read (struct mtd_info *mtd,loff_t addr,size_t size,void *buf) {
@@ -92,6 +95,7 @@ int mtdtest_read(struct mtd_info *mtd, loff_t addr, size_t size, void *buf)return err; } +EXPORT_SYMBOL_GPL (mtdtest_read);int mtdtest_write (struct mtd_info *mtd,loff_t addr,size_t size,const void *buf)
@@ -107,3 +111,8 @@ int mtdtest_write(struct mtd_info *mtd, loff_t addr, size_t size,return err; } +EXPORT_SYMBOL_GPL (mtdtest_write); + +MODULE_LICENSE ("GPL" ); +MODULE_DESCRIPTION ("MTD function test helpers" ); +MODULE_AUTHOR ("Akinobu Mita" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/352 RDMA/device: Return error earlier if port in not valid
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 917918f57a7b139c043e78c502876f2c286f4f0a ]
There is no need to allocate port data if port provided is not valid.
--- drivers/infiniband/core/device.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/infiniband/core/device.c +3 -3
@@ -2106,6 +2106,9 @@ int ib_device_set_netdev(struct ib_device *ib_dev, struct net_device *ndev,unsigned long flags;int ret; +if (!rdma_is_port_valid (ib_dev, port)) +return -EINVAL ; +/* * Drivers wish to call this before ib_register_driver, so we have to * setup the port data early.
@@ -2114,9 +2117,6 @@ int ib_device_set_netdev(struct ib_device *ib_dev, struct net_device *ndev,if (ret)return ret; -if (!rdma_is_port_valid (ib_dev, port)) -return -EINVAL ; - pdata = &ib_dev->port_data[port];spin_lock_irqsave (&pdata->netdev_lock, flags); old_ndev = rcu_dereference_protected(
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/352 Input: elan_i2c - do not leave interrupt disabled on suspend failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit 5f82c1e04721e7cd98e604eb4e58f0724d8e5a65 ]
Make sure interrupts are not left disabled when we fail to suspend the touch controller.
--- drivers/input/mouse/elan_i2c_core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/input/mouse/elan_i2c_core.c +2 -0
@@ -1340,6 +1340,8 @@ static int __maybe_unused elan_suspend(struct device *dev) } err: +if (ret) +enable_irq (client->irq);mutex_unlock (&data->sysfs_mutex);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/352 MIPS: Octeron: remove source file executable bit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dominique Martinet <[email protected]>
[ Upstream commit 89c7f5078935872cf47a713a645affb5037be694 ]
This does not matter the least, but there is no other .[ch] file in the repo that is executable, so clean this up.
--- arch/mips/pci/pcie-octeon.c | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100755 => 100644 arch/mips/pci/pcie-octeon.c
arch/mips/pci/pcie-octeon.c +0 -0
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/352 powerpc/xmon: Fix disassembly CPU feature checks
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit 14196e47c5ffe32af7ed5a51c9e421c5ea5bccce ]
In the xmon disassembly code there are several CPU feature checks to determine what dialects should be passed to the disassembler. The dialect controls which instructions the disassembler will recognise.
Unfortunately the checks are incorrect, because instead of passing a single CPU feature they are passing a mask of feature bits.
For example the code:
if (cpu_has_feature(CPU_FTRS_POWER5))
dialect |= PPC_OPCODE_POWER5;Is trying to check if the system is running on a Power5 CPU. But CPU_FTRS_POWER5 is a mask of *all* the feature bits that are enabled on a Power5.
In practice the test will always return true for any 64-bit CPU, because at least one bit in the mask will be present in the CPU_FTRS_ALWAYS mask.
Similarly for all the other checks against CPU_FTRS_xx masks.
Rather than trying to match the disassembly behaviour exactly to the current CPU, just differentiate between 32-bit and 64-bit, and Altivec, VSX and HTM.
That will cause some instructions to be shown in disassembly even on a CPU that doesn't support them, but that's OK, objdump -d output has the same behaviour, and if anything it's less confusing than some instructions not being disassembled.
--- arch/powerpc/xmon/ppc-dis.c | 33 +++++++++++---------------------- 1 file changed, 11 insertions(+), 22 deletions(-)
arch/powerpc/xmon/ppc-dis.c +11 -22
@@ -122,32 +122,21 @@ int print_insn_powerpc (unsigned long insn, unsigned long memaddr)bool insn_is_short;ppc_cpu_t dialect; - dialect =PPC_OPCODE_PPC |PPC_OPCODE_COMMON - |PPC_OPCODE_64 |PPC_OPCODE_POWER4 |PPC_OPCODE_ALTIVEC ; + dialect =PPC_OPCODE_PPC |PPC_OPCODE_COMMON ; -if (cpu_has_feature (CPU_FTRS_POWER5 )) - dialect |=PPC_OPCODE_POWER5 ; +if (IS_ENABLED (CONFIG_PPC64 )) + dialect |=PPC_OPCODE_64 |PPC_OPCODE_POWER4 |PPC_OPCODE_CELL | +PPC_OPCODE_POWER5 |PPC_OPCODE_POWER6 |PPC_OPCODE_POWER7 |PPC_OPCODE_POWER8 | +PPC_OPCODE_POWER9 ; -if (cpu_has_feature (CPU_FTRS_CELL )) - dialect |= (PPC_OPCODE_CELL |PPC_OPCODE_ALTIVEC ); +if (cpu_has_feature (CPU_FTR_TM )) + dialect |=PPC_OPCODE_HTM ; -if (cpu_has_feature (CPU_FTRS_POWER6 )) - dialect |= (PPC_OPCODE_POWER5 |PPC_OPCODE_POWER6 |PPC_OPCODE_ALTIVEC ); +if (cpu_has_feature (CPU_FTR_ALTIVEC )) + dialect |=PPC_OPCODE_ALTIVEC |PPC_OPCODE_ALTIVEC2 ; -if (cpu_has_feature (CPU_FTRS_POWER7 )) - dialect |= (PPC_OPCODE_POWER5 |PPC_OPCODE_POWER6 |PPC_OPCODE_POWER7 - |PPC_OPCODE_ALTIVEC |PPC_OPCODE_VSX ); - -if (cpu_has_feature (CPU_FTRS_POWER8 )) - dialect |= (PPC_OPCODE_POWER5 |PPC_OPCODE_POWER6 |PPC_OPCODE_POWER7 - |PPC_OPCODE_POWER8 |PPC_OPCODE_HTM - |PPC_OPCODE_ALTIVEC |PPC_OPCODE_ALTIVEC2 |PPC_OPCODE_VSX ); - -if (cpu_has_feature (CPU_FTRS_POWER9 )) - dialect |= (PPC_OPCODE_POWER5 |PPC_OPCODE_POWER6 |PPC_OPCODE_POWER7 - |PPC_OPCODE_POWER8 |PPC_OPCODE_POWER9 |PPC_OPCODE_HTM - |PPC_OPCODE_ALTIVEC |PPC_OPCODE_ALTIVEC2 - |PPC_OPCODE_VSX |PPC_OPCODE_VSX3 ); +if (cpu_has_feature (CPU_FTR_VSX )) + dialect |=PPC_OPCODE_VSX |PPC_OPCODE_VSX3 ;/* Get the major opcode of the insn. */ opcode =NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/352 macintosh/therm_windtunnel: fix module unload.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nick Bowler <[email protected]>
[ Upstream commit fd748e177194ebcbbaf98df75152a30e08230cc6 ]
The of_device_unregister call in therm_windtunnel's module_exit procedure does not fully reverse the effects of of_platform_device_create in the module_init prodedure. Once you unload this module, it is impossible to load it ever again since only the first of_platform_device_create call on the fan node succeeds.
This driver predates first git commit, and it turns out back then of_platform_device_create worked differently than it does today. So this is actually an old regression.
The appropriate function to undo of_platform_device_create now appears to be of_platform_device_destroy, and switching to use this makes it possible to unload and load the module as expected.
--- drivers/macintosh/therm_windtunnel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/macintosh/therm_windtunnel.c +1 -1
@@ -549,7 +549,7 @@ g4fan_exit( void )platform_driver_unregister ( &therm_of_driver );if ( x.of_dev ) -of_device_unregister ( x.of_dev ); +of_platform_device_destroy (&x.of_dev->dev,NULL ); }module_init (g4fan_init);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/352 RDMA/hns: Fix missing pagesize and alignment check in FRMR
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengchang Tang <[email protected]>
[ Upstream commit d387d4b54eb84208bd4ca13572e106851d0a0819 ]
The offset requires 128B alignment and the page size ranges from 4K to 128M.
--- drivers/infiniband/hw/hns/hns_roce_device.h | 4 ++++ drivers/infiniband/hw/hns/hns_roce_mr.c | 5 +++++ 2 files changed, 9 insertions(+)
drivers/infiniband/hw/hns/hns_roce_device.h +4 -0
@@ -98,6 +98,7 @@#define MR_TYPE_DMA 0x03#define HNS_ROCE_FRMR_MAX_PA 512 +#define HNS_ROCE_FRMR_ALIGN_SIZE 128#define PKEY_ID 0xffff#define GUID_LEN 8
@@ -267,6 +268,9 @@ enum {#define HNS_HW_PAGE_SHIFT 12#define HNS_HW_PAGE_SIZE (1 << HNS_HW_PAGE_SHIFT) +#define HNS_HW_MAX_PAGE_SHIFT 27 +#define HNS_HW_MAX_PAGE_SIZE (1 << HNS_HW_MAX_PAGE_SHIFT) +struct hns_roce_uar {u64 pfn;unsigned long index;
drivers/infiniband/hw/hns/hns_roce_mr.c +5 -0
@@ -486,6 +486,11 @@ int hns_roce_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents,struct hns_roce_mtr *mtr = &mr->pbl_mtr;int ret, sg_num =0 ; +if (!IS_ALIGNED (*sg_offset,HNS_ROCE_FRMR_ALIGN_SIZE ) || + ibmr->page_size <HNS_HW_PAGE_SIZE || + ibmr->page_size >HNS_HW_MAX_PAGE_SIZE ) +return sg_num; + mr->npages =0 ; mr->page_list =kvcalloc (mr->pbl_mtr.hem_cfg.buf_pg_count,sizeof (dma_addr_t),GFP_KERNEL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/352 bnxt_re: Fix imm_data endianness
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Wang <[email protected]>
[ Upstream commit 95b087f87b780daafad1dbb2c84e81b729d5d33f ]
When map a device between servers with MLX and BCM RoCE nics, RTRS server complain about unknown imm type, and can't map the device,
After more debug, it seems bnxt_re wrongly handle the imm_data, this patch fixed the compat issue with MLX for us.
In off list discussion, Selvin confirmed HW is working in little endian format and all data needs to be converted to LE while providing.
