6.10.10-rc1 review
Subsystems (8)
Greg Kroah-Hartman
maintainercover 6.10.10-rc1 review
This is the start of the stable review cycle for the 6.10.10 release. There are 375 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 12 Sep 2024 09:25:22 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.10.10-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.10.10-rc1
Huacai Chen <[email protected]>
LoongArch: Use accessors to page table entries instead of direct dereference
Stefan Wahren <[email protected]>
spi: spi-fsl-lpspi: Fix off-by-one in prescale max
Filipe Manana <[email protected]>
btrfs: fix race between direct IO write and fsync when using same fd
Jouni Högander <[email protected]>
drm/i915/display: Increase Fast Wake Sync length as a quirk
Jouni Högander <[email protected]>
drm/i915/display: Add mechanism to use sink model when applying quirk
Thomas Gleixner <[email protected]>
x86/mm: Fix PTI for i386 some more
Li Nan <[email protected]>
ublk_drv: fix NULL pointer dereference in ublk_ctrl_start_recovery()
Maurizio Lombardi <[email protected]>
nvmet: Identify-Active Namespace ID List command should reject invalid nsid
Weiwen Hu <[email protected]>
nvme: rename CDR/MORE/DNR to NVME_STATUS_*
Weiwen Hu <[email protected]>
nvme: fix status magic numbers
Weiwen Hu <[email protected]>
nvme: rename nvme_sc_to_pr_err to nvme_status_to_pr_err
David Howells <[email protected]>
cifs: Fix SMB1 readv/writev callback in the same way as SMB2/3
David Howells <[email protected]>
cifs: Fix zero_point init on inode initialisation
Alexandre Ghiti <[email protected]>
riscv: Fix RISCV_ALTERNATIVE_EARLY
Alexandre Ghiti <[email protected]>
riscv: Improve sbi_ecall() code generation by reordering arguments
Samuel Holland <[email protected]>
riscv: Add tracepoints for SBI calls and returns
Alexandre Ghiti <[email protected]>
riscv: Do not restrict memory size because of linear mapping on nommu
Anton Blanchard <[email protected]>
riscv: Fix toolchain vector detection
Paulo Alcantara <[email protected]>
smb: client: fix double put of @cfile in smb2_rename_path()
Liao Chen <[email protected]>
gpio: modepin: Enable module autoloading
Krzysztof Kozlowski <[email protected]>
gpio: rockchip: fix OF node leak in probe()
Andy Shevchenko <[email protected]>
drm/i915/fence: Mark debug_fence_free() with __maybe_unused
Andy Shevchenko <[email protected]>
drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused
Dave Airlie <[email protected]>
nouveau: fix the fwsec sb verification register.
Stephen Boyd <[email protected]>
clk: qcom: gcc-sm8550: Don't park the USB RCG at registration time
Stephen Boyd <[email protected]>
clk: qcom: gcc-sm8550: Don't use parking clk_ops for QUPs
Matteo Martelli <[email protected]>
ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode
Charlie Jenkins <[email protected]>
riscv: mm: Do not restrict mmap address based on hint
Charlie Jenkins <[email protected]>
riscv: selftests: Remove mmap hint address checks
Chen-Yu Tsai <[email protected]>
ASoc: SOF: topology: Clear SOF link platform name upon unload
Bryan O'Donoghue <[email protected]>
clk: qcom: gcc-x1e80100: Don't use parking clk_ops for QUPs
Keith Busch <[email protected]>
nvme-pci: allocate tagset on reset if necessary
Maurizio Lombardi <[email protected]>
nvmet-tcp: fix kernel crash if commands allocation fails
Mohan Kumar <[email protected]>
ASoC: tegra: Fix CBB error during probe()
Christophe Leroy <[email protected]>
powerpc/vdso: Don't discard rela sections
Christophe Leroy <[email protected]>
powerpc/64e: Define mmu_pte_psize static
Michael Ellerman <[email protected]>
powerpc/64e: split out nohash Book3E 64-bit code
Michael Ellerman <[email protected]>
powerpc/64e: remove unused IBM HTW code
devi priya <[email protected]>
clk: qcom: ipq9574: Update the alpha PLL type for GPLLs
Abel Vesa <[email protected]>
clk: qcom: gcc-x1e80100: Fix USB 0 and 1 PHY GDSC pwrsts flags
Bommu Krishnaiah <[email protected]>
drm/xe/xe2lpg: Extend workaround 14021402888
Bommu Krishnaiah <[email protected]>
drm/xe/xe2: Add workaround 14021402888
Dragos Tatulea <[email protected]>
net/mlx5e: SHAMPO, Fix page leak
Yoray Zack <[email protected]>
net/mlx5e: SHAMPO, Use KSMs instead of KLMs
Arnd Bergmann <[email protected]>
hid: bpf: add BPF_JIT dependency
Jia Jie Ho <[email protected]>
crypto: starfive - Fix nent assignment in rsa dec
Jia Jie Ho <[email protected]>
crypto: starfive - Align rsa input data to 32-bit
Igor Pylypiv <[email protected]>
ata: libata-scsi: Check ATA_QCFLAG_RTF_FILLED before using result_tf
Igor Pylypiv <[email protected]>
ata: libata-scsi: Remove redundant sense_buffer memsets
Marek Olšák <[email protected]>
drm/amdgpu: handle gfx12 in amdgpu_display_verify_sizes
Aurabindo Pillai <[email protected]>
drm/amd: Add gfx12 swizzle mode defs
Marc Kleine-Budde <[email protected]>
can: mcp251xfd: rx: add workaround for erratum DS80000789E 6 of mcp2518fd
Marc Kleine-Budde <[email protected]>
can: mcp251xfd: clarify the meaning of timestamp
Marc Kleine-Budde <[email protected]>
can: mcp251xfd: rx: prepare to workaround broken RX FIFO head index erratum
Marc Kleine-Budde <[email protected]>
can: mcp251xfd: mcp251xfd_handle_rxif_ring_uinc(): factor out in separate function
Jonathan Cameron <[email protected]>
arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
James Morse <[email protected]>
arm64: acpi: Move get_cpu_for_acpi_id() to a header
Jonathan Cameron <[email protected]>
ACPI: processor: Fix memory leaks in error paths of processor_add()
Jonathan Cameron <[email protected]>
ACPI: processor: Return an error if acpi_processor_get_info() fails in processor_add()
Christian Brauner <[email protected]>
fs: relax permissions for listmount()
Christian Brauner <[email protected]>
fs: simplify error handling
Christian Brauner <[email protected]>
path: add cleanup helper
Nicholas Piggin <[email protected]>
workqueue: Improve scalability of workqueue watchdog touch
Nicholas Piggin <[email protected]>
workqueue: wq_watchdog_touch is always called with valid CPU
Mike Yuan <[email protected]>
mm/memcontrol: respect zswap.writeback setting from parent cg too
Yosry Ahmed <[email protected]>
mm: zswap: rename is_zswap_enabled() to zswap_is_enabled()
Peter Zijlstra <[email protected]>
perf/aux: Fix AUX buffer serialization
Sven Schnelle <[email protected]>
uprobes: Use kzalloc to allocate xol area
Daniel Lezcano <[email protected]>
clocksource/drivers/timer-of: Remove percpu irq related code
Jacky Bai <[email protected]>
clocksource/drivers/imx-tpm: Fix next event not taking effect sometime
Jacky Bai <[email protected]>
clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX
David Fernandez Gonzalez <[email protected]>
VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
Naman Jain <[email protected]>
Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic
Saurabh Sengar <[email protected]>
uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
Geert Uytterhoeven <[email protected]>
nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc
John Thomson <[email protected]>
nvmem: u-boot-env: error if NVMEM device is too small
Michal Simek <[email protected]>
dt-bindings: nvmem: Use soc-nvmem node name instead of nvmem
Carlos Llamas <[email protected]>
binder: fix UAF caused by offsets overwrite
Sukrut Bellary <[email protected]>
misc: fastrpc: Fix double free of 'buf' in error path
Heikki Krogerus <[email protected]>
usb: typec: ucsi: Fix the partner PD revision
Prashanth K <[email protected]>
usb: dwc3: Avoid waking up gadget during startxfer
Pawel Laszczak <[email protected]>
usb: cdns2: Fix controller reset issue
Faisal Hassan <[email protected]>
usb: dwc3: core: update LC timer as per USB Spec V3.2
Dumitru Ceclan <[email protected]>
iio: adc: ad7124: fix DT configuration parsing
Dumitru Ceclan <[email protected]>
iio: adc: ad7124: fix chip ID mismatch
Nuno Sa <[email protected]>
iio: adc: ad_sigma_delta: fix irq_flags on irq request
Guillaume Stols <[email protected]>
iio: adc: ad7606: remove frstdata check for serial mode
Dumitru Ceclan <[email protected]>
iio: adc: ad7124: fix config comparison
Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_mpu6050: fix interrupt status read for old buggy chips
Matteo Martelli <[email protected]>
iio: fix scale application in iio_convert_raw_to_processed_unlocked
David Lechner <[email protected]>
iio: buffer-dmaengine: fix releasing dma channel on error
Aleksandr Mishin <[email protected]>
staging: iio: frequency: ad9834: Validate frequency parameter value
Matthieu Baerts (NGI0) <[email protected]>
tcp: process the 3rd ACK with sk_socket for TFO/MPTCP
Christian Brauner <[email protected]>
fs: only copy to userspace on success in listmount()
Yunxiang Li <[email protected]>
drm/amdgpu: Fix amdgpu_device_reset_sriov retry logic
Yunxiang Li <[email protected]>
drm/amdgpu: Add reset_context flag for host FLR
Yunxiang Li <[email protected]>
drm/amdgpu: Fix two reset triggered in a row
Trond Myklebust <[email protected]>
NFSv4: Add missing rescheduling points in nfs_client_return_marked_delegations
ChenXiaoSong <[email protected]>
smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()
Michael Ellerman <[email protected]>
ata: pata_macio: Use WARN instead of BUG
Carlos Song <[email protected]>
spi: spi-fsl-lpspi: limit PRESCALE bit in TCR register
Jiaxun Yang <[email protected]>
MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed
Ivan Orlov <[email protected]>
kunit/overflow: Fix UB in overflow_allocation_test
Peiyang Wang <[email protected]>
net: hns3: void array out of bound when loop tnl_num
Kent Overstreet <[email protected]>
lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
Stefan Wiehler <[email protected]>
of/irq: Prevent device address out-of-bounds read in interrupt map walk
Phillip Lougher <[email protected]>
Squashfs: sanity check symbolic link size
Oliver Neukum <[email protected]>
usbnet: ipheth: race between ipheth_close and error handling
Dmitry Torokhov <[email protected]>
Input: uinput - reject requests with unreasonable number of slots
Olivier Sobrie <[email protected]>
HID: amd_sfh: free driver_data after destroying hid device
Camila Alvarez <[email protected]>
HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
Heiko Carstens <[email protected]>
s390/vmlinux.lds.S: Move ro_after_init section behind rodata section
David Sterba <[email protected]>
btrfs: initialize location to fix -Wmaybe-uninitialized in btrfs_lookup_dentry()
Devyn Liu <[email protected]>
spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware
Zenghui Yu <[email protected]>
kselftests: dmabuf-heaps: Ensure the driver name is null-terminated
Jarkko Nikula <[email protected]>
i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup
Frank Li <[email protected]>
i3c: master: svc: resend target address when get NACK
David Howells <[email protected]>
vfs: Fix potential circular locking through setxattr() and removexattr()
David Howells <[email protected]>
cachefiles: Set the max subreq size for cache writes to MAX_RW_COUNT
Alexander Gordeev <[email protected]>
s390/boot: Do not assume the decompressor range is reserved
Arnd Bergmann <[email protected]>
regmap: maple: work around gcc-14.1 false-positive warning
Huacai Chen <[email protected]>
LoongArch: Use correct API to map cmdline in relocate_kernel()
YiPeng Chai <[email protected]>
drm/amdgpu: add mutex to protect ras shared memory
Vladimir Oltean <[email protected]>
net: dpaa: avoid on-stack arrays of NR_CPUS elements
Neeraj Sanjay Kale <[email protected]>
Bluetooth: btnxpuart: Fix Null pointer dereference in btnxpuart_flush()
Kuniyuki Iwashima <[email protected]>
tcp: Don't drop SYN+ACK for simultaneous connect().
Dan Williams <[email protected]>
PCI: Add missing bridge lock to pci_bus_lock()
yang.zhang <[email protected]>
riscv: set trap vector earlier
Alison Schofield <[email protected]>
cxl/region: Verify target positions using the ordered target list
Jakub Kicinski <[email protected]>
ethtool: fail closed if we can't get max channel used in indirection tables
Filipe Manana <[email protected]>
btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info()
Filipe Manana <[email protected]>
btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
Josef Bacik <[email protected]>
btrfs: handle errors from btrfs_dec_ref() properly
Josef Bacik <[email protected]>
btrfs: clean up our handling of refs == 0 in snapshot delete
Josef Bacik <[email protected]>
btrfs: replace BUG_ON with ASSERT in walk_down_proc()
Josef Bacik <[email protected]>
btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
Qu Wenruo <[email protected]>
btrfs: slightly loosen the requirement for qgroup removal
Konstantin Komarov <[email protected]>
fs/ntfs3: Check more cases when directory is corrupted
Zqiang <[email protected]>
smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu()
Christian König <[email protected]>
drm/amdgpu: reject gang submit on reserved VMIDs
Sascha Hauer <[email protected]>
watchdog: imx7ulp_wdt: keep already running watchdog enabled
Sebastian Andrzej Siewior <[email protected]>
bpf: Remove tst_run from lwt_seg6local_prog_ops.
Jason Gunthorpe <[email protected]>
iommufd: Require drivers to supply the cache_invalidate_user ops
Umang Jain <[email protected]>
staging: vchiq_core: Bubble up wait_event_interruptible() return value
Mrinmay Sarkar <[email protected]>
PCI: qcom: Override NO_SNOOP attribute for SA8775P RC
Kan Liang <[email protected]>
perf/x86/intel: Hide Topdown metrics events if the feature is not enumerated
Sascha Hauer <[email protected]>
wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
Yicong Yang <[email protected]>
dma-mapping: benchmark: Don't starve others when doing the test
Ye Bin <[email protected]>
jbd2: avoid mount failed when commit block is partial submitted
Luis Henriques (SUSE) <[email protected]>
ext4: fix possible tid_t sequence overflows
Yifan Zha <[email protected]>
drm/amdgpu: Set no_hw_access when VF request full GPU fails
Andreas Ziegler <[email protected]>
libbpf: Add NULL checks to bpf_object__{prev_map,next_map}Shenghao Ding <[email protected]>
ASoc: TAS2781: replace beXX_to_cpup with get_unaligned_beXX for potentially broken alignment
Guenter Roeck <[email protected]>
hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
Guenter Roeck <[email protected]>
hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
Guenter Roeck <[email protected]>
hwmon: (lm95234) Fix underflows seen when writing limit attributes
Guenter Roeck <[email protected]>
hwmon: (adc128d818) Fix underflows seen when writing limit attributes
Masami Hiramatsu (Google) <[email protected]>
tracing/kprobes: Add symbol counting check when module loads
Hareshx Sankar Raj <[email protected]>
crypto: qat - fix unintentional re-enabling of error interrupts
Justin Tee <[email protected]>
scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info
Igor Pylypiv <[email protected]>
scsi: pm80xx: Set phy->enable_completion only when we wait for it
Kyoungrul Kim <[email protected]>
scsi: ufs: core: Remove SCSI host only if added
Marcin Ślusarz <[email protected]>
wifi: rtw88: usb: schedule rx work after everything is set up
Xuan Zhuo <[email protected]>
virtio_ring: fix KMSAN error for premapped mode
Krishna Kumar <[email protected]>
pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
Zijun Hu <[email protected]>
devres: Initialize an uninitialized struct member
Johannes Berg <[email protected]>
um: line: always fill *error_out in setup_one_line()
Waiman Long <[email protected]>
cgroup: Protect css->cgroup write under css_set_lock
Christoph Hellwig <[email protected]>
block: don't call bio_uninit from bio_endio
Lu Baolu <[email protected]>
iommu/vt-d: Remove control over Execute-Requested requests
Jacob Pan <[email protected]>
iommu/vt-d: Handle volatile descriptor status read
Huang Ying <[email protected]>
cxl/region: Fix a race condition in memory hotplug notifier
Benjamin Marzinski <[email protected]>
dm init: Handle minors larger than 255
Amadeusz Sławiński <[email protected]>
ASoC: topology: Properly initialize soc_enum values
Sean Anderson <[email protected]>
phy: zynqmp: Take the phy mutex in xlate
Richard Fitzgerald <[email protected]>
firmware: cs_dsp: Don't allow writes to read-only controls
Viresh Kumar <[email protected]>
xen: privcmd: Fix possible access to a freed kirqfd instance
Arkadiusz Kubalewski <[email protected]>
tools/net/ynl: fix cli.py --subscribe feature
Jamie Bainbridge <[email protected]>
selftests: net: enable bind tests
Pawel Dembicki <[email protected]>
net: dsa: vsc73xx: fix possible subblocks range of CAPT block
Sean Anderson <[email protected]>
net: xilinx: axienet: Fix race in axienet_stop
Jonas Gorski <[email protected]>
net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN
Hayes Wang <[email protected]>
r8152: fix the firmware doesn't work
Kuniyuki Iwashima <[email protected]>
fou: Fix null-ptr-deref in GRO.
Guillaume Nault <[email protected]>
bareudp: Fix device stats updates.
Jeongjun Park <[email protected]>
bpf: add check for invalid name in btf_name_valid_section()
Tze-nan Wu <[email protected]>
bpf, net: Fix a potential race in do_sock_getsockopt()
Breno Leitao <[email protected]>
net: dqs: Do not use extern for unused dql_group
Oliver Neukum <[email protected]>
usbnet: modern method to get random MAC
Larysa Zaremba <[email protected]>
ice: do not bring the VSI up, if it was down before the XDP setup
Larysa Zaremba <[email protected]>
ice: remove ICE_CFG_BUSY locking from AF_XDP code
Larysa Zaremba <[email protected]>
ice: check ICE_VSI_DOWN under rtnl_lock when preparing for reset
Larysa Zaremba <[email protected]>
ice: protect XDP configuration with a mutex
Larysa Zaremba <[email protected]>
ice: move netif_queue_set_napi to rtnl-protected sections
Vadim Fedorenko <[email protected]>
ptp: ocp: adjust sysfs entries to expose tty information
Vadim Fedorenko <[email protected]>
ptp: ocp: convert serial ports to array
Jinjie Ruan <[email protected]>
net: phy: Fix missing of_node_put() for leds
Roger Quadros <[email protected]>
net: ethernet: ti: am65-cpsw: Fix RX statistics for XDP_TX and XDP_REDIRECT
Namhyung Kim <[email protected]>
perf lock contention: Fix spinlock and rwlock accounting
Armin Wolf <[email protected]>
hwmon: (hp-wmi-sensors) Check if WMI event data exists
Dan Carpenter <[email protected]>
igc: Unlock on error in igc_io_resume()
Marc Zyngier <[email protected]>
scripts: fix gfp-translate after ___GFP_*_BITS conversion to an enum
Pawel Dembicki <[email protected]>
hwmon: ltc2991: fix register bits defines
Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sync: Introduce hci_cmd_sync_run/hci_cmd_sync_run_once
Douglas Anderson <[email protected]>
Bluetooth: qca: If memdump doesn't work, re-enable IBS
Martin Jocic <[email protected]>
can: kvaser_pciefd: Use a single write when releasing RX buffers
Martin Jocic <[email protected]>
can: kvaser_pciefd: Move reset of DMA RX buffers to the end of the ISR
Martin Jocic <[email protected]>
can: kvaser_pciefd: Rename board_irq to pci_irq
Martin Jocic <[email protected]>
can: kvaser_pciefd: Remove unnecessary comment
Martin Jocic <[email protected]>
can: kvaser_pciefd: Skip redundant NULL pointer check in ISR
Douglas Anderson <[email protected]>
regulator: core: Stub devm_regulator_bulk_get_const() if !CONFIG_REGULATOR
Charles Han <[email protected]>
spi: intel: Add check devm_kasprintf() returned value
Aleksandr Mishin <[email protected]>
platform/x86: dell-smbios: Fix error path in dell_smbios_init()
Dawid Osuchowski <[email protected]>
ice: Add netif_device_attach/detach into PF reset flow
Daiwei Li <[email protected]>
igb: Fix not clearing TimeSync interrupts for 82580
David Howells <[email protected]>
cifs: Fix FALLOC_FL_ZERO_RANGE to preflush buffered part of target region
David Howells <[email protected]>
cifs: Fix copy offload to flush destination region
David Howells <[email protected]>
netfs, cifs: Fix handling of short DIO read
David Howells <[email protected]>
cifs: Fix lack of credit renegotiation on read retry
Andreas Hindborg <[email protected]>
rust: kbuild: fix export of bss symbols
Marc Kleine-Budde <[email protected]>
can: mcp251xfd: fix ring configuration when switching from CAN-CC to CAN-FD mode
Markus Schneider-Pargmann <[email protected]>
can: m_can: Reset cached active_interrupts on start
Markus Schneider-Pargmann <[email protected]>
can: m_can: disable_all_interrupts, not clear active_interrupts
Markus Schneider-Pargmann <[email protected]>
can: m_can: Do not cancel timer from within timer
Markus Schneider-Pargmann <[email protected]>
can: m_can: Remove m_can_rx_peripheral indirection
Markus Schneider-Pargmann <[email protected]>
can: m_can: Remove coalesing disable in isr during suspend
Markus Schneider-Pargmann <[email protected]>
can: m_can: Reset coalescing during suspend/resume
Simon Horman <[email protected]>
can: m_can: Release irq on error in m_can_open
Kuniyuki Iwashima <[email protected]>
can: bcm: Remove proc entry when dev is unregistered.
Marek Olšák <[email protected]>
drm/amdgpu/display: handle gfx12 in amdgpu_dm_plane_format_mod_supported
Hawking Zhang <[email protected]>
drm/amdgpu: Correct register used to clear fault status
Marek Olšák <[email protected]>
drm/amdgpu: check for LINEAR_ALIGNED correctly in check_tiling_flags_gfx6
Alex Hung <[email protected]>
drm/amd/display: Check denominator crb_pipes before used
Alex Hung <[email protected]>
drm/amd/display: Check denominator pbn_div before used
Jules Irenge <[email protected]>
pcmcia: Use resource_size function on resource object
Chen Ni <[email protected]>
media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse
Dmitry Torokhov <[email protected]>
Input: ili210x - use kvmalloc() to allocate buffer for firmware update
Kishon Vijay Abraham I <[email protected]>
PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)
Eric Joyner <[email protected]>
ice: Check all ice_vsi_rebuild() errors in function
Andrei Vagin <[email protected]>
seccomp: release task filters when the task exits
Nathan Lynch <[email protected]>
powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
Christian Brauner <[email protected]>
fs: relax permissions for statmount()
Christian Brauner <[email protected]>
fs: don't copy to userspace under namespace semaphore
Shivaprasad G Bhat <[email protected]>
vfio/spapr: Always clear TCEs before unsetting the window
Hans Verkuil <[email protected]>
media: vivid: don't set HDMI TX controls if there are no HDMI outputs
Jiwei Sun <[email protected]>
crypto: qat - initialize user_input.lock for rate_limiting
Danijel Slivka <[email protected]>
drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts
Hawking Zhang <[email protected]>
drm/amdgpu: Fix smatch static checker warning
Bob Zhou <[email protected]>
drm/amdgpu: add missing error handling in function amdgpu_gmc_flush_gpu_tlb_pasid
Alex Hung <[email protected]>
drm/amd/display: Validate function returns
Alex Hung <[email protected]>
drm/amd/display: Check HDCP returned status
Alex Hung <[email protected]>
drm/amd/display: Run DC_LOG_DC after checking link->link_enc
Hawking Zhang <[email protected]>
drm/amdgpu: Fix register access violation
Ma Ke <[email protected]>
usb: gadget: aspeed_udc: validate endpoint index for ast udc
Shantanu Goel <[email protected]>
usb: uas: set host status byte on data completion error
Chih-Kang Chang <[email protected]>
wifi: rtw89: wow: prevent to send unexpected H2C during download Firmware
Arend van Spriel <[email protected]>
wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3
Andy Shevchenko <[email protected]>
leds: spi-byte: Call of_node_put() on error path
Hans Verkuil <[email protected]>
media: vivid: fix wrong sizeimage value for mplane
Samuel Holland <[email protected]>
riscv: kprobes: Use patch_text_nosync() for insn slots
Konstantin Komarov <[email protected]>
fs/ntfs3: One more reason to mark inode bad
Jan Kara <[email protected]>
udf: Avoid excessive partition lengths
Johannes Berg <[email protected]>
wifi: iwlwifi: mvm: use IWL_FW_CHECK for link ID check
Ziwei Xiao <[email protected]>
gve: Add adminq mutex lock
Yunjian Wang <[email protected]>
netfilter: nf_conncount: fix wrong variable type
Jernej Skrabec <[email protected]>
iommu: sun50i: clear bypass register
Brian Johannesmeyer <[email protected]>
x86/kmsan: Fix hook for unaligned accesses
Kuniyuki Iwashima <[email protected]>
af_unix: Remove put_pid()/put_cred() in copy_peercred().
Hans Verkuil <[email protected]>
media: b2c2: flexcop-usb: fix flexcop_usb_memory_req
Pali Rohár <[email protected]>
irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1
Lad Prabhakar <[email protected]>
irqchip/renesas-rzg2l: Reorder function calls in rzg2l_irqc_irq_disable()
Rakesh Ughreja <[email protected]>
accel/habanalabs/gaudi2: unsecure edma max outstanding register
Alexey Dobriyan <[email protected]>
ELF: fix kernel.randomize_va_space double read
Leon Hwang <[email protected]>
bpf, verifier: Correct tail_call_reachable for bpf prog
Uwe Kleine-König <[email protected]>
virt: sev-guest: Mark driver struct with __refdata to prevent section mismatch
Waiman Long <[email protected]>
cgroup/cpuset: Delay setting of CS_CPU_EXCLUSIVE until valid partition
Alex Hung <[email protected]>
drm/amd/display: Check UnboundedRequestEnabled's value
Konstantin Andreev <[email protected]>
smack: unix sockets: fix accept()ed socket label
Ajith C <[email protected]>
wifi: ath12k: fix firmware crash due to invalid peer nss
Aaradhana Sahu <[email protected]>
wifi: ath12k: fix uninitialize symbol error on ath12k_peer_assoc_h_he()
Takashi Iwai <[email protected]>
ALSA: hda: Add input value sanity checks to HDMI channel map controls
Takashi Iwai <[email protected]>
ALSA: control: Apply sanity check of input values for user elements
Marek Marczykowski-Górecki <[email protected]>
ALSA: hda/realtek: extend quirks for Clevo V5[46]0
Leo Li <[email protected]>
drm/amd/display: Lock DC and exit IPS when changing backlight
Daniele Ceraolo Spurio <[email protected]>
drm/i915: Do not attempt to load the GSC multiple times
Alex Deucher <[email protected]>
drm/amdgpu: always allocate cleared VRAM for GEM allocations
Matt Coster <[email protected]>
drm/imagination: Free pvr_vm_gpuva after unlink
Mary Guillemard <[email protected]>
drm/panthor: Restrict high priorities on group_create
Adrián Larumbe <[email protected]>
drm/panthor: flush FW AS caches in slow reset path
Daniele Ceraolo Spurio <[email protected]>
drm/xe/gsc: Do not attempt to load the GSC multiple times
Naohiro Aota <[email protected]>
btrfs: zoned: handle broken write pointer on zones
Fedor Pchelkin <[email protected]>
btrfs: qgroup: don't use extent changeset when not needed
Ryusuke Konishi <[email protected]>
nilfs2: fix state management in error path of log writing function
Ryusuke Konishi <[email protected]>
nilfs2: protect references to superblock parameters exposed in sysfs
Ryusuke Konishi <[email protected]>
nilfs2: fix missing cleanup on rollforward recovery error
Toke Høiland-Jørgensen <[email protected]>
sched: sch_cake: fix bulk flow accounting logic for host fairness
Eric Dumazet <[email protected]>
ila: call nf_unregister_net_hooks() sooner
Cong Wang <[email protected]>
tcp_bpf: fix return value of tcp_bpf_sendmsg()
Baochen Qiang <[email protected]>
Revert "wifi: ath11k: support hibernation"
Baochen Qiang <[email protected]>
Revert "wifi: ath11k: restore country code during resume"
Alex Deucher <[email protected]>
Revert "drm/amdgpu: align pp_power_profile_mode with kernel docs"
Yuntao Wang <[email protected]>
x86/apic: Make x2apic_disable() work correctly
Mitchell Levy <[email protected]>
x86/fpu: Avoid writing LBR bit to IA32_XSS unless supported
Matt Johnston <[email protected]>
net: mctp-serial: Fix missing escapes on transmit
Souradeep Chakrabarti <[email protected]>
net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup
Steven Rostedt <[email protected]>
eventfs: Use list_del_rcu() for SRCU protected list variable
Baokun Li <[email protected]>
fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF
Jann Horn <[email protected]>
userfaultfd: fix checks for huge PMDs
Jann Horn <[email protected]>
userfaultfd: don't BUG_ON() if khugepaged yanks our page table
Steven Rostedt <[email protected]>
tracing/timerlat: Add interface_lock around clearing of kthread in stop_kthread()
Zheng Yejian <[email protected]>
tracing: Avoid possible softlockup in tracing_iter_reset()
Steven Rostedt <[email protected]>
tracing/timerlat: Only clear timer if a kthread exists
Steven Rostedt <[email protected]>
tracing/osnoise: Use a cpumask to know what threads are kthreads
Brian Norris <[email protected]>
spi: rockchip: Resolve unbalanced runtime PM / system PM handling
Usama Arif <[email protected]>
Revert "mm: skip CMA pages when they are not available"
Hao Ge <[email protected]>
mm/slub: add check for s->flags in the alloc_tagging_slab_free_hook
Will Deacon <[email protected]>
mm: vmalloc: ensure vmap_block is initialised before adding to queue
Petr Tesarik <[email protected]>
kexec_file: fix elfcorehdr digest exclusion when CONFIG_CRASH_HOTPLUG=y
Liam R. Howlett <[email protected]>
maple_tree: remove rcu_read_lock() from mt_validate()
Hao Ge <[email protected]>
codetag: debug: mark codetags for poisoned page as empty
Suren Baghdasaryan <[email protected]>
alloc_tag: fix allocation tag reporting when CONFIG_MODULES=n
Adrian Huang <[email protected]>
mm: vmalloc: optimize vmap_lazy_nr arithmetic when purging each vmap_area
Simon Arlott <[email protected]>
can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
Stephan Gerhold <[email protected]>
pinctrl: qcom: x1e80100: Bypass PDC wakeup parent for now
Satya Priya Kakitapalli <[email protected]>
clk: qcom: clk-alpha-pll: Update set_rate for Zonda PLL
Satya Priya Kakitapalli <[email protected]>
clk: qcom: clk-alpha-pll: Fix zonda set_rate failure when PLL is disabled
Satya Priya Kakitapalli <[email protected]>
clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API
Satya Priya Kakitapalli <[email protected]>
clk: qcom: clk-alpha-pll: Fix the pll post div mask
Xingyu Wu <[email protected]>
clk: starfive: jh7110-sys: Add notifier for PLL0 clock
Helge Deller <[email protected]>
parisc: Delay write-protection until mark_rodata_ro() call
Samuel Holland <[email protected]>
riscv: misaligned: Restrict user access to kernel memory
Hans de Goede <[email protected]>
ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards harder
Miklos Szeredi <[email protected]>
fuse: clear PG_uptodate when using a stolen page
yangyun <[email protected]>
fuse: fix memory leak in fuse_create_open
Jann Horn <[email protected]>
fuse: use unsigned type for getxattr/listxattr size truncation
Joanne Koong <[email protected]>
fuse: check aborted connection before adding requests to pending list for resending
Bernd Schubert <[email protected]>
fuse: disable the combination of passthrough and writeback cache
Joanne Koong <[email protected]>
fuse: update stats for pages in dropped aux writeback list
Seunghwan Baek <[email protected]>
mmc: cqhci: Fix checking of CQHCI_HALT state
Liao Chen <[email protected]>
mmc: sdhci-of-aspeed: fix module autoloading
Sam Protsenko <[email protected]>
mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K
Jonathan Bell <[email protected]>
mmc: core: apply SD quirks earlier during probe
Muhammad Usama Anjum <[email protected]>
selftests: mm: fix build errors on armhf
Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: Ignore keys being loaded with invalid type
Luiz Augusto von Dentz <[email protected]>
Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE"
Boqun Feng <[email protected]>
rust: macros: provide correct provenance when constructing THIS_MODULE
Georg Gottleuber <[email protected]>
nvme-pci: Add sleep quirk for Samsung 990 Evo
Dan Carpenter <[email protected]>
irqchip/riscv-aplic: Fix an IS_ERR() vs NULL bug in probe()
Roland Xu <[email protected]>
rtmutex: Drop rt_mutex::wait_lock before scheduling
Thomas Gleixner <[email protected]>
x86/kaslr: Expose and use the end of the physical memory address space
Anup Patel <[email protected]>
irqchip/sifive-plic: Probe plic driver early for Allwinner D1 platform
Ma Ke <[email protected]>
irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init()
Kan Liang <[email protected]>
perf/x86/intel: Limit the period on Haswell
Kirill A. Shutemov <[email protected]>
x86/tdx: Fix data leak in mmio_read()
Zheng Qixing <[email protected]>
ata: libata: Fix memory leak for error path in ata_host_alloc()
Dan Carpenter <[email protected]>
ksmbd: Unlock on in ksmbd_tcp_set_interfaces()
Namjae Jeon <[email protected]>
ksmbd: unset the binding mark of a reused connection
Paulo Alcantara <[email protected]>
smb: client: fix double put of @cfile in smb2_set_path_size()
Nysal Jan K.A. <[email protected]>
powerpc/qspinlock: Fix deadlock in MCS queue
Maximilien Perreault <[email protected]>
ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx
Vasiliy Kovalev <[email protected]>
ALSA: hda/realtek - Fix inactive headset mic jack for ASUS Vivobook 15 X1504VAP
Adam Queler <[email protected]>
ALSA: hda/realtek: Enable Mute Led for HP Victus 15-fb1xxx
Terry Cheong <[email protected]>
ALSA: hda/realtek: add patch for internal mic in Lenovo V145
Christoffer Sandberg <[email protected]>
ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices
Ravi Bangoria <[email protected]>
KVM: SVM: Don't advertise Bus Lock Detect to guest if SVM support is missing
Maxim Levitsky <[email protected]>
KVM: SVM: fix emulation of msr reads/writes of MSR_FS_BASE and MSR_GS_BASE
Sean Christopherson <[email protected]>
KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
robelin <[email protected]>
ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
Roger Quadros <[email protected]>
net: ethernet: ti: am65-cpsw: fix XDP_DROP, XDP_TX and XDP_REDIRECT
Jens Emil Schulz Østergaard <[email protected]>
net: microchip: vcap: Fix use-after-free error in kunit test
Roger Quadros <[email protected]>
net: ethernet: ti: am65-cpsw: Fix NULL dereference on XDP_TX
Dave Chinner <[email protected]>
xfs: xfs_finobt_count_blocks() walks the wrong btree
Stephen Hemminger <[email protected]>
sch/netem: fix use after free in netem_dequeue
Christian Brauner <[email protected]>
libfs: fix get_stashed_dentry()
-------------
Diffstat:
Documentation/admin-guide/cgroup-v2.rst | 15 +- .../bindings/nvmem/xlnx,zynqmp-nvmem.yaml | 2 +- Makefile | 4 +- arch/arm64/include/asm/acpi.h | 12 + arch/arm64/kernel/acpi_numa.c | 11 - arch/loongarch/include/asm/hugetlb.h | 4 +- arch/loongarch/include/asm/kfence.h | 6 +- arch/loongarch/include/asm/pgtable.h | 50 +-- arch/loongarch/kernel/relocate.c | 4 +- arch/loongarch/kvm/mmu.c | 8 +- arch/loongarch/mm/hugetlbpage.c | 6 +- arch/loongarch/mm/init.c | 10 +- arch/loongarch/mm/kasan_init.c | 10 +- arch/loongarch/mm/pgtable.c | 2 +- arch/mips/kernel/cevt-r4k.c | 15 +- arch/parisc/mm/init.c | 16 +- arch/powerpc/include/asm/nohash/mmu-e500.h | 3 +- arch/powerpc/kernel/rtas.c | 4 + arch/powerpc/kernel/vdso/vdso32.lds.S | 4 +- arch/powerpc/kernel/vdso/vdso64.lds.S | 4 +- arch/powerpc/lib/qspinlock.c | 10 +- arch/powerpc/mm/nohash/Makefile | 2 +- arch/powerpc/mm/nohash/tlb.c | 398 +-------------------- arch/powerpc/mm/nohash/tlb_64e.c | 361 +++++++++++++++++++ arch/powerpc/mm/nohash/tlb_low_64e.S | 195 ---------- arch/riscv/Kconfig | 4 +- arch/riscv/include/asm/processor.h | 26 +- arch/riscv/include/asm/sbi.h | 30 +- arch/riscv/include/asm/trace.h | 54 +++ arch/riscv/kernel/Makefile | 6 +- arch/riscv/kernel/head.S | 3 + arch/riscv/kernel/probes/kprobes.c | 5 +- arch/riscv/kernel/sbi.c | 56 --- arch/riscv/kernel/sbi_ecall.c | 48 +++ arch/riscv/kernel/traps_misaligned.c | 4 +- arch/riscv/mm/init.c | 2 +- arch/s390/boot/startup.c | 8 +- arch/s390/kernel/vmlinux.lds.S | 17 +- arch/um/drivers/line.c | 2 + arch/x86/coco/tdx/tdx.c | 1 - arch/x86/events/intel/core.c | 57 ++- arch/x86/include/asm/fpu/types.h | 7 + arch/x86/include/asm/page_64.h | 1 + arch/x86/include/asm/pgtable_64_types.h | 4 + arch/x86/kernel/apic/apic.c | 11 +- arch/x86/kernel/fpu/xstate.c | 3 + arch/x86/kernel/fpu/xstate.h | 4 +- arch/x86/kvm/svm/svm.c | 15 + arch/x86/kvm/x86.c | 2 + arch/x86/lib/iomem.c | 5 +- arch/x86/mm/init_64.c | 4 + arch/x86/mm/kaslr.c | 34 +- arch/x86/mm/pti.c | 45 ++- block/bio.c | 14 +- drivers/accel/habanalabs/gaudi2/gaudi2_security.c | 1 + drivers/acpi/acpi_processor.c | 15 +- drivers/android/binder.c | 1 + drivers/ata/libata-core.c | 4 +- drivers/ata/libata-scsi.c | 24 +- drivers/ata/pata_macio.c | 7 +- drivers/base/devres.c | 1 + drivers/base/regmap/regcache-maple.c | 3 +- drivers/block/ublk_drv.c | 2 + drivers/bluetooth/btnxpuart.c | 12 +- drivers/bluetooth/hci_qca.c | 1 + drivers/clk/qcom/clk-alpha-pll.c | 25 +- drivers/clk/qcom/clk-rcg.h | 1 + drivers/clk/qcom/clk-rcg2.c | 30 ++ drivers/clk/qcom/gcc-ipq9574.c | 12 +- drivers/clk/qcom/gcc-sm8550.c | 54 +-- drivers/clk/qcom/gcc-x1e80100.c | 52 +-- drivers/clk/starfive/clk-starfive-jh7110-sys.c | 31 +- drivers/clk/starfive/clk-starfive-jh71x0.h | 2 + drivers/clocksource/timer-imx-tpm.c | 16 +- drivers/clocksource/timer-of.c | 17 +- drivers/clocksource/timer-of.h | 1 - .../crypto/intel/qat/qat_common/adf_gen2_pfvf.c | 4 +- drivers/crypto/intel/qat/qat_common/adf_rl.c | 1 + .../intel/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c | 8 +- drivers/crypto/starfive/jh7110-cryp.h | 4 +- drivers/crypto/starfive/jh7110-rsa.c | 15 +- drivers/cxl/core/region.c | 24 +- drivers/firmware/cirrus/cs_dsp.c | 3 + drivers/gpio/gpio-rockchip.c | 1 + drivers/gpio/gpio-zynqmp-modepin.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 15 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 79 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 30 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 15 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 123 ++++--- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_reset.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 6 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 8 +- drivers/gpu/drm/amd/amdgpu/gfxhub_v1_2.c | 8 +- drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 3 +- drivers/gpu/drm/amd/amdgpu/ih_v6_0.c | 28 ++ drivers/gpu/drm/amd/amdgpu/mmhub_v1_8.c | 8 +- drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c | 3 +- drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c | 3 +- drivers/gpu/drm/amd/amdgpu/mxgpu_vi.c | 3 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 15 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 47 +-- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 7 +- .../gpu/drm/amd/display/dc/dcn20/dcn20_hubbub.c | 3 +- .../drm/amd/display/dc/dml2/display_mode_core.c | 2 +- drivers/gpu/drm/amd/display/dc/link/link_factory.c | 6 +- .../display/dc/link/protocols/link_dp_training.c | 3 +- .../display/dc/resource/dcn315/dcn315_resource.c | 2 +- .../drm/amd/display/modules/hdcp/hdcp1_execution.c | 15 +- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 6 +- drivers/gpu/drm/i915/display/intel_display_types.h | 4 + drivers/gpu/drm/i915/display/intel_dp.c | 4 + drivers/gpu/drm/i915/display/intel_dp_aux.c | 16 +- drivers/gpu/drm/i915/display/intel_dp_aux.h | 2 +- drivers/gpu/drm/i915/display/intel_psr.c | 2 +- drivers/gpu/drm/i915/display/intel_quirks.c | 68 ++++ drivers/gpu/drm/i915/display/intel_quirks.h | 6 + drivers/gpu/drm/i915/gt/uc/intel_gsc_uc.c | 2 +- drivers/gpu/drm/i915/gt/uc/intel_uc_fw.h | 5 + drivers/gpu/drm/i915/i915_sw_fence.c | 8 +- drivers/gpu/drm/imagination/pvr_vm.c | 4 + drivers/gpu/drm/nouveau/nvkm/subdev/gsp/fwsec.c | 2 +- drivers/gpu/drm/panthor/panthor_drv.c | 23 ++ drivers/gpu/drm/panthor/panthor_fw.c | 8 +- drivers/gpu/drm/panthor/panthor_mmu.c | 21 +- drivers/gpu/drm/panthor/panthor_mmu.h | 1 + drivers/gpu/drm/panthor/panthor_sched.c | 2 +- drivers/gpu/drm/xe/regs/xe_gt_regs.h | 1 + drivers/gpu/drm/xe/xe_gsc.c | 12 + drivers/gpu/drm/xe/xe_uc_fw.h | 9 +- drivers/gpu/drm/xe/xe_wa.c | 8 + drivers/hid/amd-sfh-hid/amd_sfh_hid.c | 4 +- drivers/hid/bpf/Kconfig | 2 +- drivers/hid/hid-cougar.c | 2 +- drivers/hv/vmbus_drv.c | 1 + drivers/hwmon/adc128d818.c | 4 +- drivers/hwmon/hp-wmi-sensors.c | 2 + drivers/hwmon/lm95234.c | 9 +- drivers/hwmon/ltc2991.c | 6 +- drivers/hwmon/nct6775-core.c | 2 +- drivers/hwmon/w83627ehf.c | 4 +- drivers/i3c/master/mipi-i3c-hci/dma.c | 5 +- drivers/i3c/master/svc-i3c-master.c | 58 ++- drivers/iio/adc/ad7124.c | 30 +- drivers/iio/adc/ad7606.c | 28 +- drivers/iio/adc/ad7606.h | 2 + drivers/iio/adc/ad7606_par.c | 46 ++- drivers/iio/adc/ad_sigma_delta.c | 2 +- drivers/iio/buffer/industrialio-buffer-dmaengine.c | 4 +- drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 13 +- drivers/iio/inkern.c | 8 +- drivers/input/misc/uinput.c | 14 + drivers/input/touchscreen/ili210x.c | 6 +- drivers/iommu/intel/dmar.c | 2 +- drivers/iommu/intel/iommu.c | 4 +- drivers/iommu/intel/iommu.h | 6 +- drivers/iommu/intel/pasid.c | 1 - drivers/iommu/intel/pasid.h | 10 - drivers/iommu/iommufd/hw_pagetable.c | 3 +- drivers/iommu/sun50i-iommu.c | 1 + drivers/irqchip/irq-armada-370-xp.c | 4 + drivers/irqchip/irq-gic-v2m.c | 6 +- drivers/irqchip/irq-renesas-rzg2l.c | 2 +- drivers/irqchip/irq-riscv-aplic-main.c | 4 +- drivers/irqchip/irq-sifive-plic.c | 115 +++--- drivers/leds/leds-spi-byte.c | 6 +- drivers/md/dm-init.c | 4 +- drivers/media/platform/qcom/camss/camss.c | 5 +- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 17 +- drivers/media/test-drivers/vivid/vivid-vid-out.c | 16 +- drivers/media/usb/b2c2/flexcop-usb.c | 7 +- drivers/misc/fastrpc.c | 5 +- drivers/misc/vmw_vmci/vmci_resource.c | 3 +- drivers/mmc/core/quirks.h | 22 +- drivers/mmc/core/sd.c | 4 + drivers/mmc/host/cqhci-core.c | 2 +- drivers/mmc/host/dw_mmc.c | 4 +- drivers/mmc/host/sdhci-of-aspeed.c | 1 + drivers/net/bareudp.c | 22 +- drivers/net/can/kvaser_pciefd.c | 43 ++- drivers/net/can/m_can/m_can.c | 100 ++++-- drivers/net/can/spi/mcp251x.c | 2 +- drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 28 +- drivers/net/can/spi/mcp251xfd/mcp251xfd-ram.c | 11 +- drivers/net/can/spi/mcp251xfd/mcp251xfd-ring.c | 23 +- drivers/net/can/spi/mcp251xfd/mcp251xfd-rx.c | 165 ++++++--- drivers/net/can/spi/mcp251xfd/mcp251xfd-tef.c | 2 +- .../net/can/spi/mcp251xfd/mcp251xfd-timestamp.c | 22 +- drivers/net/can/spi/mcp251xfd/mcp251xfd.h | 42 ++- drivers/net/dsa/vitesse-vsc73xx-core.c | 10 +- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 20 +- drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c | 10 +- drivers/net/ethernet/google/gve/gve.h | 1 + drivers/net/ethernet/google/gve/gve_adminq.c | 22 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c | 6 +- drivers/net/ethernet/intel/ice/ice.h | 2 + drivers/net/ethernet/intel/ice/ice_base.c | 11 +- drivers/net/ethernet/intel/ice/ice_lib.c | 197 ++++------ drivers/net/ethernet/intel/ice/ice_lib.h | 10 +- drivers/net/ethernet/intel/ice/ice_main.c | 63 +++- drivers/net/ethernet/intel/ice/ice_xsk.c | 12 +- drivers/net/ethernet/intel/igb/igb_main.c | 10 + drivers/net/ethernet/intel/igc/igc_main.c | 1 + drivers/net/ethernet/mellanox/mlx5/core/en.h | 20 +- .../net/ethernet/mellanox/mlx5/core/en/params.c | 12 +- drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h | 19 + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 21 +- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 66 ++-- .../net/ethernet/microchip/vcap/vcap_api_kunit.c | 14 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 22 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 82 +++-- drivers/net/ethernet/xilinx/xilinx_axienet.h | 3 + drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 8 + drivers/net/mctp/mctp-serial.c | 4 +- drivers/net/phy/phy_device.c | 2 + drivers/net/usb/ipheth.c | 2 +- drivers/net/usb/r8152.c | 17 +- drivers/net/usb/usbnet.c | 11 +- drivers/net/wireless/ath/ath11k/ahb.c | 4 +- drivers/net/wireless/ath/ath11k/core.c | 119 ++---- drivers/net/wireless/ath/ath11k/core.h | 4 - drivers/net/wireless/ath/ath11k/hif.h | 12 +- drivers/net/wireless/ath/ath11k/mhi.c | 12 +- drivers/net/wireless/ath/ath11k/mhi.h | 3 +- drivers/net/wireless/ath/ath11k/pci.c | 44 +-- drivers/net/wireless/ath/ath11k/qmi.c | 2 +- drivers/net/wireless/ath/ath12k/mac.c | 9 +- .../broadcom/brcm80211/brcmsmac/mac80211_if.c | 1 + drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 3 +- drivers/net/wireless/marvell/mwifiex/main.h | 3 + drivers/net/wireless/realtek/rtw88/usb.c | 13 +- drivers/net/wireless/realtek/rtw89/core.c | 3 +- drivers/nvme/host/constants.c | 2 +- drivers/nvme/host/core.c | 40 +-- drivers/nvme/host/fabrics.c | 10 +- drivers/nvme/host/fault_inject.c | 2 +- drivers/nvme/host/fc.c | 6 +- drivers/nvme/host/multipath.c | 2 +- drivers/nvme/host/nvme.h | 6 +- drivers/nvme/host/pci.c | 17 + drivers/nvme/host/pr.c | 10 +- drivers/nvme/target/admin-cmd.c | 34 +- drivers/nvme/target/core.c | 46 +-- drivers/nvme/target/discovery.c | 14 +- drivers/nvme/target/fabrics-cmd-auth.c | 16 +- drivers/nvme/target/fabrics-cmd.c | 36 +- drivers/nvme/target/io-cmd-bdev.c | 12 +- drivers/nvme/target/passthru.c | 10 +- drivers/nvme/target/rdma.c | 10 +- drivers/nvme/target/tcp.c | 8 +- drivers/nvme/target/zns.c | 30 +- drivers/nvmem/core.c | 6 +- drivers/nvmem/u-boot-env.c | 7 + drivers/of/irq.c | 15 +- drivers/pci/controller/dwc/pci-keystone.c | 44 ++- drivers/pci/controller/dwc/pcie-qcom.c | 25 +- drivers/pci/hotplug/pnv_php.c | 3 +- drivers/pci/pci.c | 35 +- drivers/pcmcia/yenta_socket.c | 6 +- drivers/phy/xilinx/phy-zynqmp.c | 1 + drivers/pinctrl/qcom/pinctrl-x1e80100.c | 4 +- drivers/platform/x86/dell/dell-smbios-base.c | 5 +- drivers/ptp/ptp_ocp.c | 168 +++++---- drivers/scsi/lpfc/lpfc_els.c | 17 +- drivers/scsi/pm8001/pm8001_sas.c | 4 +- drivers/spi/spi-fsl-lpspi.c | 31 +- drivers/spi/spi-hisi-kunpeng.c | 3 + drivers/spi/spi-intel.c | 3 + drivers/spi/spi-rockchip.c | 23 +- drivers/staging/iio/frequency/ad9834.c | 2 +- .../vc04_services/interface/vchiq_arm/vchiq_core.c | 31 +- drivers/ufs/core/ufshcd.c | 7 +- drivers/uio/uio_hv_generic.c | 11 +- drivers/usb/dwc3/core.c | 15 + drivers/usb/dwc3/core.h | 2 + drivers/usb/dwc3/gadget.c | 41 +-- drivers/usb/gadget/udc/aspeed_udc.c | 2 + drivers/usb/gadget/udc/cdns2/cdns2-gadget.c | 12 +- drivers/usb/gadget/udc/cdns2/cdns2-gadget.h | 9 + drivers/usb/storage/uas.c | 1 + drivers/usb/typec/ucsi/ucsi.c | 50 +-- drivers/vfio/vfio_iommu_spapr_tce.c | 13 +- drivers/virt/coco/sev-guest/sev-guest.c | 7 +- drivers/virtio/virtio_ring.c | 4 +- drivers/watchdog/imx7ulp_wdt.c | 5 + drivers/xen/privcmd.c | 10 +- fs/binfmt_elf.c | 5 +- fs/btrfs/ctree.c | 12 +- fs/btrfs/ctree.h | 1 - fs/btrfs/extent-tree.c | 62 +++- fs/btrfs/file.c | 25 +- fs/btrfs/inode.c | 2 +- fs/btrfs/qgroup.c | 90 ++++- fs/btrfs/transaction.h | 6 + fs/btrfs/zoned.c | 30 +- fs/cachefiles/io.c | 2 +- fs/ext4/fast_commit.c | 8 +- fs/fuse/dev.c | 14 +- fs/fuse/dir.c | 2 +- fs/fuse/file.c | 8 +- fs/fuse/inode.c | 7 +- fs/fuse/xattr.c | 4 +- fs/jbd2/recovery.c | 30 ++ fs/libfs.c | 6 +- fs/namespace.c | 93 ++--- fs/netfs/fscache_main.c | 1 + fs/netfs/io.c | 19 +- fs/nfs/super.c | 2 + fs/nilfs2/recovery.c | 35 +- fs/nilfs2/segment.c | 10 +- fs/nilfs2/sysfs.c | 43 ++- fs/ntfs3/dir.c | 52 +-- fs/ntfs3/frecord.c | 4 +- fs/smb/client/cifsfs.c | 21 +- fs/smb/client/cifsglob.h | 1 + fs/smb/client/cifssmb.c | 54 ++- fs/smb/client/file.c | 37 +- fs/smb/client/inode.c | 2 + fs/smb/client/smb2inode.c | 3 + fs/smb/client/smb2ops.c | 18 +- fs/smb/client/smb2pdu.c | 41 ++- fs/smb/client/trace.h | 1 + fs/smb/server/oplock.c | 2 +- fs/smb/server/smb2pdu.c | 14 +- fs/smb/server/transport_tcp.c | 4 +- fs/squashfs/inode.c | 7 +- fs/tracefs/event_inode.c | 2 +- fs/udf/super.c | 15 + fs/xattr.c | 91 ++--- fs/xfs/libxfs/xfs_ialloc_btree.c | 2 +- include/linux/bpf-cgroup.h | 9 - include/linux/mlx5/device.h | 1 + include/linux/mm.h | 4 + include/linux/netfs.h | 1 + include/linux/nvme.h | 16 +- include/linux/path.h | 9 + include/linux/regulator/consumer.h | 8 + include/linux/zswap.h | 4 +- include/net/bluetooth/hci_core.h | 5 - include/net/bluetooth/hci_sync.h | 4 + include/net/mana/mana.h | 2 + include/uapi/drm/drm_fourcc.h | 18 + include/uapi/drm/panthor_drm.h | 6 +- kernel/bpf/btf.c | 4 +- kernel/bpf/verifier.c | 4 +- kernel/cgroup/cgroup.c | 2 +- kernel/cgroup/cpuset.c | 36 +- kernel/dma/map_benchmark.c | 16 + kernel/events/core.c | 18 +- kernel/events/internal.h | 1 + kernel/events/ring_buffer.c | 2 + kernel/events/uprobes.c | 3 +- kernel/exit.c | 3 +- kernel/kexec_file.c | 2 +- kernel/locking/rtmutex.c | 9 +- kernel/resource.c | 6 +- kernel/seccomp.c | 23 +- kernel/smp.c | 1 + kernel/trace/trace.c | 2 + kernel/trace/trace_kprobe.c | 125 ++++--- kernel/trace/trace_osnoise.c | 50 ++- kernel/workqueue.c | 14 +- lib/codetag.c | 17 +- lib/generic-radix-tree.c | 2 + lib/maple_tree.c | 7 +- lib/overflow_kunit.c | 3 +- mm/memcontrol.c | 12 +- mm/memory_hotplug.c | 2 +- mm/page_alloc.c | 7 + mm/slub.c | 4 + mm/sparse.c | 2 +- mm/userfaultfd.c | 29 +- mm/vmalloc.c | 7 +- mm/vmscan.c | 24 +- mm/zswap.c | 2 +- net/bluetooth/hci_conn.c | 6 +- net/bluetooth/hci_sync.c | 42 ++- net/bluetooth/mgmt.c | 144 ++++---- net/bluetooth/smp.c | 7 - net/bridge/br_fdb.c | 6 +- net/can/bcm.c | 4 + net/core/filter.c | 1 - net/core/net-sysfs.c | 2 +- net/ethtool/channels.c | 6 +- net/ethtool/common.c | 26 +- net/ethtool/common.h | 2 +- net/ethtool/ioctl.c | 4 +- net/ipv4/fou_core.c | 29 +- net/ipv4/tcp_bpf.c | 2 +- net/ipv4/tcp_input.c | 6 + net/ipv6/ila/ila.h | 1 + net/ipv6/ila/ila_main.c | 6 + net/ipv6/ila/ila_xlat.c | 13 +- net/netfilter/nf_conncount.c | 8 +- net/sched/sch_cake.c | 11 +- net/sched/sch_netem.c | 9 +- net/socket.c | 4 +- net/unix/af_unix.c | 9 +- rust/Makefile | 2 +- rust/macros/module.rs | 6 +- scripts/gfp-translate | 66 +++- security/smack/smack_lsm.c | 12 +- sound/core/control.c | 6 +- sound/hda/hdmi_chmap.c | 18 + sound/pci/hda/patch_conexant.c | 11 + sound/pci/hda/patch_realtek.c | 22 +- sound/soc/codecs/tas2781-fmwlib.c | 71 ++-- sound/soc/intel/boards/bxt_rt298.c | 2 +- sound/soc/intel/boards/bytcht_cx2072x.c | 2 +- sound/soc/intel/boards/bytcht_da7213.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 2 +- sound/soc/intel/boards/bytcr_rt5640.c | 2 +- sound/soc/intel/boards/bytcr_rt5651.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 2 +- sound/soc/intel/boards/cht_bsw_rt5645.c | 2 +- sound/soc/intel/boards/cht_bsw_rt5672.c | 2 +- sound/soc/soc-dapm.c | 1 + sound/soc/soc-topology.c | 2 + sound/soc/sof/topology.c | 2 + sound/soc/sunxi/sun4i-i2s.c | 143 ++++---- sound/soc/tegra/tegra210_ahub.c | 12 +- tools/lib/bpf/libbpf.c | 4 +- tools/net/ynl/lib/ynl.py | 7 +- tools/perf/util/bpf_lock_contention.c | 3 + tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c | 4 +- tools/testing/selftests/mm/mseal_test.c | 37 +- tools/testing/selftests/mm/seal_elf.c | 13 +- tools/testing/selftests/net/Makefile | 3 +- tools/testing/selftests/riscv/mm/mmap_bottomup.c | 2 - tools/testing/selftests/riscv/mm/mmap_default.c | 2 - tools/testing/selftests/riscv/mm/mmap_test.h | 67 ---- 436 files changed, 4664 insertions(+), 3102 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/375 libfs: fix get_stashed_dentry()
6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <[email protected]>
commit 4e32c25b58b945f976435bbe51f39b32d714052e upstream.
