5.15.165-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 5.15.165-rc1 review
This is the start of the stable review cycle for the 5.15.165 release. There are 484 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 17 Aug 2024 13:18:17 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.165-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.15.165-rc1
Michael Walle <[email protected]>
ARM: dts: imx6qdl-kontron-samx6i: fix phy-mode
Eric Dumazet <[email protected]>
wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
Kees Cook <[email protected]>
binfmt_flat: Fix corruption when not offsetting data start
Chris Wulff <[email protected]>
usb: gadget: u_audio: Check return codes from usb_ep_enable and config_ep_by_speed.
WangYuli <[email protected]>
nvme/pci: Add APST quirk for Lenovo N60z laptop
Kees Cook <[email protected]>
exec: Fix ToCToU between perm check and set-uid/gid usage
Amit Daniel Kachhap <[email protected]>
arm64: cpufeature: Fix the visibility of compat hwcaps
Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: msm8996: correct #clock-cells for QMP PHY nodes
Mahesh Salgaonkar <[email protected]>
powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
Andi Shyti <[email protected]>
drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
Matthieu Baerts (NGI0) <[email protected]>
mptcp: fully established after ADD_ADDR echo on MPJ
Johannes Berg <[email protected]>
wifi: mac80211: check basic rates validity
Jisheng Zhang <[email protected]>
PCI: dwc: Restore MSI Receiver mask during resume
Shenwei Wang <[email protected]>
net: stmmac: Enable mac_managed_pm phylink config
Florian Westphal <[email protected]>
netfilter: nf_tables: prefer nft_chain_validate
Florian Westphal <[email protected]>
netfilter: nf_tables: allow clone callbacks to sleep
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: bail out if stateful expression provides no .clone
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: use timestamp to check for set element timeout
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: set element extended ACK reporting support
Jakub Kicinski <[email protected]>
tls: fix race between tx work scheduling and socket close
Lukas Wunner <[email protected]>
PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal
Filipe Manana <[email protected]>
btrfs: fix double inode unlock for direct IO sync writes
Christoph Hellwig <[email protected]>
xfs: fix log recovery buffer allocation for the legacy h_size fixup
Filipe Manana <[email protected]>
btrfs: fix corruption after buffer fault in during direct IO append write
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: check backup support in signal endp
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: validate backup in MPJ
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: fix backup support in signal endpoints
Geliang Tang <[email protected]>
mptcp: export local_address
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: only set request_bkup flag when sending MP_PRIO
Paolo Abeni <[email protected]>
mptcp: fix bad RCVPRUNED mib accounting
Matthieu Baerts (NGI0) <[email protected]>
mptcp: mib: count MPJ with backup flag
Paolo Abeni <[email protected]>
mptcp: fix NL PM announced address accounting
Matthieu Baerts (NGI0) <[email protected]>
mptcp: distinguish rcv vs sent backup flag in requests
Matthieu Baerts (NGI0) <[email protected]>
mptcp: sched: check both directions for backup
Thomas Zimmermann <[email protected]>
drm/mgag200: Set DDC timeout in milliseconds
Lucas Stach <[email protected]>
drm/bridge: analogix_dp: properly handle zero sized AUX transactions
Yang Yingliang <[email protected]>
sched/smt: Fix unbalance sched_smt_present dec/inc
Yang Yingliang <[email protected]>
sched/smt: Introduce sched_smt_present_inc/dec() helper
Andi Kleen <[email protected]>
x86/mtrr: Check if fixed MTRRs exist before saving them
Waiman Long <[email protected]>
padata: Fix possible divide-by-0 panic in padata_mt_helper()
Tze-nan Wu <[email protected]>
tracing: Fix overflow in get_free_elt()
Hans de Goede <[email protected]>
power: supply: axp288_charger: Round constant_charge_voltage writes down
Hans de Goede <[email protected]>
power: supply: axp288_charger: Fix constant_charge_voltage writes
Shay Drory <[email protected]>
genirq/irqdesc: Honor caller provided affinity in alloc_desc()
Radhey Shyam Pandey <[email protected]>
irqchip/xilinx: Fix shift out of bounds
Andrey Konovalov <[email protected]>
kcov: properly check for softirq context
George Kennedy <[email protected]>
serial: core: check uartclk for zero to avoid divide by zero
Thomas Gleixner <[email protected]>
timekeeping: Fix bogus clock_was_set() invocation in do_adjtimex()
Justin Stitt <[email protected]>
ntp: Safeguard against time_constant overflow
Dan Williams <[email protected]>
driver core: Fix uevent_show() vs driver detach race
Arseniy Krasnov <[email protected]>
irqchip/meson-gpio: Convert meson_gpio_irq_controller::lock to 'raw_spinlock_t'
Qianggui Song <[email protected]>
irqchip/meson-gpio: support more than 8 channels gpio irq
Paul E. McKenney <[email protected]>
clocksource: Fix brown-bag boolean thinko in cs_watchdog_read()
Feng Tang <[email protected]>
clocksource: Scale the watchdog read retries automatically
Paul E. McKenney <[email protected]>
torture: Enable clocksource watchdog with "tsc=watchdog"
Waiman Long <[email protected]>
clocksource: Reduce the default clocksource_watchdog() retries to 2
Justin Stitt <[email protected]>
ntp: Clamp maxerror and esterror to operating range
Jason Wang <[email protected]>
vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler
Thomas Gleixner <[email protected]>
tick/broadcast: Move per CPU pointer access into the atomic section
Vamshi Gajjela <[email protected]>
scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic
Damien Le Moal <[email protected]>
scsi: mpi3mr: Avoid IOMMU page faults on REPORT ZONES
Prashanth K <[email protected]>
usb: gadget: u_serial: Set start_delayed during suspend
Chris Wulff <[email protected]>
usb: gadget: core: Check for unset descriptor
Marek Marczykowski-Górecki <[email protected]>
USB: serial: debug: do not echo input by default
Oliver Neukum <[email protected]>
usb: vhci-hcd: Do not drop references before new references are gained
Takashi Iwai <[email protected]>
ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4
Steven 'Steve' Kendall <[email protected]>
ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list
Takashi Iwai <[email protected]>
ALSA: line6: Fix racy access to midibuf
Ma Ke <[email protected]>
drm/client: fix null pointer dereference in drm_client_modeset_probe
Jerome Brunet <[email protected]>
ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT
Takashi Iwai <[email protected]>
ALSA: usb-audio: Re-add ScratchAmp quirk entries
Stefan Wahren <[email protected]>
spi: spi-fsl-lpspi: Fix scldiv calculation
Masami Hiramatsu (Google) <[email protected]>
kprobes: Fix to check symbol prefixes correctly
Menglong Dong <[email protected]>
bpf: kprobe: remove unused declaring of bpf_kprobe_override
Guenter Roeck <[email protected]>
i2c: smbus: Send alert notifications to all devices if source not found
Geert Uytterhoeven <[email protected]>
spi: spidev: Add missing spi_device_id for bh2228fv
Krzysztof Kozlowski <[email protected]>
ASoC: codecs: wsa881x: Correct Soundwire ports mask
Krzysztof Kozlowski <[email protected]>
ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask
Guenter Roeck <[email protected]>
i2c: smbus: Improve handling of stuck alerts
Mark Rutland <[email protected]>
arm64: errata: Expand speculative SSBS workaround (again)
Mark Rutland <[email protected]>
arm64: cputype: Add Cortex-A725 definitions
Mark Rutland <[email protected]>
arm64: cputype: Add Cortex-X1C definitions
Mark Rutland <[email protected]>
arm64: errata: Expand speculative SSBS workaround
Mark Rutland <[email protected]>
arm64: errata: Unify speculative SSBS errata logic
Mark Rutland <[email protected]>
arm64: cputype: Add Cortex-X925 definitions
Mark Rutland <[email protected]>
arm64: cputype: Add Cortex-A720 definitions
Mark Rutland <[email protected]>
arm64: cputype: Add Cortex-X3 definitions
Mark Rutland <[email protected]>
arm64: errata: Add workaround for Arm errata 3194386 and 3312417
Mark Rutland <[email protected]>
arm64: cputype: Add Neoverse-V3 definitions
Mark Rutland <[email protected]>
arm64: cputype: Add Cortex-X4 definitions
Mark Rutland <[email protected]>
arm64: barrier: Restore spec_bar() macro
Besar Wicaksono <[email protected]>
arm64: Add Neoverse-V2 part
James Morse <[email protected]>
arm64: cpufeature: Force HWCAP to be based on the sysreg visible to user-space
Kemeng Shi <[email protected]>
ext4: fix wrong unit use in ext4_mb_find_by_goal
Zheng Zucheng <[email protected]>
sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
Damien Le Moal <[email protected]>
scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
Tetsuo Handa <[email protected]>
profiling: remove profile=sleep support
Benjamin Coddington <[email protected]>
SUNRPC: Fix a race to wake a sync task
Peter Oberparleiter <[email protected]>
s390/sclp: Prevent release of buffer in I/O
Kemeng Shi <[email protected]>
jbd2: avoid memleak in jbd2_journal_write_metadata_buffer
Xiaxi Shen <[email protected]>
ext4: fix uninitialized variable in ext4_inlinedir_to_tree
Michal Pecio <[email protected]>
media: uvcvideo: Fix the bandwdith quirk on USB 3.x
Ricardo Ribalda <[email protected]>
media: uvcvideo: Ignore empty TS packets
Alex Hung <[email protected]>
drm/amd/display: Add null checker before passing variables
Ma Jun <[email protected]>
drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules
Ma Jun <[email protected]>
drm/amdgpu: Fix the null pointer dereference to ras_manager
Ma Jun <[email protected]>
drm/amdgpu/pm: Fix the null pointer dereference for smu7
Filipe Manana <[email protected]>
btrfs: fix bitmap leak when loading free space cache on duplicate entry
Johannes Berg <[email protected]>
wifi: nl80211: don't give key data to userspace
Roman Smirnov <[email protected]>
udf: prevent integer overflow in udf_bitmap_free_blocks()
FUJITA Tomonori <[email protected]>
PCI: Add Edimax Vendor ID to pci_ids.h
Yonghong Song <[email protected]>
selftests/bpf: Fix send_signal test with nested CONFIG_PARAVIRT
Thomas Weißschuh <[email protected]>
ACPI: SBS: manage alarm sysfs attribute through psy core
Thomas Weißschuh <[email protected]>
ACPI: battery: create alarm sysfs attribute atomically
Niklas Söderlund <[email protected]>
clocksource/drivers/sh_cmt: Address race condition for clock events
Yu Kuai <[email protected]>
md/raid5: avoid BUG_ON() while continue reshape after reassembling
Li Nan <[email protected]>
md: do not delete safemode_timer in mddev_suspend
Paul E. McKenney <[email protected]>
rcutorture: Fix rcu_torture_fwd_cb_cr() data race
Csókás, Bence <[email protected]>
net: fec: Stop PPS on driver remove
James Chapman <[email protected]>
l2tp: fix lockdep splat
Joe Hattori <[email protected]>
net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
Dmitry Antipov <[email protected]>
Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()
Eric Dumazet <[email protected]>
net: linkwatch: use system_unbound_wq
Nikolay Aleksandrov <[email protected]>
net: bridge: mcast: wait for previous gc cycles when removing port
Daniele Palmas <[email protected]>
net: usb: qmi_wwan: fix memory leak for not ip packets
Kuniyuki Iwashima <[email protected]>
sctp: Fix null-ptr-deref in reuseport_add_sock().
Xin Long <[email protected]>
sctp: move hlist_node and hashent out of sctp_ep_common
Peter Zijlstra <[email protected]>
x86/mm: Fix pti_clone_entry_text() for i386
Peter Zijlstra <[email protected]>
x86/mm: Fix pti_clone_pgtable() alignment assumption
Yipeng Zou <[email protected]>
irqchip/mbigen: Fix mbigen node address layout
Marc Zyngier <[email protected]>
genirq: Allow irq_chip registration functions to take a const irq_chip
Alexander Maltsev <[email protected]>
netfilter: ipset: Add list flush to cancel_gc
Paolo Abeni <[email protected]>
mptcp: fix duplicate data handling
Heiner Kallweit <[email protected]>
r8169: don't increment tx_dropped in case of NETDEV_TX_BUSY
Ma Ke <[email protected]>
net: usb: sr9700: fix uninitialized variable use in sr_mdio_read
Zack Rusin <[email protected]>
drm/vmwgfx: Fix a deadlock in dma buf fence polling
Edmund Raile <[email protected]>
Revert "ALSA: firewire-lib: operate for period elapse event in process context"
Edmund Raile <[email protected]>
Revert "ALSA: firewire-lib: obsolete workqueue for period update"
Mavroudis Chatzilazaridis <[email protected]>
ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G
Takashi Iwai <[email protected]>
ALSA: usb-audio: Correct surround channels in UAC1 channel map
Al Viro <[email protected]>
protect the fetch of ->fd[fd] in do_dup2() from mispredictions
Tatsunosuke Tobita <[email protected]>
HID: wacom: Modify pen IDs
Patryk Duda <[email protected]>
platform/chrome: cros_ec_proto: Lock device when updating MKBP version
Justin Stitt <[email protected]>
power: supply: bq24190_charger: replace deprecated strncpy with strscpy
Zhe Qiao <[email protected]>
riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()
Maciej Żenczykowski <[email protected]>
ipv6: fix ndisc_is_useropt() handling for PIO
Shahar Shitrit <[email protected]>
net/mlx5e: Add a check for the return value from mlx5_port_set_eth_ptys
Kuniyuki Iwashima <[email protected]>
netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init().
Kuniyuki Iwashima <[email protected]>
netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init().
Dan Carpenter <[email protected]>
net: mvpp2: Don't re-use loop iterator
Alexandra Winter <[email protected]>
net/iucv: fix use after free in iucv_sock_close()
Kuniyuki Iwashima <[email protected]>
rtnetlink: Don't ignore IFLA_TARGET_NETNSID when ifname is specified in rtnl_dellink().
Florent Fourcot <[email protected]>
rtnetlink: enable alt_ifname for setlink/newlink
songxiebing <[email protected]>
ALSA: hda: conexant: Fix headset auto detect fail in the polling mode
Eric Dumazet <[email protected]>
sched: act_ct: take care of padding in struct zones_ht_key
Ian Forbes <[email protected]>
drm/vmwgfx: Fix overlay when using Screen Targets
Danilo Krummrich <[email protected]>
drm/nouveau: prime: fix refcount underflow
Jiaxun Yang <[email protected]>
MIPS: dts: loongson: Fix ls2k1000-rtc interrupt
Jiaxun Yang <[email protected]>
MIPS: dts: loongson: Fix liointc IRQ polarity
Jiaxun Yang <[email protected]>
MIPS: Loongson64: DTS: Fix PCIe port nodes for ls7a
Binbin Zhou <[email protected]>
MIPS: Loongson64: DTS: Add RTC support to Loongson-2K1000
Aleksandr Mishin <[email protected]>
remoteproc: imx_rproc: Fix refcount mistake in imx_rproc_addr_init
Wayne Lin <[email protected]>
drm/dp_mst: Fix all mstb marked as not probed after suspend/resume
Shenwei Wang <[email protected]>
irqchip/imx-irqsteer: Handle runtime power management correctly
Lucas Stach <[email protected]>
irqchip/imx-irqsteer: Add runtime PM support
Lucas Stach <[email protected]>
irqchip/imx-irqsteer: Constify irq_chip struct
Marc Zyngier <[email protected]>
genirq: Allow the PM device to originate from irq domain
Herve Codina <[email protected]>
irqdomain: Fixed unbalanced fwnode get and put
Thomas Weißschuh <[email protected]>
leds: triggers: Flush pending brightness before activating trigger
Hans de Goede <[email protected]>
leds: trigger: Call synchronize_rcu() before calling trig->activate()
Heiner Kallweit <[email protected]>
leds: trigger: Store brightness set by led_trigger_event()
Heiner Kallweit <[email protected]>
leds: trigger: Remove unused function led_trigger_rename_static()
Johannes Berg <[email protected]>
leds: trigger: use RCU to protect the led_cdevs list
Jay Buddhabhatti <[email protected]>
drivers: soc: xilinx: check return status of get_api_version()
Michael Tretter <[email protected]>
soc: xilinx: move PM_INIT_FINALIZE to zynqmp_pm_domains driver
Zhang Yi <[email protected]>
ext4: check the extent status again before inserting delalloc block
Zhang Yi <[email protected]>
ext4: factor out a common helper to query extent map
Zhang Yi <[email protected]>
ext4: convert to exclusive lock while inserting delalloc extents
Zhang Yi <[email protected]>
ext4: refactor ext4_da_map_blocks()
Baokun Li <[email protected]>
ext4: make ext4_es_insert_extent() return void
Thomas Weißschuh <[email protected]>
sysctl: always initialize i_uid/i_gid
Krishna Kurapati <[email protected]>
arm64: dts: qcom: ipq8074: Disable SS instance in Parkmode for USB
Krishna Kurapati <[email protected]>
arm64: dts: qcom: msm8998: Disable SS instance in Parkmode for USB
Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: msm8998: switch USB QMP PHY to new style of bindings
Johan Hovold <[email protected]>
arm64: dts: qcom: msm8998: drop USB PHY clock index
Shawn Guo <[email protected]>
arm64: dts: qcom: msm8996: Move '#clock-cells' to QMP PHY child node
Esben Haabendal <[email protected]>
powerpc/configs: Update defconfig with now user-visible CONFIG_FSL_IFC
Seth Forshee (DigitalOcean) <[email protected]>
fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT
Leon Romanovsky <[email protected]>
nvme-pci: add missing condition check for existence of mapped data
Jens Axboe <[email protected]>
nvme: separate command prep and issue
Jens Axboe <[email protected]>
nvme: split command copy into a helper
Artem Chernyshev <[email protected]>
iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en
Gerd Bayer <[email protected]>
s390/pci: Allow allocation of more than 1 MSI interrupt
Gerd Bayer <[email protected]>
s390/pci: Refactor arch_setup_msi_irqs()
Thomas Gleixner <[email protected]>
s390/pci: Rework MSI descriptor walk
ethanwu <[email protected]>
ceph: fix incorrect kmalloc size of pagevec mempool
Pierre-Louis Bossart <[email protected]>
ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable
Conor Dooley <[email protected]>
spi: spidev: add correct compatible for Rohm BH2228FV
Krzysztof Kozlowski <[email protected]>
spi: spidev: order compatibles alphabetically
Vincent Tremblay <[email protected]>
spidev: Add Silicon Labs EM3581 device compatible
Andy Shevchenko <[email protected]>
spi: spidev: Replace OF specific code by device property API
Andy Shevchenko <[email protected]>
spi: spidev: Replace ACPI specific code by device_get_match_data()
Javier Martinez Canillas <[email protected]>
spi: spidev: Make probe to fail early if a spidev compatible is used
Al Viro <[email protected]>
lirc: rc_dev_get_from_fd(): fix file leak
Al Viro <[email protected]>
powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap()
Xiao Liang <[email protected]>
apparmor: Fix null pointer deref when receiving skb during sock creation
Dan Carpenter <[email protected]>
mISDN: Fix a use after free in hfcmulti_tx()
Fred Li <[email protected]>
bpf: Fix a segment issue when downgrading gso_size
Petr Machata <[email protected]>
net: nexthop: Initialize all fields in dumped nexthops
Simon Horman <[email protected]>
net: stmmac: Correct byte order of perfect_match
Shigeru Yoshida <[email protected]>
tipc: Return non-zero value from tipc_udp_addr2str() on error
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo_avx2: disable softinterrupts
Johannes Berg <[email protected]>
net: bonding: correctly annotate RCU in bond_should_notify_peers()
Ido Schimmel <[email protected]>
ipv4: Fix incorrect source address in Record Route option
Gregory CLEMENT <[email protected]>
MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later
Hou Tao <[email protected]>
bpf, events: Use prog to emit ksymbol event for main program
Lance Richardson <[email protected]>
dma: fix call order in dmam_free_coherent
Andrii Nakryiko <[email protected]>
libbpf: Fix no-args func prototype BTF dumping syntax
Johannes Berg <[email protected]>
um: time-travel: fix signal blocking race/hang
Johannes Berg <[email protected]>
um: time-travel: fix time-travel-start option
Ma Ke <[email protected]>
phy: cadence-torrent: Check return value on register read
Vignesh Raghavendra <[email protected]>
dmaengine: ti: k3-udma: Fix BCHAN count with UHC and HC channels
Jeongjun Park <[email protected]>
jfs: Fix array-index-out-of-bounds in diFree
Douglas Anderson <[email protected]>
kdb: Use the passed prompt in kdb_position_cursor()
Arnd Bergmann <[email protected]>
kdb: address -Wformat-security warnings
Pavel Begunkov <[email protected]>
kernel: rerun task_work while freezing in get_signal()
Pavel Begunkov <[email protected]>
io_uring/io-wq: limit retrying worker initialisation
Ryusuke Konishi <[email protected]>
nilfs2: handle inconsistent state in nilfs_btnode_create_block()
WangYuli <[email protected]>
Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591
Hilda Wu <[email protected]>
Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables
Ilya Dryomov <[email protected]>
rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings
Ilya Dryomov <[email protected]>
rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait
Dragan Simic <[email protected]>
drm/panfrost: Mark simple_ondemand governor as softdep
Jiaxun Yang <[email protected]>
MIPS: Loongson64: Test register availability before use
Jiaxun Yang <[email protected]>
MIPS: Loongson64: reset: Prioritise firmware service
Jiaxun Yang <[email protected]>
MIPS: Loongson64: Remove memory node for builtin-dtb
Jiaxun Yang <[email protected]>
MIPS: Loongson64: env: Hook up Loongsson-2K
Jiaxun Yang <[email protected]>
MIPS: dts: loongson: Fix GMAC phy node
Jiaxun Yang <[email protected]>
MIPS: ip30: ip30-console: Add missing include
Aleksandr Mishin <[email protected]>
remoteproc: imx_rproc: Skip over memory region when node value is NULL
Gwenael Treuveur <[email protected]>
remoteproc: stm32_rproc: Fix mailbox interrupts queuing
Ilya Dryomov <[email protected]>
rbd: don't assume rbd_is_lock_owner() for exclusive mappings
Michael Ellerman <[email protected]>
selftests/sigaltstack: Fix ppc64 GCC build
Bart Van Assche <[email protected]>
RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
Jiaxun Yang <[email protected]>
platform: mips: cpu_hwmon: Disable driver on unsupported hardware
Thomas Gleixner <[email protected]>
watchdog/perf: properly initialize the turbo mode timestamp and rearm counter
Joy Chakraborty <[email protected]>
rtc: isl1208: Fix return value of nvmem callbacks
Imre Deak <[email protected]>
drm/i915/dp: Reset intel_dp->link_trained before retraining the link
Alex Deucher <[email protected]>
drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell
Nitin Gote <[email protected]>
drm/i915/gt: Do not consider preemption during execlists_dequeue for gen8
Adrian Hunter <[email protected]>
perf/x86/intel/pt: Fix a topa_entry base address calculation
Marco Cavenati <[email protected]>
perf/x86/intel/pt: Fix topa_entry base length
Kan Liang <[email protected]>
perf/x86/intel/uncore: Fix the bits of the CHA extended umask for SPR
Frederic Weisbecker <[email protected]>
perf: Fix event leak upon exec and file release
Frederic Weisbecker <[email protected]>
perf: Fix event leak upon exit
Nilesh Javali <[email protected]>
scsi: qla2xxx: validate nvme_local_port correctly
Shreyas Deodhar <[email protected]>
scsi: qla2xxx: Complete command early within lock
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix flash read failure
Quinn Tran <[email protected]>
scsi: qla2xxx: Use QP lock to search for bsg
Shreyas Deodhar <[email protected]>
scsi: qla2xxx: Fix for possible memory corruption
Quinn Tran <[email protected]>
scsi: qla2xxx: Unable to act on RSCN for port online
Manish Rangankar <[email protected]>
scsi: qla2xxx: During vport delete send async logout explicitly
Joy Chakraborty <[email protected]>
rtc: cmos: Fix return value of nvmem callbacks
Tvrtko Ursulin <[email protected]>
mm/numa_balancing: teach mpol_to_str about the balancing mode
Zijun Hu <[email protected]>
devres: Fix memory leakage caused by driver API devm_free_percpu()
Zijun Hu <[email protected]>
devres: Fix devm_krealloc() wasting memory
Bailey Forrest <[email protected]>
gve: Fix an edge case for TSO skb validity check
Zijun Hu <[email protected]>
kobject_uevent: Fix OOB access within zap_modalias_env()
Nathan Chancellor <[email protected]>
kbuild: Fix '-S -c' in x86 stack protector scripts
Ross Lagerwall <[email protected]>
decompress_bunzip2: fix rare decompression failure
Fedor Pchelkin <[email protected]>
ubi: eba: properly rollback inside self_check_eba
Bastien Curutchet <[email protected]>
clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use
Saurav Kashyap <[email protected]>
scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds
Huacai Chen <[email protected]>
fs/ntfs3: Update log->page_{mask,bits} if log->page_size changedtuhaowen <[email protected]>
dev/parport: fix the array out-of-bounds risk
Carlos Llamas <[email protected]>
binder: fix hang of unregistered readers
Manivannan Sadhasivam <[email protected]>
PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio
Niklas Cassel <[email protected]>
PCI: dw-rockchip: Fix initial PERST# GPIO value
Wei Liu <[email protected]>
PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN
Ilpo Järvinen <[email protected]>
hwrng: amd - Convert PCIBIOS_* return codes to errnos
Alan Stern <[email protected]>
tools/memory-model: Fix bug in lock.cat
wangdicheng <[email protected]>
ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
Takashi Iwai <[email protected]>
ALSA: usb-audio: Move HD Webcam quirk to the right place
wangdicheng <[email protected]>
ALSA: usb-audio: Fix microphone sound on HD webcam.
Sean Christopherson <[email protected]>
KVM: VMX: Split out the non-virtualization part of vmx_interrupt_blocked()
Ricardo Ribalda <[email protected]>
media: uvcvideo: Fix integer overflow calculating timestamp
Jan Kara <[email protected]>
jbd2: make jbd2_journal_get_max_txn_bufs() internal
Ilpo Järvinen <[email protected]>
leds: ss4200: Convert PCIBIOS_* return codes to errnos
Rafael Beims <[email protected]>
wifi: mwifiex: Fix interface type change
Mickaël Salaün <[email protected]>
selftests/landlock: Add cred_transfer test
Pavel Begunkov <[email protected]>
io_uring: tighten task exit cancellations
Baokun Li <[email protected]>
ext4: make sure the first directory block is not a hole
Baokun Li <[email protected]>
ext4: check dot and dotdot of dx_root before making dir indexed
Paolo Pisati <[email protected]>
m68k: amiga: Turn off Warp1260 interrupts during boot
Jan Kara <[email protected]>
udf: Avoid using corrupted block bitmap buffer
Frederic Weisbecker <[email protected]>
task_work: Introduce task_work_cancel() again
Frederic Weisbecker <[email protected]>
task_work: s/task_work_cancel()/task_work_cancel_func()/
Fedor Pchelkin <[email protected]>
apparmor: use kvfree_sensitive to free data->data
Pierre Gondois <[email protected]>
sched/fair: Use all little CPUs for CPU-bound workloads
Sung Joon Kim <[email protected]>
drm/amd/display: Check for NULL pointer
Shreyas Deodhar <[email protected]>
scsi: qla2xxx: Fix optrom version displayed in FDMI
Ma Ke <[email protected]>
drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
Ma Ke <[email protected]>
drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
Jan Kara <[email protected]>
ext2: Verify bitmap and itable block numbers before using them
Chao Yu <[email protected]>
hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
Igor Pylypiv <[email protected]>
ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error
Dikshita Agarwal <[email protected]>
media: venus: fix use after free in vdec_close
Joe Hattori <[email protected]>
char: tpm: Fix possible memory leak in tpm_bios_measurements_open()
Eric Sandeen <[email protected]>
fuse: verify {g,u}id mount options correctly
Tejun Heo <[email protected]>
sched/fair: set_load_weight() must also call reweight_task() for SCHED_IDLE tasks
Nicolas Dichtel <[email protected]>
ipv6: take care of scope when choosing the src addr
Chengen Du <[email protected]>
af_packet: Handle outgoing VLAN packets without hardware offloading
Breno Leitao <[email protected]>
net: netconsole: Disable target before netpoll cleanup
Yu Liao <[email protected]>
tick/broadcast: Make takeover of broadcast hrtimer reliable
Krzysztof Kozlowski <[email protected]>
dt-bindings: thermal: correct thermal zone node name limit
Tetsuo Handa <[email protected]>
mm: mmap_lock: replace get_memcg_path_buf() with on-stack buffer
Miaohe Lin <[email protected]>
mm/hugetlb: fix possible recursive locking detected warning
Jann Horn <[email protected]>
landlock: Don't lose track of restrictions on cred_transfer
Carlos López <[email protected]>
s390/dasd: fix error checks in dasd_copy_pair_store()
Konstantin Komarov <[email protected]>
fs/ntfs3: Missed error return
Csókás, Bence <[email protected]>
rtc: interface: Add RTC offset to alarm after fix-up
Ryusuke Konishi <[email protected]>
nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro
David Hildenbrand <[email protected]>
fs/proc/task_mmu: indicate PM_FILE for PMD-mapped file THP
Konstantin Komarov <[email protected]>
fs/ntfs3: Fix field-spanning write in INDEX_HDR
Konstantin Komarov <[email protected]>
fs/ntfs3: Replace inode_trylock with inode_lock
Peng Fan <[email protected]>
pinctrl: freescale: mxs: Fix refcount of child
Yang Yingliang <[email protected]>
pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails
Uwe Kleine-König <[email protected]>
pinctrl: ti: ti-iodelay: Drop if block with always false condition
Yang Yingliang <[email protected]>
pinctrl: single: fix possible memory leak when pinctrl_enable() fails
Yang Yingliang <[email protected]>
pinctrl: core: fix possible memory leak when pinctrl_enable() fails
Dmitry Yashin <[email protected]>
pinctrl: rockchip: update rk3308 iomux routes
Konstantin Komarov <[email protected]>
fs/ntfs3: Fix getting file type
Konstantin Komarov <[email protected]>
fs/ntfs3: Missed NI_FLAG_UPDATE_PARENT setting
Konstantin Komarov <[email protected]>
fs/ntfs3: Fix transform resident to nonresident for compressed files
Konstantin Komarov <[email protected]>
fs/ntfs3: Merge synonym COMPRESSION_UNIT and NTFS_LZNT_CUNIT
Konstantin Komarov <[email protected]>
fs/ntfs3: Use ALIGN kernel macro
Martin Willi <[email protected]>
net: dsa: b53: Limit chip-wide jumbo frame config to CPU ports
Martin Willi <[email protected]>
net: dsa: mv88e6xxx: Limit chip-wide frame size config to CPU ports
Florian Westphal <[email protected]>
netfilter: nf_set_pipapo: fix initial map fill
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: constify lookup fn args where possible
Pablo Neira Ayuso <[email protected]>
netfilter: ctnetlink: use helper function to calculate expect ID
Jack Wang <[email protected]>
bnxt_re: Fix imm_data endianness
Chengchang Tang <[email protected]>
RDMA/hns: Fix insufficient extend DB for VFs.
Chengchang Tang <[email protected]>
RDMA/hns: Fix undifined behavior caused by invalid max_sge
Chengchang Tang <[email protected]>
RDMA/hns: Fix missing pagesize and alignment check in FRMR
Nick Bowler <[email protected]>
macintosh/therm_windtunnel: fix module unload.
Michael Ellerman <[email protected]>
powerpc/xmon: Fix disassembly CPU feature checks
Dominique Martinet <[email protected]>
MIPS: Octeron: remove source file executable bit
Denis Arefev <[email protected]>
net: missing check virtio
Michael S. Tsirkin <[email protected]>
vhost/vsock: always initialize seqpacket_allow
Dan Carpenter <[email protected]>
PCI: endpoint: Clean up error handling in vpci_scan_bus()
Dmitry Torokhov <[email protected]>
Input: elan_i2c - do not leave interrupt disabled on suspend failure
Leon Romanovsky <[email protected]>
RDMA/device: Return error earlier if port in not valid
Arnd Bergmann <[email protected]>
mtd: make mtd_test.c a separate module
Chen Ni <[email protected]>
ASoC: max98088: Check for clk_prepare_enable() error
Honggang LI <[email protected]>
RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs
Leon Romanovsky <[email protected]>
RDMA/mlx4: Fix truncated output warning in alias_GUID.c
Leon Romanovsky <[email protected]>
RDMA/mlx4: Fix truncated output warning in mad.c
Andrei Lalaev <[email protected]>
Input: qt1050 - handle CHIP_ID reading error
Leon Romanovsky <[email protected]>
RDMA/cache: Release GID table even if leak is detected
Chiara Meiohas <[email protected]>
RDMA/mlx5: Set mkeys for dmabuf at PAGE_SIZE
James Clark <[email protected]>
coresight: Fix ref leak when of_coresight_parse_endpoint() fails
Taniya Das <[email protected]>
clk: qcom: gcc-sc7280: Update force mem core bit for UFS ICE clock
Konrad Dybcio <[email protected]>
clk: qcom: branch: Add helper functions for setting retain bits
Ilpo Järvinen <[email protected]>
PCI: Fix resource double counting on remove & rescan
Benjamin Coddington <[email protected]>
SUNRPC: Fixup gss_status tracepoint error output
Andreas Larsson <[email protected]>
sparc64: Fix incorrect function signature and add prototype for prom_cif_init
Jan Kara <[email protected]>
ext4: avoid writing unitialized memory to disk in EA inodes
Luis Henriques (SUSE) <[email protected]>
ext4: don't track ranges in fast_commit if inode has inlined data
Ritesh Harjani <[email protected]>
ext4: return early for non-eligible fast_commit track events
Olga Kornievskaia <[email protected]>
NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server
NeilBrown <[email protected]>
SUNRPC: avoid soft lockup when transmitting UDP to reachable server.