This patch fix the endianness for imm_data
--- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 ++++---- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-)
drivers/infiniband/hw/bnxt_re/ib_verbs.c +4 -4
@@ -2357,7 +2357,7 @@ static int bnxt_re_build_send_wqe(struct bnxt_re_qp *qp,break ;case IB_WR_SEND_WITH_IMM : wqe->type =BNXT_QPLIB_SWQE_TYPE_SEND_WITH_IMM ; - wqe->send.imm_data = wr->ex.imm_data; + wqe->send.imm_data =be32_to_cpu (wr->ex.imm_data);break ;case IB_WR_SEND_WITH_INV : wqe->type =BNXT_QPLIB_SWQE_TYPE_SEND_WITH_INV ;
@@ -2387,7 +2387,7 @@ static int bnxt_re_build_rdma_wqe(const struct ib_send_wr *wr,break ;case IB_WR_RDMA_WRITE_WITH_IMM : wqe->type =BNXT_QPLIB_SWQE_TYPE_RDMA_WRITE_WITH_IMM ; - wqe->rdma.imm_data = wr->ex.imm_data; + wqe->rdma.imm_data =be32_to_cpu (wr->ex.imm_data);break ;case IB_WR_RDMA_READ : wqe->type =BNXT_QPLIB_SWQE_TYPE_RDMA_READ ;
@@ -3334,7 +3334,7 @@ static void bnxt_re_process_res_shadow_qp_wc(struct bnxt_re_qp *gsi_sqp, wc->byte_len = orig_cqe->length; wc->qp = &gsi_qp->ib_qp; - wc->ex.imm_data = orig_cqe->immdata; + wc->ex.imm_data =cpu_to_be32 (le32_to_cpu (orig_cqe->immdata)); wc->src_qp = orig_cqe->src_qp;memcpy (wc->smac, orig_cqe->smac,ETH_ALEN );if (bnxt_re_is_vlan_pkt (orig_cqe, &vlan_id, &sl)) {
@@ -3474,7 +3474,7 @@ int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc)continue ; } wc->qp = &qp->ib_qp; - wc->ex.imm_data = cqe->immdata; + wc->ex.imm_data =cpu_to_be32 (le32_to_cpu (cqe->immdata)); wc->src_qp = cqe->src_qp;memcpy (wc->smac, cqe->smac,ETH_ALEN ); wc->port_num =1 ;
drivers/infiniband/hw/bnxt_re/qplib_fp.h +3 -3
@@ -162,7 +162,7 @@ struct bnxt_qplib_swqe {/* Send, with imm, inval key */ struct {union { -__be32 imm_data; +u32 imm_data;u32 inv_key; };u32 q_key;
@@ -180,7 +180,7 @@ struct bnxt_qplib_swqe {/* RDMA write, with imm, read */ struct {union { -__be32 imm_data; +u32 imm_data;u32 inv_key; };u64 remote_va;
@@ -372,7 +372,7 @@ struct bnxt_qplib_cqe {u16 cfa_meta;u64 wr_id;union { -__be32 immdata; +__le32 immdata;u32 invrkey; };u64 qp_handle;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/352 netfilter: ctnetlink: use helper function to calculate expect ID
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 782161895eb4ac45cf7cfa8db375bd4766cb8299 ]
Delete expectation path is missing a call to the nf_expect_get_id() helper function to calculate the expectation ID, otherwise LSB of the expectation object address is leaked to userspace.
--- net/netfilter/nf_conntrack_netlink.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/netfilter/nf_conntrack_netlink.c +2 -1
@@ -3413,7 +3413,8 @@ static int ctnetlink_del_expect(struct net *net, struct sock *ctnl,if (cda[CTA_EXPECT_ID ]) {__be32 id =nla_get_be32 (cda[CTA_EXPECT_ID ]); -if (ntohl (id) != (u32 )(unsigned long )exp) { + +if (id !=nf_expect_get_id (exp)) {nf_ct_expect_put (exp);return -ENOENT ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/352 net: dsa: mv88e6xxx: Limit chip-wide frame size config to CPU ports
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Willi <[email protected]>
[ Upstream commit 66b6095c264e1b4e0a441c6329861806504e06c6 ]
Marvell chips not supporting per-port jumbo frame size configurations use a chip-wide frame size configuration. In the commit referenced with the Fixes tag, the setting is applied just for the last port changing its MTU.
While configuring CPU ports accounts for tagger overhead, user ports do not. When setting the MTU for a user port, the chip-wide setting is reduced to not include the tagger overhead, resulting in an potentially insufficient maximum frame size for the CPU port. Specifically, sending full-size frames from the CPU port on a MV88E6097 having a user port MTU of 1500 bytes results in dropped frames.
As, by design, the CPU port MTU is adjusted for any user port change, apply the chip-wide setting only for CPU ports.
--- drivers/net/dsa/mv88e6xxx/chip.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/dsa/mv88e6xxx/chip.c +2 -1
@@ -2774,7 +2774,8 @@ static int mv88e6xxx_change_mtu(struct dsa_switch *ds, int port, int new_mtu)mv88e6xxx_reg_lock (chip);if (chip->info->ops->port_set_jumbo_size) ret = chip->info->ops->port_set_jumbo_size (chip, port, new_mtu); -else if (chip->info->ops->set_max_frame_size) +else if (chip->info->ops->set_max_frame_size && +dsa_is_cpu_port (ds, port)) ret = chip->info->ops->set_max_frame_size (chip, new_mtu);mv88e6xxx_reg_unlock (chip);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/352 net: dsa: b53: Limit chip-wide jumbo frame config to CPU ports
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Willi <[email protected]>
[ Upstream commit c5118072e228e7e4385fc5ac46b2e31cf6c4f2d3 ]
Broadcom switches supported by the b53 driver use a chip-wide jumbo frame configuration. In the commit referenced with the Fixes tag, the setting is applied just for the last port changing its MTU.
While configuring CPU ports accounts for tagger overhead, user ports do not. When setting the MTU for a user port, the chip-wide setting is reduced to not include the tagger overhead, resulting in an potentially insufficient chip-wide maximum frame size for the CPU port.
As, by design, the CPU port MTU is adjusted for any user port change, apply the chip-wide setting only for CPU ports. This aligns the driver to the behavior of other switch drivers.
--- drivers/net/dsa/b53/b53_common.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/dsa/b53/b53_common.c +3 -0
@@ -2180,6 +2180,9 @@ static int b53_change_mtu(struct dsa_switch *ds, int port, int mtu)if (is5325 (dev) ||is5365 (dev))return -EOPNOTSUPP ; +if (!dsa_is_cpu_port (ds, port)) +return 0 ; + enable_jumbo = (mtu >=JMS_MIN_SIZE ); allow_10_100 = (dev->chip_id ==BCM583XX_DEVICE_ID );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/352 pinctrl: rockchip: update rk3308 iomux routes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Yashin <[email protected]>
[ Upstream commit a8f2548548584549ea29d43431781d67c4afa42b ]
Some of the rk3308 iomux routes in rk3308_mux_route_data belong to the rk3308b SoC. Remove them and correct i2c3 routes.
--- drivers/pinctrl/pinctrl-rockchip.c | 17 ++--------------- 1 file changed, 2 insertions(+), 15 deletions(-)
drivers/pinctrl/pinctrl-rockchip.c +2 -15
@@ -720,9 +720,8 @@ static struct rockchip_mux_route_data rk3308_mux_route_data[] = {RK_MUXROUTE_SAME (0 ,RK_PC3 ,1 ,0x314 ,BIT (16 +0 ) |BIT (0 )),/* rtc_clk */ RK_MUXROUTE_SAME (1 ,RK_PC6 ,2 ,0x314 ,BIT (16 +2 ) |BIT (16 +3 )),/* uart2_rxm0 */ RK_MUXROUTE_SAME (4 ,RK_PD2 ,2 ,0x314 ,BIT (16 +2 ) |BIT (16 +3 ) |BIT (2 )),/* uart2_rxm1 */ -RK_MUXROUTE_SAME (0 ,RK_PB7 ,2 ,0x608 ,BIT (16 +8 ) |BIT (16 +9 )),/* i2c3_sdam0 */ -RK_MUXROUTE_SAME (3 ,RK_PB4 ,2 ,0x608 ,BIT (16 +8 ) |BIT (16 +9 ) |BIT (8 )),/* i2c3_sdam1 */ -RK_MUXROUTE_SAME (2 ,RK_PA0 ,3 ,0x608 ,BIT (16 +8 ) |BIT (16 +9 ) |BIT (9 )),/* i2c3_sdam2 */ +RK_MUXROUTE_SAME (0 ,RK_PB7 ,2 ,0x314 ,BIT (16 +4 )),/* i2c3_sdam0 */ +RK_MUXROUTE_SAME (3 ,RK_PB4 ,2 ,0x314 ,BIT (16 +4 ) |BIT (4 )),/* i2c3_sdam1 */ RK_MUXROUTE_SAME (1 ,RK_PA3 ,2 ,0x308 ,BIT (16 +3 )),/* i2s-8ch-1-sclktxm0 */ RK_MUXROUTE_SAME (1 ,RK_PA4 ,2 ,0x308 ,BIT (16 +3 )),/* i2s-8ch-1-sclkrxm0 */ RK_MUXROUTE_SAME(1, RK_PB5, 2, 0x308, BIT(16 + 3) | BIT(3)), /* i2s-8ch-1-sclktxm1 */
@@ -731,18 +730,6 @@ static struct rockchip_mux_route_data rk3308_mux_route_data[] = {RK_MUXROUTE_SAME (1 ,RK_PB6 ,4 ,0x308 ,BIT (16 +12 ) |BIT (16 +13 ) |BIT (12 )),/* pdm-clkm1 */ RK_MUXROUTE_SAME (2 ,RK_PA6 ,2 ,0x308 ,BIT (16 +12 ) |BIT (16 +13 ) |BIT (13 )),/* pdm-clkm2 */ RK_MUXROUTE_SAME(2, RK_PA4, 3, 0x600, BIT(16 + 2) | BIT(2)), /* pdm-clkm-m2 */ -RK_MUXROUTE_SAME (3 ,RK_PB2 ,3 ,0x314 ,BIT (16 +9 )),/* spi1_miso */ -RK_MUXROUTE_SAME (2 ,RK_PA4 ,2 ,0x314 ,BIT (16 +9 ) |BIT (9 )),/* spi1_miso_m1 */ -RK_MUXROUTE_SAME (0 ,RK_PB3 ,3 ,0x314 ,BIT (16 +10 ) |BIT (16 +11 )),/* owire_m0 */ -RK_MUXROUTE_SAME (1 ,RK_PC6 ,7 ,0x314 ,BIT (16 +10 ) |BIT (16 +11 ) |BIT (10 )),/* owire_m1 */ -RK_MUXROUTE_SAME (2 ,RK_PA2 ,5 ,0x314 ,BIT (16 +10 ) |BIT (16 +11 ) |BIT (11 )),/* owire_m2 */ -RK_MUXROUTE_SAME (0 ,RK_PB3 ,2 ,0x314 ,BIT (16 +12 ) |BIT (16 +13 )),/* can_rxd_m0 */ -RK_MUXROUTE_SAME (1 ,RK_PC6 ,5 ,0x314 ,BIT (16 +12 ) |BIT (16 +13 ) |BIT (12 )),/* can_rxd_m1 */ -RK_MUXROUTE_SAME (2 ,RK_PA2 ,4 ,0x314 ,BIT (16 +12 ) |BIT (16 +13 ) |BIT (13 )),/* can_rxd_m2 */ -RK_MUXROUTE_SAME (1 ,RK_PC4 ,3 ,0x314 ,BIT (16 +14 )),/* mac_rxd0_m0 */ -RK_MUXROUTE_SAME (4 ,RK_PA2 ,2 ,0x314 ,BIT (16 +14 ) |BIT (14 )),/* mac_rxd0_m1 */ -RK_MUXROUTE_SAME (3 ,RK_PB4 ,4 ,0x314 ,BIT (16 +15 )),/* uart3_rx */ - RK_MUXROUTE_SAME(0, RK_PC1, 3, 0x314, BIT(16 + 15) | BIT(15)), /* uart3_rx_m1 */ }; static struct rockchip_mux_route_data rk3328_mux_route_data[] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/352 pinctrl: core: fix possible memory leak when pinctrl_enable() fails
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <[email protected]>
[ Upstream commit ae1cf4759972c5fe665ee4c5e0c29de66fe3cf4a ]
In devm_pinctrl_register(), if pinctrl_enable() fails in pinctrl_register(), the "pctldev" has not been added to dev resources, so devm_pinctrl_dev_release() can not be called, it leads memory leak.