get_stashed_dentry() tries to optimistically retrieve a stashed dentry from a provided location. It needs to ensure to hold rcu lock before it dereference the stashed location to prevent UAF issues. Use rcu_dereference() instead of READ_ONCE() it's effectively equivalent with some lockdep bells and whistles and it communicates clearly that this expects rcu protection.
--- fs/libfs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/libfs.c +3 -3
@@ -2043,12 +2043,12 @@ struct timespec64 simple_inode_init_ts(s }EXPORT_SYMBOL (simple_inode_init_ts); -static inline struct dentry *get_stashed_dentry (struct dentry *stashed) +static inline struct dentry *get_stashed_dentry (struct dentry **stashed) {struct dentry *dentry;guard (rcu)(); - dentry =READ_ONCE (stashed); + dentry =rcu_dereference (*stashed);if (!dentry)return NULL ;if (!lockref_get_not_dead (&dentry->d_lockref))
@@ -2145,7 +2145,7 @@ int path_from_stashed(struct dentry **stconst struct stashed_operations *sops = mnt->mnt_sb->s_fs_info;/* See if dentry can be reused. */ - path->dentry =get_stashed_dentry (*stashed); + path->dentry =get_stashed_dentry (stashed);if (path->dentry) { sops->put_data (data); goto out_path;
Greg Kroah-Hartman
maintainerPATCH 2/375 sch/netem: fix use after free in netem_dequeue
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Hemminger <[email protected]>
commit 3b3a2a9c6349e25a025d2330f479bc33a6ccb54a upstream.
If netem_dequeue() enqueues packet to inner qdisc and that qdisc returns __NET_XMIT_STOLEN. The packet is dropped but qdisc_tree_reduce_backlog() is not called to update the parent's q.qlen, leading to the similar use-after-free as Commit e04991a48dbaf382 ("netem: fix return value if duplicate enqueue fails")
Commands to trigger KASAN UaF:
ip link add type dummy
ip link set lo up
ip link set dummy0 up
tc qdisc add dev lo parent root handle 1: drr
tc filter add dev lo parent 1: basic classid 1:1
tc class add dev lo classid 1:1 drr
tc qdisc add dev lo parent 1:1 handle 2: netem
tc qdisc add dev lo parent 2: handle 3: drr
tc filter add dev lo parent 3: basic classid 3:1 action mirred egress redirect dev dummy0
tc class add dev lo classid 3:1 drr
ping -c1 -W0.01 localhost # Trigger bug
tc class del dev lo classid 1:1
tc class add dev lo classid 1:1 drr
ping -c1 -W0.01 localhost # UaF
--- net/sched/sch_netem.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
net/sched/sch_netem.c +4 -5
@@ -742,11 +742,10 @@ deliver: err =qdisc_enqueue (skb, q->qdisc, &to_free);kfree_skb_list (to_free); -if (err !=NET_XMIT_SUCCESS && -net_xmit_drop_count (err)) { -qdisc_qstats_drop (sch); -qdisc_tree_reduce_backlog (sch,1 , - pkt_len); +if (err !=NET_XMIT_SUCCESS ) { +if (net_xmit_drop_count (err)) +qdisc_qstats_drop (sch); +qdisc_tree_reduce_backlog (sch,1 , pkt_len); } goto tfifo_dequeue; }
Greg Kroah-Hartman
maintainerPATCH 3/375 xfs: xfs_finobt_count_blocks() walks the wrong btree
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Chinner <[email protected]>
commit 95179935beadccaf0f0bb461adb778731e293da4 upstream.
As a result of the factoring in commit 14dd46cf31f4 ("xfs: split xfs_inobt_init_cursor"), mount started taking a long time on a user's filesystem. For Anders, this made mount times regress from under a second to over 15 minutes for a filesystem with only 30 million inodes in it.
Anders bisected it down to the above commit, but even then the bug was not obvious. In this commit, over 20 calls to xfs_inobt_init_cursor() were modified, and some we modified to call a new function named xfs_finobt_init_cursor().
If that takes you a moment to reread those function names to see what the rename was, then you have realised why this bug wasn't spotted during review. And it wasn't spotted on inspection even after the bisect pointed at this commit - a single missing "f" isn't the easiest thing for a human eye to notice....
The result is that xfs_finobt_count_blocks() now incorrectly calls xfs_inobt_init_cursor() so it is now walking the inobt instead of the finobt. Hence when there are lots of allocated inodes in a filesystem, mount takes a -long- time run because it now walks a massive allocated inode btrees instead of the small, nearly empty free inode btrees. It also means all the finobt space reservations are wrong, so mount could potentially given ENOSPC on kernel upgrade.
In hindsight, commit 14dd46cf31f4 should have been two commits - the first to convert the finobt callers to the new API, the second to modify the xfs_inobt_init_cursor() API for the inobt callers. That would have made the bug very obvious during review.
--- fs/xfs/libxfs/xfs_ialloc_btree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/xfs/libxfs/xfs_ialloc_btree.c +1 -1
@@ -749,7 +749,7 @@ xfs_finobt_count_blocks(if (error)return error; - cur =xfs_inobt_init_cursor (pag, tp, agbp); + cur =xfs_finobt_init_cursor (pag, tp, agbp); error =xfs_btree_count_blocks (cur, tree_blocks);xfs_btree_del_cursor (cur, error);xfs_trans_brelse (tp, agbp);
Greg Kroah-Hartman
maintainerPATCH 4/375 net: ethernet: ti: am65-cpsw: Fix NULL dereference on XDP_TX
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <[email protected]>
commit 0a50c35277f96481a5a6ed5faf347f282040c57d upstream.
If number of TX queues are set to 1 we get a NULL pointer dereference during XDP_TX.
~# ethtool -L eth0 tx 1
~# ./xdp-trafficgen udp -A <ipv6-src> -a <ipv6-dst> eth0 -t 2 Transmitting on eth0 (ifindex 2)
[ 241.135257] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030
Fix this by using actual TX queues instead of max TX queues when picking the TX channel in am65_cpsw_ndo_xdp_xmit().
--- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/ti/am65-cpsw-nuss.c +2 -1
@@ -1918,12 +1918,13 @@ static int am65_cpsw_ndo_bpf(struct net_static int am65_cpsw_ndo_xdp_xmit (struct net_device *ndev,int n,struct xdp_frame **frames,u32 flags) { +struct am65_cpsw_common *common =am65_ndev_to_common (ndev);struct am65_cpsw_tx_chn *tx_chn;struct netdev_queue *netif_txq;int cpu =smp_processor_id ();int i, nxmit =0 ; - tx_chn = &am65_ndev_to_common (ndev)->tx_chns[cpu %AM65_CPSW_MAX_TX_QUEUES ]; + tx_chn = &common->tx_chns[cpu % common->tx_ch_num]; netif_txq =netdev_get_tx_queue (ndev, tx_chn->id);__netif_tx_lock (netif_txq, cpu);
Greg Kroah-Hartman
maintainerPATCH 5/375 net: microchip: vcap: Fix use-after-free error in kunit test
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Emil Schulz Østergaard <[email protected]>
commit a3c1e45156ad39f225cd7ddae0f81230a3b1e657 upstream.
This is a clear use-after-free error. We remove it, and rely on checking the return code of vcap_del_rule.
--- drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-)
drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c +2 -12
@@ -1442,18 +1442,8 @@ static void vcap_api_encode_rule_test(stvcap_enable_lookups (&test_vctrl, &test_netdev,0 ,0 , rule->cookie, false); -vcap_free_rule (rule); - -/* Check that the rule has been freed: tricky to access since this -* memory should not be accessible anymore -*/ -KUNIT_EXPECT_PTR_NE (test,NULL , rule); - ret =list_empty (&rule->keyfields); -KUNIT_EXPECT_EQ (test, true, ret); - ret =list_empty (&rule->actionfields); -KUNIT_EXPECT_EQ (test, true, ret); - -vcap_del_rule (&test_vctrl, &test_netdev, id); + ret =vcap_del_rule (&test_vctrl, &test_netdev, id); +KUNIT_EXPECT_EQ (test,0 , ret); }static void vcap_api_set_rule_counter_test (struct kunit *test)
Greg Kroah-Hartman
maintainerPATCH 6/375 net: ethernet: ti: am65-cpsw: fix XDP_DROP, XDP_TX and XDP_REDIRECT
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <[email protected]>
commit 5e24db550bd6f484d2c7687ee488708260e1f84a upstream.
The following XDP_DROP test from [1] stalls the interface after 250 packets.
~# xdb-bench drop -m native eth0
This is because new RX requests are never queued. Fix that.
The below XDP_TX test from [1] fails with a warning
[ 499.947381] XDP_WARN: xdp_update_frame_from_buff(line:277): Driver BUG: missing reserved tailroom
~# xdb-bench tx -m native eth0
Fix that by using PAGE_SIZE during xdp_init_buf().
In XDP_REDIRECT case only 1 packet was processed in rx_poll. Fix it to process up to budget packets.
Fix all XDP error cases to call trace_xdp_exception() and drop the packet in am65_cpsw_run_xdp().
[1] xdp-tools suite https://github.com/xdp-project/xdp-tools
--- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 62 +++++++++++++++++-------------- 1 file changed, 34 insertions(+), 28 deletions(-)
drivers/net/ethernet/ti/am65-cpsw-nuss.c +34 -28
@@ -156,12 +156,13 @@#define AM65_CPSW_CPPI_TX_PKT_TYPE 0x7/* XDP */ -#define AM65_CPSW_XDP_CONSUMED 2 -#define AM65_CPSW_XDP_REDIRECT 1 +#define AM65_CPSW_XDP_CONSUMED BIT(1) +#define AM65_CPSW_XDP_REDIRECT BIT(0)#define AM65_CPSW_XDP_PASS 0/* Include headroom compatible with both skb and xdpf */ -#define AM65_CPSW_HEADROOM (max(NET_SKB_PAD, XDP_PACKET_HEADROOM) + NET_IP_ALIGN) +#define AM65_CPSW_HEADROOM_NA (max(NET_SKB_PAD, XDP_PACKET_HEADROOM) + NET_IP_ALIGN) +#define AM65_CPSW_HEADROOM ALIGN(AM65_CPSW_HEADROOM_NA, sizeof(long))static void am65_cpsw_port_set_sl_mac (struct am65_cpsw_port *slave,const u8 *dev_addr)
@@ -933,7 +934,7 @@ static int am65_cpsw_xdp_tx_frame(struct host_desc =k3_cppi_desc_pool_alloc (tx_chn->desc_pool);if (unlikely (!host_desc)) { ndev->stats.tx_dropped++; -return -ENOMEM ; +return AM65_CPSW_XDP_CONSUMED ;/* drop */ }am65_cpsw_nuss_set_buf_type (tx_chn, host_desc, buf_type);
@@ -942,7 +943,7 @@ static int am65_cpsw_xdp_tx_frame(struct pkt_len, DMA_TO_DEVICE);if (unlikely (dma_mapping_error (tx_chn->dma_dev, dma_buf))) { ndev->stats.tx_dropped++; - ret = -ENOMEM ; + ret =AM65_CPSW_XDP_CONSUMED ;/* drop */ goto pool_free; }
@@ -977,6 +978,7 @@ static int am65_cpsw_xdp_tx_frame(struct/* Inform BQL */ netdev_tx_completed_queue (netif_txq,1 , pkt_len); ndev->stats.tx_errors++; + ret =AM65_CPSW_XDP_CONSUMED ;/* drop */ goto dma_unmap; }
@@ -1004,6 +1006,7 @@ static int am65_cpsw_run_xdp(struct am65struct bpf_prog *prog;struct page *page;u32 act; +int err; prog =READ_ONCE (port->xdp_prog);if (!prog)
@@ -1023,14 +1026,14 @@ static int am65_cpsw_run_xdp(struct am65 xdpf =xdp_convert_buff_to_frame (xdp);if (unlikely (!xdpf)) -break ; + goto drop;__netif_tx_lock (netif_txq, cpu); - ret =am65_cpsw_xdp_tx_frame (ndev, tx_chn, xdpf, + err =am65_cpsw_xdp_tx_frame (ndev, tx_chn, xdpf,AM65_CPSW_TX_BUF_TYPE_XDP_TX );__netif_tx_unlock (netif_txq); -if (ret) -break ; +if (err) + goto drop; ndev->stats.rx_bytes += *len; ndev->stats.rx_packets++;
@@ -1038,7 +1041,7 @@ static int am65_cpsw_run_xdp(struct am65 goto out;case XDP_REDIRECT :if (unlikely (xdp_do_redirect (ndev, xdp, prog))) -break ; + goto drop; ndev->stats.rx_bytes += *len; ndev->stats.rx_packets++;
@@ -1048,6 +1051,7 @@ static int am65_cpsw_run_xdp(struct am65bpf_warn_invalid_xdp_action (ndev, prog, act); fallthrough;case XDP_ABORTED : +drop:trace_xdp_exception (ndev, prog, act); fallthrough;case XDP_DROP :
@@ -1056,7 +1060,6 @@ static int am65_cpsw_run_xdp(struct am65 page =virt_to_head_page (xdp->data);am65_cpsw_put_page (rx_chn, page, true, desc_idx); - out:return ret; }
@@ -1095,7 +1098,7 @@ static void am65_cpsw_nuss_rx_csum(struc }static int am65_cpsw_nuss_rx_packets (struct am65_cpsw_common *common, -u32 flow_idx,int cpu) +u32 flow_idx,int cpu,int *xdp_state) {struct am65_cpsw_rx_chn *rx_chn = &common->rx_chns;u32 buf_dma_len, pkt_len, port_id =0 , csum_info;
@@ -1114,6 +1117,7 @@ static int am65_cpsw_nuss_rx_packets(strvoid **swdata;u32 *psdata; + *xdp_state =AM65_CPSW_XDP_PASS ; ret =k3_udma_glue_pop_rx_chn (rx_chn->rx_chn, flow_idx, &desc_dma);if (ret) {if (ret != -ENODATA )
@@ -1161,15 +1165,13 @@ static int am65_cpsw_nuss_rx_packets(str }if (port->xdp_prog) { -xdp_init_buff (&xdp,AM65_CPSW_MAX_PACKET_SIZE , &port->xdp_rxq); - -xdp_prepare_buff (&xdp, page_addr,skb_headroom (skb), +xdp_init_buff (&xdp,PAGE_SIZE , &port->xdp_rxq); +xdp_prepare_buff (&xdp, page_addr,AM65_CPSW_HEADROOM , pkt_len, false); - - ret =am65_cpsw_run_xdp (common, port, &xdp, desc_idx, - cpu, &pkt_len); -if (ret !=AM65_CPSW_XDP_PASS ) -return ret; + *xdp_state =am65_cpsw_run_xdp (common, port, &xdp, desc_idx, + cpu, &pkt_len); +if (*xdp_state !=AM65_CPSW_XDP_PASS ) + goto allocate;/* Compute additional headroom to be reserved */ headroom = (xdp.data - xdp.data_hard_start) -skb_headroom (skb);
@@ -1193,9 +1195,13 @@ static int am65_cpsw_nuss_rx_packets(str stats->rx_bytes += pkt_len;u64_stats_update_end (&stats->syncp); +allocate: new_page =page_pool_dev_alloc_pages (rx_chn->page_pool); -if (unlikely (!new_page)) +if (unlikely (!new_page)) { +dev_err (dev,"page alloc failed\n" );return -ENOMEM ; + } + rx_chn->pages[desc_idx] = new_page;if (netif_dormant (ndev)) {
@@ -1229,8 +1235,9 @@ static int am65_cpsw_nuss_rx_poll(structstruct am65_cpsw_common *common =am65_cpsw_napi_to_common (napi_rx);int flow =AM65_CPSW_MAX_RX_FLOWS ;int cpu =smp_processor_id (); -bool xdp_redirect = false; +int xdp_state_or =0 ;int cur_budget, ret; +int xdp_state;int num_rx =0 ;/* process every flow */
@@ -1238,12 +1245,11 @@ static int am65_cpsw_nuss_rx_poll(struct cur_budget = budget - num_rx;while (cur_budget--) { - ret =am65_cpsw_nuss_rx_packets (common, flow, cpu); -if (ret) { -if (ret ==AM65_CPSW_XDP_REDIRECT ) - xdp_redirect = true; + ret =am65_cpsw_nuss_rx_packets (common, flow, cpu, + &xdp_state); + xdp_state_or |= xdp_state; +if (ret)break ; - } num_rx++; }
@@ -1251,7 +1257,7 @@ static int am65_cpsw_nuss_rx_poll(structbreak ; } -if (xdp_redirect) +if (xdp_state_or &AM65_CPSW_XDP_REDIRECT )xdp_do_flush ();dev_dbg (common->dev,"%s num_rx:%d %d\n" , __func__, num_rx, budget);
Greg Kroah-Hartman
maintainerPATCH 7/375 ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: robelin <[email protected]>
commit b4a90b543d9f62d3ac34ec1ab97fc5334b048565 upstream.
When using kernel with the following extra config,
- CONFIG_KASAN=y
- CONFIG_KASAN_GENERIC=y
- CONFIG_KASAN_INLINE=y
- CONFIG_KASAN_VMALLOC=y
- CONFIG_FRAME_WARN=4096
kernel detects that snd_pcm_suspend_all() access a freed 'snd_soc_pcm_runtime' object when the system is suspended, which leads to a use-after-free bug:
[ 52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270 [ 52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330
[ 52.047785] Call trace: [ 52.047787] dump_backtrace+0x0/0x3c0 [ 52.047794] show_stack+0x34/0x50 [ 52.047797] dump_stack_lvl+0x68/0x8c [ 52.047802] print_address_description.constprop.0+0x74/0x2c0 [ 52.047809] kasan_report+0x210/0x230 [ 52.047815] __asan_report_load1_noabort+0x3c/0x50 [ 52.047820] snd_pcm_suspend_all+0x1a8/0x270 [ 52.047824] snd_soc_suspend+0x19c/0x4e0
The snd_pcm_sync_stop() has a NULL check on 'substream->runtime' before making any access. So we need to always set 'substream->runtime' to NULL everytime we kfree() it.
--- sound/soc/soc-dapm.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/soc-dapm.c +1 -0
@@ -4066,6 +4066,7 @@ static int snd_soc_dai_link_event(structcase SND_SOC_DAPM_POST_PMD :kfree (substream->runtime); + substream->runtime =NULL ;break ;default :
Greg Kroah-Hartman
maintainerPATCH 8/375 KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 4bcdd831d9d01e0fb64faea50732b59b2ee88da1 upstream.
Grab kvm->srcu when processing KVM_SET_VCPU_EVENTS, as KVM will forcibly leave nested VMX/SVM if SMM mode is being toggled, and leaving nested VMX reads guest memory.
Note, kvm_vcpu_ioctl_x86_set_vcpu_events() can also be called from KVM_RUN via sync_regs(), which already holds SRCU. I.e. trying to precisely use kvm_vcpu_srcu_read_lock() around the problematic SMM code would cause problems. Acquiring SRCU isn't all that expensive, so for simplicity, grab it unconditionally for KVM_SET_VCPU_EVENTS.
=============================
WARNING: suspicious RCU usage 6.10.0-rc7-332d2c1d713e-next-vm #552 Not tainted
-----------------------------
include/linux/kvm_host.h:1027 suspicious rcu_dereference_check() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
1 lock held by repro/1071:
#0: ffff88811e424430 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x7d/0x970 [kvm]
stack backtrace: CPU: 15 PID: 1071 Comm: repro Not tainted 6.10.0-rc7-332d2c1d713e-next-vm #552 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl+0x7f/0x90 lockdep_rcu_suspicious+0x13f/0x1a0 kvm_vcpu_gfn_to_memslot+0x168/0x190 [kvm] kvm_vcpu_read_guest+0x3e/0x90 [kvm] nested_vmx_load_msr+0x6b/0x1d0 [kvm_intel] load_vmcs12_host_state+0x432/0xb40 [kvm_intel] vmx_leave_nested+0x30/0x40 [kvm_intel] kvm_vcpu_ioctl_x86_set_vcpu_events+0x15d/0x2b0 [kvm] kvm_arch_vcpu_ioctl+0x1107/0x1750 [kvm] ? mark_held_locks+0x49/0x70 ? kvm_vcpu_ioctl+0x7d/0x970 [kvm] ? kvm_vcpu_ioctl+0x497/0x970 [kvm] kvm_vcpu_ioctl+0x497/0x970 [kvm] ? lock_acquire+0xba/0x2d0 ? find_held_lock+0x2b/0x80 ? do_user_addr_fault+0x40c/0x6f0 ? lock_release+0xb7/0x270 __x64_sys_ioctl+0x82/0xb0 do_syscall_64+0x6c/0x170 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7ff11eb1b539 </TASK>
--- arch/x86/kvm/x86.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/kvm/x86.c +2 -0
@@ -6040,7 +6040,9 @@ long kvm_arch_vcpu_ioctl(struct file *fiif (copy_from_user (&events, argp,sizeof (struct kvm_vcpu_events )))break ; +kvm_vcpu_srcu_read_lock (vcpu); r =kvm_vcpu_ioctl_x86_set_vcpu_events (vcpu, &events); +kvm_vcpu_srcu_read_unlock (vcpu);break ; }case KVM_GET_DEBUGREGS : {
Greg Kroah-Hartman
maintainerPATCH 9/375 KVM: SVM: fix emulation of msr reads/writes of MSR_FS_BASE and MSR_GS_BASE
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxim Levitsky <[email protected]>
commit dad1613e0533b380318281c1519e1a3477c2d0d2 upstream.
If these msrs are read by the emulator (e.g due to 'force emulation' prefix), SVM code currently fails to extract the corresponding segment bases, and return them to the emulator.
Fix that.
--- arch/x86/kvm/svm/svm.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
arch/x86/kvm/svm/svm.c +12 -0
@@ -2863,6 +2863,12 @@ static int svm_get_msr(struct kvm_vcpu *case MSR_CSTAR : msr_info->data = svm->vmcb01.ptr->save.cstar;break ; +case MSR_GS_BASE : + msr_info->data = svm->vmcb01.ptr->save.gs.base; +break ; +case MSR_FS_BASE : + msr_info->data = svm->vmcb01.ptr->save.fs.base; +break ;case MSR_KERNEL_GS_BASE : msr_info->data = svm->vmcb01.ptr->save.kernel_gs_base;break ;
@@ -3088,6 +3094,12 @@ static int svm_set_msr(struct kvm_vcpu *case MSR_CSTAR : svm->vmcb01.ptr->save.cstar = data;break ; +case MSR_GS_BASE : + svm->vmcb01.ptr->save.gs.base = data; +break ; +case MSR_FS_BASE : + svm->vmcb01.ptr->save.fs.base = data; +break ;case MSR_KERNEL_GS_BASE : svm->vmcb01.ptr->save.kernel_gs_base = data;break ;
Greg Kroah-Hartman
maintainerPATCH 10/375 KVM: SVM: Dont advertise Bus Lock Detect to guest if SVM support is missing
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ravi Bangoria <[email protected]>
commit 54950bfe2b69cdc06ef753872b5225e54eb73506 upstream.
If host supports Bus Lock Detect, KVM advertises it to guests even if SVM support is absent. Additionally, guest wouldn't be able to use it despite guest CPUID bit being set. Fix it by unconditionally clearing the feature bit in KVM cpu capability.
--- arch/x86/kvm/svm/svm.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/kvm/svm/svm.c +3 -0
@@ -5223,6 +5223,9 @@ static __init void svm_set_cpu_caps(void/* CPUID 0x8000001F (SME/SEV features) */ sev_set_cpu_caps (); + +/* Don't advertise Bus Lock Detect to guest if SVM support is absent */ +kvm_cpu_cap_clear (X86_FEATURE_BUS_LOCK_DETECT ); }static __init int svm_hardware_setup (void )
Greg Kroah-Hartman
maintainerPATCH 11/375 ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoffer Sandberg <[email protected]>
commit 4178d78cd7a86510ba68d203f26fc01113c7f126 upstream.
The Sirius notebooks have two sets of speakers 0x17 (sides) and 0x1d (top center). The side speakers are active by default but the top speakers aren't.
This patch provides a pincfg quirk to activate the top speakers.
--- sound/pci/hda/patch_conexant.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
sound/pci/hda/patch_conexant.c +11 -0
@@ -307,6 +307,7 @@ enum {CXT_FIXUP_HEADSET_MIC ,CXT_FIXUP_HP_MIC_NO_PRESENCE ,CXT_PINCFG_SWS_JS201D , + CXT_PINCFG_TOP_SPEAKER, };/* for hda_fixup_thinkpad_acpi() */
@@ -974,6 +975,13 @@ static const struct hda_fixup cxt_fixups .type = HDA_FIXUP_PINS, .v.pins = cxt_pincfg_sws_js201d, }, + [CXT_PINCFG_TOP_SPEAKER] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x1d ,0x82170111 }, + { } + }, + }, };static const struct snd_pci_quirk cxt5045_fixups[] = {
@@ -1070,6 +1078,8 @@ static const struct snd_pci_quirk cxt506SND_PCI_QUIRK_VENDOR (0x17aa ,"Thinkpad" ,CXT_FIXUP_THINKPAD_ACPI ),SND_PCI_QUIRK (0x1c06 ,0x2011 ,"Lemote A1004" ,CXT_PINCFG_LEMOTE_A1004 ),SND_PCI_QUIRK (0x1c06 ,0x2012 ,"Lemote A1205" ,CXT_PINCFG_LEMOTE_A1205 ), +SND_PCI_QUIRK (0x2782 ,0x12c3 ,"Sirius Gen1" ,CXT_PINCFG_TOP_SPEAKER ), + SND_PCI_QUIRK(0x2782, 0x12c5, "Sirius Gen2", CXT_PINCFG_TOP_SPEAKER), {} };
@@ -1089,6 +1099,7 @@ static const struct hda_model_fixup cxt5 { .id = CXT_FIXUP_HP_MIC_NO_PRESENCE, .name = "hp-mic-fix" }, { .id = CXT_PINCFG_LENOVO_NOTEBOOK, .name = "lenovo-20149" }, { .id = CXT_PINCFG_SWS_JS201D, .name = "sws-js201d" }, + { .id = CXT_PINCFG_TOP_SPEAKER, .name = "sirius-top-speaker" }, {} };
Greg Kroah-Hartman
maintainerPATCH 12/375 ALSA: hda/realtek: add patch for internal mic in Lenovo V145
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Terry Cheong <[email protected]>
commit ef27e89e7f3015be2b3c124833fbd6d2e4686561 upstream.
Lenovo V145 is having phase inverted dmic but simply applying inverted dmic fixups does not work. Chaining up verb fixes for ALC283 enables inverting dmic fixup to work properly.
--- sound/pci/hda/patch_realtek.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/pci/hda/patch_realtek.c +9 -0
@@ -7428,6 +7428,7 @@ enum {ALC236_FIXUP_HP_GPIO_LED ,ALC236_FIXUP_HP_MUTE_LED ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF , +ALC236_FIXUP_LENOVO_INV_DMIC ,ALC298_FIXUP_SAMSUNG_AMP ,ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET , ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET,
@@ -9049,6 +9050,12 @@ static const struct hda_fixup alc269_fix .type = HDA_FIXUP_FUNC, .v.func = alc236_fixup_hp_mute_led_micmute_vref, }, + [ALC236_FIXUP_LENOVO_INV_DMIC] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc_fixup_inv_dmic, + .chained = true, + .chain_id = ALC283_FIXUP_INT_MIC, + }, [ALC298_FIXUP_SAMSUNG_AMP] = { .type = HDA_FIXUP_FUNC, .v.func = alc298_fixup_samsung_amp,
@@ -10609,6 +10616,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x38f9 ,"Thinkbook 16P Gen5" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x17aa ,0x38fa ,"Thinkbook 16P Gen5" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x17aa ,0x3902 ,"Lenovo E50-80" ,ALC269_FIXUP_DMIC_THINKPAD_ACPI ), +SND_PCI_QUIRK (0x17aa ,0x3913 ,"Lenovo 145" ,ALC236_FIXUP_LENOVO_INV_DMIC ),SND_PCI_QUIRK (0x17aa ,0x3977 ,"IdeaPad S210" ,ALC283_FIXUP_INT_MIC ),SND_PCI_QUIRK (0x17aa ,0x3978 ,"Lenovo B50-70" ,ALC269_FIXUP_DMIC_THINKPAD_ACPI ), SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
@@ -10860,6 +10868,7 @@ static const struct hda_model_fixup alc2 {.id = ALC623_FIXUP_LENOVO_THINKSTATION_P340, .name = "alc623-lenovo-thinkstation-p340"}, {.id = ALC255_FIXUP_ACER_HEADPHONE_AND_MIC, .name = "alc255-acer-headphone-and-mic"}, {.id = ALC285_FIXUP_HP_GPIO_AMP_INIT, .name = "alc285-hp-amp-init"}, + {.id = ALC236_FIXUP_LENOVO_INV_DMIC, .name = "alc236-fixup-lenovo-inv-mic"}, {} };#define ALC225_STANDARD_PINS \
Greg Kroah-Hartman
maintainerPATCH 13/375 ALSA: hda/realtek: Enable Mute Led for HP Victus 15-fb1xxx
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Queler <[email protected]>
commit b474f60f6a0c90f560190ac2cc6f20805f35d2c1 upstream.
The mute led is controlled by ALC245. This patch enables the already existing quirk for this device.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10229,6 +10229,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x103c ,0x8c16 ,"HP Spectre 16" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x103c ,0x8c17 ,"HP Spectre 16" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x103c ,0x8c21 ,"HP Pavilion Plus Laptop 14-ey0XXX" ,ALC245_FIXUP_HP_X360_MUTE_LEDS ), +SND_PCI_QUIRK (0x103c ,0x8c30 ,"HP Victus 15-fb1xxx" ,ALC245_FIXUP_HP_MUTE_LED_COEFBIT ),SND_PCI_QUIRK (0x103c ,0x8c46 ,"HP EliteBook 830 G11" ,ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8c47 ,"HP EliteBook 840 G11" ,ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED ), SND_PCI_QUIRK(0x103c, 0x8c48, "HP EliteBook 860 G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
Greg Kroah-Hartman
maintainerPATCH 14/375 ALSA: hda/realtek - Fix inactive headset mic jack for ASUS Vivobook 15 X1504VAP
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <[email protected]>
commit a83e4c97ddd7473406ec5e1df8d5e7b24bd7e892 upstream.
When the headset is connected, there is no automatic switching of the capture source - you can only manually select the headset microphone in pavucontrol.
This patch fixes/activates the inactive microphone of the headset.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10356,6 +10356,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1043 ,0x1e02 ,"ASUS UX3402ZA" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x1e11 ,"ASUS Zephyrus G15" ,ALC289_FIXUP_ASUS_GA502 ),SND_PCI_QUIRK (0x1043 ,0x1e12 ,"ASUS UM3402" ,ALC287_FIXUP_CS35L41_I2C_2 ), +SND_PCI_QUIRK (0x1043 ,0x1e1f ,"ASUS Vivobook 15 X1504VAP" ,ALC2XX_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x1043 ,0x1e51 ,"ASUS Zephyrus M15" ,ALC294_FIXUP_ASUS_GU502_PINS ),SND_PCI_QUIRK (0x1043 ,0x1e5e ,"ASUS ROG Strix G513" ,ALC294_FIXUP_ASUS_G513_PINS ), SND_PCI_QUIRK(0x1043, 0x1e63, "ASUS H7606W", ALC285_FIXUP_CS35L56_I2C_2),
Greg Kroah-Hartman
maintainerPATCH 15/375 ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maximilien Perreault <[email protected]>
commit 47a9e8dbb8d4713a9aac7cc6ce3c82dcc94217d8 upstream.
The mute LED on this HP laptop uses ALC236 and requires a quirk to function. This patch enables the existing quirk for the device.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10105,6 +10105,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x103c ,0x87f5 ,"HP" ,ALC287_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x87f6 ,"HP Spectre x360 14" ,ALC245_FIXUP_HP_X360_AMP ),SND_PCI_QUIRK (0x103c ,0x87f7 ,"HP Spectre x360 14" ,ALC245_FIXUP_HP_X360_AMP ), +SND_PCI_QUIRK (0x103c ,0x87fd ,"HP Laptop 14-dq2xxx" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ),SND_PCI_QUIRK (0x103c ,0x87fe ,"HP Laptop 15s-fq2xxx" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ),SND_PCI_QUIRK (0x103c ,0x8805 ,"HP ProBook 650 G8 Notebook PC" ,ALC236_FIXUP_HP_GPIO_LED ), SND_PCI_QUIRK(0x103c, 0x880d, "HP EliteBook 830 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
Greg Kroah-Hartman
maintainerPATCH 16/375 powerpc/qspinlock: Fix deadlock in MCS queue
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nysal Jan K.A. <[email protected]>
commit 734ad0af3609464f8f93e00b6c0de1e112f44559 upstream.
If an interrupt occurs in queued_spin_lock_slowpath() after we increment qnodesp->count and before node->lock is initialized, another CPU might see stale lock values in get_tail_qnode(). If the stale lock value happens to match the lock on that CPU, then we write to the "next" pointer of the wrong qnode. This causes a deadlock as the former CPU, once it becomes the head of the MCS queue, will spin indefinitely until it's "next" pointer is set by its successor in the queue.
Running stress-ng on a 16 core (16EC/16VP) shared LPAR, results in occasional lockups similar to the following:
$ stress-ng --all 128 --vm-bytes 80% --aggressive \
--maximize --oomable --verify --syslog \
--metrics --times --timeout 5m watchdog: CPU 15 Hard LOCKUP
......
NIP [c0000000000b78f4] queued_spin_lock_slowpath+0x1184/0x1490 LR [c000000001037c5c] _raw_spin_lock+0x6c/0x90
Call Trace:
0xc000002cfffa3bf0 (unreliable)
_raw_spin_lock+0x6c/0x90
raw_spin_rq_lock_nested.part.135+0x4c/0xd0
sched_ttwu_pending+0x60/0x1f0
__flush_smp_call_function_queue+0x1dc/0x670
smp_ipi_demux_relaxed+0xa4/0x100
xive_muxed_ipi_action+0x20/0x40
__handle_irq_event_percpu+0x80/0x240
handle_irq_event_percpu+0x2c/0x80
handle_percpu_irq+0x84/0xd0
generic_handle_irq+0x54/0x80
__do_irq+0xac/0x210
__do_IRQ+0x74/0xd0
0x0
do_IRQ+0x8c/0x170
hardware_interrupt_common_virt+0x29c/0x2a0
--- interrupt: 500 at queued_spin_lock_slowpath+0x4b8/0x1490
......
NIP [c0000000000b6c28] queued_spin_lock_slowpath+0x4b8/0x1490
LR [c000000001037c5c] _raw_spin_lock+0x6c/0x90
--- interrupt: 500
0xc0000029c1a41d00 (unreliable)
_raw_spin_lock+0x6c/0x90
futex_wake+0x100/0x260
do_futex+0x21c/0x2a0
sys_futex+0x98/0x270
system_call_exception+0x14c/0x2f0
system_call_vectored_common+0x15c/0x2ecThe following code flow illustrates how the deadlock occurs. For the sake of brevity, assume that both locks (A and B) are contended and we call the queued_spin_lock_slowpath() function.
CPU0 CPU1
---- ----
spin_lock_irqsave(A) |
spin_unlock_irqrestore(A) |
spin_lock(B) |
| |
▼ |
id = qnodesp->count++; |
(Note that nodes[0].lock == A) |
| |
▼ |
Interrupt |
(happens before "nodes[0].lock = B") |
| |
▼ |
spin_lock_irqsave(A) |
| |
▼ |
id = qnodesp->count++ |
nodes[1].lock = A |
| |
▼ |
Tail of MCS queue |
| spin_lock_irqsave(A)
▼ |
Head of MCS queue ▼
| CPU0 is previous tail
▼ |
Spin indefinitely ▼
(until "nodes[1].next != NULL") prev = get_tail_qnode(A, CPU0)
|
▼
prev == &qnodes[CPU0].nodes[0]
(as qnodes[CPU0].nodes[0].lock == A)
|
▼
WRITE_ONCE(prev->next, node)
|
▼
Spin indefinitely
(until nodes[0].locked == 1)Thanks to Saket Kumar Bhaskar for help with recreating the issue
--- arch/powerpc/lib/qspinlock.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
arch/powerpc/lib/qspinlock.c +9 -1
@@ -697,7 +697,15 @@ again: } release: - qnodesp->count--;/* release the node */ +/* +* Clear the lock before releasing the node, as another CPU might see stale +* values if an interrupt occurs after we increment qnodesp->count +* but before node->lock is initialized. The barrier ensures that +* there are no further stores to the node after it has been released. +*/ + node->lock =NULL ; +barrier (); + qnodesp->count--; }void queued_spin_lock_slowpath (struct qspinlock *lock)
Greg Kroah-Hartman
maintainerPATCH 17/375 smb: client: fix double put of @cfile in smb2_set_path_size()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
commit f9c169b51b6ce20394594ef674d6b10efba31220 upstream.