Chuck Lever <[email protected]>
xprtrdma: Fix rpcrdma_reqs_reset()
Javier Carrasco <[email protected]>
mfd: omap-usb-tll: Use struct_size to allocate tll
Arnd Bergmann <[email protected]>
mfd: rsmu: Split core code into separate module
Adrian Hunter <[email protected]>
perf intel-pt: Fix exclude_guest setting
Adrian Hunter <[email protected]>
perf intel-pt: Fix aux_watermark calculation for 64-bit size
Dikshita Agarwal <[email protected]>
media: venus: flush all buffers in output plane streamoff
Luis Henriques (SUSE) <[email protected]>
ext4: fix infinite loop when replaying fast_commit
Luca Ceresoli <[email protected]>
Revert "leds: led-core: Fix refcount leak in of_led_get()"
Chen Ni <[email protected]>
drm/qxl: Add check for drm_cvt_mode
Lucas Stach <[email protected]>
drm/etnaviv: fix DMA direction handling for cached RW buffers
Namhyung Kim <[email protected]>
perf report: Fix condition in sort__sym_cmp()
Hans de Goede <[email protected]>
leds: trigger: Unregister sysfs attributes before calling deactivate()
Hsiao Chien Sung <[email protected]>
drm/mediatek: Add DRM_MODE_ROTATE_0 to rotation property
Hsiao Chien Sung <[email protected]>
drm/mediatek: Add missing plane settings when async update
Laurent Pinchart <[email protected]>
media: renesas: vsp1: Store RPF partition configuration per RPF instance
Laurent Pinchart <[email protected]>
media: renesas: vsp1: Fix _irqsave and _irq mix
Daniel Schaefer <[email protected]>
media: uvcvideo: Override default flags
Aleksandr Burakov <[email protected]>
saa7134: Unchecked i2c_transfer function result fixed
David Hildenbrand <[email protected]>
s390/uv: Don't call folio_wait_writeback() without a folio reference
Matthew Wilcox (Oracle) <[email protected]>
s390/mm: Convert gmap_make_secure to use a folio
Matthew Wilcox (Oracle) <[email protected]>
s390/mm: Convert make_page_secure to use a folio
Claudio Imbrenda <[email protected]>
KVM: s390: fix race in gmap_make_secure()
Claudio Imbrenda <[email protected]>
KVM: s390: pv: add export before import
Claudio Imbrenda <[email protected]>
KVM: s390: pv: properly handle page flags for protected guests
Claudio Imbrenda <[email protected]>
KVM: s390: pv: avoid stalls when making pages secure
Bryan O'Donoghue <[email protected]>
media: i2c: Fix imx412 exposure control
Ricardo Ribalda <[email protected]>
media: imon: Fix race getting ictx->lock
Zheng Yejian <[email protected]>
media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
Douglas Anderson <[email protected]>
drm/panel: boe-tv101wum-nl6: Check for errors on the NOP in prepare()
Douglas Anderson <[email protected]>
drm/panel: boe-tv101wum-nl6: If prepare fails, disable GPIO before regulators
Friedrich Vock <[email protected]>
drm/amdgpu: Check if NBIO funcs are NULL in amdgpu_device_baco_exit
Lijo Lazar <[email protected]>
drm/amd/pm: Fix aldebaran pcie speed reporting
Taehee Yoo <[email protected]>
xdp: fix invalid wait context of page_pool_destroy()
Amit Cohen <[email protected]>
selftests: forwarding: devlink_lib: Wait for udev events after reloading
Alan Maguire <[email protected]>
bpf: Eliminate remaining "make W=1" warnings in kernel/bpf/btf.o
Alexey Kodanev <[email protected]>
bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
Alan Maguire <[email protected]>
bpf: annotate BTF show functions with __printf
Geliang Tang <[email protected]>
selftests/bpf: Close fd in error path in drop_on_reuseport
John Stultz <[email protected]>
locking/rwsem: Add __always_inline annotation to __down_write_common() and inlined callers
Johannes Berg <[email protected]>
wifi: virt_wifi: don't use strlen() in const context
Gaosheng Cui <[email protected]>
gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey
En-Wei Wu <[email protected]>
wifi: virt_wifi: avoid reporting connection success with wrong SSID
Adrian Hunter <[email protected]>
perf: Fix default aux_watermark calculation
Adrian Hunter <[email protected]>
perf: Prevent passing zero nr_pages to rb_alloc_aux()
Adrian Hunter <[email protected]>
perf: Fix perf_aux_size() for greater-than 32-bit size
Adrian Hunter <[email protected]>
perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: rise cap on SELinux secmark context
Ismael Luceno <[email protected]>
ipvs: Avoid unnecessary calls to skb_is_gso_sctp
Donglin Peng <[email protected]>
libbpf: Checking the btf_type kind when fixing variable offsets
Csókás, Bence <[email protected]>
net: fec: Fix FEC_ECR_EN1588 being cleared on link-down
Csókás Bence <[email protected]>
net: fec: Refactor: #define magic constants
Baochen Qiang <[email protected]>
wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
Baochen Qiang <[email protected]>
wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he()
Baochen Qiang <[email protected]>
wifi: ath11k: fix wrong handling of CCMP256 and GCMP ciphers
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl: Fix ACL scale regression and firmware errors
Amit Cohen <[email protected]>
mlxsw: spectrum_acl_bloom_filter: Make mlxsw_sp_acl_bf_key_encode() more flexible
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_erp: Fix object nesting warning
Ido Schimmel <[email protected]>
lib: objagg: Fix general protection fault
Geliang Tang <[email protected]>
selftests/bpf: Check length of recv in test_sockmap
Guangguan Wang <[email protected]>
net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined
Eric Dumazet <[email protected]>
tcp: fix races in tcp_v[46]_err()
Eric Dumazet <[email protected]>
tcp: fix race in tcp_write_err()
Eric Dumazet <[email protected]>
tcp: add tcp_done_with_error() helper
Eric Dumazet <[email protected]>
tcp: annotate lockless access to sk->sk_err
Eric Dumazet <[email protected]>
tcp: annotate lockless accesses to sk->sk_err_soft
Hagar Hemdan <[email protected]>
net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP
Geliang Tang <[email protected]>
selftests/bpf: Fix prog numbers in test_sockmap
Samasth Norway Ananda <[email protected]>
wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device
Marek Behún <[email protected]>
firmware: turris-mox-rwtm: Initialize completion before mailbox
Marek Behún <[email protected]>
firmware: turris-mox-rwtm: Fix checking return value of wait_for_completion_timeout()
Marek Behún <[email protected]>
firmware: turris-mox-rwtm: Do not complete if there are no waiters
Christophe Leroy <[email protected]>
vmlinux.lds.h: catch .bss..L* sections into BSS")
Dmitry Torokhov <[email protected]>
ARM: spitz: fix GPIO assignment for backlight
Arnd Bergmann <[email protected]>
ARM: pxa: spitz: use gpio descriptors for audio
Thorsten Blum <[email protected]>
m68k: cmpxchg: Fix return value for default case in __arch_xchg()
Chen Ni <[email protected]>
x86/xen: Convert comma to semicolon
Eero Tamminen <[email protected]>
m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages
Jerome Brunet <[email protected]>
arm64: dts: amlogic: gx: correct hdmi clocks
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add ports node for anx7625
Rafał Miłecki <[email protected]>
arm64: dts: mediatek: mt7622: fix "emmc" pinctrl mux
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8183-kukui: Drop bogus output-enable property
Michael Walle <[email protected]>
ARM: dts: imx6qdl-kontron-samx6i: fix PCIe reset polarity
Michael Walle <[email protected]>
ARM: dts: imx6qdl-kontron-samx6i: fix SPI0 chip selects
Michael Walle <[email protected]>
ARM: dts: imx6qdl-kontron-samx6i: fix board reset
Michael Walle <[email protected]>
ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset
Marco Felsch <[email protected]>
ARM: dts: imx6qdl-kontron-samx6i: move phy reset into phy-node
Jonas Karlman <[email protected]>
arm64: dts: rockchip: Increase VOP clk rate on RK3328
Dmitry Baryshkov <[email protected]>
soc: qcom: pdr: fix parsing of domains lists
Dmitry Baryshkov <[email protected]>
soc: qcom: pdr: protect locator_addr with the main mutex
Esben Haabendal <[email protected]>
memory: fsl_ifc: Make FSL_IFC config visible and selectable
Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: msm8996: specify UFS core_clk frequencies
Stephen Boyd <[email protected]>
soc: qcom: rpmh-rsc: Ensure irqs aren't disabled by rpmh_rsc_send_data() callers
Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sm8250: add power-domain to UFS PHY
Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sm8250: switch UFS QMP PHY to new style of bindings
Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sdm845: add power-domain to UFS PHY
Guenter Roeck <[email protected]>
hwmon: (max6697) Fix swapped temp{1,8} critical alarms
Guenter Roeck <[email protected]>
hwmon: (max6697) Fix underflow when writing limit attributes
Yao Zi <[email protected]>
drm/meson: fix canvas release in bind function
Uwe Kleine-König <[email protected]>
pwm: stm32: Always do lazy disabling
Wayne Tung <[email protected]>
hwmon: (adt7475) Fix default duty on fan is disabled
Ilpo Järvinen <[email protected]>
x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos
Ilpo Järvinen <[email protected]>
x86/pci/xen: Fix PCIBIOS_* return code handling
Ilpo Järvinen <[email protected]>
x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling
Ilpo Järvinen <[email protected]>
x86/of: Return consistent error type from x86_of_pci_irq_enable()
Chao Yu <[email protected]>
hfsplus: fix to avoid false alarm of circular locking
Christoph Hellwig <[email protected]>
block: initialize integrity buffer to zero before writing it to media
Jinyoung Choi <[email protected]>
block: cleanup bio_integrity_prep
Nitesh Shetty <[email protected]>
block: refactor to use helper
Tzung-Bi Shih <[email protected]>
platform/chrome: cros_ec_debugfs: fix wrong EC message version
Arnd Bergmann <[email protected]>
EDAC, i10nm: make skx_common.o a separate module
Chao Yu <[email protected]>
f2fs: fix to don't dirty inode for readonly filesystem
Chao Yu <[email protected]>
f2fs: fix return value of f2fs_convert_inline_inode()
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 10 +-
Documentation/arm64/cpu-feature-registers.rst | 38 ++++-
Documentation/arm64/silicon-errata.rst | 36 ++++
.../devicetree/bindings/thermal/thermal-zones.yaml | 5 +-
Makefile | 4 +-
arch/arm/boot/dts/imx6q-kontron-samx6i.dtsi | 23 ---
arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 26 ++-
arch/arm/mach-pxa/spitz.c | 39 ++++-
arch/arm/mach-pxa/{include/mach => }/spitz.h | 2 +-
arch/arm/mach-pxa/spitz_pm.c | 2 +-
arch/arm64/Kconfig | 38 +++++
arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi | 4 +-
arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 4 +-
.../boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts | 4 +-
arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts | 4 +-
.../boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 25 +--
arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 2 -
arch/arm64/boot/dts/qcom/ipq8074.dtsi | 6 +-
arch/arm64/boot/dts/qcom/msm8996.dtsi | 8 +-
arch/arm64/boot/dts/qcom/msm8998.dtsi | 36 ++--
arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +
arch/arm64/boot/dts/qcom/sm8250.dtsi | 22 +--
arch/arm64/boot/dts/qcom/sm8350.dtsi | 3 -
arch/arm64/boot/dts/rockchip/rk3328.dtsi | 4 +-
arch/arm64/include/asm/barrier.h | 4 +
arch/arm64/include/asm/cputype.h | 16 ++
arch/arm64/kernel/cpu_errata.c | 31 ++++
arch/arm64/kernel/cpufeature.c | 94 +++++++++--
arch/arm64/kernel/proton-pack.c | 12 ++
arch/arm64/tools/cpucaps | 1 +
arch/m68k/amiga/config.c | 9 +
arch/m68k/atari/ataints.c | 6 +-
arch/m68k/include/asm/cmpxchg.h | 2 +-
arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi | 98 +++++++----
arch/mips/include/asm/mach-loongson64/boot_param.h | 2 +
arch/mips/include/asm/mips-cm.h | 4 +
arch/mips/kernel/smp-cps.c | 5 +-
arch/mips/loongson64/env.c | 8 +
arch/mips/loongson64/reset.c | 38 ++---
arch/mips/loongson64/smp.c | 23 ++-
arch/mips/pci/pcie-octeon.c | 0
arch/mips/sgi-ip30/ip30-console.c | 1 +
arch/powerpc/configs/85xx-hw.config | 2 +
arch/powerpc/include/asm/interrupt.h | 14 +-
arch/powerpc/include/asm/percpu.h | 10 ++
arch/powerpc/kernel/setup_64.c | 2 +
arch/powerpc/kvm/powerpc.c | 4 +-
arch/powerpc/xmon/ppc-dis.c | 33 ++--
arch/riscv/mm/fault.c | 17 +-
arch/s390/include/asm/pgtable.h | 9 +-
arch/s390/include/asm/uv.h | 10 +-
arch/s390/kernel/uv.c | 163 +++++++++++++-----
arch/s390/kvm/intercept.c | 5 +
arch/s390/mm/gmap.c | 4 +-
arch/s390/pci/pci_irq.c | 116 ++++++++-----
arch/sparc/include/asm/oplib_64.h | 1 +
arch/sparc/prom/init_64.c | 3 -
arch/sparc/prom/p1275.c | 2 +-
arch/um/kernel/time.c | 4 +-
arch/um/os-Linux/signal.c | 118 ++++++++++---
arch/x86/events/intel/pt.c | 4 +-
arch/x86/events/intel/pt.h | 4 +-
arch/x86/events/intel/uncore_snbep.c | 6 +-
arch/x86/kernel/cpu/mtrr/mtrr.c | 2 +-
arch/x86/kernel/devicetree.c | 2 +-
arch/x86/kvm/vmx/vmx.c | 11 +-
arch/x86/kvm/vmx/vmx.h | 1 +
arch/x86/mm/pti.c | 8 +-
arch/x86/pci/intel_mid_pci.c | 4 +-
arch/x86/pci/xen.c | 4 +-
arch/x86/platform/intel/iosf_mbi.c | 4 +-
arch/x86/xen/p2m.c | 4 +-
block/bio-integrity.c | 21 ++-
drivers/acpi/battery.c | 16 +-
drivers/acpi/sbs.c | 23 +--
drivers/android/binder.c | 4 +-
drivers/ata/libata-scsi.c | 7 +-
drivers/base/core.c | 13 +-
drivers/base/devres.c | 11 +-
drivers/base/module.c | 4 +
drivers/block/rbd.c | 35 ++--
drivers/bluetooth/btusb.c | 4 +
drivers/char/hw_random/amd-rng.c | 4 +-
drivers/char/tpm/eventlog/common.c | 2 +
drivers/clk/davinci/da8xx-cfgchip.c | 4 +-
drivers/clk/qcom/clk-branch.h | 26 +++
drivers/clk/qcom/gcc-sc7280.c | 3 +
drivers/clocksource/sh_cmt.c | 13 +-
drivers/dma/ti/k3-udma.c | 4 +-
drivers/edac/Makefile | 10 +-
drivers/edac/skx_common.c | 21 ++-
drivers/edac/skx_common.h | 4 +-
drivers/firmware/turris-mox-rwtm.c | 23 ++-
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 7 +-
drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 12 ++
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 9 +-
drivers/gpu/drm/amd/display/dc/core/dc_surface.c | 3 +-
.../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 55 +++---
.../gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c | 14 +-
.../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 7 +-
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 4 +-
drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c | 5 +-
drivers/gpu/drm/drm_client_modeset.c | 5 +
drivers/gpu/drm/drm_dp_mst_topology.c | 4 +-
drivers/gpu/drm/etnaviv/etnaviv_gem.c | 6 +-
drivers/gpu/drm/gma500/cdv_intel_lvds.c | 3 +
drivers/gpu/drm/gma500/psb_intel_lvds.c | 3 +
drivers/gpu/drm/i915/display/intel_dp.c | 2 +
drivers/gpu/drm/i915/gem/i915_gem_mman.c | 53 +++++-
.../gpu/drm/i915/gt/intel_execlists_submission.c | 6 +-
drivers/gpu/drm/mediatek/mtk_disp_ovl.c | 17 +-
drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h | 6 +-
drivers/gpu/drm/mediatek/mtk_drm_plane.c | 4 +-
drivers/gpu/drm/meson/meson_drv.c | 37 ++--
drivers/gpu/drm/mgag200/mgag200_i2c.c | 2 +-
drivers/gpu/drm/nouveau/nouveau_prime.c | 3 +-
drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 8 +-
drivers/gpu/drm/panfrost/panfrost_drv.c | 1 +
drivers/gpu/drm/qxl/qxl_display.c | 3 +
drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 17 +-
drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c | 2 +-
drivers/hid/wacom_wac.c | 3 +-
drivers/hwmon/adt7475.c | 2 +-
drivers/hwmon/max6697.c | 5 +-
drivers/hwtracing/coresight/coresight-platform.c | 4 +-
drivers/i2c/i2c-smbus.c | 64 ++++++-
drivers/infiniband/core/cache.c | 14 +-
drivers/infiniband/core/device.c | 6 +-
drivers/infiniband/core/iwcm.c | 11 +-
drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 +-
drivers/infiniband/hw/bnxt_re/qplib_fp.h | 6 +-
drivers/infiniband/hw/hns/hns_roce_device.h | 4 +
drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 6 +-
drivers/infiniband/hw/hns/hns_roce_mr.c | 5 +
drivers/infiniband/hw/hns/hns_roce_srq.c | 2 +-
drivers/infiniband/hw/mlx4/alias_GUID.c | 2 +-
drivers/infiniband/hw/mlx4/mad.c | 2 +-
drivers/infiniband/hw/mlx5/mlx5_ib.h | 13 ++
drivers/infiniband/hw/mlx5/odp.c | 6 +-
drivers/infiniband/sw/rxe/rxe_req.c | 7 +-
drivers/input/keyboard/qt1050.c | 7 +-
drivers/input/mouse/elan_i2c_core.c | 2 +
drivers/iommu/sprd-iommu.c | 2 +-
drivers/irqchip/irq-imx-irqsteer.c | 40 ++++-
drivers/irqchip/irq-mbigen.c | 20 ++-
drivers/irqchip/irq-meson-gpio.c | 35 ++--
drivers/irqchip/irq-xilinx-intc.c | 2 +-
drivers/isdn/hardware/mISDN/hfcmulti.c | 7 +-
drivers/leds/led-class.c | 1 -
drivers/leds/led-triggers.c | 75 ++++----
drivers/leds/leds-ss4200.c | 7 +-
drivers/leds/trigger/ledtrig-timer.c | 5 -
drivers/macintosh/therm_windtunnel.c | 2 +-
drivers/md/md.c | 1 -
drivers/md/raid5.c | 20 ++-
drivers/media/i2c/imx412.c | 9 +-
drivers/media/pci/saa7134/saa7134-dvb.c | 8 +-
drivers/media/platform/qcom/venus/vdec.c | 3 +-
drivers/media/platform/vsp1/vsp1_histo.c | 20 +--
drivers/media/platform/vsp1/vsp1_pipe.h | 2 +-
drivers/media/platform/vsp1/vsp1_rpf.c | 8 +-
drivers/media/rc/imon.c | 5 +-
drivers/media/rc/lirc_dev.c | 4 +-
drivers/media/usb/dvb-usb/dvb-usb-init.c | 35 +++-
drivers/media/usb/uvc/uvc_ctrl.c | 9 +-
drivers/media/usb/uvc/uvc_video.c | 47 +++++-
drivers/memory/Kconfig | 2 +-
drivers/mfd/Makefile | 6 +-
drivers/mfd/omap-usb-tll.c | 3 +-
drivers/mfd/rsmu_core.c | 2 +
drivers/mtd/nand/raw/Kconfig | 3 +-
drivers/mtd/tests/Makefile | 34 ++--
drivers/mtd/tests/mtd_test.c | 9 +
drivers/mtd/ubi/eba.c | 3 +-
drivers/net/bonding/bond_main.c | 7 +-
drivers/net/dsa/b53/b53_common.c | 3 +
drivers/net/dsa/bcm_sf2.c | 4 +-
drivers/net/dsa/mv88e6xxx/chip.c | 3 +-
drivers/net/ethernet/brocade/bna/bna_types.h | 2 +-
drivers/net/ethernet/brocade/bna/bnad.c | 11 +-
drivers/net/ethernet/freescale/fec_main.c | 52 ++++--
drivers/net/ethernet/freescale/fec_ptp.c | 3 +
drivers/net/ethernet/google/gve/gve_tx_dqo.c | 22 ++-
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 6 +-
.../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 7 +-
.../ethernet/mellanox/mlxsw/spectrum_acl_atcam.c | 18 +-
.../mellanox/mlxsw/spectrum_acl_bloom_filter.c | 38 +++--
.../net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c | 13 --
.../ethernet/mellanox/mlxsw/spectrum_acl_tcam.h | 9 +-
drivers/net/ethernet/realtek/r8169_main.c | 8 +-
drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 +-
.../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 2 +-
drivers/net/ethernet/stmicro/stmmac/hwif.h | 2 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 +-
drivers/net/netconsole.c | 2 +-
drivers/net/usb/qmi_wwan.c | 1 +
drivers/net/usb/sr9700.c | 11 +-
drivers/net/wireless/ath/ath11k/dp_rx.c | 3 +-
drivers/net/wireless/ath/ath11k/dp_rx.h | 3 +
drivers/net/wireless/ath/ath11k/mac.c | 15 +-
.../broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | 18 +-
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 2 +
drivers/net/wireless/virt_wifi.c | 20 ++-
drivers/nvme/host/pci.c | 99 ++++++-----
drivers/parport/procfs.c | 24 +--
drivers/pci/controller/dwc/pcie-designware-host.c | 7 +-
drivers/pci/controller/dwc/pcie-dw-rockchip.c | 2 +-
drivers/pci/controller/pci-hyperv.c | 4 +-
drivers/pci/controller/pcie-rockchip.c | 2 +-
drivers/pci/endpoint/functions/pci-epf-vntb.c | 12 +-
drivers/pci/pci.c | 19 ++-
drivers/pci/setup-bus.c | 6 +-
drivers/phy/cadence/phy-cadence-torrent.c | 3 +
drivers/pinctrl/core.c | 12 +-
drivers/pinctrl/freescale/pinctrl-mxs.c | 4 +-
drivers/pinctrl/pinctrl-rockchip.c | 17 +-
drivers/pinctrl/pinctrl-single.c | 7 +-
drivers/pinctrl/ti/pinctrl-ti-iodelay.c | 14 +-
drivers/platform/chrome/cros_ec_debugfs.c | 1 +
drivers/platform/chrome/cros_ec_proto.c | 2 +
drivers/platform/mips/cpu_hwmon.c | 3 +
drivers/power/supply/axp288_charger.c | 24 +--
drivers/power/supply/bq24190_charger.c | 2 +-
drivers/pwm/pwm-stm32.c | 5 +-
drivers/remoteproc/imx_rproc.c | 10 +-
drivers/remoteproc/stm32_rproc.c | 2 +-
drivers/rtc/interface.c | 9 +-
drivers/rtc/rtc-cmos.c | 10 +-
drivers/rtc/rtc-isl1208.c | 11 +-
drivers/s390/block/dasd_devmap.c | 10 +-
drivers/s390/char/sclp_sd.c | 10 +-
drivers/scsi/mpi3mr/mpi3mr_os.c | 11 ++
drivers/scsi/mpt3sas/mpt3sas_base.c | 20 ++-
drivers/scsi/qla2xxx/qla_bsg.c | 98 ++++++-----
drivers/scsi/qla2xxx/qla_def.h | 3 +
drivers/scsi/qla2xxx/qla_gs.c | 35 +++-
drivers/scsi/qla2xxx/qla_init.c | 87 ++++++++--
drivers/scsi/qla2xxx/qla_inline.h | 8 +
drivers/scsi/qla2xxx/qla_mid.c | 2 +-
drivers/scsi/qla2xxx/qla_nvme.c | 5 +-
drivers/scsi/qla2xxx/qla_os.c | 7 +-
drivers/scsi/qla2xxx/qla_sup.c | 108 ++++++++----
drivers/scsi/ufs/ufshcd.c | 11 +-
drivers/soc/qcom/pdr_interface.c | 8 +-
drivers/soc/qcom/rpmh-rsc.c | 7 +-
drivers/soc/qcom/rpmh.c | 1 -
drivers/soc/xilinx/zynqmp_pm_domains.c | 16 ++
drivers/soc/xilinx/zynqmp_power.c | 5 +-
drivers/spi/spi-fsl-lpspi.c | 6 +-
drivers/spi/spidev.c | 95 +++++------
drivers/tty/serial/serial_core.c | 8 +
drivers/usb/gadget/function/u_audio.c | 42 ++++-
drivers/usb/gadget/function/u_serial.c | 1 +
drivers/usb/gadget/udc/core.c | 10 +-
drivers/usb/serial/usb_debug.c | 7 +
drivers/usb/usbip/vhci_hcd.c | 9 +-
drivers/vhost/vdpa.c | 8 +-
drivers/vhost/vsock.c | 4 +-
fs/binfmt_flat.c | 4 +-
fs/btrfs/ctree.h | 1 +
fs/btrfs/file.c | 60 +++++--
fs/btrfs/free-space-cache.c | 1 +
fs/ceph/super.c | 3 +-
fs/exec.c | 8 +-
fs/ext2/balloc.c | 11 +-
fs/ext4/extents.c | 5 +-
fs/ext4/extents_status.c | 16 +-
fs/ext4/extents_status.h | 6 +-
fs/ext4/fast_commit.c | 65 +++++--
fs/ext4/inline.c | 6 +-
fs/ext4/inode.c | 115 +++++++------
fs/ext4/mballoc.c | 3 +-
fs/ext4/namei.c | 88 +++++++---
fs/ext4/xattr.c | 6 +
fs/f2fs/inline.c | 6 +-
fs/f2fs/inode.c | 3 +
fs/file.c | 1 +
fs/fuse/inode.c | 24 ++-
fs/hfs/inode.c | 3 +
fs/hfsplus/bfind.c | 15 +-
fs/hfsplus/extents.c | 9 +-
fs/hfsplus/hfsplus_fs.h | 21 +++
fs/jbd2/commit.c | 2 +-
fs/jbd2/journal.c | 6 +
fs/jfs/jfs_imap.c | 5 +-
fs/nfs/nfs4client.c | 6 +-
fs/nfs/nfs4proc.c | 2 +-
fs/nilfs2/btnode.c | 25 ++-
fs/nilfs2/btree.c | 4 +-
fs/nilfs2/segment.c | 2 +-
fs/ntfs3/attrib.c | 14 +-
fs/ntfs3/bitmap.c | 2 +-
fs/ntfs3/dir.c | 3 +-
fs/ntfs3/file.c | 5 +-
fs/ntfs3/frecord.c | 2 +-
fs/ntfs3/fslog.c | 5 +-
fs/ntfs3/fsntfs.c | 2 +-
fs/ntfs3/index.c | 4 +-
fs/ntfs3/inode.c | 2 +-
fs/ntfs3/ntfs.h | 13 +-
fs/ntfs3/ntfs_fs.h | 2 +
fs/proc/proc_sysctl.c | 6 +-
fs/proc/task_mmu.c | 2 +
fs/super.c | 11 ++
fs/udf/balloc.c | 51 +++---
fs/udf/super.c | 3 +-
fs/xfs/xfs_log_recover.c | 20 ++-
include/asm-generic/vmlinux.lds.h | 2 +-
include/linux/clocksource.h | 14 +-
include/linux/hugetlb.h | 1 +
include/linux/irq.h | 7 +-
include/linux/irqdomain.h | 10 ++
include/linux/jbd2.h | 5 -
include/linux/leds.h | 32 ++--
include/linux/objagg.h | 1 -
include/linux/pci_ids.h | 2 +
include/linux/perf_event.h | 1 +
include/linux/profile.h | 1 -
include/linux/sched/signal.h | 6 +
include/linux/task_work.h | 3 +-
include/linux/trace_events.h | 1 -
include/linux/virtio_net.h | 11 ++
include/net/netfilter/nf_tables.h | 20 ++-
include/net/sctp/sctp.h | 4 +-
include/net/sctp/structs.h | 8 +-
include/net/tcp.h | 1 +
include/trace/events/mptcp.h | 2 +-
include/trace/events/rpcgss.h | 2 +-
include/uapi/linux/netfilter/nf_tables.h | 2 +-
include/uapi/linux/zorro_ids.h | 3 +
io_uring/io-wq.c | 10 +-
io_uring/io_uring.c | 5 +-
kernel/bpf/btf.c | 10 +-
kernel/debug/kdb/kdb_io.c | 6 +-
kernel/dma/mapping.c | 2 +-
kernel/events/core.c | 77 ++++++---
kernel/events/internal.h | 2 +-
kernel/events/ring_buffer.c | 4 +-
kernel/irq/chip.c | 32 ++--
kernel/irq/irqdesc.c | 1 +
kernel/irq/irqdomain.c | 7 +-
kernel/irq/manage.c | 2 +-
kernel/kcov.c | 15 +-
kernel/kprobes.c | 4 +-
kernel/locking/rwsem.c | 6 +-
kernel/padata.c | 7 +
kernel/profile.c | 16 +-
kernel/rcu/rcutorture.c | 2 +-
kernel/sched/core.c | 50 +++---
kernel/sched/cputime.c | 6 +
kernel/sched/fair.c | 19 +--
kernel/sched/sched.h | 2 +-
kernel/signal.c | 8 +
kernel/task_work.c | 34 +++-
kernel/time/clocksource-wdtest.c | 13 +-
kernel/time/clocksource.c | 10 +-
kernel/time/ntp.c | 9 +-
kernel/time/tick-broadcast.c | 24 +++
kernel/time/timekeeping.c | 2 +-
kernel/trace/tracing_map.c | 6 +-
kernel/watchdog_hld.c | 11 +-
lib/decompress_bunzip2.c | 3 +-
lib/kobject_uevent.c | 17 +-
lib/objagg.c | 18 +-
mm/hugetlb.c | 2 +-
mm/mempolicy.c | 18 +-
mm/mmap_lock.c | 175 +++----------------
net/bluetooth/l2cap_core.c | 1 +
net/bridge/br_multicast.c | 4 +-
net/core/filter.c | 15 +-
net/core/link_watch.c | 4 +-
net/core/rtnetlink.c | 65 +++----
net/core/xdp.c | 4 +-
net/ipv4/esp4.c | 3 +-
net/ipv4/netfilter/iptable_nat.c | 18 +-
net/ipv4/nexthop.c | 7 +-
net/ipv4/route.c | 2 +-
net/ipv4/tcp.c | 13 +-
net/ipv4/tcp_input.c | 34 ++--
net/ipv4/tcp_ipv4.c | 19 +--
net/ipv4/tcp_output.c | 2 +-
net/ipv4/tcp_timer.c | 10 +-
net/ipv6/addrconf.c | 3 +-
net/ipv6/esp6.c | 3 +-
net/ipv6/ndisc.c | 34 ++--
net/ipv6/netfilter/ip6table_nat.c | 14 +-
net/ipv6/tcp_ipv6.c | 19 +--
net/iucv/af_iucv.c | 4 +-
net/l2tp/l2tp_core.c | 15 +-
net/mac80211/cfg.c | 21 +--
net/mptcp/mib.c | 2 +
net/mptcp/mib.h | 2 +
net/mptcp/options.c | 5 +-
net/mptcp/pm.c | 9 +
net/mptcp/pm_netlink.c | 48 ++++--
net/mptcp/protocol.c | 18 +-
net/mptcp/protocol.h | 4 +
net/mptcp/subflow.c | 24 ++-
net/netfilter/ipset/ip_set_list_set.c | 3 +
net/netfilter/ipvs/ip_vs_proto_sctp.c | 4 +-
net/netfilter/nf_conntrack_netlink.c | 3 +-
net/netfilter/nf_tables_api.c | 188 ++++-----------------
net/netfilter/nft_connlimit.c | 4 +-
net/netfilter/nft_counter.c | 4 +-
net/netfilter/nft_dynset.c | 2 +-
net/netfilter/nft_last.c | 4 +-
net/netfilter/nft_limit.c | 14 +-
net/netfilter/nft_quota.c | 4 +-
net/netfilter/nft_set_hash.c | 8 +-
net/netfilter/nft_set_pipapo.c | 40 +++--
net/netfilter/nft_set_pipapo.h | 27 ++-
net/netfilter/nft_set_pipapo_avx2.c | 81 +++++----
net/netfilter/nft_set_rbtree.c | 6 +-
net/packet/af_packet.c | 86 +++++++++-
net/sched/act_ct.c | 4 +-
net/sctp/input.c | 48 +++---
net/sctp/proc.c | 10 +-
net/sctp/socket.c | 6 +-
net/smc/smc_core.c | 5 +-
net/sunrpc/auth_gss/gss_krb5_keys.c | 2 +-
net/sunrpc/clnt.c | 3 +-
net/sunrpc/sched.c | 4 +-
net/sunrpc/xprtrdma/frwr_ops.c | 3 +-
net/sunrpc/xprtrdma/verbs.c | 16 +-
net/tipc/udp_media.c | 5 +-
net/tls/tls_sw.c | 16 +-
net/wireless/nl80211.c | 16 +-
net/wireless/util.c | 8 +-
scripts/gcc-x86_32-has-stack-protector.sh | 2 +-
scripts/gcc-x86_64-has-stack-protector.sh | 2 +-
security/apparmor/lsm.c | 7 +
security/apparmor/policy.c | 2 +-
security/apparmor/policy_unpack.c | 1 +
security/keys/keyctl.c | 2 +-
security/landlock/cred.c | 11 +-
sound/firewire/amdtp-stream.c | 38 +++--
sound/firewire/amdtp-stream.h | 1 +
sound/pci/hda/patch_conexant.c | 54 +-----
sound/pci/hda/patch_hdmi.c | 2 +
sound/pci/hda/patch_realtek.c | 1 +
sound/soc/codecs/max98088.c | 10 +-
sound/soc/codecs/wcd938x-sdw.c | 4 +-
sound/soc/codecs/wsa881x.c | 2 +-
sound/soc/intel/common/soc-intel-quirks.h | 2 +-
sound/soc/meson/axg-fifo.c | 26 ++-
sound/soc/pxa/spitz.c | 58 +++----
sound/usb/line6/driver.c | 5 +
sound/usb/mixer.c | 7 +
sound/usb/quirks-table.h | 4 +
sound/usb/quirks.c | 4 +
sound/usb/stream.c | 4 +-
tools/lib/bpf/btf_dump.c | 8 +-
tools/lib/bpf/linker.c | 11 +-
tools/memory-model/lock.cat | 20 +--
tools/perf/arch/x86/util/intel-pt.c | 15 +-
tools/perf/util/sort.c | 2 +-
.../testing/selftests/bpf/prog_tests/send_signal.c | 3 +-
tools/testing/selftests/bpf/prog_tests/sk_lookup.c | 2 +-
.../bpf/progs/btf_dump_test_case_multidim.c | 4 +-
.../bpf/progs/btf_dump_test_case_syntax.c | 4 +-
tools/testing/selftests/bpf/test_sockmap.c | 9 +-
.../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 55 +++++-
tools/testing/selftests/landlock/base_test.c | 74 ++++++++
tools/testing/selftests/landlock/config | 5 +-
.../selftests/net/forwarding/devlink_lib.sh | 2 +
tools/testing/selftests/net/mptcp/mptcp_join.sh | 41 ++++-
tools/testing/selftests/rcutorture/bin/torture.sh | 6 +-
.../selftests/sigaltstack/current_stack_pointer.h | 2 +-
469 files changed, 4252 insertions(+), 2441 deletions(-)Greg Kroah-Hartman
maintainerPATCH 1/484 f2fs: fix return value of f2fs_convert_inline_inode()
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
commit a8eb3de28e7a365690c61161e7a07a4fc7c60bbf upstream.
If device is readonly, make f2fs_convert_inline_inode() return EROFS instead of zero, otherwise it may trigger panic during writeback of inline inode's dirty page as below:
f2fs_write_single_data_page+0xbb6/0x1e90 fs/f2fs/data.c:2888 f2fs_write_cache_pages fs/f2fs/data.c:3187 [inline] __f2fs_write_data_pages fs/f2fs/data.c:3342 [inline] f2fs_write_data_pages+0x1efe/0x3a90 fs/f2fs/data.c:3369 do_writepages+0x359/0x870 mm/page-writeback.c:2634 filemap_fdatawrite_wbc+0x125/0x180 mm/filemap.c:397 __filemap_fdatawrite_range mm/filemap.c:430 [inline] file_write_and_wait_range+0x1aa/0x290 mm/filemap.c:788 f2fs_do_sync_file+0x68a/0x1ae0 fs/f2fs/file.c:276 generic_write_sync include/linux/fs.h:2806 [inline] f2fs_file_write_iter+0x7bd/0x24e0 fs/f2fs/file.c:4977 call_write_iter include/linux/fs.h:2114 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xa72/0xc90 fs/read_write.c:590 ksys_write+0x1a0/0x2c0 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- fs/f2fs/inline.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/f2fs/inline.c +4 -2
@@ -203,8 +203,10 @@ int f2fs_convert_inline_inode(struct inostruct page *ipage, *page;int err =0 ; -if (!f2fs_has_inline_data (inode) || -f2fs_hw_is_readonly (sbi) ||f2fs_readonly (sbi->sb)) +if (f2fs_hw_is_readonly (sbi) ||f2fs_readonly (sbi->sb)) +return -EROFS ; + +if (!f2fs_has_inline_data (inode))return 0 ; err =f2fs_dquot_initialize (inode);
Greg Kroah-Hartman
maintainerPATCH 2/484 f2fs: fix to dont dirty inode for readonly filesystem
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
commit 192b8fb8d1c8ca3c87366ebbef599fa80bb626b8 upstream.
syzbot reports f2fs bug as below:
kernel BUG at fs/f2fs/inode.c:933!
RIP: 0010:f2fs_evict_inode+0x1576/0x1590 fs/f2fs/inode.c:933 Call Trace: evict+0x2a4/0x620 fs/inode.c:664 dispose_list fs/inode.c:697 [inline] evict_inodes+0x5f8/0x690 fs/inode.c:747 generic_shutdown_super+0x9d/0x2c0 fs/super.c:675 kill_block_super+0x44/0x90 fs/super.c:1667 kill_f2fs_super+0x303/0x3b0 fs/f2fs/super.c:4894 deactivate_locked_super+0xc1/0x130 fs/super.c:484 cleanup_mnt+0x426/0x4c0 fs/namespace.c:1256 task_work_run+0x24a/0x300 kernel/task_work.c:180 ptrace_notify+0x2cd/0x380 kernel/signal.c:2399 ptrace_report_syscall include/linux/ptrace.h:411 [inline] ptrace_report_syscall_exit include/linux/ptrace.h:473 [inline] syscall_exit_work kernel/entry/common.c:251 [inline] syscall_exit_to_user_mode_prepare kernel/entry/common.c:278 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline] syscall_exit_to_user_mode+0x15c/0x280 kernel/entry/common.c:296 do_syscall_64+0x50/0x110 arch/x86/entry/common.c:88 entry_SYSCALL_64_after_hwframe+0x63/0x6b
The root cause is:
- do_sys_open
- f2fs_lookup
- __f2fs_find_entry
- f2fs_i_depth_write
- f2fs_mark_inode_dirty_sync
- f2fs_dirty_inode
- set_inode_flag(inode, FI_DIRTY_INODE)
- umount
- kill_f2fs_super
- kill_block_super
- generic_shutdown_super
- sync_filesystem
: sb is readonly, skip sync_filesystem()
- evict_inodes
- iput
- f2fs_evict_inode
- f2fs_bug_on(sbi, is_inode_flag_set(inode, FI_DIRTY_INODE)) : trigger kernel panic
When we try to repair i_current_depth in readonly filesystem, let's skip dirty inode to avoid panic in later f2fs_evict_inode().
--- fs/f2fs/inode.c | 3 +++ 1 file changed, 3 insertions(+)
fs/f2fs/inode.c +3 -0
@@ -27,6 +27,9 @@ void f2fs_mark_inode_dirty_sync(struct iif (is_inode_flag_set (inode,FI_NEW_INODE ))return ; +if (f2fs_readonly (F2FS_I_SB (inode)->sb)) +return ; +if (f2fs_inode_dirtied (inode, sync))return ;
Greg Kroah-Hartman
maintainerPATCH 3/484 EDAC, i10nm: make skx_common.o a separate module
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 123b158635505c89ed0d3ef45c5845ff9030a466 ]
Commit 598afa050403 ("kbuild: warn objects shared among multiple modules") was added to track down cases where the same object is linked into multiple modules. This can cause serious problems if some modules are builtin while others are not.
That test triggers this warning:
scripts/Makefile.build:236: drivers/edac/Makefile: skx_common.o is added to multiple modules: i10nm_edac skx_edac
Make this a separate module instead.
[Tony: Added more background details to commit message]
--- drivers/edac/Makefile | 10 ++++++---- drivers/edac/skx_common.c | 21 +++++++++++++++++++-- drivers/edac/skx_common.h | 4 ++-- 3 files changed, 27 insertions(+), 8 deletions(-)
drivers/edac/Makefile +6 -4
@@ -54,11 +54,13 @@ obj-$(CONFIG_EDAC_MPC85XX) += mpc85xx_edac_mod.o layerscape_edac_mod-y := fsl_ddr_edac.o layerscape_edac.o obj-$(CONFIG_EDAC_LAYERSCAPE) += layerscape_edac_mod.o -skx_edac-y := skx_common.o skx_base.o -obj-$(CONFIG_EDAC_SKX) += skx_edac.o +skx_edac_common-y := skx_common.o -i10nm_edac-y := skx_common.o i10nm_base.o -obj-$(CONFIG_EDAC_I10NM) += i10nm_edac.o +skx_edac-y := skx_base.o +obj-$(CONFIG_EDAC_SKX) += skx_edac.o skx_edac_common.o + +i10nm_edac-y := i10nm_base.o +obj-$(CONFIG_EDAC_I10NM) += i10nm_edac.o skx_edac_common.o obj-$(CONFIG_EDAC_CELL) += cell_edac.o obj-$(CONFIG_EDAC_PPC4XX) += ppc4xx_edac.o
drivers/edac/skx_common.c +19 -2
@@ -46,7 +46,7 @@ static u64 skx_tolm, skx_tohm;static LIST_HEAD (dev_edac_list);static bool skx_mem_cfg_2lm; -int __init skx_adxl_get (void ) +int skx_adxl_get (void ) {const char *const *names;int i, j;
@@ -108,12 +108,14 @@ int __init skx_adxl_get(void)return -ENODEV ; } +EXPORT_SYMBOL_GPL (skx_adxl_get); -void __exit skx_adxl_put(void) +void skx_adxl_put (void ) {kfree (adxl_values);kfree (adxl_msg); } +EXPORT_SYMBOL_GPL (skx_adxl_put);static bool skx_adxl_decode (struct decoded_addr *res,bool error_in_1st_level_mem) {
@@ -180,12 +182,14 @@ void skx_set_mem_cfg(bool mem_cfg_2lm) { skx_mem_cfg_2lm = mem_cfg_2lm; } +EXPORT_SYMBOL_GPL (skx_set_mem_cfg);void skx_set_decode (skx_decode_f decode,skx_show_retry_log_f show_retry_log) { skx_decode = decode; skx_show_retry_rd_err_log = show_retry_log; } +EXPORT_SYMBOL_GPL (skx_set_decode);int skx_get_src_id (struct skx_dev *d,int off,u8 *id) {
@@ -199,6 +203,7 @@ int skx_get_src_id(struct skx_dev *d, int off, u8 *id) *id =GET_BITFIELD (reg,12 ,14 );return 0 ; } +EXPORT_SYMBOL_GPL (skx_get_src_id);int skx_get_node_id (struct skx_dev *d,u8 *id) {
@@ -212,6 +217,7 @@ int skx_get_node_id(struct skx_dev *d, u8 *id) *id =GET_BITFIELD (reg,0 ,2 );return 0 ; } +EXPORT_SYMBOL_GPL (skx_get_node_id);static int get_width (u32 mtr) {
@@ -277,6 +283,7 @@ int skx_get_all_bus_mappings(struct res_config *cfg, struct list_head **list) *list = &dev_edac_list;return ndev; } +EXPORT_SYMBOL_GPL (skx_get_all_bus_mappings);int skx_get_hi_lo (unsigned int did,int off[],u64 *tolm,u64 *tohm) {
@@ -316,6 +323,7 @@ int skx_get_hi_lo(unsigned int did, int off[], u64 *tolm, u64 *tohm)pci_dev_put (pdev);return -ENODEV ; } +EXPORT_SYMBOL_GPL (skx_get_hi_lo);static int skx_get_dimm_attr (u32 reg,int lobit,int hibit,int add,int minval,int maxval,const char *name)
@@ -387,6 +395,7 @@ int skx_get_dimm_info(u32 mtr, u32 mcmtr, u32 amap, struct dimm_info *dimm,return 1 ; } +EXPORT_SYMBOL_GPL (skx_get_dimm_info);int skx_get_nvdimm_info (struct dimm_info *dimm,struct skx_imc *imc,int chan,int dimmno,const char *mod_str)
@@ -435,6 +444,7 @@ int skx_get_nvdimm_info(struct dimm_info *dimm, struct skx_imc *imc,return (size ==0 || size == ~0ull ) ?0 :1 ; } +EXPORT_SYMBOL_GPL (skx_get_nvdimm_info); int skx_register_mci(struct skx_imc *imc, struct pci_dev *pdev, const char *ctl_name, const char *mod_str,
@@ -505,6 +515,7 @@ int skx_register_mci(struct skx_imc *imc, struct pci_dev *pdev, imc->mci =NULL ;return rc; } +EXPORT_SYMBOL_GPL (skx_register_mci);static void skx_unregister_mci (struct skx_imc *imc) {
@@ -686,6 +697,7 @@ int skx_mce_check_error(struct notifier_block *nb, unsigned long val, mce->kflags |=MCE_HANDLED_EDAC ;return NOTIFY_DONE ; } +EXPORT_SYMBOL_GPL (skx_mce_check_error);void skx_remove (void ) {
@@ -723,3 +735,8 @@ void skx_remove(void)kfree (d); } } +EXPORT_SYMBOL_GPL (skx_remove); + +MODULE_LICENSE ("GPL v2" ); +MODULE_AUTHOR ("Tony Luck" ); +MODULE_DESCRIPTION ("MC Driver for Intel server processors" );
drivers/edac/skx_common.h +2 -2
@@ -162,8 +162,8 @@ typedef int (*get_dimm_config_f)(struct mem_ctl_info *mci,typedef bool (*skx_decode_f )(struct decoded_addr *res);typedef void (*skx_show_retry_log_f )(struct decoded_addr *res,char *msg,int len,bool scrub_err); -int __init skx_adxl_get (void ); -void __exit skx_adxl_put(void); +int skx_adxl_get (void ); +void skx_adxl_put (void );void skx_set_decode (skx_decode_f decode,skx_show_retry_log_f show_retry_log);void skx_set_mem_cfg (bool mem_cfg_2lm);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/484 platform/chrome: cros_ec_debugfs: fix wrong EC message version
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <[email protected]>
[ Upstream commit c2a28647bbb4e0894e8824362410f72b06ac57a4 ]
ec_read_version_supported() uses ec_params_get_cmd_versions_v1 but it wrongly uses message version 0.
Fix it.
--- drivers/platform/chrome/cros_ec_debugfs.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/chrome/cros_ec_debugfs.c +1 -0
@@ -326,6 +326,7 @@ static int ec_read_version_supported(struct cros_ec_dev *ec)if (!msg)return 0 ; + msg->version =1 ; msg->command =EC_CMD_GET_CMD_VERSIONS + ec->cmd_offset; msg->outsize =sizeof (*params); msg->insize =sizeof (*response);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/484 block: refactor to use helper
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nitesh Shetty <[email protected]>
[ Upstream commit 8f63fef5867fb5e8c29d9c14b6d739bfc1869d32 ]
Reduce some code by making use of bio_integrity_bytes().
Stable-dep-of: 899ee2c3829c ("block: initialize integrity buffer to zero before writing it to media")
--- block/bio-integrity.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
block/bio-integrity.c +1 -3
@@ -203,7 +203,6 @@ bool bio_integrity_prep(struct bio *bio)unsigned long start, end;unsigned int len, nr_pages;unsigned int bytes, offset, i; -unsigned int intervals;blk_status_t status;if (!bi)
@@ -228,10 +227,9 @@ bool bio_integrity_prep(struct bio *bio) !(bi->flags & BLK_INTEGRITY_GENERATE))return true; } - intervals =bio_integrity_intervals (bi,bio_sectors (bio));/* Allocate kernel buffer for protection data */ - len = intervals * bi->tuple_size; + len =bio_integrity_bytes (bi,bio_sectors (bio)); buf =kmalloc (len,GFP_NOIO ); status =BLK_STS_RESOURCE ;if (unlikely (buf ==NULL )) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/484 block: cleanup bio_integrity_prep
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinyoung Choi <[email protected]>
[ Upstream commit 51d74ec9b62f5813767a60226acaf943e26e7d7a ]
If a problem occurs in the process of creating an integrity payload, the status of bio is always BLK_STS_RESOURCE.
Stable-dep-of: 899ee2c3829c ("block: initialize integrity buffer to zero before writing it to media")
--- block/bio-integrity.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
block/bio-integrity.c +1 -5
@@ -203,7 +203,6 @@ bool bio_integrity_prep(struct bio *bio)unsigned long start, end;unsigned int len, nr_pages;unsigned int bytes, offset, i; -blk_status_t status;if (!bi)return true;
@@ -231,7 +230,6 @@ bool bio_integrity_prep(struct bio *bio)/* Allocate kernel buffer for protection data */ len =bio_integrity_bytes (bi,bio_sectors (bio)); buf =kmalloc (len,GFP_NOIO ); - status =BLK_STS_RESOURCE ;if (unlikely (buf ==NULL )) {printk (KERN_ERR "could not allocate integrity buffer\n" ); goto err_end_io;
@@ -246,7 +244,6 @@ bool bio_integrity_prep(struct bio *bio)if (IS_ERR (bip)) {printk (KERN_ERR "could not allocate data integrity bioset\n" );kfree (buf); - status =BLK_STS_RESOURCE ; goto err_end_io; }
@@ -274,7 +271,6 @@ bool bio_integrity_prep(struct bio *bio)if (ret ==0 ) {printk (KERN_ERR "could not attach integrity payload\n" ); - status =BLK_STS_RESOURCE ; goto err_end_io; }
@@ -296,7 +292,7 @@ bool bio_integrity_prep(struct bio *bio)return true; err_end_io: - bio->bi_status = status; + bio->bi_status =BLK_STS_RESOURCE ;bio_endio (bio);return false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/484 block: initialize integrity buffer to zero before writing it to media
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 899ee2c3829c5ac14bfc7d3c4a5846c0b709b78f ]
Metadata added by bio_integrity_prep is using plain kmalloc, which leads to random kernel memory being written media. For PI metadata this is limited to the app tag that isn't used by kernel generated metadata, but for non-PI metadata the entire buffer leaks kernel memory.
Fix this by adding the __GFP_ZERO flag to allocations for writes.
--- block/bio-integrity.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
block/bio-integrity.c +10 -1
@@ -203,6 +203,7 @@ bool bio_integrity_prep(struct bio *bio)unsigned long start, end;unsigned int len, nr_pages;unsigned int bytes, offset, i; +gfp_t gfp =GFP_NOIO ;if (!bi)return true;
@@ -225,11 +226,19 @@ bool bio_integrity_prep(struct bio *bio)if (!bi->profile->generate_fn || !(bi->flags &BLK_INTEGRITY_GENERATE ))return true; + +/* +* Zero the memory allocated to not leak uninitialized kernel +* memory to disk. For PI this only affects the app tag, but +* for non-integrity metadata it affects the entire metadata +* buffer. +*/ + gfp |= __GFP_ZERO; }/* Allocate kernel buffer for protection data */ len =bio_integrity_bytes (bi,bio_sectors (bio)); - buf =kmalloc (len,GFP_NOIO ); + buf =kmalloc (len, gfp);if (unlikely (buf ==NULL )) {printk (KERN_ERR "could not allocate integrity buffer\n" ); goto err_end_io;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/484 hfsplus: fix to avoid false alarm of circular locking
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit be4edd1642ee205ed7bbf66edc0453b1be1fb8d7 ]
Syzbot report potential ABBA deadlock as below:
loop0: detected capacity change from 0 to 1024
======================================================
WARNING: possible circular locking dependency detected
6.9.0-syzkaller-10323-g8f6a15f095a6 #0 Not tainted
------------------------------------------------------
syz-executor171/5344 is trying to acquire lock:ffff88807cb980b0 (&tree->tree_lock){+.+.}-{3:3}, at: hfsplus_file_truncate+0x811/0xb50 fs/hfsplus/extents.c:595
but task is already holding lock:ffff88807a930108 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_truncate+0x2da/0xb50 fs/hfsplus/extents.c:576
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752
hfsplus_file_extend+0x21b/0x1b70 fs/hfsplus/extents.c:457
hfsplus_bmap_reserve+0x105/0x4e0 fs/hfsplus/btree.c:358
hfsplus_rename_cat+0x1d0/0x1050 fs/hfsplus/catalog.c:456
hfsplus_rename+0x12e/0x1c0 fs/hfsplus/dir.c:552
vfs_rename+0xbdb/0xf00 fs/namei.c:4887
do_renameat2+0xd94/0x13f0 fs/namei.c:5044
__do_sys_rename fs/namei.c:5091 [inline]
__se_sys_rename fs/namei.c:5089 [inline]
__x64_sys_rename+0x86/0xa0 fs/namei.c:5089
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f-> #0 (&tree->tree_lock){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869
__lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752
hfsplus_file_truncate+0x811/0xb50 fs/hfsplus/extents.c:595
hfsplus_setattr+0x1ce/0x280 fs/hfsplus/inode.c:265
notify_change+0xb9d/0xe70 fs/attr.c:497
do_truncate+0x220/0x310 fs/open.c:65
handle_truncate fs/namei.c:3308 [inline]
do_open fs/namei.c:3654 [inline]
path_openat+0x2a3d/0x3280 fs/namei.c:3807
do_filp_open+0x235/0x490 fs/namei.c:3834
do_sys_openat2+0x13e/0x1d0 fs/open.c:1406
do_sys_open fs/open.c:1421 [inline]
__do_sys_creat fs/open.c:1497 [inline]
__se_sys_creat fs/open.c:1491 [inline]
__x64_sys_creat+0x123/0x170 fs/open.c:1491
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7fother info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&HFSPLUS_I(inode)->extents_lock);
lock(&tree->tree_lock);
lock(&HFSPLUS_I(inode)->extents_lock); lock(&tree->tree_lock);
This is a false alarm as tree_lock mutex are different, one is from sbi->cat_tree, and another is from sbi->ext_tree:
Thread A Thread B
- hfsplus_rename
- hfsplus_rename_cat
- hfs_find_init
- mutext_lock(cat_tree->tree_lock)
- hfsplus_setattr
- hfsplus_file_truncate
- mutex_lock(hip->extents_lock)
- hfs_find_init
- mutext_lock(ext_tree->tree_lock)
- hfs_bmap_reserve
- hfsplus_file_extend
- mutex_lock(hip->extents_lock)
So, let's call mutex_lock_nested for tree_lock mutex lock, and pass correct lock class for it.