Introduce pinctrl_uninit_controller(), call it in the error path to free memory.
--- drivers/pinctrl/core.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/pinctrl/core.c +11 -1
@@ -2039,6 +2039,14 @@ pinctrl_init_controller(struct pinctrl_desc *pctldesc, struct device *dev,return ERR_PTR (ret); } +static void pinctrl_uninit_controller (struct pinctrl_dev *pctldev,struct pinctrl_desc *pctldesc) +{ +pinctrl_free_pindescs (pctldev, pctldesc->pins, + pctldesc->npins); +mutex_destroy (&pctldev->mutex); +kfree (pctldev); +} +static int pinctrl_claim_hogs (struct pinctrl_dev *pctldev) { pctldev->p =create_pinctrl (pctldev->dev, pctldev);
@@ -2119,8 +2127,10 @@ struct pinctrl_dev *pinctrl_register(struct pinctrl_desc *pctldesc,return pctldev; error =pinctrl_enable (pctldev); -if (error) +if (error) { +pinctrl_uninit_controller (pctldev, pctldesc);return ERR_PTR (error); + }return pctldev; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/352 pinctrl: single: fix possible memory leak when pinctrl_enable() fails
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <[email protected]>
[ Upstream commit 8f773bfbdd428819328a2d185976cfc6ae811cd3 ]
This driver calls pinctrl_register_and_init() which is not devm_ managed, it will leads memory leak if pinctrl_enable() fails. Replace it with devm_pinctrl_register_and_init(). And call pcs_free_resources() if pinctrl_enable() fails.
--- drivers/pinctrl/pinctrl-single.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/pinctrl/pinctrl-single.c +4 -3
@@ -1332,7 +1332,6 @@ static void pcs_irq_free(struct pcs_device *pcs)static void pcs_free_resources (struct pcs_device *pcs) {pcs_irq_free (pcs); -pinctrl_unregister (pcs->pctl);#if IS_BUILTIN (CONFIG_PINCTRL_SINGLE )if (pcs->missing_nr_pinctrl_cells)
@@ -1889,7 +1888,7 @@ static int pcs_probe(struct platform_device *pdev)if (ret <0 ) goto free; - ret =pinctrl_register_and_init (&pcs->desc, pcs->dev, pcs, &pcs->pctl); + ret =devm_pinctrl_register_and_init (pcs->dev, &pcs->desc, pcs, &pcs->pctl);if (ret) {dev_err (pcs->dev,"could not register single pinctrl driver\n" ); goto free;
@@ -1922,8 +1921,10 @@ static int pcs_probe(struct platform_device *pdev)dev_info (pcs->dev,"%i pins, size %u\n" , pcs->desc.npins, pcs->size); -return pinctrl_enable (pcs->pctl); +if (pinctrl_enable (pcs->pctl)) + goto free; +return 0 ; free:pcs_free_resources (pcs);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/352 pinctrl: ti: ti-iodelay: Drop if block with always false condition
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 88b3f108502bc45e6ebd005702add46759f3f45a ]
ti_iodelay_remove() is only called after ti_iodelay_probe() completed successfully. In this case platform_set_drvdata() was called with a non-NULL argument and so platform_get_drvdata() won't return NULL.
Simplify by removing the if block with the always false condition.
Stable-dep-of: 9b401f4a7170 ("pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails")
--- drivers/pinctrl/ti/pinctrl-ti-iodelay.c | 3 --- 1 file changed, 3 deletions(-)
drivers/pinctrl/ti/pinctrl-ti-iodelay.c +0 -3
@@ -906,9 +906,6 @@ static int ti_iodelay_remove(struct platform_device *pdev) {struct ti_iodelay_device *iod =platform_get_drvdata (pdev); -if (!iod) -return 0 ; -if (iod->pctl)pinctrl_unregister (iod->pctl);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/352 pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <[email protected]>
[ Upstream commit 9b401f4a7170125365160c9af267a41ff6b39001 ]
This driver calls pinctrl_register_and_init() which is not devm_ managed, it will leads memory leak if pinctrl_enable() fails. Replace it with devm_pinctrl_register_and_init(). And add missing of_node_put() in the error path.
--- drivers/pinctrl/ti/pinctrl-ti-iodelay.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/pinctrl/ti/pinctrl-ti-iodelay.c +6 -5
@@ -881,7 +881,7 @@ static int ti_iodelay_probe(struct platform_device *pdev) iod->desc.name =dev_name (dev); iod->desc.owner =THIS_MODULE ; - ret =pinctrl_register_and_init (&iod->desc, dev, iod, &iod->pctl); + ret =devm_pinctrl_register_and_init (dev, &iod->desc, iod, &iod->pctl);if (ret) {dev_err (dev,"Failed to register pinctrl\n" ); goto exit_out;
@@ -889,7 +889,11 @@ static int ti_iodelay_probe(struct platform_device *pdev)platform_set_drvdata (pdev, iod); -return pinctrl_enable (iod->pctl); + ret =pinctrl_enable (iod->pctl); +if (ret) + goto exit_out; + +return 0 ; exit_out:of_node_put (np);
@@ -906,9 +910,6 @@ static int ti_iodelay_remove(struct platform_device *pdev) {struct ti_iodelay_device *iod =platform_get_drvdata (pdev); -if (iod->pctl) -pinctrl_unregister (iod->pctl); -ti_iodelay_pinconf_deinit_dev (iod);/* Expect other allocations to be freed by devm */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/352 pinctrl: freescale: mxs: Fix refcount of child
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit 7f500f2011c0bbb6e1cacab74b4c99222e60248e ]
of_get_next_child() will increase refcount of the returned node, need use of_node_put() on it when done.
Per current implementation, 'child' will be override by for_each_child_of_node(np, child), so use of_get_child_count to avoid refcount leakage.
--- drivers/pinctrl/freescale/pinctrl-mxs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pinctrl/freescale/pinctrl-mxs.c +2 -2
@@ -405,8 +405,8 @@ static int mxs_pinctrl_probe_dt(struct platform_device *pdev,int ret;u32 val; - child =of_get_next_child (np,NULL ); -if (!child) { + val =of_get_child_count (np); +if (val ==0 ) {dev_err (&pdev->dev,"no group is defined\n" );return -ENOENT ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/352 fs/proc/task_mmu: indicate PM_FILE for PMD-mapped file THP
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
[ Upstream commit 3f9f022e975d930709848a86a1c79775b0585202 ]
Patch series "fs/proc: move page_mapcount() to fs/proc/internal.h".
With all other page_mapcount() users in the tree gone, move page_mapcount() to fs/proc/internal.h, rename it and extend the documentation to prevent future (ab)use.
... of course, I find some issues while working on that code that I sort first ;)
We'll now only end up calling page_mapcount() [now folio_precise_page_mapcount()] on pages mapped via present page table entries. Except for /proc/kpagecount, that still does questionable things, but we'll leave that legacy interface as is for now.
Did a quick sanity check. Likely we would want some better selfestest for /proc/$/pagemap + smaps. I'll see if I can find some time to write some more.
This patch (of 6):
Looks like we never taught pagemap_pmd_range() about the existence of PMD-mapped file THPs. Seems to date back to the times when we first added support for non-anon THPs in the form of shmem THP.
--- fs/proc/task_mmu.c | 2 ++ 1 file changed, 2 insertions(+)
fs/proc/task_mmu.c +2 -0
@@ -1468,6 +1468,8 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end, }#endif +if (page && !PageAnon (page)) + flags |=PM_FILE ;if (page && !migration &&page_mapcount (page) ==1 ) flags |=PM_MMAP_EXCLUSIVE ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/352 fs/nilfs2: remove some unused macros to tame gcc
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Shi <[email protected]>
[ Upstream commit e7920b3e9d9f5470d5ff7d883e72a47addc0a137 ]
There some macros are unused and cause gcc warning. Remove them.
fs/nilfs2/segment.c:137:0: warning: macro "nilfs_cnt32_gt" is not used [-Wunused-macros] fs/nilfs2/segment.c:144:0: warning: macro "nilfs_cnt32_le" is not used [-Wunused-macros] fs/nilfs2/segment.c:143:0: warning: macro "nilfs_cnt32_lt" is not used [-Wunused-macros]
Stable-dep-of: 0f3819e8c483 ("nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro")
--- fs/nilfs2/segment.c | 5 ----- 1 file changed, 5 deletions(-)
fs/nilfs2/segment.c +0 -5
@@ -134,14 +134,9 @@ static void nilfs_segctor_do_flush(struct nilfs_sc_info *, int);static void nilfs_segctor_do_immediate_flush (struct nilfs_sc_info *);static void nilfs_dispose_list (struct the_nilfs *,struct list_head *,int ); -#define nilfs_cnt32_gt (a, b) \ - (typecheck(__u32, a) && typecheck(__u32, b) && \ - ((__s32)(b) - (__s32)(a) < 0))#define nilfs_cnt32_ge (a, b) \ (typecheck(__u32, a) && typecheck(__u32, b) && \ ((__s32)(a) - (__s32)(b) >= 0)) -#define nilfs_cnt32_lt (a, b) nilfs_cnt32_gt(b, a) -#define nilfs_cnt32_le (a, b) nilfs_cnt32_ge(b, a)static int nilfs_prepare_segment_lock (struct super_block *sb,struct nilfs_transaction_info *ti)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/352 nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
[ Upstream commit 0f3819e8c483771a59cf9d3190cd68a7a990083c ]
According to the C standard 3.4.3p3, the result of signed integer overflow is undefined. The macro nilfs_cnt32_ge(), which compares two sequence numbers, uses signed integer subtraction that can overflow, and therefore the result of the calculation may differ from what is expected due to undefined behavior in different environments.
Similar to an earlier change to the jiffies-related comparison macros in commit 5a581b367b5d ("jiffies: Avoid undefined behavior from signed overflow"), avoid this potential issue by changing the definition of the macro to perform the subtraction as unsigned integers, then cast the result to a signed integer for comparison.
--- fs/nilfs2/segment.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nilfs2/segment.c +1 -1
@@ -136,7 +136,7 @@ static void nilfs_dispose_list(struct the_nilfs *, struct list_head *, int);#define nilfs_cnt32_ge (a, b) \ (typecheck(__u32, a) && typecheck(__u32, b) && \ - ((__s32)(a) - (__s32)(b) >= 0)) + ((__s32)((a) - (b)) >= 0))static int nilfs_prepare_segment_lock (struct super_block *sb,struct nilfs_transaction_info *ti)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/352 rtc: interface: Add RTC offset to alarm after fix-up
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Csókás, Bence <[email protected]>
[ Upstream commit 463927a8902a9f22c3633960119410f57d4c8920 ]
rtc_add_offset() is called by __rtc_read_time() and __rtc_read_alarm() to add the RTC's offset to the raw read-outs from the device drivers. However, in the latter case, a fix-up algorithm is run if the RTC device does not report a full struct rtc_time alarm value. In that case, the offset was forgot to be added.
--- drivers/rtc/interface.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/rtc/interface.c +5 -4
@@ -274,10 +274,9 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)return err;/* full-function RTCs won't have such missing fields */ -if (rtc_valid_tm (&alarm->time) ==0 ) { -rtc_add_offset (rtc, &alarm->time); -return 0 ; - } + err =rtc_valid_tm (&alarm->time); +if (!err) + goto done;/* get the "after" timestamp, to detect wrapped fields */ err =rtc_read_time (rtc, &now);
@@ -379,6 +378,8 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)if (err)dev_warn (&rtc->dev,"invalid alarm value: %ptR\n" , &alarm->time); +else +rtc_add_offset (rtc, &alarm->time);return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/352 dt-bindings: thermal: correct thermal zone node name limit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 97e32381d0fc6c2602a767b0c46e15eb2b75971d upstream.