If smb2_compound_op() is called with a valid @cfile and returned -EINVAL, we need to call cifs_get_writable_path() before retrying it as the reference of @cfile was already dropped by previous call.
This fixes the following KASAN splat when running fstests generic/013 against Windows Server 2022:
CIFS: Attempting to mount //w22-fs0/scratch
run fstests generic/013 at 2024-09-02 19:48:59
==================================================================
BUG: KASAN: slab-use-after-free in detach_if_pending+0xab/0x200 Write of size 8 at addr ffff88811f1a3730 by task kworker/3:2/176 CPU: 3 UID: 0 PID: 176 Comm: kworker/3:2 Not tainted 6.11.0-rc6 #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 Workqueue: cifsoplockd cifs_oplock_break [cifs] Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 ? detach_if_pending+0xab/0x200 print_report+0x156/0x4d9 ? detach_if_pending+0xab/0x200 ? __virt_addr_valid+0x145/0x300 ? __phys_addr+0x46/0x90 ? detach_if_pending+0xab/0x200 kasan_report+0xda/0x110 ? detach_if_pending+0xab/0x200 detach_if_pending+0xab/0x200 timer_delete+0x96/0xe0 ? __pfx_timer_delete+0x10/0x10 ? rcu_is_watching+0x20/0x50 try_to_grab_pending+0x46/0x3b0 __cancel_work+0x89/0x1b0 ? __pfx___cancel_work+0x10/0x10 ? kasan_save_track+0x14/0x30 cifs_close_deferred_file+0x110/0x2c0 [cifs] ? __pfx_cifs_close_deferred_file+0x10/0x10 [cifs] ? __pfx_down_read+0x10/0x10 cifs_oplock_break+0x4c1/0xa50 [cifs] ? __pfx_cifs_oplock_break+0x10/0x10 [cifs] ? lock_is_held_type+0x85/0xf0 ? mark_held_locks+0x1a/0x90 process_one_work+0x4c6/0x9f0 ? find_held_lock+0x8a/0xa0 ? __pfx_process_one_work+0x10/0x10 ? lock_acquired+0x220/0x550 ? __list_add_valid_or_report+0x37/0x100 worker_thread+0x2e4/0x570 ? __kthread_parkme+0xd1/0xf0 ? __pfx_worker_thread+0x10/0x10 kthread+0x17f/0x1c0 ? kthread+0xda/0x1c0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 1118: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 cifs_new_fileinfo+0xc8/0x9d0 [cifs] cifs_atomic_open+0x467/0x770 [cifs] lookup_open.isra.0+0x665/0x8b0 path_openat+0x4c3/0x1380 do_filp_open+0x167/0x270 do_sys_openat2+0x129/0x160 __x64_sys_creat+0xad/0xe0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 83: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x70 poison_slab_object+0xe9/0x160 __kasan_slab_free+0x32/0x50 kfree+0xf2/0x300 process_one_work+0x4c6/0x9f0 worker_thread+0x2e4/0x570 kthread+0x17f/0x1c0 ret_from_fork+0x31/0x60 ret_from_fork_asm+0x1a/0x30 Last potentially related work creation: kasan_save_stack+0x30/0x50 __kasan_record_aux_stack+0xad/0xc0 insert_work+0x29/0xe0 __queue_work+0x5ea/0x760 queue_work_on+0x6d/0x90 _cifsFileInfo_put+0x3f6/0x770 [cifs] smb2_compound_op+0x911/0x3940 [cifs] smb2_set_path_size+0x228/0x270 [cifs] cifs_set_file_size+0x197/0x460 [cifs] cifs_setattr+0xd9c/0x14b0 [cifs] notify_change+0x4e3/0x740 do_truncate+0xfa/0x180 vfs_truncate+0x195/0x200 __x64_sys_truncate+0x109/0x150 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- fs/smb/client/smb2inode.c | 1 + 1 file changed, 1 insertion(+)
fs/smb/client/smb2inode.c +1 -0
@@ -1149,6 +1149,7 @@ smb2_set_path_size(const unsigned int xi cfile, NULL, NULL, dentry);if (rc == -EINVAL ) {cifs_dbg (FYI ,"invalid lease key, resending request without lease" ); +cifs_get_writable_path (tcon, full_path,FIND_WR_ANY , &cfile); rc = smb2_compound_op(xid, tcon, cifs_sb, full_path, &oparms, &in_iov, &(int){SMB2_OP_SET_EOF}, 1,
Greg Kroah-Hartman
maintainerPATCH 18/375 ksmbd: unset the binding mark of a reused connection
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
commit 78c5a6f1f630172b19af4912e755e1da93ef0ab5 upstream.
Steve French reported null pointer dereference error from sha256 lib. cifs.ko can send session setup requests on reused connection. If reused connection is used for binding session, conn->binding can still remain true and generate_preauth_hash() will not set sess->Preauth_HashValue and it will be NULL.
It is used as a material to create an encryption key in ksmbd_gen_smb311_encryptionkey. ->Preauth_HashValue cause null pointer dereference error from crypto_shash_update().
BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 8 PID: 429254 Comm: kworker/8:39 Hardware name: LENOVO 20MAS08500/20MAS08500, BIOS N2CET69W (1.52 ) Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] RIP: 0010:lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] <TASK> ? show_regs+0x6d/0x80 ? __die+0x24/0x80 ? page_fault_oops+0x99/0x1b0 ? do_user_addr_fault+0x2ee/0x6b0 ? exc_page_fault+0x83/0x1b0 ? asm_exc_page_fault+0x27/0x30 ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] _sha256_update+0x77/0xa0 [sha256_ssse3] sha256_avx2_update+0x15/0x30 [sha256_ssse3] crypto_shash_update+0x1e/0x40 hmac_update+0x12/0x20 crypto_shash_update+0x1e/0x40 generate_key+0x234/0x380 [ksmbd] generate_smb3encryptionkey+0x40/0x1c0 [ksmbd] ksmbd_gen_smb311_encryptionkey+0x72/0xa0 [ksmbd] ntlm_authenticate.isra.0+0x423/0x5d0 [ksmbd] smb2_sess_setup+0x952/0xaa0 [ksmbd] __process_request+0xa3/0x1d0 [ksmbd] __handle_ksmbd_work+0x1c4/0x2f0 [ksmbd] handle_ksmbd_work+0x2d/0xa0 [ksmbd] process_one_work+0x16c/0x350 worker_thread+0x306/0x440 ? __pfx_worker_thread+0x10/0x10 kthread+0xef/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x44/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK>
--- fs/smb/server/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/smb/server/smb2pdu.c +4 -0
@@ -1687,6 +1687,8 @@ int smb2_sess_setup(struct ksmbd_work *w rc =ksmbd_session_register (conn, sess);if (rc) goto out_err; + + conn->binding = false; }else if (conn->dialect >=SMB30_PROT_ID && (server_conf.flags &KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL ) && req->Flags &SMB2_SESSION_REQ_FLAG_BINDING ) {
@@ -1765,6 +1767,8 @@ int smb2_sess_setup(struct ksmbd_work *w sess =NULL ; goto out_err; } + + conn->binding = false; } work->sess = sess;
Greg Kroah-Hartman
maintainerPATCH 19/375 ksmbd: Unlock on in ksmbd_tcp_set_interfaces()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 844436e045ac2ab7895d8b281cb784a24de1d14d upstream.
Unlock before returning an error code if this allocation fails.
--- fs/smb/server/transport_tcp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/smb/server/transport_tcp.c +3 -1
@@ -624,8 +624,10 @@ int ksmbd_tcp_set_interfaces(char *ifc_lfor_each_netdev (&init_net, netdev) {if (netif_is_bridge_port (netdev))continue ; -if (!alloc_iface (kstrdup (netdev->name,GFP_KERNEL ))) +if (!alloc_iface (kstrdup (netdev->name,GFP_KERNEL ))) { +rtnl_unlock ();return -ENOMEM ; + } }rtnl_unlock (); bind_additional_ifaces =1 ;
Greg Kroah-Hartman
maintainerPATCH 20/375 ata: libata: Fix memory leak for error path in ata_host_alloc()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <[email protected]>
commit 284b75a3d83c7631586d98f6dede1d90f128f0db upstream.
In ata_host_alloc(), if devres_alloc() fails to allocate the device host resource data pointer, the already allocated ata_host structure is not freed before returning from the function. This results in a potential memory leak.
Call kfree(host) before jumping to the error handling path to ensure that the ata_host structure is properly freed if devres_alloc() fails.
--- drivers/ata/libata-core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/ata/libata-core.c +3 -1
@@ -5583,8 +5583,10 @@ struct ata_host *ata_host_alloc(struct d } dr =devres_alloc (ata_devres_release,0 ,GFP_KERNEL ); -if (!dr) +if (!dr) { +kfree (host); goto err_out; + }devres_add (dev, dr);dev_set_drvdata (dev, host);
Greg Kroah-Hartman
maintainerPATCH 21/375 x86/tdx: Fix data leak in mmio_read()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill A. Shutemov <[email protected]>
commit b6fb565a2d15277896583d471b21bc14a0c99661 upstream.
The mmio_read() function makes a TDVMCALL to retrieve MMIO data for an address from the VMM.
Sean noticed that mmio_read() unintentionally exposes the value of an initialized variable (val) on the stack to the VMM.
This variable is only needed as an output value. It did not need to be passed to the VMM in the first place.
Do not send the original value of *val to the VMM.
[ dhansen: clarify what 'val' is used for. ]
--- arch/x86/coco/tdx/tdx.c | 1 - 1 file changed, 1 deletion(-)
arch/x86/coco/tdx/tdx.c +0 -1
@@ -385,7 +385,6 @@ static bool mmio_read(int size, unsigned .r12 = size, .r13 = EPT_READ, .r14 = addr, - .r15 = *val, };if (__tdx_hypercall (&args))
Greg Kroah-Hartman
maintainerPATCH 22/375 perf/x86/intel: Limit the period on Haswell
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kan Liang <[email protected]>
commit 25dfc9e357af8aed1ca79b318a73f2c59c1f0b2b upstream.
Running the ltp test cve-2015-3290 concurrently reports the following warnings.
perfevents: irq loop stuck!
WARNING: CPU: 31 PID: 32438 at arch/x86/events/intel/core.c:3174 intel_pmu_handle_irq+0x285/0x370 Call Trace: <NMI> ? __warn+0xa4/0x220 ? intel_pmu_handle_irq+0x285/0x370 ? __report_bug+0x123/0x130 ? intel_pmu_handle_irq+0x285/0x370 ? __report_bug+0x123/0x130 ? intel_pmu_handle_irq+0x285/0x370 ? report_bug+0x3e/0xa0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x18/0x50 ? asm_exc_invalid_op+0x1a/0x20 ? irq_work_claim+0x1e/0x40 ? intel_pmu_handle_irq+0x285/0x370 perf_event_nmi_handler+0x3d/0x60 nmi_handle+0x104/0x330
Thanks to Thomas Gleixner's analysis, the issue is caused by the low initial period (1) of the frequency estimation algorithm, which triggers the defects of the HW, specifically erratum HSW11 and HSW143. (For the details, please refer https://lore.kernel.org/lkml/87plq9l5d2.ffs@tglx/)
The HSW11 requires a period larger than 100 for the INST_RETIRED.ALL event, but the initial period in the freq mode is 1. The erratum is the same as the BDM11, which has been supported in the kernel. A minimum period of 128 is enforced as well on HSW.
HSW143 is regarding that the fixed counter 1 may overcount 32 with the Hyper-Threading is enabled. However, based on the test, the hardware has more issues than it tells. Besides the fixed counter 1, the message 'interrupt took too long' can be observed on any counter which was armed with a period < 32 and two events expired in the same NMI. A minimum period of 32 is enforced for the rest of the events.
The recommended workaround code of the HSW143 is not implemented. Because it only addresses the issue for the fixed counter. It brings extra overhead through extra MSR writing. No related overcounting issue has been reported so far.
--- arch/x86/events/intel/core.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-)
arch/x86/events/intel/core.c +21 -2
@@ -4529,6 +4529,25 @@ static enum hybrid_cpu_type adl_get_hybrreturn HYBRID_INTEL_CORE ; } +static inline bool erratum_hsw11 (struct perf_event *event) +{ +return (event->hw.config &INTEL_ARCH_EVENT_MASK ) == + X86_CONFIG(.event=0xc0, .umask=0x01); +} + +/* +* The HSW11 requires a period larger than 100 which is the same as the BDM11. +* A minimum period of 128 is enforced as well for the INST_RETIRED.ALL. +* +* The message 'interrupt took too long' can be observed on any counter which +* was armed with a period < 32 and two events expired in the same NMI. +* A minimum period of 32 is enforced for the rest of the events. +*/ +static void hsw_limit_period (struct perf_event *event,s64 *left) +{ + *left =max (*left,erratum_hsw11 (event) ?128 :32 ); +} +/* * Broadwell: *
@@ -4546,8 +4565,7 @@ static enum hybrid_cpu_type adl_get_hybr*/ static void bdw_limit_period (struct perf_event *event,s64 *left) { -if ((event->hw.config &INTEL_ARCH_EVENT_MASK ) == - X86_CONFIG(.event=0xc0, .umask=0x01)) { +if (erratum_hsw11 (event)) {if (*left <128 ) *left =128 ; *left &= ~0x3fULL ;
@@ -6573,6 +6591,7 @@ __init int intel_pmu_init(void) x86_pmu.hw_config = hsw_hw_config; x86_pmu.get_event_constraints = hsw_get_event_constraints; + x86_pmu.limit_period = hsw_limit_period; x86_pmu.lbr_double_abort = true; extra_attr =boot_cpu_has (X86_FEATURE_RTM ) ? hsw_format_attr : nhm_format_attr;
Greg Kroah-Hartman
maintainerPATCH 23/375 irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit c5af2c90ba5629f0424a8d315f75fb8d91713c3c upstream.
gicv2m_of_init() fails to perform an of_node_put() when of_address_to_resource() fails, leading to a refcount leak.
Address this by moving the error handling path outside of the loop and making it common to all failure modes.
--- drivers/irqchip/irq-gic-v2m.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/irqchip/irq-gic-v2m.c +3 -3
@@ -438,12 +438,12 @@ static int __init gicv2m_of_init(struct ret =gicv2m_init_one (&child->fwnode, spi_start, nr_spis, &res,0 ); -if (ret) { -of_node_put (child); +if (ret)break ; - } } +if (ret && child) +of_node_put (child);if (!ret) ret =gicv2m_allocate_domains (parent);if (ret)
Greg Kroah-Hartman
maintainerPATCH 24/375 irqchip/sifive-plic: Probe plic driver early for Allwinner D1 platform
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anup Patel <[email protected]>
commit 4d936f10ff80274841537a26d1fbfe9984de0ef9 upstream.
The latest Linux RISC-V no longer boots on the Allwinner D1 platform because the sun4i_timer driver fails to get an interrupt from PLIC due to the recent conversion of the PLIC to a platform driver. Converting the sun4i timer to a platform driver does not work either because the D1 does not have a SBI timer available so early boot hangs. See the 'Closes:' link for deeper analysis.
The real fix requires enabling the SBI time extension in the platform firmware (OpenSBI) and convert sun4i_timer into platform driver. Unfortunately, the real fix involves changing multiple places and can't be achieved in a short duration and aside of that requires users to update firmware.
As a work-around, retrofit PLIC probing such that the PLIC is probed early only for the Allwinner D1 platform and probed as a regular platform driver for rest of the RISC-V platforms. In the process, partially revert some of the previous changes because the PLIC device pointer is not available in all probing paths.
--- drivers/irqchip/irq-sifive-plic.c | 115 +++++++++++++++++++++++--------------- 1 file changed, 71 insertions(+), 44 deletions(-)
drivers/irqchip/irq-sifive-plic.c +71 -44
@@ -3,6 +3,7 @@* Copyright (C) 2017 SiFive * Copyright (C) 2018 Christoph Hellwig */ +#define pr_fmt (fmt) "riscv-plic: " fmt#include <linux/cpu.h> #include <linux/interrupt.h> #include <linux/io.h>
@@ -63,7 +64,7 @@#define PLIC_QUIRK_EDGE_INTERRUPT 0struct plic_priv { -struct device *dev; +struct fwnode_handle *fwnode;struct cpumask lmask;struct irq_domain *irqdomain;void __iomem *regs;
@@ -378,8 +379,8 @@ static void plic_handle_irq(struct irq_dint err =generic_handle_domain_irq (handler->priv->irqdomain, hwirq);if (unlikely (err)) { -dev_warn_ratelimited (handler->priv->dev, -"can't find mapping for hwirq %lu\n" , hwirq); +pr_warn_ratelimited ("%pfwP: can't find mapping for hwirq %lu\n" , + handler->priv->fwnode, hwirq); } }
@@ -408,7 +409,8 @@ static int plic_starting_cpu(unsigned inenable_percpu_irq (plic_parent_irq,irq_get_trigger_type (plic_parent_irq)); else - dev_warn(handler->priv->dev, "cpu%d: parent irq not available\n", cpu); + pr_warn("%pfwP: cpu%d: parent irq not available\n", + handler->priv->fwnode, cpu);plic_set_threshold (handler,PLIC_ENABLE_THRESHOLD );return 0 ;
@@ -424,38 +426,36 @@ static const struct of_device_id plic_ma {} }; -static int plic_parse_nr_irqs_and_contexts (struct platform_device *pdev, +static int plic_parse_nr_irqs_and_contexts (struct fwnode_handle *fwnode,u32 *nr_irqs,u32 *nr_contexts) { -struct device *dev = &pdev->dev;int rc;/* * Currently, only OF fwnode is supported so extend this * function for ACPI support. */ -if (!is_of_node (dev->fwnode)) +if (!is_of_node (fwnode))return -EINVAL ; - rc =of_property_read_u32 (to_of_node (dev->fwnode),"riscv,ndev" , nr_irqs); + rc =of_property_read_u32 (to_of_node (fwnode),"riscv,ndev" , nr_irqs);if (rc) { -dev_err (dev,"riscv,ndev property not available\n" ); +pr_err ("%pfwP: riscv,ndev property not available\n" , fwnode);return rc; } - *nr_contexts =of_irq_count (to_of_node (dev->fwnode)); + *nr_contexts =of_irq_count (to_of_node (fwnode));if (WARN_ON (!(*nr_contexts))) { -dev_err (dev,"no PLIC context available\n" ); +pr_err ("%pfwP: no PLIC context available\n" , fwnode);return -EINVAL ; }return 0 ; } -static int plic_parse_context_parent (struct platform_device *pdev,u32 context, +static int plic_parse_context_parent (struct fwnode_handle *fwnode,u32 context,u32 *parent_hwirq,int *parent_cpu) { -struct device *dev = &pdev->dev;struct of_phandle_args parent;unsigned long hartid;int rc;
@@ -464,10 +464,10 @@ static int plic_parse_context_parent(str* Currently, only OF fwnode is supported so extend this * function for ACPI support. */ -if (!is_of_node (dev->fwnode)) +if (!is_of_node (fwnode))return -EINVAL ; - rc =of_irq_parse_one (to_of_node (dev->fwnode), context, &parent); + rc =of_irq_parse_one (to_of_node (fwnode), context, &parent);if (rc)return rc;
@@ -480,48 +480,55 @@ static int plic_parse_context_parent(strreturn 0 ; } -static int plic_probe (struct platform_device *pdev) +static int plic_probe (struct fwnode_handle *fwnode) {int error =0 , nr_contexts, nr_handlers =0 , cpu, i; -struct device *dev = &pdev->dev;unsigned long plic_quirks =0 ;struct plic_handler *handler;u32 nr_irqs, parent_hwirq;struct plic_priv *priv;irq_hw_number_t hwirq; +void __iomem *regs; -if (is_of_node (dev->fwnode)) { +if (is_of_node (fwnode)) {const struct of_device_id *id; - id =of_match_node (plic_match,to_of_node (dev->fwnode)); + id =of_match_node (plic_match,to_of_node (fwnode));if (id) plic_quirks = (unsigned long )id->data; + + regs =of_iomap (to_of_node (fwnode),0 ); +if (!regs) +return -ENOMEM ; + }else { +return -ENODEV ; } - error =plic_parse_nr_irqs_and_contexts (pdev, &nr_irqs, &nr_contexts); + error =plic_parse_nr_irqs_and_contexts (fwnode, &nr_irqs, &nr_contexts);if (error) -return error; + goto fail_free_regs; - priv =devm_kzalloc (dev,sizeof (*priv),GFP_KERNEL ); -if (!priv) -return -ENOMEM ; + priv =kzalloc (sizeof (*priv),GFP_KERNEL ); +if (!priv) { + error = -ENOMEM ; + goto fail_free_regs; + } - priv->dev = dev; + priv->fwnode = fwnode; priv->plic_quirks = plic_quirks; priv->nr_irqs = nr_irqs; + priv->regs = regs; - priv->regs =devm_platform_ioremap_resource (pdev,0 ); -if (WARN_ON (!priv->regs)) -return -EIO ; - - priv->prio_save =devm_bitmap_zalloc (dev, nr_irqs,GFP_KERNEL ); -if (!priv->prio_save) -return -ENOMEM ; + priv->prio_save =bitmap_zalloc (nr_irqs,GFP_KERNEL ); +if (!priv->prio_save) { + error = -ENOMEM ; + goto fail_free_priv; + }for (i =0 ; i < nr_contexts; i++) { - error =plic_parse_context_parent (pdev, i, &parent_hwirq, &cpu); + error =plic_parse_context_parent (fwnode, i, &parent_hwirq, &cpu);if (error) { -dev_warn (dev,"hwirq for context%d not found\n" , i); +pr_warn ("%pfwP: hwirq for context%d not found\n" , fwnode, i);continue ; }
@@ -543,7 +550,7 @@ static int plic_probe(struct platform_de }if (cpu <0 ) { -dev_warn (dev,"Invalid cpuid for context %d\n" , i); +pr_warn ("%pfwP: Invalid cpuid for context %d\n" , fwnode, i);continue ; }
@@ -554,7 +561,7 @@ static int plic_probe(struct platform_de*/ handler =per_cpu_ptr (&plic_handlers, cpu);if (handler->present) { -dev_warn (dev,"handler already present for context %d.\n" , i); +pr_warn ("%pfwP: handler already present for context %d.\n" , fwnode, i);plic_set_threshold (handler,PLIC_DISABLE_THRESHOLD ); goto done; }
@@ -568,8 +575,8 @@ static int plic_probe(struct platform_dei *CONTEXT_ENABLE_SIZE ; handler->priv = priv; - handler->enable_save =devm_kcalloc (dev,DIV_ROUND_UP (nr_irqs,32 ), -sizeof (*handler->enable_save),GFP_KERNEL ); + handler->enable_save =kcalloc (DIV_ROUND_UP (nr_irqs,32 ), +sizeof (*handler->enable_save),GFP_KERNEL );if (!handler->enable_save) goto fail_cleanup_contexts; done:
@@ -581,7 +588,7 @@ done: nr_handlers++; } - priv->irqdomain =irq_domain_add_linear (to_of_node (dev->fwnode), nr_irqs +1 , + priv->irqdomain =irq_domain_add_linear (to_of_node (fwnode), nr_irqs +1 , &plic_irqdomain_ops, priv);if (WARN_ON (!priv->irqdomain)) goto fail_cleanup_contexts;
@@ -619,13 +626,13 @@ done: } } -dev_info (dev,"mapped %d interrupts with %d handlers for %d contexts.\n" , - nr_irqs, nr_handlers, nr_contexts); +pr_info ("%pfwP: mapped %d interrupts with %d handlers for %d contexts.\n" , + fwnode, nr_irqs, nr_handlers, nr_contexts);return 0 ; fail_cleanup_contexts:for (i =0 ; i < nr_contexts; i++) { -if (plic_parse_context_parent (pdev, i, &parent_hwirq, &cpu)) +if (plic_parse_context_parent (fwnode, i, &parent_hwirq, &cpu))continue ;if (parent_hwirq !=RV_IRQ_EXT || cpu <0 )continue ;
@@ -634,17 +641,37 @@ fail_cleanup_contexts: handler->present = false; handler->hart_base =NULL ; handler->enable_base =NULL ; +kfree (handler->enable_save); handler->enable_save =NULL ; handler->priv =NULL ; } -return -ENOMEM ; +bitmap_free (priv->prio_save); +fail_free_priv: +kfree (priv); +fail_free_regs: +iounmap (regs); +return error; +} + +static int plic_platform_probe (struct platform_device *pdev) +{ +return plic_probe (pdev->dev.fwnode); }static struct platform_driver plic_driver = { .driver = { .name ="riscv-plic" , .of_match_table = plic_match, + .suppress_bind_attrs = true, }, - .probe = plic_probe, + .probe = plic_platform_probe, };builtin_platform_driver (plic_driver); + +static int __init plic_early_probe (struct device_node *node, +struct device_node *parent) +{ +return plic_probe (&node->fwnode); +} + +IRQCHIP_DECLARE (riscv,"allwinner,sun20i-d1-plic" , plic_early_probe);
Greg Kroah-Hartman
maintainerPATCH 25/375 x86/kaslr: Expose and use the end of the physical memory address space
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit ea72ce5da22806d5713f3ffb39a6d5ae73841f93 upstream.
iounmap() on x86 occasionally fails to unmap because the provided valid ioremap address is not below high_memory. It turned out that this happens due to KASLR.
KASLR uses the full address space between PAGE_OFFSET and vaddr_end to randomize the starting points of the direct map, vmalloc and vmemmap regions. It thereby limits the size of the direct map by using the installed memory size plus an extra configurable margin for hot-plug memory. This limitation is done to gain more randomization space because otherwise only the holes between the direct map, vmalloc, vmemmap and vaddr_end would be usable for randomizing.
The limited direct map size is not exposed to the rest of the kernel, so the memory hot-plug and resource management related code paths still operate under the assumption that the available address space can be determined with MAX_PHYSMEM_BITS.
request_free_mem_region() allocates from (1 << MAX_PHYSMEM_BITS) - 1 downwards. That means the first allocation happens past the end of the direct map and if unlucky this address is in the vmalloc space, which causes high_memory to become greater than VMALLOC_START and consequently causes iounmap() to fail for valid ioremap addresses.
MAX_PHYSMEM_BITS cannot be changed for that because the randomization does not align with address bit boundaries and there are other places which actually require to know the maximum number of address bits. All remaining usage sites of MAX_PHYSMEM_BITS have been analyzed and found to be correct.
Cure this by exposing the end of the direct map via PHYSMEM_END and use that for the memory hot-plug and resource management related places instead of relying on MAX_PHYSMEM_BITS. In the KASLR case PHYSMEM_END maps to a variable which is initialized by the KASLR initialization and otherwise it is based on MAX_PHYSMEM_BITS as before.
To prevent future hickups add a check into add_pages() to catch callers trying to add memory above PHYSMEM_END.
--- arch/x86/include/asm/page_64.h | 1 + arch/x86/include/asm/pgtable_64_types.h | 4 ++++ arch/x86/mm/init_64.c | 4 ++++ arch/x86/mm/kaslr.c | 32 ++++++++++++++++++++++++++------ include/linux/mm.h | 4 ++++ kernel/resource.c | 6 ++---- mm/memory_hotplug.c | 2 +- mm/sparse.c | 2 +- 8 files changed, 43 insertions(+), 12 deletions(-)
arch/x86/include/asm/page_64.h +1 -0
@@ -17,6 +17,7 @@ extern unsigned long phys_base;extern unsigned long page_offset_base;extern unsigned long vmalloc_base;extern unsigned long vmemmap_base; +extern unsigned long physmem_end;static __always_inline unsigned long __phys_addr_nodebug (unsigned long x) {
arch/x86/include/asm/pgtable_64_types.h +4 -0
@@ -140,6 +140,10 @@ extern unsigned int ptrs_per_p4d;# define VMEMMAP_START __VMEMMAP_BASE_L4#endif /* CONFIG_DYNAMIC_MEMORY_LAYOUT */ +#ifdef CONFIG_RANDOMIZE_MEMORY +# define PHYSMEM_END physmem_end +#endif +/* * End of the region for which vmalloc page tables are pre-allocated. * For non-KMSAN builds, this is the same as VMALLOC_END.
arch/x86/mm/init_64.c +4 -0
@@ -950,8 +950,12 @@ static void update_end_of_memory_vars(u6int add_pages (int nid,unsigned long start_pfn,unsigned long nr_pages,struct mhp_params *params) { +unsigned long end = ((start_pfn + nr_pages) <<PAGE_SHIFT ) -1 ;int ret; +if (WARN_ON_ONCE (end >PHYSMEM_END )) +return -ERANGE ; + ret =__add_pages (nid, start_pfn, nr_pages, params);WARN_ON_ONCE (ret);
arch/x86/mm/kaslr.c +26 -6
@@ -47,13 +47,24 @@ static const unsigned long vaddr_end = C*/ static __initdata struct kaslr_memory_region {unsigned long *base; +unsigned long *end;unsigned long size_tb; } kaslr_regions[] = { - { &page_offset_base,0 }, - { &vmalloc_base,0 }, - { &vmemmap_base,0 }, + { + .base = &page_offset_base, + .end = &physmem_end, + }, + { + .base = &vmalloc_base, + }, + { + .base = &vmemmap_base, + }, }; +/* The end of the possible address space for physical memory */ +unsigned long physmem_end__ro_after_init ; +/* Get size in bytes used by the memory region */ static inline unsigned long get_padding (struct kaslr_memory_region *region) {
@@ -82,6 +93,8 @@ void __init kernel_randomize_memory(voidBUILD_BUG_ON (vaddr_end !=CPU_ENTRY_AREA_BASE );BUILD_BUG_ON (vaddr_end > __START_KERNEL_map); +/* Preset the end of the possible address space for physical memory */ + physmem_end = ((1ULL <<MAX_PHYSMEM_BITS ) -1 );if (!kaslr_memory_enabled ())return ;
@@ -128,11 +141,18 @@ void __init kernel_randomize_memory(void vaddr += entropy; *kaslr_regions[i].base = vaddr; +/* Calculate the end of the region */ + vaddr +=get_padding (&kaslr_regions[i]);/* -* Jump the region and add a minimum padding based on -* randomization alignment. +* KASLR trims the maximum possible size of the +* direct-map. Update the physmem_end boundary. +* No rounding required as the region starts +* PUD aligned and size is in units of TB. */ - vaddr +=get_padding (&kaslr_regions[i]); +if (kaslr_regions[i].end) + *kaslr_regions[i].end =__pa_nodebug (vaddr -1 ); + +/* Add a minimum padding based on randomization alignment. */ vaddr =round_up (vaddr +1 ,PUD_SIZE ); remain_entropy -= entropy; }
include/linux/mm.h +4 -0
@@ -97,6 +97,10 @@ extern const int mmap_rnd_compat_bits_maextern int mmap_rnd_compat_bits__read_mostly ;#endif +#ifndef PHYSMEM_END +# define PHYSMEM_END ((1ULL << MAX_PHYSMEM_BITS) - 1) +#endif +#include <asm/page.h> #include <asm/processor.h>
kernel/resource.c +2 -4
@@ -1832,8 +1832,7 @@ static resource_size_t gfr_start(structif (flags &GFR_DESCENDING ) {resource_size_t end; - end =min_t (resource_size_t, base->end, - (1ULL <<MAX_PHYSMEM_BITS ) -1 ); + end =min_t (resource_size_t, base->end,PHYSMEM_END );return end - size +1 ; }
@@ -1850,8 +1849,7 @@ static bool gfr_continue(struct resource* @size did not wrap 0. */ return addr > addr - size && - addr <=min_t (resource_size_t, base->end, - (1ULL <<MAX_PHYSMEM_BITS ) -1 ); + addr <=min_t (resource_size_t, base->end,PHYSMEM_END ); } static resource_size_t gfr_next(resource_size_t addr, resource_size_t size,
mm/memory_hotplug.c +1 -1
@@ -1682,7 +1682,7 @@ struct range __weak arch_get_mappable_rastruct range mhp_get_pluggable_range (bool need_mapping) { -const u64 max_phys = (1ULL <<MAX_PHYSMEM_BITS ) -1 ; +const u64 max_phys =PHYSMEM_END ;struct range mhp_range;if (need_mapping) {
mm/sparse.c +1 -1
@@ -129,7 +129,7 @@ static inline int sparse_early_nid(strucstatic void __meminit mminit_validate_memmodel_limits (unsigned long *start_pfn,unsigned long *end_pfn) { -unsigned long max_sparsemem_pfn =1UL << (MAX_PHYSMEM_BITS -PAGE_SHIFT ); +unsigned long max_sparsemem_pfn = (PHYSMEM_END +1 ) >>PAGE_SHIFT ;/* * Sanity checks - do not allow an architecture to pass
Greg Kroah-Hartman
maintainerPATCH 26/375 rtmutex: Drop rt_mutex::wait_lock before scheduling
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roland Xu <[email protected]>
commit d33d26036a0274b472299d7dcdaa5fb34329f91b upstream.
rt_mutex_handle_deadlock() is called with rt_mutex::wait_lock held. In the good case it returns with the lock held and in the deadlock case it emits a warning and goes into an endless scheduling loop with the lock held, which triggers the 'scheduling in atomic' warning.
Unlock rt_mutex::wait_lock in the dead lock case before issuing the warning and dropping into the schedule for ever loop.
[ tglx: Moved unlock before the WARN(), removed the pointless comment,
massaged changelog, added Fixes tag ]
--- kernel/locking/rtmutex.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
kernel/locking/rtmutex.c +5 -4
@@ -1644,6 +1644,7 @@ static int __sched rt_mutex_slowlock_blo } static void __sched rt_mutex_handle_deadlock(int res, int detect_deadlock, +struct rt_mutex_base *lock,struct rt_mutex_waiter *w) {/*
@@ -1656,10 +1657,10 @@ static void __sched rt_mutex_handle_deadif (build_ww_mutex () && w->ww_ctx)return ; -/* -* Yell loudly and stop the task right here. -*/ +raw_spin_unlock_irq (&lock->wait_lock); +WARN (1 ,"rtmutex deadlock detected\n" ); +while (1 ) {set_current_state (TASK_INTERRUPTIBLE );rt_mutex_schedule ();
@@ -1713,7 +1714,7 @@ static int __sched __rt_mutex_slowlock(s }else {__set_current_state (TASK_RUNNING );remove_waiter (lock, waiter); -rt_mutex_handle_deadlock (ret, chwalk, waiter); +rt_mutex_handle_deadlock (ret, chwalk, lock, waiter); }/*
Greg Kroah-Hartman
maintainerPATCH 27/375 irqchip/riscv-aplic: Fix an IS_ERR() vs NULL bug in probe()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit efe81b7bdf7d882d0ce3d183f1571321046da8f1 upstream.
The devm_platform_ioremap_resource() function doesn't return NULL, it returns error pointers. Fix the error handling to match.
--- drivers/irqchip/irq-riscv-aplic-main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/irqchip/irq-riscv-aplic-main.c +2 -2
@@ -175,9 +175,9 @@ static int aplic_probe(struct platform_device *pdev)/* Map the MMIO registers */ regs =devm_platform_ioremap_resource (pdev,0 ); -if (!regs) { +if (IS_ERR (regs)) {dev_err (dev,"failed map MMIO registers\n" ); -return -ENOMEM ; +return PTR_ERR (regs); }/*
Signature · 1 line
2.46.0
Greg Kroah-Hartman
maintainerPATCH 28/375 nvme-pci: Add sleep quirk for Samsung 990 Evo
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Georg Gottleuber <[email protected]>
commit 61aa894e7a2fda4ee026523b01d07e83ce2abb72 upstream.
On some TUXEDO platforms, a Samsung 990 Evo NVMe leads to a high power consumption in s2idle sleep (2-3 watts).
This patch applies 'Force No Simple Suspend' quirk to achieve a sleep with a lower power consumption, typically around 0.5 watts.
--- drivers/nvme/host/pci.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/nvme/host/pci.c +11 -0
@@ -2931,6 +2931,17 @@ static unsigned long check_vendor_combin dmi_match(DMI_BOARD_NAME, "NS5x_7xPU") || dmi_match(DMI_BOARD_NAME, "PH4PRX1_PH6PRX1"))return NVME_QUIRK_FORCE_NO_SIMPLE_SUSPEND ; + }else if (pdev->vendor ==0x144d && pdev->device ==0xa80d ) { +/* +* Exclude Samsung 990 Evo from NVME_QUIRK_SIMPLE_SUSPEND +* because of high power consumption (> 2 Watt) in s2idle +* sleep. Only some boards with Intel CPU are affected. +*/ +if (dmi_match (DMI_BOARD_NAME ,"GMxPXxx" ) || +dmi_match (DMI_BOARD_NAME ,"PH4PG31" ) || +dmi_match (DMI_BOARD_NAME ,"PH4PRX1_PH6PRX1" ) || +dmi_match (DMI_BOARD_NAME ,"PH6PG01_PH6PG71" )) +return NVME_QUIRK_FORCE_NO_SIMPLE_SUSPEND ; }/*
Greg Kroah-Hartman
maintainerPATCH 29/375 rust: macros: provide correct provenance when constructing THIS_MODULE
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boqun Feng <[email protected]>
commit a5a3c952e82c1ada12bf8c55b73af26f1a454bd2 upstream.
Currently while defining THIS_MODULE symbol in module!(), the pointer used to construct ThisModule is derived from an immutable reference of __this_module, which means the pointer doesn't have the provenance for writing, and that means any write to that pointer is UB regardless of data races or not. However, the usage of THIS_MODULE includes passing this pointer to functions that may write to it (probably in unsafe code), and this will create soundness issues.
One way to fix this is using addr_of_mut!() but that requires the unstable feature "const_mut_refs". So instead of addr_of_mut()!, an extern static Opaque is used here: since Opaque<T> is transparent to T, an extern static Opaque will just wrap the C symbol (defined in a C compile unit) in an Opaque, which provides a pointer with writable provenance via Opaque::get(). This fix the potential UBs because of pointer provenance unmatched.
--- rust/macros/module.rs | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
rust/macros/module.rs +5 -1
@@ -203,7 +203,11 @@ pub(crate) fn module(ts: TokenStream) ->// freed until the module is unloaded. #[cfg( MODULE )] static THIS_MODULE : kernel::ThisModule =unsafe {{ - kernel::ThisModule ::from_ptr (&kernel::bindings::__this_moduleas *const _ as *mut _ ) + extern \"C\" {{ +static __this_module: kernel::types::Opaque <kernel::bindings::module >; + }} + + kernel::ThisModule ::from_ptr (__this_module.get ()) }};#[cfg(not( MODULE ))] static THIS_MODULE : kernel::ThisModule =unsafe {{
Greg Kroah-Hartman
maintainerPATCH 30/375 Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE"
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
commit 532f8bcd1c2c4e8112f62e1922fd1703bc0ffce0 upstream.
This reverts commit 59b047bc98084f8af2c41483e4d68a5adf2fa7f7 which breaks compatibility with commands like:
bluetoothd[46328]: @ MGMT Command: Load.. (0x0013) plen 74 {0x0001} [hci0]
Keys: 2
BR/EDR Address: C0:DC:DA:A5:E5:47 (Samsung Electronics Co.,Ltd)
Key type: Authenticated key from P-256 (0x03)
Central: 0x00
Encryption size: 16
Diversifier[2]: 0000
Randomizer[8]: 0000000000000000
Key[16]: 6ed96089bd9765be2f2c971b0b95f624
LE Address: D7:2A:DE:1E:73:A2 (Static)
Key type: Unauthenticated key from P-256 (0x02)
Central: 0x00
Encryption size: 16
Diversifier[2]: 0000
Randomizer[8]: 0000000000000000
Key[16]: 87dd2546ededda380ffcdc0a8faa4597
@ MGMT Event: Command Status (0x0002) plen 3 {0x0001} [hci0]
Load Long Term Keys (0x0013)
Status: Invalid Parameters (0x0d)--- include/net/bluetooth/hci_core.h | 5 ----- net/bluetooth/mgmt.c | 25 +++++++------------------ net/bluetooth/smp.c | 7 ------- 3 files changed, 7 insertions(+), 30 deletions(-)
include/net/bluetooth/hci_core.h +0 -5
@@ -186,7 +186,6 @@ struct blocked_key {struct smp_csrk {bdaddr_t bdaddr;u8 bdaddr_type; -u8 link_type;u8 type;u8 val[16 ]; };
@@ -196,7 +195,6 @@ struct smp_ltk {struct rcu_head rcu;bdaddr_t bdaddr;u8 bdaddr_type; -u8 link_type;u8 authenticated;u8 type;u8 enc_size;
@@ -211,7 +209,6 @@ struct smp_irk {bdaddr_t rpa;bdaddr_t bdaddr;u8 addr_type; -u8 link_type;u8 val[16 ]; };
@@ -219,8 +216,6 @@ struct link_key {struct list_head list;struct rcu_head rcu;bdaddr_t bdaddr; -u8 bdaddr_type; -u8 link_type;u8 type;u8 val[HCI_LINK_KEY_SIZE ];u8 pin_len;
net/bluetooth/mgmt.c +7 -18
@@ -2834,8 +2834,7 @@ static int load_link_keys(struct sock *sfor (i =0 ; i < key_count; i++) {struct mgmt_link_key_info *key = &cp->keys[i]; -/* Considering SMP over BREDR/LE, there is no need to check addr_type */ -if (key->type >0x08 ) +if (key->addr.type !=BDADDR_BREDR || key->type >0x08 )return mgmt_cmd_status (sk, hdev->id,MGMT_OP_LOAD_LINK_KEYS ,MGMT_STATUS_INVALID_PARAMS );
@@ -7073,7 +7072,6 @@ static int load_irks(struct sock *sk, stfor (i =0 ; i < irk_count; i++) {struct mgmt_irk_info *irk = &cp->irks[i]; -u8 addr_type =le_addr_type (irk->addr.type); if (hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
@@ -7083,12 +7081,8 @@ static int load_irks(struct sock *sk, stcontinue ; } -/* When using SMP over BR/EDR, the addr type should be set to BREDR */ -if (irk->addr.type ==BDADDR_BREDR ) - addr_type =BDADDR_BREDR ; -hci_add_irk (hdev, &irk->addr.bdaddr, - addr_type, irk->val, +le_addr_type (irk->addr.type), irk->val,BDADDR_ANY ); }
@@ -7169,7 +7163,6 @@ static int load_long_term_keys(struct sofor (i =0 ; i < key_count; i++) {struct mgmt_ltk_info *key = &cp->keys[i];u8 type, authenticated; -u8 addr_type =le_addr_type (key->addr.type); if (hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_LTK,
@@ -7204,12 +7197,8 @@ static int load_long_term_keys(struct socontinue ; } -/* When using SMP over BR/EDR, the addr type should be set to BREDR */ -if (key->addr.type ==BDADDR_BREDR ) - addr_type =BDADDR_BREDR ; -hci_add_ltk (hdev, &key->addr.bdaddr, - addr_type, type, authenticated, +le_addr_type (key->addr.type), type, authenticated, key->val, key->enc_size, key->ediv, key->rand); }
@@ -9457,7 +9446,7 @@ void mgmt_new_link_key(struct hci_dev *h ev.store_hint = persistent;bacpy (&ev.key.addr.bdaddr, &key->bdaddr); - ev.key.addr.type =link_to_bdaddr (key->link_type, key->bdaddr_type); + ev.key.addr.type =BDADDR_BREDR ; ev.key.type = key->type;memcpy (ev.key.val, key->val,HCI_LINK_KEY_SIZE ); ev.key.pin_len = key->pin_len;
@@ -9508,7 +9497,7 @@ void mgmt_new_ltk(struct hci_dev *hdev, ev.store_hint = persistent;bacpy (&ev.key.addr.bdaddr, &key->bdaddr); - ev.key.addr.type =link_to_bdaddr (key->link_type, key->bdaddr_type); + ev.key.addr.type =link_to_bdaddr (LE_LINK , key->bdaddr_type); ev.key.type =mgmt_ltk_type (key); ev.key.enc_size = key->enc_size; ev.key.ediv = key->ediv;
@@ -9537,7 +9526,7 @@ void mgmt_new_irk(struct hci_dev *hdev,bacpy (&ev.rpa, &irk->rpa);bacpy (&ev.irk.addr.bdaddr, &irk->bdaddr); - ev.irk.addr.type =link_to_bdaddr (irk->link_type, irk->addr_type); + ev.irk.addr.type =link_to_bdaddr (LE_LINK , irk->addr_type);memcpy (ev.irk.val, irk->val,sizeof (irk->val));mgmt_event (MGMT_EV_NEW_IRK , hdev, &ev,sizeof (ev),NULL );
@@ -9566,7 +9555,7 @@ void mgmt_new_csrk(struct hci_dev *hdev, ev.store_hint = persistent;bacpy (&ev.key.addr.bdaddr, &csrk->bdaddr); - ev.key.addr.type =link_to_bdaddr (csrk->link_type, csrk->bdaddr_type); + ev.key.addr.type =link_to_bdaddr (LE_LINK , csrk->bdaddr_type); ev.key.type = csrk->type;memcpy (ev.key.val, csrk->val,sizeof (csrk->val));
net/bluetooth/smp.c +0 -7
@@ -1060,7 +1060,6 @@ static void smp_notify_keys(struct l2cap }if (smp->remote_irk) { - smp->remote_irk->link_type = hcon->type;mgmt_new_irk (hdev, smp->remote_irk, persistent);/* Now that user space can be considered to know the
@@ -1080,28 +1079,24 @@ static void smp_notify_keys(struct l2cap }if (smp->csrk) { - smp->csrk->link_type = hcon->type; smp->csrk->bdaddr_type = hcon->dst_type;bacpy (&smp->csrk->bdaddr, &hcon->dst);mgmt_new_csrk (hdev, smp->csrk, persistent); }if (smp->responder_csrk) { - smp->responder_csrk->link_type = hcon->type; smp->responder_csrk->bdaddr_type = hcon->dst_type;bacpy (&smp->responder_csrk->bdaddr, &hcon->dst);mgmt_new_csrk (hdev, smp->responder_csrk, persistent); }if (smp->ltk) { - smp->ltk->link_type = hcon->type; smp->ltk->bdaddr_type = hcon->dst_type;bacpy (&smp->ltk->bdaddr, &hcon->dst);mgmt_new_ltk (hdev, smp->ltk, persistent); }if (smp->responder_ltk) { - smp->responder_ltk->link_type = hcon->type; smp->responder_ltk->bdaddr_type = hcon->dst_type;bacpy (&smp->responder_ltk->bdaddr, &hcon->dst);mgmt_new_ltk (hdev, smp->responder_ltk, persistent);
@@ -1121,8 +1116,6 @@ static void smp_notify_keys(struct l2cap key =hci_add_link_key (hdev, smp->conn->hcon, &hcon->dst, smp->link_key, type,0 , &persistent);if (key) { - key->link_type = hcon->type; - key->bdaddr_type = hcon->dst_type;mgmt_new_link_key (hdev, key, persistent);/* Don't keep debug keys around if the relevant
Greg Kroah-Hartman
maintainerPATCH 31/375 Bluetooth: MGMT: Ignore keys being loaded with invalid type
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
commit 1e9683c9b6ca88cc9340cdca85edd6134c8cffe3 upstream.
Due to 59b047bc98084f8af2c41483e4d68a5adf2fa7f7 there could be keys stored with the wrong address type so this attempt to detect it and ignore them instead of just failing to load all keys.