--- fs/hfsplus/bfind.c | 15 ++------------- fs/hfsplus/extents.c | 9 ++++++--- fs/hfsplus/hfsplus_fs.h | 21 +++++++++++++++++++++ 3 files changed, 29 insertions(+), 16 deletions(-)
fs/hfsplus/bfind.c +2 -13
@@ -25,19 +25,8 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) fd->key = ptr + tree->max_key_len +2 ;hfs_dbg (BNODE_REFS ,"find_init: %d (%p)\n" , tree->cnid,__builtin_return_address (0 )); -switch (tree->cnid) { -case HFSPLUS_CAT_CNID : -mutex_lock_nested (&tree->tree_lock,CATALOG_BTREE_MUTEX ); -break ; -case HFSPLUS_EXT_CNID : -mutex_lock_nested (&tree->tree_lock,EXTENTS_BTREE_MUTEX ); -break ; -case HFSPLUS_ATTR_CNID : -mutex_lock_nested (&tree->tree_lock,ATTR_BTREE_MUTEX ); -break ; -default : -BUG (); - } +mutex_lock_nested (&tree->tree_lock, +hfsplus_btree_lock_class (tree));return 0 ; }
fs/hfsplus/extents.c +6 -3
@@ -430,7 +430,8 @@ int hfsplus_free_fork(struct super_block *sb, u32 cnid,hfsplus_free_extents (sb, ext_entry, total_blocks - start, total_blocks); total_blocks = start; -mutex_lock (&fd.tree->tree_lock); +mutex_lock_nested (&fd.tree->tree_lock, +hfsplus_btree_lock_class (fd.tree)); }while (total_blocks > blocks);hfs_find_exit (&fd);
@@ -592,7 +593,8 @@ void hfsplus_file_truncate(struct inode *inode) alloc_cnt, alloc_cnt - blk_cnt);hfsplus_dump_extent (hip->first_extents); hip->first_blocks = blk_cnt; -mutex_lock (&fd.tree->tree_lock); +mutex_lock_nested (&fd.tree->tree_lock, +hfsplus_btree_lock_class (fd.tree));break ; } res =__hfsplus_ext_cache_extent (&fd, inode, alloc_cnt);
@@ -606,7 +608,8 @@ void hfsplus_file_truncate(struct inode *inode)hfsplus_free_extents (sb, hip->cached_extents, alloc_cnt - start, alloc_cnt - blk_cnt);hfsplus_dump_extent (hip->cached_extents); -mutex_lock (&fd.tree->tree_lock); +mutex_lock_nested (&fd.tree->tree_lock, +hfsplus_btree_lock_class (fd.tree));if (blk_cnt > start) { hip->extent_state |=HFSPLUS_EXT_DIRTY ;break ;
fs/hfsplus/hfsplus_fs.h +21 -0
@@ -550,6 +550,27 @@ static inline __be32 __hfsp_ut2mt(time64_t ut)return cpu_to_be32 (lower_32_bits (ut) +HFSPLUS_UTC_OFFSET ); } +static inline enum hfsplus_btree_mutex_classes +hfsplus_btree_lock_class (struct hfs_btree *tree) +{ +enum hfsplus_btree_mutex_classes class; + +switch (tree->cnid) { +case HFSPLUS_CAT_CNID : + class =CATALOG_BTREE_MUTEX ; +break ; +case HFSPLUS_EXT_CNID : + class =EXTENTS_BTREE_MUTEX ; +break ; +case HFSPLUS_ATTR_CNID : + class =ATTR_BTREE_MUTEX ; +break ; +default : +BUG (); + } +return class; +} +/* compatibility */ #define hfsp_mt2ut (t) (struct timespec64){ .tv_sec = __hfsp_mt2ut(t) }#define hfsp_ut2mt (t) __hfsp_ut2mt((t).tv_sec)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/484 x86/of: Return consistent error type from x86_of_pci_irq_enable()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit ec0b4c4d45cf7cf9a6c9626a494a89cb1ae7c645 ]
x86_of_pci_irq_enable() returns PCIBIOS_* code received from pci_read_config_byte() directly and also -EINVAL which are not compatible error types. x86_of_pci_irq_enable() is used as (*pcibios_enable_irq) function which should not return PCIBIOS_* codes.
Convert the PCIBIOS_* return code from pci_read_config_byte() into normal errno using pcibios_err_to_errno().
--- arch/x86/kernel/devicetree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/devicetree.c +1 -1
@@ -92,7 +92,7 @@ static int x86_of_pci_irq_enable(struct pci_dev *dev) ret =pci_read_config_byte (dev,PCI_INTERRUPT_PIN , &pin);if (ret) -return ret; +return pcibios_err_to_errno (ret);if (!pin)return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/484 x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 724852059e97c48557151b3aa4af424614819752 ]
intel_mid_pci_irq_enable() uses pci_read_config_byte() that returns PCIBIOS_* codes. The error handling, however, assumes the codes are normal errnos because it checks for < 0.
intel_mid_pci_irq_enable() also returns the PCIBIOS_* code back to the caller but the function is used as the (*pcibios_enable_irq) function which should return normal errnos.
Convert the error check to plain non-zero check which works for PCIBIOS_* return codes and convert the PCIBIOS_* return code using pcibios_err_to_errno() into normal errno before returning it.
--- arch/x86/pci/intel_mid_pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/pci/intel_mid_pci.c +2 -2
@@ -233,9 +233,9 @@ static int intel_mid_pci_irq_enable(struct pci_dev *dev)return 0 ; ret =pci_read_config_byte (dev,PCI_INTERRUPT_LINE , &gsi); -if (ret <0 ) { +if (ret) {dev_warn (&dev->dev,"Failed to read interrupt line: %d\n" , ret); -return ret; +return pcibios_err_to_errno (ret); } id =x86_match_cpu (intel_mid_cpu_ids);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/484 x86/pci/xen: Fix PCIBIOS_* return code handling
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit e9d7b435dfaec58432f4106aaa632bf39f52ce9f ]
xen_pcifront_enable_irq() uses pci_read_config_byte() that returns PCIBIOS_* codes. The error handling, however, assumes the codes are normal errnos because it checks for < 0.
xen_pcifront_enable_irq() also returns the PCIBIOS_* code back to the caller but the function is used as the (*pcibios_enable_irq) function which should return normal errnos.
Convert the error check to plain non-zero check which works for PCIBIOS_* return codes and convert the PCIBIOS_* return code using pcibios_err_to_errno() into normal errno before returning it.
--- arch/x86/pci/xen.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/pci/xen.c +2 -2
@@ -37,10 +37,10 @@ static int xen_pcifront_enable_irq(struct pci_dev *dev)u8 gsi; rc =pci_read_config_byte (dev,PCI_INTERRUPT_LINE , &gsi); -if (rc <0 ) { +if (rc) {dev_warn (&dev->dev,"Xen PCI: failed to read interrupt line: %d\n" , rc); -return rc; +return pcibios_err_to_errno (rc); }/* In PV DomU the Xen PCI backend puts the PIRQ in the interrupt line.*/ pirq = gsi;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/484 x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 7821fa101eab529521aa4b724bf708149d70820c ]
iosf_mbi_pci_{read,write}_mdr() use pci_{read,write}_config_dword() that return PCIBIOS_* codes but functions also return -ENODEV which are not compatible error codes. As neither of the functions are related to PCI read/write functions, they should return normal errnos.
Convert PCIBIOS_* returns code using pcibios_err_to_errno() into normal errno before returning it.
--- arch/x86/platform/intel/iosf_mbi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/platform/intel/iosf_mbi.c +2 -2
@@ -62,7 +62,7 @@ static int iosf_mbi_pci_read_mdr(u32 mcrx, u32 mcr, u32 *mdr) fail_read:dev_err (&mbi_pdev->dev,"PCI config access failed with %d\n" , result); -return result; +return pcibios_err_to_errno (result); }static int iosf_mbi_pci_write_mdr (u32 mcrx,u32 mcr,u32 mdr)
@@ -91,7 +91,7 @@ static int iosf_mbi_pci_write_mdr(u32 mcrx, u32 mcr, u32 mdr) fail_write:dev_err (&mbi_pdev->dev,"PCI config access failed with %d\n" , result); -return result; +return pcibios_err_to_errno (result); }int iosf_mbi_read (u8 port,u8 opcode,u32 offset,u32 *mdr)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/484 hwmon: (adt7475) Fix default duty on fan is disabled
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Tung <[email protected]>
[ Upstream commit 39b24cced70fdc336dbc0070f8b3bde61d8513a8 ]
According to the comments on fan is disabled, we change to manual mode and set the duty cycle to 0.
For setting the duty cycle part, the register is wrong. Fix it.
--- drivers/hwmon/adt7475.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/adt7475.c +1 -1
@@ -1770,7 +1770,7 @@ static void adt7475_read_pwm(struct i2c_client *client, int index) data->pwm[CONTROL ][index] &= ~0xE0 ; data->pwm[CONTROL ][index] |= (7 <<5 ); -i2c_smbus_write_byte_data (client,PWM_CONFIG_REG (index), +i2c_smbus_write_byte_data (client,PWM_REG (index), data->pwm[INPUT ][index]); i2c_smbus_write_byte_data(client, PWM_CONFIG_REG(index),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/484 pwm: stm32: Always do lazy disabling
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 7346e7a058a2c9aa9ff1cc699c7bf18a402d9f84 ]
When the state changes from enabled to disabled, polarity, duty_cycle and period are not configured in hardware and TIM_CCER_CCxE is just cleared. However if the state changes from one disabled state to another, all parameters are written to hardware because the early exit from stm32_pwm_apply() is only taken if the pwm is currently enabled.
This yields surprises like: Applying
{ .period = 1, .duty_cycle = 0, .enabled = false }succeeds if the pwm is initially on, but fails if it's already off because 1 is a too small period.
Update the check for lazy disable to always exit early if the target state is disabled, no matter what is currently configured.
--- drivers/pwm/pwm-stm32.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/pwm/pwm-stm32.c +3 -2
@@ -452,8 +452,9 @@ static int stm32_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, enabled = pwm->state.enabled; -if (enabled && !state->enabled) { -stm32_pwm_disable (priv, pwm->hwpwm); +if (!state->enabled) { +if (enabled) +stm32_pwm_disable (priv, pwm->hwpwm);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/484 drm/meson: fix canvas release in bind function
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yao Zi <[email protected]>
[ Upstream commit a695949b2e9bb6b6700a764c704731a306c4bebf ]
Allocated canvases may not be released on the error exit path of meson_drv_bind_master(), leading to resource leaking. Rewrite exit path to release canvases on error.
--- drivers/gpu/drm/meson/meson_drv.c | 37 +++++++++++++++---------------- 1 file changed, 18 insertions(+), 19 deletions(-)
drivers/gpu/drm/meson/meson_drv.c +18 -19
@@ -248,29 +248,20 @@ static int meson_drv_bind_master(struct device *dev, bool has_components)if (ret) goto free_drm; ret =meson_canvas_alloc (priv->canvas, &priv->canvas_id_vd1_0); -if (ret) { -meson_canvas_free (priv->canvas, priv->canvas_id_osd1); - goto free_drm; - } +if (ret) + goto free_canvas_osd1; ret =meson_canvas_alloc (priv->canvas, &priv->canvas_id_vd1_1); -if (ret) { -meson_canvas_free (priv->canvas, priv->canvas_id_osd1); -meson_canvas_free (priv->canvas, priv->canvas_id_vd1_0); - goto free_drm; - } +if (ret) + goto free_canvas_vd1_0; ret =meson_canvas_alloc (priv->canvas, &priv->canvas_id_vd1_2); -if (ret) { -meson_canvas_free (priv->canvas, priv->canvas_id_osd1); -meson_canvas_free (priv->canvas, priv->canvas_id_vd1_0); -meson_canvas_free (priv->canvas, priv->canvas_id_vd1_1); - goto free_drm; - } +if (ret) + goto free_canvas_vd1_1; priv->vsync_irq =platform_get_irq (pdev,0 ); ret =drm_vblank_init (drm,1 );if (ret) - goto free_drm; + goto free_canvas_vd1_2;/* Assign limits per soc revision/package */ for (i =0 ; i <ARRAY_SIZE (meson_drm_soc_attrs) ; ++i) {
@@ -286,11 +277,11 @@ static int meson_drv_bind_master(struct device *dev, bool has_components)*/ ret =drm_aperture_remove_framebuffers (false, &meson_driver);if (ret) - goto free_drm; + goto free_canvas_vd1_2; ret =drmm_mode_config_init (drm);if (ret) - goto free_drm; + goto free_canvas_vd1_2; drm->mode_config.max_width =3840 ; drm->mode_config.max_height =2160 ; drm->mode_config.funcs = &meson_mode_config_funcs;
@@ -305,7 +296,7 @@ static int meson_drv_bind_master(struct device *dev, bool has_components)if (priv->afbcd.ops) { ret = priv->afbcd.ops->init (priv);if (ret) - goto free_drm; + goto free_canvas_vd1_2; }/* Encoder Initialization */
@@ -364,6 +355,14 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) exit_afbcd:if (priv->afbcd.ops) priv->afbcd.ops->exit (priv); +free_canvas_vd1_2: +meson_canvas_free (priv->canvas, priv->canvas_id_vd1_2); +free_canvas_vd1_1: +meson_canvas_free (priv->canvas, priv->canvas_id_vd1_1); +free_canvas_vd1_0: +meson_canvas_free (priv->canvas, priv->canvas_id_vd1_0); +free_canvas_osd1: +meson_canvas_free (priv->canvas, priv->canvas_id_osd1); free_drm:drm_dev_put (drm);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/484 hwmon: (max6697) Fix underflow when writing limit attributes
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit cbf7467828cd4ec7ceac7a8b5b5ddb2f69f07b0e ]
Using DIV_ROUND_CLOSEST() on an unbound value can result in underflows. Indeed, module test scripts report:
temp1_max: Suspected underflow: [min=0, read 255000, written -9223372036854775808]temp1_crit: Suspected underflow: [min=0, read 255000, written -9223372036854775808]
Fix by introducing an extra set of clamping.
--- drivers/hwmon/max6697.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/max6697.c +1 -0
@@ -312,6 +312,7 @@ static ssize_t temp_store(struct device *dev,return ret;mutex_lock (&data->update_lock); + temp =clamp_val (temp,-1000000 ,1000000 );/* prevent underflow */ temp =DIV_ROUND_CLOSEST (temp,1000 ) + data->temp_offset; temp =clamp_val (temp,0 , data->type == max6581 ?255 :127 ); data->temp[nr][index] = temp;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/484 hwmon: (max6697) Fix swapped temp{1,8} critical alarms
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 1ea3fd1eb9869fcdcbc9c68f9728bfc47b9503f1 ]
The critical alarm bit for the local temperature sensor (temp1) is in bit 7 of register 0x45 (not bit 6), and the critical alarm bit for remote temperature sensor 7 (temp8) is in bit 6 (not bit 7).
This only affects MAX6581 since all other chips supported by this driver do not support those critical alarms.
--- drivers/hwmon/max6697.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/max6697.c +2 -2
@@ -430,14 +430,14 @@ static SENSOR_DEVICE_ATTR_RO(temp6_max_alarm, alarm, 20); static SENSOR_DEVICE_ATTR_RO(temp7_max_alarm, alarm, 21); static SENSOR_DEVICE_ATTR_RO(temp8_max_alarm, alarm, 23); -static SENSOR_DEVICE_ATTR_RO(temp1_crit_alarm, alarm, 14); +static SENSOR_DEVICE_ATTR_RO(temp1_crit_alarm, alarm, 15); static SENSOR_DEVICE_ATTR_RO(temp2_crit_alarm, alarm, 8); static SENSOR_DEVICE_ATTR_RO(temp3_crit_alarm, alarm, 9); static SENSOR_DEVICE_ATTR_RO(temp4_crit_alarm, alarm, 10); static SENSOR_DEVICE_ATTR_RO(temp5_crit_alarm, alarm, 11); static SENSOR_DEVICE_ATTR_RO(temp6_crit_alarm, alarm, 12); static SENSOR_DEVICE_ATTR_RO(temp7_crit_alarm, alarm, 13); -static SENSOR_DEVICE_ATTR_RO(temp8_crit_alarm, alarm, 15); +static SENSOR_DEVICE_ATTR_RO(temp8_crit_alarm, alarm, 14); static SENSOR_DEVICE_ATTR_RO(temp2_fault, alarm, 1); static SENSOR_DEVICE_ATTR_RO(temp3_fault, alarm, 2);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/484 arm64: dts: qcom: sdm845: add power-domain to UFS PHY
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit fd39ae8b9bc10419b1e4b849cdbc6755a967ade1 ]
The UFS PHY is powered on via the UFS_PHY_GDSC power domain. Add corresponding power-domain the the PHY node.
--- arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/qcom/sdm845.dtsi +2 -0
@@ -2299,6 +2299,8 @@ ufs_mem_phy: phy@1d87000 { clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>, <&gcc GCC_UFS_PHY_PHY_AUX_CLK>; + power-domains = <&gcc UFS_PHY_GDSC>; + resets = <&ufs_mem_hc 0>; reset-names = "ufsphy"; status = "disabled";
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/484 arm64: dts: qcom: sm8250: switch UFS QMP PHY to new style of bindings
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit ba865bdcc688932980b8e5ec2154eaa33cd4a981 ]
Change the UFS QMP PHY to use newer style of QMP PHY bindings (single resource region, no per-PHY subnodes).
Stable-dep-of: 154ed5ea328d ("arm64: dts: qcom: sm8250: add power-domain to UFS PHY")
--- arch/arm64/boot/dts/qcom/sm8250.dtsi | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-)
arch/arm64/boot/dts/qcom/sm8250.dtsi +6 -14
@@ -1702,7 +1702,7 @@ ufs_mem_hc: ufshc@1d84000 { "jedec,ufs-2.0"; reg = <0 0x01d84000 0 0x3000>; interrupts = <GIC_SPI 265 IRQ_TYPE_LEVEL_HIGH>; - phys = <&ufs_mem_phy_lanes>; + phys = <&ufs_mem_phy>; phy-names = "ufsphy"; lanes-per-direction = <2>; #reset-cells = <1>;
@@ -1746,10 +1746,8 @@ ufs_mem_hc: ufshc@1d84000 { ufs_mem_phy: phy@1d87000 { compatible = "qcom,sm8250-qmp-ufs-phy"; - reg = <0 0x01d87000 0 0x1c0>; - #address-cells = <2>; - #size-cells = <2>; - ranges; + reg = <0 0x01d87000 0 0x1000>; + clock-names = "ref", "ref_aux"; clocks = <&rpmhcc RPMH_CXO_CLK>,
@@ -1757,16 +1755,10 @@ ufs_mem_phy: phy@1d87000 { resets = <&ufs_mem_hc 0>; reset-names = "ufsphy"; - status = "disabled"; - ufs_mem_phy_lanes: phy@1d87400 { - reg = <0 0x01d87400 0 0x16c>, - <0 0x01d87600 0 0x200>, - <0 0x01d87c00 0 0x200>, - <0 0x01d87800 0 0x16c>, - <0 0x01d87a00 0 0x200>; - #phy-cells = <0>; - }; + #phy-cells = <0>; + + status = "disabled"; }; ipa_virt: interconnect@1e00000 {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/484 arm64: dts: qcom: sm8250: add power-domain to UFS PHY
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 154ed5ea328d8a97a4ef5d1447e6f06d11fe2bbe ]
The UFS PHY is powered on via the UFS_PHY_GDSC power domain. Add corresponding power-domain the the PHY node.
--- arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/qcom/sm8250.dtsi +2 -0
@@ -1756,6 +1756,8 @@ ufs_mem_phy: phy@1d87000 { resets = <&ufs_mem_hc 0>; reset-names = "ufsphy"; + power-domains = <&gcc UFS_PHY_GDSC>; + #phy-cells = <0>; status = "disabled";
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/484 soc: qcom: rpmh-rsc: Ensure irqs arent disabled by rpmh_rsc_send_data() callers
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit e43111f52b9ec5c2d700f89a1d61c8d10dc2d9e9 ]
Dan pointed out that Smatch is concerned about this code because it uses spin_lock_irqsave() and then calls wait_event_lock_irq() which enables irqs before going to sleep. The comment above the function says it should be called with interrupts enabled, but we simply hope that's true without really confirming that. Let's add a might_sleep() here to confirm that interrupts and preemption aren't disabled. Once we do that, we can change the lock to be non-saving, spin_lock_irq(), to clarify that we don't expect irqs to be disabled. If irqs are disabled by callers they're going to be enabled anyway in the wait_event_lock_irq() call which would be bad.
This should make Smatch happier and find bad callers faster with the might_sleep(). We can drop the WARN_ON() in the caller because we have the might_sleep() now, simplifying the code.
--- drivers/soc/qcom/rpmh-rsc.c | 7 ++++--- drivers/soc/qcom/rpmh.c | 1 - 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/soc/qcom/rpmh-rsc.c +4 -3
@@ -608,13 +608,14 @@ int rpmh_rsc_send_data(struct rsc_drv *drv, const struct tcs_request *msg) {struct tcs_group *tcs;int tcs_id; -unsigned long flags; + +might_sleep (); tcs =get_tcs_for_msg (drv, msg);if (IS_ERR (tcs))return PTR_ERR (tcs); -spin_lock_irqsave (&drv->lock, flags); +spin_lock_irq (&drv->lock);/* Wait forever for a free tcs. It better be there eventually! */ wait_event_lock_irq(drv->tcs_wait,
@@ -632,7 +633,7 @@ int rpmh_rsc_send_data(struct rsc_drv *drv, const struct tcs_request *msg)write_tcs_reg_sync (drv,RSC_DRV_CMD_ENABLE , tcs_id,0 );enable_tcs_irq (drv, tcs_id, true); } -spin_unlock_irqrestore (&drv->lock, flags); +spin_unlock_irq (&drv->lock);/* * These two can be done after the lock is released because:
drivers/soc/qcom/rpmh.c +0 -1
@@ -189,7 +189,6 @@ static int __rpmh_write(const struct device *dev, enum rpmh_state state, }if (state ==RPMH_ACTIVE_ONLY_STATE ) { -WARN_ON (irqs_disabled ()); ret =rpmh_rsc_send_data (ctrlr_to_drv (ctrlr), &rpm_msg->msg); }else {/* Clean up our call by spoofing tx_done */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/484 arm64: dts: qcom: msm8996: specify UFS core_clk frequencies
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 02f838b7f8cdfb7a96b7f08e7f6716f230bdecba ]
Follow the example of other platforms and specify core_clk frequencies in the frequency table in addition to the core_clk_src frequencies. The driver should be setting the leaf frequency instead of some interim clock freq.
--- arch/arm64/boot/dts/qcom/msm8996.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/msm8996.dtsi +1 -1
@@ -1756,7 +1756,7 @@ ufshc: ufshc@624000 { <&gcc GCC_UFS_RX_SYMBOL_0_CLK>; freq-table-hz = <100000000 200000000>, - <0 0>, + <100000000 200000000>, <0 0>, <0 0>, <0 0>,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/484 memory: fsl_ifc: Make FSL_IFC config visible and selectable
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Esben Haabendal <[email protected]>
[ Upstream commit 9ba0cae3cac07c21c583f9ff194f74043f90d29c ]
While use of fsl_ifc driver with NAND flash is fine, as the fsl_ifc_nand driver selects FSL_IFC automatically, we need the CONFIG_FSL_IFC option to be selectable for platforms using fsl_ifc with NOR flash.
--- drivers/memory/Kconfig | 2 +- drivers/mtd/nand/raw/Kconfig | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-)
drivers/memory/Kconfig +1 -1
@@ -168,7 +168,7 @@ config FSL_CORENET_CF represents a coherency violation. config FSL_IFC - bool "Freescale IFC driver" if COMPILE_TEST + bool "Freescale IFC driver" depends on FSL_SOC || ARCH_LAYERSCAPE || SOC_LS1021A || COMPILE_TEST depends on HAS_IOMEM
drivers/mtd/nand/raw/Kconfig +1 -2
@@ -254,8 +254,7 @@ config MTD_NAND_FSL_IFC tristate "Freescale IFC NAND controller" depends on FSL_SOC || ARCH_LAYERSCAPE || SOC_LS1021A || COMPILE_TEST depends on HAS_IOMEM - select FSL_IFC - select MEMORY + depends on FSL_IFC help Various Freescale chips e.g P1010, include a NAND Flash machine with built-in hardware ECC capabilities.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/484 soc: qcom: pdr: protect locator_addr with the main mutex
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 107924c14e3ddd85119ca43c26a4ee1056fa9b84 ]
If the service locator server is restarted fast enough, the PDR can rewrite locator_addr fields concurrently. Protect them by placing modification of those fields under the main pdr->lock.
--- drivers/soc/qcom/pdr_interface.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/soc/qcom/pdr_interface.c +4 -2
@@ -76,12 +76,12 @@ static int pdr_locator_new_server(struct qmi_handle *qmi, locator_hdl);struct pdr_service *pds; +mutex_lock (&pdr->lock);/* Create a local client port for QMI communication */ pdr->locator_addr.sq_family =AF_QIPCRTR ; pdr->locator_addr.sq_node = svc->node; pdr->locator_addr.sq_port = svc->port; -mutex_lock (&pdr->lock); pdr->locator_init_complete = true;mutex_unlock (&pdr->lock);
@@ -104,10 +104,10 @@ static void pdr_locator_del_server(struct qmi_handle *qmi,mutex_lock (&pdr->lock); pdr->locator_init_complete = false; -mutex_unlock (&pdr->lock); pdr->locator_addr.sq_node =0 ; pdr->locator_addr.sq_port =0 ; +mutex_unlock (&pdr->lock); }static const struct qmi_ops pdr_locator_ops = {
@@ -366,12 +366,14 @@ static int pdr_get_domain_list(struct servreg_get_domain_list_req *req,if (ret <0 )return ret; +mutex_lock (&pdr->lock); ret =qmi_send_request (&pdr->locator_hdl, &pdr->locator_addr, &txn,SERVREG_GET_DOMAIN_LIST_REQ ,SERVREG_GET_DOMAIN_LIST_REQ_MAX_LEN , servreg_get_domain_list_req_ei, req); +mutex_unlock (&pdr->lock);if (ret <0 ) {qmi_txn_cancel (&txn);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/484 soc: qcom: pdr: fix parsing of domains lists
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 57f20d51f35780f240ecf39d81cda23612800a92 ]
While parsing the domains list, start offsets from 0 rather than from domains_read. The domains_read is equal to the total count of the domains we have seen, while the domains list in the message starts from offset 0.
--- drivers/soc/qcom/pdr_interface.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/qcom/pdr_interface.c +1 -1
@@ -418,7 +418,7 @@ static int pdr_locate_service(struct pdr_handle *pdr, struct pdr_service *pds)if (ret <0 ) goto out; -for (i = domains_read; i < resp->domain_list_len; i++) { +for (i =0 ; i < resp->domain_list_len; i++) { entry = &resp->domain_list[i];if (strnlen (entry->name,sizeof (entry->name)) ==sizeof (entry->name))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/484 arm64: dts: rockchip: Increase VOP clk rate on RK3328
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <[email protected]>
[ Upstream commit 0f2ddb128fa20f8441d903285632f2c69e90fae1 ]
The VOP on RK3328 needs to run at a higher rate in order to produce a proper 3840x2160 signal.
Change to use 300MHz for VIO clk and 400MHz for VOP clk, same rates used by vendor 4.4 kernel.
--- arch/arm64/boot/dts/rockchip/rk3328.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/rockchip/rk3328.dtsi +2 -2
@@ -807,8 +807,8 @@ cru: clock-controller@ff440000 { <0>, <24000000>, <24000000>, <24000000>, <15000000>, <15000000>, - <100000000>, <100000000>, - <100000000>, <100000000>, + <300000000>, <100000000>, + <400000000>, <100000000>, <50000000>, <100000000>, <100000000>, <100000000>, <50000000>, <50000000>,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/484 ARM: dts: imx6qdl-kontron-samx6i: move phy reset into phy-node
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Felsch <[email protected]>
[ Upstream commit 5694eed98cca5c164ebb5b831b65b4c9eee4b2d5 ]
Add ethernet-phy node so we can drop the deprecated fec phy-reset-gpios property. The reset-assert-us value is taken from the existing logic since the fec driver will add an 1ms assert delay per default if phy-reset-gpios is used and phy-reset-duration is not specified.
Stable-dep-of: edfea889a049 ("ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset")
--- arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +13 -1
@@ -260,7 +260,19 @@ &fec { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_enet>; phy-mode = "rgmii"; - phy-reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>; + phy-handle = <ðphy>; + + mdio { + #address-cells = <1>; + #size-cells = <0>; + + ethphy: ethernet-phy@1 { + compatible = "ethernet-phy-ieee802.3-c22"; + reg = <1>; + reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>; + reset-assert-us = <1000>; + }; + }; }; &hdmi {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/484 ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit edfea889a049abe80f0d55c0365bf60fbade272f ]
The PHY reset line is connected to both the SoC (GPIO1_25) and the CPLD. We must not use the GPIO1_25 as it will drive against the output buffer of the CPLD. Instead there is another GPIO (GPIO2_01), an input to the CPLD, which will tell the CPLD to assert the PHY reset line.
--- arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +2 -2
@@ -269,7 +269,7 @@ mdio { ethphy: ethernet-phy@1 { compatible = "ethernet-phy-ieee802.3-c22"; reg = <1>; - reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>; + reset-gpios = <&gpio2 1 GPIO_ACTIVE_LOW>; reset-assert-us = <1000>; }; };
@@ -516,7 +516,7 @@ MX6QDL_PAD_RGMII_RX_CTL__RGMII_RX_CTL 0x1b0b0 MX6QDL_PAD_ENET_MDIO__ENET_MDIO 0x1b0b0 MX6QDL_PAD_ENET_MDC__ENET_MDC 0x1b0b0 MX6QDL_PAD_ENET_REF_CLK__ENET_TX_CLK 0x1b0b0 - MX6QDL_PAD_ENET_CRS_DV__GPIO1_IO25 0x1b0b0 /* RST_GBE0_PHY# */ + MX6QDL_PAD_NANDF_D1__GPIO2_IO01 0x1b0b0 /* RST_GBE0_PHY# */ >; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/484 ARM: dts: imx6qdl-kontron-samx6i: fix board reset
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit b972d6b3b46345023aee56a95df8e2c137aa4ee4 ]
On i.MX6 the board is reset by the watchdog. But in turn to do a complete board reset, we have to assert the WDOG_B output which is routed also to the CPLD which then do a complete power-cycle of the board.
--- arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +1 -0
@@ -817,5 +817,6 @@ &wdog1 { /* CPLD is feeded by watchdog (hardwired) */ pinctrl-names = "default"; pinctrl-0 = <&pinctrl_wdog1>; + fsl,ext-reset-output; status = "okay"; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/484 ARM: dts: imx6qdl-kontron-samx6i: fix SPI0 chip selects
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit 74e1c956a68a65d642447d852e95b3fbb69bebaa ]
There is a comment in the imx6q variant dtsi claiming that these modules will have one more chip select than the imx6dl variant. This is wrong. Ordinary GPIOs are used for chip selects and both variants of the module share the very same PCB and both have this GPIO routed to the SPI0_CS1# pin of the SMARC connector.
Fix it by moving the third chip select description to the common dtsi.
--- arch/arm/boot/dts/imx6q-kontron-samx6i.dtsi | 23 ------------------- arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 5 +++- 2 files changed, 4 insertions(+), 24 deletions(-)
arch/arm/boot/dts/imx6q-kontron-samx6i.dtsi +0 -23
@@ -5,31 +5,8 @@ #include "imx6q.dtsi" #include "imx6qdl-kontron-samx6i.dtsi" -#include <dt-bindings/gpio/gpio.h> / { model = "Kontron SMARC sAMX6i Quad/Dual"; compatible = "kontron,imx6q-samx6i", "fsl,imx6q"; }; - -/* Quad/Dual SoMs have 3 chip-select signals */ -&ecspi4 { - cs-gpios = <&gpio3 24 GPIO_ACTIVE_LOW>, - <&gpio3 29 GPIO_ACTIVE_LOW>, - <&gpio3 25 GPIO_ACTIVE_LOW>; -}; - -&pinctrl_ecspi4 { - fsl,pins = < - MX6QDL_PAD_EIM_D21__ECSPI4_SCLK 0x100b1 - MX6QDL_PAD_EIM_D28__ECSPI4_MOSI 0x100b1 - MX6QDL_PAD_EIM_D22__ECSPI4_MISO 0x100b1 - - /* SPI4_IMX_CS2# - connected to internal flash */ - MX6QDL_PAD_EIM_D24__GPIO3_IO24 0x1b0b0 - /* SPI4_IMX_CS0# - connected to SMARC SPI0_CS0# */ - MX6QDL_PAD_EIM_D29__GPIO3_IO29 0x1b0b0 - /* SPI4_CS3# - connected to SMARC SPI0_CS1# */ - MX6QDL_PAD_EIM_D25__GPIO3_IO25 0x1b0b0 - >; -};
arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +4 -1
@@ -244,7 +244,8 @@ &ecspi4 { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_ecspi4>; cs-gpios = <&gpio3 24 GPIO_ACTIVE_LOW>, - <&gpio3 29 GPIO_ACTIVE_LOW>; + <&gpio3 29 GPIO_ACTIVE_LOW>, + <&gpio3 25 GPIO_ACTIVE_LOW>; status = "okay"; /* default boot source: workaround #1 for errata ERR006282 */
@@ -464,6 +465,8 @@ MX6QDL_PAD_EIM_D22__ECSPI4_MISO 0x100b1 MX6QDL_PAD_EIM_D24__GPIO3_IO24 0x1b0b0 /* SPI_IMX_CS0# - connected to SMARC SPI0_CS0# */ MX6QDL_PAD_EIM_D29__GPIO3_IO29 0x1b0b0 + /* SPI4_CS3# - connected to SMARC SPI0_CS1# */ + MX6QDL_PAD_EIM_D25__GPIO3_IO25 0x1b0b0 >; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/484 ARM: dts: imx6qdl-kontron-samx6i: fix PCIe reset polarity
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit df35c6e9027cf9affe699e632a48082ab1bbba4c ]
The PCIe reset line is active low. Fix it.
--- arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +1 -1
@@ -732,7 +732,7 @@ &pcie { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_pcie>; wake-up-gpio = <&gpio6 18 GPIO_ACTIVE_HIGH>; - reset-gpio = <&gpio3 13 GPIO_ACTIVE_HIGH>; + reset-gpio = <&gpio3 13 GPIO_ACTIVE_LOW>; }; /* LCD_BKLT_PWM */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/484 arm64: dts: mediatek: mt8183-kukui: Drop bogus output-enable property
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit e9a9055fdcdc1e5a27cef118c5b4f09cdd2fa28e ]
The "output-enable" property is set on uart1's RTS pin. This is bogus because the hardware does not actually have a controllable output buffer. Secondly, the implementation incorrectly treats this property as a request to switch the pin to GPIO output. This does not fit the intended semantic of "output-enable" and it does not have any affect either because the pin is muxed to the UART function, not the GPIO function.
Drop the property.
--- arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 2 -- 1 file changed, 2 deletions(-)
arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi +0 -2
@@ -703,7 +703,6 @@ pins-tx { }; pins-rts { pinmux = <PINMUX_GPIO47__FUNC_URTS1>; - output-enable; }; pins-cts { pinmux = <PINMUX_GPIO46__FUNC_UCTS1>;
@@ -722,7 +721,6 @@ pins-tx { }; pins-rts { pinmux = <PINMUX_GPIO47__FUNC_URTS1>; - output-enable; }; pins-cts { pinmux = <PINMUX_GPIO46__FUNC_UCTS1>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/484 arm64: dts: mediatek: mt7622: fix "emmc" pinctrl mux
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit aebba1030a5766cdf894ed4ab0cac7aed5aee9c1 ]
Value "emmc_rst" is a group name and should be part of the "groups" property.
This fixes:arch/arm64/boot/dts/mediatek/mt7622-rfb1.dtb: pinctrl@10211000: emmc-pins-default:mux:function: ['emmc', 'emmc_rst'] is too long
from schema $id: http://devicetree.org/schemas/pinctrl/mediatek,mt7622-pinctrl.yaml#arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dtb: pinctrl@10211000: emmc-pins-default:mux:function: ['emmc', 'emmc_rst'] is too long
from schema $id: http://devicetree.org/schemas/pinctrl/mediatek,mt7622-pinctrl.yaml#
--- arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts | 4 ++-- arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts +2 -2
@@ -285,8 +285,8 @@ asm_sel { /* eMMC is shared pin with parallel NAND */ emmc_pins_default: emmc-pins-default { mux { - function = "emmc", "emmc_rst"; - groups = "emmc"; + function = "emmc"; + groups = "emmc", "emmc_rst"; }; /* "NDL0","NDL1","NDL2","NDL3","NDL4","NDL5","NDL6","NDL7",
arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts +2 -2
@@ -249,8 +249,8 @@ &pio { /* eMMC is shared pin with parallel NAND */ emmc_pins_default: emmc-pins-default { mux { - function = "emmc", "emmc_rst"; - groups = "emmc"; + function = "emmc"; + groups = "emmc", "emmc_rst"; }; /* "NDL0","NDL1","NDL2","NDL3","NDL4","NDL5","NDL6","NDL7",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/484 arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add ports node for anx7625
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 4055416e6c51347e7dd5784065263fe0ced0bb7d ]
The anx7625 binding requires a "ports" node as a container for the "port" nodes. The jacuzzi dtsi file is missing it.
Add a "ports" node under the anx7625 node, and move the port related nodes and properties under it.
--- .../dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 25 +++++++++++-------- 1 file changed, 14 insertions(+), 11 deletions(-)
arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi +14 -11
@@ -169,21 +169,24 @@ anx_bridge: anx7625@58 { vdd18-supply = <&pp1800_mipibrdg>; vdd33-supply = <&vddio_mipibrdg>; - #address-cells = <1>; - #size-cells = <0>; - port@0 { - reg = <0>; + ports { + #address-cells = <1>; + #size-cells = <0>; - anx7625_in: endpoint { - remote-endpoint = <&dsi_out>; + port@0 { + reg = <0>; + + anx7625_in: endpoint { + remote-endpoint = <&dsi_out>; + }; }; - }; - port@1 { - reg = <1>; + port@1 { + reg = <1>; - anx7625_out: endpoint { - remote-endpoint = <&panel_in>; + anx7625_out: endpoint { + remote-endpoint = <&panel_in>; + }; }; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/484 arm64: dts: amlogic: gx: correct hdmi clocks
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 0602ba0dcd0e76067a0b7543e92b2de3fb231073 ]
The clocks provided to HDMI tx are not consistent between gx and g12:
* gx receives the peripheral clock as 'isfr' while g12 receives it as 'iahb'
* g12 gets the HDMI system clock as 'isfr' but gx does not even get it. It surely needs that clock since the driver is directly poking around the clock controller's registers for that clock.
Align gx SoCs with g12 and provide:
* the HDMI peripheral clock as 'iahb'
* the HDMI system clock as 'isfr'
--- arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi | 4 ++-- arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi +2 -2
@@ -311,8 +311,8 @@ &hdmi_tx { <&reset RESET_HDMI_SYSTEM_RESET>, <&reset RESET_HDMI_TX>; reset-names = "hdmitx_apb", "hdmitx", "hdmitx_phy"; - clocks = <&clkc CLKID_HDMI_PCLK>, - <&clkc CLKID_CLK81>, + clocks = <&clkc CLKID_HDMI>, + <&clkc CLKID_HDMI_PCLK>, <&clkc CLKID_GCLK_VENCI_INT0>; clock-names = "isfr", "iahb", "venci"; };
arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +2 -2
@@ -323,8 +323,8 @@ &hdmi_tx { <&reset RESET_HDMI_SYSTEM_RESET>, <&reset RESET_HDMI_TX>; reset-names = "hdmitx_apb", "hdmitx", "hdmitx_phy"; - clocks = <&clkc CLKID_HDMI_PCLK>, - <&clkc CLKID_CLK81>, + clocks = <&clkc CLKID_HDMI>, + <&clkc CLKID_HDMI_PCLK>, <&clkc CLKID_GCLK_VENCI_INT0>; clock-names = "isfr", "iahb", "venci"; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/484 m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eero Tamminen <[email protected]>
[ Upstream commit f70065a9fd988983b2c693631b801f25a615fc04 ]
Avoid freeze on Atari TT / MegaSTe boot with continuous messages of:
unexpected interrupt from 112
Which was due to VBL interrupt being enabled in SCU sys mask, but there being no handler for that any more.
(Bug and fix were first verified on real Atari TT HW by Christian,
this patch later on in Hatari emulator.)
--- arch/m68k/atari/ataints.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
arch/m68k/atari/ataints.c +1 -5
@@ -302,11 +302,7 @@ void __init atari_init_IRQ(void)if (ATARIHW_PRESENT (SCU )) {/* init the SCU if present */ - tt_scu.sys_mask =0x10 ;/* enable VBL (for the cursor) and -* disable HSYNC interrupts (who -* needs them?) MFP and SCC are -* enabled in VME mask -*/ + tt_scu.sys_mask =0x0 ;/* disable all interrupts */ tt_scu.vme_mask =0x60 ;/* enable MFP and SCC ints */ }else {/* If no SCU and no Hades, the HSYNC interrupt needs to be
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/484 x86/xen: Convert comma to semicolon
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit 349d271416c61f82b853336509b1d0dc04c1fcbb ]
Replace a comma between expression statements by a semicolon.
--- arch/x86/xen/p2m.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/xen/p2m.c +2 -2
@@ -736,7 +736,7 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,* immediate unmapping. */ map_ops[i].status = GNTST_general_error; - unmap[0 ].host_addr = map_ops[i].host_addr, + unmap[0 ].host_addr = map_ops[i].host_addr; unmap[0 ].handle = map_ops[i].handle; map_ops[i].handle =INVALID_GRANT_HANDLE ;if (map_ops[i].flags & GNTMAP_device_map)
@@ -746,7 +746,7 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,if (kmap_ops) { kmap_ops[i].status = GNTST_general_error; - unmap[1 ].host_addr = kmap_ops[i].host_addr, + unmap[1 ].host_addr = kmap_ops[i].host_addr; unmap[1 ].handle = kmap_ops[i].handle; kmap_ops[i].handle =INVALID_GRANT_HANDLE ;if (kmap_ops[i].flags & GNTMAP_device_map)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/484 m68k: cmpxchg: Fix return value for default case in __arch_xchg()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
[ Upstream commit 21b9e722ad28c19c2bc83f18f540b3dbd89bf762 ]
The return value of __invalid_xchg_size() is assigned to tmp instead of the return variable x. Assign it to x instead.
--- arch/m68k/include/asm/cmpxchg.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/m68k/include/asm/cmpxchg.h +1 -1
@@ -33,7 +33,7 @@ static inline unsigned long __xchg(unsigned long x, volatile void * ptr, int siz x = tmp;break ;default : - tmp =__invalid_xchg_size (x, ptr, size); + x =__invalid_xchg_size (x, ptr, size);break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/484 ARM: pxa: spitz: use gpio descriptors for audio
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 726d8c965bae2d7468445d990849e281dca8cbf7 ]
The audio driver should not use a hardwired gpio number from the header. Change it to use a lookup table.
Stable-dep-of: 78ab3d352f29 ("ARM: spitz: fix GPIO assignment for backlight")
---
arch/arm/mach-pxa/spitz.c | 33 ++++++++++-
arch/arm/mach-pxa/{include/mach => }/spitz.h | 2 +-
arch/arm/mach-pxa/spitz_pm.c | 2 +-
sound/soc/pxa/spitz.c | 58 ++++++++------------
4 files changed, 57 insertions(+), 38 deletions(-)
rename arch/arm/mach-pxa/{include/mach => }/spitz.h (99%)arch/arm/mach-pxa/spitz.c +32 -1
@@ -43,7 +43,7 @@#include <linux/platform_data/mmc-pxamci.h> #include <linux/platform_data/usb-ohci-pxa27x.h> #include <linux/platform_data/video-pxafb.h> -#include <mach/spitz.h> +#include "spitz.h" #include "sharpsl_pm.h" #include <mach/smemc.h>
@@ -954,11 +954,42 @@ static void __init spitz_i2c_init(void)static inline void spitz_i2c_init (void ) {}#endif +static struct gpiod_lookup_table spitz_audio_gpio_table = { + .dev_id ="spitz-audio" , + .table = { +GPIO_LOOKUP ("sharp-scoop.0" ,SPITZ_GPIO_MUTE_L -SPITZ_SCP_GPIO_BASE , +"mute-l" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("sharp-scoop.0" ,SPITZ_GPIO_MUTE_R -SPITZ_SCP_GPIO_BASE , +"mute-r" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("sharp-scoop.1" ,SPITZ_GPIO_MIC_BIAS -SPITZ_SCP2_GPIO_BASE , +"mic" ,GPIO_ACTIVE_HIGH ), + { }, + }, +}; + +static struct gpiod_lookup_table akita_audio_gpio_table = { + .dev_id ="spitz-audio" , + .table = { +GPIO_LOOKUP ("sharp-scoop.0" ,SPITZ_GPIO_MUTE_L -SPITZ_SCP_GPIO_BASE , +"mute-l" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("sharp-scoop.0" ,SPITZ_GPIO_MUTE_R -SPITZ_SCP_GPIO_BASE , +"mute-r" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("i2c-max7310" ,AKITA_GPIO_MIC_BIAS -AKITA_IOEXP_GPIO_BASE , +"mic" ,GPIO_ACTIVE_HIGH ), + { }, + }, +}; +/****************************************************************************** * Audio devices ******************************************************************************/ static inline void spitz_audio_init (void ) { +if (machine_is_akita ()) +gpiod_add_lookup_table (&akita_audio_gpio_table); +else +gpiod_add_lookup_table (&spitz_audio_gpio_table); +platform_device_register_simple ("spitz-audio" ,-1 ,NULL ,0 ); }
arch/arm/mach-pxa/spitz.h renamed from arch/arm/mach-pxa/include/mach/spitz.h +1 -1
@@ -11,7 +11,7 @@#define __ASM_ARCH_SPITZ_H 1#endif -#include "irqs.h" /* PXA_NR_BUILTIN_GPIO, PXA_GPIO_TO_IRQ */ +#include <mach/irqs.h> /* PXA_NR_BUILTIN_GPIO, PXA_GPIO_TO_IRQ */ #include <linux/fb.h> /* Spitz/Akita GPIOs */
arch/arm/mach-pxa/spitz_pm.c +1 -1
@@ -20,7 +20,7 @@#include <asm/mach-types.h> #include <mach/hardware.h> -#include <mach/spitz.h> +#include "spitz.h" #include "pxa27x.h" #include "sharpsl_pm.h"
sound/soc/pxa/spitz.c +23 -35
129 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/484 ARM: spitz: fix GPIO assignment for backlight
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit 78ab3d352f2982bf3f7e506bfbaba7afee1ed8a9 ]
GPIOs controlling backlight on Spitz and Akita are coming from GPIO expanders, not the pxa27xx-gpio block, correct it.