Linux kernel uses thermal zone node name during registering thermal zones and has a hard-coded limit of 20 characters, including terminating NUL byte. The bindings expect node names to finish with '-thermal' which is eight bytes long, thus we have only 11 characters for the reset of the node name (thus 10 for the pattern after leading fixed character).
--- Documentation/devicetree/bindings/thermal/thermal-zones.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
Documentation/devicetree/bindings/thermal/thermal-zones.yaml +4 -1
@@ -49,7 +49,10 @@ properties: to take when the temperature crosses those thresholds. patternProperties: - "^[a-zA-Z][a-zA-Z0-9\\-]{1,12}-thermal$": + # Node name is limited in size due to Linux kernel requirements - 19 + # characters in total (see THERMAL_NAME_LENGTH, including terminating NUL + # byte): + "^[a-zA-Z][a-zA-Z0-9\\-]{1,10}-thermal$": type: object description: Each thermal zone node contains information about how frequently it
Signature · 1 line
2.45.2
Greg Kroah-Hartman
maintainerPATCH 125/352 tick/broadcast: Make takeover of broadcast hrtimer reliable
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Liao <[email protected]>
commit f7d43dd206e7e18c182f200e67a8db8c209907fa upstream.
Running the LTP hotplug stress test on a aarch64 machine results in rcu_sched stall warnings when the broadcast hrtimer was owned by the un-plugged CPU. The issue is the following:
CPU1 (owns the broadcast hrtimer) CPU2
tick_broadcast_enter() // shutdown local timer device broadcast_shutdown_local() ... tick_broadcast_exit() clockevents_switch_state(dev, CLOCK_EVT_STATE_ONESHOT) // timer device is not programmed cpumask_set_cpu(cpu, tick_broadcast_force_mask) initiates offlining of CPU1
take_cpu_down()
/*
* CPU1 shuts down and does not
* send broadcast IPI anymore
*/
takedown_cpu() hotplug_cpu__broadcast_tick_pull() // move broadcast hrtimer to this CPU clockevents_program_event() bc_set_next() hrtimer_start() /* * timer device is not programmed * because only the first expiring * timer will trigger clockevent * device reprogramming */
What happens is that CPU2 exits broadcast mode with force bit set, then the local timer device is not reprogrammed and CPU2 expects to receive the expired event by the broadcast IPI. But this does not happen because CPU1 is offlined by CPU2. CPU switches the clockevent device to ONESHOT state, but does not reprogram the device.
The subsequent reprogramming of the hrtimer broadcast device does not program the clockevent device of CPU2 either because the pending expiry time is already in the past and the CPU expects the event to be delivered. As a consequence all CPUs which wait for a broadcast event to be delivered are stuck forever.
Fix this issue by reprogramming the local timer device if the broadcast force bit of the CPU is set so that the broadcast hrtimer is delivered.
[ tglx: Massage comment and change log. Add Fixes tag ]
--- kernel/time/tick-broadcast.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
kernel/time/tick-broadcast.c +23 -0
@@ -944,6 +944,7 @@ void tick_broadcast_switch_to_oneshot(vo#ifdef CONFIG_HOTPLUG_CPU void hotplug_cpu__broadcast_tick_pull (int deadcpu) { +struct tick_device *td =this_cpu_ptr (&tick_cpu_device);struct clock_event_device *bc;unsigned long flags;
@@ -951,6 +952,28 @@ void hotplug_cpu__broadcast_tick_pull(in bc = tick_broadcast_device.evtdev;if (bc &&broadcast_needs_cpu (bc, deadcpu)) { +/* +* If the broadcast force bit of the current CPU is set, +* then the current CPU has not yet reprogrammed the local +* timer device to avoid a ping-pong race. See +* ___tick_broadcast_oneshot_control(). +* +* If the broadcast device is hrtimer based then +* programming the broadcast event below does not have any +* effect because the local clockevent device is not +* running and not programmed because the broadcast event +* is not earlier than the pending event of the local clock +* event device. As a consequence all CPUs waiting for a +* broadcast event are stuck forever. +* +* Detect this condition and reprogram the cpu local timer +* device to avoid the starvation. +*/ +if (tick_check_broadcast_expired ()) { +cpumask_clear_cpu (smp_processor_id (), tick_broadcast_force_mask); +tick_program_event (td->evtdev->next_event,1 ); + } +/* This moves the broadcast assignment to this CPU: */ clockevents_program_event (bc, bc->next_event,1 ); }
Greg Kroah-Hartman
maintainerPATCH 126/352 net: netconsole: Disable target before netpoll cleanup
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
commit 97d9fba9a812cada5484667a46e14a4c976ca330 upstream.
Currently, netconsole cleans up the netpoll structure before disabling the target. This approach can lead to race conditions, as message senders (write_ext_msg() and write_msg()) check if the target is enabled before using netpoll. The sender can validate that the target is enabled, but, the netpoll might be de-allocated already, causing undesired behaviours.
This patch reverses the order of operations:
1. Disable the target
2. Clean up the netpoll structure
This change eliminates the potential race condition, ensuring that no messages are sent through a partially cleaned-up netpoll structure.
--- drivers/net/netconsole.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/netconsole.c +1 -1
@@ -715,6 +715,7 @@ restart:/* rtnl_lock already held * we might sleep in __netpoll_cleanup() */ + nt->enabled = false;spin_unlock_irqrestore (&target_list_lock, flags);__netpoll_cleanup (&nt->np);
@@ -722,7 +723,6 @@ restart:spin_lock_irqsave (&target_list_lock, flags);dev_put (nt->np.dev); nt->np.dev =NULL ; - nt->enabled = false; stopped = true;netconsole_target_put (nt); goto restart;
Greg Kroah-Hartman
maintainerPATCH 127/352 af_packet: Handle outgoing VLAN packets without hardware offloading
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengen Du <[email protected]>
commit 79eecf631c14e7f4057186570ac20e2cfac3802e upstream.
The issue initially stems from libpcap. The ethertype will be overwritten as the VLAN TPID if the network interface lacks hardware VLAN offloading. In the outbound packet path, if hardware VLAN offloading is unavailable, the VLAN tag is inserted into the payload but then cleared from the sk_buff struct. Consequently, this can lead to a false negative when checking for the presence of a VLAN tag, causing the packet sniffing outcome to lack VLAN tag information (i.e., TCI-TPID). As a result, the packet capturing tool may be unable to parse packets as expected.
The TCI-TPID is missing because the prb_fill_vlan_info() function does not modify the tp_vlan_tci/tp_vlan_tpid values, as the information is in the payload and not in the sk_buff struct. The skb_vlan_tag_present() function only checks vlan_all in the sk_buff struct. In cooked mode, the L2 header is stripped, preventing the packet capturing tool from determining the correct TCI-TPID value. Additionally, the protocol in SLL is incorrect, which means the packet capturing tool cannot parse the L3 header correctly.
--- net/packet/af_packet.c | 86 +++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 84 insertions(+), 2 deletions(-)
net/packet/af_packet.c +84 -2
@@ -503,6 +503,61 @@ static void *packet_current_frame(structreturn packet_lookup_frame (po, rb, rb->head, status); } +static u16 vlan_get_tci (struct sk_buff *skb,struct net_device *dev) +{ +u8 *skb_orig_data = skb->data; +int skb_orig_len = skb->len; +struct vlan_hdr vhdr, *vh; +unsigned int header_len; + +if (!dev) +return 0 ; + +/* In the SOCK_DGRAM scenario, skb data starts at the network +* protocol, which is after the VLAN headers. The outer VLAN +* header is at the hard_header_len offset in non-variable +* length link layer headers. If it's a VLAN device, the +* min_header_len should be used to exclude the VLAN header +* size. +*/ +if (dev->min_header_len == dev->hard_header_len) + header_len = dev->hard_header_len; +else if (is_vlan_dev (dev)) + header_len = dev->min_header_len; +else +return 0 ; + +skb_push (skb, skb->data -skb_mac_header (skb)); + vh =skb_header_pointer (skb, header_len,sizeof (vhdr), &vhdr); +if (skb_orig_data != skb->data) { + skb->data = skb_orig_data; + skb->len = skb_orig_len; + } +if (unlikely (!vh)) +return 0 ; + +return ntohs (vh->h_vlan_TCI); +} + +static __be16 vlan_get_protocol_dgram (struct sk_buff *skb) +{ +__be16 proto = skb->protocol; + +if (unlikely (eth_type_vlan (proto))) { +u8 *skb_orig_data = skb->data; +int skb_orig_len = skb->len; + +skb_push (skb, skb->data -skb_mac_header (skb)); + proto =__vlan_get_protocol (skb, proto,NULL ); +if (skb_orig_data != skb->data) { + skb->data = skb_orig_data; + skb->len = skb_orig_len; + } + } + +return proto; +} +static void prb_del_retire_blk_timer (struct tpacket_kbdq_core *pkc) {del_timer_sync (&pkc->retire_blk_timer);
@@ -972,10 +1027,16 @@ static void prb_clear_rxhash(struct tpacstatic void prb_fill_vlan_info (struct tpacket_kbdq_core *pkc,struct tpacket3_hdr *ppd) { + struct packet_sock *po = container_of(pkc, struct packet_sock, rx_ring.prb_bdqc); +if (skb_vlan_tag_present (pkc->skb)) { ppd->hv1.tp_vlan_tci =skb_vlan_tag_get (pkc->skb); ppd->hv1.tp_vlan_tpid =ntohs (pkc->skb->vlan_proto); ppd->tp_status =TP_STATUS_VLAN_VALID |TP_STATUS_VLAN_TPID_VALID ; + }else if (unlikely (po->sk.sk_type ==SOCK_DGRAM &ð_type_vlan (pkc->skb->protocol))) { + ppd->hv1.tp_vlan_tci =vlan_get_tci (pkc->skb, pkc->skb->dev); + ppd->hv1.tp_vlan_tpid =ntohs (pkc->skb->protocol); + ppd->tp_status =TP_STATUS_VLAN_VALID |TP_STATUS_VLAN_TPID_VALID ; }else { ppd->hv1.tp_vlan_tci =0 ; ppd->hv1.tp_vlan_tpid =0 ;
@@ -2390,6 +2451,10 @@ static int tpacket_rcv(struct sk_buff *s h.h2->tp_vlan_tci =skb_vlan_tag_get (skb); h.h2->tp_vlan_tpid =ntohs (skb->vlan_proto); status |=TP_STATUS_VLAN_VALID |TP_STATUS_VLAN_TPID_VALID ; + }else if (unlikely (sk->sk_type ==SOCK_DGRAM &ð_type_vlan (skb->protocol))) { + h.h2->tp_vlan_tci =vlan_get_tci (skb, skb->dev); + h.h2->tp_vlan_tpid =ntohs (skb->protocol); + status |=TP_STATUS_VLAN_VALID |TP_STATUS_VLAN_TPID_VALID ; }else { h.h2->tp_vlan_tci =0 ; h.h2->tp_vlan_tpid =0 ;
@@ -2419,7 +2484,8 @@ static int tpacket_rcv(struct sk_buff *s sll->sll_halen =dev_parse_header (skb, sll->sll_addr); sll->sll_family =AF_PACKET ; sll->sll_hatype = dev->type; - sll->sll_protocol = skb->protocol; + sll->sll_protocol = (sk->sk_type ==SOCK_DGRAM ) ? +vlan_get_protocol_dgram (skb) : skb->protocol; sll->sll_pkttype = skb->pkt_type;if (unlikely (packet_sock_flag (po,PACKET_SOCK_ORIGDEV ))) sll->sll_ifindex = orig_dev->ifindex;
@@ -3451,7 +3517,8 @@ static int packet_recvmsg(struct socket/* Original length was stored in sockaddr_ll fields */ origlen =PACKET_SKB_CB (skb)->sa.origlen; sll->sll_family =AF_PACKET ; - sll->sll_protocol = skb->protocol; + sll->sll_protocol = (sock->type ==SOCK_DGRAM ) ? +vlan_get_protocol_dgram (skb) : skb->protocol; }sock_recv_ts_and_drops (msg, sk, skb);
@@ -3506,6 +3573,21 @@ static int packet_recvmsg(struct socket aux.tp_vlan_tci =skb_vlan_tag_get (skb); aux.tp_vlan_tpid =ntohs (skb->vlan_proto); aux.tp_status |=TP_STATUS_VLAN_VALID |TP_STATUS_VLAN_TPID_VALID ; + }else if (unlikely (sock->type ==SOCK_DGRAM &ð_type_vlan (skb->protocol))) { +struct sockaddr_ll *sll = &PACKET_SKB_CB (skb)->sa.ll; +struct net_device *dev; + +rcu_read_lock (); + dev =dev_get_by_index_rcu (sock_net (sk), sll->sll_ifindex); +if (dev) { + aux.tp_vlan_tci =vlan_get_tci (skb, dev); + aux.tp_vlan_tpid =ntohs (skb->protocol); + aux.tp_status |=TP_STATUS_VLAN_VALID |TP_STATUS_VLAN_TPID_VALID ; + }else { + aux.tp_vlan_tci =0 ; + aux.tp_vlan_tpid =0 ; + } +rcu_read_unlock (); }else { aux.tp_vlan_tci =0 ; aux.tp_vlan_tpid =0 ;
Greg Kroah-Hartman
maintainerPATCH 128/352 ipv6: take care of scope when choosing the src addr
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Dichtel <[email protected]>
commit abb9a68d2c64dd9b128ae1f2e635e4d805e7ce64 upstream.