--- net/bluetooth/mgmt.c | 37 +++++++++++++++++++------------------ 1 file changed, 19 insertions(+), 18 deletions(-)
net/bluetooth/mgmt.c +19 -18
@@ -2831,15 +2831,6 @@ static int load_link_keys(struct sock *sbt_dev_dbg (hdev,"debug_keys %u key_count %u" , cp->debug_keys, key_count); -for (i =0 ; i < key_count; i++) { -struct mgmt_link_key_info *key = &cp->keys[i]; - -if (key->addr.type !=BDADDR_BREDR || key->type >0x08 ) -return mgmt_cmd_status (sk, hdev->id, -MGMT_OP_LOAD_LINK_KEYS , -MGMT_STATUS_INVALID_PARAMS ); - } -hci_dev_lock (hdev);hci_link_keys_clear (hdev);
@@ -2864,6 +2855,19 @@ static int load_link_keys(struct sock *scontinue ; } +if (key->addr.type !=BDADDR_BREDR ) { +bt_dev_warn (hdev, +"Invalid link address type %u for %pMR" , + key->addr.type, &key->addr.bdaddr); +continue ; + } + +if (key->type >0x08 ) { +bt_dev_warn (hdev,"Invalid link key type %u for %pMR" , + key->type, &key->addr.bdaddr); +continue ; + } +/* Always ignore debug keys and require a new pairing if * the user wants to use them. */
@@ -7147,15 +7151,6 @@ static int load_long_term_keys(struct sobt_dev_dbg (hdev,"key_count %u" , key_count); -for (i =0 ; i < key_count; i++) { -struct mgmt_ltk_info *key = &cp->keys[i]; - -if (!ltk_is_valid (key)) -return mgmt_cmd_status (sk, hdev->id, -MGMT_OP_LOAD_LONG_TERM_KEYS , -MGMT_STATUS_INVALID_PARAMS ); - } -hci_dev_lock (hdev);hci_smp_ltks_clear (hdev);
@@ -7171,6 +7166,12 @@ static int load_long_term_keys(struct so &key->addr.bdaddr);continue ; } + +if (!ltk_is_valid (key)) { +bt_dev_warn (hdev,"Invalid LTK for %pMR" , + &key->addr.bdaddr); +continue ; + }switch (key->type) {case MGMT_LTK_UNAUTHENTICATED :
Greg Kroah-Hartman
maintainerPATCH 32/375 selftests: mm: fix build errors on armhf
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Usama Anjum <[email protected]>
commit b808f629215685c1941b1cd567c7b7ccb3c90278 upstream.
The __NR_mmap isn't found on armhf. The mmap() is commonly available system call and its wrapper is present on all architectures. So it should be used directly. It solves problem for armhf and doesn't create problem for other architectures.
Remove sys_mmap() functions as they aren't doing anything else other than calling mmap(). There is no need to set errno = 0 manually as glibc always resets it.
For reference errors are as following:
CC seal_elfseal_elf.c: In function 'sys_mmap':
seal_elf.c:39:33: error: '__NR_mmap' undeclared (first use in this function)
39 | sret = (void *) syscall(__NR_mmap, addr, len, prot,
| ^~~~~~~~~
mseal_test.c: In function 'sys_mmap':
mseal_test.c:90:33: error: '__NR_mmap' undeclared (first use in this function)
90 | sret = (void *) syscall(__NR_mmap, addr, len, prot,
| ^~~~~~~~~
--- tools/testing/selftests/mm/mseal_test.c | 37 +++++++++++--------------------- tools/testing/selftests/mm/seal_elf.c | 13 ----------- 2 files changed, 14 insertions(+), 36 deletions(-)
tools/testing/selftests/mm/mseal_test.c +13 -24
@@ -128,17 +128,6 @@ static int sys_mprotect_pkey(void *ptr,return sret; } -static void *sys_mmap (void *addr,unsigned long len,unsigned long prot, -unsigned long flags,unsigned long fd,unsigned long offset) -{ -void *sret; - - errno =0 ; - sret = (void *)syscall (__NR_mmap, addr, len, prot, - flags, fd, offset); -return sret; -} -static int sys_munmap (void *ptr,size_t size) {int sret;
@@ -219,7 +208,7 @@ static void setup_single_address(int siz {void *ptr; - ptr =sys_mmap (NULL , size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 ); + ptr =mmap (NULL , size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 ); *ptrOut = ptr; }
@@ -228,7 +217,7 @@ static void setup_single_address_rw(intvoid *ptr;unsigned long mapflags =MAP_ANONYMOUS |MAP_PRIVATE ; - ptr =sys_mmap (NULL , size,PROT_READ |PROT_WRITE , mapflags,-1 ,0 ); + ptr =mmap (NULL , size,PROT_READ |PROT_WRITE , mapflags,-1 ,0 ); *ptrOut = ptr; }
@@ -252,7 +241,7 @@ bool seal_support(void)void *ptr;unsigned long page_size =getpagesize (); - ptr =sys_mmap (NULL , page_size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 ); + ptr =mmap (NULL , page_size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 );if (ptr == (void *)-1 )return false;
@@ -528,8 +517,8 @@ static void test_seal_zero_address(void)int prot;/* use mmap to change protection. */ - ptr =sys_mmap (0 , size,PROT_NONE , -MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 ); + ptr =mmap (0 , size,PROT_NONE , +MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 );FAIL_TEST_IF_FALSE (ptr ==0 ); size =get_vma_size (ptr, &prot);
@@ -1256,8 +1245,8 @@ static void test_seal_mmap_overwrite_pro }/* use mmap to change protection. */ - ret2 =sys_mmap (ptr, size,PROT_NONE , -MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 ); + ret2 =mmap (ptr, size,PROT_NONE , +MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 );if (seal) {FAIL_TEST_IF_FALSE (ret2 ==MAP_FAILED );FAIL_TEST_IF_FALSE (errno ==EPERM );
@@ -1287,8 +1276,8 @@ static void test_seal_mmap_expand(bool s }/* use mmap to expand. */ - ret2 =sys_mmap (ptr, size,PROT_READ , -MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 ); + ret2 =mmap (ptr, size,PROT_READ , +MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 );if (seal) {FAIL_TEST_IF_FALSE (ret2 ==MAP_FAILED );FAIL_TEST_IF_FALSE (errno ==EPERM );
@@ -1315,8 +1304,8 @@ static void test_seal_mmap_shrink(bool s }/* use mmap to shrink. */ - ret2 =sys_mmap (ptr,8 * page_size,PROT_READ , -MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 ); + ret2 =mmap (ptr,8 * page_size,PROT_READ , +MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 );if (seal) {FAIL_TEST_IF_FALSE (ret2 ==MAP_FAILED );FAIL_TEST_IF_FALSE (errno ==EPERM );
@@ -1697,7 +1686,7 @@ static void test_seal_discard_ro_anon_on ret =fallocate (fd,0 ,0 , size);FAIL_TEST_IF_FALSE (!ret); - ptr =sys_mmap (NULL , size,PROT_READ , mapflags, fd,0 ); + ptr =mmap (NULL , size,PROT_READ , mapflags, fd,0 );FAIL_TEST_IF_FALSE (ptr !=MAP_FAILED );if (seal) {
@@ -1727,7 +1716,7 @@ static void test_seal_discard_ro_anon_onint ret;unsigned long mapflags =MAP_ANONYMOUS |MAP_SHARED ; - ptr =sys_mmap (NULL , size,PROT_READ , mapflags,-1 ,0 ); + ptr =mmap (NULL , size,PROT_READ , mapflags,-1 ,0 );FAIL_TEST_IF_FALSE (ptr != (void *)-1 );if (seal) {
tools/testing/selftests/mm/seal_elf.c +1 -12
@@ -61,17 +61,6 @@ static int sys_mseal(void *start, size_treturn sret; } -static void *sys_mmap (void *addr,unsigned long len,unsigned long prot, -unsigned long flags,unsigned long fd,unsigned long offset) -{ -void *sret; - - errno =0 ; - sret = (void *)syscall (__NR_mmap, addr, len, prot, - flags, fd, offset); -return sret; -} -static inline int sys_mprotect (void *ptr,size_t size,unsigned long prot) {int sret;
@@ -87,7 +76,7 @@ static bool seal_support(void)void *ptr;unsigned long page_size =getpagesize (); - ptr =sys_mmap (NULL , page_size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 ); + ptr =mmap (NULL , page_size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 );if (ptr == (void *)-1 )return false;
Re: [PATCH 6.10 032/375] selftests: mm: fix build errors on armhf
Hi
I'm not sure this is a correct fix.
Since mseal is a security feature, an attacker can access syscall directly, so the test should utilize syscall directly instead of adding glibc as an extra layer.
The correct fix is probably one of below:
1> switch to __NR_mmap2 for this test on all architecture, or
2> switch to __NR_mmap2 for ARMHF
Though I'm not sure which one is more appropriate, because I don't have a test environment for ARMHF .
Although, I don't think we need to block this getting into 6.10, we can backport again when a future fix is available.
Thanks
-Jeff
Quoted 186 lines · Greg Kroah-Hartman
6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Usama Anjum <[email protected]>
commit
b808f629215685c1941b1cd567c7b7ccb3c90278upstream.The
__NR_mmapisn't found on armhf. Themmap()is commonly available system call and its wrapper is present on all architectures. So it should be used directly. It solves problem for armhf and doesn't create problem for other architectures.Remove
sys_mmap()functions as they aren't doing anything else other than callingmmap(). There is no need to set errno = 0 manually as glibc always resets it.For reference errors are as following:
CC
seal_elfseal_elf.c: In function 'sys_mmap':
seal_elf.c:39:33: error: '__NR_mmap' undeclared (first use in this function)
39 | sret = (void *) syscall(__NR_mmap, addr, len, prot,
| ^~~~~~~~~
mseal_test.c: In function 'sys_mmap':
mseal_test.c:90:33: error: '__NR_mmap' undeclared (first use in this function)
90 | sret = (void *) syscall(__NR_mmap, addr, len, prot,
| ^~~~~~~~~Fixes 4926c7a52de7 ("selftest mm/mseal memory sealing")Signed-off-by Muhammad Usama Anjum <[email protected]>Cc Jeff Xu <[email protected]>Cc Kees Cook <[email protected]>Cc Liam R. Howlett <[email protected]>Cc Shuah Khan <[email protected]>Cc <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- tools/testing/selftests/mm/mseal_test.c | 37 +++++++++++--------------------- tools/testing/selftests/mm/seal_elf.c | 13 ----------- 2 files changed, 14 insertions(+), 36 deletions(-)tools/testing/selftests/mm/mseal_test.c +13
-24@@ -128,17 +128,6 @@ static int sys_mprotect_pkey(void *ptr,return sret; } -static void *sys_mmap (void *addr,unsigned long len,unsigned long prot, -unsigned long flags,unsigned long fd,unsigned long offset) -{ -void *sret; - - errno =0 ; - sret = (void *)syscall (__NR_mmap, addr, len, prot, - flags, fd, offset); -return sret; -} -static int sys_munmap (void *ptr,size_t size) {int sret;@@ -219,7 +208,7 @@ static void setup_single_address(int siz {void *ptr; - ptr =sys_mmap (NULL , size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 ); + ptr =mmap (NULL , size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 ); *ptrOut = ptr; }@@ -228,7 +217,7 @@ static void setup_single_address_rw(intvoid *ptr;unsigned long mapflags =MAP_ANONYMOUS |MAP_PRIVATE ; - ptr =sys_mmap (NULL , size,PROT_READ |PROT_WRITE , mapflags,-1 ,0 ); + ptr =mmap (NULL , size,PROT_READ |PROT_WRITE , mapflags,-1 ,0 ); *ptrOut = ptr; }@@ -252,7 +241,7 @@ bool seal_support(void)void *ptr;unsigned long page_size =getpagesize (); - ptr =sys_mmap (NULL , page_size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 ); + ptr =mmap (NULL , page_size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 );if (ptr == (void *)-1 )return false;@@ -528,8 +517,8 @@ static void test_seal_zero_address(void)int prot;/* use mmap to change protection. */ - ptr =sys_mmap (0 , size,PROT_NONE , -MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 ); + ptr =mmap (0 , size,PROT_NONE , +MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 );FAIL_TEST_IF_FALSE (ptr ==0 ); size =get_vma_size (ptr, &prot);@@ -1256,8 +1245,8 @@ static void test_seal_mmap_overwrite_pro }/* use mmap to change protection. */ - ret2 =sys_mmap (ptr, size,PROT_NONE , -MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 ); + ret2 =mmap (ptr, size,PROT_NONE , +MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 );if (seal) {FAIL_TEST_IF_FALSE (ret2 ==MAP_FAILED );FAIL_TEST_IF_FALSE (errno ==EPERM );@@ -1287,8 +1276,8 @@ static void test_seal_mmap_expand(bool s }/* use mmap to expand. */ - ret2 =sys_mmap (ptr, size,PROT_READ , -MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 ); + ret2 =mmap (ptr, size,PROT_READ , +MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 );if (seal) {FAIL_TEST_IF_FALSE (ret2 ==MAP_FAILED );FAIL_TEST_IF_FALSE (errno ==EPERM );@@ -1315,8 +1304,8 @@ static void test_seal_mmap_shrink(bool s }/* use mmap to shrink. */ - ret2 =sys_mmap (ptr,8 * page_size,PROT_READ , -MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 ); + ret2 =mmap (ptr,8 * page_size,PROT_READ , +MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 );if (seal) {FAIL_TEST_IF_FALSE (ret2 ==MAP_FAILED );FAIL_TEST_IF_FALSE (errno ==EPERM );@@ -1697,7 +1686,7 @@ static void test_seal_discard_ro_anon_on ret =fallocate (fd,0 ,0 , size);FAIL_TEST_IF_FALSE (!ret); - ptr =sys_mmap (NULL , size,PROT_READ , mapflags, fd,0 ); + ptr =mmap (NULL , size,PROT_READ , mapflags, fd,0 );FAIL_TEST_IF_FALSE (ptr !=MAP_FAILED );if (seal) {@@ -1727,7 +1716,7 @@ static void test_seal_discard_ro_anon_onint ret;unsigned long mapflags =MAP_ANONYMOUS |MAP_SHARED ; - ptr =sys_mmap (NULL , size,PROT_READ , mapflags,-1 ,0 ); + ptr =mmap (NULL , size,PROT_READ , mapflags,-1 ,0 );FAIL_TEST_IF_FALSE (ptr != (void *)-1 );if (seal) {tools/testing/selftests/mm/seal_elf.c +1
-12@@ -61,17 +61,6 @@ static int sys_mseal(void *start, size_treturn sret; } -static void *sys_mmap (void *addr,unsigned long len,unsigned long prot, -unsigned long flags,unsigned long fd,unsigned long offset) -{ -void *sret; - - errno =0 ; - sret = (void *)syscall (__NR_mmap, addr, len, prot, - flags, fd, offset); -return sret; -} -static inline int sys_mprotect (void *ptr,size_t size,unsigned long prot) {int sret;@@ -87,7 +76,7 @@ static bool seal_support(void)void *ptr;unsigned long page_size =getpagesize (); - ptr =sys_mmap (NULL , page_size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 ); + ptr =mmap (NULL , page_size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 );if (ptr == (void *)-1 )return false;
Re: [PATCH 6.10 032/375] selftests: mm: fix build errors on armhf
Quoted 3 lines · Jeff Xu
Hi
I'm not sure this is a correct fix.
This should be backported, mainly to help facilitate future backports.
...
Quoted 2 lines
Although, I don't think we need to block this getting into 6.10, we can backport again when a future fix is available.
Please move this discussion to the mm mailing list.
Any changes to the area will depend on the stable and upstream kernel being in sync for easier backporting. Without the fix, armhf will fail to build the selftest. So our choices are to have a working selftest that helps backporting in the future or broken selftest on certain archs and potentially more work for the stable team.
Thanks,
Liam
Quoted 193 lines
Thanks
-JeffQuoted 186 lines · Greg Kroah-Hartman
6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Usama Anjum <[email protected]>
commit
b808f629215685c1941b1cd567c7b7ccb3c90278upstream.The
__NR_mmapisn't found on armhf. Themmap()is commonly available system call and its wrapper is present on all architectures. So it should be used directly. It solves problem for armhf and doesn't create problem for other architectures.Remove
sys_mmap()functions as they aren't doing anything else other than callingmmap(). There is no need to set errno = 0 manually as glibc always resets it.For reference errors are as following:
CC
seal_elfseal_elf.c: In function 'sys_mmap':
seal_elf.c:39:33: error: '__NR_mmap' undeclared (first use in this function)
39 | sret = (void *) syscall(__NR_mmap, addr, len, prot,
| ^~~~~~~~~
mseal_test.c: In function 'sys_mmap':
mseal_test.c:90:33: error: '__NR_mmap' undeclared (first use in this function)
90 | sret = (void *) syscall(__NR_mmap, addr, len, prot,
| ^~~~~~~~~Fixes 4926c7a52de7 ("selftest mm/mseal memory sealing")Signed-off-by Muhammad Usama Anjum <[email protected]>Cc Jeff Xu <[email protected]>Cc Kees Cook <[email protected]>Cc Liam R. Howlett <[email protected]>Cc Shuah Khan <[email protected]>Cc <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- tools/testing/selftests/mm/mseal_test.c | 37 +++++++++++--------------------- tools/testing/selftests/mm/seal_elf.c | 13 ----------- 2 files changed, 14 insertions(+), 36 deletions(-)tools/testing/selftests/mm/mseal_test.c +13
-24@@ -128,17 +128,6 @@ static int sys_mprotect_pkey(void *ptr,return sret; } -static void *sys_mmap (void *addr,unsigned long len,unsigned long prot, -unsigned long flags,unsigned long fd,unsigned long offset) -{ -void *sret; - - errno =0 ; - sret = (void *)syscall (__NR_mmap, addr, len, prot, - flags, fd, offset); -return sret; -} -static int sys_munmap (void *ptr,size_t size) {int sret;@@ -219,7 +208,7 @@ static void setup_single_address(int siz {void *ptr; - ptr =sys_mmap (NULL , size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 ); + ptr =mmap (NULL , size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 ); *ptrOut = ptr; }@@ -228,7 +217,7 @@ static void setup_single_address_rw(intvoid *ptr;unsigned long mapflags =MAP_ANONYMOUS |MAP_PRIVATE ; - ptr =sys_mmap (NULL , size,PROT_READ |PROT_WRITE , mapflags,-1 ,0 ); + ptr =mmap (NULL , size,PROT_READ |PROT_WRITE , mapflags,-1 ,0 ); *ptrOut = ptr; }@@ -252,7 +241,7 @@ bool seal_support(void)void *ptr;unsigned long page_size =getpagesize (); - ptr =sys_mmap (NULL , page_size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 ); + ptr =mmap (NULL , page_size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 );if (ptr == (void *)-1 )return false;@@ -528,8 +517,8 @@ static void test_seal_zero_address(void)int prot;/* use mmap to change protection. */ - ptr =sys_mmap (0 , size,PROT_NONE , -MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 ); + ptr =mmap (0 , size,PROT_NONE , +MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 );FAIL_TEST_IF_FALSE (ptr ==0 ); size =get_vma_size (ptr, &prot);@@ -1256,8 +1245,8 @@ static void test_seal_mmap_overwrite_pro }/* use mmap to change protection. */ - ret2 =sys_mmap (ptr, size,PROT_NONE , -MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 ); + ret2 =mmap (ptr, size,PROT_NONE , +MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 );if (seal) {FAIL_TEST_IF_FALSE (ret2 ==MAP_FAILED );FAIL_TEST_IF_FALSE (errno ==EPERM );@@ -1287,8 +1276,8 @@ static void test_seal_mmap_expand(bool s }/* use mmap to expand. */ - ret2 =sys_mmap (ptr, size,PROT_READ , -MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 ); + ret2 =mmap (ptr, size,PROT_READ , +MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 );if (seal) {FAIL_TEST_IF_FALSE (ret2 ==MAP_FAILED );FAIL_TEST_IF_FALSE (errno ==EPERM );@@ -1315,8 +1304,8 @@ static void test_seal_mmap_shrink(bool s }/* use mmap to shrink. */ - ret2 =sys_mmap (ptr,8 * page_size,PROT_READ , -MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 ); + ret2 =mmap (ptr,8 * page_size,PROT_READ , +MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 );if (seal) {FAIL_TEST_IF_FALSE (ret2 ==MAP_FAILED );FAIL_TEST_IF_FALSE (errno ==EPERM );@@ -1697,7 +1686,7 @@ static void test_seal_discard_ro_anon_on ret =fallocate (fd,0 ,0 , size);FAIL_TEST_IF_FALSE (!ret); - ptr =sys_mmap (NULL , size,PROT_READ , mapflags, fd,0 ); + ptr =mmap (NULL , size,PROT_READ , mapflags, fd,0 );FAIL_TEST_IF_FALSE (ptr !=MAP_FAILED );if (seal) {@@ -1727,7 +1716,7 @@ static void test_seal_discard_ro_anon_onint ret;unsigned long mapflags =MAP_ANONYMOUS |MAP_SHARED ; - ptr =sys_mmap (NULL , size,PROT_READ , mapflags,-1 ,0 ); + ptr =mmap (NULL , size,PROT_READ , mapflags,-1 ,0 );FAIL_TEST_IF_FALSE (ptr != (void *)-1 );if (seal) {tools/testing/selftests/mm/seal_elf.c +1
-12@@ -61,17 +61,6 @@ static int sys_mseal(void *start, size_treturn sret; } -static void *sys_mmap (void *addr,unsigned long len,unsigned long prot, -unsigned long flags,unsigned long fd,unsigned long offset) -{ -void *sret; - - errno =0 ; - sret = (void *)syscall (__NR_mmap, addr, len, prot, - flags, fd, offset); -return sret; -} -static inline int sys_mprotect (void *ptr,size_t size,unsigned long prot) {int sret;@@ -87,7 +76,7 @@ static bool seal_support(void)void *ptr;unsigned long page_size =getpagesize (); - ptr =sys_mmap (NULL , page_size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 ); + ptr =mmap (NULL , page_size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 );if (ptr == (void *)-1 )return false;
Re: [PATCH 6.10 032/375] selftests: mm: fix build errors on armhf
Quoted 13 lines · Liam R. Howlett
Quoted 3 lines · Jeff Xu
Hi
I'm not sure this is a correct fix.
This should be backported, mainly to help facilitate future backports.
...
Quoted 2 lines
Although, I don't think we need to block this getting into 6.10, we can backport again when a future fix is available.
Quoted 8 lines
Please move this discussion to the mm mailing list.
Any changes to the area will depend on the stable and upstream kernel being in sync for easier backporting. Without the fix, armhf will fail to build the selftest. So our choices are to have a working selftest that helps backporting in the future or broken selftest on certain archs and potentially more work for the stable team.
I'm ok with applying this to 6.10 :-)
-Jeff
Quoted 196 lines
Thanks,
LiamQuoted 193 lines
Thanks
-JeffQuoted 186 lines · Greg Kroah-Hartman
6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Usama Anjum <[email protected]>
commit
b808f629215685c1941b1cd567c7b7ccb3c90278upstream.The
__NR_mmapisn't found on armhf. Themmap()is commonly available system call and its wrapper is present on all architectures. So it should be used directly. It solves problem for armhf and doesn't create problem for other architectures.Remove
sys_mmap()functions as they aren't doing anything else other than callingmmap(). There is no need to set errno = 0 manually as glibc always resets it.For reference errors are as following:
CC
seal_elfseal_elf.c: In function 'sys_mmap':
seal_elf.c:39:33: error: '__NR_mmap' undeclared (first use in this function)
39 | sret = (void *) syscall(__NR_mmap, addr, len, prot,
| ^~~~~~~~~
mseal_test.c: In function 'sys_mmap':
mseal_test.c:90:33: error: '__NR_mmap' undeclared (first use in this function)
90 | sret = (void *) syscall(__NR_mmap, addr, len, prot,
| ^~~~~~~~~Fixes 4926c7a52de7 ("selftest mm/mseal memory sealing")Signed-off-by Muhammad Usama Anjum <[email protected]>Cc Jeff Xu <[email protected]>Cc Kees Cook <[email protected]>Cc Liam R. Howlett <[email protected]>Cc Shuah Khan <[email protected]>Cc <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- tools/testing/selftests/mm/mseal_test.c | 37 +++++++++++--------------------- tools/testing/selftests/mm/seal_elf.c | 13 ----------- 2 files changed, 14 insertions(+), 36 deletions(-)tools/testing/selftests/mm/mseal_test.c +13
-24@@ -128,17 +128,6 @@ static int sys_mprotect_pkey(void *ptr,return sret; } -static void *sys_mmap (void *addr,unsigned long len,unsigned long prot, -unsigned long flags,unsigned long fd,unsigned long offset) -{ -void *sret; - - errno =0 ; - sret = (void *)syscall (__NR_mmap, addr, len, prot, - flags, fd, offset); -return sret; -} -static int sys_munmap (void *ptr,size_t size) {int sret;@@ -219,7 +208,7 @@ static void setup_single_address(int siz {void *ptr; - ptr =sys_mmap (NULL , size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 ); + ptr =mmap (NULL , size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 ); *ptrOut = ptr; }@@ -228,7 +217,7 @@ static void setup_single_address_rw(intvoid *ptr;unsigned long mapflags =MAP_ANONYMOUS |MAP_PRIVATE ; - ptr =sys_mmap (NULL , size,PROT_READ |PROT_WRITE , mapflags,-1 ,0 ); + ptr =mmap (NULL , size,PROT_READ |PROT_WRITE , mapflags,-1 ,0 ); *ptrOut = ptr; }@@ -252,7 +241,7 @@ bool seal_support(void)void *ptr;unsigned long page_size =getpagesize (); - ptr =sys_mmap (NULL , page_size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 ); + ptr =mmap (NULL , page_size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 );if (ptr == (void *)-1 )return false;@@ -528,8 +517,8 @@ static void test_seal_zero_address(void)int prot;/* use mmap to change protection. */ - ptr =sys_mmap (0 , size,PROT_NONE , -MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 ); + ptr =mmap (0 , size,PROT_NONE , +MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 );FAIL_TEST_IF_FALSE (ptr ==0 ); size =get_vma_size (ptr, &prot);@@ -1256,8 +1245,8 @@ static void test_seal_mmap_overwrite_pro }/* use mmap to change protection. */ - ret2 =sys_mmap (ptr, size,PROT_NONE , -MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 ); + ret2 =mmap (ptr, size,PROT_NONE , +MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 );if (seal) {FAIL_TEST_IF_FALSE (ret2 ==MAP_FAILED );FAIL_TEST_IF_FALSE (errno ==EPERM );@@ -1287,8 +1276,8 @@ static void test_seal_mmap_expand(bool s }/* use mmap to expand. */ - ret2 =sys_mmap (ptr, size,PROT_READ , -MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 ); + ret2 =mmap (ptr, size,PROT_READ , +MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 );if (seal) {FAIL_TEST_IF_FALSE (ret2 ==MAP_FAILED );FAIL_TEST_IF_FALSE (errno ==EPERM );@@ -1315,8 +1304,8 @@ static void test_seal_mmap_shrink(bool s }/* use mmap to shrink. */ - ret2 =sys_mmap (ptr,8 * page_size,PROT_READ , -MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 ); + ret2 =mmap (ptr,8 * page_size,PROT_READ , +MAP_ANONYMOUS |MAP_PRIVATE |MAP_FIXED ,-1 ,0 );if (seal) {FAIL_TEST_IF_FALSE (ret2 ==MAP_FAILED );FAIL_TEST_IF_FALSE (errno ==EPERM );@@ -1697,7 +1686,7 @@ static void test_seal_discard_ro_anon_on ret =fallocate (fd,0 ,0 , size);FAIL_TEST_IF_FALSE (!ret); - ptr =sys_mmap (NULL , size,PROT_READ , mapflags, fd,0 ); + ptr =mmap (NULL , size,PROT_READ , mapflags, fd,0 );FAIL_TEST_IF_FALSE (ptr !=MAP_FAILED );if (seal) {@@ -1727,7 +1716,7 @@ static void test_seal_discard_ro_anon_onint ret;unsigned long mapflags =MAP_ANONYMOUS |MAP_SHARED ; - ptr =sys_mmap (NULL , size,PROT_READ , mapflags,-1 ,0 ); + ptr =mmap (NULL , size,PROT_READ , mapflags,-1 ,0 );FAIL_TEST_IF_FALSE (ptr != (void *)-1 );if (seal) {tools/testing/selftests/mm/seal_elf.c +1
-12@@ -61,17 +61,6 @@ static int sys_mseal(void *start, size_treturn sret; } -static void *sys_mmap (void *addr,unsigned long len,unsigned long prot, -unsigned long flags,unsigned long fd,unsigned long offset) -{ -void *sret; - - errno =0 ; - sret = (void *)syscall (__NR_mmap, addr, len, prot, - flags, fd, offset); -return sret; -} -static inline int sys_mprotect (void *ptr,size_t size,unsigned long prot) {int sret;@@ -87,7 +76,7 @@ static bool seal_support(void)void *ptr;unsigned long page_size =getpagesize (); - ptr =sys_mmap (NULL , page_size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 ); + ptr =mmap (NULL , page_size,PROT_READ ,MAP_ANONYMOUS |MAP_PRIVATE ,-1 ,0 );if (ptr == (void *)-1 )return false;
Greg Kroah-Hartman
maintainerPATCH 33/375 mmc: core: apply SD quirks earlier during probe
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Bell <[email protected]>
commit 469e5e4713989fdd5e3e502b922e7be0da2464b9 upstream.
Applying MMC_QUIRK_BROKEN_SD_CACHE is broken, as the card's SD quirks are referenced in sd_parse_ext_reg_perf() prior to the quirks being initialized in mmc_blk_probe().
To fix this problem, let's split out an SD-specific list of quirks and apply in mmc_sd_init_card() instead. In this way, sd_read_ext_regs() to has the available information for not assigning the SD_EXT_PERF_CACHE as one of the (un)supported features, which in turn allows mmc_sd_init_card() to properly skip execution of sd_enable_cache().
--- drivers/mmc/core/quirks.h | 22 +++++++++++++--------- drivers/mmc/core/sd.c | 4 ++++ 2 files changed, 17 insertions(+), 9 deletions(-)
drivers/mmc/core/quirks.h +13 -9
@@ -15,6 +15,19 @@#include "card.h" +static const struct mmc_fixup __maybe_unused mmc_sd_fixups[] = { +/* +* Kingston Canvas Go! Plus microSD cards never finish SD cache flush. +* This has so far only been observed on cards from 11/2019, while new +* cards from 2023/05 do not exhibit this behavior. +*/ +_FIXUP_EXT ("SD64G" ,CID_MANFID_KINGSTON_SD ,0x5449 ,2019 ,11 , +0 ,-1ull ,SDIO_ANY_ID ,SDIO_ANY_ID , add_quirk_sd, +MMC_QUIRK_BROKEN_SD_CACHE ,EXT_CSD_REV_ANY ), + +END_FIXUP +}; +static const struct mmc_fixup __maybe_unused mmc_blk_fixups[] = { #define INAND_CMD38_ARG_EXT_CSD 113 #define INAND_CMD38_ARG_ERASE 0x00
@@ -54,15 +67,6 @@ static const struct mmc_fixup __maybe_un MMC_QUIRK_BLK_NO_CMD23),/* -* Kingston Canvas Go! Plus microSD cards never finish SD cache flush. -* This has so far only been observed on cards from 11/2019, while new -* cards from 2023/05 do not exhibit this behavior. -*/ -_FIXUP_EXT ("SD64G" ,CID_MANFID_KINGSTON_SD ,0x5449 ,2019 ,11 , -0 ,-1ull ,SDIO_ANY_ID ,SDIO_ANY_ID , add_quirk_sd, -MMC_QUIRK_BROKEN_SD_CACHE ,EXT_CSD_REV_ANY ), - -/* * Some SD cards lockup while using CMD23 multiblock transfers. */ MMC_FIXUP("AF SD", CID_MANFID_ATP, CID_OEMID_ANY, add_quirk_sd,
drivers/mmc/core/sd.c +4 -0
@@ -26,6 +26,7 @@#include "host.h" #include "bus.h" #include "mmc_ops.h" +#include "quirks.h" #include "sd.h" #include "sd_ops.h"
@@ -1475,6 +1476,9 @@ retry: goto free_card; } +/* Apply quirks prior to card setup */ +mmc_fixup_device (card, mmc_sd_fixups); + err =mmc_sd_setup_card (host, card, oldcard !=NULL );if (err) goto free_card;
Greg Kroah-Hartman
maintainerPATCH 34/375 mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sam Protsenko <[email protected]>
commit 8396c793ffdf28bb8aee7cfe0891080f8cab7890 upstream.
Commit 616f87661792 ("mmc: pass queue_limits to blk_mq_alloc_disk") [1] revealed the long living issue in dw_mmc.c driver, existing since the time when it was first introduced in commit f95f3850f7a9 ("mmc: dw_mmc:
Add Synopsys DesignWare mmc host driver."), also making kernel boot broken on platforms using dw_mmc driver with 16K or 64K pages enabled, with this message in dmesg:
mmcblk: probe of mmc0:0001 failed with error -22
That's happening because mmc_blk_probe() fails when it calls blk_validate_limits() consequently, which returns the error due to failed max_segment_size check in this code:
/*
* The maximum segment size has an odd historic 64k default that
* drivers probably should override. Just like the I/O size we
* require drivers to at least handle a full page per segment.
*/
...
if (WARN_ON_ONCE(lim->max_segment_size < PAGE_SIZE))
return -EINVAL;In case when IDMAC (Internal DMA Controller) is used, dw_mmc.c always sets .max_seg_size to 4 KiB:
mmc->max_seg_size = 0x1000;
The comment in the code above explains why it's incorrect. Arnd suggested setting .max_seg_size to .max_req_size to fix it, which is also what some other drivers are doing:
$ grep -rl 'max_seg_size.*=.*max_req_size' drivers/mmc/host/ | \
wc -l
18This change is not only fixing the boot with 16K/64K pages, but also leads to a better MMC performance. The linear write performance was tested on E850-96 board (eMMC only), before commit [1] (where it's possible to boot with 16K/64K pages without this fix, to be able to do a comparison). It was tested with this command:
# dd if=/dev/zero of=somefile bs=1M count=500 oflag=sync
Test results are as follows:
- 4K pages, .max_seg_size = 4 KiB: 94.2 MB/s
- 4K pages, .max_seg_size = .max_req_size = 512 KiB: 96.9 MB/s
- 16K pages, .max_seg_size = 4 KiB: 126 MB/s - 16K pages, .max_seg_size = .max_req_size = 2 MiB: 128 MB/s - 64K pages, .max_seg_size = 4 KiB: 138 MB/s - 64K pages, .max_seg_size = .max_req_size = 8 MiB: 138 MB/s
Unfortunately, SD card controller is not enabled in E850-96 yet, so it wasn't possible for me to run the test on some cheap SD cards to check this patch's impact on those. But it's possible that this change might also reduce the writes count, thus improving SD/eMMC longevity.
All credit for the analysis and the suggested solution goes to Arnd.
[1] https://lore.kernel.org/all/[email protected]/
--- drivers/mmc/host/dw_mmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mmc/host/dw_mmc.c +2 -2
@@ -2951,8 +2951,8 @@ static int dw_mci_init_slot(struct dw_mcif (host->use_dma ==TRANS_MODE_IDMAC ) { mmc->max_segs = host->ring_size; mmc->max_blk_size =65535 ; - mmc->max_seg_size =0x1000 ; - mmc->max_req_size = mmc->max_seg_size * host->ring_size; + mmc->max_req_size =DW_MCI_DESC_DATA_LENGTH * host->ring_size; + mmc->max_seg_size = mmc->max_req_size; mmc->max_blk_count = mmc->max_req_size /512 ; }else if (host->use_dma ==TRANS_MODE_EDMAC ) { mmc->max_segs =64 ;
Greg Kroah-Hartman
maintainerPATCH 35/375 mmc: sdhci-of-aspeed: fix module autoloading
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Chen <[email protected]>
commit 6e540da4c1db7b840e347c4dfe48359b18b7e376 upstream.
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table.
--- drivers/mmc/host/sdhci-of-aspeed.c | 1 + 1 file changed, 1 insertion(+)
drivers/mmc/host/sdhci-of-aspeed.c +1 -0
@@ -510,6 +510,7 @@ static const struct of_device_id aspeed_ { .compatible = "aspeed,ast2600-sdhci", .data = &ast2600_sdhci_pdata, }, { } }; +MODULE_DEVICE_TABLE (of, aspeed_sdhci_of_match);static struct platform_driver aspeed_sdhci_driver = { .driver = {
Greg Kroah-Hartman
maintainerPATCH 36/375 mmc: cqhci: Fix checking of CQHCI_HALT state
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seunghwan Baek <[email protected]>
commit aea62c744a9ae2a8247c54ec42138405216414da upstream.
To check if mmc cqe is in halt state, need to check set/clear of CQHCI_HALT bit. At this time, we need to check with &, not &&.
--- drivers/mmc/host/cqhci-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/cqhci-core.c +1 -1
@@ -617,7 +617,7 @@ static int cqhci_request(struct mmc_hostcqhci_writel (cq_host,0 ,CQHCI_CTL ); mmc->cqe_on = true;pr_debug ("%s: cqhci: CQE on\n" ,mmc_hostname (mmc)); -if (cqhci_readl (cq_host,CQHCI_CTL ) &&CQHCI_HALT ) { +if (cqhci_readl (cq_host,CQHCI_CTL ) &CQHCI_HALT ) {pr_err ("%s: cqhci: CQE failed to exit halt state\n" ,mmc_hostname (mmc)); }
Greg Kroah-Hartman
maintainerPATCH 37/375 fuse: update stats for pages in dropped aux writeback list
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joanne Koong <[email protected]>
commit f7790d67785302b3116bbbfda62a5a44524601a3 upstream.
In the case where the aux writeback list is dropped (e.g. the pages have been truncated or the connection is broken), the stats for its pages and backing device info need to be updated as well.
--- fs/fuse/file.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/fuse/file.c +7 -1
@@ -1832,10 +1832,16 @@ __acquires(fi->lock)fuse_writepage_finish (fm, wpa);spin_unlock (&fi->lock); -/* After fuse_writepage_finish() aux request list is private */ +/* After rb_erase() aux request list is private */ for (aux = wpa->next; aux; aux = next) { +struct backing_dev_info *bdi =inode_to_bdi (aux->inode); + next = aux->next; aux->next =NULL ; + +dec_wb_stat (&bdi->wb,WB_WRITEBACK ); +dec_node_page_state (aux->ia.ap.pages[0 ],NR_WRITEBACK_TEMP ); +wb_writeout_inc (&bdi->wb);fuse_writepage_free (aux); }
Greg Kroah-Hartman
maintainerPATCH 38/375 fuse: disable the combination of passthrough and writeback cache
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bernd Schubert <[email protected]>
commit 3ab394b363c5fd14b231e335fb6746ddfb93aaaa upstream.
Current design and handling of passthrough is without fuse caching and with that FUSE_WRITEBACK_CACHE is conflicting.
--- fs/fuse/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/fuse/inode.c +6 -1
@@ -1336,11 +1336,16 @@ static void process_init_reply(struct fu* on a stacked fs (e.g. overlayfs) themselves and with * max_stack_depth == 1, FUSE fs can be stacked as the * underlying fs of a stacked fs (e.g. overlayfs). +* +* Also don't allow the combination of FUSE_PASSTHROUGH +* and FUSE_WRITEBACK_CACHE, current design doesn't handle +* them together. */ if (IS_ENABLED (CONFIG_FUSE_PASSTHROUGH ) && (flags &FUSE_PASSTHROUGH ) && arg->max_stack_depth >0 && - arg->max_stack_depth <=FILESYSTEM_MAX_STACK_DEPTH ) { + arg->max_stack_depth <=FILESYSTEM_MAX_STACK_DEPTH && + !(flags &FUSE_WRITEBACK_CACHE )) { fc->passthrough =1 ; fc->max_stack_depth = arg->max_stack_depth; fm->sb->s_stack_depth = arg->max_stack_depth;
Greg Kroah-Hartman
maintainerPATCH 39/375 fuse: check aborted connection before adding requests to pending list for resending
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joanne Koong <[email protected]>
commit 97f30876c94382d1b01d45c2c76be8911b196527 upstream.
There is a race condition where inflight requests will not be aborted if they are in the middle of being re-sent when the connection is aborted.
If fuse_resend has already moved all the requests in the fpq->processing lists to its private queue ("to_queue") and then the connection starts and finishes aborting, these requests will be added to the pending queue and remain on it indefinitely.
--- fs/fuse/dev.c | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/fuse/dev.c +9 -0
@@ -31,6 +31,8 @@ MODULE_ALIAS("devname:fuse");static struct kmem_cache *fuse_req_cachep; +static void end_requests (struct list_head *head); +static struct fuse_dev *fuse_get_dev (struct file *file) {/*
@@ -1822,6 +1824,13 @@ static void fuse_resend(struct fuse_conn }spin_lock (&fiq->lock); +if (!fiq->connected) { +spin_unlock (&fiq->lock); +list_for_each_entry (req, &to_queue, list) +clear_bit (FR_PENDING , &req->flags); +end_requests (&to_queue); +return ; + }/* iq and pq requests are both oldest to newest */ list_splice (&to_queue, &fiq->pending); fiq->ops->wake_pending_and_unlock (fiq);
Greg Kroah-Hartman
maintainerPATCH 40/375 fuse: use unsigned type for getxattr/listxattr size truncation
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit b18915248a15eae7d901262f108d6ff0ffb4ffc1 upstream.
The existing code uses min_t(ssize_t, outarg.size, XATTR_LIST_MAX) when parsing the FUSE daemon's response to a zero-length getxattr/listxattr request.
On 32-bit kernels, where ssize_t and outarg.size are the same size, this is
wrong: The min_t() will pass through any size values that are negative when interpreted as signed.fuse_listxattr() will then return this userspace-supplied negative value, which callers will treat as an error value.
This kind of bug pattern can lead to fairly bad security bugs because of how error codes are used in the Linux kernel. If a caller were to convert the numeric error into an error pointer, like so:
struct foo *func(...) {
int len = fuse_getxattr(..., NULL, 0);
if (len < 0)
return ERR_PTR(len);
...
}then it would end up returning this userspace-supplied negative value cast to a pointer - but the caller of this function wouldn't recognize it as an error pointer (IS_ERR_VALUE() only detects values in the narrow range in which legitimate errno values are), and so it would just be treated as a kernel pointer.
I think there is at least one theoretical codepath where this could happen, but that path would involve virtio-fs with submounts plus some weird SELinux configuration, so I think it's probably not a concern in practice.
--- fs/fuse/xattr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/fuse/xattr.c +2 -2
@@ -81,7 +81,7 @@ ssize_t fuse_getxattr(struct inode *inod } ret =fuse_simple_request (fm, &args);if (!ret && !size) - ret =min_t (ssize_t, outarg.size,XATTR_SIZE_MAX ); + ret =min_t (size_t, outarg.size,XATTR_SIZE_MAX );if (ret == -ENOSYS ) { fm->fc->no_getxattr =1 ; ret = -EOPNOTSUPP ;
@@ -143,7 +143,7 @@ ssize_t fuse_listxattr(struct dentry *en } ret =fuse_simple_request (fm, &args);if (!ret && !size) - ret =min_t (ssize_t, outarg.size,XATTR_LIST_MAX ); + ret =min_t (size_t, outarg.size,XATTR_LIST_MAX );if (ret >0 && size) ret =fuse_verify_xattr_list (list, ret);if (ret == -ENOSYS ) {
Greg Kroah-Hartman
maintainerPATCH 41/375 fuse: fix memory leak in fuse_create_open
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: yangyun <[email protected]>
commit 3002240d16494d798add0575e8ba1f284258ab34 upstream.
The memory of struct fuse_file is allocated but not freed when get_create_ext return error.
--- fs/fuse/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/fuse/dir.c +1 -1
@@ -670,7 +670,7 @@ static int fuse_create_open(struct inode err =get_create_ext (&args, dir, entry, mode);if (err) - goto out_put_forget_req; + goto out_free_ff; err =fuse_simple_request (fm, &args);free_ext_value (&args);
Greg Kroah-Hartman
maintainerPATCH 42/375 fuse: clear PG_uptodate when using a stolen page
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
commit 76a51ac00ca2a72fe3e168b7fb0e70f75ba6f512 upstream.
Originally when a stolen page was inserted into fuse's page cache by fuse_try_move_page(), it would be marked uptodate. Then fuse_readpages_end() would call SetPageUptodate() again on the already uptodate page.
Commit 413e8f014c8b ("fuse: Convert fuse_readpages_end() to use folio_end_read()") changed that by replacing the SetPageUptodate() + unlock_page() combination with folio_end_read(), which does mostly the same, except it sets the uptodate flag with an xor operation, which in the above scenario resulted in the uptodate flag being cleared, which in turn resulted in EIO being returned on the read.
Fix by clearing PG_uptodate instead of setting it in fuse_try_move_page(), conforming to the expectation of folio_end_read().
--- fs/fuse/dev.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
fs/fuse/dev.c +1 -4
@@ -775,7 +775,6 @@ static int fuse_check_folio(struct folio *folio) (folio->flags & PAGE_FLAGS_CHECK_AT_PREP & ~(1 << PG_locked | 1 << PG_referenced | - 1 << PG_uptodate | 1 << PG_lru | 1 << PG_active | 1 << PG_workingset |
@@ -820,9 +819,7 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep) newfolio =page_folio (buf->page); -if (!folio_test_uptodate (newfolio)) -folio_mark_uptodate (newfolio); - +folio_clear_uptodate (newfolio);folio_clear_mappedtodisk (newfolio);if (fuse_check_folio (newfolio) !=0 )
Signature · 1 line
2.46.0
Greg Kroah-Hartman
maintainerPATCH 43/375 ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards harder
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 0cc65482f5b03ac2b1c240bc34665e43ea2d71bb upstream.
Since commit 13f58267cda3 ("ASoC: soc.h: don't create dummy Component via COMP_DUMMY()") dummy codecs declared like this:
SND_SOC_DAILINK_DEF(dummy,
DAILINK_COMP_ARRAY(COMP_DUMMY()));
expand to:
static struct snd_soc_dai_link_component dummy[] = { };
Which means that dummy is a zero sized array and thus dais[i].codecs should not be dereferenced *at all* since it points to the address of the next variable stored in the data section as the "dummy" variable has an address but no size, so even dereferencing dais[0] is already an out of bounds array reference.
Which means that the if (dais[i].codecs->name) check added in commit 7d99a70b6595 ("ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards") relies on that the part of the next variable which the name member maps to just happens to be NULL.
Which apparently so far it usually is, except when it isn't and then it results in crashes like this one:
[ 28.795659] BUG: unable to handle page fault for address: 0000000000030011 ... [ 28.795780] Call Trace: [ 28.795787] <TASK> ... [ 28.795862] ? strcmp+0x18/0x40 [ 28.795872] 0xffffffffc150c605 [ 28.795887] platform_probe+0x40/0xa0 ... [ 28.795979] ? __pfx_init_module+0x10/0x10 [snd_soc_sst_bytcr_wm5102]
Really fix things this time around by checking dais.num_codecs != 0.