Additionally GPIO lookup tables operate with pin numbers rather than legacy GPIO numbers, fix that as well. Use raw numbers instead of legacy GPIO names to avoid confusion.
--- arch/arm/mach-pxa/spitz.c | 30 ++++++++++-------------------- 1 file changed, 10 insertions(+), 20 deletions(-)
arch/arm/mach-pxa/spitz.c +10 -20
@@ -516,10 +516,8 @@ static struct pxa2xx_spi_chip spitz_ads7846_chip = {static struct gpiod_lookup_table spitz_lcdcon_gpio_table = { .dev_id ="spi2.1" , .table = { -GPIO_LOOKUP ("gpio-pxa" ,SPITZ_GPIO_BACKLIGHT_CONT , -"BL_CONT" ,GPIO_ACTIVE_LOW ), -GPIO_LOOKUP ("gpio-pxa" ,SPITZ_GPIO_BACKLIGHT_ON , -"BL_ON" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("sharp-scoop.1" ,6 ,"BL_CONT" ,GPIO_ACTIVE_LOW ), +GPIO_LOOKUP ("sharp-scoop.1" ,7 ,"BL_ON" ,GPIO_ACTIVE_HIGH ), { }, }, };
@@ -527,10 +525,8 @@ static struct gpiod_lookup_table spitz_lcdcon_gpio_table = {static struct gpiod_lookup_table akita_lcdcon_gpio_table = { .dev_id ="spi2.1" , .table = { -GPIO_LOOKUP ("gpio-pxa" ,AKITA_GPIO_BACKLIGHT_CONT , -"BL_CONT" ,GPIO_ACTIVE_LOW ), -GPIO_LOOKUP ("gpio-pxa" ,AKITA_GPIO_BACKLIGHT_ON , -"BL_ON" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("i2c-max7310" ,3 ,"BL_ON" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("i2c-max7310" ,4 ,"BL_CONT" ,GPIO_ACTIVE_LOW ), { }, }, };
@@ -957,12 +953,9 @@ static inline void spitz_i2c_init(void) {}static struct gpiod_lookup_table spitz_audio_gpio_table = { .dev_id ="spitz-audio" , .table = { -GPIO_LOOKUP ("sharp-scoop.0" ,SPITZ_GPIO_MUTE_L -SPITZ_SCP_GPIO_BASE , -"mute-l" ,GPIO_ACTIVE_HIGH ), -GPIO_LOOKUP ("sharp-scoop.0" ,SPITZ_GPIO_MUTE_R -SPITZ_SCP_GPIO_BASE , -"mute-r" ,GPIO_ACTIVE_HIGH ), -GPIO_LOOKUP ("sharp-scoop.1" ,SPITZ_GPIO_MIC_BIAS -SPITZ_SCP2_GPIO_BASE , -"mic" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("sharp-scoop.0" ,3 ,"mute-l" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("sharp-scoop.0" ,4 ,"mute-r" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("sharp-scoop.1" ,8 ,"mic" ,GPIO_ACTIVE_HIGH ), { }, }, };
@@ -970,12 +963,9 @@ static struct gpiod_lookup_table spitz_audio_gpio_table = {static struct gpiod_lookup_table akita_audio_gpio_table = { .dev_id ="spitz-audio" , .table = { -GPIO_LOOKUP ("sharp-scoop.0" ,SPITZ_GPIO_MUTE_L -SPITZ_SCP_GPIO_BASE , -"mute-l" ,GPIO_ACTIVE_HIGH ), -GPIO_LOOKUP ("sharp-scoop.0" ,SPITZ_GPIO_MUTE_R -SPITZ_SCP_GPIO_BASE , -"mute-r" ,GPIO_ACTIVE_HIGH ), -GPIO_LOOKUP ("i2c-max7310" ,AKITA_GPIO_MIC_BIAS -AKITA_IOEXP_GPIO_BASE , -"mic" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("sharp-scoop.0" ,3 ,"mute-l" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("sharp-scoop.0" ,4 ,"mute-r" ,GPIO_ACTIVE_HIGH ), +GPIO_LOOKUP ("i2c-max7310" ,2 ,"mic" ,GPIO_ACTIVE_HIGH ), { }, }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/484 vmlinux.lds.h: catch .bss..L* sections into BSS")
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 1a7b7326d587c9a5e8ff067e70d6aaf0333f4bb3 ]
Commit 9a427556fb8e ("vmlinux.lds.h: catch compound literals into data and BSS") added catches for .data..L* and .rodata..L* but missed .bss..L*
Since commit 5431fdd2c181 ("ptrace: Convert ptrace_attach() to use lock guards") the following appears at build:
LD .tmp_vmlinux.kallsyms1
powerpc64-linux-ld: warning: orphan section .bss..Lubsan_data33' from kernel/ptrace.o' being placed in section `.bss..Lubsan_data33'
NM .tmp_vmlinux.kallsyms1.syms KSYMS .tmp_vmlinux.kallsyms1.S AS .tmp_vmlinux.kallsyms1.S LD .tmp_vmlinux.kallsyms2 powerpc64-linux-ld: warning: orphan section `.bss..Lubsan_data33' from `kernel/ptrace.o' being placed in section `.bss..Lubsan_data33' NM .tmp_vmlinux.kallsyms2.syms KSYMS .tmp_vmlinux.kallsyms2.S AS .tmp_vmlinux.kallsyms2.S LD vmlinux
powerpc64-linux-ld: warning: orphan section .bss..Lubsan_data33' from kernel/ptrace.o' being placed in section `.bss..Lubsan_data33'
Lets add .bss..L* to BSS_MAIN macro to catch those sections into BSS.
--- include/asm-generic/vmlinux.lds.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/asm-generic/vmlinux.lds.h +1 -1
@@ -101,7 +101,7 @@#define DATA_MAIN .data .data.[0-9a-zA-Z_]* .data..L* .data..compoundliteral* .data.$__unnamed_* .data.$L*#define SDATA_MAIN .sdata .sdata.[0-9a-zA-Z_]*#define RODATA_MAIN .rodata .rodata.[0-9a-zA-Z_]* .rodata..L* -#define BSS_MAIN .bss .bss.[0-9a-zA-Z_]* .bss..compoundliteral* +#define BSS_MAIN .bss .bss.[0-9a-zA-Z_]* .bss..L* .bss..compoundliteral*#define SBSS_MAIN .sbss .sbss.[0-9a-zA-Z_]*#else #define TEXT_MAIN .text
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/484 firmware: turris-mox-rwtm: Do not complete if there are no waiters
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Behún <[email protected]>
[ Upstream commit 0bafb172b111ab27251af0eb684e7bde9570ce4c ]
Do not complete the "command done" completion if there are no waiters. This can happen if a wait_for_completion() timed out or was interrupted.
--- drivers/firmware/turris-mox-rwtm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/firmware/turris-mox-rwtm.c +4 -1
@@ -2,7 +2,7 @@/* * Turris Mox rWTM firmware driver * -* Copyright (C) 2019 Marek Behún <[email protected]> +* Copyright (C) 2019, 2024 Marek Behún <[email protected]> */ #include <linux/armada-37xx-rwtm-mailbox.h>
@@ -174,6 +174,9 @@ static void mox_rwtm_rx_callback(struct mbox_client *cl, void *data)struct mox_rwtm *rwtm =dev_get_drvdata (cl->dev);struct armada_37xx_rwtm_rx_msg *msg = data; +if (completion_done (&rwtm->cmd_done)) +return ; + rwtm->reply = *msg;complete (&rwtm->cmd_done); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/484 firmware: turris-mox-rwtm: Fix checking return value of wait_for_completion_timeout()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Behún <[email protected]>
[ Upstream commit 8467cfe821ac3526f7598682ad5f90689fa8cc49 ]
The wait_for_completion_timeout() function returns 0 if timed out, and a positive value if completed. Fix the usage of this function.
--- drivers/firmware/turris-mox-rwtm.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
drivers/firmware/turris-mox-rwtm.c +6 -9
@@ -202,9 +202,8 @@ static int mox_get_board_info(struct mox_rwtm *rwtm)if (ret <0 )return ret; - ret =wait_for_completion_timeout (&rwtm->cmd_done,HZ /2 ); -if (ret <0 ) -return ret; +if (!wait_for_completion_timeout (&rwtm->cmd_done,HZ /2 )) +return -ETIMEDOUT ; ret =mox_get_status (MBOX_CMD_BOARD_INFO , reply->retval);if (ret == -ENODATA ) {
@@ -238,9 +237,8 @@ static int mox_get_board_info(struct mox_rwtm *rwtm)if (ret <0 )return ret; - ret =wait_for_completion_timeout (&rwtm->cmd_done,HZ /2 ); -if (ret <0 ) -return ret; +if (!wait_for_completion_timeout (&rwtm->cmd_done,HZ /2 )) +return -ETIMEDOUT ; ret =mox_get_status (MBOX_CMD_ECDSA_PUB_KEY , reply->retval);if (ret == -ENODATA ) {
@@ -277,9 +275,8 @@ static int check_get_random_support(struct mox_rwtm *rwtm)if (ret <0 )return ret; - ret =wait_for_completion_timeout (&rwtm->cmd_done,HZ /2 ); -if (ret <0 ) -return ret; +if (!wait_for_completion_timeout (&rwtm->cmd_done,HZ /2 )) +return -ETIMEDOUT ;return mox_get_status (MBOX_CMD_GET_RANDOM , rwtm->reply.retval); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/484 firmware: turris-mox-rwtm: Initialize completion before mailbox
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Behún <[email protected]>
[ Upstream commit 49e24c80d3c81c43e2a56101449e1eea32fcf292 ]
Initialize the completion before the mailbox channel is requested.
--- drivers/firmware/turris-mox-rwtm.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/firmware/turris-mox-rwtm.c +1 -2
@@ -499,6 +499,7 @@ static int turris_mox_rwtm_probe(struct platform_device *pdev)platform_set_drvdata (pdev, rwtm);mutex_init (&rwtm->busy); +init_completion (&rwtm->cmd_done); rwtm->mbox_client.dev = dev; rwtm->mbox_client.rx_callback = mox_rwtm_rx_callback;
@@ -512,8 +513,6 @@ static int turris_mox_rwtm_probe(struct platform_device *pdev) goto remove_files; } -init_completion (&rwtm->cmd_done); - ret =mox_get_board_info (rwtm);if (ret <0 )dev_warn (dev,"Cannot read board information: %i\n" , ret);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/484 wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samasth Norway Ananda <[email protected]>
[ Upstream commit c636fa85feb450ca414a10010ed05361a73c93a6 ]
The band_idx variable in the function wlc_lcnphy_tx_iqlo_cal() will never be set to 1 as BCM4313 is the only device for which the LCN PHY code is used. This is a 2G-only device.
--- .../broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c +9 -9
@@ -2567,7 +2567,6 @@ wlc_lcnphy_tx_iqlo_cal(struct brcms_phy *pi,struct lcnphy_txgains cal_gains, temp_gains;u16 hash; -u8 band_idx;int j;u16 ncorr_override[5 ];u16 syst_coeffs[] = {0x0000 ,0x0000 ,0x0000 ,0x0000 ,0x0000 ,0x0000 ,
@@ -2599,6 +2598,9 @@ wlc_lcnphy_tx_iqlo_cal(struct brcms_phy *pi,u16 *values_to_save;struct brcms_phy_lcnphy *pi_lcn = pi->u.pi_lcnphy; +if (WARN_ON (CHSPEC_IS5G (pi->radio_chanspec))) +return ; + values_to_save =kmalloc_array (20 ,sizeof (u16),GFP_ATOMIC );if (NULL == values_to_save)return ;
@@ -2662,20 +2664,18 @@ wlc_lcnphy_tx_iqlo_cal(struct brcms_phy *pi, hash = (target_gains->gm_gain <<8 ) | (target_gains->pga_gain <<4 ) | (target_gains->pad_gain); - band_idx = (CHSPEC_IS5G (pi->radio_chanspec) ?1 :0 ); - cal_gains = *target_gains;memset (ncorr_override,0 ,sizeof (ncorr_override)); -for (j =0 ; j < iqcal_gainparams_numgains_lcnphy[band_idx]; j++) { -if (hash == tbl_iqcal_gainparams_lcnphy[band_idx][j][0 ]) { +for (j =0 ; j < iqcal_gainparams_numgains_lcnphy[0 ]; j++) { +if (hash == tbl_iqcal_gainparams_lcnphy[0 ][j][0 ]) { cal_gains.gm_gain = - tbl_iqcal_gainparams_lcnphy[band_idx][j][1 ]; + tbl_iqcal_gainparams_lcnphy[0 ][j][1 ]; cal_gains.pga_gain = - tbl_iqcal_gainparams_lcnphy[band_idx][j][2 ]; + tbl_iqcal_gainparams_lcnphy[0 ][j][2 ]; cal_gains.pad_gain = - tbl_iqcal_gainparams_lcnphy[band_idx][j][3 ]; + tbl_iqcal_gainparams_lcnphy[0 ][j][3 ];memcpy (ncorr_override, - &tbl_iqcal_gainparams_lcnphy[band_idx][j][3 ], + &tbl_iqcal_gainparams_lcnphy[0 ][j][3 ],sizeof (ncorr_override));break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/484 selftests/bpf: Fix prog numbers in test_sockmap
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
[ Upstream commit 6c8d7598dfed759bf1d9d0322b4c2b42eb7252d8 ]
bpf_prog5 and bpf_prog7 are removed from progs/test_sockmap_kern.h in commit d79a32129b21 ("bpf: Selftests, remove prints from sockmap tests"), now there are only 9 progs in it, not 11:
SEC("sk_skb1")
int bpf_prog1(struct __sk_buff *skb)
SEC("sk_skb2")
int bpf_prog2(struct __sk_buff *skb)
SEC("sk_skb3")
int bpf_prog3(struct __sk_buff *skb)
SEC("sockops")
int bpf_sockmap(struct bpf_sock_ops *skops)
SEC("sk_msg1")
int bpf_prog4(struct sk_msg_md *msg)
SEC("sk_msg2")
int bpf_prog6(struct sk_msg_md *msg)
SEC("sk_msg3")
int bpf_prog8(struct sk_msg_md *msg)
SEC("sk_msg4")
int bpf_prog9(struct sk_msg_md *msg)
SEC("sk_msg5")
int bpf_prog10(struct sk_msg_md *msg)This patch updates the array sizes of prog_fd[], prog_attach_type[] and prog_type[] from 11 to 9 accordingly.
--- tools/testing/selftests/bpf/test_sockmap.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
tools/testing/selftests/bpf/test_sockmap.c +1 -5
@@ -65,7 +65,7 @@ int passed;int failed;int map_fd[9 ];struct bpf_map *maps[9 ]; -int prog_fd[11 ]; +int prog_fd[9 ];int txmsg_pass;int txmsg_redir;
@@ -1708,8 +1708,6 @@ int prog_attach_type[] = {BPF_SK_MSG_VERDICT ,BPF_SK_MSG_VERDICT , BPF_SK_MSG_VERDICT, -BPF_SK_MSG_VERDICT , - BPF_SK_MSG_VERDICT, }; int prog_type[] = {
@@ -1722,8 +1720,6 @@ int prog_type[] = {BPF_PROG_TYPE_SK_MSG ,BPF_PROG_TYPE_SK_MSG , BPF_PROG_TYPE_SK_MSG, -BPF_PROG_TYPE_SK_MSG , - BPF_PROG_TYPE_SK_MSG, };static int populate_progs (char *bpf_file)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/484 net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hagar Hemdan <[email protected]>
[ Upstream commit 96f887a612e4cda89efc3f54bc10c1997e3ab0e9 ]
xmit() functions should consume skb or return error codes in error paths.
When the configuration "CONFIG_INET_ESPINTCP" is not set, the implementation of the function "esp_output_tail_tcp" violates this rule. The function frees the skb and returns the error code.
This change removes the kfree_skb from both functions, for both esp4 and esp6.WARN_ON is added because esp_output_tail_tcp() should never be called if CONFIG_INET_ESPINTCP is not set.
This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc.
--- net/ipv4/esp4.c | 3 +-- net/ipv6/esp6.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-)
net/ipv4/esp4.c +1 -2
@@ -237,8 +237,7 @@ static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb)#else static int esp_output_tail_tcp (struct xfrm_state *x,struct sk_buff *skb) { -kfree_skb (skb); - +WARN_ON (1 );return -EOPNOTSUPP ; }#endif
net/ipv6/esp6.c +1 -2
@@ -255,8 +255,7 @@ static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb)#else static int esp_output_tail_tcp (struct xfrm_state *x,struct sk_buff *skb) { -kfree_skb (skb); - +WARN_ON (1 );return -EOPNOTSUPP ; }#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/484 tcp: annotate lockless accesses to sk->sk_err_soft
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit cee1af825d65b8122627fc2efbc36c1bd51ee103 ]
This field can be read/written without lock synchronization.
Stable-dep-of: 853c3bd7b791 ("tcp: fix race in tcp_write_err()")
--- net/ipv4/tcp_input.c | 2 +- net/ipv4/tcp_ipv4.c | 6 +++--- net/ipv4/tcp_timer.c | 6 +++--- net/ipv6/tcp_ipv6.c | 11 ++++++----- 4 files changed, 13 insertions(+), 12 deletions(-)
net/ipv4/tcp_input.c +1 -1
@@ -3915,7 +3915,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)/* We passed data and got it acked, remove any soft error * log. Something worked... */ - sk->sk_err_soft =0 ; +WRITE_ONCE (sk->sk_err_soft,0 ); icsk->icsk_probes_out =0 ; tp->rcv_tstamp = tcp_jiffies32;if (!prior_packets)
net/ipv4/tcp_ipv4.c +3 -3
@@ -361,7 +361,7 @@ void tcp_v4_mtu_reduced(struct sock *sk)* for the case, if this connection will not able to recover. */ if (mtu <dst_mtu (dst) &&ip_dont_fragment (sk, dst)) - sk->sk_err_soft =EMSGSIZE ; +WRITE_ONCE (sk->sk_err_soft,EMSGSIZE ); mtu =dst_mtu (dst);
@@ -599,7 +599,7 @@ int tcp_v4_err(struct sk_buff *skb, u32 info)tcp_done (sk); }else { - sk->sk_err_soft = err; +WRITE_ONCE (sk->sk_err_soft, err); } goto out; }
@@ -625,7 +625,7 @@ int tcp_v4_err(struct sk_buff *skb, u32 info) sk->sk_err = err;sk_error_report (sk); }else {/* Only an error on timeout */ - sk->sk_err_soft = err; +WRITE_ONCE (sk->sk_err_soft, err); } out:
net/ipv4/tcp_timer.c +3 -3
@@ -67,7 +67,7 @@ u32 tcp_clamp_probe0_to_user_timeout(const struct sock *sk, u32 when)static void tcp_write_err (struct sock *sk) { - sk->sk_err = sk->sk_err_soft ? :ETIMEDOUT ; + sk->sk_err =READ_ONCE (sk->sk_err_soft) ? :ETIMEDOUT ;sk_error_report (sk);tcp_write_queue_purge (sk);
@@ -110,7 +110,7 @@ static int tcp_out_of_resources(struct sock *sk, bool do_reset) shift++;/* If some dubious ICMP arrived, penalize even more. */ -if (sk->sk_err_soft) +if (READ_ONCE (sk->sk_err_soft)) shift++;if (tcp_check_oom (sk, shift)) {
@@ -146,7 +146,7 @@ static int tcp_orphan_retries(struct sock *sk, bool alive)int retries =READ_ONCE (sock_net (sk)->ipv4.sysctl_tcp_orphan_retries);/* May be zero. */ /* We know from an ICMP that something is wrong. */ -if (sk->sk_err_soft && !alive) +if (READ_ONCE (sk->sk_err_soft) && !alive) retries =0 ;/* However, if socket sent something recently, select some safe
net/ipv6/tcp_ipv6.c +6 -5
@@ -490,8 +490,9 @@ static int tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,sk_error_report (sk);/* Wake people up to see the error (see connect in sock.c) */ tcp_done (sk); - }else - sk->sk_err_soft = err; + }else { +WRITE_ONCE (sk->sk_err_soft, err); + } goto out;case TCP_LISTEN :break ;
@@ -507,9 +508,9 @@ static int tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,if (!sock_owned_by_user (sk) && np->recverr) { sk->sk_err = err;sk_error_report (sk); - }else - sk->sk_err_soft = err; - + }else { +WRITE_ONCE (sk->sk_err_soft, err); + } out:bh_unlock_sock (sk);sock_put (sk);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/484 tcp: annotate lockless access to sk->sk_err
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit e13ec3da05d130f0d10da8e1fbe1be26dcdb0e27 ]
tcp_poll() reads sk->sk_err without socket lock held/owned.
We should used READ_ONCE() here, and update writers to use WRITE_ONCE().
Stable-dep-of: 853c3bd7b791 ("tcp: fix race in tcp_write_err()")
--- net/ipv4/tcp.c | 11 ++++++----- net/ipv4/tcp_input.c | 6 +++--- net/ipv4/tcp_ipv4.c | 4 ++-- net/ipv4/tcp_output.c | 2 +- net/ipv4/tcp_timer.c | 2 +- net/ipv6/tcp_ipv6.c | 4 ++-- 6 files changed, 15 insertions(+), 14 deletions(-)
net/ipv4/tcp.c +6 -5
@@ -594,7 +594,8 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait) }/* This barrier is coupled with smp_wmb() in tcp_reset() */ smp_rmb (); -if (sk->sk_err || !skb_queue_empty_lockless (&sk->sk_error_queue)) +if (READ_ONCE (sk->sk_err) || + !skb_queue_empty_lockless (&sk->sk_error_queue)) mask |=EPOLLERR ;return mask;
@@ -2995,7 +2996,7 @@ int tcp_disconnect(struct sock *sk, int flags)if (old_state ==TCP_LISTEN ) {inet_csk_listen_stop (sk); }else if (unlikely (tp->repair)) { - sk->sk_err =ECONNABORTED ; +WRITE_ONCE (sk->sk_err,ECONNABORTED ); }else if (tcp_need_reset (old_state) || (tp->snd_nxt != tp->write_seq && (1 << old_state) & (TCPF_CLOSING |TCPF_LAST_ACK ))) {
@@ -3003,9 +3004,9 @@ int tcp_disconnect(struct sock *sk, int flags)* states */ tcp_send_active_reset (sk,gfp_any ()); - sk->sk_err =ECONNRESET ; +WRITE_ONCE (sk->sk_err,ECONNRESET ); }else if (old_state ==TCP_SYN_SENT ) - sk->sk_err =ECONNRESET ; +WRITE_ONCE (sk->sk_err,ECONNRESET );tcp_clear_xmit_timers (sk);__skb_queue_purge (&sk->sk_receive_queue);
@@ -4513,7 +4514,7 @@ int tcp_abort(struct sock *sk, int err)bh_lock_sock (sk);if (!sock_flag (sk,SOCK_DEAD )) { - sk->sk_err = err; +WRITE_ONCE (sk->sk_err, err);/* This barrier is coupled with smp_rmb() in tcp_poll() */ smp_wmb ();sk_error_report (sk);
net/ipv4/tcp_input.c +3 -3
@@ -4362,15 +4362,15 @@ void tcp_reset(struct sock *sk, struct sk_buff *skb)/* We want the right error as BSD sees it (and indeed as we do). */ switch (sk->sk_state) {case TCP_SYN_SENT : - sk->sk_err =ECONNREFUSED ; +WRITE_ONCE (sk->sk_err,ECONNREFUSED );break ;case TCP_CLOSE_WAIT : - sk->sk_err =EPIPE ; +WRITE_ONCE (sk->sk_err,EPIPE );break ;case TCP_CLOSE :return ;default : - sk->sk_err =ECONNRESET ; +WRITE_ONCE (sk->sk_err,ECONNRESET ); }/* This barrier is coupled with smp_rmb() in tcp_poll() */ smp_wmb ();
net/ipv4/tcp_ipv4.c +2 -2
@@ -593,7 +593,7 @@ int tcp_v4_err(struct sk_buff *skb, u32 info)ip_icmp_error (sk, skb, err, th->dest, info, (u8 *)th);if (!sock_owned_by_user (sk)) { - sk->sk_err = err; +WRITE_ONCE (sk->sk_err, err);sk_error_report (sk);
@@ -622,7 +622,7 @@ int tcp_v4_err(struct sk_buff *skb, u32 info) inet =inet_sk (sk);if (!sock_owned_by_user (sk) && inet->recverr) { - sk->sk_err = err; +WRITE_ONCE (sk->sk_err, err);sk_error_report (sk); }else {/* Only an error on timeout */ WRITE_ONCE (sk->sk_err_soft, err);
net/ipv4/tcp_output.c +1 -1
@@ -3724,7 +3724,7 @@ static void tcp_connect_init(struct sock *sk) tp->rx_opt.rcv_wscale = rcv_wscale; tp->rcv_ssthresh = tp->rcv_wnd; - sk->sk_err =0 ; +WRITE_ONCE (sk->sk_err,0 );sock_reset_flag (sk,SOCK_DONE ); tp->snd_wnd =0 ;tcp_init_wl (tp,0 );
net/ipv4/tcp_timer.c +1 -1
@@ -67,7 +67,7 @@ u32 tcp_clamp_probe0_to_user_timeout(const struct sock *sk, u32 when)static void tcp_write_err (struct sock *sk) { - sk->sk_err =READ_ONCE (sk->sk_err_soft) ? :ETIMEDOUT ; +WRITE_ONCE (sk->sk_err,READ_ONCE (sk->sk_err_soft) ? :ETIMEDOUT );sk_error_report (sk);tcp_write_queue_purge (sk);
net/ipv6/tcp_ipv6.c +2 -2
@@ -486,7 +486,7 @@ static int tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,ipv6_icmp_error (sk, skb, err, th->dest,ntohl (info), (u8 *)th);if (!sock_owned_by_user (sk)) { - sk->sk_err = err; +WRITE_ONCE (sk->sk_err, err);sk_error_report (sk);/* Wake people up to see the error (see connect in sock.c) */ tcp_done (sk);
@@ -506,7 +506,7 @@ static int tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, }if (!sock_owned_by_user (sk) && np->recverr) { - sk->sk_err = err; +WRITE_ONCE (sk->sk_err, err);sk_error_report (sk); }else {WRITE_ONCE (sk->sk_err_soft, err);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/484 tcp: add tcp_done_with_error() helper
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 5e514f1cba090e1c8fff03e92a175eccfe46305f ]
tcp_reset() ends with a sequence that is carefuly ordered.
We need to fix [e]poll bugs in the following patches, it makes sense to use a common helper.
Stable-dep-of: 853c3bd7b791 ("tcp: fix race in tcp_write_err()")
--- include/net/tcp.h | 1 + net/ipv4/tcp.c | 2 +- net/ipv4/tcp_input.c | 32 +++++++++++++++++++++----------- 3 files changed, 23 insertions(+), 12 deletions(-)
include/net/tcp.h +1 -0
@@ -612,6 +612,7 @@ void tcp_skb_collapse_tstamp(struct sk_buff *skb,/* tcp_input.c */ void tcp_rearm_rto (struct sock *sk);void tcp_synack_rtt_meas (struct sock *sk,struct request_sock *req); +void tcp_done_with_error (struct sock *sk,int err);void tcp_reset (struct sock *sk,struct sk_buff *skb);void tcp_skb_mark_lost_uncond_verify (struct tcp_sock *tp,struct sk_buff *skb);void tcp_fin (struct sock *sk);
net/ipv4/tcp.c +1 -1
@@ -592,7 +592,7 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait)*/ mask |=EPOLLOUT |EPOLLWRNORM ; } -/* This barrier is coupled with smp_wmb() in tcp_reset() */ +/* This barrier is coupled with smp_wmb() in tcp_done_with_error() */ smp_rmb ();if (READ_ONCE (sk->sk_err) || !skb_queue_empty_lockless (&sk->sk_error_queue))
net/ipv4/tcp_input.c +21 -11
@@ -4348,9 +4348,26 @@ static inline bool tcp_sequence(const struct tcp_sock *tp, u32 seq, u32 end_seq) !after (seq, tp->rcv_nxt +tcp_receive_window (tp)); } + +void tcp_done_with_error (struct sock *sk,int err) +{ +/* This barrier is coupled with smp_rmb() in tcp_poll() */ +WRITE_ONCE (sk->sk_err, err); +smp_wmb (); + +tcp_write_queue_purge (sk); +tcp_done (sk); + +if (!sock_flag (sk,SOCK_DEAD )) +sk_error_report (sk); +} +EXPORT_SYMBOL (tcp_done_with_error); +/* When we get a reset we do this. */ void tcp_reset (struct sock *sk,struct sk_buff *skb) { +int err; +trace_tcp_receive_reset (sk);/* mptcp can't tell us to ignore reset pkts,
@@ -4362,24 +4379,17 @@ void tcp_reset(struct sock *sk, struct sk_buff *skb)/* We want the right error as BSD sees it (and indeed as we do). */ switch (sk->sk_state) {case TCP_SYN_SENT : -WRITE_ONCE (sk->sk_err,ECONNREFUSED ); + err =ECONNREFUSED ;break ;case TCP_CLOSE_WAIT : -WRITE_ONCE (sk->sk_err,EPIPE ); + err =EPIPE ;break ;case TCP_CLOSE :return ;default : -WRITE_ONCE (sk->sk_err,ECONNRESET ); + err =ECONNRESET ; } -/* This barrier is coupled with smp_rmb() in tcp_poll() */ -smp_wmb (); - -tcp_write_queue_purge (sk); -tcp_done (sk); - -if (!sock_flag (sk,SOCK_DEAD )) -sk_error_report (sk); +tcp_done_with_error (sk, err); }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/484 tcp: fix race in tcp_write_err()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 853c3bd7b7917670224c9fe5245bd045cac411dd ]
I noticed flakes in a packetdrill test, expecting an epoll_wait() to return EPOLLERR | EPOLLHUP on a failed connect() attempt, after multiple SYN retransmits. It sometimes return EPOLLERR only.
The issue is that tcp_write_err():
1) writes an error in sk->sk_err,
2) calls sk_error_report(),
3) then calls tcp_done().
tcp_done() is writing SHUTDOWN_MASK into sk->sk_shutdown, among other things.
Problem is that the awaken user thread (from 2) sk_error_report()) might call tcp_poll() before tcp_done() has written sk->sk_shutdown.
tcp_poll() only sees a non zero sk->sk_err and returns EPOLLERR.
This patch fixes the issue by making sure to call sk_error_report() after tcp_done().
tcp_write_err() also lacks an smp_wmb().
We can reuse tcp_done_with_error() to factor out the details, as Neal suggested.
--- net/ipv4/tcp_timer.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
net/ipv4/tcp_timer.c +1 -5
@@ -67,11 +67,7 @@ u32 tcp_clamp_probe0_to_user_timeout(const struct sock *sk, u32 when)static void tcp_write_err (struct sock *sk) { -WRITE_ONCE (sk->sk_err,READ_ONCE (sk->sk_err_soft) ? :ETIMEDOUT ); -sk_error_report (sk); - -tcp_write_queue_purge (sk); -tcp_done (sk); +tcp_done_with_error (sk,READ_ONCE (sk->sk_err_soft) ? :ETIMEDOUT );__NET_INC_STATS (sock_net (sk),LINUX_MIB_TCPABORTONTIMEOUT ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/484 tcp: fix races in tcp_v[46]_err()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit fde6f897f2a184546bf5516ac736523ef24dc6a7 ]
These functions have races when they:
1) Write sk->sk_err
2) call sk_error_report(sk)
3) call tcp_done(sk)
As described in prior patches in this series:
An smp_wmb() is missing.
We should call tcp_done() before sk_error_report(sk) to have consistent tcp_poll() results on SMP hosts.
Use tcp_done_with_error() where we centralized the correct sequence.
--- net/ipv4/tcp_ipv4.c | 11 +++-------- net/ipv6/tcp_ipv6.c | 10 +++------- 2 files changed, 6 insertions(+), 15 deletions(-)
net/ipv4/tcp_ipv4.c +3 -8
@@ -592,15 +592,10 @@ int tcp_v4_err(struct sk_buff *skb, u32 info)ip_icmp_error (sk, skb, err, th->dest, info, (u8 *)th); -if (!sock_owned_by_user (sk)) { -WRITE_ONCE (sk->sk_err, err); - -sk_error_report (sk); - -tcp_done (sk); - }else { +if (!sock_owned_by_user (sk)) +tcp_done_with_error (sk, err); +else WRITE_ONCE (sk->sk_err_soft, err); - } goto out; }
net/ipv6/tcp_ipv6.c +3 -7
@@ -485,14 +485,10 @@ static int tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,ipv6_icmp_error (sk, skb, err, th->dest,ntohl (info), (u8 *)th); -if (!sock_owned_by_user (sk)) { -WRITE_ONCE (sk->sk_err, err); -sk_error_report (sk);/* Wake people up to see the error (see connect in sock.c) */ - -tcp_done (sk); - }else { +if (!sock_owned_by_user (sk)) +tcp_done_with_error (sk, err); +else WRITE_ONCE (sk->sk_err_soft, err); - } goto out;case TCP_LISTEN :break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/484 net/smc: set rmbs SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangguan Wang <[email protected]>
[ Upstream commit 3ac14b9dfbd345e891d48d89f6c2fa519848f0f4 ]
SG_MAX_SINGLE_ALLOC is used to limit maximum number of entries that will be allocated in one piece of scatterlist. When the entries of scatterlist exceeds SG_MAX_SINGLE_ALLOC, sg chain will be used. From commit 7c703e54cc71 ("arch: switch the default on ARCH_HAS_SG_CHAIN"), we can know that the macro CONFIG_ARCH_NO_SG_CHAIN is used to identify whether sg chain is supported. So, SMC-R's rmb buffer should be limited by SG_MAX_SINGLE_ALLOC only when the macro CONFIG_ARCH_NO_SG_CHAIN is defined.
--- net/smc/smc_core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/smc/smc_core.c +3 -2
@@ -1772,7 +1772,6 @@ int smc_conn_create(struct smc_sock *smc, struct smc_init_info *ini)*/ static u8 smc_compress_bufsize (int size,bool is_smcd,bool is_rmb) { -const unsigned int max_scat =SG_MAX_SINGLE_ALLOC *PAGE_SIZE ;u8 compressed;if (size <=SMC_BUF_MIN_SIZE )
@@ -1782,9 +1781,11 @@ static u8 smc_compress_bufsize(int size, bool is_smcd, bool is_rmb) compressed =min_t (u8,ilog2 (size) +1 , is_smcd ?SMCD_DMBE_SIZES :SMCR_RMBE_SIZES ); +#ifdef CONFIG_ARCH_NO_SG_CHAIN if (!is_smcd && is_rmb)/* RMBs are backed by & limited to max size of scatterlists */ - compressed =min_t (u8, compressed,ilog2 (max_scat >>14 )); + compressed =min_t (u8, compressed,ilog2 ((SG_MAX_SINGLE_ALLOC *PAGE_SIZE ) >>14 )); +#endif return compressed; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/484 selftests/bpf: Check length of recv in test_sockmap
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
[ Upstream commit de1b5ea789dc28066cc8dc634b6825bd6148f38b ]
The value of recv in msg_loop may be negative, like EWOULDBLOCK, so it's necessary to check if it is positive before accumulating it to bytes_recvd.
--- tools/testing/selftests/bpf/test_sockmap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/bpf/test_sockmap.c +2 -1
@@ -663,7 +663,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, } } - s->bytes_recvd += recv; +if (recv >0 ) + s->bytes_recvd += recv;if (data) { int chunk_sz = opt->sendpage ?
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/484 lib: objagg: Fix general protection fault
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit b4a3a89fffcdf09702b1f161b914e52abca1894d ]
The library supports aggregation of objects into other objects only if the parent object does not have a parent itself. That is, nesting is not supported.
Aggregation happens in two cases: Without and with hints, where hints are a pre-computed recommendation on how to aggregate the provided objects.
Nesting is not possible in the first case due to a check that prevents it, but in the second case there is no check because the assumption is that nesting cannot happen when creating objects based on hints. The violation of this assumption leads to various warnings and eventually to a general protection fault [1].
Before fixing the root cause, error out when nesting happens and warn.
[1]
general protection fault, probably for non-canonical address 0xdead000000000d90: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 1083 Comm: kworker/1:9 Tainted: G W 6.9.0-rc6-custom-gd9b4f1cca7fb #7 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:mlxsw_sp_acl_erp_bf_insert+0x25/0x80 [...] Call Trace: <TASK> mlxsw_sp_acl_atcam_entry_add+0x256/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK>
--- lib/objagg.c | 3 +++ 1 file changed, 3 insertions(+)
lib/objagg.c +3 -0
@@ -167,6 +167,9 @@ static int objagg_obj_parent_assign(struct objagg *objagg, {void *delta_priv; +if (WARN_ON (!objagg_obj_is_root (parent))) +return -EINVAL ; + delta_priv = objagg->ops->delta_create (objagg->priv, parent->obj, objagg_obj->obj);if (IS_ERR (delta_priv))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/484 mlxsw: spectrum_acl_erp: Fix object nesting warning
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 97d833ceb27dc19f8777d63f90be4a27b5daeedf ]
ACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM (A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former can contain more ACLs (i.e., tc filters), but the number of masks in each region (i.e., tc chain) is limited.
In order to mitigate the effects of the above limitation, the device allows filters to share a single mask if their masks only differ in up to 8 consecutive bits. For example, dst_ip/25 can be represented using dst_ip/24 with a delta of 1 bit. The C-TCAM does not have a limit on the number of masks being used (and therefore does not support mask aggregation), but can contain a limited number of filters.
The driver uses the "objagg" library to perform the mask aggregation by passing it objects that consist of the filter's mask and whether the filter is to be inserted into the A-TCAM or the C-TCAM since filters in different TCAMs cannot share a mask.
The set of created objects is dependent on the insertion order of the filters and is not necessarily optimal. Therefore, the driver will periodically ask the library to compute a more optimal set ("hints") by looking at all the existing objects.
When the library asks the driver whether two objects can be aggregated the driver only compares the provided masks and ignores the A-TCAM / C-TCAM indication. This is the right thing to do since the goal is to move as many filters as possible to the A-TCAM. The driver also forbids two identical masks from being aggregated since this can only happen if one was intentionally put in the C-TCAM to avoid a conflict in the A-TCAM.
The above can result in the following set of hints:
H1: {mask X, A-TCAM} -> H2: {mask Y, A-TCAM} // X is Y + delta
H3: {mask Y, C-TCAM} -> H4: {mask Z, A-TCAM} // Y is Z + delta
After getting the hints from the library the driver will start migrating filters from one region to another while consulting the computed hints and instructing the device to perform a lookup in both regions during the transition.
Assuming a filter with mask X is being migrated into the A-TCAM in the new region, the hints lookup will return H1. Since H2 is the parent of H1, the library will try to find the object associated with it and create it if necessary in which case another hints lookup (recursive) will be performed. This hints lookup for {mask Y, A-TCAM} will either return H2 or H3 since the driver passes the library an object comparison function that ignores the A-TCAM / C-TCAM indication.
This can eventually lead to nested objects which are not supported by the library [1].
Fix by removing the object comparison function from both the driver and the library as the driver was the only user. That way the lookup will only return exact matches.
I do not have a reliable reproducer that can reproduce the issue in a timely manner, but before the fix the issue would reproduce in several minutes and with the fix it does not reproduce in over an hour.
Note that the current usefulness of the hints is limited because they include the C-TCAM indication and represent aggregation that cannot actually happen. This will be addressed in net-next.
[1]
WARNING: CPU: 0 PID: 153 at lib/objagg.c:170 objagg_obj_parent_assign+0xb5/0xd0 Modules linked in: CPU: 0 PID: 153 Comm: kworker/0:18 Not tainted 6.9.0-rc6-custom-g70fbc2c1c38b #42 Hardware name: Mellanox Technologies Ltd. MSN3700C/VMOD0008, BIOS 5.11 10/10/2018 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:objagg_obj_parent_assign+0xb5/0xd0 [...] Call Trace: <TASK> __objagg_obj_get+0x2bb/0x580 objagg_obj_get+0xe/0x80 mlxsw_sp_acl_erp_mask_get+0xb5/0xf0 mlxsw_sp_acl_atcam_entry_add+0xe8/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 process_one_work+0x151/0x370
--- .../ethernet/mellanox/mlxsw/spectrum_acl_erp.c | 13 ------------- include/linux/objagg.h | 1 - lib/objagg.c | 15 --------------- 3 files changed, 29 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c +0 -13
@@ -1217,18 +1217,6 @@ static bool mlxsw_sp_acl_erp_delta_check(void *priv, const void *parent_obj,return err ? false : true; } -static int mlxsw_sp_acl_erp_hints_obj_cmp (const void *obj1,const void *obj2) -{ -const struct mlxsw_sp_acl_erp_key *key1 = obj1; -const struct mlxsw_sp_acl_erp_key *key2 = obj2; - -/* For hints purposes, two objects are considered equal -* in case the masks are the same. Does not matter what -* the "ctcam" value is. -*/ -return memcmp (key1->mask, key2->mask,sizeof (key1->mask)); -} -static void *mlxsw_sp_acl_erp_delta_create (void *priv,void *parent_obj,void *obj) {
@@ -1308,7 +1296,6 @@ static void mlxsw_sp_acl_erp_root_destroy(void *priv, void *root_priv)static const struct objagg_ops mlxsw_sp_acl_erp_objagg_ops = { .obj_size =sizeof (struct mlxsw_sp_acl_erp_key ), .delta_check = mlxsw_sp_acl_erp_delta_check, - .hints_obj_cmp = mlxsw_sp_acl_erp_hints_obj_cmp, .delta_create = mlxsw_sp_acl_erp_delta_create, .delta_destroy = mlxsw_sp_acl_erp_delta_destroy, .root_create = mlxsw_sp_acl_erp_root_create,
include/linux/objagg.h +0 -1
@@ -8,7 +8,6 @@ struct objagg_ops {size_t obj_size;bool (*delta_check)(void *priv,const void *parent_obj,const void *obj); -int (*hints_obj_cmp)(const void *obj1,const void *obj2);void * (*delta_create)(void *priv,void *parent_obj,void *obj);void (*delta_destroy)(void *priv,void *delta_priv);void * (*root_create)(void *priv,void *obj,unsigned int root_id);
lib/objagg.c +0 -15
@@ -909,20 +909,6 @@ static const struct objagg_opt_algo *objagg_opt_algos[] = { [OBJAGG_OPT_ALGO_SIMPLE_GREEDY] = &objagg_opt_simple_greedy, }; -static int objagg_hints_obj_cmp (struct rhashtable_compare_arg *arg, -const void *obj) -{ -struct rhashtable *ht = arg->ht; -struct objagg_hints *objagg_hints = - container_of(ht, struct objagg_hints, node_ht); -const struct objagg_ops *ops = objagg_hints->ops; -const char *ptr = obj; - - ptr += ht->p.key_offset; -return ops->hints_obj_cmp ? ops->hints_obj_cmp (ptr, arg->key) : -memcmp (ptr, arg->key, ht->p.key_len); -} -/** * objagg_hints_get - obtains hints instance * @objagg: objagg instance
@@ -961,7 +947,6 @@ struct objagg_hints *objagg_hints_get(struct objagg *objagg, offsetof(struct objagg_hints_node , obj); objagg_hints->ht_params.head_offset = offsetof(struct objagg_hints_node , ht_node); - objagg_hints->ht_params.obj_cmpfn = objagg_hints_obj_cmp; err =rhashtable_init (&objagg_hints->node_ht, &objagg_hints->ht_params);if (err)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/484 mlxsw: spectrum_acl_bloom_filter: Make mlxsw_sp_acl_bf_key_encode() more flexible
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Cohen <[email protected]>
[ Upstream commit 5d5c3ba9e4121b7738d10be3825f4d9a5a1d80ef ]
Spectrum-4 will calculate hash function for bloom filter differently from the existing ASICs.