When the source address is selected, the scope must be checked. For example, if a loopback address is assigned to the vrf device, it must not be chosen for packets sent outside.
--- net/ipv6/addrconf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv6/addrconf.c +2 -1
@@ -1822,7 +1822,8 @@ int ipv6_dev_get_saddr(struct net *net, master, &dst, scores, hiscore_idx); -if (scores[hiscore_idx].ifa) +if (scores[hiscore_idx].ifa && + scores[hiscore_idx].scopedist >=0 ) goto out; }
Greg Kroah-Hartman
maintainerPATCH 129/352 sched/fair: set_load_weight() must also call reweight_task() for SCHED_IDLE tasks
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit d329605287020c3d1c3b0dadc63d8208e7251382 upstream.
When a task's weight is being changed, set_load_weight() is called with @update_load set. As weight changes aren't trivial for the fair class, set_load_weight() calls fair.c::reweight_task() for fair class tasks.
However, set_load_weight() first tests task_has_idle_policy() on entry and skips calling reweight_task() for SCHED_IDLE tasks. This is buggy as SCHED_IDLE tasks are just fair tasks with a very low weight and they would incorrectly skip load, vlag and position updates.
Fix it by updating reweight_task() to take struct load_weight as idle weight can't be expressed with prio and making set_load_weight() call reweight_task() for SCHED_IDLE tasks too when @update_load is set.
--- kernel/sched/core.c | 23 ++++++++++------------- kernel/sched/fair.c | 7 +++---- kernel/sched/sched.h | 2 +- 3 files changed, 14 insertions(+), 18 deletions(-)
kernel/sched/core.c +10 -13
@@ -848,27 +848,24 @@ static void set_load_weight(struct task_ {bool update_load = !(READ_ONCE (p->state) &TASK_NEW );int prio = p->static_prio -MAX_RT_PRIO ; -struct load_weight *load = &p->se.load; +struct load_weight lw; -/* -* SCHED_IDLE tasks get minimal weight: -*/ if (task_has_idle_policy (p)) { - load->weight =scale_load (WEIGHT_IDLEPRIO ); - load->inv_weight =WMULT_IDLEPRIO ; -return ; + lw.weight =scale_load (WEIGHT_IDLEPRIO ); + lw.inv_weight =WMULT_IDLEPRIO ; + }else { + lw.weight =scale_load (sched_prio_to_weight[prio]); + lw.inv_weight = sched_prio_to_wmult[prio]; }/* * SCHED_OTHER tasks have to update their load when changing their * weight */ -if (update_load && p->sched_class == &fair_sched_class) { -reweight_task (p, prio); - }else { - load->weight =scale_load (sched_prio_to_weight[prio]); - load->inv_weight = sched_prio_to_wmult[prio]; - } +if (update_load && p->sched_class == &fair_sched_class) +reweight_task (p, &lw); +else + p->se.load = lw; }#ifdef CONFIG_UCLAMP_TASK
kernel/sched/fair.c +3 -4
@@ -3119,15 +3119,14 @@ static void reweight_entity(struct cfs_r } -void reweight_task (struct task_struct *p,int prio) +void reweight_task (struct task_struct *p,const struct load_weight *lw) {struct sched_entity *se = &p->se;struct cfs_rq *cfs_rq =cfs_rq_of (se);struct load_weight *load = &se->load; -unsigned long weight =scale_load (sched_prio_to_weight[prio]); -reweight_entity (cfs_rq, se, weight); - load->inv_weight = sched_prio_to_wmult[prio]; +reweight_entity (cfs_rq, se, lw->weight); + load->inv_weight = lw->inv_weight; }#ifdef CONFIG_FAIR_GROUP_SCHED
kernel/sched/sched.h +1 -1
@@ -1938,7 +1938,7 @@ extern void init_sched_dl_class(void);extern void init_sched_rt_class (void );extern void init_sched_fair_class (void ); -extern void reweight_task (struct task_struct *p,int prio); +extern void reweight_task (struct task_struct *p,const struct load_weight *lw);extern void resched_curr (struct rq *rq);extern void resched_cpu (int cpu);
Greg Kroah-Hartman
maintainerPATCH 130/352 char: tpm: Fix possible memory leak in tpm_bios_measurements_open()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
commit 5d8e2971e817bb64225fc0b6327a78752f58a9aa upstream.
In tpm_bios_measurements_open(), get_device() is called on the device embedded in struct tpm_chip. In the error path, however, put_device() is not called. This results in a reference count leak, which prevents the device from being properly released. This commit makes sure to call put_device() when the seq_open() call fails.
--- drivers/char/tpm/eventlog/common.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/char/tpm/eventlog/common.c +2 -0
@@ -47,6 +47,8 @@ static int tpm_bios_measurements_open(stif (!err) { seq = file->private_data; seq->private = chip; + }else { +put_device (&chip->dev); }return err;
Greg Kroah-Hartman
maintainerPATCH 131/352 media: venus: fix use after free in vdec_close
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dikshita Agarwal <[email protected]>
commit a0157b5aa34eb43ec4c5510f9c260bbb03be937e upstream.
There appears to be a possible use after free with vdec_close(). The firmware will add buffer release work to the work queue through HFI callbacks as a normal part of decoding. Randomly closing the decoder device from userspace during normal decoding can incur a read after free for inst.
Fix it by cancelling the work in vdec_close.
--- drivers/media/platform/qcom/venus/vdec.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/platform/qcom/venus/vdec.c +1 -0
@@ -1587,6 +1587,7 @@ static int vdec_close(struct file *file)vdec_pm_get (inst); +cancel_work_sync (&inst->delayed_process_work);v4l2_m2m_ctx_release (inst->m2m_ctx);v4l2_m2m_release (inst->m2m_dev);vdec_ctrl_deinit (inst);
Greg Kroah-Hartman
maintainerPATCH 132/352 hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
commit 26a2ed107929a855155429b11e1293b83e6b2a8b upstream.
Syzbot reports uninitialized value access issue as below:
loop0: detected capacity change from 0 to 64
=====================================================
BUG: KMSAN: uninit-value in hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 d_revalidate fs/namei.c:862 [inline] lookup_fast+0x89e/0x8e0 fs/namei.c:1649 walk_component fs/namei.c:2001 [inline] link_path_walk+0x817/0x1480 fs/namei.c:2332 path_lookupat+0xd9/0x6f0 fs/namei.c:2485 filename_lookup+0x22e/0x740 fs/namei.c:2515 user_path_at_empty+0x8b/0x390 fs/namei.c:2924 user_path_at include/linux/namei.h:57 [inline] do_mount fs/namespace.c:3689 [inline] __do_sys_mount fs/namespace.c:3898 [inline] __se_sys_mount+0x66b/0x810 fs/namespace.c:3875 __x64_sys_mount+0xe4/0x140 fs/namespace.c:3875 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: KMSAN: uninit-value in hfs_ext_read_extent fs/hfs/extent.c:196 [inline] BUG: KMSAN: uninit-value in hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366 hfs_ext_read_extent fs/hfs/extent.c:196 [inline] hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366 block_read_full_folio+0x4ff/0x11b0 fs/buffer.c:2271 hfs_read_folio+0x55/0x60 fs/hfs/inode.c:39 filemap_read_folio+0x148/0x4f0 mm/filemap.c:2426 do_read_cache_folio+0x7c8/0xd90 mm/filemap.c:3553 do_read_cache_page mm/filemap.c:3595 [inline] read_cache_page+0xfb/0x2f0 mm/filemap.c:3604 read_mapping_page include/linux/pagemap.h:755 [inline] hfs_btree_open+0x928/0x1ae0 fs/hfs/btree.c:78 hfs_mdb_get+0x260c/0x3000 fs/hfs/mdb.c:204 hfs_fill_super+0x1fb1/0x2790 fs/hfs/super.c:406 mount_bdev+0x628/0x920 fs/super.c:1359 hfs_mount+0xcd/0xe0 fs/hfs/super.c:456 legacy_get_tree+0x167/0x2e0 fs/fs_context.c:610 vfs_get_tree+0xdc/0x5d0 fs/super.c:1489 do_new_mount+0x7a9/0x16f0 fs/namespace.c:3145 path_mount+0xf98/0x26a0 fs/namespace.c:3475 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x919/0x9e0 fs/namespace.c:3674 __ia32_sys_mount+0x15b/0x1b0 fs/namespace.c:3674 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82
Uninit was created at:
__alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page mm/slub.c:2190 [inline] allocate_slab mm/slub.c:2354 [inline] new_slab+0x2d7/0x1400 mm/slub.c:2407 ___slab_alloc+0x16b5/0x3970 mm/slub.c:3540 __slab_alloc mm/slub.c:3625 [inline] __slab_alloc_node mm/slub.c:3678 [inline] slab_alloc_node mm/slub.c:3850 [inline] kmem_cache_alloc_lru+0x64d/0xb30 mm/slub.c:3879 alloc_inode_sb include/linux/fs.h:3018 [inline] hfs_alloc_inode+0x5a/0xc0 fs/hfs/super.c:165 alloc_inode+0x83/0x440 fs/inode.c:260 new_inode_pseudo fs/inode.c:1005 [inline] new_inode+0x38/0x4f0 fs/inode.c:1031 hfs_new_inode+0x61/0x1010 fs/hfs/inode.c:186 hfs_mkdir+0x54/0x250 fs/hfs/dir.c:228 vfs_mkdir+0x49a/0x700 fs/namei.c:4126 do_mkdirat+0x529/0x810 fs/namei.c:4149 __do_sys_mkdirat fs/namei.c:4164 [inline] __se_sys_mkdirat fs/namei.c:4162 [inline] __x64_sys_mkdirat+0xc8/0x120 fs/namei.c:4162 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
It missed to initialize .tz_secondswest, .cached_start and .cached_blocks fields in struct hfs_inode_info after hfs_alloc_inode(), fix it.