--- sound/soc/intel/boards/bxt_rt298.c | 2 +- sound/soc/intel/boards/bytcht_cx2072x.c | 2 +- sound/soc/intel/boards/bytcht_da7213.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 2 +- sound/soc/intel/boards/bytcr_rt5640.c | 2 +- sound/soc/intel/boards/bytcr_rt5651.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 2 +- sound/soc/intel/boards/cht_bsw_rt5645.c | 2 +- sound/soc/intel/boards/cht_bsw_rt5672.c | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-)
sound/soc/intel/boards/bxt_rt298.c +1 -1
@@ -605,7 +605,7 @@ static int broxton_audio_probe(struct platform_device *pdev) int i; for (i = 0; i < ARRAY_SIZE(broxton_rt298_dais); i++) { - if (card->dai_link[i].codecs->name && + if (card->dai_link[i].num_codecs && !strncmp(card->dai_link[i].codecs->name, "i2c-INT343A:00", I2C_NAME_SIZE)) { if (!strncmp(card->name, "broxton-rt298",
sound/soc/intel/boards/bytcht_cx2072x.c +1 -1
@@ -241,7 +241,7 @@ static int snd_byt_cht_cx2072x_probe(struct platform_device *pdev)/* fix index of codec dai */ for (i =0 ; i <ARRAY_SIZE (byt_cht_cx2072x_dais); i++) { -if (byt_cht_cx2072x_dais[i].codecs->name && +if (byt_cht_cx2072x_dais[i].num_codecs && !strcmp (byt_cht_cx2072x_dais[i].codecs->name,"i2c-14F10720:00" )) { dai_index = i;
sound/soc/intel/boards/bytcht_da7213.c +1 -1
@@ -245,7 +245,7 @@ static int bytcht_da7213_probe(struct platform_device *pdev)/* fix index of codec dai */ for (i =0 ; i <ARRAY_SIZE (dailink); i++) { -if (dailink[i].codecs->name && +if (dailink[i].num_codecs && !strcmp (dailink[i].codecs->name,"i2c-DLGS7213:00" )) { dai_index = i;break ;
sound/soc/intel/boards/bytcht_es8316.c +1 -1
@@ -546,7 +546,7 @@ static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev)/* fix index of codec dai */ for (i =0 ; i <ARRAY_SIZE (byt_cht_es8316_dais); i++) { -if (byt_cht_es8316_dais[i].codecs->name && +if (byt_cht_es8316_dais[i].num_codecs && !strcmp (byt_cht_es8316_dais[i].codecs->name,"i2c-ESSX8316:00" )) { dai_index = i;
sound/soc/intel/boards/bytcr_rt5640.c +1 -1
@@ -1677,7 +1677,7 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev)/* fix index of codec dai */ for (i =0 ; i <ARRAY_SIZE (byt_rt5640_dais); i++) { -if (byt_rt5640_dais[i].codecs->name && +if (byt_rt5640_dais[i].num_codecs && !strcmp (byt_rt5640_dais[i].codecs->name,"i2c-10EC5640:00" )) { dai_index = i;
sound/soc/intel/boards/bytcr_rt5651.c +1 -1
@@ -910,7 +910,7 @@ static int snd_byt_rt5651_mc_probe(struct platform_device *pdev)/* fix index of codec dai */ for (i =0 ; i <ARRAY_SIZE (byt_rt5651_dais); i++) { -if (byt_rt5651_dais[i].codecs->name && +if (byt_rt5651_dais[i].num_codecs && !strcmp (byt_rt5651_dais[i].codecs->name,"i2c-10EC5651:00" )) { dai_index = i;
sound/soc/intel/boards/bytcr_wm5102.c +1 -1
@@ -605,7 +605,7 @@ static int snd_byt_wm5102_mc_probe(struct platform_device *pdev)/* find index of codec dai */ for (i =0 ; i <ARRAY_SIZE (byt_wm5102_dais); i++) { -if (byt_wm5102_dais[i].codecs->name && +if (byt_wm5102_dais[i].num_codecs && !strcmp (byt_wm5102_dais[i].codecs->name,"wm5102-codec" )) { dai_index = i;
sound/soc/intel/boards/cht_bsw_rt5645.c +1 -1
@@ -569,7 +569,7 @@ static int snd_cht_mc_probe(struct platform_device *pdev)/* set correct codec name */ for (i =0 ; i <ARRAY_SIZE (cht_dailink); i++) -if (cht_dailink[i].codecs->name && +if (cht_dailink[i].num_codecs && !strcmp (cht_dailink[i].codecs->name,"i2c-10EC5645:00" )) { dai_index = i;
sound/soc/intel/boards/cht_bsw_rt5672.c +1 -1
@@ -466,7 +466,7 @@ static int snd_cht_mc_probe(struct platform_device *pdev)/* find index of codec dai */ for (i =0 ; i <ARRAY_SIZE (cht_dailink); i++) { -if (cht_dailink[i].codecs->name && +if (cht_dailink[i].num_codecs && !strcmp (cht_dailink[i].codecs->name,RT5672_I2C_DEFAULT )) { dai_index = i;break ;
Signature · 1 line
2.46.0
Greg Kroah-Hartman
maintainerPATCH 44/375 riscv: misaligned: Restrict user access to kernel memory
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Holland <[email protected]>
commit b686ecdeacf6658e1348c1a32a08e2e72f7c0f00 upstream.
raw_copy_{to,from}_user() do not call access_ok(), so this code allowed userspace to access any virtual memory address.
--- arch/riscv/kernel/traps_misaligned.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/riscv/kernel/traps_misaligned.c +2 -2
@@ -417,7 +417,7 @@ int handle_misaligned_load(struct pt_regs *regs) val.data_u64 =0 ;if (user_mode (regs)) { -if (raw_copy_from_user (&val, (u8 __user *)addr, len)) +if (copy_from_user (&val, (u8 __user *)addr, len))return -1 ; }else {memcpy (&val, (u8 *)addr, len);
@@ -515,7 +515,7 @@ int handle_misaligned_store(struct pt_regs *regs)return -EOPNOTSUPP ;if (user_mode (regs)) { -if (raw_copy_to_user ((u8 __user *)addr, &val, len)) +if (copy_to_user ((u8 __user *)addr, &val, len))return -1 ; }else {memcpy ((u8 *)addr, &val, len);
Signature · 1 line
2.46.0
Greg Kroah-Hartman
maintainerPATCH 45/375 parisc: Delay write-protection until mark_rodata_ro() call
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit 213aa670153ed675a007c1f35c5db544b0fefc94 upstream.
Do not write-protect the kernel read-only and __ro_after_init sections earlier than before mark_rodata_ro() is called. This fixes a boot issue on parisc which is triggered by commit 91a1d97ef482 ("jump_label,module: Don't alloc static_key_mod for __ro_after_init keys"). That commit may modify static key contents in the __ro_after_init section at bootup, so this section needs to be writable at least until mark_rodata_ro() is called.
--- arch/parisc/mm/init.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
arch/parisc/mm/init.c +11 -5
@@ -459,7 +459,6 @@ void free_initmem(void)unsigned long kernel_end = (unsigned long )&_end;/* Remap kernel text and data, but do not touch init section yet. */ - kernel_set_to_readonly = true;map_pages (init_end,__pa (init_end), kernel_end - init_end,PAGE_KERNEL ,0 );
@@ -493,11 +492,18 @@ void free_initmem(void)#ifdef CONFIG_STRICT_KERNEL_RWX void mark_rodata_ro (void ) { -/* rodata memory was already mapped with KERNEL_RO access rights by -pagetable_init() and map_pages(). No need to do additional stuff here */ -unsigned long roai_size = __end_ro_after_init - __start_ro_after_init; +unsigned long start = (unsigned long ) &__start_rodata; +unsigned long end = (unsigned long ) &__end_rodata; -pr_info ("Write protected read-only-after-init data: %luk\n" , roai_size >>10 ); +pr_info ("Write protecting the kernel read-only data: %luk\n" , + (end - start) >>10 ); + + kernel_set_to_readonly = true; +map_pages (start,__pa (start), end - start,PAGE_KERNEL ,0 ); + +/* force the kernel to see the new page table entries */ +flush_cache_all (); +flush_tlb_all (); }#endif
Signature · 1 line
2.46.0
Greg Kroah-Hartman
maintainerPATCH 46/375 clk: starfive: jh7110-sys: Add notifier for PLL0 clock
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xingyu Wu <[email protected]>
commit 538d5477b25289ac5d46ca37b9e5b4d685cbe019 upstream.
Add notifier function for PLL0 clock. In the function, the cpu_root clock should be operated by saving its current parent and setting a new safe parent (osc clock) before setting the PLL0 clock rate. After setting PLL0 rate, it should be switched back to the original parent clock.
--- drivers/clk/starfive/clk-starfive-jh7110-sys.c | 31 ++++++++++++++++++++++++- drivers/clk/starfive/clk-starfive-jh71x0.h | 2 + 2 files changed, 32 insertions(+), 1 deletion(-)
drivers/clk/starfive/clk-starfive-jh7110-sys.c +30 -1
@@ -385,6 +385,32 @@ int jh7110_reset_controller_register(str }EXPORT_SYMBOL_GPL (jh7110_reset_controller_register); +/* +* This clock notifier is called when the rate of PLL0 clock is to be changed. +* The cpu_root clock should save the curent parent clock and switch its parent +* clock to osc before PLL0 rate will be changed. Then switch its parent clock +* back after the PLL0 rate is completed. +*/ +static int jh7110_pll0_clk_notifier_cb (struct notifier_block *nb, +unsigned long action,void *data) +{ + struct jh71x0_clk_priv *priv = container_of(nb, struct jh71x0_clk_priv, pll_clk_nb); +struct clk *cpu_root = priv->reg[JH7110_SYSCLK_CPU_ROOT ].hw.clk; +int ret =0 ; + +if (action ==PRE_RATE_CHANGE ) { +struct clk *osc =clk_get (priv->dev,"osc" ); + + priv->original_clk =clk_get_parent (cpu_root); + ret =clk_set_parent (cpu_root, osc); +clk_put (osc); + }else if (action ==POST_RATE_CHANGE ) { + ret =clk_set_parent (cpu_root, priv->original_clk); + } + +return notifier_from_errno (ret); +} +static int __init jh7110_syscrg_probe (struct platform_device *pdev) {struct jh71x0_clk_priv *priv;
@@ -413,7 +439,10 @@ static int __init jh7110_syscrg_probe(stif (IS_ERR (priv->pll[0 ]))return PTR_ERR (priv->pll[0 ]); }else { -clk_put (pllclk); + priv->pll_clk_nb.notifier_call = jh7110_pll0_clk_notifier_cb; + ret =clk_notifier_register (pllclk, &priv->pll_clk_nb); +if (ret) +return ret; priv->pll[0 ] =NULL ; }
drivers/clk/starfive/clk-starfive-jh71x0.h +2 -0
@@ -114,6 +114,8 @@ struct jh71x0_clk_priv {spinlock_t rmw_lock;struct device *dev;void __iomem *base; +struct clk *original_clk; +struct notifier_block pll_clk_nb;struct clk_hw *pll[3 ];struct jh71x0_clk reg[]; };
Greg Kroah-Hartman
maintainerPATCH 47/375 clk: qcom: clk-alpha-pll: Fix the pll post div mask
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Satya Priya Kakitapalli <[email protected]>
commit 2c4553e6c485a96b5d86989eb9654bf20e51e6dd upstream.
The PLL_POST_DIV_MASK should be 0 to (width - 1) bits. Fix it.
--- drivers/clk/qcom/clk-alpha-pll.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/qcom/clk-alpha-pll.c +1 -1
@@ -40,7 +40,7 @@#define PLL_USER_CTL (p) ((p)->offset + (p)->regs[PLL_OFF_USER_CTL])# define PLL_POST_DIV_SHIFT 8 -# define PLL_POST_DIV_MASK (p) GENMASK((p)->width, 0) +# define PLL_POST_DIV_MASK (p) GENMASK((p)->width - 1, 0)# define PLL_ALPHA_EN BIT(24)# define PLL_ALPHA_MODE BIT(25)# define PLL_VCO_SHIFT 20
Greg Kroah-Hartman
maintainerPATCH 48/375 clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Satya Priya Kakitapalli <[email protected]>
commit 4ad1ed6ef27cab94888bb3c740c14042d5c0dff2 upstream.
Correct the pll postdiv shift used in clk_trion_pll_postdiv_set_rate API. The shift value is not same for different types of plls and should be taken from the pll's .post_div_shift member.
--- drivers/clk/qcom/clk-alpha-pll.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/qcom/clk-alpha-pll.c +2 -2
@@ -1505,8 +1505,8 @@ clk_trion_pll_postdiv_set_rate(struct cl }return regmap_update_bits (regmap,PLL_USER_CTL (pll), -PLL_POST_DIV_MASK (pll) <<PLL_POST_DIV_SHIFT , - val <<PLL_POST_DIV_SHIFT ); +PLL_POST_DIV_MASK (pll) << pll->post_div_shift, + val << pll->post_div_shift); }const struct clk_ops clk_alpha_pll_postdiv_trion_ops = {
Greg Kroah-Hartman
maintainerPATCH 49/375 clk: qcom: clk-alpha-pll: Fix zonda set_rate failure when PLL is disabled
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Satya Priya Kakitapalli <[email protected]>
commit 85e8ee59dfde1a7b847fbed0778391392cd985cb upstream.
Currently, clk_zonda_pll_set_rate polls for the PLL to lock even if the PLL is disabled. However, if the PLL is disabled then LOCK_DET will never assert and we'll return an error. There is no reason to poll LOCK_DET if the PLL is already disabled, so skip polling in this case.
--- drivers/clk/qcom/clk-alpha-pll.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/clk/qcom/clk-alpha-pll.c +3 -0
@@ -2089,6 +2089,9 @@ static int clk_zonda_pll_set_rate(structregmap_write (pll->clkr.regmap,PLL_ALPHA_VAL (pll), a);regmap_write (pll->clkr.regmap,PLL_L_VAL (pll), l); +if (!clk_hw_is_enabled (hw)) +return 0 ; +/* Wait before polling for the frequency latch */ udelay (5 );
Greg Kroah-Hartman
maintainerPATCH 50/375 clk: qcom: clk-alpha-pll: Update set_rate for Zonda PLL
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Satya Priya Kakitapalli <[email protected]>
commit f4973130d255dd4811006f5822d4fa4d0de9d712 upstream.
The Zonda PLL has a 16 bit signed alpha and in the cases where the alpha value is greater than 0.5, the L value needs to be adjusted accordingly. Thus update the logic to handle the signed alpha val.
--- drivers/clk/qcom/clk-alpha-pll.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/clk/qcom/clk-alpha-pll.c +16 -0
@@ -41,6 +41,7 @@#define PLL_USER_CTL (p) ((p)->offset + (p)->regs[PLL_OFF_USER_CTL])# define PLL_POST_DIV_SHIFT 8# define PLL_POST_DIV_MASK (p) GENMASK((p)->width - 1, 0) +# define PLL_ALPHA_MSB BIT(15)# define PLL_ALPHA_EN BIT(24)# define PLL_ALPHA_MODE BIT(25)# define PLL_VCO_SHIFT 20
@@ -2070,6 +2071,18 @@ static void clk_zonda_pll_disable(structregmap_write (regmap,PLL_OPMODE (pll),0x0 ); } +static void zonda_pll_adjust_l_val (unsigned long rate,unsigned long prate,u32 *l) +{ +u64 remainder, quotient; + + quotient = rate; + remainder =do_div (quotient, prate); + *l = quotient; + +if ((remainder *2 ) / prate) + *l = *l +1 ; +} +static int clk_zonda_pll_set_rate (struct clk_hw *hw,unsigned long rate,unsigned long prate) {
@@ -2086,6 +2099,9 @@ static int clk_zonda_pll_set_rate(structif (ret <0 )return ret; +if (a &PLL_ALPHA_MSB ) +zonda_pll_adjust_l_val (rate, prate, &l); +regmap_write (pll->clkr.regmap,PLL_ALPHA_VAL (pll), a);regmap_write (pll->clkr.regmap,PLL_L_VAL (pll), l);
Greg Kroah-Hartman
maintainerPATCH 51/375 pinctrl: qcom: x1e80100: Bypass PDC wakeup parent for now
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
commit 602cb14e310a7a32c4f27d1f16c4614c790c7f6f upstream.
On X1E80100, GPIO interrupts for wakeup-capable pins have been broken since the introduction of the pinctrl driver. This prevents keyboard and touchpad from working on most of the X1E laptops. So far we have worked around this by manually building a kernel with the "wakeup-parent" removed from the pinctrl node in the device tree, but we cannot expect all users to do that.
Implement a similar workaround in the driver by clearing the wakeirq_map for X1E80100. This avoids using the PDC wakeup parent for all GPIOs and handles the interrupts directly in the pinctrl driver instead.
The PDC driver needs additional changes to support X1E80100 properly. Adding a workaround separately first allows to land the necessary PDC changes through the normal release cycle, while still solving the more critical problem with keyboard and touchpad on the current stable kernel versions. Bypassing the PDC is enough for now, because we have not yet enabled the deep idle states where using the PDC becomes necessary.
--- drivers/pinctrl/qcom/pinctrl-x1e80100.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/pinctrl/qcom/pinctrl-x1e80100.c +3 -1
@@ -1839,7 +1839,9 @@ static const struct msm_pinctrl_soc_data x1e80100_pinctrl = { .ngroups = ARRAY_SIZE(x1e80100_groups), .ngpios = 239, .wakeirq_map = x1e80100_pdc_map, - .nwakeirq_map = ARRAY_SIZE(x1e80100_pdc_map), +/* TODO: Enabling PDC currently breaks GPIO interrupts */ + .nwakeirq_map = 0, +/* .nwakeirq_map = ARRAY_SIZE(x1e80100_pdc_map), */ .egpio_func = 9, };
Signature · 1 line
2.46.0
Greg Kroah-Hartman
maintainerPATCH 52/375 can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Arlott <[email protected]>
commit 7dd9c26bd6cf679bcfdef01a8659791aa6487a29 upstream.
The mcp251x_hw_wake() function is called with the mpc_lock mutex held and disables the interrupt handler so that no interrupts can be processed while waking the device. If an interrupt has already occurred then waiting for the interrupt handler to complete will deadlock because it will be trying to acquire the same mutex.
CPU0 CPU1
---- ----mcp251x_open()
mutex_lock(&priv->mcp_lock)
request_threaded_irq()
<interrupt>
mcp251x_can_ist()
mutex_lock(&priv->mcp_lock) mcp251x_hw_wake()
disable_irq() <-- deadlock
Use disable_irq_nosync() instead because the interrupt handler does everything while holding the mutex so it doesn't matter if it's still running.
--- drivers/net/can/spi/mcp251x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/spi/mcp251x.c +1 -1
@@ -753,7 +753,7 @@ static int mcp251x_hw_wake(struct spi_deint ret;/* Force wakeup interrupt to wake device, but don't execute IST */ -disable_irq (spi->irq); +disable_irq_nosync (spi->irq);mcp251x_write_2regs (spi,CANINTE ,CANINTE_WAKIE ,CANINTF_WAKIF );/* Wait for oscillator startup timer after wake up */
Greg Kroah-Hartman
maintainerPATCH 53/375 mm: vmalloc: optimize vmap_lazy_nr arithmetic when purging each vmap_area
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Huang <[email protected]>
commit 409faf8c97d5abb0597ea43e99c8b3dd8dbe99e3 upstream.
When running the vmalloc stress on a 448-core system, observe the average latency of purge_vmap_node() is about 2 seconds by using the eBPF/bcc 'funclatency.py' tool [1].
# /your-git-repo/bcc/tools/funclatency.py -u purge_vmap_node & pid1=$! && sleep 8 && modprobe test_vmalloc nr_threads=$(nproc) run_test_mask=0x7; kill -SIGINT $pid1
usecs : count distribution
0 -> 1 : 0 | |
2 -> 3 : 29 | |
4 -> 7 : 19 | |
8 -> 15 : 56 | |
16 -> 31 : 483 |**** |
32 -> 63 : 1548 |************ |
64 -> 127 : 2634 |********************* |
128 -> 255 : 2535 |********************* |
256 -> 511 : 1776 |************** |
512 -> 1023 : 1015 |******** |
1024 -> 2047 : 573 |**** |
2048 -> 4095 : 488 |**** |
4096 -> 8191 : 1091 |********* |
8192 -> 16383 : 3078 |************************* |
16384 -> 32767 : 4821 |****************************************|
32768 -> 65535 : 3318 |*************************** |
65536 -> 131071 : 1718 |************** |
131072 -> 262143 : 2220 |****************** |
262144 -> 524287 : 1147 |********* |
524288 -> 1048575 : 1179 |********* |
1048576 -> 2097151 : 822 |****** |
2097152 -> 4194303 : 906 |******* |
4194304 -> 8388607 : 2148 |***************** |
8388608 -> 16777215 : 4497 |************************************* |
16777216 -> 33554431 : 289 |** |avg = 2041714 usecs, total: 78381401772 usecs, count: 38390
The worst case is over 16-33 seconds, so soft lockup is triggered [2].
[Root Cause]
1) Each purge_list has the long list. The following shows the number of vmap_area is purged.
crash> p vmap_nodes
vmap_nodes = $27 = (struct vmap_node *) 0xff2de5a900100000 crash> vmap_node 0xff2de5a900100000 128 | grep nr_purged
nr_purged = 663070
...
nr_purged = 821670
nr_purged = 692214
nr_purged = 726808
...2) atomic_long_sub() employs the 'lock' prefix to ensure the atomic operation when purging each vmap_area. However, the iteration is over 600000 vmap_area (See 'nr_purged' above).
Here is objdump output:
$ objdump -D vmlinux
ffffffff813e8c80 <purge_vmap_node>:
...
ffffffff813e8d70: f0 48 29 2d 68 0c bb lock sub %rbp,0x2bb0c68(%rip)
... Quote from "Instruction tables" pdf file [3]:
Instructions with a LOCK prefix have a long latency that depends on cache organization and possibly RAM speed. If there are multiple processors or cores or direct memory access (DMA) devices, then all locked instructions will lock a cache line for exclusive access, which may involve RAM access. A LOCK prefix typically costs more than a hundred clock cycles, even on single-processor systems.
That's why the latency of purge_vmap_node() dramatically increases on a many-core system: One core is busy on purging each vmap_area of the *long* purge_list and executing atomic_long_sub() for each vmap_area, while other cores free vmalloc allocations and execute atomic_long_add_return() in free_vmap_area_noflush().
[Solution]
Employ a local variable to record the total purged pages, and execute atomic_long_sub() after the traversal of the purge_list is done. The experiment result shows the latency improvement is 99%.
[Experiment Result]
1) System Configuration: Three servers (with HT-enabled) are tested.
* 72-core server: 3rd Gen Intel Xeon Scalable Processor*1
* 192-core server: 5th Gen Intel Xeon Scalable Processor*2
* 448-core server: AMD Zen 4 Processor*2
2) Kernel Config
* CONFIG_KASAN is disabled
3) The data in column "w/o patch" and "w/ patch"
* Unit: micro seconds (us)
* Each data is the average of 3-time measurements
System w/o patch (us) w/ patch (us) Improvement (%)
--------------- -------------- ------------- -------------
72-core server 2194 14 99.36%
192-core server 143799 1139 99.21%
448-core server 1992122 6883 99.65%
[1] https://github.com/iovisor/bcc/blob/master/tools/funclatency.py
[2] https://gist.github.com/AdrianHuang/37c15f67b45407b83c2d32f918656c12
[3] https://www.agner.org/optimize/instruction_tables.pdf
--- mm/vmalloc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
mm/vmalloc.c +4 -1
@@ -2190,6 +2190,7 @@ static void purge_vmap_node(struct work_ {struct vmap_node *vn =container_of (work, struct vmap_node, purge_work); +unsigned long nr_purged_pages =0 ;struct vmap_area *va, *n_va;LIST_HEAD (local_list);
@@ -2207,7 +2208,7 @@ static void purge_vmap_node(struct work_kasan_release_vmalloc (orig_start, orig_end, va->va_start, va->va_end); -atomic_long_sub (nr, &vmap_lazy_nr); + nr_purged_pages += nr; vn->nr_purged++;if (is_vn_id_valid (vn_id) && !vn->skip_populate)
@@ -2218,6 +2219,8 @@ static void purge_vmap_node(struct work_list_add (&va->list, &local_list); } +atomic_long_sub (nr_purged_pages, &vmap_lazy_nr); +reclaim_list_global (&local_list); }
Greg Kroah-Hartman
maintainerPATCH 54/375 alloc_tag: fix allocation tag reporting when CONFIG_MODULES=n
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suren Baghdasaryan <[email protected]>
commit 052a45c1cb1b32f05dd63a295d65496d8b403283 upstream.
codetag_module_init() is used to initialize sections containing allocation tags. This function is used to initialize module sections as well as core kernel sections, in which case the module parameter is set to NULL. This function has to be called even when CONFIG_MODULES=n to initialize core kernel allocation tag sections. When CONFIG_MODULES=n, this function is a NOP, which is wrong. This leads to /proc/allocinfo reported as empty. Fix this by making it independent of CONFIG_MODULES.
--- lib/codetag.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
lib/codetag.c +11 -6
@@ -125,7 +125,6 @@ static inline size_t range_size(const struct codetag_type *cttype, cttype->desc.tag_size; } -#ifdef CONFIG_MODULES static void *get_symbol (struct module *mod,const char *prefix,const char *name) {DECLARE_SEQ_BUF (sb,KSYM_NAME_LEN );
@@ -155,6 +154,15 @@ static struct codetag_range get_section_range(struct module *mod, }; } +static const char *get_mod_name (__maybe_unused struct module *mod) +{ +#ifdef CONFIG_MODULES +if (mod) +return mod->name; +#endif +return "(built-in)" ; +} +static int codetag_module_init (struct codetag_type *cttype,struct module *mod) {struct codetag_range range;
@@ -164,8 +172,7 @@ static int codetag_module_init(struct codetag_type *cttype, struct module *mod) range =get_section_range (mod, cttype->desc.section);if (!range.start || !range.stop) {pr_warn ("Failed to load code tags of type %s from the module %s\n" , - cttype->desc.section, - mod ? mod->name :"(built-in)" ); + cttype->desc.section,get_mod_name (mod));return -EINVAL ; }
@@ -199,6 +206,7 @@ static int codetag_module_init(struct codetag_type *cttype, struct module *mod)return 0 ; } +#ifdef CONFIG_MODULES void codetag_load_module (struct module *mod) {struct codetag_type *cttype;
@@ -248,9 +256,6 @@ bool codetag_unload_module(struct module *mod)return unload_ok; } - -#else /* CONFIG_MODULES */ -static int codetag_module_init (struct codetag_type *cttype,struct module *mod) {return 0 ; }#endif /* CONFIG_MODULES */ struct codetag_type *
Signature · 1 line
2.46.0
Greg Kroah-Hartman
maintainerPATCH 55/375 codetag: debug: mark codetags for poisoned page as empty
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Ge <[email protected]>
commit 5e9784e997620af7c1399029282f5d6964b41942 upstream.
When PG_hwpoison pages are freed they are treated differently in free_pages_prepare() and instead of being released they are isolated.
Page allocation tag counters are decremented at this point since the page is considered not in use. Later on when such pages are released by unpoison_memory(), the allocation tag counters will be decremented again and the following warning gets reported:
[ 113.930443][ T3282] ------------[ cut here ]------------ [ 113.931105][ T3282] alloc_tag was not set [ 113.931576][ T3282] WARNING: CPU: 2 PID: 3282 at ./include/linux/alloc_tag.h:130 pgalloc_tag_sub.part.66+0x154/0x164 [ 113.932866][ T3282] Modules linked in: hwpoison_inject fuse ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_conntrack ebtable_nat ebtable_broute ip6table_nat ip6table_man4 [ 113.941638][ T3282] CPU: 2 UID: 0 PID: 3282 Comm: madvise11 Kdump: loaded Tainted: G W 6.11.0-rc4-dirty #18 [ 113.943003][ T3282] Tainted: [W]=WARN [ 113.943453][ T3282] Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 [ 113.944378][ T3282] pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 113.945319][ T3282] pc : pgalloc_tag_sub.part.66+0x154/0x164 [ 113.946016][ T3282] lr : pgalloc_tag_sub.part.66+0x154/0x164 [ 113.946706][ T3282] sp : ffff800087093a10 [ 113.947197][ T3282] x29: ffff800087093a10 x28: ffff0000d7a9d400 x27: ffff80008249f0a0 [ 113.948165][ T3282] x26: 0000000000000000 x25: ffff80008249f2b0 x24: 0000000000000000 [ 113.949134][ T3282] x23: 0000000000000001 x22: 0000000000000001 x21: 0000000000000000 [ 113.950597][ T3282] x20: ffff0000c08fcad8 x19: ffff80008251e000 x18: ffffffffffffffff [ 113.952207][ T3282] x17: 0000000000000000 x16: 0000000000000000 x15: ffff800081746210 [ 113.953161][ T3282] x14: 0000000000000000 x13: 205d323832335420 x12: 5b5d353031313339 [ 113.954120][ T3282] x11: ffff800087093500 x10: 000000000000005d x9 : 00000000ffffffd0 [ 113.955078][ T3282] x8 : 7f7f7f7f7f7f7f7f x7 : ffff80008236ba90 x6 : c0000000ffff7fff [ 113.956036][ T3282] x5 : ffff000b34bf4dc8 x4 : ffff8000820aba90 x3 : 0000000000000001 [ 113.956994][ T3282] x2 : ffff800ab320f000 x1 : 841d1e35ac932e00 x0 : 0000000000000000 [ 113.957962][ T3282] Call trace: [ 113.958350][ T3282] pgalloc_tag_sub.part.66+0x154/0x164 [ 113.959000][ T3282] pgalloc_tag_sub+0x14/0x1c [ 113.959539][ T3282] free_unref_page+0xf4/0x4b8 [ 113.960096][ T3282] __folio_put+0xd4/0x120 [ 113.960614][ T3282] folio_put+0x24/0x50 [ 113.961103][ T3282] unpoison_memory+0x4f0/0x5b0 [ 113.961678][ T3282] hwpoison_unpoison+0x30/0x48 [hwpoison_inject] [ 113.962436][ T3282] simple_attr_write_xsigned.isra.34+0xec/0x1cc [ 113.963183][ T3282] simple_attr_write+0x38/0x48 [ 113.963750][ T3282] debugfs_attr_write+0x54/0x80 [ 113.964330][ T3282] full_proxy_write+0x68/0x98 [ 113.964880][ T3282] vfs_write+0xdc/0x4d0 [ 113.965372][ T3282] ksys_write+0x78/0x100 [ 113.965875][ T3282] __arm64_sys_write+0x24/0x30 [ 113.966440][ T3282] invoke_syscall+0x7c/0x104 [ 113.966984][ T3282] el0_svc_common.constprop.1+0x88/0x104 [ 113.967652][ T3282] do_el0_svc+0x2c/0x38 [ 113.968893][ T3282] el0_svc+0x3c/0x1b8 [ 113.969379][ T3282] el0t_64_sync_handler+0x98/0xbc [ 113.969980][ T3282] el0t_64_sync+0x19c/0x1a0 [ 113.970511][ T3282] ---[ end trace 0000000000000000 ]---
To fix this, clear the page tag reference after the page got isolated and accounted for.
--- mm/page_alloc.c | 7 +++++++ 1 file changed, 7 insertions(+)
mm/page_alloc.c +7 -0
@@ -1053,6 +1053,13 @@ __always_inline bool free_pages_prepare(reset_page_owner (page, order);page_table_check_free (page, order);pgalloc_tag_sub (page,1 << order); + +/* +* The page is isolated and accounted for. +* Mark the codetag as empty to avoid accounting error +* when the page is freed by unpoison_memory(). +*/ +clear_page_tag_ref (page);return false; }
Greg Kroah-Hartman
maintainerPATCH 56/375 maple_tree: remove rcu_read_lock() from mt_validate()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liam R. Howlett <[email protected]>
commit f806de88d8f7f8191afd0fd9b94db4cd058e7d4f upstream.
The write lock should be held when validating the tree to avoid updates racing with checks. Holding the rcu read lock during a large tree validation may also cause a prolonged rcu read window and "rcu_preempt detected stalls" warnings.
--- lib/maple_tree.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
lib/maple_tree.c +2 -5
@@ -7569,14 +7569,14 @@ static void mt_validate_nulls(struct map* 2. The gap is correctly set in the parents */ void mt_validate (struct maple_tree *mt) + __must_hold(mas->tree->ma_lock) {unsigned char end;MA_STATE (mas, mt,0 ,0 ); -rcu_read_lock ();mas_start (&mas);if (!mas_is_active (&mas)) - goto done; +return ;while (!mte_is_leaf (mas.node))mas_descend (&mas);
@@ -7597,9 +7597,6 @@ void mt_validate(struct maple_tree *mt)mas_dfs_postorder (&mas,ULONG_MAX ); }mt_validate_nulls (mt); -done: -rcu_read_unlock (); - }EXPORT_SYMBOL_GPL (mt_validate);
Greg Kroah-Hartman
maintainerPATCH 57/375 kexec_file: fix elfcorehdr digest exclusion when CONFIG_CRASH_HOTPLUG=y
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Tesarik <[email protected]>
commit 6dacd79d28842ff01f18b4900d897741aac5999e upstream.
Fix the condition to exclude the elfcorehdr segment from the SHA digest calculation.
The j iterator is an index into the output sha_regions[] array, not into the input image->segment[] array. Once it reaches image->elfcorehdr_index, all subsequent segments are excluded. Besides, if the purgatory segment precedes the elfcorehdr segment, the elfcorehdr may be wrongly included in the calculation.
--- kernel/kexec_file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/kexec_file.c +1 -1
@@ -752,7 +752,7 @@ static int kexec_calculate_store_digests#ifdef CONFIG_CRASH_HOTPLUG /* Exclude elfcorehdr segment to allow future changes via hotplug */ -if (j == image->elfcorehdr_index) +if (i == image->elfcorehdr_index)continue ;#endif
Greg Kroah-Hartman
maintainerPATCH 58/375 mm: vmalloc: ensure vmap_block is initialised before adding to queue
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit 3e3de7947c751509027d26b679ecd243bc9db255 upstream.
Commit 8c61291fd850 ("mm: fix incorrect vbq reference in purge_fragmented_block") extended the 'vmap_block' structure to contain a 'cpu' field which is set at allocation time to the id of the initialising CPU.
When a new 'vmap_block' is being instantiated by new_vmap_block(), the partially initialised structure is added to the local 'vmap_block_queue' xarray before the 'cpu' field has been initialised. If another CPU is concurrently walking the xarray (e.g. via vm_unmap_aliases()), then it may perform an out-of-bounds access to the remote queue thanks to an uninitialised index.
This has been observed as UBSAN errors in Android:
| Internal error: UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP | | Call trace: | purge_fragmented_block+0x204/0x21c | _vm_unmap_aliases+0x170/0x378 | vm_unmap_aliases+0x1c/0x28 | change_memory_common+0x1dc/0x26c | set_memory_ro+0x18/0x24 | module_enable_ro+0x98/0x238 | do_init_module+0x1b0/0x310
Move the initialisation of 'vb->cpu' in new_vmap_block() ahead of the addition to the xarray.
--- mm/vmalloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/vmalloc.c +1 -1
@@ -2628,6 +2628,7 @@ static void *new_vmap_block(unsigned int vb->dirty_max =0 ;bitmap_set (vb->used_map,0 , (1UL << order));INIT_LIST_HEAD (&vb->free_list); + vb->cpu =raw_smp_processor_id (); xa =addr_to_vb_xa (va->va_start); vb_idx =addr_to_vb_idx (va->va_start);
@@ -2644,7 +2645,6 @@ static void *new_vmap_block(unsigned int* integrity together with list_for_each_rcu from read * side. */ - vb->cpu =raw_smp_processor_id (); vbq =per_cpu_ptr (&vmap_block_queue, vb->cpu);spin_lock (&vbq->lock);list_add_tail_rcu (&vb->free_list, &vbq->free);
Greg Kroah-Hartman
maintainerPATCH 59/375 mm/slub: add check for s->flags in the alloc_tagging_slab_free_hook
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Ge <[email protected]>
commit ab7ca09520e9c41c219a4427fe0dae24024bfe7f upstream.
When enable CONFIG_MEMCG & CONFIG_KFENCE & CONFIG_KMEMLEAK, the following warning always occurs,This is because the following call stack occurred:mem_pool_alloc
kmem_cache_alloc_noprof
slab_alloc_node
kfence_alloc
Once the kfence allocation is successful,slab->obj_exts will not be empty, because it has already been assigned a value in kfence_init_pool.
Since in the prepare_slab_obj_exts_hook function,we perform a check for s->flags & (SLAB_NO_OBJ_EXT | SLAB_NOLEAKTRACE),the alloc_tag_add function will not be called as a result.Therefore,ref->ct remains NULL.
However,when we call mem_pool_free,since obj_ext is not empty, it eventually leads to the alloc_tag_sub scenario being invoked. This is where the warning occurs.
So we should add corresponding checks in the alloc_tagging_slab_free_hook. For __GFP_NO_OBJ_EXT case,I didn't see the specific case where it's using kfence,so I won't add the corresponding check in alloc_tagging_slab_free_hook for now.
[ 3.734349] ------------[ cut here ]------------ [ 3.734807] alloc_tag was not set [ 3.735129] WARNING: CPU: 4 PID: 40 at ./include/linux/alloc_tag.h:130 kmem_cache_free+0x444/0x574 [ 3.735866] Modules linked in: autofs4 [ 3.736211] CPU: 4 UID: 0 PID: 40 Comm: ksoftirqd/4 Tainted: G W 6.11.0-rc3-dirty #1 [ 3.736969] Tainted: [W]=WARN [ 3.737258] Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 [ 3.737875] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 3.738501] pc : kmem_cache_free+0x444/0x574 [ 3.738951] lr : kmem_cache_free+0x444/0x574 [ 3.739361] sp : ffff80008357bb60 [ 3.739693] x29: ffff80008357bb70 x28: 0000000000000000 x27: 0000000000000000 [ 3.740338] x26: ffff80008207f000 x25: ffff000b2eb2fd60 x24: ffff0000c0005700 [ 3.740982] x23: ffff8000804229e4 x22: ffff800082080000 x21: ffff800081756000 [ 3.741630] x20: fffffd7ff8253360 x19: 00000000000000a8 x18: ffffffffffffffff [ 3.742274] x17: ffff800ab327f000 x16: ffff800083398000 x15: ffff800081756df0 [ 3.742919] x14: 0000000000000000 x13: 205d344320202020 x12: 5b5d373038343337 [ 3.743560] x11: ffff80008357b650 x10: 000000000000005d x9 : 00000000ffffffd0 [ 3.744231] x8 : 7f7f7f7f7f7f7f7f x7 : ffff80008237bad0 x6 : c0000000ffff7fff [ 3.744907] x5 : ffff80008237ba78 x4 : ffff8000820bbad0 x3 : 0000000000000001 [ 3.745580] x2 : 68d66547c09f7800 x1 : 68d66547c09f7800 x0 : 0000000000000000 [ 3.746255] Call trace: [ 3.746530] kmem_cache_free+0x444/0x574 [ 3.746931] mem_pool_free+0x44/0xf4 [ 3.747306] free_object_rcu+0xc8/0xdc [ 3.747693] rcu_do_batch+0x234/0x8a4 [ 3.748075] rcu_core+0x230/0x3e4 [ 3.748424] rcu_core_si+0x14/0x1c [ 3.748780] handle_softirqs+0x134/0x378 [ 3.749189] run_ksoftirqd+0x70/0x9c [ 3.749560] smpboot_thread_fn+0x148/0x22c [ 3.749978] kthread+0x10c/0x118 [ 3.750323] ret_from_fork+0x10/0x20 [ 3.750696] ---[ end trace 0000000000000000 ]---
--- mm/slub.c | 4 ++++ 1 file changed, 4 insertions(+)
mm/slub.c +4 -0
@@ -2044,6 +2044,10 @@ alloc_tagging_slab_free_hook(struct kmemif (!mem_alloc_profiling_enabled ())return ; +/* slab->obj_exts might not be NULL if it was created for MEMCG accounting. */ +if (s->flags & (SLAB_NO_OBJ_EXT |SLAB_NOLEAKTRACE )) +return ; + obj_exts =slab_obj_exts (slab);if (!obj_exts)return ;
Greg Kroah-Hartman
maintainerPATCH 60/375 Revert "mm: skip CMA pages when they are not available"
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Usama Arif <[email protected]>
commit bfe0857c20c663fcc1592fa4e3a61ca12b07dac9 upstream.
This reverts commit 5da226dbfce3 ("mm: skip CMA pages when they are not available") and b7108d66318a ("Multi-gen LRU: skip CMA pages when they are not eligible").
lruvec->lru_lock is highly contended and is held when calling isolate_lru_folios. If the lru has a large number of CMA folios consecutively, while the allocation type requested is not MIGRATE_MOVABLE, isolate_lru_folios can hold the lock for a very long time while it skips those. For FIO workload, ~150million order=0 folios were skipped to isolate a few ZONE_DMA folios [1]. This can cause lockups [1] and high memory pressure for extended periods of time [2].
Remove skipping CMA for MGLRU as well, as it was introduced in sort_folio for the same resaon as 5da226dbfce3a2f44978c2c7cf88166e69a6788b.
[1] https://lore.kernel.org/all/CAOUHufbkhMZYz20aM_3rHZ3OcK4m2puji2FGpUpn_-DevGk3Kg@mail.gmail.com/
[2] https://lore.kernel.org/all/[email protected]/
--- mm/vmscan.c | 24 ++---------------------- 1 file changed, 2 insertions(+), 22 deletions(-)
mm/vmscan.c +2 -22
@@ -1587,25 +1587,6 @@ static __always_inline void update_lru_s } -#ifdef CONFIG_CMA -/* -* It is waste of effort to scan and reclaim CMA pages if it is not available -* for current allocation context. Kswapd can not be enrolled as it can not -* distinguish this scenario by using sc->gfp_mask = GFP_KERNEL -*/ -static bool skip_cma (struct folio *folio,struct scan_control *sc) -{ -return !current_is_kswapd () && -gfp_migratetype (sc->gfp_mask) !=MIGRATE_MOVABLE && -folio_migratetype (folio) ==MIGRATE_CMA ; -} -#else -static bool skip_cma (struct folio *folio,struct scan_control *sc) -{ -return false; -} -#endif -/* * Isolating page from the lruvec to fill in @dst list by nr_to_scan times. *
@@ -1652,8 +1633,7 @@ static unsigned long isolate_lru_folios( nr_pages =folio_nr_pages (folio); total_scan += nr_pages; -if (folio_zonenum (folio) > sc->reclaim_idx || -skip_cma (folio, sc)) { +if (folio_zonenum (folio) > sc->reclaim_idx) { nr_skipped[folio_zonenum (folio)] += nr_pages; move_to = &folios_skipped; goto move;
@@ -4314,7 +4294,7 @@ static bool sort_folio(struct lruvec *lr }/* ineligible */ -if (zone > sc->reclaim_idx ||skip_cma (folio, sc)) { +if (zone > sc->reclaim_idx) { gen =folio_inc_gen (lruvec, folio, false);list_move_tail (&folio->lru, &lrugen->folios[gen][type][zone]);return true;
Greg Kroah-Hartman
maintainerPATCH 61/375 spi: rockchip: Resolve unbalanced runtime PM / system PM handling
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <[email protected]>
commit be721b451affbecc4ba4eaac3b71cdbdcade1b1b upstream.
Commit e882575efc77 ("spi: rockchip: Suspend and resume the bus during NOIRQ_SYSTEM_SLEEP_PM ops") stopped respecting runtime PM status and simply disabled clocks unconditionally when suspending the system. This causes problems when the device is already runtime suspended when we go to sleep -- in which case we double-disable clocks and produce a WARNing.
Switch back to pm_runtime_force_{suspend,resume}(), because that still seems like the right thing to do, and the aforementioned commit makes no explanation why it stopped using it.
Also, refactor some of the resume() error handling, because it's not actually a good idea to re-disable clocks on failure.
--- drivers/spi/spi-rockchip.c | 23 +++++++---------------- 1 file changed, 7 insertions(+), 16 deletions(-)
drivers/spi/spi-rockchip.c +7 -16
@@ -945,14 +945,16 @@ static int rockchip_spi_suspend(struct d {int ret;struct spi_controller *ctlr =dev_get_drvdata (dev); -struct rockchip_spi *rs =spi_controller_get_devdata (ctlr); ret =spi_controller_suspend (ctlr);if (ret <0 )return ret; -clk_disable_unprepare (rs->spiclk); -clk_disable_unprepare (rs->apb_pclk); + ret =pm_runtime_force_suspend (dev); +if (ret <0 ) { +spi_controller_resume (ctlr); +return ret; + }pinctrl_pm_select_sleep_state (dev);
@@ -963,25 +965,14 @@ static int rockchip_spi_resume(struct de {int ret;struct spi_controller *ctlr =dev_get_drvdata (dev); -struct rockchip_spi *rs =spi_controller_get_devdata (ctlr);pinctrl_pm_select_default_state (dev); - ret =clk_prepare_enable (rs->apb_pclk); + ret =pm_runtime_force_resume (dev);if (ret <0 )return ret; - ret =clk_prepare_enable (rs->spiclk); -if (ret <0 ) -clk_disable_unprepare (rs->apb_pclk); - - ret =spi_controller_resume (ctlr); -if (ret <0 ) { -clk_disable_unprepare (rs->spiclk); -clk_disable_unprepare (rs->apb_pclk); - } - -return 0 ; +return spi_controller_resume (ctlr); }#endif /* CONFIG_PM_SLEEP */
Greg Kroah-Hartman
maintainerPATCH 62/375 tracing/osnoise: Use a cpumask to know what threads are kthreads
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
commit 177e1cc2f41235c145041eed03ef5bab18f32328 upstream.
The start_kthread() and stop_thread() code was not always called with the interface_lock held. This means that the kthread variable could be unexpectedly changed causing the kthread_stop() to be called on it when it should not have been, leading to:
while true; do
rtla timerlat top -u -q & PID=$!;
sleep 5;
kill -INT $PID;
sleep 0.001;
kill -TERM $PID;
wait $PID;
done
Causing the following OOPS:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 5 UID: 0 PID: 885 Comm: timerlatu/5 Not tainted 6.11.0-rc4-test-00002-gbc754cc76d1b-dirty #125 a533010b71dab205ad2f507188ce8c82203b0254 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:hrtimer_active+0x58/0x300 Code: 48 c1 ee 03 41 54 48 01 d1 48 01 d6 55 53 48 83 ec 20 80 39 00 0f 85 30 02 00 00 49 8b 6f 30 4c 8d 75 10 4c 89 f0 48 c1 e8 03 <0f> b6 3c 10 4c 89 f0 83 e0 07 83 c0 03 40 38 f8 7c 09 40 84 ff 0f RSP: 0018:ffff88811d97f940 EFLAGS: 00010202 RAX: 0000000000000002 RBX: ffff88823c6b5b28 RCX: ffffed10478d6b6b RDX: dffffc0000000000 RSI: ffffed10478d6b6c RDI: ffff88823c6b5b28 RBP: 0000000000000000 R08: ffff88823c6b5b58 R09: ffff88823c6b5b60 R10: ffff88811d97f957 R11: 0000000000000010 R12: 00000000000a801d R13: ffff88810d8b35d8 R14: 0000000000000010 R15: ffff88823c6b5b28 FS: 0000000000000000(0000) GS:ffff88823c680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561858ad7258 CR3: 000000007729e001 CR4: 0000000000170ef0 Call Trace: <TASK> ? die_addr+0x40/0xa0 ? exc_general_protection+0x154/0x230 ? asm_exc_general_protection+0x26/0x30 ? hrtimer_active+0x58/0x300 ? __pfx_mutex_lock+0x10/0x10 ? __pfx_locks_remove_file+0x10/0x10 hrtimer_cancel+0x15/0x40 timerlat_fd_release+0x8e/0x1f0 ? security_file_release+0x43/0x80 __fput+0x372/0xb10 task_work_run+0x11e/0x1f0 ? _raw_spin_lock+0x85/0xe0 ? __pfx_task_work_run+0x10/0x10 ? poison_slab_object+0x109/0x170 ? do_exit+0x7a0/0x24b0 do_exit+0x7bd/0x24b0 ? __pfx_migrate_enable+0x10/0x10 ? __pfx_do_exit+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x64/0x140 ? _raw_spin_lock_irq+0x86/0xe0 do_group_exit+0xb0/0x220 get_signal+0x17ba/0x1b50 ? vfs_read+0x179/0xa40 ? timerlat_fd_read+0x30b/0x9d0 ? __pfx_get_signal+0x10/0x10 ? __pfx_timerlat_fd_read+0x10/0x10 arch_do_signal_or_restart+0x8c/0x570 ? __pfx_arch_do_signal_or_restart+0x10/0x10 ? vfs_read+0x179/0xa40 ? ksys_read+0xfe/0x1d0 ? __pfx_ksys_read+0x10/0x10 syscall_exit_to_user_mode+0xbc/0x130 do_syscall_64+0x74/0x110 ? __pfx___rseq_handle_notify_resume+0x10/0x10 ? __pfx_ksys_read+0x10/0x10 ? fpregs_restore_userregs+0xdb/0x1e0 ? fpregs_restore_userregs+0xdb/0x1e0 ? syscall_exit_to_user_mode+0x116/0x130 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 entry_SYSCALL_64_after_hwframe+0x71/0x79 RIP: 0033:0x7ff0070eca9c Code: Unable to access opcode bytes at 0x7ff0070eca72. RSP: 002b:00007ff006dff8c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007ff0070eca9c RDX: 0000000000000400 RSI: 00007ff006dff9a0 RDI: 0000000000000003 RBP: 00007ff006dffde0 R08: 0000000000000000 R09: 00007ff000000ba0 R10: 00007ff007004b08 R11: 0000000000000246 R12: 0000000000000003 R13: 00007ff006dff9a0 R14: 0000000000000007 R15: 0000000000000008 </TASK> Modules linked in: snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hwdep snd_hda_core ---[ end trace 0000000000000000 ]---
This is because it would mistakenly call kthread_stop() on a user space thread making it "exit" before it actually exits.