One of the changes is related to the way that the chunks will be build - without padding.
As preparation for support of Spectrum-4 bloom filter, make mlxsw_sp_acl_bf_key_encode() more flexible, so it will be able to use it for Spectrum-4 as well.
Stable-dep-of: 75d8d7a63065 ("mlxsw: spectrum_acl: Fix ACL scale regression and firmware errors")
--- .../mlxsw/spectrum_acl_bloom_filter.c | 36 +++++++++++++------ 1 file changed, 25 insertions(+), 11 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c +25 -11
@@ -116,9 +116,10 @@ static u16 mlxsw_sp_acl_bf_crc(const u8 *buffer, size_t len) }static void -mlxsw_sp_acl_bf_key_encode (struct mlxsw_sp_acl_atcam_region *aregion, -struct mlxsw_sp_acl_atcam_entry *aentry, -char *output,u8 *len) +__mlxsw_sp_acl_bf_key_encode (struct mlxsw_sp_acl_atcam_region *aregion, +struct mlxsw_sp_acl_atcam_entry *aentry, +char *output,u8 *len,u8 max_chunks,u8 pad_bytes, +u8 key_offset,u8 chunk_key_len,u8 chunk_len) {struct mlxsw_afk_key_info *key_info = aregion->region->key_info;u8 chunk_index, chunk_count, block_count;
@@ -129,17 +130,30 @@ mlxsw_sp_acl_bf_key_encode(struct mlxsw_sp_acl_atcam_region *aregion, chunk_count =1 + ((block_count -1 ) >>2 ); erp_region_id =cpu_to_be16 (aentry->ht_key.erp_id | (aregion->region->id <<4 )); -for (chunk_index =MLXSW_BLOOM_KEY_CHUNKS - chunk_count; - chunk_index <MLXSW_BLOOM_KEY_CHUNKS ; chunk_index++) { -memset (chunk,0 ,MLXSW_BLOOM_CHUNK_PAD_BYTES ); -memcpy (chunk +MLXSW_BLOOM_CHUNK_PAD_BYTES , &erp_region_id, +for (chunk_index = max_chunks - chunk_count; chunk_index < max_chunks; + chunk_index++) { +memset (chunk,0 , pad_bytes); +memcpy (chunk + pad_bytes, &erp_region_id,sizeof (erp_region_id)); -memcpy (chunk +MLXSW_BLOOM_CHUNK_KEY_OFFSET , +memcpy (chunk + key_offset, &aentry->enc_key[chunk_key_offsets[chunk_index]], -MLXSW_BLOOM_CHUNK_KEY_BYTES ); - chunk +=MLXSW_BLOOM_KEY_CHUNK_BYTES ; + chunk_key_len); + chunk += chunk_len; } - *len = chunk_count *MLXSW_BLOOM_KEY_CHUNK_BYTES ; + *len = chunk_count * chunk_len; +} + +static void +mlxsw_sp_acl_bf_key_encode (struct mlxsw_sp_acl_atcam_region *aregion, +struct mlxsw_sp_acl_atcam_entry *aentry, +char *output,u8 *len) +{ +__mlxsw_sp_acl_bf_key_encode (aregion, aentry, output, len, +MLXSW_BLOOM_KEY_CHUNKS , +MLXSW_BLOOM_CHUNK_PAD_BYTES , +MLXSW_BLOOM_CHUNK_KEY_OFFSET , +MLXSW_BLOOM_CHUNK_KEY_BYTES , +MLXSW_BLOOM_KEY_CHUNK_BYTES ); } static unsigned int
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/484 mlxsw: spectrum_acl: Fix ACL scale regression and firmware errors
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 75d8d7a63065b18df9555dbaab0b42d4c6f20943 ]
ACLs that reside in the algorithmic TCAM (A-TCAM) in Spectrum-2 and newer ASICs can share the same mask if their masks only differ in up to 8 consecutive bits. For example, consider the following filters:
# tc filter add dev swp1 ingress pref 1 proto ip flower dst_ip 192.0.2.0/24 action drop # tc filter add dev swp1 ingress pref 1 proto ip flower dst_ip 198.51.100.128/25 action drop
The second filter can use the same mask as the first (dst_ip/24) with a delta of 1 bit.
However, the above only works because the two filters have different values in the common unmasked part (dst_ip/24). When entries have the same value in the common unmasked part they create undesired collisions in the device since many entries now have the same key. This leads to firmware errors such as [1] and to a reduced scale.
Fix by adjusting the hash table key to only include the value in the common unmasked part. That is, without including the delta bits. That way the driver will detect the collision during filter insertion and spill the filter into the circuit TCAM (C-TCAM).
Add a test case that fails without the fix and adjust existing cases that check C-TCAM spillage according to the above limitation.
[1]mlxsw_spectrum2 0000:06:00.0: EMAD reg access failed (tid=3379b18a00003394,reg_id=3027(ptce3),type=write,status=8(resource not available))
--- .../mellanox/mlxsw/spectrum_acl_atcam.c | 18 +++--- .../mlxsw/spectrum_acl_bloom_filter.c | 2 +- .../mellanox/mlxsw/spectrum_acl_tcam.h | 9 +-- .../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 55 +++++++++++++++++-- 4 files changed, 63 insertions(+), 21 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_atcam.c +8 -10
@@ -391,7 +391,8 @@ mlxsw_sp_acl_atcam_region_entry_insert(struct mlxsw_sp *mlxsw_sp,if (err)return err; - lkey_id = aregion->ops->lkey_id_get (aregion, aentry->enc_key, erp_id); + lkey_id = aregion->ops->lkey_id_get (aregion, aentry->ht_key.enc_key, + erp_id);if (IS_ERR (lkey_id))return PTR_ERR (lkey_id); aentry->lkey_id = lkey_id;
@@ -399,7 +400,7 @@ mlxsw_sp_acl_atcam_region_entry_insert(struct mlxsw_sp *mlxsw_sp, kvdl_index =mlxsw_afa_block_first_kvdl_index (rulei->act_block); mlxsw_reg_ptce3_pack(ptce3_pl, true, MLXSW_REG_PTCE3_OP_WRITE_WRITE, priority, region->tcam_region_info, - aentry->enc_key, erp_id, + aentry->ht_key.enc_key, erp_id, aentry->delta_info.start, aentry->delta_info.mask, aentry->delta_info.value,
@@ -428,7 +429,7 @@ mlxsw_sp_acl_atcam_region_entry_remove(struct mlxsw_sp *mlxsw_sp, mlxsw_reg_ptce3_pack(ptce3_pl, false, MLXSW_REG_PTCE3_OP_WRITE_WRITE, 0, region->tcam_region_info, - aentry->enc_key, erp_id, + aentry->ht_key.enc_key, erp_id, aentry->delta_info.start, aentry->delta_info.mask, aentry->delta_info.value,
@@ -457,7 +458,7 @@ mlxsw_sp_acl_atcam_region_entry_action_replace(struct mlxsw_sp *mlxsw_sp, kvdl_index =mlxsw_afa_block_first_kvdl_index (rulei->act_block); mlxsw_reg_ptce3_pack(ptce3_pl, true, MLXSW_REG_PTCE3_OP_WRITE_UPDATE, priority, region->tcam_region_info, - aentry->enc_key, erp_id, + aentry->ht_key.enc_key, erp_id, aentry->delta_info.start, aentry->delta_info.mask, aentry->delta_info.value,
@@ -480,15 +481,13 @@ __mlxsw_sp_acl_atcam_entry_add(struct mlxsw_sp *mlxsw_sp,int err;mlxsw_afk_encode (afk, region->key_info, &rulei->values, - aentry->ht_key.full_enc_key, mask); + aentry->ht_key.enc_key, mask); erp_mask =mlxsw_sp_acl_erp_mask_get (aregion, mask, false);if (IS_ERR (erp_mask))return PTR_ERR (erp_mask); aentry->erp_mask = erp_mask; aentry->ht_key.erp_id =mlxsw_sp_acl_erp_mask_erp_id (erp_mask); -memcpy (aentry->enc_key, aentry->ht_key.full_enc_key, -sizeof (aentry->enc_key));/* Compute all needed delta information and clear the delta bits * from the encrypted key.
@@ -497,9 +496,8 @@ __mlxsw_sp_acl_atcam_entry_add(struct mlxsw_sp *mlxsw_sp, aentry->delta_info.start =mlxsw_sp_acl_erp_delta_start (delta); aentry->delta_info.mask =mlxsw_sp_acl_erp_delta_mask (delta); aentry->delta_info.value = -mlxsw_sp_acl_erp_delta_value (delta, - aentry->ht_key.full_enc_key); -mlxsw_sp_acl_erp_delta_clear (delta, aentry->enc_key); +mlxsw_sp_acl_erp_delta_value (delta, aentry->ht_key.enc_key); +mlxsw_sp_acl_erp_delta_clear (delta, aentry->ht_key.enc_key);/* Add rule to the list of A-TCAM rules, assuming this * rule is intended to A-TCAM. In case this rule does
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c +1 -1
@@ -136,7 +136,7 @@ __mlxsw_sp_acl_bf_key_encode(struct mlxsw_sp_acl_atcam_region *aregion,memcpy (chunk + pad_bytes, &erp_region_id,sizeof (erp_region_id));memcpy (chunk + key_offset, - &aentry->enc_key[chunk_key_offsets[chunk_index]], + &aentry->ht_key.enc_key[chunk_key_offsets[chunk_index]], chunk_key_len); chunk += chunk_len; }
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.h +3 -6
@@ -171,9 +171,9 @@ struct mlxsw_sp_acl_atcam_region { };struct mlxsw_sp_acl_atcam_entry_ht_key { -char full_enc_key[MLXSW_REG_PTCEX_FLEX_KEY_BLOCKS_LEN ];/* Encoded -* key. -*/ +char enc_key[MLXSW_REG_PTCEX_FLEX_KEY_BLOCKS_LEN ];/* Encoded key, minus +* delta bits. +*/ u8 erp_id; };
@@ -185,9 +185,6 @@ struct mlxsw_sp_acl_atcam_entry {struct rhash_head ht_node;struct list_head list;/* Member in entries_list */ struct mlxsw_sp_acl_atcam_entry_ht_key ht_key; -char enc_key[MLXSW_REG_PTCEX_FLEX_KEY_BLOCKS_LEN ];/* Encoded key, -* minus delta bits. -*/ struct {u16 start;u8 mask;
tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh +51 -4
79 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/484 wifi: ath11k: fix wrong handling of CCMP256 and GCMP ciphers
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit d2b0ca38d362ebf16ca79cd7f309d5bb8b581deb ]
Currently for CCMP256, GCMP128 and GCMP256 ciphers, in ath11k_install_key() IEEE80211_KEY_FLAG_GENERATE_IV_MGMT is not set. And in ath11k_mac_mgmt_tx_wmi() a length of IEEE80211_CCMP_MIC_LEN is reserved for all ciphers.
This results in unexpected management frame drop in case either of above 3 ciphers is used. The reason is, without IEEE80211_KEY_FLAG_GENERATE_IV_MGMT set, mac80211 will not generate CCMP/GCMP headers in frame for ath11k. Also MIC length reserved is wrong. Such frame is dropped later by hardware:
ath11k_pci 0000:5a:00.0: mac tx mgmt frame, buf id 0 ath11k_pci 0000:5a:00.0: mgmt tx compl ev pdev_id 1, desc_id 0, status 1
Quoted 1 line
From user point of view, we have observed very low throughput due to this issue:
action frames are all dropped so ADDBA response from DUT never reaches AP. AP can not use aggregation thus throughput is low.
Fix this by setting IEEE80211_KEY_FLAG_GENERATE_IV_MGMT flag and by reserving proper MIC length for those ciphers.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath11k/dp_rx.c | 3 +-- drivers/net/wireless/ath/ath11k/dp_rx.h | 3 +++ drivers/net/wireless/ath/ath11k/mac.c | 15 +++++++++++---- 3 files changed, 15 insertions(+), 6 deletions(-)
drivers/net/wireless/ath/ath11k/dp_rx.c +1 -2
@@ -1861,8 +1861,7 @@ static void ath11k_dp_rx_h_csum_offload(struct ath11k *ar, struct sk_buff *msdu) CHECKSUM_NONE :CHECKSUM_UNNECESSARY ; } -static int ath11k_dp_rx_crypto_mic_len (struct ath11k *ar, -enum hal_encrypt_type enctype) +int ath11k_dp_rx_crypto_mic_len (struct ath11k *ar,enum hal_encrypt_type enctype) {switch (enctype) {case HAL_ENCRYPT_TYPE_OPEN :
drivers/net/wireless/ath/ath11k/dp_rx.h +3 -0
@@ -1,6 +1,7 @@/* SPDX-License-Identifier: BSD-3-Clause-Clear */ /* * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved. +* Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved. */ #ifndef ATH11K_DP_RX_H #define ATH11K_DP_RX_H
@@ -95,4 +96,6 @@ int ath11k_peer_rx_frag_setup(struct ath11k *ar, const u8 *peer_mac, int vdev_idint ath11k_dp_rx_pktlog_start (struct ath11k_base *ab);int ath11k_dp_rx_pktlog_stop (struct ath11k_base *ab,bool stop_timer); +int ath11k_dp_rx_crypto_mic_len (struct ath11k *ar,enum hal_encrypt_type enctype); +#endif /* ATH11K_DP_RX_H */
drivers/net/wireless/ath/ath11k/mac.c +11 -4
@@ -2675,6 +2675,7 @@ static int ath11k_install_key(struct ath11k_vif *arvif,switch (key->cipher) {case WLAN_CIPHER_SUITE_CCMP : +case WLAN_CIPHER_SUITE_CCMP_256 : arg.key_cipher =WMI_CIPHER_AES_CCM ;/* TODO: Re-check if flag is valid */ key->flags |=IEEE80211_KEY_FLAG_GENERATE_IV_MGMT ;
@@ -2684,12 +2685,10 @@ static int ath11k_install_key(struct ath11k_vif *arvif, arg.key_txmic_len =8 ; arg.key_rxmic_len =8 ;break ; -case WLAN_CIPHER_SUITE_CCMP_256 : - arg.key_cipher =WMI_CIPHER_AES_CCM ; -break ;case WLAN_CIPHER_SUITE_GCMP :case WLAN_CIPHER_SUITE_GCMP_256 : arg.key_cipher =WMI_CIPHER_AES_GCM ; + key->flags |=IEEE80211_KEY_FLAG_GENERATE_IV_MGMT ;break ;default :ath11k_warn (ar->ab,"cipher %d is not supported\n" , key->cipher);
@@ -4204,7 +4203,10 @@ static int ath11k_mac_mgmt_tx_wmi(struct ath11k *ar, struct ath11k_vif *arvif, {struct ath11k_base *ab = ar->ab;struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; +struct ath11k_skb_cb *skb_cb =ATH11K_SKB_CB (skb);struct ieee80211_tx_info *info; +enum hal_encrypt_type enctype; +unsigned int mic_len;dma_addr_t paddr;int buf_id;int ret;
@@ -4224,7 +4226,12 @@ static int ath11k_mac_mgmt_tx_wmi(struct ath11k *ar, struct ath11k_vif *arvif, ieee80211_is_deauth(hdr->frame_control) || ieee80211_is_disassoc(hdr->frame_control)) && ieee80211_has_protected(hdr->frame_control)) { -skb_put (skb,IEEE80211_CCMP_MIC_LEN ); +if (!(skb_cb->flags &ATH11K_SKB_CIPHER_SET )) +ath11k_warn (ab,"WMI management tx frame without ATH11K_SKB_CIPHER_SET" ); + + enctype =ath11k_dp_tx_get_encrypt_type (skb_cb->cipher); + mic_len =ath11k_dp_rx_crypto_mic_len (ar, enctype); +skb_put (skb, mic_len); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/484 wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit 9ee0d44f055276fe2802b2f65058e920853f4f99 ]
rates_996 is mistakenly written as rates_969, fix it.
--- net/wireless/util.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/wireless/util.c +2 -2
@@ -1363,7 +1363,7 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate) 5120, /* 0.833333... */ };u32 rates_160M[3 ] = {960777777 ,907400000 ,816666666 }; -u32 rates_969[3 ] = {480388888 ,453700000 ,408333333 }; +u32 rates_996[3 ] = {480388888 ,453700000 ,408333333 };u32 rates_484[3 ] = {229411111 ,216666666 ,195000000 };u32 rates_242[3 ] = {114711111 ,108333333 ,97500000 };u32 rates_106[3 ] = {40000000 ,37777777 ,34000000 };
@@ -1388,7 +1388,7 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate)else if (rate->bw ==RATE_INFO_BW_80 || (rate->bw ==RATE_INFO_BW_HE_RU && rate->he_ru_alloc ==NL80211_RATE_INFO_HE_RU_ALLOC_996 )) - result = rates_969[rate->he_gi]; + result = rates_996[rate->he_gi];else if (rate->bw ==RATE_INFO_BW_40 || (rate->bw ==RATE_INFO_BW_HE_RU && rate->he_ru_alloc ==NL80211_RATE_INFO_HE_RU_ALLOC_484 ))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/484 wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit bcbd771cd5d68c0c52567556097d75f9fc4e7cd6 ]
Currently NL80211_RATE_INFO_HE_RU_ALLOC_2x996 is not handled in cfg80211_calculate_bitrate_he(), leading to below warning:
kernel: invalid HE MCS: bw:6, ru:6
kernel: WARNING: CPU: 0 PID: 2312 at net/wireless/util.c:1501 cfg80211_calculate_bitrate_he+0x22b/0x270 [cfg80211]
Fix it by handling 2x996 RU allocation in the same way as 160 MHz bandwidth.
--- net/wireless/util.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/wireless/util.c +3 -1
@@ -1383,7 +1383,9 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate)if (WARN_ON_ONCE (rate->nss <1 || rate->nss >8 ))return 0 ; -if (rate->bw ==RATE_INFO_BW_160 ) +if (rate->bw ==RATE_INFO_BW_160 || + (rate->bw ==RATE_INFO_BW_HE_RU && + rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_2x996)) result = rates_160M[rate->he_gi]; else if (rate->bw == RATE_INFO_BW_80 || (rate->bw == RATE_INFO_BW_HE_RU &&
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/484 net: fec: Refactor: #define magic constants
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Csókás Bence <[email protected]>
[ Upstream commit ff049886671ccd4e624a30ec464cb20e4c39a313 ]
Add defines for bits of ECR, RCR control registers, TX watermark etc.
Stable-dep-of: c32fe1986f27 ("net: fec: Fix FEC_ECR_EN1588 being cleared on link-down")
--- drivers/net/ethernet/freescale/fec_main.c | 46 +++++++++++++++-------- 1 file changed, 30 insertions(+), 16 deletions(-)
drivers/net/ethernet/freescale/fec_main.c +30 -16
@@ -252,8 +252,8 @@ MODULE_PARM_DESC(macaddr, "FEC Ethernet MAC address");#define PKT_MINBUF_SIZE 64/* FEC receive acceleration */ -#define FEC_RACC_IPDIS (1 << 1) -#define FEC_RACC_PRODIS (1 << 2) +#define FEC_RACC_IPDIS BIT(1) +#define FEC_RACC_PRODIS BIT(2)#define FEC_RACC_SHIFT16 BIT(7)#define FEC_RACC_OPTIONS (FEC_RACC_IPDIS | FEC_RACC_PRODIS)
@@ -285,8 +285,23 @@ MODULE_PARM_DESC(macaddr, "FEC Ethernet MAC address");#define FEC_MMFR_TA (2 << 16)#define FEC_MMFR_DATA (v) (v & 0xffff)/* FEC ECR bits definition */ -#define FEC_ECR_MAGICEN (1 << 2) -#define FEC_ECR_SLEEP (1 << 3) +#define FEC_ECR_RESET BIT(0) +#define FEC_ECR_ETHEREN BIT(1) +#define FEC_ECR_MAGICEN BIT(2) +#define FEC_ECR_SLEEP BIT(3) +#define FEC_ECR_EN1588 BIT(4) +#define FEC_ECR_BYTESWP BIT(8) +/* FEC RCR bits definition */ +#define FEC_RCR_LOOP BIT(0) +#define FEC_RCR_HALFDPX BIT(1) +#define FEC_RCR_MII BIT(2) +#define FEC_RCR_PROMISC BIT(3) +#define FEC_RCR_BC_REJ BIT(4) +#define FEC_RCR_FLOWCTL BIT(5) +#define FEC_RCR_RMII BIT(8) +#define FEC_RCR_10BASET BIT(9) +/* TX WMARK bits */ +#define FEC_TXWMRK_STRFWD BIT(8)#define FEC_MII_TIMEOUT 30000/* us */
@@ -981,7 +996,7 @@ fec_restart(struct net_device *ndev)struct fec_enet_private *fep =netdev_priv (ndev);u32 temp_mac[2 ];u32 rcntl =OPT_FRAME_SIZE |0x04 ; -u32 ecntl =0x2 ;/* ETHEREN */ +u32 ecntl =FEC_ECR_ETHEREN ;/* Whack a reset. We should wait for this. * For i.MX6SX SOC, enet use AXI bus, we use disable MAC
@@ -1059,18 +1074,18 @@ fec_restart(struct net_device *ndev) fep->phy_interface == PHY_INTERFACE_MODE_RGMII_TXID) rcntl |= (1 <<6 ); else if (fep->phy_interface == PHY_INTERFACE_MODE_RMII) - rcntl |= (1 << 8); + rcntl |= FEC_RCR_RMII; else - rcntl &= ~(1 << 8); + rcntl &= ~FEC_RCR_RMII;/* 1G, 100M or 10M */ if (ndev->phydev) {if (ndev->phydev->speed ==SPEED_1000 ) ecntl |= (1 <<5 );else if (ndev->phydev->speed ==SPEED_100 ) - rcntl &= ~(1 <<9 ); + rcntl &= ~FEC_RCR_10BASET ;else - rcntl |= (1 <<9 ); + rcntl |=FEC_RCR_10BASET ; } }else {#ifdef FEC_MIIGSK_ENR
@@ -1129,13 +1144,13 @@ fec_restart(struct net_device *ndev)if (fep->quirks &FEC_QUIRK_ENET_MAC ) {/* enable ENET endian swap */ - ecntl |= (1 <<8 ); + ecntl |=FEC_ECR_BYTESWP ;/* enable ENET store and forward mode */ -writel (1 <<8 , fep->hwp +FEC_X_WMRK ); +writel (FEC_TXWMRK_STRFWD , fep->hwp +FEC_X_WMRK ); }if (fep->bufdesc_ex) - ecntl |= (1 <<4 ); + ecntl |=FEC_ECR_EN1588 ;if (fep->quirks &FEC_QUIRK_DELAYED_CLKS_SUPPORT && fep->rgmii_txc_dly)
@@ -1189,7 +1204,7 @@ static void fec_stop(struct net_device *ndev) {struct fec_enet_private *fep =netdev_priv (ndev); -u32 rmii_mode =readl (fep->hwp +FEC_R_CNTRL ) & (1 <<8 ); +u32 rmii_mode =readl (fep->hwp +FEC_R_CNTRL ) &FEC_RCR_RMII ;u32 val;/* We cannot expect a graceful transmit stop without link !!! */
@@ -1208,7 +1223,7 @@ fec_stop(struct net_device *ndev)if (fep->quirks &FEC_QUIRK_HAS_MULTI_QUEUES ) {writel (0 , fep->hwp +FEC_ECNTRL ); }else { -writel (1 , fep->hwp +FEC_ECNTRL ); +writel (FEC_ECR_RESET , fep->hwp +FEC_ECNTRL );udelay (10 ); }writel (FEC_DEFAULT_IMASK , fep->hwp +FEC_IMASK );
@@ -1224,12 +1239,11 @@ fec_stop(struct net_device *ndev)/* We have to keep ENET enabled to have MII interrupt stay working */ if (fep->quirks &FEC_QUIRK_ENET_MAC && !(fep->wol_flag &FEC_WOL_FLAG_SLEEP_ON )) { -writel (2 , fep->hwp +FEC_ECNTRL ); +writel (FEC_ECR_ETHEREN , fep->hwp +FEC_ECNTRL );writel (rmii_mode, fep->hwp +FEC_R_CNTRL ); } } -static void fec_timeout (struct net_device *ndev,unsigned int txqueue) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/484 net: fec: Fix FEC_ECR_EN1588 being cleared on link-down
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Csókás, Bence <[email protected]>
[ Upstream commit c32fe1986f27cac329767d3497986e306cad1d5e ]
FEC_ECR_EN1588 bit gets cleared after MAC reset in fec_stop(), which makes all 1588 functionality shut down, and all the extended registers disappear, on link-down, making the adapter fall back to compatibility "dumb mode". However, some functionality needs to be retained (e.g. PPS) even without link.
--- drivers/net/ethernet/freescale/fec_main.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/ethernet/freescale/fec_main.c +6 -0
@@ -1242,6 +1242,12 @@ fec_stop(struct net_device *ndev)writel (FEC_ECR_ETHEREN , fep->hwp +FEC_ECNTRL );writel (rmii_mode, fep->hwp +FEC_R_CNTRL ); } + +if (fep->bufdesc_ex) { + val =readl (fep->hwp +FEC_ECNTRL ); + val |=FEC_ECR_EN1588 ; +writel (val, fep->hwp +FEC_ECNTRL ); + } } static void
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/484 libbpf: Checking the btf_type kind when fixing variable offsets
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donglin Peng <[email protected]>
[ Upstream commit cc5083d1f3881624ad2de1f3cbb3a07e152cb254 ]
I encountered an issue when building the test_progs from the repository [1]:
$ pwd /work/Qemu/x86_64/linux-6.10-rc2/tools/testing/selftests/bpf/
$ make test_progs V=1 [...] ./tools/sbin/bpftool gen object ./ip_check_defrag.bpf.linked2.o ./ip_check_defrag.bpf.linked1.o libbpf: failed to find symbol for variable 'bpf_dynptr_slice' in section '.ksyms' Error: failed to link './ip_check_defrag.bpf.linked1.o': No such file or directory (2) [...]
Upon investigation, I discovered that the btf_types referenced in the '.ksyms' section had a kind of BTF_KIND_FUNC instead of BTF_KIND_VAR:
$ bpftool btf dump file ./ip_check_defrag.bpf.linked1.o
[...]
[2] DATASEC '.ksyms' size=0 vlen=2
type_id=16 offset=0 size=0 (FUNC 'bpf_dynptr_from_skb')
type_id=17 offset=0 size=0 (FUNC 'bpf_dynptr_slice')
[...]
[16] FUNC 'bpf_dynptr_from_skb' type_id=82 linkage=extern
[17] FUNC 'bpf_dynptr_slice' type_id=85 linkage=extern
[...]For a detailed analysis, please refer to [2]. We can add a kind checking to fix the issue.
[1] https://github.com/eddyz87/bpf/tree/binsort-btf-dedup
[2] https://lore.kernel.org/all/[email protected]/
--- tools/lib/bpf/linker.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
tools/lib/bpf/linker.c +9 -2
@@ -2193,10 +2193,17 @@ static int linker_fixup_btf(struct src_obj *obj) vi =btf_var_secinfos (t);for (j =0 , m =btf_vlen (t); j < m; j++, vi++) {const struct btf_type *vt =btf__type_by_id (obj->btf, vi->type); -const char *var_name =btf__str_by_offset (obj->btf, vt->name_off); -int var_linkage =btf_var (vt)->linkage; +const char *var_name; +int var_linkage;Elf64_Sym *sym; +/* could be a variable or function */ +if (!btf_is_var (vt)) +continue ; + + var_name =btf__str_by_offset (obj->btf, vt->name_off); + var_linkage =btf_var (vt)->linkage; +/* no need to patch up static or extern vars */ if (var_linkage !=BTF_VAR_GLOBAL_ALLOCATED )continue ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/484 ipvs: Avoid unnecessary calls to skb_is_gso_sctp
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ismael Luceno <[email protected]>
[ Upstream commit 53796b03295cf7ab1fc8600016fa6dfbf4a494a0 ]
In the context of the SCTP SNAT/DNAT handler, these calls can only return true.
--- net/netfilter/ipvs/ip_vs_proto_sctp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/netfilter/ipvs/ip_vs_proto_sctp.c +2 -2
@@ -126,7 +126,7 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,if (sctph->source != cp->vport || payload_csum || skb->ip_summed ==CHECKSUM_PARTIAL ) { sctph->source = cp->vport; -if (!skb_is_gso (skb) || !skb_is_gso_sctp (skb)) +if (!skb_is_gso (skb))sctp_nat_csum (skb, sctph, sctphoff); }else { skb->ip_summed =CHECKSUM_UNNECESSARY ;
@@ -175,7 +175,7 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, (skb->ip_summed == CHECKSUM_PARTIAL && !(skb_dst(skb)->dev->features & NETIF_F_SCTP_CRC))) { sctph->dest = cp->dport; -if (!skb_is_gso (skb) || !skb_is_gso_sctp (skb)) +if (!skb_is_gso (skb))sctp_nat_csum (skb, sctph, sctphoff); } else if (skb->ip_summed != CHECKSUM_PARTIAL) { skb->ip_summed =CHECKSUM_UNNECESSARY ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/484 netfilter: nf_tables: rise cap on SELinux secmark context
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit e29630247be24c3987e2b048f8e152771b32d38b ]
secmark context is artificially limited 256 bytes, rise it to 4Kbytes.
--- include/uapi/linux/netfilter/nf_tables.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/netfilter/nf_tables.h +1 -1
@@ -1320,7 +1320,7 @@ enum nft_secmark_attributes {#define NFTA_SECMARK_MAX (__NFTA_SECMARK_MAX - 1)/* Max security context length */ -#define NFT_SECMARK_CTX_MAXLEN 256 +#define NFT_SECMARK_CTX_MAXLEN 4096/** * enum nft_reject_types - nf_tables reject expression reject types
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/484 perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit 3520b251dcae2b4a27b95cd6f745c54fd658bda5 ]
Currently, perf allocates an array of page pointers which is limited in size by MAX_PAGE_ORDER. That in turn limits the maximum Intel PT buffer size to 2GiB. Should that limitation be lifted, the Intel PT driver can support larger sizes, except for one calculation in pt_topa_entry_for_page(), which is limited to 32-bits.
Fix pt_topa_entry_for_page() address calculation by adding a cast.
--- arch/x86/events/intel/pt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/events/intel/pt.c +1 -1
@@ -973,7 +973,7 @@ pt_topa_entry_for_page(struct pt_buffer *buf, unsigned int pg)* order allocations, there shouldn't be many of these. */ list_for_each_entry (topa, &buf->tables, list) { -if (topa->offset + topa->size > pg <<PAGE_SHIFT ) +if (topa->offset + topa->size > (unsigned long )pg <<PAGE_SHIFT ) goto found; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/484 perf: Fix perf_aux_size() for greater-than 32-bit size
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit 3df94a5b1078dfe2b0c03f027d018800faf44c82 ]
perf_buffer->aux_nr_pages uses a 32-bit type, so a cast is needed to calculate a 64-bit size.
--- kernel/events/internal.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/internal.h +1 -1
@@ -128,7 +128,7 @@ static inline unsigned long perf_data_size(struct perf_buffer *rb)static inline unsigned long perf_aux_size (struct perf_buffer *rb) { -return rb->aux_nr_pages <<PAGE_SHIFT ; +return (unsigned long )rb->aux_nr_pages <<PAGE_SHIFT ; }#define __DEFINE_OUTPUT_COPY_BODY (advance_buf, memcpy_func, ...) \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/484 perf: Prevent passing zero nr_pages to rb_alloc_aux()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit dbc48c8f41c208082cfa95e973560134489e3309 ]
nr_pages is unsigned long but gets passed to rb_alloc_aux() as an int, and is stored as an int.
Only power-of-2 values are accepted, so if nr_pages is a 64_bit value, it will be passed to rb_alloc_aux() as zero.
That is not ideal because:
1. the value is incorrect
2. rb_alloc_aux() is at risk of misbehaving, although it manages to return -ENOMEM in that case, it is a result of passing zero to get_order() even though the get_order() result is documented to be undefined in that case.
Fix by simply validating the maximum supported value in the first place. Use -ENOMEM error code for consistency with the current error code that is returned in that case.
--- kernel/events/core.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/events/core.c +2 -0
@@ -6401,6 +6401,8 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma)return -EINVAL ; nr_pages = vma_size /PAGE_SIZE ; +if (nr_pages >INT_MAX ) +return -ENOMEM ;mutex_lock (&event->mmap_mutex); ret = -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/484 perf: Fix default aux_watermark calculation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit 43deb76b19663a96ec2189d8f4eb9a9dc2d7623f ]
The default aux_watermark is half the AUX area buffer size. In general, on a 64-bit architecture, the AUX area buffer size could be a bigger than fits in a 32-bit type, but the calculation does not allow for that possibility.
However the aux_watermark value is recorded in a u32, so should not be more than U32_MAX either.
Fix by doing the calculation in a correctly sized type, and limiting the result to U32_MAX.
--- kernel/events/ring_buffer.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/events/ring_buffer.c +3 -1
@@ -683,7 +683,9 @@ int rb_alloc_aux(struct perf_buffer *rb, struct perf_event *event,* max_order, to aid PMU drivers in double buffering. */ if (!watermark) - watermark = nr_pages << (PAGE_SHIFT -1 ); + watermark = min_t(unsigned long, +U32_MAX , + (unsigned long )nr_pages << (PAGE_SHIFT -1 ));/* * Use aux_watermark as the basis for chunking to
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/484 wifi: virt_wifi: avoid reporting connection success with wrong SSID
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: En-Wei Wu <[email protected]>
[ Upstream commit b5d14b0c6716fad7f0c94ac6e1d6f60a49f985c7 ]
When user issues a connection with a different SSID than the one virt_wifi has advertised, the __cfg80211_connect_result() will trigger the warning: WARN_ON(bss_not_found).
The issue is because the connection code in virt_wifi does not check the SSID from user space (it only checks the BSSID), and virt_wifi will call cfg80211_connect_result() with WLAN_STATUS_SUCCESS even if the SSID is different from the one virt_wifi has advertised. Eventually cfg80211 won't be able to find the cfg80211_bss and generate the warning.
Fixed it by checking the SSID (from user space) in the connection code.
--- drivers/net/wireless/virt_wifi.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
drivers/net/wireless/virt_wifi.c +16 -3
@@ -136,6 +136,8 @@ static struct ieee80211_supported_band band_5ghz = {/* Assigned at module init. Guaranteed locally-administered and unicast. */ static u8 fake_router_bssid[ETH_ALEN ]__ro_after_init = {}; +#define VIRT_WIFI_SSID "VirtWifi" +static void virt_wifi_inform_bss (struct wiphy *wiphy) {u64 tsf =div_u64 (ktime_get_boottime_ns (),1000 );
@@ -146,8 +148,8 @@ static void virt_wifi_inform_bss(struct wiphy *wiphy)u8 ssid[8 ]; }__packed ssid = { .tag =WLAN_EID_SSID , - .len =8 , - .ssid ="VirtWifi" , + .len =strlen (VIRT_WIFI_SSID ), + .ssid =VIRT_WIFI_SSID , }; informed_bss = cfg80211_inform_bss(wiphy, &channel_5ghz,
@@ -213,6 +215,8 @@ struct virt_wifi_netdev_priv {struct net_device *upperdev;u32 tx_packets;u32 tx_failed; +u32 connect_requested_ssid_len; +u8 connect_requested_ssid[IEEE80211_MAX_SSID_LEN ];u8 connect_requested_bss[ETH_ALEN ];bool is_up;bool is_connected;
@@ -229,6 +233,12 @@ static int virt_wifi_connect(struct wiphy *wiphy, struct net_device *netdev,if (priv->being_deleted || !priv->is_up)return -EBUSY ; +if (!sme->ssid) +return -EINVAL ; + + priv->connect_requested_ssid_len = sme->ssid_len; +memcpy (priv->connect_requested_ssid, sme->ssid, sme->ssid_len); + could_schedule =schedule_delayed_work (&priv->connect,HZ *2 );if (!could_schedule)return -EBUSY ;
@@ -252,12 +262,15 @@ static void virt_wifi_connect_complete(struct work_struct *work) container_of(work, struct virt_wifi_netdev_priv, connect.work);u8 *requested_bss = priv->connect_requested_bss;bool right_addr =ether_addr_equal (requested_bss, fake_router_bssid); +bool right_ssid = priv->connect_requested_ssid_len ==strlen (VIRT_WIFI_SSID ) && + !memcmp (priv->connect_requested_ssid,VIRT_WIFI_SSID , + priv->connect_requested_ssid_len);u16 status =WLAN_STATUS_SUCCESS ;if (is_zero_ether_addr (requested_bss)) requested_bss =NULL ; -if (!priv->is_up || (requested_bss && !right_addr)) +if (!priv->is_up || (requested_bss && !right_addr) || !right_ssid) status =WLAN_STATUS_UNSPECIFIED_FAILURE ;else priv->is_connected = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/484 gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaosheng Cui <[email protected]>
[ Upstream commit a3123341dc358952ce2bf8067fbdfb7eaadf71bb ]
If we fail to call crypto_sync_skcipher_setkey, we should free the memory allocation for cipher, replace err_return with err_free_cipher to free the memory of cipher.
--- net/sunrpc/auth_gss/gss_krb5_keys.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sunrpc/auth_gss/gss_krb5_keys.c +1 -1
@@ -161,7 +161,7 @@ u32 krb5_derive_key(const struct gss_krb5_enctype *gk5e,if (IS_ERR (cipher)) goto err_return;if (crypto_sync_skcipher_setkey (cipher, inkey->data, inkey->len)) - goto err_return; + goto err_free_cipher;/* allocate and set up buffers */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/484 wifi: virt_wifi: dont use strlen() in const context
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 6e909f489191b365364e9d636dec33b5dfd4e5eb ]
Looks like not all compilers allow strlen(constant) as a constant, so don't do that. Instead, revert back to defining the length as the first submission had it.
--- drivers/net/wireless/virt_wifi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/virt_wifi.c +3 -2
@@ -137,6 +137,7 @@ static struct ieee80211_supported_band band_5ghz = {static u8 fake_router_bssid[ETH_ALEN ]__ro_after_init = {};#define VIRT_WIFI_SSID "VirtWifi" +#define VIRT_WIFI_SSID_LEN 8static void virt_wifi_inform_bss (struct wiphy *wiphy) {
@@ -148,7 +149,7 @@ static void virt_wifi_inform_bss(struct wiphy *wiphy)u8 ssid[8 ]; }__packed ssid = { .tag =WLAN_EID_SSID , - .len =strlen (VIRT_WIFI_SSID ), + .len =VIRT_WIFI_SSID_LEN , .ssid =VIRT_WIFI_SSID , };
@@ -262,7 +263,7 @@ static void virt_wifi_connect_complete(struct work_struct *work) container_of(work, struct virt_wifi_netdev_priv, connect.work);u8 *requested_bss = priv->connect_requested_bss;bool right_addr =ether_addr_equal (requested_bss, fake_router_bssid); -bool right_ssid = priv->connect_requested_ssid_len ==strlen (VIRT_WIFI_SSID ) && +bool right_ssid = priv->connect_requested_ssid_len ==VIRT_WIFI_SSID_LEN && !memcmp (priv->connect_requested_ssid,VIRT_WIFI_SSID , priv->connect_requested_ssid_len);u16 status =WLAN_STATUS_SUCCESS ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/484 locking/rwsem: Add __always_inline annotation to __down_write_common() and inlined callers
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Stultz <[email protected]>
[ Upstream commit e81859fe64ad42dccefe134d1696e0635f78d763 ]
Apparently despite it being marked inline, the compiler may not inline __down_write_common() which makes it difficult to identify the cause of lock contention, as the wchan of the blocked function will always be listed as __down_write_common().
So add __always_inline annotation to the common function (as well as the inlined helper callers) to force it to be inlined so a more useful blocking function will be listed (via wchan).
This mirrors commit 92cc5d00a431 ("locking/rwsem: Add __always_inline annotation to __down_read_common() and inlined callers") which did the same for __down_read_common.
I sort of worry that I'm playing wack-a-mole here, and talking with compiler people, they tell me inline means nothing, which makes me want to cry a little. So I'm wondering if we need to replace all the inlines with __always_inline, or remove them because either we mean something by it, or not.
--- kernel/locking/rwsem.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
kernel/locking/rwsem.c +3 -3
@@ -1286,7 +1286,7 @@ static inline int __down_read_trylock(struct rw_semaphore *sem)/* * lock for writing */ -static inline int __down_write_common (struct rw_semaphore *sem,int state) +static __always_inline int __down_write_common(struct rw_semaphore *sem, int state) {if (unlikely (!rwsem_write_trylock (sem))) {if (IS_ERR (rwsem_down_write_slowpath (sem, state)))
@@ -1296,12 +1296,12 @@ static inline int __down_write_common(struct rw_semaphore *sem, int state)return 0 ; } -static inline void __down_write (struct rw_semaphore *sem) +static __always_inline void __down_write(struct rw_semaphore *sem) {__down_write_common (sem,TASK_UNINTERRUPTIBLE ); } -static inline int __down_write_killable (struct rw_semaphore *sem) +static __always_inline int __down_write_killable(struct rw_semaphore *sem) {return __down_write_common (sem,TASK_KILLABLE ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/484 selftests/bpf: Close fd in error path in drop_on_reuseport
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
[ Upstream commit adae187ebedcd95d02f045bc37dfecfd5b29434b ]
In the error path when update_lookup_map() fails in drop_on_reuseport in prog_tests/sk_lookup.c, "server1", the fd of server 1, should be closed. This patch fixes this by using "goto close_srv1" lable instead of "detach" to close "server1" in this case.
--- tools/testing/selftests/bpf/prog_tests/sk_lookup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/prog_tests/sk_lookup.c +1 -1
@@ -964,7 +964,7 @@ static void drop_on_reuseport(const struct test *t) err =update_lookup_map (t->sock_map,SERVER_A , server1);if (err) - goto detach; + goto close_srv1;/* second server on destination address we should never reach */ server2 = make_server(t->sotype, t->connect_to.ip, t->connect_to.port,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/484 bpf: annotate BTF show functions with __printf
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Maguire <[email protected]>
[ Upstream commit b3470da314fd8018ee237e382000c4154a942420 ]
-Werror=suggest-attribute=format warns about two functions in kernel/bpf/btf.c [1]; add __printf() annotations to silence these warnings since for CONFIG_WERROR=y they will trigger build failures.
[1] https://lore.kernel.org/bpf/[email protected]/
--- kernel/bpf/btf.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
kernel/bpf/btf.c +4 -4
@@ -5808,8 +5808,8 @@ static void btf_type_show(const struct btf *btf, u32 type_id, void *obj,btf_type_ops (t)->show (btf, t, type_id, obj,0 , show); } -static void btf_seq_show (struct btf_show *show,const char *fmt, -va_list args) +__printf(2, 0) static void btf_seq_show(struct btf_show *show, const char *fmt, +va_list args) {seq_vprintf ((struct seq_file *)show->target, fmt, args); }
@@ -5842,8 +5842,8 @@ struct btf_show_snprintf {int len;/* length we would have written */ }; -static void btf_snprintf_show (struct btf_show *show,const char *fmt, -va_list args) +__printf(2, 0) static void btf_snprintf_show(struct btf_show *show, const char *fmt, +va_list args) {struct btf_show_snprintf *ssnprintf = (struct btf_show_snprintf *)show;int len;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/484 bna: adjust name buf size of bna_tcb and bna_ccb structures
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Kodanev <[email protected]>
[ Upstream commit c9741a03dc8e491e57b95fba0058ab46b7e506da ]
To have enough space to write all possible sprintf() args. Currently 'name' size is 16, but the first '%s' specifier may already need at least 16 characters, since 'bnad->netdev->name' is used there.
For '%d' specifiers, assume that they require:
* 1 char for 'tx_id + tx_info->tcb[i]->id' sum, BNAD_MAX_TXQ_PER_TX is 8
* 2 chars for 'rx_id + rx_info->rx_ctrl[i].ccb->id', BNAD_MAX_RXP_PER_RX is 16
And replace sprintf with snprintf.
Detected using the static analysis tool - Svace.