--- fs/hfs/inode.c | 3 +++ 1 file changed, 3 insertions(+)
fs/hfs/inode.c +3 -0
@@ -200,6 +200,7 @@ struct inode *hfs_new_inode(struct inodeHFS_I (inode)->flags =0 ;HFS_I (inode)->rsrc_inode =NULL ;HFS_I (inode)->fs_blocks =0 ; +HFS_I (inode)->tz_secondswest = sys_tz.tz_minuteswest *60 ;if (S_ISDIR (mode)) { inode->i_size =2 ;HFS_SB (sb)->folder_count++;
@@ -275,6 +276,8 @@ void hfs_inode_read_fork(struct inode *ifor (count =0 , i =0 ; i <3 ; i++) count +=be16_to_cpu (ext[i].count);HFS_I (inode)->first_blocks = count; +HFS_I (inode)->cached_start =0 ; +HFS_I (inode)->cached_blocks =0 ; inode->i_size =HFS_I (inode)->phys_size = log_size;HFS_I (inode)->fs_blocks = (log_size + sb->s_blocksize -1 ) >> sb->s_blocksize_bits;
Greg Kroah-Hartman
maintainerPATCH 133/352 ext2: Verify bitmap and itable block numbers before using them
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 322a6aff03937aa1ece33b4e46c298eafaf9ac41 upstream.
Verify bitmap block numbers and inode table blocks are sane before using them for checking bits in the block bitmap.
--- fs/ext2/balloc.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
fs/ext2/balloc.c +9 -2
@@ -79,26 +79,33 @@ static int ext2_valid_block_bitmap(strucext2_grpblk_t next_zero_bit;ext2_fsblk_t bitmap_blk;ext2_fsblk_t group_first_block; +ext2_grpblk_t max_bit; group_first_block =ext2_group_first_block_no (sb, block_group); + max_bit =ext2_group_last_block_no (sb, block_group) - group_first_block;/* check whether block bitmap block number is set */ bitmap_blk =le32_to_cpu (desc->bg_block_bitmap); offset = bitmap_blk - group_first_block; -if (!ext2_test_bit (offset, bh->b_data)) +if (offset <0 || offset > max_bit || + !ext2_test_bit (offset, bh->b_data))/* bad block bitmap */ goto err_out;/* check whether the inode bitmap block number is set */ bitmap_blk =le32_to_cpu (desc->bg_inode_bitmap); offset = bitmap_blk - group_first_block; -if (!ext2_test_bit (offset, bh->b_data)) +if (offset <0 || offset > max_bit || + !ext2_test_bit (offset, bh->b_data))/* bad block bitmap */ goto err_out;/* check whether the inode table block number is set */ bitmap_blk =le32_to_cpu (desc->bg_inode_table); offset = bitmap_blk - group_first_block; +if (offset <0 || offset > max_bit || + offset +EXT2_SB (sb)->s_itb_per_group -1 > max_bit) + goto err_out; next_zero_bit =ext2_find_next_zero_bit (bh->b_data, offset +EXT2_SB (sb)->s_itb_per_group, offset);
Greg Kroah-Hartman
maintainerPATCH 134/352 drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit cb520c3f366c77e8d69e4e2e2781a8ce48d98e79 upstream.
In cdv_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd.
--- drivers/gpu/drm/gma500/cdv_intel_lvds.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/gma500/cdv_intel_lvds.c +3 -0
@@ -310,6 +310,9 @@ static int cdv_intel_lvds_get_modes(struif (mode_dev->panel_fixed_mode !=NULL ) {struct drm_display_mode *mode =drm_mode_duplicate (dev, mode_dev->panel_fixed_mode); +if (!mode) +return 0 ; +drm_mode_probed_add (connector, mode);return 1 ; }
Greg Kroah-Hartman
maintainerPATCH 135/352 drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 2df7aac81070987b0f052985856aa325a38debf6 upstream.
In psb_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a possible NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd.
--- drivers/gpu/drm/gma500/psb_intel_lvds.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/gma500/psb_intel_lvds.c +3 -0
@@ -508,6 +508,9 @@ static int psb_intel_lvds_get_modes(struif (mode_dev->panel_fixed_mode !=NULL ) {struct drm_display_mode *mode =drm_mode_duplicate (dev, mode_dev->panel_fixed_mode); +if (!mode) +return 0 ; +drm_mode_probed_add (connector, mode);return 1 ; }
Greg Kroah-Hartman
maintainerPATCH 136/352 scsi: qla2xxx: Fix optrom version displayed in FDMI
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shreyas Deodhar <[email protected]>
commit 348744f27a35e087acc9378bf53537fbfb072775 upstream.
Bios version was popluated for FDMI response. Systems with EFI would show optrom version as 0. EFI version is populated here and BIOS version is already displayed under FDMI_HBA_BOOT_BIOS_NAME.
--- drivers/scsi/qla2xxx/qla_gs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/qla2xxx/qla_gs.c +1 -1
@@ -1708,7 +1708,7 @@ qla2x00_hba_attributes(scsi_qla_host_t * eiter->type =cpu_to_be16 (FDMI_HBA_OPTION_ROM_VERSION ); alen =scnprintf ( eiter->a.orom_version,sizeof (eiter->a.orom_version), -"%d.%02d" , ha->bios_revision[1 ], ha->bios_revision[0 ]); +"%d.%02d" , ha->efi_revision[1 ], ha->efi_revision[0 ]); alen +=FDMI_ATTR_ALIGNMENT (alen); alen +=FDMI_ATTR_TYPELEN (eiter); eiter->len =cpu_to_be16 (alen);
Greg Kroah-Hartman
maintainerPATCH 137/352 drm/amd/display: Check for NULL pointer
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sung Joon Kim <[email protected]>
commit 4ab68e168ae1695f7c04fae98930740aaf7c50fa upstream.
[why & how]
Need to make sure plane_state is initialized
before accessing its members.
--- drivers/gpu/drm/amd/display/dc/core/dc_surface.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc_surface.c +2 -1
@@ -154,7 +154,8 @@ const struct dc_plane_status *dc_plane_gif (pipe_ctx->plane_state != plane_state)continue ; - pipe_ctx->plane_state->status.is_flip_pending = false; +if (pipe_ctx->plane_state) + pipe_ctx->plane_state->status.is_flip_pending = false;break ; }
Greg Kroah-Hartman
maintainerPATCH 138/352 sched/fair: Use all little CPUs for CPU-bound workloads
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Gondois <[email protected]>
commit 3af7524b14198f5159a86692d57a9f28ec9375ce upstream.
Running N CPU-bound tasks on an N CPUs platform:
- with asymmetric CPU capacity
- not being a DynamIq system (i.e. having a PKG level sched domain without the SD_SHARE_PKG_RESOURCES flag set)
.. might result in a task placement where two tasks run on a big CPU and none on a little CPU. This placement could be more optimal by using all CPUs.
Testing platform:
Juno-r2:
- 2 big CPUs (1-2), maximum capacity of 1024
- 4 little CPUs (0,3-5), maximum capacity of 383
Testing workload ([1]):
Spawn 6 CPU-bound tasks. During the first 100ms (step 1), each tasks is affine to a CPU, except for:
- one little CPU which is left idle.
- one big CPU which has 2 tasks affine.
After the 100ms (step 2), remove the cpumask affinity.
Behavior before the patch:
During step 2, the load balancer running from the idle CPU tags sched domains as:
- little CPUs: 'group_has_spare'. Cf. group_has_capacity() and group_is_overloaded(), 3 CPU-bound tasks run on a 4 CPUs sched-domain, and the idle CPU provides enough spare capacity regarding the imbalance_pct
- big CPUs: 'group_overloaded'. Indeed, 3 tasks run on a 2 CPUs sched-domain, so the following path is used:
group_is_overloaded()
\-if (sgs->sum_nr_running <= sgs->group_weight) return true;
The following path which would change the migration type to 'migrate_task' is not taken:
calculate_imbalance()
\-if (env->idle != CPU_NOT_IDLE && env->imbalance == 0)
as the local group has some spare capacity, so the imbalance is not 0.
The migration type requested is 'migrate_util' and the busiest runqueue is the big CPU's runqueue having 2 tasks (each having a utilization of 512). The idle little CPU cannot pull one of these task as its capacity is too small for the task. The following path is used:
detach_tasks()
\-case migrate_util:
\-if (util > env->imbalance) goto next;After the patch:
As the number of failed balancing attempts grows (with 'nr_balance_failed'), progressively make it easier to migrate a big task to the idling little CPU. A similar mechanism is used for the 'migrate_load' migration type.
Improvement:
Running the testing workload [1] with the step 2 representing a ~10s load for a big CPU:
Before patch: ~19.3s
After patch: ~18s (-6.7%)
Similar issue reported at:
https://lore.kernel.org/lkml/[email protected]/
--- kernel/sched/fair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/fair.c +1 -1
@@ -7950,7 +7950,7 @@ static int detach_tasks(struct lb_env *ecase migrate_util: util =task_util_est (p); -if (util > env->imbalance) +if (shr_bound (util, env->sd->nr_balance_failed) > env->imbalance) goto next; env->imbalance -= util;
Greg Kroah-Hartman
maintainerPATCH 139/352 apparmor: use kvfree_sensitive to free data->data
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
commit 2bc73505a5cd2a18a7a542022722f136c19e3b87 upstream.
Inside unpack_profile() data->data is allocated using kvmemdup() so it should be freed with the corresponding kvfree_sensitive().
Also add missing data->data release for rhashtable insertion failure path in unpack_profile().
Found by Linux Verification Center (linuxtesting.org).
--- security/apparmor/policy.c | 2 +- security/apparmor/policy_unpack.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)
security/apparmor/policy.c +1 -1
@@ -187,7 +187,7 @@ static void aa_free_data(void *ptr, void {struct aa_data *data = ptr; -kfree_sensitive (data->data); +kvfree_sensitive (data->data, data->size);kfree_sensitive (data->key);kfree_sensitive (data); }
security/apparmor/policy_unpack.c +1 -0
@@ -915,6 +915,7 @@ static struct aa_profile *unpack_profileif (rhashtable_insert_fast (profile->data, &data->head, profile->data->p)) { +kvfree_sensitive (data->data, data->size);kfree_sensitive (data->key);kfree_sensitive (data); info ="failed to insert data to table" ;
Greg Kroah-Hartman
maintainerPATCH 140/352 task_work: s/task_work_cancel()/task_work_cancel_func()/
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederic Weisbecker <[email protected]>
commit 68cbd415dd4b9c5b9df69f0f091879e56bf5907a upstream.
A proper task_work_cancel() API that actually cancels a callback and not *any* callback pointing to a given function is going to be needed for perf events event freeing. Do the appropriate rename to prepare for that.