Since kthreads are created based on global behavior, use a cpumask to know when kthreads are running and that they need to be shutdown before proceeding to do new work.
This was debugged by using the persistent ring buffer:
Note, locking was originally used to fix this, but that proved to cause too many deadlocks to work around:
https://lore.kernel.org/linux-trace-kernel/[email protected]/
--- kernel/trace/trace_osnoise.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
kernel/trace/trace_osnoise.c +15 -3
@@ -1612,6 +1612,7 @@ out:static struct cpumask osnoise_cpumask;static struct cpumask save_cpumask; +static struct cpumask kthread_cpumask;/* * osnoise_sleep - sleep until the next period
@@ -1675,6 +1676,7 @@ static inline int osnoise_migration_pend*/ mutex_lock (&interface_lock);this_cpu_osn_var ()->kthread =NULL ; +cpumask_clear_cpu (smp_processor_id (), &kthread_cpumask);mutex_unlock (&interface_lock);return 1 ;
@@ -1947,9 +1949,10 @@ static void stop_kthread(unsigned int cp kthread =per_cpu (per_cpu_osnoise_var, cpu).kthread;if (kthread) { -if (test_bit (OSN_WORKLOAD , &osnoise_options)) { +if (cpumask_test_and_clear_cpu (cpu, &kthread_cpumask) && + !WARN_ON (!test_bit (OSN_WORKLOAD , &osnoise_options))) {kthread_stop (kthread); - }else { + }else if (!WARN_ON (test_bit (OSN_WORKLOAD , &osnoise_options))) {/* * This is a user thread waiting on the timerlat_fd. We need * to close all users, and the best way to guarantee this is
@@ -2021,6 +2024,7 @@ static int start_kthread(unsigned int cp }per_cpu (per_cpu_osnoise_var, cpu).kthread = kthread; +cpumask_set_cpu (cpu, &kthread_cpumask);return 0 ; }
@@ -2048,8 +2052,16 @@ static int start_per_cpu_kthreads(void)*/ cpumask_and (current_mask, cpu_online_mask, &osnoise_cpumask); -for_each_possible_cpu (cpu) +for_each_possible_cpu (cpu) { +if (cpumask_test_and_clear_cpu (cpu, &kthread_cpumask)) { +struct task_struct *kthread; + + kthread =per_cpu (per_cpu_osnoise_var, cpu).kthread; +if (!WARN_ON (!kthread)) +kthread_stop (kthread); + }per_cpu (per_cpu_osnoise_var, cpu).kthread =NULL ; + }for_each_cpu (cpu, current_mask) { retval =start_kthread (cpu);
Greg Kroah-Hartman
maintainerPATCH 63/375 tracing/timerlat: Only clear timer if a kthread exists
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
commit e6a53481da292d970d1edf0d8831121d1c5e2f0d upstream.
The timerlat tracer can use user space threads to check for osnoise and timer latency. If the program using this is killed via a SIGTERM, the threads are shutdown one at a time and another tracing instance can start up resetting the threads before they are fully closed. That causes the hrtimer assigned to the kthread to be shutdown and freed twice when the dying thread finally closes the file descriptors, causing a use-after-free bug.
Only cancel the hrtimer if the associated thread is still around. Also add the interface_lock around the resetting of the tlat_var->kthread.
Note, this is just a quick fix that can be backported to stable. A real fix is to have a better synchronization between the shutdown of old threads and the starting of new ones.
--- kernel/trace/trace_osnoise.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
kernel/trace/trace_osnoise.c +13 -6
@@ -253,20 +253,31 @@ static inline struct timerlat_variables }/* +* Protect the interface. +*/ +static struct mutex interface_lock; + +/* * tlat_var_reset - Reset the values of the given timerlat_variables */ static inline void tlat_var_reset (void ) {struct timerlat_variables *tlat_var;int cpu; + +/* Synchronize with the timerlat interfaces */ +mutex_lock (&interface_lock);/* * So far, all the values are initialized as 0, so * zeroing the structure is perfect. */ for_each_cpu (cpu, cpu_online_mask) { tlat_var =per_cpu_ptr (&per_cpu_timerlat_var, cpu); +if (tlat_var->kthread) +hrtimer_cancel (&tlat_var->timer);memset (tlat_var,0 ,sizeof (*tlat_var)); } +mutex_unlock (&interface_lock); }#else /* CONFIG_TIMERLAT_TRACER */ #define tlat_var_reset () do {} while (0)
@@ -332,11 +343,6 @@ struct timerlat_sample {#endif /* -* Protect the interface. -*/ -static struct mutex interface_lock; - -/* * Tracer data. */ static struct osnoise_data {
@@ -2591,7 +2597,8 @@ static int timerlat_fd_release(struct in osn_var =per_cpu_ptr (&per_cpu_osnoise_var, cpu); tlat_var =per_cpu_ptr (&per_cpu_timerlat_var, cpu); -hrtimer_cancel (&tlat_var->timer); +if (tlat_var->kthread) +hrtimer_cancel (&tlat_var->timer);memset (tlat_var,0 ,sizeof (*tlat_var)); osn_var->sampling =0 ;
Greg Kroah-Hartman
maintainerPATCH 64/375 tracing: Avoid possible softlockup in tracing_iter_reset()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
commit 49aa8a1f4d6800721c7971ed383078257f12e8f9 upstream.
In __tracing_open(), when max latency tracers took place on the cpu, the time start of its buffer would be updated, then event entries with timestamps being earlier than start of the buffer would be skipped (see tracing_iter_reset()).
Softlockup will occur if the kernel is non-preemptible and too many entries were skipped in the loop that reset every cpu buffer, so add cond_resched() to avoid it.
--- kernel/trace/trace.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/trace/trace.c +2 -0
@@ -3958,6 +3958,8 @@ void tracing_iter_reset(struct trace_itebreak ; entries++;ring_buffer_iter_advance (buf_iter); +/* This could be a big loop */ +cond_resched (); }per_cpu_ptr (iter->array_buffer->data, cpu)->skipped_entries = entries;
Greg Kroah-Hartman
maintainerPATCH 65/375 tracing/timerlat: Add interface_lock around clearing of kthread in stop_kthread()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
commit 5bfbcd1ee57b607fd29e4645c7f350dd385dd9ad upstream.
The timerlat interface will get and put the task that is part of the "kthread" field of the osn_var to keep it around until all references are released. But here's a race in the "stop_kthread()" code that will call put_task_struct() on the kthread if it is not a kernel thread. This can race with the releasing of the references to that task struct and the put_task_struct() can be called twice when it should have been called just once.
Take the interface_lock() in stop_kthread() to synchronize this change. But to do so, the function stop_per_cpu_kthreads() needs to change the loop from for_each_online_cpu() to for_each_possible_cpu() and remove the cpu_read_lock(), as the interface_lock can not be taken while the cpu locks are held. The only side effect of this change is that it may do some extra work, as the per_cpu variables of the offline CPUs would not be set anyway, and would simply be skipped in the loop.
Remove unneeded "return;" in stop_kthread().
--- kernel/trace/trace_osnoise.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
kernel/trace/trace_osnoise.c +6 -7
@@ -1953,8 +1953,12 @@ static void stop_kthread(unsigned int cp {struct task_struct *kthread; +mutex_lock (&interface_lock); kthread =per_cpu (per_cpu_osnoise_var, cpu).kthread;if (kthread) { +per_cpu (per_cpu_osnoise_var, cpu).kthread =NULL ; +mutex_unlock (&interface_lock); +if (cpumask_test_and_clear_cpu (cpu, &kthread_cpumask) && !WARN_ON (!test_bit (OSN_WORKLOAD , &osnoise_options))) {kthread_stop (kthread);
@@ -1967,8 +1971,8 @@ static void stop_kthread(unsigned int cpkill_pid (kthread->thread_pid,SIGKILL ,1 );put_task_struct (kthread); } -per_cpu (per_cpu_osnoise_var, cpu).kthread =NULL ; }else { +mutex_unlock (&interface_lock);/* if no workload, just return */ if (!test_bit (OSN_WORKLOAD , &osnoise_options)) {/*
@@ -1976,7 +1980,6 @@ static void stop_kthread(unsigned int cp*/ per_cpu (per_cpu_osnoise_var, cpu).sampling = false;barrier (); -return ; } } }
@@ -1991,12 +1994,8 @@ static void stop_per_cpu_kthreads(void) {int cpu; -cpus_read_lock (); - -for_each_online_cpu (cpu) +for_each_possible_cpu (cpu)stop_kthread (cpu); - -cpus_read_unlock (); }/*
Greg Kroah-Hartman
maintainerPATCH 66/375 userfaultfd: dont BUG_ON() if khugepaged yanks our page table
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit 4828d207dc5161dc7ddf9a4f6dcfd80c7dd7d20a upstream.
Since khugepaged was changed to allow retracting page tables in file mappings without holding the mmap lock, these BUG_ON()s are wrong - get rid of them.
We could also remove the preceding "if (unlikely(...))" block, but then we could reach pte_offset_map_lock() with transhuge pages not just for file mappings but also for anonymous mappings - which would probably be fine but I think is not necessarily expected.
--- mm/userfaultfd.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
mm/userfaultfd.c +4 -3
@@ -805,9 +805,10 @@ retry: err = -EFAULT ;break ; } - -BUG_ON (pmd_none (*dst_pmd)); -BUG_ON (pmd_trans_huge (*dst_pmd)); +/* +* For shmem mappings, khugepaged is allowed to remove page +* tables under us; pte_offset_map_lock() will deal with that. +*/ err =mfill_atomic_pte (dst_pmd, dst_vma, dst_addr, src_addr, flags, &folio);
Greg Kroah-Hartman
maintainerPATCH 67/375 userfaultfd: fix checks for huge PMDs
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit 71c186efc1b2cf1aeabfeff3b9bd5ac4c5ac14d8 upstream.
Patch series "userfaultfd: fix races around pmd_trans_huge() check", v2.
The pmd_trans_huge() code in mfill_atomic() is wrong in three different ways depending on kernel version:
1. The pmd_trans_huge() check is racy and can lead to a BUG_ON() (if you hit the right two race windows) - I've tested this in a kernel build with some extra mdelay() calls. See the commit message for a description of the race scenario.
On older kernels (before 6.5), I think the same bug can even theoretically lead to accessing transhuge page contents as a page table if you hit the right 5 narrow race windows (I haven't tested this case).
2. As pointed out by Qi Zheng, pmd_trans_huge() is not sufficient for detecting PMDs that don't point to page tables.
On older kernels (before 6.5), you'd just have to win a single fairly wide race to hit this.
I've tested this on 6.1 stable by racing migration (with a mdelay() patched into try_to_migrate()) against UFFDIO_ZEROPAGE - on my x86 VM, that causes a kernel oops in ptlock_ptr().
3. On newer kernels (>=6.5), for shmem mappings, khugepaged is allowed to yank page tables out from under us (though I haven't tested that), so I think the BUG_ON() checks in mfill_atomic() are just wrong.
I decided to write two separate fixes for these (one fix for bugs 1+2, one fix for bug 3), so that the first fix can be backported to kernels affected by bugs 1+2.
This patch (of 2):
This fixes two issues.
I discovered that the following race can occur:
mfill_atomic other thread
============ ============
<zap PMD>
pmdp_get_lockless() [reads none pmd]
<bail if trans_huge>
<if none:>
<pagefault creates transhuge zeropage>
__pte_alloc [no-op]
<zap PMD>
<bail if pmd_trans_huge(*dst_pmd)> BUG_ON(pmd_none(*dst_pmd))
I have experimentally verified this in a kernel with extra mdelay() calls; the BUG_ON(pmd_none(*dst_pmd)) triggers.
On kernels newer than commit 0d940a9b270b ("mm/pgtable: allow pte_offset_map[_lock]() to fail"), this can't lead to anything worse than a BUG_ON(), since the page table access helpers are actually designed to deal with page tables concurrently disappearing; but on older kernels (<=6.4), I think we could probably theoretically race past the two BUG_ON() checks and end up treating a hugepage as a page table.
The second issue is that, as Qi Zheng pointed out, there are other types of huge PMDs that pmd_trans_huge() can't catch: devmap PMDs and swap PMDs (in particular, migration PMDs).
On <=6.4, this is worse than the first issue: If mfill_atomic() runs on a PMD that contains a migration entry (which just requires winning a single, fairly wide race), it will pass the PMD to pte_offset_map_lock(), which assumes that the PMD points to a page table.
Breakage follows: First, the kernel tries to take the PTE lock (which will crash or maybe worse if there is no "struct page" for the address bits in the migration entry PMD - I think at least on X86 there usually is no corresponding "struct page" thanks to the PTE inversion mitigation, amd64 looks different).
If that didn't crash, the kernel would next try to write a PTE into what it wrongly thinks is a page table.
As part of fixing these issues, get rid of the check for pmd_trans_huge() before __pte_alloc() - that's redundant, we're going to have to check for that after the __pte_alloc() anyway.
Backport note: pmdp_get_lockless() is pmd_read_atomic() in older kernels.
--- mm/userfaultfd.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
mm/userfaultfd.c +12 -10
@@ -787,21 +787,23 @@ retry: } dst_pmdval =pmdp_get_lockless (dst_pmd); -/* -* If the dst_pmd is mapped as THP don't -* override it and just be strict. -*/ -if (unlikely (pmd_trans_huge (dst_pmdval))) { - err = -EEXIST ; -break ; - }if (unlikely (pmd_none (dst_pmdval)) &&unlikely (__pte_alloc (dst_mm, dst_pmd))) { err = -ENOMEM ;break ; } -/* If an huge pmd materialized from under us fail */ -if (unlikely (pmd_trans_huge (*dst_pmd))) { + dst_pmdval =pmdp_get_lockless (dst_pmd); +/* +* If the dst_pmd is THP don't override it and just be strict. +* (This includes the case where the PMD used to be THP and +* changed back to none after __pte_alloc().) +*/ +if (unlikely (!pmd_present (dst_pmdval) ||pmd_trans_huge (dst_pmdval) || +pmd_devmap (dst_pmdval))) { + err = -EEXIST ; +break ; + } +if (unlikely (pmd_bad (dst_pmdval))) { err = -EFAULT ;break ; }
Greg Kroah-Hartman
maintainerPATCH 68/375 fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
commit 72a6e22c604c95ddb3b10b5d3bb85b6ff4dbc34f upstream.
The fscache_cookie_lru_timer is initialized when the fscache module is inserted, but is not deleted when the fscache module is removed. If timer_reduce() is called before removing the fscache module, the fscache_cookie_lru_timer will be added to the timer list of the current cpu. Afterwards, a use-after-free will be triggered in the softIRQ after removing the fscache module, as follows:
==================================================================
BUG: unable to handle page fault for address: fffffbfff803c9e9 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 21ffea067 P4D 21ffea067 PUD 21ffe6067 PMD 110a7c067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G W 6.11.0-rc3 #855 Tainted: [W]=WARN RIP: 0010:__run_timer_base.part.0+0x254/0x8a0 Call Trace: <IRQ> tmigr_handle_remote_up+0x627/0x810 __walk_groups.isra.0+0x47/0x140 tmigr_handle_remote+0x1fa/0x2f0 handle_softirqs+0x180/0x590 irq_exit_rcu+0x84/0xb0 sysvec_apic_timer_interrupt+0x6e/0x90 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:default_idle+0xf/0x20 default_idle_call+0x38/0x60 do_idle+0x2b5/0x300 cpu_startup_entry+0x54/0x60 start_secondary+0x20d/0x280 common_startup_64+0x13e/0x148 </TASK> Modules linked in: [last unloaded: netfs] ==================================================================
Therefore delete fscache_cookie_lru_timer when removing the fscahe module.
--- fs/netfs/fscache_main.c | 1 + 1 file changed, 1 insertion(+)
fs/netfs/fscache_main.c +1 -0
@@ -103,6 +103,7 @@ void __exit fscache_exit(void)kmem_cache_destroy (fscache_cookie_jar);fscache_proc_cleanup (); +timer_shutdown_sync (&fscache_cookie_lru_timer);destroy_workqueue (fscache_wq);pr_notice ("FS-Cache unloaded\n" ); }
Greg Kroah-Hartman
maintainerPATCH 69/375 eventfs: Use list_del_rcu() for SRCU protected list variable
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
commit d2603279c7d645bf0d11fa253b23f1ab48fc8d3c upstream.
Chi Zhiling reported:
We found a null pointer accessing in tracefs[1], the reason is that the variable 'ei_child' is set to LIST_POISON1, that means the list was removed in eventfs_remove_rec. so when access the ei_child->is_freed, the panic triggered.
by the way, the following script can reproduce this panic
loop1 (){
while true
do
echo "p:kp submit_bio" > /sys/kernel/debug/tracing/kprobe_events
echo "" > /sys/kernel/debug/tracing/kprobe_events
done
}
loop2 (){
while true
do
tree /sys/kernel/debug/tracing/events/kprobes/
done
}
loop1 &
loop2[1]:
[ 1147.959632][T17331] Unable to handle kernel paging request at virtual address dead000000000150 [ 1147.968239][T17331] Mem abort info: [ 1147.971739][T17331] ESR = 0x0000000096000004 [ 1147.976172][T17331] EC = 0x25: DABT (current EL), IL = 32 bits [ 1147.982171][T17331] SET = 0, FnV = 0 [ 1147.985906][T17331] EA = 0, S1PTW = 0 [ 1147.989734][T17331] FSC = 0x04: level 0 translation fault [ 1147.995292][T17331] Data abort info: [ 1147.998858][T17331] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 1148.005023][T17331] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 1148.010759][T17331] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 1148.016752][T17331] [dead000000000150] address between user and kernel address ranges [ 1148.024571][T17331] Internal error: Oops: 0000000096000004 [#1] SMP [ 1148.030825][T17331] Modules linked in: team_mode_loadbalance team nlmon act_gact cls_flower sch_ingress bonding tls macvlan dummy ib_core bridge stp llc veth amdgpu amdxcp mfd_core gpu_sched drm_exec drm_buddy radeon crct10dif_ce video drm_suballoc_helper ghash_ce drm_ttm_helper sha2_ce ttm sha256_arm64 i2c_algo_bit sha1_ce sbsa_gwdt cp210x drm_display_helper cec sr_mod cdrom drm_kms_helper binfmt_misc sg loop fuse drm dm_mod nfnetlink ip_tables autofs4 [last unloaded: tls] [ 1148.072808][T17331] CPU: 3 PID: 17331 Comm: ls Tainted: G W ------- ---- 6.6.43 #2 [ 1148.081751][T17331] Source Version: 21b3b386e948bedd29369af66f3e98ab01b1c650 [ 1148.088783][T17331] Hardware name: Greatwall GW-001M1A-FTF/GW-001M1A-FTF, BIOS KunLun BIOS V4.0 07/16/2020 [ 1148.098419][T17331] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1148.106060][T17331] pc : eventfs_iterate+0x2c0/0x398 [ 1148.111017][T17331] lr : eventfs_iterate+0x2fc/0x398 [ 1148.115969][T17331] sp : ffff80008d56bbd0 [ 1148.119964][T17331] x29: ffff80008d56bbf0 x28: ffff001ff5be2600 x27: 0000000000000000 [ 1148.127781][T17331] x26: ffff001ff52ca4e0 x25: 0000000000009977 x24: dead000000000100 [ 1148.135598][T17331] x23: 0000000000000000 x22: 000000000000000b x21: ffff800082645f10 [ 1148.143415][T17331] x20: ffff001fddf87c70 x19: ffff80008d56bc90 x18: 0000000000000000 [ 1148.151231][T17331] x17: 0000000000000000 x16: 0000000000000000 x15: ffff001ff52ca4e0 [ 1148.159048][T17331] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 1148.166864][T17331] x11: 0000000000000000 x10: 0000000000000000 x9 : ffff8000804391d0 [ 1148.174680][T17331] x8 : 0000000180000000 x7 : 0000000000000018 x6 : 0000aaab04b92862 [ 1148.182498][T17331] x5 : 0000aaab04b92862 x4 : 0000000080000000 x3 : 0000000000000068 [ 1148.190314][T17331] x2 : 000000000000000f x1 : 0000000000007ea8 x0 : 0000000000000001 [ 1148.198131][T17331] Call trace: [ 1148.201259][T17331] eventfs_iterate+0x2c0/0x398 [ 1148.205864][T17331] iterate_dir+0x98/0x188 [ 1148.210036][T17331] __arm64_sys_getdents64+0x78/0x160 [ 1148.215161][T17331] invoke_syscall+0x78/0x108 [ 1148.219593][T17331] el0_svc_common.constprop.0+0x48/0xf0 [ 1148.224977][T17331] do_el0_svc+0x24/0x38 [ 1148.228974][T17331] el0_svc+0x40/0x168 [ 1148.232798][T17331] el0t_64_sync_handler+0x120/0x130 [ 1148.237836][T17331] el0t_64_sync+0x1a4/0x1a8 [ 1148.242182][T17331] Code: 54ffff6c f9400676 910006d6 f9000676 (b9405300) [ 1148.248955][T17331] ---[ end trace 0000000000000000 ]---
The issue is that list_del() is used on an SRCU protected list variable before the synchronization occurs. This can poison the list pointers while there is a reader iterating the list.
This is simply fixed by using list_del_rcu() that is specifically made for this purpose.
--- fs/tracefs/event_inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/tracefs/event_inode.c +1 -1
@@ -862,7 +862,7 @@ static void eventfs_remove_rec(struct evlist_for_each_entry (ei_child, &ei->children, list)eventfs_remove_rec (ei_child, level +1 ); -list_del (&ei->list); +list_del_rcu (&ei->list);free_ei (ei); }
Greg Kroah-Hartman
maintainerPATCH 70/375 net: mana: Fix error handling in mana_create_txq/rxqs NAPI cleanup
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Souradeep Chakrabarti <[email protected]>
commit b6ecc662037694488bfff7c9fd21c405df8411f2 upstream.
Currently napi_disable() gets called during rxq and txq cleanup, even before napi is enabled and hrtimer is initialized. It causes kernel panic.
? page_fault_oops+0x136/0x2b0 ? page_counter_cancel+0x2e/0x80 ? do_user_addr_fault+0x2f2/0x640 ? refill_obj_stock+0xc4/0x110 ? exc_page_fault+0x71/0x160 ? asm_exc_page_fault+0x27/0x30 ? __mmdrop+0x10/0x180 ? __mmdrop+0xec/0x180 ? hrtimer_active+0xd/0x50 hrtimer_try_to_cancel+0x2c/0xf0 hrtimer_cancel+0x15/0x30 napi_disable+0x65/0x90 mana_destroy_rxq+0x4c/0x2f0 mana_create_rxq.isra.0+0x56c/0x6d0 ? mana_uncfg_vport+0x50/0x50 mana_alloc_queues+0x21b/0x320 ? skb_dequeue+0x5f/0x80
--- drivers/net/ethernet/microsoft/mana/mana_en.c | 22 +++++++++++++--------- include/net/mana/mana.h | 2 ++ 2 files changed, 15 insertions(+), 9 deletions(-)
drivers/net/ethernet/microsoft/mana/mana_en.c +13 -9
@@ -1857,10 +1857,12 @@ static void mana_destroy_txq(struct manafor (i =0 ; i < apc->num_queues; i++) { napi = &apc->tx_qp[i].tx_cq.napi; -napi_synchronize (napi); -napi_disable (napi); -netif_napi_del (napi); - +if (apc->tx_qp[i].txq.napi_initialized) { +napi_synchronize (napi); +napi_disable (napi); +netif_napi_del (napi); + apc->tx_qp[i].txq.napi_initialized = false; + }mana_destroy_wq_obj (apc,GDMA_SQ , apc->tx_qp[i].tx_object);mana_deinit_cq (apc, &apc->tx_qp[i].tx_cq);
@@ -1916,6 +1918,7 @@ static int mana_create_txq(struct mana_p txq->ndev = net; txq->net_txq =netdev_get_tx_queue (net, i); txq->vp_offset = apc->tx_vp_offset; + txq->napi_initialized = false;skb_queue_head_init (&txq->pending_skbs);memset (&spec,0 ,sizeof (spec));
@@ -1982,6 +1985,7 @@ static int mana_create_txq(struct mana_pnetif_napi_add_tx (net, &cq->napi, mana_poll);napi_enable (&cq->napi); + txq->napi_initialized = true;mana_gd_ring_cq (cq->gdma_cq,SET_ARM_BIT ); }
@@ -1993,7 +1997,7 @@ out: }static void mana_destroy_rxq (struct mana_port_context *apc, -struct mana_rxq *rxq,bool validate_state) +struct mana_rxq *rxq,bool napi_initialized) {struct gdma_context *gc = apc->ac->gdma_dev->gdma_context;
@@ -2008,15 +2012,15 @@ static void mana_destroy_rxq(struct mana napi = &rxq->rx_cq.napi; -if (validate_state) +if (napi_initialized) {napi_synchronize (napi); -napi_disable (napi); +napi_disable (napi); +netif_napi_del (napi); + }xdp_rxq_info_unreg (&rxq->xdp_rxq); -netif_napi_del (napi); -mana_destroy_wq_obj (apc,GDMA_RQ , rxq->rxobj);mana_deinit_cq (apc, &rxq->rx_cq);
include/net/mana/mana.h +2 -0
@@ -97,6 +97,8 @@ struct mana_txq {atomic_t pending_sends; +bool napi_initialized; +struct mana_stats_tx stats; };
Greg Kroah-Hartman
maintainerPATCH 71/375 net: mctp-serial: Fix missing escapes on transmit
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Johnston <[email protected]>
commit f962e8361adfa84e8252d3fc3e5e6bb879f029b1 upstream.
0x7d and 0x7e bytes are meant to be escaped in the data portion of frames, but this didn't occur since next_chunk_len() had an off-by-one error. That also resulted in the final byte of a payload being written as a separate tty write op.
The chunk prior to an escaped byte would be one byte short, and the next call would never test the txpos+1 case, which is where the escaped byte was located. That meant it never hit the escaping case in mctp_serial_tx_work().
Example Input: 01 00 08 c8 7e 80 02
Previous incorrect chunks from next_chunk_len():
01 00 08
c8 7e 80
02
With this fix:
01 00 08 c8
7e
80 02
--- drivers/net/mctp/mctp-serial.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/mctp/mctp-serial.c +2 -2
@@ -91,8 +91,8 @@ static int next_chunk_len(struct mctp_se* will be those non-escaped bytes, and does not include the escaped * byte. */ -for (i =1 ; i + dev->txpos +1 < dev->txlen; i++) { -if (needs_escape (dev->txbuf[dev->txpos + i +1 ])) +for (i =1 ; i + dev->txpos < dev->txlen; i++) { +if (needs_escape (dev->txbuf[dev->txpos + i]))break ; }
Greg Kroah-Hartman
maintainerPATCH 72/375 x86/fpu: Avoid writing LBR bit to IA32_XSS unless supported
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mitchell Levy <[email protected]>
commit 2848ff28d180bd63a95da8e5dcbcdd76c1beeb7b upstream.
There are two distinct CPU features related to the use of XSAVES and LBR:
whether LBR is itself supported and whether XSAVES supports LBR. The LBR subsystem correctly checks both in intel_pmu_arch_lbr_init(), but the XSTATE subsystem does not.
The LBR bit is only removed from xfeatures_mask_independent when LBR is not supported by the CPU, but there is no validation of XSTATE support.
If XSAVES does not support LBR the write to IA32_XSS causes a #GP fault, leaving the state of IA32_XSS unchanged, i.e. zero. The fault is handled with a warning and the boot continues.
Consequently the next XRSTORS which tries to restore supervisor state fails with #GP because the RFBM has zero for all supervisor features, which does not match the XCOMP_BV field.
As XFEATURE_MASK_FPSTATE includes supervisor features setting up the FPU causes a #GP, which ends up in fpu_reset_from_exception_fixup(). That fails due to the same problem resulting in recursive #GPs until the kernel runs out of stack space and double faults.
Prevent this by storing the supported independent features in fpu_kernel_cfg during XSTATE initialization and use that cached value for retrieving the independent feature bits to be written into IA32_XSS.
[ tglx: Massaged change log ]
--- arch/x86/include/asm/fpu/types.h | 7 +++++++ arch/x86/kernel/fpu/xstate.c | 3 +++ arch/x86/kernel/fpu/xstate.h | 4 ++-- 3 files changed, 12 insertions(+), 2 deletions(-)
arch/x86/include/asm/fpu/types.h +7 -0
@@ -591,6 +591,13 @@ struct fpu_state_config {* even without XSAVE support, i.e. legacy features FP + SSE */ u64 legacy_features; +/* +* @independent_features: +* +* Features that are supported by XSAVES, but not managed as part of +* the FPU core, such as LBR +*/ +u64 independent_features; };/* FPU state configuration information */
arch/x86/kernel/fpu/xstate.c +3 -0
@@ -788,6 +788,9 @@ void __init fpu__init_system_xstate(unsi goto out_disable; } + fpu_kernel_cfg.independent_features = fpu_kernel_cfg.max_features & +XFEATURE_MASK_INDEPENDENT ; +/* * Clear XSAVE features that are disabled in the normal CPUID. */
arch/x86/kernel/fpu/xstate.h +2 -2
@@ -62,9 +62,9 @@ static inline u64 xfeatures_mask_supervistatic inline u64 xfeatures_mask_independent (void ) {if (!cpu_feature_enabled (X86_FEATURE_ARCH_LBR )) -return XFEATURE_MASK_INDEPENDENT & ~XFEATURE_MASK_LBR ; +return fpu_kernel_cfg.independent_features & ~XFEATURE_MASK_LBR ; -return XFEATURE_MASK_INDEPENDENT ; +return fpu_kernel_cfg.independent_features; }/* XSAVE/XRSTOR wrapper functions */
Greg Kroah-Hartman
maintainerPATCH 73/375 x86/apic: Make x2apic_disable() work correctly
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Wang <[email protected]>
commit 0ecc5be200c84e67114f3640064ba2bae3ba2f5a upstream.
x2apic_disable() clears x2apic_state and x2apic_mode unconditionally, even when the state is X2APIC_ON_LOCKED, which prevents the kernel to disable it thereby creating inconsistent state.
Due to the early state check for X2APIC_ON, the code path which warns about a locked X2APIC cannot be reached.
Test for state < X2APIC_ON instead and move the clearing of the state and mode variables to the place which actually disables X2APIC.
[ tglx: Massaged change log. Added Fixes tag. Moved clearing so it's at the
right place for back ports ]
--- arch/x86/kernel/apic/apic.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
arch/x86/kernel/apic/apic.c +6 -5
@@ -1775,12 +1775,9 @@ static __init void apic_set_fixmap(boolstatic __init void x2apic_disable (void ) { -u32 x2apic_id, state = x2apic_state; +u32 x2apic_id; - x2apic_mode =0 ; - x2apic_state =X2APIC_DISABLED ; - -if (state !=X2APIC_ON ) +if (x2apic_state <X2APIC_ON )return ; x2apic_id =read_apic_id ();
@@ -1793,6 +1790,10 @@ static __init void x2apic_disable(void) }__x2apic_disable (); + + x2apic_mode =0 ; + x2apic_state =X2APIC_DISABLED ; +/* * Don't reread the APIC ID as it was already done from * check_x2apic() and the APIC driver still is a x2APIC variant,
Greg Kroah-Hartman
maintainerPATCH 74/375 Revert "drm/amdgpu: align pp_power_profile_mode with kernel docs"
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 1a8d845470941f1b6de1b392227530c097dc5e0c upstream.
This reverts commit 8f614469de248a4bc55fb07e55d5f4c340c75b11.
This breaks some manual setting of the profile mode in certain cases.
--- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +4 -2
@@ -2257,7 +2257,8 @@ static int smu_adjust_power_state_dynami smu_dpm_ctx->dpm_level = level; } -if (smu_dpm_ctx->dpm_level !=AMD_DPM_FORCED_LEVEL_PERF_DETERMINISM ) { +if (smu_dpm_ctx->dpm_level !=AMD_DPM_FORCED_LEVEL_MANUAL && + smu_dpm_ctx->dpm_level !=AMD_DPM_FORCED_LEVEL_PERF_DETERMINISM ) { index =fls (smu->workload_mask); index = index >0 && index <=WORKLOAD_POLICY_MAX ? index -1 :0 ; workload[0 ] = smu->workload_setting[index];
@@ -2336,7 +2337,8 @@ static int smu_switch_power_profile(void workload[0 ] = smu->workload_setting[index]; } -if (smu_dpm_ctx->dpm_level !=AMD_DPM_FORCED_LEVEL_PERF_DETERMINISM ) +if (smu_dpm_ctx->dpm_level !=AMD_DPM_FORCED_LEVEL_MANUAL && + smu_dpm_ctx->dpm_level !=AMD_DPM_FORCED_LEVEL_PERF_DETERMINISM )smu_bump_power_profile_mode (smu, workload,0 );return 0 ;
Greg Kroah-Hartman
maintainerPATCH 75/375 Revert "wifi: ath11k: restore country code during resume"
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
commit d3e154d7776ba57ab679fb816fb87b627fba21c9 upstream.
This reverts commit 7f0343b7b8710436c1e6355c71782d32ada47e0c.
We are going to revert commit 166a490f59ac ("wifi: ath11k: support hibernation"), on which this commit depends. With that commit reverted, this one is not needed any more, so revert this commit first.
--- drivers/net/wireless/ath/ath11k/core.c | 10 ---------- 1 file changed, 10 deletions(-)
drivers/net/wireless/ath/ath11k/core.c +0 -10
@@ -1009,16 +1009,6 @@ int ath11k_core_resume(struct ath11k_basreturn -ETIMEDOUT ; } -if (ab->hw_params.current_cc_support && - ar->alpha2[0 ] !=0 && ar->alpha2[1 ] !=0 ) { - ret =ath11k_reg_set_cc (ar); -if (ret) { -ath11k_warn (ab,"failed to set country code during resume: %d\n" , - ret); -return ret; - } - } - ret =ath11k_dp_rx_pktlog_start (ab);if (ret) ath11k_warn(ab, "failed to start rx pktlog during resume: %d\n",
Greg Kroah-Hartman
maintainerPATCH 76/375 Revert "wifi: ath11k: support hibernation"
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
commit 2f833e8948d6c88a3a257d4e426c9897b4907d5a upstream.
This reverts commit 166a490f59ac10340ee5330e51c15188ce2a7f8f.
There are several reports that this commit breaks system suspend on some specific Lenovo platforms. Since there is no fix available, for now revert this commit to make suspend work again on those platforms.
--- drivers/net/wireless/ath/ath11k/ahb.c | 4 - drivers/net/wireless/ath/ath11k/core.c | 107 +++++++++------------------------ drivers/net/wireless/ath/ath11k/core.h | 4 - drivers/net/wireless/ath/ath11k/hif.h | 12 --- drivers/net/wireless/ath/ath11k/mhi.c | 12 --- drivers/net/wireless/ath/ath11k/mhi.h | 3 drivers/net/wireless/ath/ath11k/pci.c | 44 ++----------- drivers/net/wireless/ath/ath11k/qmi.c | 2 8 files changed, 49 insertions(+), 139 deletions(-)
drivers/net/wireless/ath/ath11k/ahb.c +2 -2
@@ -413,7 +413,7 @@ static int ath11k_ahb_power_up(struct atreturn ret; } -static void ath11k_ahb_power_down (struct ath11k_base *ab,bool is_suspend) +static void ath11k_ahb_power_down (struct ath11k_base *ab) {struct ath11k_ahb *ab_ahb =ath11k_ahb_priv (ab);
@@ -1261,7 +1261,7 @@ static void ath11k_ahb_remove(struct plastruct ath11k_base *ab =platform_get_drvdata (pdev);if (test_bit (ATH11K_FLAG_QMI_FAIL , &ab->dev_flags)) { -ath11k_ahb_power_down (ab, false); +ath11k_ahb_power_down (ab);ath11k_debugfs_soc_destroy (ab);ath11k_qmi_deinit_service (ab); goto qmi_fail;
drivers/net/wireless/ath/ath11k/core.c +32 -75
171 lines not on this page · raw message
drivers/net/wireless/ath/ath11k/core.h +0 -4
@@ -1033,8 +1033,6 @@ struct ath11k_base {DECLARE_BITMAP (fw_features,ATH11K_FW_FEATURE_COUNT ); } fw; -struct completion restart_completed; - #ifdef CONFIG_NL80211_TESTMODE struct { u32 data_pos;
@@ -1234,10 +1232,8 @@ void ath11k_core_free_bdf(struct ath11k_int ath11k_core_check_dt (struct ath11k_base *ath11k);int ath11k_core_check_smbios (struct ath11k_base *ab);void ath11k_core_halt (struct ath11k *ar); -int ath11k_core_resume_early (struct ath11k_base *ab);int ath11k_core_resume (struct ath11k_base *ab);int ath11k_core_suspend (struct ath11k_base *ab); -int ath11k_core_suspend_late (struct ath11k_base *ab);void ath11k_core_pre_reconfigure_recovery (struct ath11k_base *ab);bool ath11k_core_coldboot_cal_support (struct ath11k_base *ab);
drivers/net/wireless/ath/ath11k/hif.h +3 -9
@@ -18,7 +18,7 @@ struct ath11k_hif_ops {int (*start)(struct ath11k_base *ab);void (*stop)(struct ath11k_base *ab);int (*power_up)(struct ath11k_base *ab); -void (*power_down)(struct ath11k_base *ab,bool is_suspend); +void (*power_down)(struct ath11k_base *ab);int (*suspend)(struct ath11k_base *ab);int (*resume)(struct ath11k_base *ab); int (*map_service_to_pipe)(struct ath11k_base *ab, u16 service_id,
@@ -67,18 +67,12 @@ static inline void ath11k_hif_irq_disablstatic inline int ath11k_hif_power_up (struct ath11k_base *ab) { -if (!ab->hif.ops->power_up) -return -EOPNOTSUPP ; -return ab->hif.ops->power_up (ab); } -static inline void ath11k_hif_power_down (struct ath11k_base *ab,bool is_suspend) +static inline void ath11k_hif_power_down (struct ath11k_base *ab) { -if (!ab->hif.ops->power_down) -return ; - - ab->hif.ops->power_down (ab, is_suspend); + ab->hif.ops->power_down (ab); }static inline int ath11k_hif_suspend (struct ath11k_base *ab)
drivers/net/wireless/ath/ath11k/mhi.c +2 -10
@@ -453,17 +453,9 @@ int ath11k_mhi_start(struct ath11k_pci *return 0 ; } -void ath11k_mhi_stop (struct ath11k_pci *ab_pci,bool is_suspend) +void ath11k_mhi_stop (struct ath11k_pci *ab_pci) { -/* During suspend we need to use mhi_power_down_keep_dev() -* workaround, otherwise ath11k_core_resume() will timeout -* during resume. -*/ -if (is_suspend) -mhi_power_down_keep_dev (ab_pci->mhi_ctrl, true); -else -mhi_power_down (ab_pci->mhi_ctrl, true); - +mhi_power_down (ab_pci->mhi_ctrl, true);mhi_unprepare_after_power_down (ab_pci->mhi_ctrl); }
drivers/net/wireless/ath/ath11k/mhi.h +2 -1
@@ -18,7 +18,7 @@#define MHICTRL_RESET_MASK 0x2int ath11k_mhi_start (struct ath11k_pci *ar_pci); -void ath11k_mhi_stop (struct ath11k_pci *ar_pci,bool is_suspend); +void ath11k_mhi_stop (struct ath11k_pci *ar_pci);int ath11k_mhi_register (struct ath11k_pci *ar_pci);void ath11k_mhi_unregister (struct ath11k_pci *ar_pci);void ath11k_mhi_set_mhictrl_reset (struct ath11k_base *ab);
@@ -26,4 +26,5 @@ void ath11k_mhi_clear_vector(struct ath1int ath11k_mhi_suspend (struct ath11k_pci *ar_pci);int ath11k_mhi_resume (struct ath11k_pci *ar_pci); +#endif
drivers/net/wireless/ath/ath11k/pci.c +7 -37
74 lines not on this page · raw message
drivers/net/wireless/ath/ath11k/qmi.c +1 -1
@@ -2877,7 +2877,7 @@ int ath11k_qmi_fwreset_from_cold_boot(st }/* reset the firmware */ -ath11k_hif_power_down (ab, false); +ath11k_hif_power_down (ab);ath11k_hif_power_up (ab);ath11k_dbg (ab,ATH11K_DBG_QMI ,"exit wait for cold boot done\n" );return 0 ;
Greg Kroah-Hartman
maintainerPATCH 77/375 tcp_bpf: fix return value of tcp_bpf_sendmsg()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Wang <[email protected]>
commit fe1910f9337bd46a9343967b547ccab26b4b2c6e upstream.
When we cork messages in psock->cork, the last message triggers the flushing will result in sending a sk_msg larger than the current message size. In this case, in tcp_bpf_send_verdict(), 'copied' becomes negative at least in the following case:
468 case __SK_DROP:
469 default:
470 sk_msg_free_partial(sk, msg, tosend); 471 sk_msg_apply_bytes(psock, tosend); 472 *copied -= (tosend + delta); // <==== HERE 473 return -EACCES;
Therefore, it could lead to the following BUG with a proper value of 'copied' (thanks to syzbot). We should not use negative 'copied' as a return value here.
------------[ cut here ]------------ kernel BUG at net/socket.c:733! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 UID: 0 PID: 3265 Comm: syz-executor510 Not tainted 6.11.0-rc3-syzkaller-00060-gd07b43284ab3 #0 Hardware name: linux,dummy-virt (DT) pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : sock_sendmsg_nosec net/socket.c:733 [inline] pc : sock_sendmsg_nosec net/socket.c:728 [inline] pc : __sock_sendmsg+0x5c/0x60 net/socket.c:745 lr : sock_sendmsg_nosec net/socket.c:730 [inline] lr : __sock_sendmsg+0x54/0x60 net/socket.c:745 sp : ffff800088ea3b30 x29: ffff800088ea3b30 x28: fbf00000062bc900 x27: 0000000000000000 x26: ffff800088ea3bc0 x25: ffff800088ea3bc0 x24: 0000000000000000 x23: f9f00000048dc000 x22: 0000000000000000 x21: ffff800088ea3d90 x20: f9f00000048dc000 x19: ffff800088ea3d90 x18: 0000000000000001 x17: 0000000000000000 x16: 0000000000000000 x15: 000000002002ffaf x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: ffff8000815849c0 x9 : ffff8000815b49c0 x8 : 0000000000000000 x7 : 000000000000003f x6 : 0000000000000000 x5 : 00000000000007e0 x4 : fff07ffffd239000 x3 : fbf00000062bc900 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 00000000fffffdef Call trace: sock_sendmsg_nosec net/socket.c:733 [inline] __sock_sendmsg+0x5c/0x60 net/socket.c:745 ____sys_sendmsg+0x274/0x2ac net/socket.c:2597 ___sys_sendmsg+0xac/0x100 net/socket.c:2651 __sys_sendmsg+0x84/0xe0 net/socket.c:2680 __do_sys_sendmsg net/socket.c:2689 [inline] __se_sys_sendmsg net/socket.c:2687 [inline] __arm64_sys_sendmsg+0x24/0x30 net/socket.c:2687 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151 el0_svc+0x34/0xec arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 Code: f9404463 d63f0060 3108441f 54fffe81 (d4210000) ---[ end trace 0000000000000000 ]---
--- net/ipv4/tcp_bpf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/tcp_bpf.c +1 -1
@@ -577,7 +577,7 @@ out_err: err =sk_stream_error (sk, msg->msg_flags, err);release_sock (sk);sk_psock_put (sk, psock); -return copied ? copied : err; +return copied >0 ? copied : err; }enum {
Greg Kroah-Hartman
maintainerPATCH 78/375 ila: call nf_unregister_net_hooks() sooner
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 031ae72825cef43e4650140b800ad58bf7a6a466 upstream.
syzbot found an use-after-free Read in ila_nf_input [1]
Issue here is that ila_xlat_exit_net() frees the rhashtable, then call nf_unregister_net_hooks().
It should be done in the reverse way, with a synchronize_rcu().
This is a good match for a pre_exit() method.