--- drivers/net/ethernet/brocade/bna/bna_types.h | 2 +- drivers/net/ethernet/brocade/bna/bnad.c | 11 ++++++----- 2 files changed, 7 insertions(+), 6 deletions(-)
drivers/net/ethernet/brocade/bna/bna_types.h +1 -1
@@ -410,7 +410,7 @@ struct bna_ib {/* Tx object */ /* Tx datapath control structure */ -#define BNA_Q_NAME_SIZE 16 +#define BNA_Q_NAME_SIZE (IFNAMSIZ + 6)struct bna_tcb {/* Fast path */ void **sw_qpt;
drivers/net/ethernet/brocade/bna/bnad.c +6 -5
@@ -1535,8 +1535,9 @@ bnad_tx_msix_register(struct bnad *bnad, struct bnad_tx_info *tx_info,for (i =0 ; i < num_txqs; i++) { vector_num = tx_info->tcb[i]->intr_vector; -sprintf (tx_info->tcb[i]->name,"%s TXQ %d" , bnad->netdev->name, - tx_id + tx_info->tcb[i]->id); +snprintf (tx_info->tcb[i]->name,BNA_Q_NAME_SIZE ,"%s TXQ %d" , + bnad->netdev->name, + tx_id + tx_info->tcb[i]->id); err = request_irq(bnad->msix_table[vector_num].vector, (irq_handler_t)bnad_msix_tx, 0, tx_info->tcb[i]->name,
@@ -1586,9 +1587,9 @@ bnad_rx_msix_register(struct bnad *bnad, struct bnad_rx_info *rx_info,for (i =0 ; i < num_rxps; i++) { vector_num = rx_info->rx_ctrl[i].ccb->intr_vector; -sprintf (rx_info->rx_ctrl[i].ccb->name,"%s CQ %d" , - bnad->netdev->name, - rx_id + rx_info->rx_ctrl[i].ccb->id); +snprintf (rx_info->rx_ctrl[i].ccb->name,BNA_Q_NAME_SIZE , +"%s CQ %d" , bnad->netdev->name, + rx_id + rx_info->rx_ctrl[i].ccb->id); err = request_irq(bnad->msix_table[vector_num].vector, (irq_handler_t)bnad_msix_rx, 0, rx_info->rx_ctrl[i].ccb->name,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/484 bpf: Eliminate remaining "make W=1" warnings in kernel/bpf/btf.o
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Maguire <[email protected]>
[ Upstream commit 2454075f8e2915cebbe52a1195631bc7efe2b7e1 ]
As reported by Mirsad [1] we still see format warnings in kernel/bpf/btf.o at W=1 warning level:
CC kernel/bpf/btf.o./kernel/bpf/btf.c: In function ‘btf_type_seq_show_flags’:./kernel/bpf/btf.c:7553:21: warning: assignment left-hand side might be a candidate for a format attribute [-Wsuggest-attribute=format]
7553 | sseq.showfn = btf_seq_show;
| ^./kernel/bpf/btf.c: In function ‘btf_type_snprintf_show’:./kernel/bpf/btf.c:7604:31: warning: assignment left-hand side might be a candidate for a format attribute [-Wsuggest-attribute=format]
7604 | ssnprintf.show.showfn = btf_snprintf_show;
| ^
Combined with CONFIG_WERROR=y these can halt the build.
The fix (annotating the structure field with __printf()) suggested by Mirsad resolves these. Apologies I missed this last time. No other W=1 warnings were observed in kernel/bpf after this fix.
[1] https://lore.kernel.org/bpf/[email protected]/
--- kernel/bpf/btf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/bpf/btf.c +1 -1
@@ -349,7 +349,7 @@ const char *btf_type_str(const struct btf_type *t)struct btf_show {u64 flags;void *target;/* target of show operation (seq file, buffer) */ -void (*showfn)(struct btf_show *show,const char *fmt,va_list args); + __printf(2, 0) void (*showfn)(struct btf_show *show, const char *fmt, va_list args);const struct btf *btf;/* below are used during iteration */ struct {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/484 selftests: forwarding: devlink_lib: Wait for udev events after reloading
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Cohen <[email protected]>
[ Upstream commit f67a90a0c8f5b3d0acc18f10650d90fec44775f9 ]
Lately, an additional locking was added by commit c0a40097f0bc ("drivers: core: synchronize really_probe() and dev_uevent()"). The locking protects dev_uevent() calling. This function is used to send messages from the kernel to user space. Uevent messages notify user space about changes in device states, such as when a device is added, removed, or changed. These messages are used by udev (or other similar user-space tools) to apply device-specific rules.
After reloading devlink instance, udev events should be processed. This locking causes a short delay of udev events handling.
One example for useful udev rule is renaming ports. 'forwading.config' can be configured to use names after udev rules are applied. Some tests run devlink_reload() and immediately use the updated names. This worked before the above mentioned commit was pushed, but now the delay of uevent messages causes that devlink_reload() returns before udev events are handled and tests fail.
Adjust devlink_reload() to not assume that udev events are already processed when devlink reload is done, instead, wait for udev events to ensure they are processed before returning from the function.
Without this patch:
TESTS='rif_mac_profile' ./resource_scale.sh
TEST: 'rif_mac_profile' 4 [ OK ]
sysctl: cannot stat /proc/sys/net/ipv6/conf/swp1/disable_ipv6: No such file or directory
sysctl: cannot stat /proc/sys/net/ipv6/conf/swp1/disable_ipv6: No such file or directory
sysctl: cannot stat /proc/sys/net/ipv6/conf/swp2/disable_ipv6: No such file or directory
sysctl: cannot stat /proc/sys/net/ipv6/conf/swp2/disable_ipv6: No such file or directory Cannot find device "swp1"
Cannot find device "swp2"
TEST: setup_wait_dev (: Interface swp1 does not come up.) [FAIL]
With this patch:
$ TESTS='rif_mac_profile' ./resource_scale.sh TEST: 'rif_mac_profile' 4 [ OK ] TEST: 'rif_mac_profile' overflow 5 [ OK ]
This is relevant not only for this test.
--- tools/testing/selftests/net/forwarding/devlink_lib.sh | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/net/forwarding/devlink_lib.sh +2 -0
@@ -122,6 +122,8 @@ devlink_reload() still_pending=$(devlink resource show "$DEVLINK_DEV" | \ grep -c "size_new") check_err $still_pending "Failed reload - There are still unset sizes" + + udevadm settle } declare -A DEVLINK_ORIG
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/484 xdp: fix invalid wait context of page_pool_destroy()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <[email protected]>
[ Upstream commit 59a931c5b732ca5fc2ca727f5a72aeabaafa85ec ]
If the driver uses a page pool, it creates a page pool with page_pool_create().
The reference count of page pool is 1 as default.
A page pool will be destroyed only when a reference count reaches 0. page_pool_destroy() is used to destroy page pool, it decreases a reference count.
When a page pool is destroyed, ->disconnect() is called, which is mem_allocator_disconnect().
This function internally acquires mutex_lock().
If the driver uses XDP, it registers a memory model with xdp_rxq_info_reg_mem_model().
The xdp_rxq_info_reg_mem_model() internally increases a page pool reference count if a memory model is a page pool.
Now the reference count is 2.
To destroy a page pool, the driver should call both page_pool_destroy() and xdp_unreg_mem_model().
The xdp_unreg_mem_model() internally calls page_pool_destroy(). Only page_pool_destroy() decreases a reference count.
If a driver calls page_pool_destroy() then xdp_unreg_mem_model(), we will face an invalid wait context warning.
Because xdp_unreg_mem_model() calls page_pool_destroy() with rcu_read_lock().
The page_pool_destroy() internally acquires mutex_lock().
Splat looks like:
=============================
[ BUG: Invalid wait context ]
6.10.0-rc6+ #4 Tainted: G W
-----------------------------
ethtool/1806 is trying to lock:ffffffff90387b90 (mem_id_lock){+.+.}-{4:4}, at: mem_allocator_disconnect+0x73/0x150 other info that might help us debug this:
context-{5:5}
3 locks held by ethtool/1806:
stack backtrace: CPU: 0 PID: 1806 Comm: ethtool Tainted: G W 6.10.0-rc6+ #4 f916f41f172891c800f2fed Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 Call Trace: <TASK> dump_stack_lvl+0x7e/0xc0 __lock_acquire+0x1681/0x4de0 ? _printk+0x64/0xe0 ? __pfx_mark_lock.part.0+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 lock_acquire+0x1b3/0x580 ? mem_allocator_disconnect+0x73/0x150 ? __wake_up_klogd.part.0+0x16/0xc0 ? __pfx_lock_acquire+0x10/0x10 ? dump_stack_lvl+0x91/0xc0 __mutex_lock+0x15c/0x1690 ? mem_allocator_disconnect+0x73/0x150 ? __pfx_prb_read_valid+0x10/0x10 ? mem_allocator_disconnect+0x73/0x150 ? __pfx_llist_add_batch+0x10/0x10 ? console_unlock+0x193/0x1b0 ? lockdep_hardirqs_on+0xbe/0x140 ? __pfx___mutex_lock+0x10/0x10 ? tick_nohz_tick_stopped+0x16/0x90 ? __irq_work_queue_local+0x1e5/0x330 ? irq_work_queue+0x39/0x50 ? __wake_up_klogd.part.0+0x79/0xc0 ? mem_allocator_disconnect+0x73/0x150 mem_allocator_disconnect+0x73/0x150 ? __pfx_mem_allocator_disconnect+0x10/0x10 ? mark_held_locks+0xa5/0xf0 ? rcu_is_watching+0x11/0xb0 page_pool_release+0x36e/0x6d0 page_pool_destroy+0xd7/0x440 xdp_unreg_mem_model+0x1a7/0x2a0 ? __pfx_xdp_unreg_mem_model+0x10/0x10 ? kfree+0x125/0x370 ? bnxt_free_ring.isra.0+0x2eb/0x500 ? bnxt_free_mem+0x5ac/0x2500 xdp_rxq_info_unreg+0x4a/0xd0 bnxt_free_mem+0x1356/0x2500 bnxt_close_nic+0xf0/0x3b0 ? __pfx_bnxt_close_nic+0x10/0x10 ? ethnl_parse_bit+0x2c6/0x6d0 ? __pfx___nla_validate_parse+0x10/0x10 ? __pfx_ethnl_parse_bit+0x10/0x10 bnxt_set_features+0x2a8/0x3e0 __netdev_update_features+0x4dc/0x1370 ? ethnl_parse_bitset+0x4ff/0x750 ? __pfx_ethnl_parse_bitset+0x10/0x10 ? __pfx___netdev_update_features+0x10/0x10 ? mark_held_locks+0xa5/0xf0 ? _raw_spin_unlock_irqrestore+0x42/0x70 ? __pm_runtime_resume+0x7d/0x110 ethnl_set_features+0x32d/0xa20
To fix this problem, it uses rhashtable_lookup_fast() instead of rhashtable_lookup() with rcu_read_lock().
Using xa without rcu_read_lock() here is safe.
xa is freed by __xdp_mem_allocator_rcu_free() and this is called by call_rcu() of mem_xa_remove().
The mem_xa_remove() is called by page_pool_destroy() if a reference count reaches 0.
The xa is already protected by the reference count mechanism well in the control plane.
So removing rcu_read_lock() for page_pool_destroy() is safe.
--- net/core/xdp.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
net/core/xdp.c +1 -3
@@ -124,10 +124,8 @@ void xdp_unreg_mem_model(struct xdp_mem_info *mem)return ;if (type ==MEM_TYPE_PAGE_POOL ) { -rcu_read_lock (); - xa =rhashtable_lookup (mem_id_ht, &id, mem_id_rht_params); + xa =rhashtable_lookup_fast (mem_id_ht, &id, mem_id_rht_params);page_pool_destroy (xa->page_pool); -rcu_read_unlock (); } }EXPORT_SYMBOL_GPL (xdp_unreg_mem_model);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/484 drm/amd/pm: Fix aldebaran pcie speed reporting
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <[email protected]>
[ Upstream commit b6420021e17e262c57bb289d0556ee181b014f9c ]
Fix the field definitions for LC_CURRENT_DATA_RATE.
--- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +2 -2
@@ -69,8 +69,8 @@ MODULE_FIRMWARE("amdgpu/aldebaran_smc.bin");#define PCIE_LC_LINK_WIDTH_CNTL__LC_LINK_WIDTH_RD_MASK 0x00000070L#define PCIE_LC_LINK_WIDTH_CNTL__LC_LINK_WIDTH_RD__SHIFT 0x4#define smnPCIE_LC_SPEED_CNTL 0x11140290 -#define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE_MASK 0xC000 -#define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE__SHIFT 0xE +#define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE_MASK 0xE0 +#define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE__SHIFT 0x5static const int link_width[] = {0 ,1 ,2 ,4 ,8 ,12 ,16 };static const int link_speed[] = {25 ,50 ,80 ,160 };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/484 drm/amdgpu: Check if NBIO funcs are NULL in amdgpu_device_baco_exit
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Friedrich Vock <[email protected]>
[ Upstream commit 0cdb3f9740844b9d95ca413e3fcff11f81223ecf ]
The special case for VM passthrough doesn't check adev->nbio.funcs before dereferencing it. If GPUs that don't have an NBIO block are passed through, this leads to a NULL pointer dereference on startup.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +1 -1
@@ -5531,7 +5531,7 @@ int amdgpu_device_baco_exit(struct drm_device *dev) adev->nbio.funcs->enable_doorbell_interrupt) adev->nbio.funcs->enable_doorbell_interrupt(adev, true); -if (amdgpu_passthrough (adev) && +if (amdgpu_passthrough (adev) && adev->nbio.funcs && adev->nbio.funcs->clear_doorbell_interrupt) adev->nbio.funcs->clear_doorbell_interrupt (adev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/484 drm/panel: boe-tv101wum-nl6: If prepare fails, disable GPIO before regulators
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 587c48f622374e5d47b1d515c6006a4df4dee882 ]
The enable GPIO should clearly be set low before turning off regulators. That matches both the inverse order that things were enabled and also the order in unprepare().
--- drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c +1 -1
@@ -574,13 +574,13 @@ static int boe_panel_prepare(struct drm_panel *panel)return 0 ; poweroff: +gpiod_set_value (boe->enable_gpio,0 );regulator_disable (boe->avee); poweroffavdd:regulator_disable (boe->avdd); poweroff1v8:usleep_range (5000 ,7000 );regulator_disable (boe->pp1800); -gpiod_set_value (boe->enable_gpio,0 );return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/484 drm/panel: boe-tv101wum-nl6: Check for errors on the NOP in prepare()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 6320b9199dd99622668649c234d4e8a99e44a9c8 ]
The mipi_dsi_dcs_nop() function returns an error but we weren't checking it in boe_panel_prepare(). Add a check. This is highly unlikely to matter in practice. If the NOP failed then likely later MIPI commands would fail too.
Found by code inspection.
--- drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c +5 -1
@@ -553,7 +553,11 @@ static int boe_panel_prepare(struct drm_panel *panel)usleep_range (5000 ,10000 );if (boe->desc->lp11_before_reset) { -mipi_dsi_dcs_nop (boe->dsi); + ret =mipi_dsi_dcs_nop (boe->dsi); +if (ret <0 ) { +dev_err (&boe->dsi->dev,"Failed to send NOP: %d\n" , ret); + goto poweroff; + }usleep_range (1000 ,2000 ); }gpiod_set_value (boe->enable_gpio,1 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/484 media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
[ Upstream commit 2052138b7da52ad5ccaf74f736d00f39a1c9198c ]
Infinite log printing occurs during fuzz test:
rc rc1: DViCO FusionHDTV DVB-T USB (LGZ201) as ...
...
dvb-usb: schedule remote query interval to 100 msecs.
dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized ...
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
...
dvb-usb: bulk message failed: -22 (1/0)
Looking into the codes, there is a loop in dvb_usb_read_remote_control(), that is in rc_core_dvb_usb_remote_init() create a work that will call dvb_usb_read_remote_control(), and this work will reschedule itself at 'rc_interval' intervals to recursively call dvb_usb_read_remote_control(), see following code snippet:
rc_core_dvb_usb_remote_init() {
...
INIT_DELAYED_WORK(&d->rc_query_work, dvb_usb_read_remote_control);
schedule_delayed_work(&d->rc_query_work,
msecs_to_jiffies(rc_interval));
...
}
dvb_usb_read_remote_control() {
...
err = d->props.rc.core.rc_query(d);
if (err)
err(...) // Did not return even if query failed
schedule_delayed_work(&d->rc_query_work,
msecs_to_jiffies(rc_interval));
}When the infinite log printing occurs, the query callback 'd->props.rc.core.rc_query' is cxusb_rc_query(). And the log is due to the failure of finding a valid 'generic_bulk_ctrl_endpoint' in usb_bulk_msg(), see following code snippet:
cxusb_rc_query() {
cxusb_ctrl_msg() {
dvb_usb_generic_rw() {
ret = usb_bulk_msg(d->udev, usb_sndbulkpipe(d->udev,
d->props.generic_bulk_ctrl_endpoint),...);
if (ret)
err("bulk message failed: %d (%d/%d)",ret,wlen,actlen);
...
}
...
}By analyzing the corresponding USB descriptor, it shows that the bNumEndpoints is 0 in its interface descriptor, but
the 'generic_bulk_ctrl_endpoint' is 1, that means user don't configure a valid endpoint for 'generic_bulk_ctrl_endpoint', therefore this 'invalid' USB device should be rejected before it calls into dvb_usb_read_remote_control().
To fix it, we need to add endpoint check for 'generic_bulk_ctrl_endpoint'. And as Sean suggested, the same check and clear halts should be done for 'generic_bulk_ctrl_endpoint_response'. So introduce dvb_usb_check_bulk_endpoint() to do it for both of them.
--- drivers/media/usb/dvb-usb/dvb-usb-init.c | 35 +++++++++++++++++++++--- 1 file changed, 31 insertions(+), 4 deletions(-)
drivers/media/usb/dvb-usb/dvb-usb-init.c +31 -4
@@ -23,11 +23,40 @@ static int dvb_usb_force_pid_filter_usage;module_param_named (force_pid_filter_usage, dvb_usb_force_pid_filter_usage, int,0444 );MODULE_PARM_DESC (force_pid_filter_usage,"force all dvb-usb-devices to use a PID filter, if any (default: 0)." ); +static int dvb_usb_check_bulk_endpoint (struct dvb_usb_device *d,u8 endpoint) +{ +if (endpoint) { +int ret; + + ret =usb_pipe_type_check (d->udev,usb_sndbulkpipe (d->udev, endpoint)); +if (ret) +return ret; + ret =usb_pipe_type_check (d->udev,usb_rcvbulkpipe (d->udev, endpoint)); +if (ret) +return ret; + } +return 0 ; +} + +static void dvb_usb_clear_halt (struct dvb_usb_device *d,u8 endpoint) +{ +if (endpoint) { +usb_clear_halt (d->udev,usb_sndbulkpipe (d->udev, endpoint)); +usb_clear_halt (d->udev,usb_rcvbulkpipe (d->udev, endpoint)); + } +} +static int dvb_usb_adapter_init (struct dvb_usb_device *d,short *adapter_nrs) {struct dvb_usb_adapter *adap;int ret, n, o; + ret =dvb_usb_check_bulk_endpoint (d, d->props.generic_bulk_ctrl_endpoint); +if (ret) +return ret; + ret =dvb_usb_check_bulk_endpoint (d, d->props.generic_bulk_ctrl_endpoint_response); +if (ret) +return ret;for (n =0 ; n < d->props.num_adapters; n++) { adap = &d->adapter[n]; adap->dev = d;
@@ -103,10 +132,8 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs)* when reloading the driver w/o replugging the device * sometimes a timeout occurs, this helps */ -if (d->props.generic_bulk_ctrl_endpoint !=0 ) { -usb_clear_halt (d->udev,usb_sndbulkpipe (d->udev, d->props.generic_bulk_ctrl_endpoint)); -usb_clear_halt (d->udev,usb_rcvbulkpipe (d->udev, d->props.generic_bulk_ctrl_endpoint)); - } +dvb_usb_clear_halt (d, d->props.generic_bulk_ctrl_endpoint); +dvb_usb_clear_halt (d, d->props.generic_bulk_ctrl_endpoint_response);return 0 ;
Signature · 1 line
2.43.0
Re: [PATCH 5.15 085/484] media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
Quoted 20 lines · Greg Kroah-Hartman
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
[ Upstream commit
2052138b7da52ad5ccaf74f736d00f39a1c9198c]Infinite log printing occurs during fuzz test:
rc rc1: DViCO FusionHDTV DVB-T USB (LGZ201) as ...
...
dvb-usb: schedule remote query interval to 100 msecs.
dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized ...
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
...
dvb-usb: bulk message failed: -22 (1/0)
Quoted 5 lines
Looking into the codes, there is a loop in
dvb_usb_read_remote_control(), that is inrc_core_dvb_usb_remote_init()create a work that will calldvb_usb_read_remote_control(), and this work will reschedule itself at 'rc_interval' intervals to recursively calldvb_usb_read_remote_control(), see following code snippet:
This commit causes problems and has been reverted upstream.
https://git.linuxtv.org/media_stage.git/commit/?h=fixes&id=0c84bde4f37ba27d50e4c70ecacd33fe4a57030d
Please don't apply.
Thanks,
Sean
Greg Kroah-Hartman
maintainerRe: [PATCH 5.15 085/484] media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
Quoted 27 lines · Sean Young
Quoted 20 lines · Greg Kroah-Hartman
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
[ Upstream commit
2052138b7da52ad5ccaf74f736d00f39a1c9198c]Infinite log printing occurs during fuzz test:
rc rc1: DViCO FusionHDTV DVB-T USB (LGZ201) as ...
...
dvb-usb: schedule remote query interval to 100 msecs.
dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized ...
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
...
dvb-usb: bulk message failed: -22 (1/0)Quoted 5 lines
Looking into the codes, there is a loop in
dvb_usb_read_remote_control(), that is inrc_core_dvb_usb_remote_init()create a work that will calldvb_usb_read_remote_control(), and this work will reschedule itself at 'rc_interval' intervals to recursively calldvb_usb_read_remote_control(), see following code snippet:
Quoted 5 lines
This commit causes problems and has been reverted upstream.
https://git.linuxtv.org/media_stage.git/commit/?h=fixes&id=0c84bde4f37ba27d50e4c70ecacd33fe4a57030d
Please don't apply.
When will that land in Linus's tree? Currently this commit is already in released 6.1, 6.6, and 6.10 kernels :(
thanks,
greg k-h
Re: [PATCH 5.15 085/484] media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
Quoted 28 lines · Greg Kroah-Hartman
Quoted 27 lines · Sean Young
Quoted 25 lines · Greg Kroah-Hartman
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
[ Upstream commit
2052138b7da52ad5ccaf74f736d00f39a1c9198c]Infinite log printing occurs during fuzz test:
rc rc1: DViCO FusionHDTV DVB-T USB (LGZ201) as ...
...
dvb-usb: schedule remote query interval to 100 msecs.
dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized ...
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
...
dvb-usb: bulk message failed: -22 (1/0)Looking into the codes, there is a loop in
dvb_usb_read_remote_control(), that is inrc_core_dvb_usb_remote_init()create a work that will calldvb_usb_read_remote_control(), and this work will reschedule itself at 'rc_interval' intervals to recursively calldvb_usb_read_remote_control(), see following code snippet:
Quoted 8 lines
Quoted 5 lines
This commit causes problems and has been reverted upstream.
https://git.linuxtv.org/media_stage.git/commit/?h=fixes&id=0c84bde4f37ba27d50e4c70ecacd33fe4a57030d
Please don't apply.
When will that land in Linus's tree? Currently this commit is already in released 6.1, 6.6, and 6.10 kernels :(
I asked Mauro to make a PR asap. Hopefully for the next rc.
Regards,
Hans
Quoted 4 lines
thanks,
greg k-h
Re: [PATCH 5.15 085/484] media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
Em Thu, 15 Aug 2024 16:51:03 +0200
Hans Verkuil <[email protected]> escreveu:
Quoted 31 lines · Greg Kroah-Hartman
Quoted 30 lines · Sean Young
Quoted 29 lines · Greg Kroah-Hartman
Quoted 20 lines
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
[ Upstream commit
2052138b7da52ad5ccaf74f736d00f39a1c9198c]Infinite log printing occurs during fuzz test:
rc rc1: DViCO FusionHDTV DVB-T USB (LGZ201) as ...
...
dvb-usb: schedule remote query interval to 100 msecs.
dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized ...
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
...
dvb-usb: bulk message failed: -22 (1/0)Quoted 5 lines
Looking into the codes, there is a loop in
dvb_usb_read_remote_control(), that is inrc_core_dvb_usb_remote_init()create a work that will calldvb_usb_read_remote_control(), and this work will reschedule itself at 'rc_interval' intervals to recursively calldvb_usb_read_remote_control(), see following code snippet:This commit causes problems and has been reverted upstream.
Quoted 8 lines
Quoted 6 lines
Quoted 3 lines
https://git.linuxtv.org/media_stage.git/commit/?h=fixes&id=0c84bde4f37ba27d50e4c70ecacd33fe4a57030d
Please don't apply.
When will that land in Linus's tree? Currently this commit is already in released 6.1, 6.6, and 6.10 kernels :(
I asked Mauro to make a PR asap. Hopefully for the next rc.
PR just sent:
https://lore.kernel.org/linux-media/[email protected]/T/#u
Regards,
Mauro
Thanks,
Mauro
Re: [PATCH 5.15 085/484] media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
In reply to Greg Kroah-HartmanQuoted 28 lines · Greg Kroah-Hartman
Quoted 27 lines · Sean Young
Quoted 25 lines · Greg Kroah-Hartman
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
[ Upstream commit
2052138b7da52ad5ccaf74f736d00f39a1c9198c]Infinite log printing occurs during fuzz test:
rc rc1: DViCO FusionHDTV DVB-T USB (LGZ201) as ...
...
dvb-usb: schedule remote query interval to 100 msecs.
dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized ...
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
...
dvb-usb: bulk message failed: -22 (1/0)Looking into the codes, there is a loop in
dvb_usb_read_remote_control(), that is inrc_core_dvb_usb_remote_init()create a work that will calldvb_usb_read_remote_control(), and this work will reschedule itself at 'rc_interval' intervals to recursively calldvb_usb_read_remote_control(), see following code snippet:
Quoted 8 lines
Quoted 5 lines
This commit causes problems and has been reverted upstream.
https://git.linuxtv.org/media_stage.git/commit/?h=fixes&id=0c84bde4f37ba27d50e4c70ecacd33fe4a57030d
Please don't apply.
When will that land in Linus's tree? Currently this commit is already in released 6.1, 6.6, and 6.10 kernels :(
I've queued up the revert everywhere now, thanks!
greg k-h
Greg Kroah-Hartman
maintainerPATCH 86/484 media: imon: Fix race getting ictx->lock
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 24147897507cd3a7d63745d1518a638bf4132238 ]
Lets fix a race between mutex_is_lock() and mutex_lock().
<-mutex is not locked
if (!mutex_is_locked(&ictx->lock)) {
unlock = true; <- mutex is locked externaly
mutex_lock(&ictx->lock);
}Let's use mutex_trylock() that does mutex_is_lock() and mutex_lock() atomically.
Fix the following cocci warning:
drivers/media/rc/imon.c:1167:1-7: preceding lock on line 1153
--- drivers/media/rc/imon.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/media/rc/imon.c +1 -4
@@ -1150,10 +1150,7 @@ static int imon_ir_change_protocol(struct rc_dev *rc, u64 *rc_proto)memcpy (ictx->usb_tx_buf, &ir_proto_packet,sizeof (ir_proto_packet)); -if (!mutex_is_locked (&ictx->lock)) { - unlock = true; -mutex_lock (&ictx->lock); - } + unlock =mutex_trylock (&ictx->lock); retval =send_packet (ictx);if (retval)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/484 media: i2c: Fix imx412 exposure control
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryan O'Donoghue <[email protected]>
[ Upstream commit a1956bf53a2774014ee1768b484af2c38c633a25 ]
Currently we have the following algorithm to calculate what value should be written to the exposure control of imx412.
lpfr = imx412->vblank + imx412->cur_mode->height;
shutter = lpfr - exposure;
The 'shutter' value is given to IMX412_REG_EXPOSURE_CIT however, the above algorithm will result in the value given to IMX412_REG_EXPOSURE_CIT decreasing as the requested exposure value from user-space goes up.
e.g.
[ 2255.713989] imx412 20-001a: Received exp 1608, analog gain 0 [ 2255.714002] imx412 20-001a: Set exp 1608, analog gain 0, shutter 1938, lpfr 3546 [ 2256.302770] imx412 20-001a: Received exp 2586, analog gain 100 [ 2256.302800] imx412 20-001a: Set exp 2586, analog gain 100, shutter 960, lpfr 3546 [ 2256.753755] imx412 20-001a: Received exp 3524, analog gain 110 [ 2256.753772] imx412 20-001a: Set exp 3524, analog gain 110, shutter 22, lpfr 3546
This behaviour results in the image having less exposure as the requested exposure value from user-space increases.
Other sensor drivers such as ov5675, imx218, hid556 and others take the requested exposure value and use the value directly.
Take the example of the above cited sensor drivers and directly apply the requested exposure value from user-space. The 'lpfr' variable still functions as before but the 'shutter' variable can be dispensed with as a result.
Once done a similar run of the test application requesting higher exposure looks like this, with 'exp' written directly to the sensor.
[ 133.207884] imx412 20-001a: Received exp 1608, analog gain 0 [ 133.207899] imx412 20-001a: Set exp 1608, analog gain 0, lpfr 3546 [ 133.905309] imx412 20-001a: Received exp 2844, analog gain 100 [ 133.905344] imx412 20-001a: Set exp 2844, analog gain 100, lpfr 3546 [ 134.241705] imx412 20-001a: Received exp 3524, analog gain 110 [ 134.241775] imx412 20-001a: Set exp 3524, analog gain 110, lpfr 3546
The result is then setting the sensor exposure to lower values results in darker, less exposure images and vice versa with higher exposure values.
--- drivers/media/i2c/imx412.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/media/i2c/imx412.c +4 -5
@@ -535,14 +535,13 @@ static int imx412_update_controls(struct imx412 *imx412,*/ static int imx412_update_exp_gain (struct imx412 *imx412,u32 exposure,u32 gain) { -u32 lpfr, shutter; +u32 lpfr;int ret; lpfr = imx412->vblank + imx412->cur_mode->height; - shutter = lpfr - exposure; -dev_dbg (imx412->dev,"Set exp %u, analog gain %u, shutter %u, lpfr %u" , - exposure, gain, shutter, lpfr); +dev_dbg (imx412->dev,"Set exp %u, analog gain %u, lpfr %u" , + exposure, gain, lpfr); ret =imx412_write_reg (imx412,IMX412_REG_HOLD ,1 ,1 );if (ret)
@@ -552,7 +551,7 @@ static int imx412_update_exp_gain(struct imx412 *imx412, u32 exposure, u32 gain)if (ret) goto error_release_group_hold; - ret =imx412_write_reg (imx412,IMX412_REG_EXPOSURE_CIT ,2 , shutter); + ret =imx412_write_reg (imx412,IMX412_REG_EXPOSURE_CIT ,2 , exposure);if (ret) goto error_release_group_hold;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/484 KVM: s390: pv: avoid stalls when making pages secure
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudio Imbrenda <[email protected]>
[ Upstream commit f0a1a0615a6ff6d38af2c65a522698fb4bb85df6 ]
Improve make_secure_pte to avoid stalls when the system is heavily overcommitted. This was especially problematic in kvm_s390_pv_unpack, because of the loop over all pages that needed unpacking.
Due to the locks being held, it was not possible to simply replace uv_call with uv_call_sched. A more complex approach was needed, in which uv_call is replaced with __uv_call, which does not loop. When the UVC needs to be executed again, -EAGAIN is returned, and the caller (or its caller) will try again.
When -EAGAIN is returned, the path is the same as when the page is in writeback (and the writeback check is also performed, which is harmless).
Stable-dep-of: 3f29f6537f54 ("s390/uv: Don't call folio_wait_writeback() without a folio reference")
--- arch/s390/kernel/uv.c | 29 +++++++++++++++++++++++------ arch/s390/kvm/intercept.c | 5 +++++ 2 files changed, 28 insertions(+), 6 deletions(-)
arch/s390/kernel/uv.c +23 -6
@@ -165,7 +165,7 @@ static int make_secure_pte(pte_t *ptep, unsigned long addr, {pte_t entry =READ_ONCE (*ptep);struct page *page; -int expected, rc =0 ; +int expected, cc =0 ;if (!pte_present (entry))return -ENXIO ;
@@ -181,12 +181,25 @@ static int make_secure_pte(pte_t *ptep, unsigned long addr,if (!page_ref_freeze (page, expected))return -EBUSY ;set_bit (PG_arch_1, &page->flags); - rc =uv_call (0 , (u64 )uvcb); +/* +* If the UVC does not succeed or fail immediately, we don't want to +* loop for long, or we might get stall notifications. +* On the other hand, this is a complex scenario and we are holding a lot of +* locks, so we can't easily sleep and reschedule. We try only once, +* and if the UVC returned busy or partial completion, we return +* -EAGAIN and we let the callers deal with it. +*/ + cc =__uv_call (0 , (u64 )uvcb);page_ref_unfreeze (page, expected); -/* Return -ENXIO if the page was not mapped, -EINVAL otherwise */ -if (rc) - rc = uvcb->rc ==0x10a ? -ENXIO : -EINVAL ; -return rc; +/* +* Return -ENXIO if the page was not mapped, -EINVAL for other errors. +* If busy or partially completed, return -EAGAIN. +*/ +if (cc ==UVC_CC_OK ) +return 0 ; +else if (cc ==UVC_CC_BUSY || cc ==UVC_CC_PARTIAL ) +return -EAGAIN ; +return uvcb->rc ==0x10a ? -ENXIO : -EINVAL ; }/*
@@ -239,6 +252,10 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb)mmap_read_unlock (gmap->mm);if (rc == -EAGAIN ) { +/* +* If we are here because the UVC returned busy or partial +* completion, this is just a useless check, but it is safe. +*/ wait_on_page_writeback (page); }else if (rc == -EBUSY ) {/*
arch/s390/kvm/intercept.c +5 -0
@@ -537,6 +537,11 @@ static int handle_pv_uvc(struct kvm_vcpu *vcpu)*/ if (rc == -EINVAL )return 0 ; +/* +* If we got -EAGAIN here, we simply return it. It will eventually +* get propagated all the way to userspace, which should then try +* again. +*/ return rc; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/484 KVM: s390: pv: properly handle page flags for protected guests
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudio Imbrenda <[email protected]>
[ Upstream commit 380d97bd02fca7b9b41aec2d1c767874d602bc78 ]
Introduce variants of the convert and destroy page functions that also clear the PG_arch_1 bit used to mark them as secure pages.
The PG_arch_1 flag is always allowed to overindicate; using the new functions introduced here allows to reduce the extent of overindication and thus improve performance.
These new functions can only be called on pages for which a reference is already being held.
Stable-dep-of: 3f29f6537f54 ("s390/uv: Don't call folio_wait_writeback() without a folio reference")
--- arch/s390/include/asm/pgtable.h | 9 ++++++--- arch/s390/include/asm/uv.h | 10 ++++++++-- arch/s390/kernel/uv.c | 34 ++++++++++++++++++++++++++++++++- arch/s390/mm/gmap.c | 4 +++- 4 files changed, 50 insertions(+), 7 deletions(-)
arch/s390/include/asm/pgtable.h +6 -3
@@ -1074,8 +1074,9 @@ static inline pte_t ptep_get_and_clear(struct mm_struct *mm,pte_t res; res =ptep_xchg_lazy (mm, addr, ptep,__pte (_PAGE_INVALID)); +/* At this point the reference through the mapping is still present */ if (mm_is_protected (mm) &&pte_present (res)) -uv_convert_from_secure (pte_val (res) &PAGE_MASK ); +uv_convert_owned_from_secure (pte_val (res) &PAGE_MASK );return res; }
@@ -1091,8 +1092,9 @@ static inline pte_t ptep_clear_flush(struct vm_area_struct *vma,pte_t res; res =ptep_xchg_direct (vma->vm_mm, addr, ptep,__pte (_PAGE_INVALID)); +/* At this point the reference through the mapping is still present */ if (mm_is_protected (vma->vm_mm) &&pte_present (res)) -uv_convert_from_secure (pte_val (res) &PAGE_MASK ); +uv_convert_owned_from_secure (pte_val (res) &PAGE_MASK );return res; }
@@ -1116,8 +1118,9 @@ static inline pte_t ptep_get_and_clear_full(struct mm_struct *mm, }else { res =ptep_xchg_lazy (mm, addr, ptep,__pte (_PAGE_INVALID)); } +/* At this point the reference through the mapping is still present */ if (mm_is_protected (mm) &&pte_present (res)) -uv_convert_from_secure (pte_val (res) &PAGE_MASK ); +uv_convert_owned_from_secure (pte_val (res) &PAGE_MASK );return res; }
arch/s390/include/asm/uv.h +8 -2
@@ -351,8 +351,9 @@ static inline int is_prot_virt_host(void) }int gmap_make_secure (struct gmap *gmap,unsigned long gaddr,void *uvcb); -int uv_destroy_page (unsigned long paddr); +int uv_destroy_owned_page (unsigned long paddr);int uv_convert_from_secure (unsigned long paddr); +int uv_convert_owned_from_secure (unsigned long paddr);int gmap_convert_to_secure (struct gmap *gmap,unsigned long gaddr);void setup_uv (void );
@@ -360,7 +361,7 @@ void setup_uv(void);#define is_prot_virt_host () 0static inline void setup_uv (void ) {} -static inline int uv_destroy_page (unsigned long paddr) +static inline int uv_destroy_owned_page (unsigned long paddr) {return 0 ; }
@@ -369,6 +370,11 @@ static inline int uv_convert_from_secure(unsigned long paddr) {return 0 ; } + +static inline int uv_convert_owned_from_secure (unsigned long paddr) +{ +return 0 ; +}#endif #endif /* _ASM_S390_UV_H */
arch/s390/kernel/uv.c +33 -1
@@ -100,7 +100,7 @@ static int uv_pin_shared(unsigned long paddr)* * @paddr: Absolute host address of page to be destroyed */ -int uv_destroy_page (unsigned long paddr) +static int uv_destroy_page (unsigned long paddr) {struct uv_cb_cfs uvcb = { .header.cmd =UVC_CMD_DESTR_SEC_STOR ,
@@ -120,6 +120,22 @@ int uv_destroy_page(unsigned long paddr)return 0 ; } +/* +* The caller must already hold a reference to the page +*/ +int uv_destroy_owned_page (unsigned long paddr) +{ +struct page *page =phys_to_page (paddr); +int rc; + +get_page (page); + rc =uv_destroy_page (paddr); +if (!rc) +clear_bit (PG_arch_1, &page->flags); +put_page (page); +return rc; +} +/* * Requests the Ultravisor to encrypt a guest page and make it * accessible to the host for paging (export).
@@ -139,6 +155,22 @@ int uv_convert_from_secure(unsigned long paddr)return 0 ; } +/* +* The caller must already hold a reference to the page +*/ +int uv_convert_owned_from_secure (unsigned long paddr) +{ +struct page *page =phys_to_page (paddr); +int rc; + +get_page (page); + rc =uv_convert_from_secure (paddr); +if (!rc) +clear_bit (PG_arch_1, &page->flags); +put_page (page); +return rc; +} +/* * Calculate the expected ref_count for a page that would otherwise have no * further pins. This was cribbed from similar functions in other places in
arch/s390/mm/gmap.c +3 -1
@@ -2698,8 +2698,10 @@ static int __s390_reset_acc(pte_t *ptep, unsigned long addr, {pte_t pte =READ_ONCE (*ptep); +/* There is a reference through the mapping */ if (pte_present (pte)) -WARN_ON_ONCE (uv_destroy_page (pte_val (pte) &PAGE_MASK )); +WARN_ON_ONCE (uv_destroy_owned_page (pte_val (pte) &PAGE_MASK )); +return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/484 KVM: s390: pv: add export before import
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudio Imbrenda <[email protected]>
[ Upstream commit 72b1daff2671cef2c8cccc6c4e52f8d5ce4ebe58 ]
Due to upcoming changes, it will be possible to temporarily have multiple protected VMs in the same address space, although only one will be actually active.
In that scenario, it is necessary to perform an export of every page that is to be imported, since the hardware does not allow a page belonging to a protected guest to be imported into a different protected guest.
This also applies to pages that are shared, and thus accessible by the host.
Message-Id: <[email protected]>
Stable-dep-of: 3f29f6537f54 ("s390/uv: Don't call folio_wait_writeback() without a folio reference")
--- arch/s390/kernel/uv.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
arch/s390/kernel/uv.c +28 -0
@@ -234,6 +234,32 @@ static int make_secure_pte(pte_t *ptep, unsigned long addr,return uvcb->rc ==0x10a ? -ENXIO : -EINVAL ; } +/** +* should_export_before_import - Determine whether an export is needed +* before an import-like operation +* @uvcb: the Ultravisor control block of the UVC to be performed +* @mm: the mm of the process +* +* Returns whether an export is needed before every import-like operation. +* This is needed for shared pages, which don't trigger a secure storage +* exception when accessed from a different guest. +* +* Although considered as one, the Unpin Page UVC is not an actual import, +* so it is not affected. +* +* No export is needed also when there is only one protected VM, because the +* page cannot belong to the wrong VM in that case (there is no "other VM" +* it can belong to). +* +* Return: true if an export is needed before every import, otherwise false. +*/ +static bool should_export_before_import (struct uv_cb_header *uvcb,struct mm_struct *mm) +{ +if (uvcb->cmd ==UVC_CMD_UNPIN_PAGE_SHARED ) +return false; +return atomic_read (&mm->context.protected_count) >1 ; +} +/* * Requests the Ultravisor to make a page accessible to a guest. * If it's brought in the first time, it will be cleared. If
@@ -277,6 +303,8 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb)lock_page (page); ptep =get_locked_pte (gmap->mm, uaddr, &ptelock); +if (should_export_before_import (uvcb, gmap->mm)) +uv_convert_from_secure (page_to_phys (page)); rc =make_secure_pte (ptep, uaddr, page, uvcb);pte_unmap_unlock (ptep, ptelock);unlock_page (page);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/484 KVM: s390: fix race in gmap_make_secure()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudio Imbrenda <[email protected]>
[ Upstream commit c148dc8e2fa403be501612ee409db866eeed35c0 ]
Fix a potential race in gmap_make_secure() and remove the last user of follow_page() without FOLL_GET.
The old code is locking something it doesn't have a reference to, and as explained by Jason and David in this discussion:
https://lore.kernel.org/linux-mm/Y9J4P%[email protected]/
it can lead to all kind of bad things, including the page getting unmapped (MADV_DONTNEED), freed, reallocated as a larger folio and the unlock_page() would target the wrong bit.
There is also another race with the FOLL_WRITE, which could race between the follow_page() and the get_locked_pte().
The main point is to remove the last use of follow_page() without FOLL_GET or FOLL_PIN, removing the races can be considered a nice bonus.
Message-Id: <[email protected]>
Stable-dep-of: 3f29f6537f54 ("s390/uv: Don't call folio_wait_writeback() without a folio reference")
--- arch/s390/kernel/uv.c | 32 +++++++++++--------------------- 1 file changed, 11 insertions(+), 21 deletions(-)
arch/s390/kernel/uv.c +11 -21
@@ -192,21 +192,10 @@ static int expected_page_refs(struct page *page)return res; } -static int make_secure_pte (pte_t *ptep,unsigned long addr, -struct page *exp_page,struct uv_cb_header *uvcb) +static int make_page_secure (struct page *page,struct uv_cb_header *uvcb) { -pte_t entry =READ_ONCE (*ptep); -struct page *page;int expected, cc =0 ; -if (!pte_present (entry)) -return -ENXIO ; -if (pte_val (entry) & _PAGE_INVALID) -return -ENXIO ; - - page =pte_page (entry); -if (page != exp_page) -return -ENXIO ;if (PageWriteback (page))return -EAGAIN ; expected =expected_page_refs (page);
@@ -297,17 +286,18 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb) goto out; rc = -ENXIO ; - page =follow_page (vma, uaddr,FOLL_WRITE ); -if (IS_ERR_OR_NULL (page)) - goto out; - -lock_page (page); ptep =get_locked_pte (gmap->mm, uaddr, &ptelock); -if (should_export_before_import (uvcb, gmap->mm)) -uv_convert_from_secure (page_to_phys (page)); - rc =make_secure_pte (ptep, uaddr, page, uvcb); +if (pte_present (*ptep) && !(pte_val (*ptep) & _PAGE_INVALID) &&pte_write (*ptep)) { + page =pte_page (*ptep); + rc = -EAGAIN ; +if (trylock_page (page)) { +if (should_export_before_import (uvcb, gmap->mm)) +uv_convert_from_secure (page_to_phys (page)); + rc =make_page_secure (page, uvcb); +unlock_page (page); + } + }pte_unmap_unlock (ptep, ptelock); -unlock_page (page); out:mmap_read_unlock (gmap->mm);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/484 s390/mm: Convert make_page_secure to use a folio
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit 259e660d91d0e7261ae0ee37bb37266d6006a546 ]
These page APIs are deprecated, so convert the incoming page to a folio and use the folio APIs instead. The ultravisor API cannot handle large folios, so return -EINVAL if one has slipped through.