--- include/linux/task_work.h | 2 +- kernel/irq/manage.c | 2 +- kernel/task_work.c | 10 +++++----- security/keys/keyctl.c | 2 +- 4 files changed, 8 insertions(+), 8 deletions(-)
include/linux/task_work.h +1 -1
@@ -24,7 +24,7 @@ int task_work_add(struct task_struct *tastruct callback_head *task_work_cancel_match (struct task_struct *task,bool (*match)(struct callback_head *,void *data),void *data); -struct callback_head *task_work_cancel (struct task_struct *,task_work_func_t ); +struct callback_head *task_work_cancel_func (struct task_struct *,task_work_func_t );void task_work_run (void );static inline void exit_task_work (struct task_struct *task)
kernel/irq/manage.c +1 -1
@@ -1230,7 +1230,7 @@ static int irq_thread(void *data)* synchronize_hardirq(). So neither IRQTF_RUNTHREAD nor the * oneshot mask bit can be set. */ -task_work_cancel (current, irq_thread_dtor); +task_work_cancel_func (current, irq_thread_dtor);return 0 ; }
kernel/task_work.c +5 -5
@@ -101,9 +101,9 @@ static bool task_work_func_match(struct }/** -* task_work_cancel - cancel a pending work added by task_work_add() -* @task: the task which should execute the work -* @func: identifies the work to remove +* task_work_cancel_func - cancel a pending work matching a function added by task_work_add() +* @task: the task which should execute the func's work +* @func: identifies the func to match with a work to remove * * Find the last queued pending work with ->func == @func and remove * it from queue.
@@ -112,7 +112,7 @@ static bool task_work_func_match(struct* The found work or NULL if not found. */ struct callback_head * -task_work_cancel (struct task_struct *task,task_work_func_t func) +task_work_cancel_func (struct task_struct *task,task_work_func_t func) {return task_work_cancel_match (task, task_work_func_match, func); }
@@ -149,7 +149,7 @@ void task_work_run(void)if (!work)break ;/* -* Synchronize with task_work_cancel(). It can not remove +* Synchronize with task_work_cancel_match(). It can not remove * the first entry == work, cmpxchg(task_works) must fail. * But it can remove another entry from the ->next list. */
security/keys/keyctl.c +1 -1
@@ -1694,7 +1694,7 @@ long keyctl_session_to_parent(void) goto unlock;/* cancel an already pending keyring replacement */ - oldwork =task_work_cancel (parent, key_change_session_keyring); + oldwork =task_work_cancel_func (parent, key_change_session_keyring);/* the replacement session keyring is applied just prior to userspace * restarting */
Greg Kroah-Hartman
maintainerPATCH 141/352 task_work: Introduce task_work_cancel() again
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederic Weisbecker <[email protected]>
commit f409530e4db9dd11b88cb7703c97c8f326ff6566 upstream.
Re-introduce task_work_cancel(), this time to cancel an actual callback and not *any* callback pointing to a given function. This is going to be needed for perf events event freeing.
--- include/linux/task_work.h | 1 + kernel/task_work.c | 24 ++++++++++++++++++++++++ 2 files changed, 25 insertions(+)
include/linux/task_work.h +1 -0
@@ -25,6 +25,7 @@ int task_work_add(struct task_struct *tastruct callback_head *task_work_cancel_match (struct task_struct *task,bool (*match)(struct callback_head *,void *data),void *data);struct callback_head *task_work_cancel_func (struct task_struct *,task_work_func_t ); +bool task_work_cancel (struct task_struct *task,struct callback_head *cb);void task_work_run (void );static inline void exit_task_work (struct task_struct *task)
kernel/task_work.c +24 -0
@@ -117,6 +117,30 @@ task_work_cancel_func(struct task_structreturn task_work_cancel_match (task, task_work_func_match, func); } +static bool task_work_match (struct callback_head *cb,void *data) +{ +return cb == data; +} + +/** +* task_work_cancel - cancel a pending work added by task_work_add() +* @task: the task which should execute the work +* @cb: the callback to remove if queued +* +* Remove a callback from a task's queue if queued. +* +* RETURNS: +* True if the callback was queued and got cancelled, false otherwise. +*/ +bool task_work_cancel (struct task_struct *task,struct callback_head *cb) +{ +struct callback_head *ret; + + ret =task_work_cancel_match (task, task_work_match, cb); + +return ret == cb; +} +/** * task_work_run - execute the works added by task_work_add() *
Greg Kroah-Hartman
maintainerPATCH 142/352 udf: Avoid using corrupted block bitmap buffer
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit a90d4471146de21745980cba51ce88e7926bcc4f upstream.
When the filesystem block bitmap is corrupted, we detect the corruption while loading the bitmap and fail the allocation with error. However the next allocation from the same bitmap will notice the bitmap buffer is already loaded and tries to allocate from the bitmap with mixed results (depending on the exact nature of the bitmap corruption). Fix the problem by using BH_verified bit to indicate whether the bitmap is valid or not.
--- fs/udf/balloc.c | 15 +++++++++++++-- fs/udf/super.c | 3 ++- 2 files changed, 15 insertions(+), 3 deletions(-)
fs/udf/balloc.c +13 -2
@@ -68,8 +68,12 @@ static int read_block_bitmap(struct supe }for (i =0 ; i < count; i++) -if (udf_test_bit (i + off, bh->b_data)) +if (udf_test_bit (i + off, bh->b_data)) { + bitmap->s_block_bitmap[bitmap_nr] = +ERR_PTR (-EFSCORRUPTED ); +brelse (bh);return -EFSCORRUPTED ; + }return 0 ; }
@@ -85,8 +89,15 @@ static int __load_block_bitmap(struct su block_group, nr_groups); } -if (bitmap->s_block_bitmap[block_group]) +if (bitmap->s_block_bitmap[block_group]) { +/* +* The bitmap failed verification in the past. No point in +* trying again. +*/ +if (IS_ERR (bitmap->s_block_bitmap[block_group])) +return PTR_ERR (bitmap->s_block_bitmap[block_group]);return block_group; + } retval =read_block_bitmap (sb, bitmap, block_group, block_group);if (retval <0 )
fs/udf/super.c +2 -1
@@ -266,7 +266,8 @@ static void udf_sb_free_bitmap(struct udint nr_groups = bitmap->s_nr_groups;for (i =0 ; i < nr_groups; i++) -brelse (bitmap->s_block_bitmap[i]); +if (!IS_ERR_OR_NULL (bitmap->s_block_bitmap[i])) +brelse (bitmap->s_block_bitmap[i]);kvfree (bitmap); }
Greg Kroah-Hartman
maintainerPATCH 143/352 m68k: amiga: Turn off Warp1260 interrupts during boot
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Pisati <[email protected]>
commit 1d8491d3e726984343dd8c3cdbe2f2b47cfdd928 upstream.
On an Amiga 1200 equipped with a Warp1260 accelerator, an interrupt storm coming from the accelerator board causes the machine to crash in local_irq_enable() or auto_irq_enable(). Disabling interrupts for the Warp1260 in amiga_parse_bootinfo() fixes the problem.
--- arch/m68k/amiga/config.c | 9 +++++++++ include/uapi/linux/zorro_ids.h | 3 +++ 2 files changed, 12 insertions(+)
arch/m68k/amiga/config.c +9 -0
@@ -179,6 +179,15 @@ int __init amiga_parse_bootinfo(const st dev->slotsize =be16_to_cpu (cd->cd_SlotSize); dev->boardaddr =be32_to_cpu (cd->cd_BoardAddr); dev->boardsize =be32_to_cpu (cd->cd_BoardSize); + +/* CS-LAB Warp 1260 workaround */ +if (be16_to_cpu (dev->rom.er_Manufacturer) ==ZORRO_MANUF (ZORRO_PROD_CSLAB_WARP_1260 ) && + dev->rom.er_Product ==ZORRO_PROD (ZORRO_PROD_CSLAB_WARP_1260 )) { + +/* turn off all interrupts */ +pr_info ("Warp 1260 card detected: applying interrupt storm workaround\n" ); + *(uint32_t *)(dev->boardaddr +0x1000 ) =0xfff ; + } }else pr_warn ("amiga_parse_bootinfo: too many AutoConfig devices\n" );#endif /* CONFIG_ZORRO */
include/uapi/linux/zorro_ids.h +3 -0
@@ -449,6 +449,9 @@#define ZORRO_PROD_VMC_ISDN_BLASTER_Z2 ZORRO_ID(VMC, 0x01, 0)#define ZORRO_PROD_VMC_HYPERCOM_4 ZORRO_ID(VMC, 0x02, 0) +#define ZORRO_MANUF_CSLAB 0x1400 +#define ZORRO_PROD_CSLAB_WARP_1260 ZORRO_ID(CSLAB, 0x65, 0) +#define ZORRO_MANUF_INFORMATION 0x157C#define ZORRO_PROD_INFORMATION_ISDN_ENGINE_I ZORRO_ID(INFORMATION, 0x64, 0)
Greg Kroah-Hartman
maintainerPATCH 144/352 ext4: check dot and dotdot of dx_root before making dir indexed
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
commit 50ea741def587a64e08879ce6c6a30131f7111e7 upstream.
Syzbot reports a issue as follows:
============================================
BUG: unable to handle page fault for address: ffffed11022e24fe PGD 23ffee067 P4D 23ffee067 PUD 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 PID: 5079 Comm: syz-executor306 Not tainted 6.10.0-rc5-g55027e689933 #0 Call Trace: <TASK> make_indexed_dir+0xdaf/0x13c0 fs/ext4/namei.c:2341 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2451 ext4_rename fs/ext4/namei.c:3936 [inline] ext4_rename2+0x26e5/0x4370 fs/ext4/namei.c:4214
[...]
============================================
The immediate cause of this problem is that there is only one valid dentry for the block to be split during do_split, so split==0 results in out of bounds accesses to the map triggering the issue.
do_split
unsigned split
dx_make_map
count = 1
split = count/2 = 0;
continued = hash2 == map[split - 1].hash;
---> map[4294967295]The maximum length of a filename is 255 and the minimum block size is 1024, so it is always guaranteed that the number of entries is greater than or equal to 2 when do_split() is called.
But syzbot's crafted image has no dot and dotdot in dir, and the dentry distribution in dirblock is as follows:
bus dentry1 hole dentry2 free
|xx--|xx-------------|...............|xx-------------|...............| 0 12 (8+248)=256 268 256 524 (8+256)=264 788 236 1024
So when renaming dentry1 increases its name_len length by 1, neither hole nor free is sufficient to hold the new dentry, and make_indexed_dir() is called.
In make_indexed_dir() it is assumed that the first two entries of the dirblock must be dot and dotdot, so bus and dentry1 are left in dx_root because they are treated as dot and dotdot, and only dentry2 is moved to the new leaf block. That's why count is equal to 1.
Therefore add the ext4_check_dx_root() helper function to add more sanity checks to dot and dotdot before starting the conversion to avoid the above issue.
--- fs/ext4/namei.c | 56 +++++++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 51 insertions(+), 5 deletions(-)
fs/ext4/namei.c +51 -5
@@ -2098,6 +2098,52 @@ static int add_dirent_to_buf(handle_t *hreturn err ? err : err2; } +static bool ext4_check_dx_root (struct inode *dir,struct dx_root *root) +{ +struct fake_dirent *fde; +const char *error_msg; +unsigned int rlen; +unsigned int blocksize = dir->i_sb->s_blocksize; +char *blockend = (char *)root + dir->i_sb->s_blocksize; + + fde = &root->dot; +if (unlikely (fde->name_len !=1 )) { + error_msg ="invalid name_len for '.'" ; + goto corrupted; + } +if (unlikely (strncmp (root->dot_name,"." , fde->name_len))) { + error_msg ="invalid name for '.'" ; + goto corrupted; + } + rlen =ext4_rec_len_from_disk (fde->rec_len, blocksize); +if (unlikely ((char *)fde + rlen >= blockend)) { + error_msg ="invalid rec_len for '.'" ; + goto corrupted; + } + + fde = &root->dotdot; +if (unlikely (fde->name_len !=2 )) { + error_msg ="invalid name_len for '..'" ; + goto corrupted; + } +if (unlikely (strncmp (root->dotdot_name,".." , fde->name_len))) { + error_msg ="invalid name for '..'" ; + goto corrupted; + } + rlen =ext4_rec_len_from_disk (fde->rec_len, blocksize); +if (unlikely ((char *)fde + rlen >= blockend)) { + error_msg ="invalid rec_len for '..'" ; + goto corrupted; + } + +return true; + +corrupted: +EXT4_ERROR_INODE (dir,"Corrupt dir, %s, running e2fsck is recommended" , + error_msg); +return false; +} +/* * This converts a one block unindexed directory to a 3 block indexed * directory, and adds the dentry to the indexed directory.