[1]
BUG: KASAN: use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline]
BUG: KASAN: use-after-free in __rhashtable_lookup include/linux/rhashtable.h:604 [inline]
BUG: KASAN: use-after-free in rhashtable_lookup include/linux/rhashtable.h:646 [inline]
BUG: KASAN: use-after-free in rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672
Read of size 4 at addr ffff888064620008 by task ksoftirqd/0/16
CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.11.0-rc4-syzkaller-00238-g2ad6d23f465a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
rht_key_hashfn include/linux/rhashtable.h:159 [inline]
__rhashtable_lookup include/linux/rhashtable.h:604 [inline]
rhashtable_lookup include/linux/rhashtable.h:646 [inline]
rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672
ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:132 [inline]
ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline]
ila_nf_input+0x1fe/0x3c0 net/ipv6/ila/ila_xlat.c:190
nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626
nf_hook include/linux/netfilter.h:269 [inline]
NF_HOOK+0x29e/0x450 include/linux/netfilter.h:312
__netif_receive_skb_one_core net/core/dev.c:5661 [inline]
__netif_receive_skb+0x1ea/0x650 net/core/dev.c:5775
process_backlog+0x662/0x15b0 net/core/dev.c:6108
__napi_poll+0xcb/0x490 net/core/dev.c:6772
napi_poll net/core/dev.c:6841 [inline]
net_rx_action+0x89b/0x1240 net/core/dev.c:6963
handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
run_ksoftirqd+0xca/0x130 kernel/softirq.c:928
smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x64620
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xbfffffff(buddy)
raw: 00fff00000000000 ffffea0000959608 ffffea00019d9408 0000000000000000
raw: 0000000000000000 0000000000000003 00000000bfffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52dc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_ZERO), pid 5242, tgid 5242 (syz-executor), ts 73611328570, free_ts 618981657187
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1493
prep_new_page mm/page_alloc.c:1501 [inline]
get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3439
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4695
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
___kmalloc_large_node+0x8b/0x1d0 mm/slub.c:4103
__kmalloc_large_node_noprof+0x1a/0x80 mm/slub.c:4130
__do_kmalloc_node mm/slub.c:4146 [inline]
__kmalloc_node_noprof+0x2d2/0x440 mm/slub.c:4164
__kvmalloc_node_noprof+0x72/0x190 mm/util.c:650
bucket_table_alloc lib/rhashtable.c:186 [inline]
rhashtable_init_noprof+0x534/0xa60 lib/rhashtable.c:1071
ila_xlat_init_net+0xa0/0x110 net/ipv6/ila/ila_xlat.c:613
ops_init+0x359/0x610 net/core/net_namespace.c:139
setup_net+0x515/0xca0 net/core/net_namespace.c:343
copy_net_ns+0x4e2/0x7b0 net/core/net_namespace.c:508
create_new_namespaces+0x425/0x7b0 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0x124/0x180 kernel/nsproxy.c:228
ksys_unshare+0x619/0xc10 kernel/fork.c:3328
__do_sys_unshare kernel/fork.c:3399 [inline]
__se_sys_unshare kernel/fork.c:3397 [inline]
__x64_sys_unshare+0x38/0x40 kernel/fork.c:3397
page last free pid 11846 tgid 11846 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1094 [inline]
free_unref_page+0xd22/0xea0 mm/page_alloc.c:2612
__folio_put+0x2c8/0x440 mm/swap.c:128
folio_put include/linux/mm.h:1486 [inline]
free_large_kmalloc+0x105/0x1c0 mm/slub.c:4565
kfree+0x1c4/0x360 mm/slub.c:4588
rhashtable_free_and_destroy+0x7c6/0x920 lib/rhashtable.c:1169
ila_xlat_exit_net+0x55/0x110 net/ipv6/ila/ila_xlat.c:626
ops_exit_list net/core/net_namespace.c:173 [inline]
cleanup_net+0x802/0xcc0 net/core/net_namespace.c:640
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd40 kernel/workqueue.c:3390
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Memory state around the buggy address:
ffff88806461ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88806461ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888064620000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888064620080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888064620100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff--- net/ipv6/ila/ila.h | 1 + net/ipv6/ila/ila_main.c | 6 ++++++ net/ipv6/ila/ila_xlat.c | 13 +++++++++---- 3 files changed, 16 insertions(+), 4 deletions(-)
net/ipv6/ila/ila.h +1 -0
@@ -108,6 +108,7 @@ int ila_lwt_init(void);void ila_lwt_fini (void );int ila_xlat_init_net (struct net *net); +void ila_xlat_pre_exit_net (struct net *net);void ila_xlat_exit_net (struct net *net);int ila_xlat_nl_cmd_add_mapping (struct sk_buff *skb,struct genl_info *info);
net/ipv6/ila/ila_main.c +6 -0
@@ -71,6 +71,11 @@ ila_xlat_init_fail:return err; } +static __net_exit void ila_pre_exit_net(struct net *net) +{ +ila_xlat_pre_exit_net (net); +} + static __net_exit void ila_exit_net(struct net *net) {ila_xlat_exit_net (net);
@@ -78,6 +83,7 @@ static __net_exit void ila_exit_net(strustatic struct pernet_operations ila_net_ops = { .init = ila_init_net, + .pre_exit = ila_pre_exit_net, .exit = ila_exit_net, .id = &ila_net_id, .size =sizeof (struct ila_net ),
net/ipv6/ila/ila_xlat.c +9 -4
@@ -619,6 +619,15 @@ int ila_xlat_init_net(struct net *net)return 0 ; } +void ila_xlat_pre_exit_net (struct net *net) +{ +struct ila_net *ilan =net_generic (net, ila_net_id); + +if (ilan->xlat.hooks_registered) +nf_unregister_net_hooks (net, ila_nf_hook_ops, +ARRAY_SIZE (ila_nf_hook_ops)); +} +void ila_xlat_exit_net (struct net *net) {struct ila_net *ilan =net_generic (net, ila_net_id);
@@ -626,10 +635,6 @@ void ila_xlat_exit_net(struct net *net)rhashtable_free_and_destroy (&ilan->xlat.rhash_table, ila_free_cb,NULL );free_bucket_spinlocks (ilan->xlat.locks); - -if (ilan->xlat.hooks_registered) -nf_unregister_net_hooks (net, ila_nf_hook_ops, -ARRAY_SIZE (ila_nf_hook_ops)); }static int ila_xlat_addr (struct sk_buff *skb,bool sir2ila)
Greg Kroah-Hartman
maintainerPATCH 79/375 sched: sch_cake: fix bulk flow accounting logic for host fairness
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
commit 546ea84d07e3e324644025e2aae2d12ea4c5896e upstream.
In sch_cake, we keep track of the count of active bulk flows per host, when running in dst/src host fairness mode, which is used as the round-robin weight when iterating through flows. The count of active bulk flows is updated whenever a flow changes state.
This has a peculiar interaction with the hash collision handling: when a hash collision occurs (after the set-associative hashing), the state of the hash bucket is simply updated to match the new packet that collided, and if host fairness is enabled, that also means assigning new per-host state to the flow. For this reason, the bulk flow counters of the host(s) assigned to the flow are decremented, before new state is assigned (and the counters, which may not belong to the same host anymore, are incremented again).
Back when this code was introduced, the host fairness mode was always enabled, so the decrement was unconditional. When the configuration flags were introduced the *increment* was made conditional, but the *decrement* was not. Which of course can lead to a spurious decrement (and associated wrap-around to U16_MAX).
AFAICT, when host fairness is disabled, the decrement and wrap-around happens as soon as a hash collision occurs (which is not that common in itself, due to the set-associative hashing). However, in most cases this is harmless, as the value is only used when host fairness mode is enabled. So in order to trigger an array overflow, sch_cake has to first be configured with host fairness disabled, and while running in this mode, a hash collision has to occur to cause the overflow. Then, the qdisc has to be reconfigured to enable host fairness, which leads to the array out-of-bounds because the wrapped-around value is retained and used as an array index. It seems that syzbot managed to trigger this, which is quite impressive in its own right.
This patch fixes the issue by introducing the same conditional check on decrement as is used on increment.
The original bug predates the upstreaming of cake, but the commit listed in the Fixes tag touched that code, meaning that this patch won't apply before that.
--- net/sched/sch_cake.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
net/sched/sch_cake.c +7 -4
@@ -786,12 +786,15 @@ skip_hash:* queue, accept the collision, update the host tags. */ q->way_collisions++; -if (q->flows[outer_hash + k].set ==CAKE_SET_BULK ) { - q->hosts[q->flows[reduced_hash].srchost].srchost_bulk_flow_count--; - q->hosts[q->flows[reduced_hash].dsthost].dsthost_bulk_flow_count--; - } allocate_src =cake_dsrc (flow_mode); allocate_dst =cake_ddst (flow_mode); + +if (q->flows[outer_hash + k].set ==CAKE_SET_BULK ) { +if (allocate_src) + q->hosts[q->flows[reduced_hash].srchost].srchost_bulk_flow_count--; +if (allocate_dst) + q->hosts[q->flows[reduced_hash].dsthost].dsthost_bulk_flow_count--; + } found:/* reserve queue for future packets in same flow */ reduced_hash = outer_hash + k;
Greg Kroah-Hartman
maintainerPATCH 80/375 nilfs2: fix missing cleanup on rollforward recovery error
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit 5787fcaab9eb5930f5378d6a1dd03d916d146622 upstream.
In an error injection test of a routine for mount-time recovery, KASAN found a use-after-free bug.
It turned out that if data recovery was performed using partial logs created by dsync writes, but an error occurred before starting the log writer to create a recovered checkpoint, the inodes whose data had been recovered were left in the ns_dirty_files list of the nilfs object and were not freed.
Fix this issue by cleaning up inodes that have read the recovery data if the recovery routine fails midway before the log writer starts.
--- fs/nilfs2/recovery.c | 35 +++++++++++++++++++++++++++++++++-- 1 file changed, 33 insertions(+), 2 deletions(-)
fs/nilfs2/recovery.c +33 -2
@@ -716,6 +716,33 @@ static void nilfs_finish_roll_forward(st }/** +* nilfs_abort_roll_forward - cleaning up after a failed rollforward recovery +* @nilfs: nilfs object +*/ +static void nilfs_abort_roll_forward (struct the_nilfs *nilfs) +{ +struct nilfs_inode_info *ii, *n; +LIST_HEAD (head); + +/* Abandon inodes that have read recovery data */ +spin_lock (&nilfs->ns_inode_lock); +list_splice_init (&nilfs->ns_dirty_files, &head); +spin_unlock (&nilfs->ns_inode_lock); +if (list_empty (&head)) +return ; + +set_nilfs_purging (nilfs); +list_for_each_entry_safe (ii, n, &head, i_dirty) { +spin_lock (&nilfs->ns_inode_lock); +list_del_init (&ii->i_dirty); +spin_unlock (&nilfs->ns_inode_lock); + +iput (&ii->vfs_inode); + } +clear_nilfs_purging (nilfs); +} + +/** * nilfs_salvage_orphan_logs - salvage logs written after the latest checkpoint * @nilfs: nilfs object * @sb: super block instance
@@ -773,15 +800,19 @@ int nilfs_salvage_orphan_logs(struct theif (unlikely (err)) {nilfs_err (sb,"error %d writing segment for recovery" , err); - goto failed; + goto put_root; }nilfs_finish_roll_forward (nilfs, ri); } - failed: +put_root:nilfs_put_root (root);return err; + +failed: +nilfs_abort_roll_forward (nilfs); + goto put_root; }/**
Greg Kroah-Hartman
maintainerPATCH 81/375 nilfs2: protect references to superblock parameters exposed in sysfs
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit 683408258917541bdb294cd717c210a04381931e upstream.
The superblock buffers of nilfs2 can not only be overwritten at runtime for modifications/repairs, but they are also regularly swapped, replaced during resizing, and even abandoned when degrading to one side due to backing device issues. So, accessing them requires mutual exclusion using the reader/writer semaphore "nilfs->ns_sem".
Some sysfs attribute show methods read this superblock buffer without the necessary mutual exclusion, which can cause problems with pointer dereferencing and memory access, so fix it.
--- fs/nilfs2/sysfs.c | 43 +++++++++++++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 10 deletions(-)
fs/nilfs2/sysfs.c +33 -10
@@ -836,9 +836,15 @@ ssize_t nilfs_dev_revision_show(struct nstruct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; -u32 major =le32_to_cpu (sbp[0 ]->s_rev_level); -u16 minor =le16_to_cpu (sbp[0 ]->s_minor_rev_level); + struct nilfs_super_block *raw_sb; +u32 major; +u16 minor; + +down_read (&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0 ]; + major =le32_to_cpu (raw_sb->s_rev_level); + minor =le16_to_cpu (raw_sb->s_minor_rev_level); +up_read (&nilfs->ns_sem);return sysfs_emit (buf,"%d.%d\n" , major, minor); }
@@ -856,8 +862,13 @@ ssize_t nilfs_dev_device_size_show(strucstruct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; -u64 dev_size =le64_to_cpu (sbp[0 ]->s_dev_size); + struct nilfs_super_block *raw_sb; +u64 dev_size; + +down_read (&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0 ]; + dev_size =le64_to_cpu (raw_sb->s_dev_size); +up_read (&nilfs->ns_sem);return sysfs_emit (buf,"%llu\n" , dev_size); }
@@ -879,9 +890,15 @@ ssize_t nilfs_dev_uuid_show(struct nilfsstruct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; + struct nilfs_super_block *raw_sb; +ssize_t len; + +down_read (&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0 ]; + len =sysfs_emit (buf,"%pUb\n" , raw_sb->s_uuid); +up_read (&nilfs->ns_sem); -return sysfs_emit (buf,"%pUb\n" , sbp[0 ]->s_uuid); +return len; } static
@@ -889,10 +906,16 @@ ssize_t nilfs_dev_volume_name_show(strucstruct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; + struct nilfs_super_block *raw_sb; +ssize_t len; + +down_read (&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0 ]; + len =scnprintf (buf,sizeof (raw_sb->s_volume_name),"%s\n" , + raw_sb->s_volume_name); +up_read (&nilfs->ns_sem); -return scnprintf (buf,sizeof (sbp[0 ]->s_volume_name),"%s\n" , - sbp[0 ]->s_volume_name); +return len; } static const char dev_readme_str[] =
Greg Kroah-Hartman
maintainerPATCH 82/375 nilfs2: fix state management in error path of log writing function
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit 6576dd6695f2afca3f4954029ac4a64f82ba60ab upstream.
After commit a694291a6211 ("nilfs2: separate wait function from nilfs_segctor_write") was applied, the log writing function nilfs_segctor_do_construct() was able to issue I/O requests continuously even if user data blocks were split into multiple logs across segments, but two potential flaws were introduced in its error handling.
First, if nilfs_segctor_begin_construction() fails while creating the second or subsequent logs, the log writing function returns without calling nilfs_segctor_abort_construction(), so the writeback flag set on pages/folios will remain uncleared. This causes page cache operations to hang waiting for the writeback flag. For example, truncate_inode_pages_final(), which is called via nilfs_evict_inode() when an inode is evicted from memory, will hang.
Second, the NILFS_I_COLLECTED flag set on normal inodes remain uncleared. As a result, if the next log write involves checkpoint creation, that's fine, but if a partial log write is performed that does not, inodes with NILFS_I_COLLECTED set are erroneously removed from the "sc_dirty_files" list, and their data and b-tree blocks may not be written to the device, corrupting the block mapping.
Fix these issues by uniformly calling nilfs_segctor_abort_construction() on failure of each step in the loop in nilfs_segctor_do_construct(), having it clean up logs and segment usages according to progress, and correcting the conditions for calling nilfs_redirty_inodes() to ensure that the NILFS_I_COLLECTED flag is cleared.
--- fs/nilfs2/segment.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
fs/nilfs2/segment.c +6 -4
@@ -1788,6 +1788,9 @@ static void nilfs_segctor_abort_construcnilfs_abort_logs (&logs, ret ? : err);list_splice_tail_init (&sci->sc_segbufs, &logs); +if (list_empty (&logs)) +return ;/* if the first segment buffer preparation failed */ +nilfs_cancel_segusage (&logs, nilfs->ns_sufile);nilfs_free_incomplete_logs (&logs, nilfs);
@@ -2032,7 +2035,7 @@ static int nilfs_segctor_do_construct(st err =nilfs_segctor_begin_construction (sci, nilfs);if (unlikely (err)) - goto out; + goto failed;/* Update time stamp */ sci->sc_seg_ctime =ktime_get_real_seconds ();
@@ -2099,10 +2102,9 @@ static int nilfs_segctor_do_construct(streturn err; failed_to_write: -if (sci->sc_stage.flags &NILFS_CF_IFILE_STARTED ) -nilfs_redirty_inodes (&sci->sc_dirty_files); - failed: +if (mode ==SC_LSEG_SR &&nilfs_sc_cstage_get (sci) >=NILFS_ST_IFILE ) +nilfs_redirty_inodes (&sci->sc_dirty_files);if (nilfs_doing_gc ())nilfs_redirty_inodes (&sci->sc_gc_inodes);nilfs_segctor_abort_construction (sci, nilfs, err);
Greg Kroah-Hartman
maintainerPATCH 83/375 btrfs: qgroup: dont use extent changeset when not needed
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
commit c346c629765ab982967017e2ae859156d0e235cf upstream.
The local extent changeset is passed to clear_record_extent_bits() where it may have some additional memory dynamically allocated for ulist. When qgroup is disabled, the memory is leaked because in this case the changeset is not released upon __btrfs_qgroup_release_data() return.
Since the recorded contents of the changeset are not used thereafter, just don't pass it.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- fs/btrfs/qgroup.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/btrfs/qgroup.c +1 -2
@@ -4269,10 +4269,9 @@ static int __btrfs_qgroup_release_data(sint ret;if (btrfs_qgroup_mode (inode->root->fs_info) ==BTRFS_QGROUP_MODE_DISABLED ) { -extent_changeset_init (&changeset);return clear_record_extent_bits (&inode->io_tree, start, start + len -1 , -EXTENT_QGROUP_RESERVED , &changeset); +EXTENT_QGROUP_RESERVED ,NULL ); }/* In release case, we shouldn't have @reserved */
Greg Kroah-Hartman
maintainerPATCH 84/375 btrfs: zoned: handle broken write pointer on zones
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiro Aota <[email protected]>
commit b1934cd6069538db2255dc94ba573771ecf3b560 upstream.
Btrfs rejects to mount a FS if it finds a block group with a broken write pointer (e.g, unequal write pointers on two zones of RAID1 block group). Since such case can happen easily with a power-loss or crash of a system, we need to handle the case more gently.
Handle such block group by making it unallocatable, so that there will be no writes into it. That can be done by setting the allocation pointer at the end of allocating region (= block_group->zone_capacity). Then, existing code handle zone_unusable properly.
Having proper zone_capacity is necessary for the change. So, set it as fast as possible.
We cannot handle RAID0 and RAID10 case like this. But, they are anyway unable to read because of a missing stripe.
--- fs/btrfs/zoned.c | 30 +++++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-)
fs/btrfs/zoned.c +25 -5
@@ -1408,6 +1408,8 @@ static int btrfs_load_block_group_dup(streturn -EINVAL ; } + bg->zone_capacity =min_not_zero (zone_info[0 ].capacity, zone_info[1 ].capacity); +if (zone_info[0 ].alloc_offset ==WP_MISSING_DEV ) { btrfs_err(bg->fs_info, "zoned: cannot recover write pointer for zone %llu",
@@ -1434,7 +1436,6 @@ static int btrfs_load_block_group_dup(st } bg->alloc_offset = zone_info[0 ].alloc_offset; - bg->zone_capacity =min (zone_info[0 ].capacity, zone_info[1 ].capacity);return 0 ; }
@@ -1452,6 +1453,9 @@ static int btrfs_load_block_group_raid1(return -EINVAL ; } +/* In case a device is missing we have a cap of 0, so don't use it. */ + bg->zone_capacity =min_not_zero (zone_info[0 ].capacity, zone_info[1 ].capacity); +for (i =0 ; i < map->num_stripes; i++) {if (zone_info[i].alloc_offset ==WP_MISSING_DEV || zone_info[i].alloc_offset ==WP_CONVENTIONAL )
@@ -1473,9 +1477,6 @@ static int btrfs_load_block_group_raid1(if (test_bit (0 , active))set_bit (BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE , &bg->runtime_flags); } -/* In case a device is missing we have a cap of 0, so don't use it. */ - bg->zone_capacity =min_not_zero (zone_info[0 ].capacity, - zone_info[1 ].capacity); }if (zone_info[0 ].alloc_offset !=WP_MISSING_DEV )
@@ -1565,6 +1566,7 @@ int btrfs_load_block_group_zone_info(strunsigned long *active =NULL ;u64 last_alloc =0 ;u32 num_sequential =0 , num_conventional =0 ; +u64 profile;if (!btrfs_is_zoned (fs_info))return 0 ;
@@ -1625,7 +1627,8 @@ int btrfs_load_block_group_zone_info(str } } -switch (map->type &BTRFS_BLOCK_GROUP_PROFILE_MASK ) { + profile = map->type &BTRFS_BLOCK_GROUP_PROFILE_MASK ; +switch (profile) {case 0 :/* single */ ret =btrfs_load_block_group_single (cache, &zone_info[0 ], active);break ;
@@ -1652,6 +1655,23 @@ int btrfs_load_block_group_zone_info(str goto out; } +if (ret == -EIO && profile !=0 && profile !=BTRFS_BLOCK_GROUP_RAID0 && + profile !=BTRFS_BLOCK_GROUP_RAID10 ) { +/* +* Detected broken write pointer. Make this block group +* unallocatable by setting the allocation pointer at the end of +* allocatable region. Relocating this block group will fix the +* mismatch. +* +* Currently, we cannot handle RAID0 or RAID10 case like this +* because we don't have a proper zone_capacity value. But, +* reading from this block group won't work anyway by a missing +* stripe. +*/ + cache->alloc_offset = cache->zone_capacity; + ret =0 ; + } + out:/* Reject non SINGLE data profiles without RST */ if ((map->type & BTRFS_BLOCK_GROUP_DATA) &&
Greg Kroah-Hartman
maintainerPATCH 85/375 drm/xe/gsc: Do not attempt to load the GSC multiple times
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Ceraolo Spurio <[email protected]>
commit 529bf8d1118bbaa1aa835563a22b0b5c64ca9d68 upstream.
The GSC HW is only reset by driver FLR or D3cold entry. We don't support the former at runtime, while the latter is only supported on DGFX, for which we don't support GSC. Therefore, if GSC failed to load previously there is no need to try again because the HW is stuck in the error state.
An assert has been added so that if we ever add DGFX support we'll know we need to handle the D3 case.
v2: use "< 0" instead of "!= 0" in the FW state error check (Julia).
--- drivers/gpu/drm/xe/xe_gsc.c | 12 ++++++++++++ drivers/gpu/drm/xe/xe_uc_fw.h | 9 +++++++-- 2 files changed, 19 insertions(+), 2 deletions(-)
drivers/gpu/drm/xe/xe_gsc.c +12 -0
@@ -511,10 +511,22 @@ out_bo:void xe_gsc_load_start (struct xe_gsc *gsc) {struct xe_gt *gt =gsc_to_gt (gsc); +struct xe_device *xe =gt_to_xe (gt);if (!xe_uc_fw_is_loadable (&gsc->fw) || !gsc->q)return ; +/* +* The GSC HW is only reset by driver FLR or D3cold entry. We don't +* support the former at runtime, while the latter is only supported on +* DGFX, for which we don't support GSC. Therefore, if GSC failed to +* load previously there is no need to try again because the HW is +* stuck in the error state. +*/ +xe_assert (xe, !IS_DGFX (xe)); +if (xe_uc_fw_is_in_error_state (&gsc->fw)) +return ; +/* GSC FW survives GT reset and D3Hot */ if (gsc_fw_is_loaded (gt)) {xe_uc_fw_change_status (&gsc->fw,XE_UC_FIRMWARE_TRANSFERRED );
drivers/gpu/drm/xe/xe_uc_fw.h +7 -2
@@ -65,7 +65,7 @@ const char *xe_uc_fw_status_repr(enum xereturn "<invalid>" ; } -static inline int xe_uc_fw_status_to_error (enum xe_uc_fw_status status) +static inline int xe_uc_fw_status_to_error (const enum xe_uc_fw_status status) {switch (status) {case XE_UC_FIRMWARE_NOT_SUPPORTED :
@@ -108,7 +108,7 @@ static inline const char *xe_uc_fw_type_ }static inline enum xe_uc_fw_status -__xe_uc_fw_status (struct xe_uc_fw *uc_fw) +__xe_uc_fw_status (const struct xe_uc_fw *uc_fw) {/* shouldn't call this before checking hw/blob availability */ XE_WARN_ON (uc_fw->status ==XE_UC_FIRMWARE_UNINITIALIZED );
@@ -156,6 +156,11 @@ static inline bool xe_uc_fw_is_overriddereturn uc_fw->user_overridden; } +static inline bool xe_uc_fw_is_in_error_state (const struct xe_uc_fw *uc_fw) +{ +return xe_uc_fw_status_to_error (__xe_uc_fw_status (uc_fw)) <0 ; +} +static inline void xe_uc_fw_sanitize (struct xe_uc_fw *uc_fw) {if (xe_uc_fw_is_loaded (uc_fw))
Greg Kroah-Hartman
maintainerPATCH 86/375 drm/panthor: flush FW AS caches in slow reset path
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrián Larumbe <[email protected]>
commit 7de295d1a1a1b84e57b348e8bfd0fab5aab3ce69 upstream.
In the off-chance that waiting for the firmware to signal its booted status timed out in the fast reset path, one must flush the cache lines for the entire FW VM address space before reloading the regions, otherwise stale values eventually lead to a scheduler job timeout.
--- drivers/gpu/drm/panthor/panthor_fw.c | 8 +++++++- drivers/gpu/drm/panthor/panthor_mmu.c | 21 ++++++++++++++++++--- drivers/gpu/drm/panthor/panthor_mmu.h | 1 + 3 files changed, 26 insertions(+), 4 deletions(-)
drivers/gpu/drm/panthor/panthor_fw.c +7 -1
@@ -1089,6 +1089,12 @@ int panthor_fw_post_reset(struct panthor_device *ptdev)panthor_fw_stop (ptdev); ptdev->fw->fast_reset = false;drm_err (&ptdev->base,"FW fast reset failed, trying a slow reset" ); + + ret =panthor_vm_flush_all (ptdev->fw->vm); +if (ret) { +drm_err (&ptdev->base,"FW slow reset failed (couldn't flush FW's AS l2cache)" ); +return ret; + } }/* Reload all sections, including RO ones. We're not supposed
@@ -1099,7 +1105,7 @@ int panthor_fw_post_reset(struct panthor_device *ptdev) ret =panthor_fw_start (ptdev);if (ret) { -drm_err (&ptdev->base,"FW slow reset failed" ); +drm_err (&ptdev->base,"FW slow reset failed (couldn't start the FW )" );return ret; }
drivers/gpu/drm/panthor/panthor_mmu.c +18 -3
@@ -576,6 +576,12 @@ static int mmu_hw_do_operation_locked(struct panthor_device *ptdev, int as_nr,if (as_nr <0 )return 0 ; +/* +* If the AS number is greater than zero, then we can be sure +* the device is up and running, so we don't need to explicitly +* power it up +*/ +if (op !=AS_COMMAND_UNLOCK )lock_region (ptdev, as_nr, iova, size);
@@ -874,14 +880,23 @@ static int panthor_vm_flush_range(struct panthor_vm *vm, u64 iova, u64 size)if (!drm_dev_enter (&ptdev->base, &cookie))return 0 ; -/* Flush the PTs only if we're already awake */ -if (pm_runtime_active (ptdev->base.dev)) - ret =mmu_hw_do_operation (vm, iova, size,AS_COMMAND_FLUSH_PT ); + ret =mmu_hw_do_operation (vm, iova, size,AS_COMMAND_FLUSH_PT );drm_dev_exit (cookie);return ret; } +/** +* panthor_vm_flush_all() - Flush L2 caches for the entirety of a VM's AS +* @vm: VM whose cache to flush +* +* Return: 0 on success, a negative error code if flush failed. +*/ +int panthor_vm_flush_all (struct panthor_vm *vm) +{ +return panthor_vm_flush_range (vm, vm->base.mm_start, vm->base.mm_range); +} +static int panthor_vm_unmap_pages (struct panthor_vm *vm,u64 iova,u64 size) {struct panthor_device *ptdev = vm->ptdev;
drivers/gpu/drm/panthor/panthor_mmu.h +1 -0
@@ -31,6 +31,7 @@ panthor_vm_get_bo_for_va(struct panthor_vm *vm, u64 va, u64 *bo_offset);int panthor_vm_active (struct panthor_vm *vm);void panthor_vm_idle (struct panthor_vm *vm);int panthor_vm_as (struct panthor_vm *vm); +int panthor_vm_flush_all (struct panthor_vm *vm);struct panthor_heap_pool *panthor_vm_get_heap_pool (struct panthor_vm *vm,bool create);
Signature · 1 line
2.46.0
Greg Kroah-Hartman
maintainerPATCH 87/375 drm/panthor: Restrict high priorities on group_create
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mary Guillemard <[email protected]>
commit 5f7762042f8a5377bd8a32844db353c0311a7369 upstream.
We were allowing any users to create a high priority group without any permission checks. As a result, this was allowing possible denial of service.
We now only allow the DRM master or users with the CAP_SYS_NICE capability to set higher priorities than PANTHOR_GROUP_PRIORITY_MEDIUM.
As the sole user of that uAPI lives in Mesa and hardcode a value of MEDIUM [1], this should be safe to do.
Additionally, as those checks are performed at the ioctl level, panthor_group_create now only check for priority level validity.
--- drivers/gpu/drm/panthor/panthor_drv.c | 23 +++++++++++++++++++++++ drivers/gpu/drm/panthor/panthor_sched.c | 2 +- include/uapi/drm/panthor_drm.h | 6 +++++- 3 files changed, 29 insertions(+), 2 deletions(-)
drivers/gpu/drm/panthor/panthor_drv.c +23 -0
@@ -10,6 +10,7 @@#include <linux/platform_device.h> #include <linux/pm_runtime.h> +#include <drm/drm_auth.h> #include <drm/drm_debugfs.h> #include <drm/drm_drv.h> #include <drm/drm_exec.h>
@@ -996,6 +997,24 @@ static int panthor_ioctl_group_destroy(struct drm_device *ddev, void *data,return panthor_group_destroy (pfile, args->group_handle); } +static int group_priority_permit (struct drm_file *file, +u8 priority) +{ +/* Ensure that priority is valid */ +if (priority >PANTHOR_GROUP_PRIORITY_HIGH ) +return -EINVAL ; + +/* Medium priority and below are always allowed */ +if (priority <=PANTHOR_GROUP_PRIORITY_MEDIUM ) +return 0 ; + +/* Higher priorities require CAP_SYS_NICE or DRM_MASTER */ +if (capable (CAP_SYS_NICE ) ||drm_is_current_master (file)) +return 0 ; + +return -EACCES ; +} +static int panthor_ioctl_group_create (struct drm_device *ddev,void *data,struct drm_file *file) {
@@ -1011,6 +1030,10 @@ static int panthor_ioctl_group_create(struct drm_device *ddev, void *data,if (ret)return ret; + ret =group_priority_permit (file, args->priority); +if (ret) +return ret; + ret =panthor_group_create (pfile, args, queue_args);if (ret >=0 ) { args->group_handle = ret;
drivers/gpu/drm/panthor/panthor_sched.c +1 -1
@@ -3092,7 +3092,7 @@ int panthor_group_create(struct panthor_file *pfile,if (group_args->pad)return -EINVAL ; -if (group_args->priority >PANTHOR_CSG_PRIORITY_HIGH ) +if (group_args->priority >=PANTHOR_CSG_PRIORITY_COUNT )return -EINVAL ; if ((group_args->compute_core_mask & ~ptdev->gpu_info.shader_present) ||
include/uapi/drm/panthor_drm.h +5 -1
@@ -692,7 +692,11 @@ enum drm_panthor_group_priority {/** @PANTHOR_GROUP_PRIORITY_MEDIUM: Medium priority group. */ PANTHOR_GROUP_PRIORITY_MEDIUM , -/** @PANTHOR_GROUP_PRIORITY_HIGH: High priority group. */ +/** +* @PANTHOR_GROUP_PRIORITY_HIGH: High priority group. +* +* Requires CAP_SYS_NICE or DRM_MASTER. +*/ PANTHOR_GROUP_PRIORITY_HIGH, };
Signature · 1 line
2.46.0
Greg Kroah-Hartman
maintainerPATCH 88/375 drm/imagination: Free pvr_vm_gpuva after unlink
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Coster <[email protected]>
commit 3f6b2f60b4631cd0c368da6a1587ab55a696164d upstream.
This caused a measurable memory leak. Although the individual allocations are small, the leaks occurs in a high-usage codepath (remapping or unmapping device memory) so they add up quickly.
--- drivers/gpu/drm/imagination/pvr_vm.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/imagination/pvr_vm.c +4 -0
@@ -114,6 +114,8 @@ struct pvr_vm_gpuva {struct drm_gpuva base; }; +#define to_pvr_vm_gpuva (va) container_of_const(va, struct pvr_vm_gpuva, base) +enum pvr_vm_bind_type {PVR_VM_BIND_TYPE_MAP ,PVR_VM_BIND_TYPE_UNMAP ,
@@ -386,6 +388,7 @@ pvr_vm_gpuva_unmap(struct drm_gpuva_op *op, void *op_ctx)drm_gpuva_unmap (&op->unmap);drm_gpuva_unlink (op->unmap.va); +kfree (to_pvr_vm_gpuva (op->unmap.va));return 0 ; }
@@ -433,6 +436,7 @@ pvr_vm_gpuva_remap(struct drm_gpuva_op *op, void *op_ctx) }drm_gpuva_unlink (op->remap.unmap->va); +kfree (to_pvr_vm_gpuva (op->remap.unmap->va));return 0 ; }
Signature · 1 line
2.46.0
Greg Kroah-Hartman
maintainerPATCH 89/375 drm/amdgpu: always allocate cleared VRAM for GEM allocations
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 4de34b04783628f14614badb0a1aa67ce3fcef5d upstream.
This adds allocation latency, but aligns better with user expectations. The latency should improve with the drm buddy clearing patches that Arun has been working on.
In addition this fixes the high CPU spikes seen when doing wipe on release.
v2: always set AMDGPU_GEM_CREATE_VRAM_CLEARED (Christian)
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c +3 -0
@@ -347,6 +347,9 @@ int amdgpu_gem_create_ioctl(struct drm_dreturn -EINVAL ; } +/* always clear VRAM */ + flags |=AMDGPU_GEM_CREATE_VRAM_CLEARED ; +/* create a gem object to contain this object in */ if (args->in.domains & (AMDGPU_GEM_DOMAIN_GDS |AMDGPU_GEM_DOMAIN_GWS |AMDGPU_GEM_DOMAIN_OA )) {
Greg Kroah-Hartman
maintainerPATCH 90/375 drm/i915: Do not attempt to load the GSC multiple times
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Ceraolo Spurio <[email protected]>
commit 59d3cfdd7f9655a0400ac453bf92199204f8b2a1 upstream.
If the GSC FW fails to load the GSC HW hangs permanently; the only ways to recover it are FLR or D3cold entry, with the former only being supported on driver unload and the latter only on DGFX, for which we don't need to load the GSC. Therefore, if GSC fails to load there is no need to try again because the HW is stuck in the error state and the submission to load the FW would just hang the GSCCS.
Note that, due to wa_14015076503, on MTL the GuC escalates all GSCCS hangs to full GT resets, which would trigger a new attempt to load the GSC FW in the post-reset HW re-init; this issue is also fixed by not attempting to load the GSC FW after an error.
--- drivers/gpu/drm/i915/gt/uc/intel_gsc_uc.c | 2 +- drivers/gpu/drm/i915/gt/uc/intel_uc_fw.h | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/gt/uc/intel_gsc_uc.c +1 -1
@@ -302,7 +302,7 @@ void intel_gsc_uc_load_start(struct inte {struct intel_gt *gt =gsc_uc_to_gt (gsc); -if (!intel_uc_fw_is_loadable (&gsc->fw)) +if (!intel_uc_fw_is_loadable (&gsc->fw) ||intel_uc_fw_is_in_error (&gsc->fw))return ;if (intel_gsc_uc_fw_init_done (gsc))
drivers/gpu/drm/i915/gt/uc/intel_uc_fw.h +5 -0
@@ -258,6 +258,11 @@ static inline bool intel_uc_fw_is_runninreturn __intel_uc_fw_status (uc_fw) ==INTEL_UC_FIRMWARE_RUNNING ; } +static inline bool intel_uc_fw_is_in_error (struct intel_uc_fw *uc_fw) +{ +return intel_uc_fw_status_to_error (__intel_uc_fw_status (uc_fw)) !=0 ; +} +static inline bool intel_uc_fw_is_overridden (const struct intel_uc_fw *uc_fw) {return uc_fw->user_overridden;
Greg Kroah-Hartman
maintainerPATCH 91/375 drm/amd/display: Lock DC and exit IPS when changing backlight
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Li <[email protected]>
commit 53c3685f5307967a62517ace10e69d66520d0fc5 upstream.
Backlight updates require aux and/or register access. Therefore, driver needs to disallow IPS beforehand.
So, acquire the dc lock before calling into dc to update backlight - we should be doing this regardless of IPS. Then, while the lock is held, disallow IPS before calling into dc, then allow IPS afterwards (if it was previously allowed).
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +12 -1
@@ -4237,7 +4237,7 @@ static void amdgpu_dm_backlight_set_levestruct amdgpu_dm_backlight_caps caps;struct dc_link *link;u32 brightness; -bool rc; +bool rc, reallow_idle = false;amdgpu_dm_update_backlight_caps (dm, bl_idx); caps = dm->backlight_caps[bl_idx];
@@ -4250,6 +4250,12 @@ static void amdgpu_dm_backlight_set_leve link = (struct dc_link *)dm->backlight_link[bl_idx];/* Change brightness based on AUX property */ +mutex_lock (&dm->dc_lock); +if (dm->dc->caps.ips_support && dm->dc->ctx->dmub_srv->idle_allowed) { +dc_allow_idle_optimizations (dm->dc, false); + reallow_idle = true; + } +if (caps.aux_support) { rc =dc_link_set_backlight_level_nits (link, true, brightness,AUX_BL_DEFAULT_TRANSITION_TIME_MS );
@@ -4261,6 +4267,11 @@ static void amdgpu_dm_backlight_set_leveDRM_DEBUG ("DM: Failed to update backlight on eDP[%d]\n" , bl_idx); } +if (dm->dc->caps.ips_support && reallow_idle) +dc_allow_idle_optimizations (dm->dc, true); + +mutex_unlock (&dm->dc_lock); +if (rc) dm->actual_brightness[bl_idx] = user_brightness; }
Greg Kroah-Hartman
maintainerPATCH 92/375 ALSA: hda/realtek: extend quirks for Clevo V5[46]0
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Marczykowski-Górecki <[email protected]>
commit 562755501d44cfbbe82703a62cb41502bd067bd1 upstream.
The mic in those laptops suffers too high gain resulting in mostly (fan or else) noise being recorded. In addition to the existing fixup about mic detection, apply also limiting its boost. While at it, extend the quirk to also V5[46]0TNE models, which have the same issue.
--- sound/pci/hda/patch_realtek.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +9 -1
@@ -7526,6 +7526,7 @@ enum {ALC256_FIXUP_CHROME_BOOK ,ALC287_FIXUP_LENOVO_14ARP8_LEGION_IAH7 ,ALC287_FIXUP_LENOVO_SSID_17AA3820 , + ALC245_FIXUP_CLEVO_NOISY_MIC, };/* A special fixup for Lenovo C940 and Yoga Duet 7;
@@ -9857,6 +9858,12 @@ static const struct hda_fixup alc269_fix .type = HDA_FIXUP_FUNC, .v.func = alc287_fixup_lenovo_ssid_17aa3820, }, + [ALC245_FIXUP_CLEVO_NOISY_MIC] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc269_fixup_limit_int_mic_boost, + .chained = true, + .chain_id = ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE, + }, }; static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -10496,7 +10503,8 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1558 ,0xa600 ,"Clevo NL50NU" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0xa650 ,"Clevo NP[567]0SN[CD]" ,ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0xa671 ,"Clevo NP70SN[CDE]" ,ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE ), -SND_PCI_QUIRK (0x1558 ,0xa763 ,"Clevo V54x_6x_TU" ,ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0x1558 ,0xa741 ,"Clevo V54x_6x_TNE" ,ALC245_FIXUP_CLEVO_NOISY_MIC ), +SND_PCI_QUIRK (0x1558 ,0xa763 ,"Clevo V54x_6x_TU" ,ALC245_FIXUP_CLEVO_NOISY_MIC ),SND_PCI_QUIRK (0x1558 ,0xb018 ,"Clevo NP50D[BE]" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0xb019 ,"Clevo NH77D[BE]Q" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ), SND_PCI_QUIRK(0x1558, 0xb022, "Clevo NH77D[DC][QW]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
Greg Kroah-Hartman
maintainerPATCH 93/375 ALSA: control: Apply sanity check of input values for user elements
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 50ed081284fe2bfd1f25e8b92f4f6a4990e73c0a ]
Although we have already a mechanism for sanity checks of input values for control writes, it's not applied unless the kconfig CONFIG_SND_CTL_INPUT_VALIDATION is set due to the performance reason. Nevertheless, it still makes sense to apply the same check for user elements despite of its cost, as that's the only way to filter out the invalid values; the user controls are handled solely in ALSA core code, and there is no corresponding driver, after all.
This patch adds the same input value validation for user control elements at its put callback. The kselftest will be happier with this change, as the incorrect values will be bailed out now with errors.
For other normal controls, the check is applied still only when CONFIG_SND_CTL_INPUT_VALIDATION is set.
--- sound/core/control.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
sound/core/control.c +5 -1
@@ -1480,12 +1480,16 @@ static int snd_ctl_elem_user_get(struct snd_kcontrol *kcontrol,static int snd_ctl_elem_user_put (struct snd_kcontrol *kcontrol,struct snd_ctl_elem_value *ucontrol) { -int change; +int err, change;struct user_element *ue = kcontrol->private_data;unsigned int size = ue->elem_data_size;char *dst = ue->elem_data +snd_ctl_get_ioff (kcontrol, &ucontrol->id) * size; + err =sanity_check_input_values (ue->card, ucontrol, &ue->info, false); +if (err <0 ) +return err; + change =memcmp (&ucontrol->value, dst, size) !=0 ;if (change)memcpy (dst, &ucontrol->value, size);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/375 ALSA: hda: Add input value sanity checks to HDMI channel map controls
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 6278056e42d953e207e2afd416be39d09ed2d496 ]
Add a simple sanity check to HD-audio HDMI Channel Map controls. Although the value might not be accepted for the actual connection, we can filter out some bogus values beforehand, and that should be enough for making kselftest happier.
--- sound/hda/hdmi_chmap.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
sound/hda/hdmi_chmap.c +18 -0
@@ -753,6 +753,20 @@ static int hdmi_chmap_ctl_get(struct snd_kcontrol *kcontrol,return 0 ; } +/* a simple sanity check for input values to chmap kcontrol */ +static int chmap_value_check (struct hdac_chmap *hchmap, +const struct snd_ctl_elem_value *ucontrol) +{ +int i; + +for (i =0 ; i < hchmap->channels_max; i++) { +if (ucontrol->value.integer.value[i] <0 || + ucontrol->value.integer.value[i] >SNDRV_CHMAP_LAST ) +return -EINVAL ; + } +return 0 ; +} +static int hdmi_chmap_ctl_put (struct snd_kcontrol *kcontrol,struct snd_ctl_elem_value *ucontrol) {
@@ -764,6 +778,10 @@ static int hdmi_chmap_ctl_put(struct snd_kcontrol *kcontrol,unsigned char chmap[8 ], per_pin_chmap[8 ];int i, err, ca, prepared =0 ; + err =chmap_value_check (hchmap, ucontrol); +if (err <0 ) +return err; +/* No monitor is connected in dyn_pcm_assign. * It's invalid to setup the chmap */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/375 wifi: ath12k: fix uninitialize symbol error on ath12k_peer_assoc_h_he()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaradhana Sahu <[email protected]>
[ Upstream commit 19b77e7c656a3e125319cc3ef347b397cf042bf6 ]
Smatch throws following errors
drivers/net/wireless/ath/ath12k/mac.c:1922 ath12k_peer_assoc_h_he() error: uninitialized symbol 'rx_mcs_80'. drivers/net/wireless/ath/ath12k/mac.c:1922 ath12k_peer_assoc_h_he() error: uninitialized symbol 'rx_mcs_160'. drivers/net/wireless/ath/ath12k/mac.c:1924 ath12k_peer_assoc_h_he() error: uninitialized symbol 'rx_mcs_80'.
In ath12k_peer_assoc_h_he() rx_mcs_80 and rx_mcs_160 variables remain uninitialized in the following conditions:
1. Whenever the value of mcs_80 become equal to IEEE80211_HE_MCS_NOT_SUPPORTED then rx_mcs_80 remains uninitialized.
2. Whenever phy capability is not supported 160 channel width and value of mcs_160 become equal to IEEE80211_HE_MCS_NOT_SUPPORTED then rx_mcs_160 remains uninitialized.
Initialize these variables during declaration.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00188-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath12k/mac.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath12k/mac.c +3 -1
@@ -1881,7 +1881,9 @@ static void ath12k_peer_assoc_h_he(struct ath12k *ar, {const struct ieee80211_sta_he_cap *he_cap = &sta->deflink.he_cap;int i; -u8 ampdu_factor, rx_mcs_80, rx_mcs_160, max_nss; +u8 ampdu_factor, max_nss; +u8 rx_mcs_80 =IEEE80211_HE_MCS_NOT_SUPPORTED ; +u8 rx_mcs_160 =IEEE80211_HE_MCS_NOT_SUPPORTED ;u16 mcs_160_map, mcs_80_map;bool support_160;u16 v;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/375 wifi: ath12k: fix firmware crash due to invalid peer nss
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ajith C <[email protected]>
[ Upstream commit db163a463bb93cd3e37e1e7b10b9726fb6f95857 ]
Currently, if the access point receives an association request containing an Extended HE Capabilities Information Element with an invalid MCS-NSS, it triggers a firmware crash.
This issue arises when EHT-PHY capabilities shows support for a bandwidth and MCS-NSS set for that particular bandwidth is filled by zeros and due to this, driver obtains peer_nss as 0 and sending this value to firmware causes crash.
Address this issue by implementing a validation step for the peer_nss value before passing it to the firmware. If the value is greater than zero, proceed with forwarding it to the firmware. However, if the value is invalid, reject the association request to prevent potential firmware crashes.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath12k/mac.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/wireless/ath/ath12k/mac.c +5 -0
@@ -3847,6 +3847,11 @@ static int ath12k_station_assoc(struct ath12k *ar,ath12k_peer_assoc_prepare (ar, vif, sta, &peer_arg, reassoc); +if (peer_arg.peer_nss <1 ) { +ath12k_warn (ar->ab, +"invalid peer NSS %d\n" , peer_arg.peer_nss); +return -EINVAL ; + } ret =ath12k_wmi_send_peer_assoc_cmd (ar, &peer_arg);if (ret) { ath12k_warn(ar->ab, "failed to run peer assoc for STA %pM vdev %i: %d\n",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/375 smack: unix sockets: fix accept()ed socket label
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Andreev <[email protected]>
[ Upstream commit e86cac0acdb1a74f608bacefe702f2034133a047 ]
When a process accept()s connection from a unix socket (either stream or seqpacket)
it gets the socket with the label of the connecting process.
For example, if a connecting process has a label 'foo', the accept()ed socket will also have 'in' and 'out' labels 'foo', regardless of the label of the listener process.
This is because kernel creates unix child sockets
in the context of the connecting process.
I do not see any obvious way for the listener to abuse alien labels coming with the new socket, but,
to be on the safe side, it's better fix new socket labels.
--- security/smack/smack_lsm.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
security/smack/smack_lsm.c +9 -3
@@ -3871,12 +3871,18 @@ static int smack_unix_stream_connect(struct sock *sock, } } -/* -* Cross reference the peer labels for SO_PEERSEC. -*/ if (rc ==0 ) { +/* +* Cross reference the peer labels for SO_PEERSEC. +*/ nsp->smk_packet = ssp->smk_out; ssp->smk_packet = osp->smk_out; + +/* +* new/child/established socket must inherit listening socket labels +*/ + nsp->smk_out = osp->smk_out; + nsp->smk_in = osp->smk_in; }return rc;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/375 drm/amd/display: Check UnboundedRequestEnableds value
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit a7b38c7852093385d0605aa3c8a2efd6edd1edfd ]
CalculateSwathAndDETConfiguration_params_st's UnboundedRequestEnabled is a pointer (i.e. dml_bool_t *UnboundedRequestEnabled), and thus if (p->UnboundedRequestEnabled) checks its address, not bool value.