Stable-dep-of: 3f29f6537f54 ("s390/uv: Don't call folio_wait_writeback() without a folio reference")
--- arch/s390/kernel/uv.c | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-)
arch/s390/kernel/uv.c +16 -13
@@ -172,21 +172,21 @@ int uv_convert_owned_from_secure(unsigned long paddr) }/* -* Calculate the expected ref_count for a page that would otherwise have no +* Calculate the expected ref_count for a folio that would otherwise have no * further pins. This was cribbed from similar functions in other places in * the kernel, but with some slight modifications. We know that a secure -* page can not be a huge page for example. +* folio can not be a large folio, for example. */ -static int expected_page_refs (struct page *page) +static int expected_folio_refs (struct folio *folio) {int res; - res =page_mapcount (page); -if (PageSwapCache (page)) { + res =folio_mapcount (folio); +if (folio_test_swapcache (folio)) { res++; - }else if (page_mapping (page)) { + }else if (folio_mapping (folio)) { res++; -if (page_has_private (page)) +if (folio->private) res++; }return res;
@@ -194,14 +194,17 @@ static int expected_page_refs(struct page *page)static int make_page_secure (struct page *page,struct uv_cb_header *uvcb) { +struct folio *folio =page_folio (page);int expected, cc =0 ; -if (PageWriteback (page)) +if (folio_test_large (folio)) +return -EINVAL ; +if (folio_test_writeback (folio))return -EAGAIN ; - expected =expected_page_refs (page); -if (!page_ref_freeze (page, expected)) + expected =expected_folio_refs (folio); +if (!folio_ref_freeze (folio, expected))return -EBUSY ; -set_bit (PG_arch_1, &page->flags); +set_bit (PG_arch_1, &folio->flags);/* * If the UVC does not succeed or fail immediately, we don't want to * loop for long, or we might get stall notifications.
@@ -211,9 +214,9 @@ static int make_page_secure(struct page *page, struct uv_cb_header *uvcb)* -EAGAIN and we let the callers deal with it. */ cc =__uv_call (0 , (u64 )uvcb); -page_ref_unfreeze (page, expected); +folio_ref_unfreeze (folio, expected);/* -* Return -ENXIO if the page was not mapped, -EINVAL for other errors. +* Return -ENXIO if the folio was not mapped, -EINVAL for other errors. * If busy or partially completed, return -EAGAIN. */ if (cc ==UVC_CC_OK )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/484 s390/mm: Convert gmap_make_secure to use a folio
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit d35c34bb32f2cc4ec0b52e91ad7a8fcab55d7856 ]
Remove uses of deprecated page APIs, and move the check for large folios to here to avoid taking the folio lock if the folio is too large. We could do better here by attempting to split the large folio, but I'll leave that improvement for someone who can test it.
Stable-dep-of: 3f29f6537f54 ("s390/uv: Don't call folio_wait_writeback() without a folio reference")
--- arch/s390/kernel/uv.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-)
arch/s390/kernel/uv.c +14 -13
@@ -192,13 +192,10 @@ static int expected_folio_refs(struct folio *folio)return res; } -static int make_page_secure (struct page *page,struct uv_cb_header *uvcb) +static int make_folio_secure (struct folio *folio,struct uv_cb_header *uvcb) { -struct folio *folio =page_folio (page);int expected, cc =0 ; -if (folio_test_large (folio)) -return -EINVAL ;if (folio_test_writeback (folio))return -EAGAIN ; expected =expected_folio_refs (folio);
@@ -264,7 +261,7 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb)bool local_drain = false;spinlock_t *ptelock;unsigned long uaddr; -struct page *page; +struct folio *folio;pte_t *ptep;int rc;
@@ -291,15 +288,19 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb) rc = -ENXIO ; ptep =get_locked_pte (gmap->mm, uaddr, &ptelock);if (pte_present (*ptep) && !(pte_val (*ptep) & _PAGE_INVALID) &&pte_write (*ptep)) { - page =pte_page (*ptep); + folio =page_folio (pte_page (*ptep)); + rc = -EINVAL ; +if (folio_test_large (folio)) + goto unlock; rc = -EAGAIN ; -if (trylock_page (page)) { +if (folio_trylock (folio)) {if (should_export_before_import (uvcb, gmap->mm)) -uv_convert_from_secure (page_to_phys (page)); - rc =make_page_secure (page, uvcb); -unlock_page (page); +uv_convert_from_secure (PFN_PHYS (folio_pfn (folio))); + rc =make_folio_secure (folio, uvcb); +folio_unlock (folio); } } +unlock:pte_unmap_unlock (ptep, ptelock); out:mmap_read_unlock (gmap->mm);
@@ -309,10 +310,10 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb)* If we are here because the UVC returned busy or partial * completion, this is just a useless check, but it is safe. */ -wait_on_page_writeback (page); +folio_wait_writeback (folio); }else if (rc == -EBUSY ) {/* -* If we have tried a local drain and the page refcount +* If we have tried a local drain and the folio refcount * still does not match our expected safe value, try with a * system wide drain. This is needed if the pagevecs holding * the page are on a different CPU.
@@ -323,7 +324,7 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb)return -EAGAIN ; }/* -* We are here if the page refcount does not match the +* We are here if the folio refcount does not match the * expected safe value. The main culprits are usually * pagevecs. With lru_add_drain() we drain the pagevecs * on the local CPU so that hopefully the refcount will
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/484 s390/uv: Dont call folio_wait_writeback() without a folio reference
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
[ Upstream commit 3f29f6537f54d74e64bac0a390fb2e26da25800d ]
folio_wait_writeback() requires that no spinlocks are held and that a folio reference is held, as documented. After we dropped the PTL, the folio could get freed concurrently. So grab a temporary reference.
--- arch/s390/kernel/uv.c | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/s390/kernel/uv.c +8 -0
@@ -299,6 +299,13 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb) rc =make_folio_secure (folio, uvcb);folio_unlock (folio); } + +/* +* Once we drop the PTL, the folio may get unmapped and +* freed immediately. We need a temporary reference. +*/ +if (rc == -EAGAIN ) +folio_get (folio); } unlock:pte_unmap_unlock (ptep, ptelock);
@@ -311,6 +318,7 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb)* completion, this is just a useless check, but it is safe. */ folio_wait_writeback (folio); +folio_put (folio); }else if (rc == -EBUSY ) {/* * If we have tried a local drain and the folio refcount
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/484 saa7134: Unchecked i2c_transfer function result fixed
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Burakov <[email protected]>
[ Upstream commit 9d8683b3fd93f0e378f24dc3d9604e5d7d3e0a17 ]
Return value of function 'i2c_transfer' is not checked that may cause undefined behaviour.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/media/pci/saa7134/saa7134-dvb.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/media/pci/saa7134/saa7134-dvb.c +6 -2
@@ -466,7 +466,9 @@ static int philips_europa_tuner_sleep(struct dvb_frontend *fe)/* switch the board to analog mode */ if (fe->ops.i2c_gate_ctrl) fe->ops.i2c_gate_ctrl (fe,1 ); -i2c_transfer (&dev->i2c_adap, &analog_msg,1 ); +if (i2c_transfer (&dev->i2c_adap, &analog_msg,1 ) !=1 ) +return -EIO ; +return 0 ; }
@@ -1018,7 +1020,9 @@ static int md8800_set_voltage2(struct dvb_frontend *fe,else wbuf[1 ] = rbuf &0xef ; msg[0 ].len =2 ; -i2c_transfer (&dev->i2c_adap, msg,1 ); +if (i2c_transfer (&dev->i2c_adap, msg,1 ) !=1 ) +return -EIO ; +return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/484 media: uvcvideo: Override default flags
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Schaefer <[email protected]>
[ Upstream commit 86419686e66da5b90a07fb8a40ab138fe97189b5 ]
When the UVC device has a control that is readonly it doesn't set the SET_CUR flag. For example the privacy control has SET_CUR flag set in the defaults in the uvc_ctrls variable. Even if the device does not have it set, it's not cleared by uvc_ctrl_get_flags().
Originally written with assignment in commit 859086ae3636 ("media:
uvcvideo: Apply flags from device to actual properties"). But changed to |= in commit 0dc68cabdb62 ("media: uvcvideo: Prevent setting unavailable flags"). It would not clear the default flags.
With this patch applied the correct flags are reported to user space. Tested with:
``` > v4l2-ctl --list-ctrls | grep privacy privacy 0x009a0910 (bool) : default=0 value=0 flags=read-only ```
--- drivers/media/usb/uvc/uvc_ctrl.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/media/usb/uvc/uvc_ctrl.c +8 -1
@@ -1868,7 +1868,13 @@ static int uvc_ctrl_get_flags(struct uvc_device *dev,else ret =uvc_query_ctrl (dev,UVC_GET_INFO , ctrl->entity->id, dev->intfnum, info->selector, data,1 ); -if (!ret) + +if (!ret) { + info->flags &= ~(UVC_CTRL_FLAG_GET_CUR | +UVC_CTRL_FLAG_SET_CUR | +UVC_CTRL_FLAG_AUTO_UPDATE | +UVC_CTRL_FLAG_ASYNCHRONOUS ); + info->flags |= (data[0 ] &UVC_CONTROL_CAP_GET ?UVC_CTRL_FLAG_GET_CUR :0 ) | (data[0] & UVC_CONTROL_CAP_SET ?
@@ -1877,6 +1883,7 @@ static int uvc_ctrl_get_flags(struct uvc_device *dev, UVC_CTRL_FLAG_AUTO_UPDATE : 0) | (data[0 ] &UVC_CONTROL_CAP_ASYNCHRONOUS ?UVC_CTRL_FLAG_ASYNCHRONOUS :0 ); + }kfree (data);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/484 media: renesas: vsp1: Fix _irqsave and _irq mix
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <[email protected]>
[ Upstream commit 57edbbcf5258c378a9b9d0c80d33b03a010b22c8 ]
The histogram support mixes _irqsave and _irq, causing the following smatch warning:
drivers/media/platform/renesas/vsp1/vsp1_histo.c:153 histo_stop_streaming()
warn: mixing irqsave and irq
The histo_stop_streaming() calls spin_lock_irqsave() followed by wait_event_lock_irq(). The former hints that interrupts may be disabled by the caller, while the latter reenables interrupts unconditionally. This doesn't cause any real bug, as the function is always called with interrupts enabled, but the pattern is still incorrect.
Fix the problem by using spin_lock_irq() instead of spin_lock_irqsave() in histo_stop_streaming(). While at it, switch to spin_lock_irq() and spin_lock() as appropriate elsewhere.
--- drivers/media/platform/vsp1/vsp1_histo.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-)
drivers/media/platform/vsp1/vsp1_histo.c +8 -12
@@ -36,9 +36,8 @@ struct vsp1_histogram_buffer * vsp1_histogram_buffer_get(struct vsp1_histogram *histo) {struct vsp1_histogram_buffer *buf =NULL ; -unsigned long flags; -spin_lock_irqsave (&histo->irqlock, flags); +spin_lock (&histo->irqlock);if (list_empty (&histo->irqqueue)) goto done;
@@ -49,7 +48,7 @@ vsp1_histogram_buffer_get(struct vsp1_histogram *histo) histo->readout = true; done: -spin_unlock_irqrestore (&histo->irqlock, flags); +spin_unlock (&histo->irqlock);return buf; }
@@ -58,7 +57,6 @@ void vsp1_histogram_buffer_complete(struct vsp1_histogram *histo, size_t size) {struct vsp1_pipeline *pipe = histo->entity.pipe; -unsigned long flags;/* * The pipeline pointer is guaranteed to be valid as this function is
@@ -70,10 +68,10 @@ void vsp1_histogram_buffer_complete(struct vsp1_histogram *histo,vb2_set_plane_payload (&buf->buf.vb2_buf,0 , size);vb2_buffer_done (&buf->buf.vb2_buf,VB2_BUF_STATE_DONE ); -spin_lock_irqsave (&histo->irqlock, flags); +spin_lock (&histo->irqlock); histo->readout = false;wake_up (&histo->wait_queue); -spin_unlock_irqrestore (&histo->irqlock, flags); +spin_unlock (&histo->irqlock); }/* -----------------------------------------------------------------------------
@@ -124,11 +122,10 @@ static void histo_buffer_queue(struct vb2_buffer *vb)struct vb2_v4l2_buffer *vbuf =to_vb2_v4l2_buffer (vb);struct vsp1_histogram *histo =vb2_get_drv_priv (vb->vb2_queue);struct vsp1_histogram_buffer *buf =to_vsp1_histogram_buffer (vbuf); -unsigned long flags; -spin_lock_irqsave (&histo->irqlock, flags); +spin_lock_irq (&histo->irqlock);list_add_tail (&buf->queue, &histo->irqqueue); -spin_unlock_irqrestore (&histo->irqlock, flags); +spin_unlock_irq (&histo->irqlock); }static int histo_start_streaming (struct vb2_queue *vq,unsigned int count)
@@ -140,9 +137,8 @@ static void histo_stop_streaming(struct vb2_queue *vq) {struct vsp1_histogram *histo =vb2_get_drv_priv (vq);struct vsp1_histogram_buffer *buffer; -unsigned long flags; -spin_lock_irqsave (&histo->irqlock, flags); +spin_lock_irq (&histo->irqlock);/* Remove all buffers from the IRQ queue. */ list_for_each_entry (buffer, &histo->irqqueue, queue)
@@ -152,7 +148,7 @@ static void histo_stop_streaming(struct vb2_queue *vq)/* Wait for the buffer being read out (if any) to complete. */ wait_event_lock_irq (histo->wait_queue, !histo->readout, histo->irqlock); -spin_unlock_irqrestore (&histo->irqlock, flags); +spin_unlock_irq (&histo->irqlock); }static const struct vb2_ops histo_video_queue_qops = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/484 media: renesas: vsp1: Store RPF partition configuration per RPF instance
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <[email protected]>
[ Upstream commit a213bc09b1025c771ee722ee341af1d84375db8a ]
The vsp1_partition structure stores the RPF partition configuration in a single field for all RPF instances, while each RPF can have its own configuration. Fix it by storing the configuration separately for each RPF instance.
--- drivers/media/platform/vsp1/vsp1_pipe.h | 2 +- drivers/media/platform/vsp1/vsp1_rpf.c | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-)
drivers/media/platform/vsp1/vsp1_pipe.h +1 -1
@@ -73,7 +73,7 @@ struct vsp1_partition_window {* @wpf: The WPF partition window configuration */ struct vsp1_partition { -struct vsp1_partition_window rpf; +struct vsp1_partition_window rpf[VSP1_MAX_RPF ];struct vsp1_partition_window uds_sink;struct vsp1_partition_window uds_source;struct vsp1_partition_window sru;
drivers/media/platform/vsp1/vsp1_rpf.c +5 -3
@@ -271,8 +271,8 @@ static void rpf_configure_partition(struct vsp1_entity *entity,* 'width' need to be adjusted. */ if (pipe->partitions >1 ) { - crop.width = pipe->partition->rpf.width; - crop.left += pipe->partition->rpf.left; + crop.width = pipe->partition->rpf[rpf->entity.index].width; + crop.left += pipe->partition->rpf[rpf->entity.index].left; }if (pipe->interlaced) {
@@ -327,7 +327,9 @@ static void rpf_partition(struct vsp1_entity *entity,unsigned int partition_idx, struct vsp1_partition_window *window) { - partition->rpf = *window; + struct vsp1_rwpf *rpf = to_rwpf(&entity->subdev); + + partition->rpf[rpf->entity.index] = *window; } static const struct vsp1_entity_operations rpf_entity_ops = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/484 drm/mediatek: Add missing plane settings when async update
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hsiao Chien Sung <[email protected]>
[ Upstream commit 86b89dc669c400576dc23aa923bcf302f99e8e3a ]
Fix an issue that plane coordinate was not saved when calling async update.
--- drivers/gpu/drm/mediatek/mtk_drm_plane.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/mediatek/mtk_drm_plane.c +2 -0
@@ -154,6 +154,8 @@ static void mtk_plane_atomic_async_update(struct drm_plane *plane, plane->state->src_y = new_state->src_y; plane->state->src_h = new_state->src_h; plane->state->src_w = new_state->src_w; + plane->state->dst.x1 = new_state->dst.x1; + plane->state->dst.y1 = new_state->dst.y1;mtk_plane_update_new_state (new_state, new_plane_state);swap (plane->state->fb, new_state->fb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/484 drm/mediatek: Add DRM_MODE_ROTATE_0 to rotation property
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hsiao Chien Sung <[email protected]>
[ Upstream commit 74608d8feefd1675388f23362aac8df4ac3af931 ]
Always add DRM_MODE_ROTATE_0 to rotation property to meet IGT's (Intel GPU Tools) requirement.
--- drivers/gpu/drm/mediatek/mtk_disp_ovl.c | 17 +++++------------ drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h | 6 +++++- drivers/gpu/drm/mediatek/mtk_drm_plane.c | 2 +- 3 files changed, 11 insertions(+), 14 deletions(-)
drivers/gpu/drm/mediatek/mtk_disp_ovl.c +5 -12
@@ -204,27 +204,20 @@ int mtk_ovl_layer_check(struct device *dev, unsigned int idx, struct mtk_plane_state *mtk_state) {struct drm_plane_state *state = &mtk_state->base; -unsigned int rotation =0 ; - rotation =drm_rotation_simplify (state->rotation, -DRM_MODE_ROTATE_0 | -DRM_MODE_REFLECT_X | -DRM_MODE_REFLECT_Y ); - rotation &= ~DRM_MODE_ROTATE_0 ; - -/* We can only do reflection, not rotation */ -if ((rotation &DRM_MODE_ROTATE_MASK ) !=0 ) +/* check if any unsupported rotation is set */ +if (state->rotation & ~mtk_ovl_supported_rotations (dev))return -EINVAL ;/* * TODO: Rotating/reflecting YUV buffers is not supported at this time. * Only RGB[AX] variants are supported. +* Since DRM_MODE_ROTATE_0 means "no rotation", we should not +* reject layers with this property. */ -if (state->fb->format->is_yuv && rotation !=0 ) +if (state->fb->format->is_yuv && (state->rotation & ~DRM_MODE_ROTATE_0 ))return -EINVAL ; - state->rotation = rotation; -return 0 ; }
drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h +5 -1
@@ -145,7 +145,11 @@ unsigned int mtk_ddp_comp_supported_rotations(struct mtk_ddp_comp *comp)if (comp->funcs && comp->funcs->supported_rotations)return comp->funcs->supported_rotations (comp->dev); -return 0 ; +/* +* In order to pass IGT tests, DRM_MODE_ROTATE_0 is required when +* rotation is not supported. +*/ +return DRM_MODE_ROTATE_0 ; }static inline unsigned int mtk_ddp_comp_layer_nr (struct mtk_ddp_comp *comp)
drivers/gpu/drm/mediatek/mtk_drm_plane.c +1 -1
@@ -258,7 +258,7 @@ int mtk_plane_init(struct drm_device *dev, struct drm_plane *plane,return err; } -if (supported_rotations & ~DRM_MODE_ROTATE_0 ) { +if (supported_rotations) { err =drm_plane_create_rotation_property (plane,DRM_MODE_ROTATE_0 , supported_rotations);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/484 leds: trigger: Unregister sysfs attributes before calling deactivate()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit c0dc9adf9474ecb7106e60e5472577375aedaed3 ]
Triggers which have trigger specific sysfs attributes typically store related data in trigger-data allocated by the activate() callback and freed by the deactivate() callback.
Calling device_remove_groups() after calling deactivate() leaves a window where the sysfs attributes show/store functions could be called after deactivation and then operate on the just freed trigger-data.
Move the device_remove_groups() call to before deactivate() to close this race window.
This also makes the deactivation path properly do things in reverse order of the activation path which calls the activate() callback before calling device_add_groups().
--- drivers/leds/led-triggers.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/leds/led-triggers.c +1 -1
@@ -177,9 +177,9 @@ int led_trigger_set(struct led_classdev *led_cdev, struct led_trigger *trig) flags);cancel_work_sync (&led_cdev->set_brightness_work);led_stop_software_blink (led_cdev); +device_remove_groups (led_cdev->dev, led_cdev->trigger->groups);if (led_cdev->trigger->deactivate) led_cdev->trigger->deactivate (led_cdev); -device_remove_groups (led_cdev->dev, led_cdev->trigger->groups); led_cdev->trigger =NULL ; led_cdev->trigger_data =NULL ; led_cdev->activated = false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/484 perf report: Fix condition in sort__sym_cmp()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit cb39d05e67dc24985ff9f5150e71040fa4d60ab8 ]
It's expected that both hist entries are in the same hists when comparing two. But the current code in the function checks one without dso sort key and other with the key. This would make the condition true in any case.
I guess the intention of the original commit was to add '!' for the right side too. But as it should be the same, let's just remove it.
--- tools/perf/util/sort.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/sort.c +1 -1
@@ -275,7 +275,7 @@ sort__sym_cmp(struct hist_entry *left, struct hist_entry *right)* comparing symbol address alone is not enough since it's a * relative address within a dso. */ -if (!hists__has (left->hists, dso) ||hists__has (right->hists, dso)) { +if (!hists__has (left->hists, dso)) { ret =sort__dso_cmp (left, right);if (ret !=0 )return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/484 drm/etnaviv: fix DMA direction handling for cached RW buffers
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Stach <[email protected]>
[ Upstream commit 58979ad6330a70450ed78837be3095107d022ea9 ]
The dma sync operation needs to be done with DMA_BIDIRECTIONAL when the BO is prepared for both read and write operations.
--- drivers/gpu/drm/etnaviv/etnaviv_gem.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/etnaviv/etnaviv_gem.c +4 -2
@@ -353,9 +353,11 @@ static void *etnaviv_gem_vmap_impl(struct etnaviv_gem_object *obj)static inline enum dma_data_direction etnaviv_op_to_dma_dir (u32 op) { -if (op &ETNA_PREP_READ ) + op &=ETNA_PREP_READ |ETNA_PREP_WRITE ; + +if (op ==ETNA_PREP_READ )return DMA_FROM_DEVICE ; -else if (op &ETNA_PREP_WRITE ) +else if (op ==ETNA_PREP_WRITE )return DMA_TO_DEVICE ;else return DMA_BIDIRECTIONAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/484 drm/qxl: Add check for drm_cvt_mode
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit 7bd09a2db0f617377027a2bb0b9179e6959edff3 ]
Add check for the return value of drm_cvt_mode() and return the error if it fails in order to avoid NULL pointer dereference.
--- drivers/gpu/drm/qxl/qxl_display.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/qxl/qxl_display.c +3 -0
@@ -233,6 +233,9 @@ static int qxl_add_mode(struct drm_connector *connector,return 0 ; mode =drm_cvt_mode (dev, width, height,60 , false, false, false); +if (!mode) +return 0 ; +if (preferred) mode->type |=DRM_MODE_TYPE_PREFERRED ; mode->hdisplay = width;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/484 Revert "leds: led-core: Fix refcount leak in of_led_get()"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Ceresoli <[email protected]>
[ Upstream commit 940b27161afc6ec53fc66245a4fb3518394cdc92 ]
This reverts commit da1afe8e6099980fe1e2fd7436dca284af9d3f29.
Commit 699a8c7c4bd3 ("leds: Add of_led_get() and led_put()"), introduced in 5.5, added of_led_get() and led_put() but missed a put_device() in led_put(), thus creating a leak in case the consumer device is removed.
Arguably device removal was not very popular, so this went apparently unnoticed until 2022. In January 2023 two different patches got merged to fix the same bug:
- commit da1afe8e6099 ("leds: led-core: Fix refcount leak in of_led_get()")
- commit 445110941eb9 ("leds: led-class: Add missing put_device() to led_put()")
They fix the bug in two different ways, which creates no patch conflicts, and both were merged in v6.2. The result is that now there is one more put_device() than get_device()s, instead of one less.
Arguably device removal is not very popular yet, so this apparently hasn't been noticed as well up to now. But it blew up here while I'm working with device tree overlay insertion and removal. The symptom is an apparently unrelated list of oopses on device removal, with reasons:
kernfs: can not remove 'uevent', no directory
kernfs: can not remove 'brightness', no directory
kernfs: can not remove 'max_brightness', no directory
...
Here sysfs fails removing attribute files, which is because the device name changed and so the sysfs path. This is because the device name string got corrupted, which is because it got freed too early and its memory reused.
Different symptoms could appear in different use cases.
Fix by removing one of the two fixes.
The choice was to remove commit da1afe8e6099 because:
* it is calling put_device() inside of_led_get() just after getting the device, thus it is basically not refcounting the LED device at all during its entire lifetime
* it does not add a corresponding put_device() in led_get(), so it fixes only the OF case
The other fix (445110941eb9) is adding the put_device() in led_put() so it covers the entire lifetime, and it works even in the non-DT case.
--- drivers/leds/led-class.c | 1 - 1 file changed, 1 deletion(-)
drivers/leds/led-class.c +0 -1
@@ -235,7 +235,6 @@ struct led_classdev *of_led_get(struct device_node *np, int index) led_dev =class_find_device_by_of_node (leds_class, led_node);of_node_put (led_node); -put_device (led_dev);if (!led_dev)return ERR_PTR (-EPROBE_DEFER );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/484 ext4: fix infinite loop when replaying fast_commit
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luis Henriques (SUSE) <[email protected]>
[ Upstream commit 907c3fe532253a6ef4eb9c4d67efb71fab58c706 ]
When doing fast_commit replay an infinite loop may occur due to an uninitialized extent_status struct. ext4_ext_determine_insert_hole() does not detect the replay and calls ext4_es_find_extent_range(), which will return immediately without initializing the 'es' variable.
Because 'es' contains garbage, an integer overflow may happen causing an infinite loop in this function, easily reproducible using fstest generic/039.
This commit fixes this issue by unconditionally initializing the structure in function ext4_es_find_extent_range().
Thanks to Zhang Yi, for figuring out the real problem!
--- fs/ext4/extents_status.c | 2 ++ 1 file changed, 2 insertions(+)
fs/ext4/extents_status.c +2 -0
@@ -312,6 +312,8 @@ void ext4_es_find_extent_range(struct inode *inode, ext4_lblk_t lblk, ext4_lblk_t end, struct extent_status *es) { + es->es_lblk = es->es_len = es->es_pblk = 0; +if (EXT4_SB (inode->i_sb)->s_mount_state &EXT4_FC_REPLAY )return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/484 media: venus: flush all buffers in output plane streamoff
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dikshita Agarwal <[email protected]>
[ Upstream commit e750a4b1224142bd8dd057b0d5adf8a5608b7e77 ]
For scenarios, when source change is followed by VIDIOC_STREAMOFF on output plane, driver should discard any queued OUTPUT buffers, which are not decoded or dequeued.
Flush with HFI_FLUSH_INPUT does not have any actual impact. So, fix it, by invoking HFI_FLUSH_ALL, which will flush all queued buffers.
--- drivers/media/platform/qcom/venus/vdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/qcom/venus/vdec.c +1 -1
@@ -1165,7 +1165,7 @@ static int vdec_stop_output(struct venus_inst *inst)break ;case VENUS_DEC_STATE_INIT :case VENUS_DEC_STATE_CAPTURE_SETUP : - ret =hfi_session_flush (inst,HFI_FLUSH_INPUT , true); + ret =hfi_session_flush (inst,HFI_FLUSH_ALL , true);break ;default :break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/484 perf intel-pt: Fix aux_watermark calculation for 64-bit size
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit 36b4cd990a8fd3f5b748883050e9d8c69fe6398d ]
aux_watermark is a u32. For a 64-bit size, cap the aux_watermark calculation at UINT_MAX instead of truncating it to 32-bits.
--- tools/perf/arch/x86/util/intel-pt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/perf/arch/x86/util/intel-pt.c +2 -1
@@ -777,7 +777,8 @@ static int intel_pt_recording_options(struct auxtrace_record *itr, }if (!opts->auxtrace_snapshot_mode && !opts->auxtrace_sample_mode) { -u32 aux_watermark = opts->auxtrace_mmap_pages * page_size /4 ; +size_t aw = opts->auxtrace_mmap_pages * (size_t )page_size /4 ; +u32 aux_watermark = aw >UINT_MAX ?UINT_MAX : aw; intel_pt_evsel->core.attr.aux_watermark = aux_watermark; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/484 perf intel-pt: Fix exclude_guest setting
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit b40934ae32232140e85dc7dc1c3ea0e296986723 ]
In the past, the exclude_guest setting has had no effect on Intel PT tracing, but that may not be the case in the future.
Set the flag correctly based upon whether KVM is using Intel PT "Host/Guest" mode, which is determined by the kvm_intel module parameter pt_mode:
pt_mode=0 System-wide mode : host and guest output to host buffer
pt_mode=1 Host/Guest mode : host/guest output to host/guest
buffers respectively
--- tools/perf/arch/x86/util/intel-pt.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
tools/perf/arch/x86/util/intel-pt.c +12 -0
@@ -31,6 +31,7 @@#include "../../../util/tsc.h" #include <internal/lib.h> // page_size #include "../../../util/intel-pt.h" +#include <api/fs/fs.h> #define KiB (x) ((x) * 1024)#define MiB (x) ((x) * 1024 * 1024)
@@ -438,6 +439,16 @@ static int intel_pt_track_switches(struct evlist *evlist)return 0 ; } +static bool intel_pt_exclude_guest (void ) +{ +int pt_mode; + +if (sysfs__read_int ("module/kvm_intel/parameters/pt_mode" , &pt_mode)) + pt_mode =0 ; + +return pt_mode ==1 ; +} +static void intel_pt_valid_str (char *str,size_t len,u64 valid) {unsigned int val, last =0 , state =1 ;
@@ -641,6 +652,7 @@ static int intel_pt_recording_options(struct auxtrace_record *itr, } evsel->core.attr.freq =0 ; evsel->core.attr.sample_period =1 ; + evsel->core.attr.exclude_guest =intel_pt_exclude_guest (); evsel->no_aux_samples = true; intel_pt_evsel = evsel; opts->full_auxtrace = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/484 mfd: rsmu: Split core code into separate module
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit c879a8c39dd55e7fabdd8d13341f7bc5200db377 ]
Linking a file into two modules can have unintended side-effects and produces a W=1 warning:
scripts/Makefile.build:236: drivers/mfd/Makefile: rsmu_core.o is added to multiple modules: rsmu-i2c rsmu-spi
Make this one a separate module instead.
--- drivers/mfd/Makefile | 6 ++---- drivers/mfd/rsmu_core.c | 2 ++ 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/mfd/Makefile +2 -4
@@ -274,7 +274,5 @@ obj-$(CONFIG_MFD_INTEL_M10_BMC) += intel-m10-bmc.o obj-$(CONFIG_MFD_ATC260X) += atc260x-core.o obj-$(CONFIG_MFD_ATC260X_I2C) += atc260x-i2c.o -rsmu-i2c-objs := rsmu_core.o rsmu_i2c.o -rsmu-spi-objs := rsmu_core.o rsmu_spi.o -obj-$(CONFIG_MFD_RSMU_I2C) += rsmu-i2c.o -obj-$(CONFIG_MFD_RSMU_SPI) += rsmu-spi.o +obj-$(CONFIG_MFD_RSMU_I2C) += rsmu_i2c.o rsmu_core.o +obj-$(CONFIG_MFD_RSMU_SPI) += rsmu_spi.o rsmu_core.o
drivers/mfd/rsmu_core.c +2 -0
@@ -78,11 +78,13 @@ int rsmu_core_init(struct rsmu_ddata *rsmu)return ret; } +EXPORT_SYMBOL_GPL (rsmu_core_init);void rsmu_core_exit (struct rsmu_ddata *rsmu) {mutex_destroy (&rsmu->lock); } +EXPORT_SYMBOL_GPL (rsmu_core_exit);MODULE_DESCRIPTION ("Renesas SMU core driver" );MODULE_LICENSE ("GPL" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/484 mfd: omap-usb-tll: Use struct_size to allocate tll
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
[ Upstream commit 40176714c818b0b6a2ca8213cdb7654fbd49b742 ]
Commit 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once") changed the memory allocation of 'tll' to consolidate it into a single allocation, introducing an incorrect size calculation.
In particular, the allocation for the array of pointers was converted into a single-pointer allocation.
The memory allocation used to occur in two steps:
tll = devm_kzalloc(dev, sizeof(struct usbtll_omap), GFP_KERNEL); tll->ch_clk = devm_kzalloc(dev, sizeof(struct clk *) * tll->nch,
GFP_KERNEL);
And it turned that into the following allocation:
tll = devm_kzalloc(dev, sizeof(*tll) + sizeof(tll->ch_clk[nch]),
GFP_KERNEL);
sizeof(tll->ch_clk[nch]) returns the size of a single pointer instead of the expected nch pointers.
This bug went unnoticed because the allocation size was small enough to fit within the minimum size of a memory allocation for this particular case [1].
The complete allocation can still be done at once with the struct_size macro, which comes in handy for structures with a trailing flexible array.
Fix the memory allocation to obtain the original size again.
--- drivers/mfd/omap-usb-tll.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/mfd/omap-usb-tll.c +1 -2
@@ -237,8 +237,7 @@ static int usbtll_omap_probe(struct platform_device *pdev)break ; } - tll =devm_kzalloc (dev,sizeof (*tll) +sizeof (tll->ch_clk[nch]), -GFP_KERNEL ); + tll =devm_kzalloc (dev,struct_size (tll, ch_clk, nch),GFP_KERNEL );if (!tll) {pm_runtime_put_sync (dev);pm_runtime_disable (dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/484 xprtrdma: Fix rpcrdma_reqs_reset()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit acd9f2dd23c632568156217aac7a05f5a0313152 ]
Avoid FastReg operations getting MW_BIND_ERR after a reconnect.
rpcrdma_reqs_reset() is called on transport tear-down to get each rpcrdma_req back into a clean state.
MRs on req->rl_registered are waiting for a FastReg, are already registered, or are waiting for invalidation. If the transport is being torn down when reqs_reset() is called, the matching LocalInv might never be posted. That leaves these MR registered /and/ on req->rl_free_mrs, where they can be re-used for the next connection.
Since xprtrdma does not keep specific track of the MR state, it's not possible to know what state these MRs are in, so the only safe thing to do is release them immediately.
--- net/sunrpc/xprtrdma/frwr_ops.c | 3 ++- net/sunrpc/xprtrdma/verbs.c | 16 +++++++++++++++- 2 files changed, 17 insertions(+), 2 deletions(-)
net/sunrpc/xprtrdma/frwr_ops.c +2 -1
@@ -96,7 +96,8 @@ static void frwr_mr_put(struct rpcrdma_mr *mr)rpcrdma_mr_push (mr, &mr->mr_req->rl_free_mrs); } -/* frwr_reset - Place MRs back on the free list +/** +* frwr_reset - Place MRs back on @req's free list * @req: request to reset * * Used after a failed marshal. For FRWR, this means the MRs
net/sunrpc/xprtrdma/verbs.c +15 -1
@@ -924,6 +924,8 @@ static int rpcrdma_reqs_setup(struct rpcrdma_xprt *r_xprt)static void rpcrdma_req_reset (struct rpcrdma_req *req) { +struct rpcrdma_mr *mr; +/* Credits are valid for only one connection */ req->rl_slot.rq_cong =0 ;
@@ -933,7 +935,19 @@ static void rpcrdma_req_reset(struct rpcrdma_req *req)rpcrdma_regbuf_dma_unmap (req->rl_sendbuf);rpcrdma_regbuf_dma_unmap (req->rl_recvbuf); -frwr_reset (req); +/* The verbs consumer can't know the state of an MR on the +* req->rl_registered list unless a successful completion +* has occurred, so they cannot be re-used. +*/ +while ((mr =rpcrdma_mr_pop (&req->rl_registered))) { +struct rpcrdma_buffer *buf = &mr->mr_xprt->rx_buf; + +spin_lock (&buf->rb_lock); +list_del (&mr->mr_all); +spin_unlock (&buf->rb_lock); + +frwr_mr_release (mr); + } }/* ASSUMPTION: the rb_allreqs list is stable for the duration,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/484 SUNRPC: avoid soft lockup when transmitting UDP to reachable server.
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
[ Upstream commit 6258cf25d5e3155c3219ab5a79b970eef7996356 ]
Prior to the commit identified below, call_transmit_status() would handle -EPERM and other errors related to an unreachable server by falling through to call_status() which added a 3-second delay and handled the failure as a timeout.
Since that commit, call_transmit_status() falls through to handle_bind(). For UDP this moves straight on to handle_connect() and handle_transmit() so we immediately retransmit - and likely get the same error.
This results in an indefinite loop in __rpc_execute() which triggers a soft-lockup warning.
For the errors that indicate an unreachable server, call_transmit_status() should fall back to call_status() as it did before. This cannot cause the thundering herd that the previous patch was avoiding, as the call_status() will insert a delay.
--- net/sunrpc/clnt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sunrpc/clnt.c +2 -1
@@ -2226,12 +2226,13 @@ call_transmit_status(struct rpc_task *task) task->tk_action = call_transmit; task->tk_status =0 ;break ; -case -ECONNREFUSED :case -EHOSTDOWN :case -ENETDOWN :case -EHOSTUNREACH :case -ENETUNREACH :case -EPERM : +break ; +case -ECONNREFUSED :if (RPC_IS_SOFTCONN (task)) {if (!task->tk_msg.rpc_proc->p_proc) trace_xprt_ping(task->tk_xprt,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/484 NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <[email protected]>
[ Upstream commit 4840c00003a2275668a13b82c9f5b1aed80183aa ]
Previously in order to mark the communication with the DS server, we tried to use NFS_CS_DS in cl_flags. However, this flag would only be saved for the DS server and in case where DS equals MDS, the client would not find a matching nfs_client in nfs_match_client that represents the MDS (but is also a DS).
Instead, don't rely on the NFS_CS_DS but instead use NFS_CS_PNFS.
--- fs/nfs/nfs4client.c | 6 ++---- fs/nfs/nfs4proc.c | 2 +- 2 files changed, 3 insertions(+), 5 deletions(-)
fs/nfs/nfs4client.c +2 -4
@@ -230,9 +230,8 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)__set_bit (NFS_CS_INFINITE_SLOTS , &clp->cl_flags);__set_bit (NFS_CS_DISCRTRY , &clp->cl_flags);__set_bit (NFS_CS_NO_RETRANS_TIMEOUT , &clp->cl_flags); - -if (test_bit (NFS_CS_DS , &cl_init->init_flags)) -__set_bit (NFS_CS_DS , &clp->cl_flags); +if (test_bit (NFS_CS_PNFS , &cl_init->init_flags)) +__set_bit (NFS_CS_PNFS , &clp->cl_flags);/* * Set up the connection to the server before we add add to the * global list.
@@ -997,7 +996,6 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv,if (mds_srv->flags &NFS_MOUNT_NORESVPORT )__set_bit (NFS_CS_NORESVPORT , &cl_init.init_flags); -__set_bit (NFS_CS_DS , &cl_init.init_flags);__set_bit (NFS_CS_PNFS , &cl_init.init_flags); cl_init.max_connect =NFS_MAX_TRANSPORTS ;/*
fs/nfs/nfs4proc.c +1 -1
@@ -8718,7 +8718,7 @@ nfs4_run_exchange_id(struct nfs_client *clp, const struct cred *cred,#ifdef CONFIG_NFS_V4_1_MIGRATION calldata->args.flags |=EXCHGID4_FLAG_SUPP_MOVED_MIGR ;#endif -if (test_bit (NFS_CS_DS , &clp->cl_flags)) +if (test_bit (NFS_CS_PNFS , &clp->cl_flags)) calldata->args.flags |=EXCHGID4_FLAG_USE_PNFS_DS ; msg.rpc_argp = &calldata->args; msg.rpc_resp = &calldata->res;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/484 ext4: return early for non-eligible fast_commit track events
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ritesh Harjani <[email protected]>
[ Upstream commit 78be0471da4e9fff874307d73d68f0173fa6a154 ]
Currently ext4_fc_track_template() checks, whether the trace event path belongs to replay or does sb has ineligible set, if yes it simply returns. This patch pulls those checks before calling ext4_fc_track_template() in the callers of ext4_fc_track_template().
[ Add checks to ext4_rename() which calls the __ext4_fc_track_*()
functions directly. -- TYT ]
Stable-dep-of: 7882b0187bbe ("ext4: don't track ranges in fast_commit if inode has inlined data")
--- fs/ext4/fast_commit.c | 59 +++++++++++++++++++++++++++++++++++-------- fs/ext4/namei.c | 15 ++++++++--- 2 files changed, 60 insertions(+), 14 deletions(-)
fs/ext4/fast_commit.c +49 -10
@@ -353,13 +353,6 @@ static int ext4_fc_track_template(tid_t tid =0 ;int ret; -if (!test_opt2 (inode->i_sb,JOURNAL_FAST_COMMIT ) || - (sbi->s_mount_state &EXT4_FC_REPLAY )) -return -EOPNOTSUPP ; - -if (ext4_test_mount_flag (inode->i_sb,EXT4_MF_FC_INELIGIBLE )) -return -EINVAL ; - tid = handle->h_transaction->t_tid;mutex_lock (&ei->i_fc_lock);if (tid == ei->i_sync_tid) {
@@ -468,7 +461,17 @@ void __ext4_fc_track_unlink(handle_t *handle,void ext4_fc_track_unlink (handle_t *handle,struct dentry *dentry) { -__ext4_fc_track_unlink (handle,d_inode (dentry), dentry); +struct inode *inode =d_inode (dentry); +struct ext4_sb_info *sbi =EXT4_SB (inode->i_sb); + +if (!test_opt2 (inode->i_sb,JOURNAL_FAST_COMMIT ) || + (sbi->s_mount_state &EXT4_FC_REPLAY )) +return ; + +if (ext4_test_mount_flag (inode->i_sb,EXT4_MF_FC_INELIGIBLE )) +return ; + +__ext4_fc_track_unlink (handle, inode, dentry); } void __ext4_fc_track_link(handle_t *handle,
@@ -487,7 +490,17 @@ void __ext4_fc_track_link(handle_t *handle,void ext4_fc_track_link (handle_t *handle,struct dentry *dentry) { -__ext4_fc_track_link (handle,d_inode (dentry), dentry); +struct inode *inode =d_inode (dentry); +struct ext4_sb_info *sbi =EXT4_SB (inode->i_sb); + +if (!test_opt2 (inode->i_sb,JOURNAL_FAST_COMMIT ) || + (sbi->s_mount_state &EXT4_FC_REPLAY )) +return ; + +if (ext4_test_mount_flag (inode->i_sb,EXT4_MF_FC_INELIGIBLE )) +return ; + +__ext4_fc_track_link (handle, inode, dentry); } void __ext4_fc_track_create(handle_t *handle, struct inode *inode,
@@ -506,7 +519,17 @@ void __ext4_fc_track_create(handle_t *handle, struct inode *inode,void ext4_fc_track_create (handle_t *handle,struct dentry *dentry) { -__ext4_fc_track_create (handle,d_inode (dentry), dentry); +struct inode *inode =d_inode (dentry); +struct ext4_sb_info *sbi =EXT4_SB (inode->i_sb); + +if (!test_opt2 (inode->i_sb,JOURNAL_FAST_COMMIT ) || + (sbi->s_mount_state &EXT4_FC_REPLAY )) +return ; + +if (ext4_test_mount_flag (inode->i_sb,EXT4_MF_FC_INELIGIBLE )) +return ; + +__ext4_fc_track_create (handle, inode, dentry); }/* __track_fn for inode tracking */
@@ -522,6 +545,7 @@ static int __track_inode(struct inode *inode, void *arg, bool update)void ext4_fc_track_inode (handle_t *handle,struct inode *inode) { +struct ext4_sb_info *sbi =EXT4_SB (inode->i_sb);int ret;if (S_ISDIR (inode->i_mode))
@@ -533,6 +557,13 @@ void ext4_fc_track_inode(handle_t *handle, struct inode *inode)return ; } +if (!test_opt2 (inode->i_sb,JOURNAL_FAST_COMMIT ) || + (sbi->s_mount_state &EXT4_FC_REPLAY )) +return ; + +if (ext4_test_mount_flag (inode->i_sb,EXT4_MF_FC_INELIGIBLE )) +return ; + ret =ext4_fc_track_template (handle, inode, __track_inode,NULL ,1 );trace_ext4_fc_track_inode (inode, ret); }
@@ -572,12 +603,20 @@ static int __track_range(struct inode *inode, void *arg, bool update)void ext4_fc_track_range (handle_t *handle,struct inode *inode,ext4_lblk_t start,ext4_lblk_t end) { +struct ext4_sb_info *sbi =EXT4_SB (inode->i_sb);struct __track_range_args args;int ret;if (S_ISDIR (inode->i_mode))return ; +if (!test_opt2 (inode->i_sb,JOURNAL_FAST_COMMIT ) || + (sbi->s_mount_state &EXT4_FC_REPLAY )) +return ; + +if (ext4_test_mount_flag (inode->i_sb,EXT4_MF_FC_INELIGIBLE )) +return ; + args.start = start; args.end = end;
fs/ext4/namei.c +11 -4
@@ -4011,12 +4011,19 @@ static int ext4_rename(struct user_namespace *mnt_userns, struct inode *old_dir,ext4_fc_mark_ineligible (old.inode->i_sb,EXT4_FC_REASON_RENAME_DIR , handle); }else { +struct super_block *sb = old.inode->i_sb; +if (new.inode)ext4_fc_track_unlink (handle, new.dentry); -__ext4_fc_track_link (handle, old.inode, new.dentry); -__ext4_fc_track_unlink (handle, old.inode, old.dentry); -if (whiteout) -__ext4_fc_track_create (handle, whiteout, old.dentry); +if (test_opt2 (sb,JOURNAL_FAST_COMMIT ) && + !(EXT4_SB (sb)->s_mount_state &EXT4_FC_REPLAY ) && + !(ext4_test_mount_flag (sb,EXT4_MF_FC_INELIGIBLE ))) { +__ext4_fc_track_link (handle, old.inode, new.dentry); +__ext4_fc_track_unlink (handle, old.inode, old.dentry); +if (whiteout) +__ext4_fc_track_create (handle, whiteout, + old.dentry); + } }if (new.inode) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/484 ext4: dont track ranges in fast_commit if inode has inlined data
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luis Henriques (SUSE) <[email protected]>
[ Upstream commit 7882b0187bbeb647967a7b5998ce4ad26ef68a9a ]
When fast-commit needs to track ranges, it has to handle inodes that have inlined data in a different way because ext4_fc_write_inode_data(), in the actual commit path, will attempt to map the required blocks for the range. However, inodes that have inlined data will have it's data stored in inode->i_block and, eventually, in the extended attribute space.