@@ -2131,17 +2177,17 @@ static int make_indexed_dir(handle_t *habrelse (bh);return retval; } + root = (struct dx_root *) bh->b_data; +if (!ext4_check_dx_root (dir, root)) { +brelse (bh); +return -EFSCORRUPTED ; + }/* The 0th block becomes the root, move the dirents out */ fde = &root->dotdot; de = (struct ext4_dir_entry_2 *)((char *)fde +ext4_rec_len_from_disk (fde->rec_len, blocksize)); -if ((char *) de >= (((char *) root) + blocksize)) { -EXT4_ERROR_INODE (dir,"invalid rec_len for '..'" ); -brelse (bh); -return -EFSCORRUPTED ; - } len = ((char *) root) + (blocksize - csum_size) - (char *) de;/* Allocate new block for the 0th block's dirents */
Greg Kroah-Hartman
maintainerPATCH 145/352 ext4: make sure the first directory block is not a hole
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
commit f9ca51596bbfd0f9c386dd1c613c394c78d9e5e6 upstream.
The syzbot constructs a directory that has no dirblock but is non-inline, i.e. the first directory block is a hole. And no errors are reported when creating files in this directory in the following flow.
ext4_mknod
...
ext4_add_entry
// Read block 0
ext4_read_dirblock(dir, block, DIRENT)
bh = ext4_bread(NULL, inode, block, 0)
if (!bh && (type == INDEX || type == DIRENT_HTREE))
// The first directory block is a hole
// But type == DIRENT, so no error is reported.After that, we get a directory block without '.' and '..' but with a valid dentry. This may cause some code that relies on dot or dotdot (such as make_indexed_dir()) to crash.
Therefore when ext4_read_dirblock() finds that the first directory block is a hole report that the filesystem is corrupted and return an error to avoid loading corrupted data from disk causing something bad.
--- fs/ext4/namei.c | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-)
fs/ext4/namei.c +6 -11
@@ -145,10 +145,11 @@ static struct buffer_head *__ext4_read_dreturn bh; } -if (!bh && (type ==INDEX || type ==DIRENT_HTREE )) { +/* The first directory block must not be a hole. */ +if (!bh && (type ==INDEX || type ==DIRENT_HTREE || block ==0 )) {ext4_error_inode (inode, func, line, block, -"Directory hole found for htree %s block" , - (type ==INDEX ) ?"index" :"leaf" ); +"Directory hole found for htree %s block %u" , + (type ==INDEX ) ?"index" :"leaf" , block);return ERR_PTR (-EFSCORRUPTED ); }if (!bh)
@@ -2977,10 +2978,7 @@ bool ext4_empty_dir(struct inode *inode)EXT4_ERROR_INODE (inode,"invalid size" );return false; } -/* The first directory block must not be a hole, -* so treat it as DIRENT_HTREE -*/ - bh =ext4_read_dirblock (inode,0 ,DIRENT_HTREE ); + bh =ext4_read_dirblock (inode,0 ,EITHER );if (IS_ERR (bh))return false;
@@ -3611,10 +3609,7 @@ static struct buffer_head *ext4_get_firsstruct ext4_dir_entry_2 *de;unsigned int offset; -/* The first directory block must not be a hole, so -* treat it as DIRENT_HTREE -*/ - bh =ext4_read_dirblock (inode,0 ,DIRENT_HTREE ); + bh =ext4_read_dirblock (inode,0 ,EITHER );if (IS_ERR (bh)) { *retval =PTR_ERR (bh);return NULL ;
Greg Kroah-Hartman
maintainerPATCH 146/352 wifi: mwifiex: Fix interface type change
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael Beims <[email protected]>
commit a17b9f590f6ec2b9f1b12b1db3bf1d181de6b272 upstream.
When changing the interface type we also need to update the bss_num, the driver private data is searched based on a unique (bss_type, bss_num) tuple, therefore every time bss_type changes, bss_num must also change.
This fixes for example an issue in which, after the mode changed, a wireless scan on the changed interface would not finish, leading to repeated -EBUSY messages to userspace when other scan requests were sent.
--- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/marvell/mwifiex/cfg80211.c +2 -0
@@ -930,6 +930,8 @@ mwifiex_init_new_priv_params(struct mwifreturn -EOPNOTSUPP ; } + priv->bss_num =mwifiex_get_unused_bss_num (adapter, priv->bss_type); +spin_lock_irqsave (&adapter->main_proc_lock, flags); adapter->main_locked = false;spin_unlock_irqrestore (&adapter->main_proc_lock, flags);
Greg Kroah-Hartman
maintainerPATCH 147/352 leds: ss4200: Convert PCIBIOS_* return codes to errnos
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
commit ce068e83976140badb19c7f1307926b4b562fac4 upstream.
ich7_lpc_probe() uses pci_read_config_dword() that returns PCIBIOS_* codes. The error handling code assumes incorrectly it's a normal errno and checks for < 0. The return code is returned from the probe function as is but probe functions should return normal errnos.
Remove < 0 from the check and convert PCIBIOS_* returns code using pcibios_err_to_errno() into normal errno before returning it.
--- drivers/leds/leds-ss4200.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/leds/leds-ss4200.c +5 -2
@@ -356,8 +356,10 @@ static int ich7_lpc_probe(struct pci_dev nas_gpio_pci_dev = dev; status =pci_read_config_dword (dev,PMBASE , &g_pm_io_base); -if (status) +if (status) { + status =pcibios_err_to_errno (status); goto out; + } g_pm_io_base &=0x00000ff80 ; status =pci_read_config_dword (dev,GPIO_CTRL , &gc);
@@ -369,8 +371,9 @@ static int ich7_lpc_probe(struct pci_dev } status =pci_read_config_dword (dev,GPIO_BASE , &nas_gpio_io_base); -if (0 > status) { +if (status) {dev_info (&dev->dev,"Unable to read GPIOBASE.\n" ); + status =pcibios_err_to_errno (status); goto out; }dev_dbg (&dev->dev,": GPIOBASE = 0x%08x\n" , nas_gpio_io_base);
Greg Kroah-Hartman
maintainerPATCH 148/352 jbd2: make jbd2_journal_get_max_txn_bufs() internal
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 4aa99c71e42ad60178c1154ec24e3df9c684fb67 upstream.
There's no reason to have jbd2_journal_get_max_txn_bufs() public function. Currently all users are internal and can use journal->j_max_transaction_buffers instead. This saves some unnecessary recomputations of the limit as a bonus which becomes important as this function gets more complex in the following patch.
--- fs/jbd2/commit.c | 2 +- fs/jbd2/journal.c | 5 +++++ include/linux/jbd2.h | 5 ----- 3 files changed, 6 insertions(+), 6 deletions(-)
fs/jbd2/commit.c +1 -1
@@ -813,7 +813,7 @@ start_journal_io:if (first_block < journal->j_tail) freed += journal->j_last - journal->j_first;/* Update tail only if we free significant amount of space */ -if (freed <jbd2_journal_get_max_txn_bufs (journal)) +if (freed < journal->j_max_transaction_buffers) update_tail =0 ; }J_ASSERT (commit_transaction->t_state ==T_COMMIT );
fs/jbd2/journal.c +5 -0
@@ -1481,6 +1481,11 @@ static void journal_fail_superblock(jour journal->j_sb_buffer =NULL ; } +static int jbd2_journal_get_max_txn_bufs (journal_t *journal) +{ +return (journal->j_total_len - journal->j_fc_wbufsize) /4 ; +} +/* * Given a journal_t structure, initialise the various fields for * startup of a new journaling session. We use this both when creating
include/linux/jbd2.h +0 -5
@@ -1626,11 +1626,6 @@ int jbd2_wait_inode_data(journal_t *jourint jbd2_fc_wait_bufs (journal_t *journal,int num_blks);int jbd2_fc_release_bufs (journal_t *journal); -static inline int jbd2_journal_get_max_txn_bufs (journal_t *journal) -{ -return (journal->j_total_len - journal->j_fc_wbufsize) /4 ; -} -/* * is_journal_abort *
Greg Kroah-Hartman
maintainerPATCH 149/352 KVM: VMX: Split out the non-virtualization part of vmx_interrupt_blocked()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 322a569c4b4188a0da2812f9e952780ce09b74ba upstream.
Move the non-VMX chunk of the "interrupt blocked" checks to a separate helper so that KVM can reuse the code to detect if interrupts are blocked for L2, e.g. to determine if a virtual interrupt _for L2_ is a valid wake event. If L1 disables HLT-exiting for L2, nested APICv is enabled, and L2 HLTs, then L2 virtual interrupts are valid wake events, but if and only if interrupts are unblocked for L2.
--- arch/x86/kvm/vmx/vmx.c | 11 ++++++++--- arch/x86/kvm/vmx/vmx.h | 1 + 2 files changed, 9 insertions(+), 3 deletions(-)
arch/x86/kvm/vmx/vmx.c +8 -3
@@ -4738,14 +4738,19 @@ static int vmx_nmi_allowed(struct kvm_vcreturn !vmx_nmi_blocked (vcpu); } +bool __vmx_interrupt_blocked (struct kvm_vcpu *vcpu) +{ +return !(vmx_get_rflags (vcpu) &X86_EFLAGS_IF ) || + (vmcs_read32 (GUEST_INTERRUPTIBILITY_INFO ) & + (GUEST_INTR_STATE_STI |GUEST_INTR_STATE_MOV_SS )); +} +bool vmx_interrupt_blocked (struct kvm_vcpu *vcpu) {if (is_guest_mode (vcpu) &&nested_exit_on_intr (vcpu))return false; -return !(vmx_get_rflags (vcpu) &X86_EFLAGS_IF ) || - (vmcs_read32 (GUEST_INTERRUPTIBILITY_INFO ) & - (GUEST_INTR_STATE_STI |GUEST_INTR_STATE_MOV_SS )); +return __vmx_interrupt_blocked (vcpu); }static int vmx_interrupt_allowed (struct kvm_vcpu *vcpu,bool for_injection)
arch/x86/kvm/vmx/vmx.h +1 -0
@@ -359,6 +359,7 @@ bool vmx_guest_inject_ac(struct kvm_vcpuvoid update_exception_bitmap (struct kvm_vcpu *vcpu);void vmx_update_msr_bitmap (struct kvm_vcpu *vcpu);bool vmx_nmi_blocked (struct kvm_vcpu *vcpu); +bool __vmx_interrupt_blocked (struct kvm_vcpu *vcpu);bool vmx_interrupt_blocked (struct kvm_vcpu *vcpu);bool vmx_get_nmi_mask (struct kvm_vcpu *vcpu);void vmx_set_nmi_mask (struct kvm_vcpu *vcpu,bool masked);