Unfortunately, because fast commit doesn't currently support extended attributes, the solution is to mark this commit as ineligible.
--- fs/ext4/fast_commit.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ext4/fast_commit.c +6 -0
@@ -617,6 +617,12 @@ void ext4_fc_track_range(handle_t *handle, struct inode *inode, ext4_lblk_t starif (ext4_test_mount_flag (inode->i_sb,EXT4_MF_FC_INELIGIBLE ))return ; +if (ext4_has_inline_data (inode)) { +ext4_fc_mark_ineligible (inode->i_sb,EXT4_FC_REASON_XATTR , + handle); +return ; + } + args.start = start; args.end = end;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/484 ext4: avoid writing unitialized memory to disk in EA inodes
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 65121eff3e4c8c90f8126debf3c369228691c591 ]
If the extended attribute size is not a multiple of block size, the last block in the EA inode will have uninitialized tail which will get written to disk. We will never expose the data to userspace but still this is not a good practice so just zero out the tail of the block as it isn't going to cause a noticeable performance overhead.
--- fs/ext4/xattr.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ext4/xattr.c +6 -0
@@ -1384,6 +1384,12 @@ static int ext4_xattr_inode_write(handle_t *handle, struct inode *ea_inode, goto out;memcpy (bh->b_data, buf, csize); +/* +* Zero out block tail to avoid writing uninitialized memory +* to disk. +*/ +if (csize < blocksize) +memset (bh->b_data + csize,0 , blocksize - csize);set_buffer_uptodate (bh);ext4_handle_dirty_metadata (handle, ea_inode, bh);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/484 sparc64: Fix incorrect function signature and add prototype for prom_cif_init
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Larsson <[email protected]>
[ Upstream commit a6c3ea1ec96307dbfbb2f16d96c674c5cc80f445 ]
Remove the unused cif_stack argument and add a protype in oplib_64.h Commit ef3e035c3a9b ("sparc64: Fix register corruption in top-most kernel stack frame during boot.") removed the cif_stack argument to prom_cif init in the declaration at the caller site and the usage of it within prom_cif_init, but not in the function signature of the function itself.
This also fixes the following warning:arch/sparc/prom/p1275.c:52:6: warning: no previous prototype for ‘prom_cif_init’
--- arch/sparc/include/asm/oplib_64.h | 1 + arch/sparc/prom/init_64.c | 3 --- arch/sparc/prom/p1275.c | 2 +- 3 files changed, 2 insertions(+), 4 deletions(-)
arch/sparc/include/asm/oplib_64.h +1 -0
@@ -247,6 +247,7 @@ void prom_sun4v_guest_soft_state(void);int prom_ihandle2path (int handle,char *buffer,int bufsize);/* Client interface level routines. */ +void prom_cif_init (void *cif_handler);void p1275_cmd_direct (unsigned long *);#endif /* !(__SPARC64_OPLIB_H) */
arch/sparc/prom/init_64.c +0 -3
@@ -26,9 +26,6 @@ phandle prom_chosen_node;* routines in the prom library. * It gets passed the pointer to the PROM vector. */ - -extern void prom_cif_init (void *); -void __init prom_init (void *cif_handler) {phandle node;
arch/sparc/prom/p1275.c +1 -1
@@ -49,7 +49,7 @@ void p1275_cmd_direct(unsigned long *args)local_irq_restore (flags); } -void prom_cif_init (void *cif_handler,void *cif_stack) +void prom_cif_init (void *cif_handler) { p1275buf.prom_cif_handler = (void (*)(long *))cif_handler; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/484 SUNRPC: Fixup gss_status tracepoint error output
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <[email protected]>
[ Upstream commit b9fae9f06d84ffab0f3f9118f3a96bbcdc528bf6 ]
The GSS routine errors are values, not flags.
--- include/trace/events/rpcgss.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/trace/events/rpcgss.h +1 -1
@@ -54,7 +54,7 @@ TRACE_DEFINE_ENUM(GSS_S_UNSEQ_TOKEN);TRACE_DEFINE_ENUM (GSS_S_GAP_TOKEN );#define show_gss_status (x) \ - __print_flags(x, "|", \ + __print_symbolic(x, \ { GSS_S_BAD_MECH, "GSS_S_BAD_MECH" }, \ { GSS_S_BAD_NAME, "GSS_S_BAD_NAME" }, \ { GSS_S_BAD_NAMETYPE, "GSS_S_BAD_NAMETYPE" }, \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/484 PCI: Fix resource double counting on remove & rescan
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 903534fa7d30214d8ba840ab1cd9e917e0c88e41 ]
pbus_size_mem() keeps the size of the optional resources in children_add_size. When calculating the PCI bridge window size, calculate_memsize() lower bounds size by old_size before adding children_add_size and performing the window size alignment. This results in double counting for the resources in children_add_size because old_size may be based on the previous size of the bridge window after it has already included children_add_size (that is, size1 in pbus_size_mem() from an earlier invocation of that function).
As a result, on repeated remove of the bus & rescan cycles the resource size keeps increasing when children_add_size is non-zero as can be seen from this extract:
iomem0: 23fffd00000-23fffdfffff : PCI Bus 0000:03 # 1MiB iomem1: 20000000000-200001fffff : PCI Bus 0000:03 # 2MiB iomem2: 20000000000-200002fffff : PCI Bus 0000:03 # 3MiB iomem3: 20000000000-200003fffff : PCI Bus 0000:03 # 4MiB iomem4: 20000000000-200004fffff : PCI Bus 0000:03 # 5MiB
Solve the double counting by moving old_size check later in calculate_memsize() so that children_add_size is already accounted for.
After the patch, the bridge window retains its size as expected:
iomem0: 23fffd00000-23fffdfffff : PCI Bus 0000:03 # 1MiB iomem1: 20000000000-200000fffff : PCI Bus 0000:03 # 1MiB iomem2: 20000000000-200000fffff : PCI Bus 0000:03 # 1MiB
--- drivers/pci/setup-bus.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/pci/setup-bus.c +2 -4
@@ -824,11 +824,9 @@ static resource_size_t calculate_memsize(resource_size_t size, size = min_size;if (old_size ==1 ) old_size =0 ; -if (size < old_size) - size = old_size; - size =ALIGN (max (size, add_size) + children_add_size, align); -return size; + size =max (size, add_size) + children_add_size; +return ALIGN (max (size, old_size), align); } resource_size_t __weak pcibios_window_alignment(struct pci_bus *bus,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/484 clk: qcom: branch: Add helper functions for setting retain bits
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit b594e6f6605311785171b8d4600fe96e35625530 ]
Most Qualcomm branch clocks come with a pretty usual set of bits that can enable memory retention by means of not turning off parts of the memory logic. Add them to the common header file and introduce helper functions for setting them instead of using magic writes.
Stable-dep-of: f38467b5a920 ("clk: qcom: gcc-sc7280: Update force mem core bit for UFS ICE clock")
--- drivers/clk/qcom/clk-branch.h | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+)
drivers/clk/qcom/clk-branch.h +26 -0
@@ -37,6 +37,32 @@ struct clk_branch {struct clk_regmap clkr; }; +/* Branch clock common bits for HLOS-owned clocks */ +#define CBCR_FORCE_MEM_CORE_ON BIT(14) +#define CBCR_FORCE_MEM_PERIPH_ON BIT(13) +#define CBCR_FORCE_MEM_PERIPH_OFF BIT(12) + +static inline void qcom_branch_set_force_mem_core (struct regmap *regmap, +struct clk_branch clk,bool on) +{ +regmap_update_bits (regmap, clk.halt_reg,CBCR_FORCE_MEM_CORE_ON , + on ?CBCR_FORCE_MEM_CORE_ON :0 ); +} + +static inline void qcom_branch_set_force_periph_on (struct regmap *regmap, +struct clk_branch clk,bool on) +{ +regmap_update_bits (regmap, clk.halt_reg,CBCR_FORCE_MEM_PERIPH_ON , + on ?CBCR_FORCE_MEM_PERIPH_ON :0 ); +} + +static inline void qcom_branch_set_force_periph_off (struct regmap *regmap, +struct clk_branch clk,bool on) +{ +regmap_update_bits (regmap, clk.halt_reg,CBCR_FORCE_MEM_PERIPH_OFF , + on ?CBCR_FORCE_MEM_PERIPH_OFF :0 ); +} +extern const struct clk_ops clk_branch_ops;extern const struct clk_ops clk_branch2_ops;extern const struct clk_ops clk_branch_simple_ops;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/484 clk: qcom: gcc-sc7280: Update force mem core bit for UFS ICE clock
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taniya Das <[email protected]>
[ Upstream commit f38467b5a920be1473710428a93c4e54b6f8a0c1 ]
Update the force mem core bit for UFS ICE clock to force the core on signal to remain active during halt state of the clk. When retention bit of the clock is set the memories of the subsystem will retain the logic across power states.
--- drivers/clk/qcom/gcc-sc7280.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/clk/qcom/gcc-sc7280.c +3 -0
@@ -3573,6 +3573,9 @@ static int gcc_sc7280_probe(struct platform_device *pdev)regmap_update_bits (regmap,0x71004 ,BIT (0 ),BIT (0 ));regmap_update_bits (regmap,0x7100C ,BIT (13 ),BIT (13 )); +/* FORCE_MEM_CORE_ON for ufs phy ice core clocks */ +qcom_branch_set_force_mem_core (regmap, gcc_ufs_phy_ice_core_clk, true); + ret =qcom_cc_register_rcg_dfs (regmap, gcc_dfs_clocks,ARRAY_SIZE (gcc_dfs_clocks));if (ret)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/484 coresight: Fix ref leak when of_coresight_parse_endpoint() fails
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <[email protected]>
[ Upstream commit 7fcb9cb2fe47294e16067c3cfd25332c8662a115 ]
of_graph_get_next_endpoint() releases the reference to the previous endpoint on each iteration, but when parsing fails the loop exits early meaning the last reference is never dropped.
Fix it by dropping the refcount in the exit condition.
--- drivers/hwtracing/coresight/coresight-platform.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/hwtracing/coresight/coresight-platform.c +3 -1
@@ -323,8 +323,10 @@ static int of_get_coresight_platform_data(struct device *dev,continue ; ret =of_coresight_parse_endpoint (dev, ep, pdata); -if (ret) +if (ret) { +of_node_put (ep);return ret; + } }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/484 RDMA/mlx5: Set mkeys for dmabuf at PAGE_SIZE
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chiara Meiohas <[email protected]>
[ Upstream commit a4e540119be565f47c305f295ed43f8e0bc3f5c3 ]
Set the mkey for dmabuf at PAGE_SIZE to support any SGL after a move operation.
ib_umem_find_best_pgsz returns 0 on error, so it is incorrect to check the returned page_size against PAGE_SIZE
--- drivers/infiniband/hw/mlx5/mlx5_ib.h | 13 +++++++++++++ drivers/infiniband/hw/mlx5/odp.c | 6 ++---- 2 files changed, 15 insertions(+), 4 deletions(-)
drivers/infiniband/hw/mlx5/mlx5_ib.h +13 -0
@@ -109,6 +109,19 @@ unsigned long __mlx5_umem_find_best_quantized_pgoff( __mlx5_bit_sz(typ, page_offset_fld), 0, scale, \ page_offset_quantized) +static inline unsigned long +mlx5_umem_dmabuf_find_best_pgsz (struct ib_umem_dmabuf *umem_dmabuf) +{ +/* +* mkeys used for dmabuf are fixed at PAGE_SIZE because we must be able +* to hold any sgl after a move operation. Ideally the mkc page size +* could be changed at runtime to be optimal, but right now the driver +* cannot do that. +*/ +return ib_umem_find_best_pgsz (&umem_dmabuf->umem,PAGE_SIZE , + umem_dmabuf->umem.iova); +} +enum {MLX5_IB_MMAP_OFFSET_START =9 ,MLX5_IB_MMAP_OFFSET_END =255 ,
drivers/infiniband/hw/mlx5/odp.c +2 -4
@@ -704,10 +704,8 @@ static int pagefault_dmabuf_mr(struct mlx5_ib_mr *mr, size_t bcnt,return err; } - page_size =mlx5_umem_find_best_pgsz (&umem_dmabuf->umem, mkc, - log_page_size,0 , - umem_dmabuf->umem.iova); -if (unlikely (page_size <PAGE_SIZE )) { + page_size =mlx5_umem_dmabuf_find_best_pgsz (umem_dmabuf); +if (!page_size) {ib_umem_dmabuf_unmap_pages (umem_dmabuf); err = -EINVAL ; }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/484 RDMA/cache: Release GID table even if leak is detected
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit a92fbeac7e94a420b55570c10fe1b90e64da4025 ]
When the table is released, we nullify pointer to GID table, it means that in case GID entry leak is detected, we will leak table too.
Delete code that prevents table destruction.
--- drivers/infiniband/core/cache.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-)
drivers/infiniband/core/cache.c +5 -9
@@ -794,7 +794,6 @@ static struct ib_gid_table *alloc_gid_table(int sz)static void release_gid_table (struct ib_device *device,struct ib_gid_table *table) { -bool leak = false;int i;if (!table)
@@ -803,15 +802,12 @@ static void release_gid_table(struct ib_device *device,for (i =0 ; i < table->sz; i++) {if (is_gid_entry_free (table->data_vec[i]))continue ; -if (kref_read (&table->data_vec[i]->kref) >1 ) { -dev_err (&device->dev, -"GID entry ref leak for index %d ref=%u\n" , i, -kref_read (&table->data_vec[i]->kref)); - leak = true; - } + +WARN_ONCE (true, +"GID entry ref leak for dev %s index %d ref=%u\n" , +dev_name (&device->dev), i, +kref_read (&table->data_vec[i]->kref)); } -if (leak) -return ;mutex_destroy (&table->lock);kfree (table->data_vec);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/484 Input: qt1050 - handle CHIP_ID reading error
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Lalaev <[email protected]>
[ Upstream commit 866a5c7e2781cf1b019072288f1f5c64186dcb63 ]
If the device is missing, we get the following error:
qt1050 3-0041: ID -1340767592 not supported
Let's handle this situation and print more informative error when reading of CHIP_ID fails:
qt1050 3-0041: Failed to read chip ID: -6
--- drivers/input/keyboard/qt1050.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/input/keyboard/qt1050.c +6 -1
@@ -226,7 +226,12 @@ static bool qt1050_identify(struct qt1050_priv *ts)int err;/* Read Chip ID */ -regmap_read (ts->regmap,QT1050_CHIP_ID , &val); + err =regmap_read (ts->regmap,QT1050_CHIP_ID , &val); +if (err) { +dev_err (&ts->client->dev,"Failed to read chip ID: %d\n" , err); +return false; + } +if (val !=QT1050_CHIP_ID_VER ) {dev_err (&ts->client->dev,"ID %d not supported\n" , val);return false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/484 RDMA/mlx4: Fix truncated output warning in mad.c
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 0d2e6992fc956e3308cd5376c18567def4cb3967 ]
Increase size of the name array to avoid truncated output warning.
drivers/infiniband/hw/mlx4/mad.c: In function ‘mlx4_ib_alloc_demux_ctx’:drivers/infiniband/hw/mlx4/mad.c:2197:47: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 4 [-Werror=format-truncation=]
2197 | snprintf(name, sizeof(name), "mlx4_ibt%d", port);
| ^~drivers/infiniband/hw/mlx4/mad.c:2197:38: note: directive argument in the range [-2147483645, 2147483647]
2197 | snprintf(name, sizeof(name), "mlx4_ibt%d", port);
| ^~~~~~~~~~~~
drivers/infiniband/hw/mlx4/mad.c:2197:9: note: ‘snprintf’ output between
10 and 20 bytes into a destination of size 12
2197 | snprintf(name, sizeof(name), "mlx4_ibt%d", port);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~drivers/infiniband/hw/mlx4/mad.c:2205:48: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 3 [-Werror=format-truncation=]
2205 | snprintf(name, sizeof(name), "mlx4_ibwi%d", port);
| ^~drivers/infiniband/hw/mlx4/mad.c:2205:38: note: directive argument in the range [-2147483645, 2147483647]
2205 | snprintf(name, sizeof(name), "mlx4_ibwi%d", port);
| ^~~~~~~~~~~~~
drivers/infiniband/hw/mlx4/mad.c:2205:9: note: ‘snprintf’ output between
11 and 21 bytes into a destination of size 12
2205 | snprintf(name, sizeof(name), "mlx4_ibwi%d", port);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~drivers/infiniband/hw/mlx4/mad.c:2213:48: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 3 [-Werror=format-truncation=]
2213 | snprintf(name, sizeof(name), "mlx4_ibud%d", port);
| ^~drivers/infiniband/hw/mlx4/mad.c:2213:38: note: directive argument in the range [-2147483645, 2147483647]
2213 | snprintf(name, sizeof(name), "mlx4_ibud%d", port);
| ^~~~~~~~~~~~~
drivers/infiniband/hw/mlx4/mad.c:2213:9: note: ‘snprintf’ output between
11 and 21 bytes into a destination of size 12
2213 | snprintf(name, sizeof(name), "mlx4_ibud%d", port);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~cc1: all warnings being treated as errors
make[6]: *** [scripts/Makefile.build:244: drivers/infiniband/hw/mlx4/mad.o] Error 1
--- drivers/infiniband/hw/mlx4/mad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/mlx4/mad.c +1 -1
@@ -2158,7 +2158,7 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev,struct mlx4_ib_demux_ctx *ctx, int port) { - char name[12]; + char name[21];int ret =0 ;int i;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/484 RDMA/mlx4: Fix truncated output warning in alias_GUID.c
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 5953e0647cec703ef436ead37fed48943507b433 ]
drivers/infiniband/hw/mlx4/alias_GUID.c: In function ‘mlx4_ib_init_alias_guid_service’:drivers/infiniband/hw/mlx4/alias_GUID.c:878:74: error: ‘%d’ directive
output may be truncated writing between 1 and 11 bytes into a region of
size 5 [-Werror=format-truncation=]
878 | snprintf(alias_wq_name, sizeof alias_wq_name, "alias_guid%d", i);
| ^~drivers/infiniband/hw/mlx4/alias_GUID.c:878:63: note: directive argument in the range [-2147483641, 2147483646]
878 | snprintf(alias_wq_name, sizeof alias_wq_name, "alias_guid%d", i);
| ^~~~~~~~~~~~~~drivers/infiniband/hw/mlx4/alias_GUID.c:878:17: note: ‘snprintf’ output
between 12 and 22 bytes into a destination of size 15
878 | snprintf(alias_wq_name, sizeof alias_wq_name, "alias_guid%d", i);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~cc1: all warnings being treated as errors
--- drivers/infiniband/hw/mlx4/alias_GUID.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/mlx4/alias_GUID.c +1 -1
@@ -832,7 +832,7 @@ void mlx4_ib_destroy_alias_guid_service(struct mlx4_ib_dev *dev)int mlx4_ib_init_alias_guid_service (struct mlx4_ib_dev *dev) { -char alias_wq_name[15 ]; +char alias_wq_name[22 ];int ret =0 ;int i, j;union ib_gid gid;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/484 RDMA/rxe: Dont set BTH_ACK_MASK for UC or UD QPs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Honggang LI <[email protected]>
[ Upstream commit 4adcaf969d77d3d3aa3871bbadc196258a38aec6 ]
BTH_ACK_MASK bit is used to indicate that an acknowledge (for this packet) should be scheduled by the responder. Both UC and UD QPs are unacknowledged, so don't set BTH_ACK_MASK for UC or UD QPs.
--- drivers/infiniband/sw/rxe/rxe_req.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/infiniband/sw/rxe/rxe_req.c +4 -3
@@ -374,7 +374,7 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp,int solicited;u16 pkey;u32 qp_num; -int ack_req; +int ack_req =0 ;/* length from start of bth to end of icrc */ paylen = rxe_opcode[opcode].length + payload + pad +RXE_ICRC_SIZE ;
@@ -407,8 +407,9 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp, qp_num = (pkt->mask &RXE_DETH_MASK ) ? ibwr->wr.ud.remote_qpn : qp->attr.dest_qp_num; - ack_req = ((pkt->mask &RXE_END_MASK ) || - (qp->req.noack_pkts++ >RXE_MAX_PKT_PER_ACK )); +if (qp_type (qp) !=IB_QPT_UD &&qp_type (qp) !=IB_QPT_UC ) + ack_req = ((pkt->mask &RXE_END_MASK ) || + (qp->req.noack_pkts++ >RXE_MAX_PKT_PER_ACK ));if (ack_req) qp->req.noack_pkts =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/484 ASoC: max98088: Check for clk_prepare_enable() error
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit 1a70579723fde3624a72dfea6e79e55be6e36659 ]
clk_prepare_enable() may fail, so we should better check its return value and propagate it in the case of error.
--- sound/soc/codecs/max98088.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
sound/soc/codecs/max98088.c +7 -3
@@ -1319,6 +1319,7 @@ static int max98088_set_bias_level(struct snd_soc_component *component, enum snd_soc_bias_level level) {struct max98088_priv *max98088 =snd_soc_component_get_drvdata (component); +int ret;switch (level) {case SND_SOC_BIAS_ON :
@@ -1334,10 +1335,13 @@ static int max98088_set_bias_level(struct snd_soc_component *component,*/ if (!IS_ERR (max98088->mclk)) {if (snd_soc_component_get_bias_level (component) == -SND_SOC_BIAS_ON ) +SND_SOC_BIAS_ON ) {clk_disable_unprepare (max98088->mclk); -else -clk_prepare_enable (max98088->mclk); + }else { + ret =clk_prepare_enable (max98088->mclk); +if (ret) +return ret; + } }break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/484 mtd: make mtd_test.c a separate module
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit a5cf054d325e6f362e82fe6d124a1871a4af8174 ]
This file gets linked into nine different modules, which causes a warning:
scripts/Makefile.build:236: drivers/mtd/tests/Makefile: mtd_test.o is added to multiple modules: mtd_nandbiterrs mtd_oobtest mtd_pagetest mtd_readtest mtd_speedtest mtd_stresstest mtd_subpagetest mtd_torturetest
Make it a separate module instead.
--- drivers/mtd/tests/Makefile | 34 +++++++++++++++++----------------- drivers/mtd/tests/mtd_test.c | 9 +++++++++ 2 files changed, 26 insertions(+), 17 deletions(-)
drivers/mtd/tests/Makefile +17 -17
@@ -1,19 +1,19 @@ # SPDX-License-Identifier: GPL-2.0 -obj-$(CONFIG_MTD_TESTS) += mtd_oobtest.o -obj-$(CONFIG_MTD_TESTS) += mtd_pagetest.o -obj-$(CONFIG_MTD_TESTS) += mtd_readtest.o -obj-$(CONFIG_MTD_TESTS) += mtd_speedtest.o -obj-$(CONFIG_MTD_TESTS) += mtd_stresstest.o -obj-$(CONFIG_MTD_TESTS) += mtd_subpagetest.o -obj-$(CONFIG_MTD_TESTS) += mtd_torturetest.o -obj-$(CONFIG_MTD_TESTS) += mtd_nandecctest.o -obj-$(CONFIG_MTD_TESTS) += mtd_nandbiterrs.o +obj-$(CONFIG_MTD_TESTS) += mtd_oobtest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_pagetest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_readtest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_speedtest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_stresstest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_subpagetest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_torturetest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_nandecctest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_nandbiterrs.o mtd_test.o -mtd_oobtest-objs := oobtest.o mtd_test.o -mtd_pagetest-objs := pagetest.o mtd_test.o -mtd_readtest-objs := readtest.o mtd_test.o -mtd_speedtest-objs := speedtest.o mtd_test.o -mtd_stresstest-objs := stresstest.o mtd_test.o -mtd_subpagetest-objs := subpagetest.o mtd_test.o -mtd_torturetest-objs := torturetest.o mtd_test.o -mtd_nandbiterrs-objs := nandbiterrs.o mtd_test.o +mtd_oobtest-objs := oobtest.o +mtd_pagetest-objs := pagetest.o +mtd_readtest-objs := readtest.o +mtd_speedtest-objs := speedtest.o +mtd_stresstest-objs := stresstest.o +mtd_subpagetest-objs := subpagetest.o +mtd_torturetest-objs := torturetest.o +mtd_nandbiterrs-objs := nandbiterrs.o
drivers/mtd/tests/mtd_test.c +9 -0
@@ -25,6 +25,7 @@ int mtdtest_erase_eraseblock(struct mtd_info *mtd, unsigned int ebnum)return 0 ; } +EXPORT_SYMBOL_GPL (mtdtest_erase_eraseblock);static int is_block_bad (struct mtd_info *mtd,unsigned int ebnum) {
@@ -57,6 +58,7 @@ int mtdtest_scan_for_bad_eraseblocks(struct mtd_info *mtd, unsigned char *bbt,return 0 ; } +EXPORT_SYMBOL_GPL (mtdtest_scan_for_bad_eraseblocks);int mtdtest_erase_good_eraseblocks (struct mtd_info *mtd,unsigned char *bbt,unsigned int eb,int ebcnt)
@@ -75,6 +77,7 @@ int mtdtest_erase_good_eraseblocks(struct mtd_info *mtd, unsigned char *bbt,return 0 ; } +EXPORT_SYMBOL_GPL (mtdtest_erase_good_eraseblocks);int mtdtest_read (struct mtd_info *mtd,loff_t addr,size_t size,void *buf) {
@@ -92,6 +95,7 @@ int mtdtest_read(struct mtd_info *mtd, loff_t addr, size_t size, void *buf)return err; } +EXPORT_SYMBOL_GPL (mtdtest_read);int mtdtest_write (struct mtd_info *mtd,loff_t addr,size_t size,const void *buf)
@@ -107,3 +111,8 @@ int mtdtest_write(struct mtd_info *mtd, loff_t addr, size_t size,return err; } +EXPORT_SYMBOL_GPL (mtdtest_write); + +MODULE_LICENSE ("GPL" ); +MODULE_DESCRIPTION ("MTD function test helpers" ); +MODULE_AUTHOR ("Akinobu Mita" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/484 RDMA/device: Return error earlier if port in not valid
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 917918f57a7b139c043e78c502876f2c286f4f0a ]
There is no need to allocate port data if port provided is not valid.
--- drivers/infiniband/core/device.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/infiniband/core/device.c +3 -3
@@ -2145,6 +2145,9 @@ int ib_device_set_netdev(struct ib_device *ib_dev, struct net_device *ndev,unsigned long flags;int ret; +if (!rdma_is_port_valid (ib_dev, port)) +return -EINVAL ; +/* * Drivers wish to call this before ib_register_driver, so we have to * setup the port data early.
@@ -2153,9 +2156,6 @@ int ib_device_set_netdev(struct ib_device *ib_dev, struct net_device *ndev,if (ret)return ret; -if (!rdma_is_port_valid (ib_dev, port)) -return -EINVAL ; - pdata = &ib_dev->port_data[port];spin_lock_irqsave (&pdata->netdev_lock, flags); old_ndev = rcu_dereference_protected(
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/484 Input: elan_i2c - do not leave interrupt disabled on suspend failure
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit 5f82c1e04721e7cd98e604eb4e58f0724d8e5a65 ]
Make sure interrupts are not left disabled when we fail to suspend the touch controller.
--- drivers/input/mouse/elan_i2c_core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/input/mouse/elan_i2c_core.c +2 -0
@@ -1378,6 +1378,8 @@ static int __maybe_unused elan_suspend(struct device *dev) } err: +if (ret) +enable_irq (client->irq);mutex_unlock (&data->sysfs_mutex);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 134/484 PCI: endpoint: Clean up error handling in vpci_scan_bus()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 8e0f5a96c534f781e8c57ca30459448b3bfe5429 ]
Smatch complains about inconsistent NULL checking in vpci_scan_bus():
drivers/pci/endpoint/functions/pci-epf-vntb.c:1024 vpci_scan_bus() error: we previously assumed 'vpci_bus' could be null (see line 1021)
Instead of printing an error message and then crashing we should return an error code and clean up.
Also the NULL check is reversed so it prints an error for success instead of failure.
--- drivers/pci/endpoint/functions/pci-epf-vntb.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/pci/endpoint/functions/pci-epf-vntb.c +9 -3
@@ -993,8 +993,10 @@ static int vpci_scan_bus(void *sysdata)struct epf_ntb *ndev = sysdata; vpci_bus =pci_scan_bus (ndev->vbus_number, &vpci_ops, sysdata); -if (vpci_bus) -pr_err ("create pci bus\n" ); +if (!vpci_bus) { +pr_err ("create pci bus failed\n" ); +return -EINVAL ; + }pci_bus_add_devices (vpci_bus);
@@ -1313,10 +1315,14 @@ static int epf_ntb_bind(struct pci_epf *epf) goto err_bar_alloc; } -vpci_scan_bus (ntb); + ret =vpci_scan_bus (ntb); +if (ret) + goto err_unregister;return 0 ; +err_unregister: +pci_unregister_driver (&vntb_pci_driver); err_bar_alloc:epf_ntb_config_spad_bar_free (ntb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 135/484 vhost/vsock: always initialize seqpacket_allow
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <[email protected]>
[ Upstream commit 1e1fdcbdde3b7663e5d8faeb2245b9b151417d22 ]
There are two issues around seqpacket_allow:
1. seqpacket_allow is not initialized when socket is created. Thus if features are never set, it will be read uninitialized.
2. if VIRTIO_VSOCK_F_SEQPACKET is set and then cleared, then seqpacket_allow will not be cleared appropriately (existing apps I know about don't usually do this but it's legal and there's no way to be sure no one relies on this).
To fix:
- initialize seqpacket_allow after allocation
- set it unconditionally in set_features
Message-ID: <[email protected]>
--- drivers/vhost/vsock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/vhost/vsock.c +2 -2
@@ -684,6 +684,7 @@ static int vhost_vsock_dev_open(struct inode *inode, struct file *file) } vsock->guest_cid =0 ;/* no CID assigned yet */ + vsock->seqpacket_allow = false;atomic_set (&vsock->queued_replies,0 );
@@ -842,8 +843,7 @@ static int vhost_vsock_set_features(struct vhost_vsock *vsock, u64 features) goto err; } -if (features & (1ULL <<VIRTIO_VSOCK_F_SEQPACKET )) - vsock->seqpacket_allow = true; + vsock->seqpacket_allow = features & (1ULL <<VIRTIO_VSOCK_F_SEQPACKET );for (i =0 ; i <ARRAY_SIZE (vsock->vqs); i++) { vq = &vsock->vqs[i];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 136/484 net: missing check virtio
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Arefev <[email protected]>
[ Upstream commit e269d79c7d35aa3808b1f3c1737d63dab504ddc8 ]
Two missing check in virtio_net_hdr_to_skb() allowed syzbot to crash kernels again
1. After the skb_segment function the buffer may become non-linear (nr_frags != 0), but since the SKBTX_SHARED_FRAG flag is not set anywhere the __skb_linearize function will not be executed, then the buffer will remain non-linear. Then the condition (offset >= skb_headlen(skb)) becomes true, which causes WARN_ON_ONCE in skb_checksum_help.
2. The struct sk_buff and struct virtio_net_hdr members must be mathematically related.
(gso_size) must be greater than (needed) otherwise WARN_ON_ONCE. (remainder) must be greater than (needed) otherwise WARN_ON_ONCE. (remainder) may be 0 if division is without remainder.
offset+2 (4191) > skb_headlen() (1116)
WARNING: CPU: 1 PID: 5084 at net/core/dev.c:3303 skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303 Modules linked in: CPU: 1 PID: 5084 Comm: syz-executor336 Not tainted 6.7.0-rc3-syzkaller-00014-gdf60cee26a2e #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303 Code: 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 52 01 00 00 44 89 e2 2b 53 74 4c 89 ee 48 c7 c7 40 57 e9 8b e8 af 8f dd f8 90 <0f> 0b 90 90 e9 87 fe ff ff e8 40 0f 6e f9 e9 4b fa ff ff 48 89 ef RSP: 0018:ffffc90003a9f338 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff888025125780 RCX: ffffffff814db209 RDX: ffff888015393b80 RSI: ffffffff814db216 RDI: 0000000000000001 RBP: ffff8880251257f4 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000045c R13: 000000000000105f R14: ffff8880251257f0 R15: 000000000000105d FS: 0000555555c24380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002000f000 CR3: 0000000023151000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ip_do_fragment+0xa1b/0x18b0 net/ipv4/ip_output.c:777 ip_fragment.constprop.0+0x161/0x230 net/ipv4/ip_output.c:584 ip_finish_output_gso net/ipv4/ip_output.c:286 [inline] __ip_finish_output net/ipv4/ip_output.c:308 [inline] __ip_finish_output+0x49c/0x650 net/ipv4/ip_output.c:295 ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:433 dst_output include/net/dst.h:451 [inline] ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:129 iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82 ipip6_tunnel_xmit net/ipv6/sit.c:1034 [inline] sit_tunnel_xmit+0xed2/0x28f0 net/ipv6/sit.c:1076 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3545 [inline] dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3561 __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4346 dev_queue_xmit include/linux/netdevice.h:3134 [inline] packet_xmit+0x257/0x380 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24ca/0x5240 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 __sys_sendto+0x255/0x340 net/socket.c:2190 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Found by Linux Verification Center (linuxtesting.org) with Syzkaller
Message-Id: <[email protected]>
--- include/linux/virtio_net.h | 11 +++++++++++ 1 file changed, 11 insertions(+)
include/linux/virtio_net.h +11 -0
@@ -51,6 +51,7 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,unsigned int thlen =0 ;unsigned int p_off =0 ;unsigned int ip_proto; +u64 ret, remainder, gso_size;if (hdr->gso_type !=VIRTIO_NET_HDR_GSO_NONE ) {switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN ) {
@@ -87,6 +88,16 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,u32 off =__virtio16_to_cpu (little_endian, hdr->csum_offset);u32 needed = start +max_t (u32, thlen, off +sizeof (__sum16)); +if (hdr->gso_size) { + gso_size =__virtio16_to_cpu (little_endian, hdr->gso_size); + ret =div64_u64_rem (skb->len, gso_size, &remainder); +if (!(ret && (hdr->gso_size > needed) && + ((remainder > needed) || (remainder ==0 )))) { +return -EINVAL ; + } +skb_shinfo (skb)->tx_flags |=SKBFL_SHARED_FRAG ; + } +if (!pskb_may_pull (skb, needed))return -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/484 MIPS: Octeron: remove source file executable bit
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dominique Martinet <[email protected]>
[ Upstream commit 89c7f5078935872cf47a713a645affb5037be694 ]
This does not matter the least, but there is no other .[ch] file in the repo that is executable, so clean this up.
--- arch/mips/pci/pcie-octeon.c | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100755 => 100644 arch/mips/pci/pcie-octeon.c
arch/mips/pci/pcie-octeon.c +0 -0
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 138/484 powerpc/xmon: Fix disassembly CPU feature checks
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit 14196e47c5ffe32af7ed5a51c9e421c5ea5bccce ]
In the xmon disassembly code there are several CPU feature checks to determine what dialects should be passed to the disassembler. The dialect controls which instructions the disassembler will recognise.
Unfortunately the checks are incorrect, because instead of passing a single CPU feature they are passing a mask of feature bits.
For example the code:
if (cpu_has_feature(CPU_FTRS_POWER5))
dialect |= PPC_OPCODE_POWER5;Is trying to check if the system is running on a Power5 CPU. But CPU_FTRS_POWER5 is a mask of *all* the feature bits that are enabled on a Power5.
In practice the test will always return true for any 64-bit CPU, because at least one bit in the mask will be present in the CPU_FTRS_ALWAYS mask.
Similarly for all the other checks against CPU_FTRS_xx masks.
Rather than trying to match the disassembly behaviour exactly to the current CPU, just differentiate between 32-bit and 64-bit, and Altivec, VSX and HTM.
That will cause some instructions to be shown in disassembly even on a CPU that doesn't support them, but that's OK, objdump -d output has the same behaviour, and if anything it's less confusing than some instructions not being disassembled.
--- arch/powerpc/xmon/ppc-dis.c | 33 +++++++++++---------------------- 1 file changed, 11 insertions(+), 22 deletions(-)
arch/powerpc/xmon/ppc-dis.c +11 -22
@@ -122,32 +122,21 @@ int print_insn_powerpc (unsigned long insn, unsigned long memaddr)bool insn_is_short;ppc_cpu_t dialect; - dialect =PPC_OPCODE_PPC |PPC_OPCODE_COMMON - |PPC_OPCODE_64 |PPC_OPCODE_POWER4 |PPC_OPCODE_ALTIVEC ; + dialect =PPC_OPCODE_PPC |PPC_OPCODE_COMMON ; -if (cpu_has_feature (CPU_FTRS_POWER5 )) - dialect |=PPC_OPCODE_POWER5 ; +if (IS_ENABLED (CONFIG_PPC64 )) + dialect |=PPC_OPCODE_64 |PPC_OPCODE_POWER4 |PPC_OPCODE_CELL | +PPC_OPCODE_POWER5 |PPC_OPCODE_POWER6 |PPC_OPCODE_POWER7 |PPC_OPCODE_POWER8 | +PPC_OPCODE_POWER9 ; -if (cpu_has_feature (CPU_FTRS_CELL )) - dialect |= (PPC_OPCODE_CELL |PPC_OPCODE_ALTIVEC ); +if (cpu_has_feature (CPU_FTR_TM )) + dialect |=PPC_OPCODE_HTM ; -if (cpu_has_feature (CPU_FTRS_POWER6 )) - dialect |= (PPC_OPCODE_POWER5 |PPC_OPCODE_POWER6 |PPC_OPCODE_ALTIVEC ); +if (cpu_has_feature (CPU_FTR_ALTIVEC )) + dialect |=PPC_OPCODE_ALTIVEC |PPC_OPCODE_ALTIVEC2 ; -if (cpu_has_feature (CPU_FTRS_POWER7 )) - dialect |= (PPC_OPCODE_POWER5 |PPC_OPCODE_POWER6 |PPC_OPCODE_POWER7 - |PPC_OPCODE_ALTIVEC |PPC_OPCODE_VSX ); - -if (cpu_has_feature (CPU_FTRS_POWER8 )) - dialect |= (PPC_OPCODE_POWER5 |PPC_OPCODE_POWER6 |PPC_OPCODE_POWER7 - |PPC_OPCODE_POWER8 |PPC_OPCODE_HTM - |PPC_OPCODE_ALTIVEC |PPC_OPCODE_ALTIVEC2 |PPC_OPCODE_VSX ); - -if (cpu_has_feature (CPU_FTRS_POWER9 )) - dialect |= (PPC_OPCODE_POWER5 |PPC_OPCODE_POWER6 |PPC_OPCODE_POWER7 - |PPC_OPCODE_POWER8 |PPC_OPCODE_POWER9 |PPC_OPCODE_HTM - |PPC_OPCODE_ALTIVEC |PPC_OPCODE_ALTIVEC2 - |PPC_OPCODE_VSX |PPC_OPCODE_VSX3 ); +if (cpu_has_feature (CPU_FTR_VSX )) + dialect |=PPC_OPCODE_VSX |PPC_OPCODE_VSX3 ;/* Get the major opcode of the insn. */ opcode =NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 139/484 macintosh/therm_windtunnel: fix module unload.
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nick Bowler <[email protected]>
[ Upstream commit fd748e177194ebcbbaf98df75152a30e08230cc6 ]
The of_device_unregister call in therm_windtunnel's module_exit procedure does not fully reverse the effects of of_platform_device_create in the module_init prodedure. Once you unload this module, it is impossible to load it ever again since only the first of_platform_device_create call on the fan node succeeds.
This driver predates first git commit, and it turns out back then of_platform_device_create worked differently than it does today. So this is actually an old regression.
The appropriate function to undo of_platform_device_create now appears to be of_platform_device_destroy, and switching to use this makes it possible to unload and load the module as expected.
--- drivers/macintosh/therm_windtunnel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/macintosh/therm_windtunnel.c +1 -1
@@ -549,7 +549,7 @@ g4fan_exit( void )platform_driver_unregister ( &therm_of_driver );if ( x.of_dev ) -of_device_unregister ( x.of_dev ); +of_platform_device_destroy (&x.of_dev->dev,NULL ); }module_init (g4fan_init);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 140/484 RDMA/hns: Fix missing pagesize and alignment check in FRMR
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengchang Tang <[email protected]>
[ Upstream commit d387d4b54eb84208bd4ca13572e106851d0a0819 ]
The offset requires 128B alignment and the page size ranges from 4K to 128M.
--- drivers/infiniband/hw/hns/hns_roce_device.h | 4 ++++ drivers/infiniband/hw/hns/hns_roce_mr.c | 5 +++++ 2 files changed, 9 insertions(+)
drivers/infiniband/hw/hns/hns_roce_device.h +4 -0
@@ -100,6 +100,7 @@#define MR_TYPE_DMA 0x03#define HNS_ROCE_FRMR_MAX_PA 512 +#define HNS_ROCE_FRMR_ALIGN_SIZE 128#define PKEY_ID 0xffff#define GUID_LEN 8
@@ -220,6 +221,9 @@ enum {#define HNS_HW_PAGE_SHIFT 12#define HNS_HW_PAGE_SIZE (1 << HNS_HW_PAGE_SHIFT) +#define HNS_HW_MAX_PAGE_SHIFT 27 +#define HNS_HW_MAX_PAGE_SIZE (1 << HNS_HW_MAX_PAGE_SHIFT) +struct hns_roce_uar {u64 pfn;unsigned long index;
drivers/infiniband/hw/hns/hns_roce_mr.c +5 -0
@@ -446,6 +446,11 @@ int hns_roce_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents,struct hns_roce_mtr *mtr = &mr->pbl_mtr;int ret, sg_num =0 ; +if (!IS_ALIGNED (*sg_offset,HNS_ROCE_FRMR_ALIGN_SIZE ) || + ibmr->page_size <HNS_HW_PAGE_SIZE || + ibmr->page_size >HNS_HW_MAX_PAGE_SIZE ) +return sg_num; + mr->npages =0 ; mr->page_list =kvcalloc (mr->pbl_mtr.hem_cfg.buf_pg_count,sizeof (dma_addr_t),GFP_KERNEL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 141/484 RDMA/hns: Fix undifined behavior caused by invalid max_sge
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengchang Tang <[email protected]>
[ Upstream commit 36397b907355e2fdb5a25a02a7921a937fd8ef4c ]
If max_sge has been set to 0, roundup_pow_of_two() in set_srq_basic_param() may have undefined behavior.
--- drivers/infiniband/hw/hns/hns_roce_srq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/hns/hns_roce_srq.c +1 -1
@@ -295,7 +295,7 @@ static int set_srq_basic_param(struct hns_roce_srq *srq, max_sge =proc_srq_sge (hr_dev, srq, !!udata);if (attr->max_wr > hr_dev->caps.max_srq_wrs || - attr->max_sge > max_sge) { + attr->max_sge > max_sge || !attr->max_sge) {ibdev_err (&hr_dev->ib_dev,"invalid SRQ attr, depth = %u, sge = %u.\n" , attr->max_wr, attr->max_sge);
Signature · 1 line
2.43.0