This fixes 1 REVERSE_INULL issue reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c +1 -1
@@ -4282,7 +4282,7 @@ static void CalculateSwathAndDETConfiguration(struct display_mode_lib_scratch_st } *p->compbuf_reserved_space_64b =2 * p->PixelChunkSizeInKByte *1024 /64 ; -if (p->UnboundedRequestEnabled) { +if (*p->UnboundedRequestEnabled) { *p->compbuf_reserved_space_64b =dml_max (*p->compbuf_reserved_space_64b, (dml_float_t)(p->ROBBufferSizeInKByte *1024 /64 ) - (dml_float_t)(RoundedUpSwathSizeBytesY[SurfaceDoingUnboundedRequest] *TTUFIFODEPTH /MAXIMUMCOMPRESSION /64 ));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/375 cgroup/cpuset: Delay setting of CS_CPU_EXCLUSIVE until valid partition
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Waiman Long <[email protected]>
[ Upstream commit fe8cd2736e75c8ca3aed1ef181a834e41dc5310f ]
The CS_CPU_EXCLUSIVE flag is currently set whenever cpuset.cpus.exclusive is set to make sure that the exclusivity test will be run to ensure its exclusiveness. At the same time, this flag can be changed whenever the partition root state is changed. For example, the CS_CPU_EXCLUSIVE flag will be reset whenever a partition root becomes invalid. This makes using CS_CPU_EXCLUSIVE to ensure exclusiveness a bit fragile.
The current scheme also makes setting up a cpuset.cpus.exclusive hierarchy to enable remote partition harder as cpuset.cpus.exclusive cannot overlap with any cpuset.cpus of sibling cpusets if their cpuset.cpus.exclusive aren't set.
Solve these issues by deferring the setting of CS_CPU_EXCLUSIVE flag until the cpuset become a valid partition root while adding new checks in validate_change() to ensure that cpuset.cpus.exclusive of sibling cpusets cannot overlap.
An additional check is also added to validate_change() to make sure that cpuset.cpus of one cpuset cannot be a subset of cpuset.cpus.exclusive of a sibling cpuset to avoid the problem that none of those CPUs will be available when these exclusive CPUs are extracted out to a newly enabled partition root. The Documentation/admin-guide/cgroup-v2.rst file is updated to document the new constraints.
--- Documentation/admin-guide/cgroup-v2.rst | 8 ++++-- kernel/cgroup/cpuset.c | 36 ++++++++++++++++++++----- 2 files changed, 35 insertions(+), 9 deletions(-)
Documentation/admin-guide/cgroup-v2.rst +6 -2
@@ -2346,8 +2346,12 @@ Cpuset Interface Files is always a subset of it. Users can manually set it to a value that is different from - "cpuset.cpus". The only constraint in setting it is that the - list of CPUs must be exclusive with respect to its sibling. + "cpuset.cpus". One constraint in setting it is that the list of + CPUs must be exclusive with respect to "cpuset.cpus.exclusive" + of its sibling. If "cpuset.cpus.exclusive" of a sibling cgroup + isn't set, its "cpuset.cpus" value, if set, cannot be a subset + of it to leave at least one CPU available when the exclusive + CPUs are taken away. For a parent cgroup, any one of its exclusive CPUs can only be distributed to at most one of its child cgroups. Having an
kernel/cgroup/cpuset.c +29 -7
@@ -826,17 +826,41 @@ static int validate_change(struct cpuset *cur, struct cpuset *trial)/* * If either I or some sibling (!= me) is exclusive, we can't -* overlap +* overlap. exclusive_cpus cannot overlap with each other if set. */ ret = -EINVAL ;cpuset_for_each_child (c, css, par) { -if ((is_cpu_exclusive (trial) ||is_cpu_exclusive (c)) && - c != cur) { +bool txset, cxset;/* Are exclusive_cpus set? */ + +if (c == cur) +continue ; + + txset = !cpumask_empty (trial->exclusive_cpus); + cxset = !cpumask_empty (c->exclusive_cpus); +if (is_cpu_exclusive (trial) ||is_cpu_exclusive (c) || + (txset && cxset)) {if (!cpusets_are_exclusive (trial, c)) goto out; + }else if (txset || cxset) { +struct cpumask *xcpus, *acpus; + +/* +* When just one of the exclusive_cpus's is set, +* cpus_allowed of the other cpuset, if set, cannot be +* a subset of it or none of those CPUs will be +* available if these exclusive CPUs are activated. +*/ +if (txset) { + xcpus = trial->exclusive_cpus; + acpus = c->cpus_allowed; + }else { + xcpus = c->exclusive_cpus; + acpus = trial->cpus_allowed; + } +if (!cpumask_empty (acpus) &&cpumask_subset (acpus, xcpus)) + goto out; }if ((is_mem_exclusive (trial) ||is_mem_exclusive (c)) && - c != cur &&nodes_intersects (trial->mems_allowed, c->mems_allowed)) goto out; }
@@ -1376,7 +1400,7 @@ static void update_sibling_cpumasks(struct cpuset *parent, struct cpuset *cs,*/ static int update_partition_exclusive (struct cpuset *cs,int new_prs) { -bool exclusive = (new_prs >0 ); +bool exclusive = (new_prs >PRS_MEMBER );if (exclusive && !is_cpu_exclusive (cs)) {if (update_flag (CS_CPU_EXCLUSIVE , cs,1 ))
@@ -2624,8 +2648,6 @@ static int update_exclusive_cpumask(struct cpuset *cs, struct cpuset *trialcs, retval =cpulist_parse (buf, trialcs->exclusive_cpus);if (retval <0 )return retval; -if (!is_cpu_exclusive (cs)) -set_bit (CS_CPU_EXCLUSIVE , &trialcs->flags); }/* Nothing to do if the CPUs didn't change */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/375 virt: sev-guest: Mark driver struct with __refdata to prevent section mismatch
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 3991b04d4870fd334b77b859a8642ca7fb592603 ]
As described in the added code comment, a reference to .exit.text is ok for drivers registered via module_platform_driver_probe(). Make this explicit to prevent the following section mismatch warning:
WARNING: modpost: drivers/virt/coco/sev-guest/sev-guest: section mismatch in reference: \
sev_guest_driver+0x10 (section: .data) -> sev_guest_remove (section: .exit.text)that triggers on an allmodconfig W=1 build.
--- drivers/virt/coco/sev-guest/sev-guest.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/virt/coco/sev-guest/sev-guest.c +6 -1
@@ -1009,8 +1009,13 @@ static void __exit sev_guest_remove(struct platform_device *pdev)* This driver is meant to be a common SEV guest interface driver and to * support any SEV guest API. As such, even though it has been introduced * with the SEV-SNP support, it is named "sev-guest". +* +* sev_guest_remove() lives in .exit.text. For drivers registered via +* module_platform_driver_probe() this is ok because they cannot get unbound +* at runtime. So mark the driver struct with __refdata to prevent modpost +* triggering a section mismatch warning. */ -static struct platform_driver sev_guest_driver = { +static struct platform_driver sev_guest_driver__refdata = { .remove_new =__exit_p (sev_guest_remove), .driver = { .name ="sev-guest" ,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/375 bpf, verifier: Correct tail_call_reachable for bpf prog
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Hwang <[email protected]>
[ Upstream commit 01793ed86b5d7df1e956520b5474940743eb7ed8 ]
It's confusing to inspect 'prog->aux->tail_call_reachable' with drgn[0], when bpf prog has tail call but 'tail_call_reachable' is false.
This patch corrects 'tail_call_reachable' when bpf prog has tail call.
--- kernel/bpf/verifier.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/bpf/verifier.c +3 -1
@@ -2982,8 +2982,10 @@ static int check_subprogs(struct bpf_verifier_env *env)if (code == (BPF_JMP |BPF_CALL ) && insn[i].src_reg ==0 && - insn[i].imm == BPF_FUNC_tail_call) + insn[i].imm == BPF_FUNC_tail_call) { subprog[cur_subprog].has_tail_call = true; + subprog[cur_subprog].tail_call_reachable = true; + }if (BPF_CLASS (code) ==BPF_LD && (BPF_MODE (code) ==BPF_ABS ||BPF_MODE (code) ==BPF_IND )) subprog[cur_subprog].has_ld_abs = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/375 ELF: fix kernel.randomize_va_space double read
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Dobriyan <[email protected]>
[ Upstream commit 2a97388a807b6ab5538aa8f8537b2463c6988bd2 ]
ELF loader uses "randomize_va_space" twice. It is sysctl and can change at any moment, so 2 loads could see 2 different values in theory with unpredictable consequences.
Issue exactly one load for consistent value across one exec.
--- fs/binfmt_elf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/binfmt_elf.c +3 -2
@@ -1003,7 +1003,8 @@ static int load_elf_binary(struct linux_binprm *bprm)if (elf_read_implies_exec (*elf_ex, executable_stack)) current->personality |=READ_IMPLIES_EXEC ; -if (!(current->personality &ADDR_NO_RANDOMIZE ) && randomize_va_space) +const int snapshot_randomize_va_space =READ_ONCE (randomize_va_space); +if (!(current->personality &ADDR_NO_RANDOMIZE ) && snapshot_randomize_va_space) current->flags |=PF_RANDOMIZE ;setup_new_exec (bprm);
@@ -1251,7 +1252,7 @@ static int load_elf_binary(struct linux_binprm *bprm) mm->end_data = end_data; mm->start_stack = bprm->p; -if ((current->flags &PF_RANDOMIZE ) && (randomize_va_space >1 )) { +if ((current->flags &PF_RANDOMIZE ) && (snapshot_randomize_va_space >1 )) {/* * For architectures with ELF randomization, when executing * a loader directly (i.e. no interpreter listed in ELF
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/375 accel/habanalabs/gaudi2: unsecure edma max outstanding register
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rakesh Ughreja <[email protected]>
[ Upstream commit 3309887c6ff8ca2ac05a74e1ee5d1c44829f63f2 ]
Netowrk EDMAs uses more outstanding transfers so this needs to be programmed by EDMA firmware.
--- drivers/accel/habanalabs/gaudi2/gaudi2_security.c | 1 + 1 file changed, 1 insertion(+)
drivers/accel/habanalabs/gaudi2/gaudi2_security.c +1 -0
@@ -479,6 +479,7 @@ static const u32 gaudi2_pb_dcr0_edma0_unsecured_regs[] = { mmDCORE0_EDMA0_CORE_CTX_TE_NUMROWS, mmDCORE0_EDMA0_CORE_CTX_IDX, mmDCORE0_EDMA0_CORE_CTX_IDX_INC, + mmDCORE0_EDMA0_CORE_WR_COMP_MAX_OUTSTAND, mmDCORE0_EDMA0_CORE_RD_LBW_RATE_LIM_CFG, mmDCORE0_EDMA0_QM_CQ_CFG0_0, mmDCORE0_EDMA0_QM_CQ_CFG0_1,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/375 irqchip/renesas-rzg2l: Reorder function calls in rzg2l_irqc_irq_disable()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <[email protected]>
[ Upstream commit 492eee82574b163fbb3f099c74ce3b4322d0af28 ]
The order of function calls in the disable operation should be the reverse of that in the enable operation. Thus, reorder the function calls to first disable the parent IRQ chip before disabling the TINT IRQ.
--- drivers/irqchip/irq-renesas-rzg2l.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/irqchip/irq-renesas-rzg2l.c +1 -1
@@ -162,8 +162,8 @@ static void rzg2l_tint_irq_endisable(struct irq_data *d, bool enable)static void rzg2l_irqc_irq_disable (struct irq_data *d) { -rzg2l_tint_irq_endisable (d, false);irq_chip_disable_parent (d); +rzg2l_tint_irq_endisable (d, false); }static void rzg2l_irqc_irq_enable (struct irq_data *d)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/375 irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pali Rohár <[email protected]>
[ Upstream commit 3cef738208e5c3cb7084e208caf9bbf684f24feb ]
IRQs 0 (IPI) and 1 (MSI) are handled internally by this driver, generic_handle_domain_irq() is never called for these IRQs.
Disallow mapping these IRQs.
[ Marek: changed commit message ]
--- drivers/irqchip/irq-armada-370-xp.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/irqchip/irq-armada-370-xp.c +4 -0
@@ -566,6 +566,10 @@ static struct irq_chip armada_370_xp_irq_chip = {static int armada_370_xp_mpic_irq_map (struct irq_domain *h,unsigned int virq,irq_hw_number_t hw) { +/* IRQs 0 and 1 cannot be mapped, they are handled internally */ +if (hw <=1 ) +return -EINVAL ; +armada_370_xp_irq_mask (irq_get_irq_data (virq));if (!is_percpu_irq (hw)) writel(hw, per_cpu_int_base +
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/375 media: b2c2: flexcop-usb: fix flexcop_usb_memory_req
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit b178aa6f333b07bda0548d7e45085660a112414d ]
smatch generated this warning:
drivers/media/usb/b2c2/flexcop-usb.c:199 flexcop_usb_memory_req() warn: iterator 'i' not incremented
and indeed the function is not using i or updating buf.
The reason this always worked is that this function is called to write just 6 bytes (a MAC address) to the USB device, and so in practice there is only a single chunk written. If we ever would need to write more than one chunk, this function would fail since each chunk would read from or write to the same buf address.
Rewrite the function to properly handle this.
--- drivers/media/usb/b2c2/flexcop-usb.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/media/usb/b2c2/flexcop-usb.c +4 -3
@@ -179,7 +179,7 @@ static int flexcop_usb_memory_req(struct flexcop_usb *fc_usb, flexcop_usb_request_t req, flexcop_usb_mem_page_t page_start, u32 addr, int extended, u8 *buf, u32 len) { - int i, ret = 0; + int ret = 0;u16 wMax;u32 pagechunk =0 ;
@@ -196,7 +196,7 @@ static int flexcop_usb_memory_req(struct flexcop_usb *fc_usb,default :return -EINVAL ; } -for (i =0 ; i < len;) { +while (len) { pagechunk =min (wMax,bytes_left_to_read_on_page (addr, len)); deb_info("%x\n", (addr & V8_MEMORY_PAGE_MASK) |
@@ -206,11 +206,12 @@ static int flexcop_usb_memory_req(struct flexcop_usb *fc_usb, page_start + (addr /V8_MEMORY_PAGE_SIZE ), (addr &V8_MEMORY_PAGE_MASK ) | (V8_MEMORY_EXTENDED *extended), - &buf[i], pagechunk); + buf, pagechunk);if (ret <0 )return ret; addr += pagechunk; + buf += pagechunk; len -= pagechunk; }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/375 af_unix: Remove put_pid()/put_cred() in copy_peercred().
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit e4bd881d987121dbf1a288641491955a53d9f8f7 ]
When (AF_UNIX, SOCK_STREAM) socket connect()s to a listening socket, the listener's sk_peer_pid/sk_peer_cred are copied to the client in copy_peercred().
Then, the client's sk_peer_pid and sk_peer_cred are always NULL, so we need not call put_pid() and put_cred() there.
--- net/unix/af_unix.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
net/unix/af_unix.c +1 -8
@@ -692,9 +692,6 @@ static void init_peercred(struct sock *sk)static void copy_peercred (struct sock *sk,struct sock *peersk) { -const struct cred *old_cred; -struct pid *old_pid; -if (sk < peersk) {spin_lock (&sk->sk_peer_lock);spin_lock_nested (&peersk->sk_peer_lock,SINGLE_DEPTH_NESTING );
@@ -702,16 +699,12 @@ static void copy_peercred(struct sock *sk, struct sock *peersk)spin_lock (&peersk->sk_peer_lock);spin_lock_nested (&sk->sk_peer_lock,SINGLE_DEPTH_NESTING ); } - old_pid = sk->sk_peer_pid; - old_cred = sk->sk_peer_cred; + sk->sk_peer_pid =get_pid (peersk->sk_peer_pid); sk->sk_peer_cred =get_cred (peersk->sk_peer_cred);spin_unlock (&sk->sk_peer_lock);spin_unlock (&peersk->sk_peer_lock); - -put_pid (old_pid); -put_cred (old_cred); }static int unix_listen (struct socket *sock,int backlog)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/375 x86/kmsan: Fix hook for unaligned accesses
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Johannesmeyer <[email protected]>
[ Upstream commit bf6ab33d8487f5e2a0998ce75286eae65bb0a6d6 ]
When called with a 'from' that is not 4-byte-aligned, string_memcpy_fromio() calls the movs() macro to copy the first few bytes, so that 'from' becomes 4-byte-aligned before calling rep_movs(). This movs() macro modifies 'to', and the subsequent line modifies 'n'.
As a result, on unaligned accesses, kmsan_unpoison_memory() uses the updated (aligned) values of 'to' and 'n'. Hence, it does not unpoison the entire region.
Save the original values of 'to' and 'n', and pass those to kmsan_unpoison_memory(), so that the entire region is unpoisoned.
--- arch/x86/lib/iomem.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/x86/lib/iomem.c +4 -1
@@ -25,6 +25,9 @@ static __always_inline void rep_movs(void *to, const void *from, size_t n)static void string_memcpy_fromio (void *to,const volatile void __iomem *from,size_t n) { +const void *orig_to = to; +const size_t orig_n = n; +if (unlikely (!n))return ;
@@ -39,7 +42,7 @@ static void string_memcpy_fromio(void *to, const volatile void __iomem *from, si }rep_movs (to, (const void *)from, n);/* KMSAN must treat values read from devices as initialized. */ -kmsan_unpoison_memory (to, n); +kmsan_unpoison_memory (orig_to, orig_n); }static void string_memcpy_toio (volatile void __iomem *to,const void *from,size_t n)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/375 iommu: sun50i: clear bypass register
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jernej Skrabec <[email protected]>
[ Upstream commit 927c70c93d929f4c2dcaf72f51b31bb7d118a51a ]
The Allwinner H6 IOMMU has a bypass register, which allows to circumvent the page tables for each possible master. The reset value for this register is 0, which disables the bypass.
The Allwinner H616 IOMMU resets this register to 0x7f, which activates the bypass for all masters, which is not what we want.
Always clear this register to 0, to enforce the usage of page tables, and make this driver compatible with the H616 in this respect.
--- drivers/iommu/sun50i-iommu.c | 1 + 1 file changed, 1 insertion(+)
drivers/iommu/sun50i-iommu.c +1 -0
@@ -452,6 +452,7 @@ static int sun50i_iommu_enable(struct sun50i_iommu *iommu)IOMMU_TLB_PREFETCH_MASTER_ENABLE (3 ) |IOMMU_TLB_PREFETCH_MASTER_ENABLE (4 ) | IOMMU_TLB_PREFETCH_MASTER_ENABLE(5)); +iommu_write (iommu,IOMMU_BYPASS_REG ,0 );iommu_write (iommu,IOMMU_INT_ENABLE_REG ,IOMMU_INT_MASK ); iommu_write(iommu, IOMMU_DM_AUT_CTRL_REG(SUN50I_IOMMU_ACI_NONE), IOMMU_DM_AUT_CTRL_RD_UNAVAIL(SUN50I_IOMMU_ACI_NONE, 0) |
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/375 netfilter: nf_conncount: fix wrong variable type
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunjian Wang <[email protected]>
[ Upstream commit 0b88d1654d556264bcd24a9cb6383f0888e30131 ]
Now there is a issue is that code checks reports a warning: implicit narrowing conversion from type 'unsigned int' to small type 'u8' (the 'keylen' variable). Fix it by removing the 'keylen' variable.
--- net/netfilter/nf_conncount.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
net/netfilter/nf_conncount.c +3 -5
@@ -321,7 +321,6 @@ insert_tree(struct net *net,struct nf_conncount_rb *rbconn;struct nf_conncount_tuple *conn;unsigned int count =0 , gc_count =0 ; -u8 keylen = data->keylen;bool do_gc = true;spin_lock_bh (&nf_conncount_locks[hash]);
@@ -333,7 +332,7 @@ insert_tree(struct net *net, rbconn = rb_entry(*rbnode, struct nf_conncount_rb, node); parent = *rbnode; - diff =key_diff (key, rbconn->key, keylen); + diff =key_diff (key, rbconn->key, data->keylen);if (diff <0 ) { rbnode = &((*rbnode)->rb_left); }else if (diff >0 ) {
@@ -378,7 +377,7 @@ insert_tree(struct net *net, conn->tuple = *tuple; conn->zone = *zone; -memcpy (rbconn->key, key,sizeof (u32) * keylen); +memcpy (rbconn->key, key,sizeof (u32) * data->keylen);nf_conncount_list_init (&rbconn->list);list_add (&conn->node, &rbconn->list.head);
@@ -403,7 +402,6 @@ count_tree(struct net *net,struct rb_node *parent;struct nf_conncount_rb *rbconn;unsigned int hash; -u8 keylen = data->keylen; hash =jhash2 (key, data->keylen, conncount_rnd) %CONNCOUNT_SLOTS ; root = &data->root[hash];
@@ -414,7 +412,7 @@ count_tree(struct net *net, rbconn = rb_entry(parent, struct nf_conncount_rb, node); - diff =key_diff (key, rbconn->key, keylen); + diff =key_diff (key, rbconn->key, data->keylen);if (diff <0 ) { parent =rcu_dereference_raw (parent->rb_left); }else if (diff >0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/375 gve: Add adminq mutex lock
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziwei Xiao <[email protected]>
[ Upstream commit 1108566ca509e67aa8abfbf914b1cd31e9ff51f8 ]
We were depending on the rtnl_lock to make sure there is only one adminq command running at a time. But some commands may take too long to hold the rtnl_lock, such as the upcoming flow steering operations. For such situations, it can temporarily drop the rtnl_lock, and replace it for these operations with a new adminq lock, which can ensure the adminq command execution to be thread-safe.
--- drivers/net/ethernet/google/gve/gve.h | 1 + drivers/net/ethernet/google/gve/gve_adminq.c | 22 +++++++++++--------- 2 files changed, 13 insertions(+), 10 deletions(-)
drivers/net/ethernet/google/gve/gve.h +1 -0
@@ -724,6 +724,7 @@ struct gve_priv {union gve_adminq_command *adminq;dma_addr_t adminq_bus_addr;struct dma_pool *adminq_pool; +struct mutex adminq_lock;/* Protects adminq command execution */ u32 adminq_mask;/* masks prod_cnt to adminq size */ u32 adminq_prod_cnt;/* free-running count of AQ cmds executed */ u32 adminq_cmd_fail;/* free-running count of AQ cmds failed */
drivers/net/ethernet/google/gve/gve_adminq.c +12 -10
@@ -284,6 +284,7 @@ int gve_adminq_alloc(struct device *dev, struct gve_priv *priv) &priv->reg_bar0->adminq_base_address_lo);iowrite32be (GVE_DRIVER_STATUS_RUN_MASK , &priv->reg_bar0->driver_status); } +mutex_init (&priv->adminq_lock);gve_set_admin_queue_ok (priv);return 0 ; }
@@ -511,28 +512,29 @@ static int gve_adminq_issue_cmd(struct gve_priv *priv,return 0 ; } -/* This function is not threadsafe - the caller is responsible for any -* necessary locks. -* The caller is also responsible for making sure there are no commands -* waiting to be executed. -*/ static int gve_adminq_execute_cmd (struct gve_priv *priv,union gve_adminq_command *cmd_orig) {u32 tail, head;int err; +mutex_lock (&priv->adminq_lock); tail =ioread32be (&priv->reg_bar0->adminq_event_counter); head = priv->adminq_prod_cnt; -if (tail != head) -// This is not a valid path -return -EINVAL ; +if (tail != head) { + err = -EINVAL ; + goto out; + } err =gve_adminq_issue_cmd (priv, cmd_orig);if (err) -return err; + goto out; -return gve_adminq_kick_and_wait (priv); + err =gve_adminq_kick_and_wait (priv); + +out: +mutex_unlock (&priv->adminq_lock); +return err; }/* The device specifies that the management vector can either be the first irq
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/375 wifi: iwlwifi: mvm: use IWL_FW_CHECK for link ID check
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 9215152677d4b321801a92b06f6d5248b2b4465f ]
The lookup function iwl_mvm_rcu_fw_link_id_to_link_conf() is normally called with input from the firmware, so it should use IWL_FW_CHECK() instead of WARN_ON().
--- drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +2 -1
@@ -1442,7 +1442,8 @@ iwl_mvm_rcu_dereference_vif_id(struct iwl_mvm *mvm, u8 vif_id, bool rcu)static inline struct ieee80211_bss_conf *iwl_mvm_rcu_fw_link_id_to_link_conf (struct iwl_mvm *mvm,u8 link_id,bool rcu) { -if (WARN_ON (link_id >=ARRAY_SIZE (mvm->link_id_to_link_conf))) +if (IWL_FW_CHECK (mvm, link_id >=ARRAY_SIZE (mvm->link_id_to_link_conf), +"erroneous FW link ID: %d\n" , link_id))return NULL ;if (rcu)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/375 udf: Avoid excessive partition lengths
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit ebbe26fd54a9621994bc16b14f2ba8f84c089693 ]
Avoid mounting filesystems where the partition would overflow the 32-bits used for block number. Also refuse to mount filesystems where the partition length is so large we cannot safely index bits in a block bitmap.
--- fs/udf/super.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
fs/udf/super.c +15 -0
@@ -1111,12 +1111,19 @@ static int udf_fill_partdesc_info(struct super_block *sb,struct udf_part_map *map;struct udf_sb_info *sbi =UDF_SB (sb);struct partitionHeaderDesc *phd; +u32 sum;int err; map = &sbi->s_partmaps[p_index]; map->s_partition_len =le32_to_cpu (p->partitionLength);/* blocks */ map->s_partition_root =le32_to_cpu (p->partitionStartingLocation); +if (check_add_overflow (map->s_partition_root, map->s_partition_len, + &sum)) { +udf_err (sb,"Partition %d has invalid location %u + %u\n" , + p_index, map->s_partition_root, map->s_partition_len); +return -EFSCORRUPTED ; + }if (p->accessType ==cpu_to_le32 (PD_ACCESS_TYPE_READ_ONLY )) map->s_partition_flags |=UDF_PART_FLAG_READ_ONLY ;
@@ -1172,6 +1179,14 @@ static int udf_fill_partdesc_info(struct super_block *sb, bitmap->s_extPosition =le32_to_cpu ( phd->unallocSpaceBitmap.extPosition); map->s_partition_flags |=UDF_PART_FLAG_UNALLOC_BITMAP ; +/* Check whether math over bitmap won't overflow. */ +if (check_add_overflow (map->s_partition_len, +sizeof (struct spaceBitmapDesc ) <<3 , + &sum)) { +udf_err (sb,"Partition %d is too long (%u)\n" , p_index, + map->s_partition_len); +return -EFSCORRUPTED ; + }udf_debug ("unallocSpaceBitmap (part %d) @ %u\n" , p_index, bitmap->s_extPosition); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/375 fs/ntfs3: One more reason to mark inode bad
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit a0dde5d7a58b6bf9184ef3d8c6e62275c3645584 ]
In addition to returning an error, mark the node as bad.
--- fs/ntfs3/frecord.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/ntfs3/frecord.c +3 -1
@@ -1601,8 +1601,10 @@ int ni_delete_all(struct ntfs_inode *ni) asize =le32_to_cpu (attr->size); roff =le16_to_cpu (attr->nres.run_off); -if (roff > asize) +if (roff > asize) { +_ntfs_bad_inode (&ni->vfs_inode);return -EINVAL ; + }/* run==1 means unpack and deallocate. */ run_unpack_ex(RUN_DEALLOCATE, sbi, ni->mi.rno, svcn, evcn, svcn,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/375 riscv: kprobes: Use patch_text_nosync() for insn slots
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Holland <[email protected]>
[ Upstream commit b1756750a397f36ddc857989d31887c3f5081fb0 ]
These instructions are not yet visible to the rest of the system, so there is no need to do the whole stop_machine() dance.
--- arch/riscv/kernel/probes/kprobes.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
arch/riscv/kernel/probes/kprobes.c +2 -3
@@ -29,9 +29,8 @@ static void __kprobes arch_prepare_ss_slot(struct kprobe *p) p->ainsn.api.restore = (unsigned long )p->addr + offset; -patch_text (p->ainsn.api.insn, &p->opcode,1 ); -patch_text ((void *)((unsigned long )(p->ainsn.api.insn) + offset), - &insn,1 ); +patch_text_nosync (p->ainsn.api.insn, &p->opcode,1 ); +patch_text_nosync (p->ainsn.api.insn + offset, &insn,1 ); }static void __kprobes arch_prepare_simulate (struct kprobe *p)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/375 media: vivid: fix wrong sizeimage value for mplane
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit 0fd7c0c2c156270dceb8c15fad3120cdce03e539 ]
In several places a division by fmt->vdownsampling[p] was missing in the sizeimage[p] calculation, causing incorrect behavior for multiplanar formats were some planes are smaller than the first plane.
Found by new v4l2-compliance tests.
--- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 5 +++-- drivers/media/test-drivers/vivid/vivid-vid-out.c | 16 +++++++++------- 2 files changed, 12 insertions(+), 9 deletions(-)
drivers/media/test-drivers/vivid/vivid-vid-cap.c +3 -2
@@ -106,8 +106,9 @@ static int vid_cap_queue_setup(struct vb2_queue *vq,if (*nplanes != buffers)return -EINVAL ;for (p =0 ; p < buffers; p++) { -if (sizes[p] <tpg_g_line_width (&dev->tpg, p) * h + - dev->fmt_cap->data_offset[p]) +if (sizes[p] <tpg_g_line_width (&dev->tpg, p) * h / + dev->fmt_cap->vdownsampling[p] + + dev->fmt_cap->data_offset[p])return -EINVAL ; } }else {
drivers/media/test-drivers/vivid/vivid-vid-out.c +9 -7
@@ -63,14 +63,16 @@ static int vid_out_queue_setup(struct vb2_queue *vq,if (sizes[0 ] < size)return -EINVAL ;for (p =1 ; p < planes; p++) { -if (sizes[p] < dev->bytesperline_out[p] * h + - vfmt->data_offset[p]) +if (sizes[p] < dev->bytesperline_out[p] * h / + vfmt->vdownsampling[p] + + vfmt->data_offset[p])return -EINVAL ; } }else {for (p =0 ; p < planes; p++) - sizes[p] = p ? dev->bytesperline_out[p] * h + - vfmt->data_offset[p] : size; + sizes[p] = p ? dev->bytesperline_out[p] * h / + vfmt->vdownsampling[p] + + vfmt->data_offset[p] : size; } *nplanes = planes;
@@ -124,7 +126,7 @@ static int vid_out_buf_prepare(struct vb2_buffer *vb)for (p =0 ; p < planes; p++) {if (p) - size = dev->bytesperline_out[p] * h; + size = dev->bytesperline_out[p] * h / vfmt->vdownsampling[p]; size += vb->planes[p].data_offset;if (vb2_get_plane_payload (vb, p) < size) {
@@ -331,8 +333,8 @@ int vivid_g_fmt_vid_out(struct file *file, void *priv,for (p =0 ; p < mp->num_planes; p++) { mp->plane_fmt[p].bytesperline = dev->bytesperline_out[p]; mp->plane_fmt[p].sizeimage = - mp->plane_fmt[p].bytesperline * mp->height + - fmt->data_offset[p]; + mp->plane_fmt[p].bytesperline * mp->height / + fmt->vdownsampling[p] + fmt->data_offset[p]; }for (p = fmt->buffers; p < fmt->planes; p++) {unsigned stride = dev->bytesperline_out[p];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/375 leds: spi-byte: Call of_node_put() on error path
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 7f9ab862e05c5bc755f65bf6db7edcffb3b49dfc ]
Add a missing call to of_node_put(np) on error.
--- drivers/leds/leds-spi-byte.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/leds/leds-spi-byte.c +5 -1
@@ -91,7 +91,6 @@ static int spi_byte_probe(struct spi_device *spi)dev_err (dev,"Device must have exactly one LED sub-node." );return -EINVAL ; } - child =of_get_next_available_child (dev_of_node (dev),NULL ); led =devm_kzalloc (dev,sizeof (*led),GFP_KERNEL );if (!led)
@@ -104,11 +103,13 @@ static int spi_byte_probe(struct spi_device *spi) led->ldev.max_brightness = led->cdef->max_value - led->cdef->off_value; led->ldev.brightness_set_blocking = spi_byte_brightness_set_blocking; + child =of_get_next_available_child (dev_of_node (dev),NULL ); state =of_get_property (child,"default-state" ,NULL );if (state) {if (!strcmp (state,"on" )) { led->ldev.brightness = led->ldev.max_brightness; }else if (strcmp (state,"off" )) { +of_node_put (child);/* all other cases except "off" */ dev_err (dev,"default-state can only be 'on' or 'off'" );return -EINVAL ;
@@ -123,9 +124,12 @@ static int spi_byte_probe(struct spi_device *spi) ret =devm_led_classdev_register_ext (&spi->dev, &led->ldev, &init_data);if (ret) { +of_node_put (child);mutex_destroy (&led->mutex);return ret; } + +of_node_put (child);spi_set_drvdata (spi, led);return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/375 wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arend van Spriel <[email protected]>
[ Upstream commit dbb5265a5d7cca1cdba7736dba313ab7d07bc19d ]
After being asked about support for WPA3 for BCM43224 chipset it was found that all it takes is setting the MFP_CAPABLE flag and mac80211 will take care of all that is needed [1].
--- drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c +1 -0
@@ -1090,6 +1090,7 @@ static int ieee_hw_init(struct ieee80211_hw *hw)ieee80211_hw_set (hw,AMPDU_AGGREGATION );ieee80211_hw_set (hw,SIGNAL_DBM );ieee80211_hw_set (hw,REPORTS_TX_ACK_STATUS ); +ieee80211_hw_set (hw,MFP_CAPABLE ); hw->extra_tx_headroom =brcms_c_get_header_len (); hw->queues =N_TX_QUEUES ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/375 wifi: rtw89: wow: prevent to send unexpected H2C during download Firmware
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chih-Kang Chang <[email protected]>
[ Upstream commit 60757f28408bcc63c4c0676b2a69a38adce30fc7 ]
While downloading Firmware in the resume flow, it is possible to receive beacon and send H2C to Firmware. However, if Firmware receives unexpected H2C during the download process, it will fail. Therefore, we prevent to send unexpected H2C during download Firmware in WoWLAN mode.
--- drivers/net/wireless/realtek/rtw89/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtw89/core.c +2 -1
@@ -1917,7 +1917,8 @@ static void rtw89_vif_rx_stats_iter(void *data, u8 *mac,return ;if (ieee80211_is_beacon (hdr->frame_control)) { -if (vif->type ==NL80211_IFTYPE_STATION ) { +if (vif->type ==NL80211_IFTYPE_STATION && + !test_bit (RTW89_FLAG_WOWLAN , rtwdev->flags)) {rtw89_vif_sync_bcn_tsf (rtwvif, hdr, skb->len);rtw89_fw_h2c_rssi_offload (rtwdev, phy_ppdu); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/375 usb: uas: set host status byte on data completion error
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shantanu Goel <[email protected]>
[ Upstream commit 9d32685a251a754f1823d287df233716aa23bcb9 ]
Set the host status byte when a data completion error is encountered otherwise the upper layer may end up using the invalid zero'ed data. The following output was observed from scsi/sd.c prior to this fix.
[ 11.872824] sd 0:0:0:1: [sdf] tag#9 data cmplt err -75 uas-tag 1 inflight: [ 11.872826] sd 0:0:0:1: [sdf] tag#9 CDB: Read capacity(16) 9e 10 00 00 00 00 00 00 00 00 00 00 00 20 00 00 [ 11.872830] sd 0:0:0:1: [sdf] Sector size 0 reported, assuming 512.
--- drivers/usb/storage/uas.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/storage/uas.c +1 -0
@@ -423,6 +423,7 @@ static void uas_data_cmplt(struct urb *urb)uas_log_cmd_state (cmnd,"data cmplt err" , status);/* error: no data transfered */ scsi_set_resid (cmnd, sdb->length); +set_host_byte (cmnd,DID_ERROR ); }else {scsi_set_resid (cmnd, sdb->length - urb->actual_length); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/375 usb: gadget: aspeed_udc: validate endpoint index for ast udc
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit ee0d382feb44ec0f445e2ad63786cd7f3f6a8199 ]
We should verify the bound of the array to assure that host may not manipulate the index to point past endpoint array.
Found by static analysis.
--- drivers/usb/gadget/udc/aspeed_udc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/gadget/udc/aspeed_udc.c +2 -0
@@ -1009,6 +1009,8 @@ static void ast_udc_getstatus(struct ast_udc_dev *udc)break ;case USB_RECIP_ENDPOINT : epnum = crq.wIndex &USB_ENDPOINT_NUMBER_MASK ; +if (epnum >=AST_UDC_NUM_ENDPOINTS ) + goto stall; status = udc->ep[epnum].stopped;break ;default :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/375 drm/amdgpu: Fix register access violation
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hawking Zhang <[email protected]>
[ Upstream commit 9da0f7736763aa0fbf63bb15060c6827135f3f67 ]
fault_status is read only register. fault_cntl is not accessible from guest environment.
--- drivers/gpu/drm/amd/amdgpu/gfxhub_v1_2.c | 8 +++++--- drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 3 ++- drivers/gpu/drm/amd/amdgpu/mmhub_v1_8.c | 8 +++++--- 3 files changed, 12 insertions(+), 7 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfxhub_v1_2.c +5 -3
@@ -627,9 +627,11 @@ static bool gfxhub_v1_2_query_utcl2_poison_status(struct amdgpu_device *adev, status =RREG32_SOC15 (GC ,GET_INST (GC , xcc_id), regVM_L2_PROTECTION_FAULT_STATUS); fed =REG_GET_FIELD (status,VM_L2_PROTECTION_FAULT_STATUS ,FED ); -/* reset page fault status */ -WREG32_P (SOC15_REG_OFFSET (GC ,GET_INST (GC , xcc_id), - regVM_L2_PROTECTION_FAULT_STATUS),1 , ~1 ); +if (!amdgpu_sriov_vf (adev)) { +/* clear page fault status and address */ +WREG32_P (SOC15_REG_OFFSET (GC ,GET_INST (GC , xcc_id), + regVM_L2_PROTECTION_FAULT_CNTL),1 , ~1 ); + }return fed; }
drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c +2 -1
@@ -671,7 +671,8 @@ static int gmc_v9_0_process_interrupt(struct amdgpu_device *adev, (amdgpu_ip_version(adev, GC_HWIP, 0) >= IP_VERSION(9, 4, 2)))return 0 ; -WREG32_P (hub->vm_l2_pro_fault_cntl,1 , ~1 ); +if (!amdgpu_sriov_vf (adev)) +WREG32_P (hub->vm_l2_pro_fault_cntl,1 , ~1 );amdgpu_vm_update_fault_cache (adev, entry->pasid, addr, status, vmhub);
drivers/gpu/drm/amd/amdgpu/mmhub_v1_8.c +5 -3
@@ -566,9 +566,11 @@ static bool mmhub_v1_8_query_utcl2_poison_status(struct amdgpu_device *adev, status =RREG32_SOC15 (MMHUB , hub_inst, regVM_L2_PROTECTION_FAULT_STATUS); fed =REG_GET_FIELD (status,VM_L2_PROTECTION_FAULT_STATUS ,FED ); -/* reset page fault status */ -WREG32_P (SOC15_REG_OFFSET (MMHUB , hub_inst, - regVM_L2_PROTECTION_FAULT_STATUS),1 , ~1 ); +if (!amdgpu_sriov_vf (adev)) { +/* clear page fault status and address */ +WREG32_P (SOC15_REG_OFFSET (MMHUB , hub_inst, + regVM_L2_PROTECTION_FAULT_STATUS),1 , ~1 ); + }return fed; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/375 drm/amd/display: Run DC_LOG_DC after checking link->link_enc
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 3a82f62b0d9d7687eac47603bb6cd14a50fa718b ]
[WHAT]
The DC_LOG_DC should be run after link->link_enc is checked, not before.
This fixes 1 REVERSE_INULL issue reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/link/link_factory.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/display/dc/link/link_factory.c +3 -3
@@ -611,14 +611,14 @@ static bool construct_phy(struct dc_link *link, link->link_enc = link->dc->res_pool->funcs->link_enc_create (dc_ctx, &enc_init_data); -DC_LOG_DC ("BIOS object table - DP_IS_USB_C: %d" , link->link_enc->features.flags.bits.DP_IS_USB_C); -DC_LOG_DC ("BIOS object table - IS_DP2_CAPABLE: %d" , link->link_enc->features.flags.bits.IS_DP2_CAPABLE); -if (!link->link_enc) {DC_ERROR ("Failed to create link encoder!\n" ); goto link_enc_create_fail; } +DC_LOG_DC ("BIOS object table - DP_IS_USB_C: %d" , link->link_enc->features.flags.bits.DP_IS_USB_C); +DC_LOG_DC ("BIOS object table - IS_DP2_CAPABLE: %d" , link->link_enc->features.flags.bits.IS_DP2_CAPABLE); +/* Update link encoder tracking variables. These are used for the dynamic * assignment of link encoders to streams. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/375 drm/amd/display: Check HDCP returned status
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 5d93060d430b359e16e7c555c8f151ead1ac614b ]
[WHAT & HOW]
Check mod_hdcp_execute_and_set() return values in authenticated_dp.
This fixes 3 CHECKED_RETURN issues reported by Coverity.
--- .../amd/display/modules/hdcp/hdcp1_execution.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c +9 -6
@@ -433,17 +433,20 @@ static enum mod_hdcp_status authenticated_dp(struct mod_hdcp *hdcp, }if (status ==MOD_HDCP_STATUS_SUCCESS ) -mod_hdcp_execute_and_set (mod_hdcp_read_bstatus, +if (!mod_hdcp_execute_and_set (mod_hdcp_read_bstatus, &input->bstatus_read, &status, - hdcp,"bstatus_read" ); + hdcp,"bstatus_read" )) + goto out;if (status ==MOD_HDCP_STATUS_SUCCESS ) -mod_hdcp_execute_and_set (check_link_integrity_dp, +if (!mod_hdcp_execute_and_set (check_link_integrity_dp, &input->link_integrity_check, &status, - hdcp,"link_integrity_check" ); + hdcp,"link_integrity_check" )) + goto out;if (status ==MOD_HDCP_STATUS_SUCCESS ) -mod_hdcp_execute_and_set (check_no_reauthentication_request_dp, +if (!mod_hdcp_execute_and_set (check_no_reauthentication_request_dp, &input->reauth_request_check, &status, - hdcp,"reauth_request_check" ); + hdcp,"reauth_request_check" )) + goto out; out:return status; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/375 drm/amd/display: Validate function returns
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 673f816b9e1e92d1f70e1bf5f21b531e0ff9ad6c ]
[WHAT & HOW]
Function return values must be checked before data can be used in subsequent functions.
This fixes 4 CHECKED_RETURN issues reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 7 +++++-- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubbub.c | 3 ++- .../drm/amd/display/dc/link/protocols/link_dp_training.c | 3 +-- 3 files changed, 8 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c +5 -2
@@ -245,7 +245,9 @@ bool dc_dmub_srv_cmd_run_list(struct dc_dmub_srv *dc_dmub_srv, unsigned int counif (status ==DMUB_STATUS_POWER_STATE_D3 )return false; -dmub_srv_wait_for_idle (dmub,100000 ); + status =dmub_srv_wait_for_idle (dmub,100000 ); +if (status !=DMUB_STATUS_OK ) +return false;/* Requeue the command. */ status =dmub_srv_cmd_queue (dmub, &cmd_list[i]);
@@ -511,7 +513,8 @@ void dc_dmub_srv_get_visual_confirm_color_cmd(struct dc *dc, struct pipe_ctx *piunion dmub_rb_cmd cmd = {0 };unsigned int panel_inst =0 ; -dc_get_edp_link_panel_inst (dc, pipe_ctx->stream->link, &panel_inst); +if (!dc_get_edp_link_panel_inst (dc, pipe_ctx->stream->link, &panel_inst)) +return ;memset (&cmd,0 ,sizeof (cmd));
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubbub.c +2 -1
@@ -595,7 +595,8 @@ static bool hubbub2_program_watermarks( hubbub1->base.ctx->dc->clk_mgr->clks.p_state_change_support == false) safe_to_lower = true; -hubbub1_program_pstate_watermarks (hubbub, watermarks, refclk_mhz, safe_to_lower); +if (hubbub1_program_pstate_watermarks (hubbub, watermarks, refclk_mhz, safe_to_lower)) + wm_pending = true;REG_SET (DCHUBBUB_ARB_SAT_LEVEL ,0 ,DCHUBBUB_ARB_SAT_LEVEL ,60 * refclk_mhz);
drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c +1 -2
@@ -1659,8 +1659,7 @@ bool perform_link_training_with_retries(if (status ==LINK_TRAINING_ABORT ) {enum dc_connection_type type = dc_connection_none; -link_detect_connection_type (link, &type); -if (type == dc_connection_none) { +if (link_detect_connection_type (link, &type) && type == dc_connection_none) {DC_LOG_HW_LINK_TRAINING ("%s: Aborting training because sink unplugged\n" , __func__);break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/375 drm/amdgpu: add missing error handling in function amdgpu_gmc_flush_gpu_tlb_pasid
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bob Zhou <[email protected]>
[ Upstream commit 9ff2e14cf013fa887e269bdc5ea3cffacada8635 ]
Fix the unchecked return value warning reported by Coverity, so add error handling.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +5 -1
@@ -720,7 +720,11 @@ int amdgpu_gmc_flush_gpu_tlb_pasid(struct amdgpu_device *adev, uint16_t pasid, ndw += kiq->pmf->invalidate_tlbs_size;spin_lock (&adev->gfx.kiq[inst].ring_lock); -amdgpu_ring_alloc (ring, ndw); + r =amdgpu_ring_alloc (ring, ndw); +if (r) { +spin_unlock (&adev->gfx.kiq[inst].ring_lock); + goto error_unlock_reset; + }if (adev->gmc.flush_tlb_needs_extra_type_2) kiq->pmf->kiq_invalidate_tlbs (ring, pasid,2 , all_hub);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/375 drm/amdgpu: Fix smatch static checker warning
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hawking Zhang <[email protected]>
[ Upstream commit bdbdc7cecd00305dc844a361f9883d3a21022027 ]
adev->gfx.imu.funcs could be NULL
--- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +4 -4
@@ -4293,11 +4293,11 @@ static int gfx_v11_0_hw_init(void *handle)/* RLC autoload sequence 1: Program rlc ram */ if (adev->gfx.imu.funcs->program_rlc_ram) adev->gfx.imu.funcs->program_rlc_ram (adev); +/* rlc autoload firmware */ + r =gfx_v11_0_rlc_backdoor_autoload_enable (adev); +if (r) +return r; } -/* rlc autoload firmware */ - r =gfx_v11_0_rlc_backdoor_autoload_enable (adev); -if (r) -return r; }else {if (adev->firmware.load_type ==AMDGPU_FW_LOAD_DIRECT ) {if (adev->gfx.imu.funcs && (amdgpu_dpm >0 )) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/375 drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danijel Slivka <[email protected]>
[ Upstream commit afbf7955ff01e952dbdd465fa25a2ba92d00291c ]
Why:
Setting IH_RB_WPTR register to 0 will not clear the RB_OVERFLOW bit if RB_ENABLE is not set.
How to fix:
Set WPTR_OVERFLOW_CLEAR bit after RB_ENABLE bit is set. The RB_ENABLE bit is required to be set, together with WPTR_OVERFLOW_ENABLE bit so that setting WPTR_OVERFLOW_CLEAR bit would clear the RB_OVERFLOW.
--- drivers/gpu/drm/amd/amdgpu/ih_v6_0.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
drivers/gpu/drm/amd/amdgpu/ih_v6_0.c +28 -0
@@ -135,6 +135,34 @@ static int ih_v6_0_toggle_ring_interrupts(struct amdgpu_device *adev, tmp =RREG32 (ih_regs->ih_rb_cntl); tmp =REG_SET_FIELD (tmp,IH_RB_CNTL ,RB_ENABLE , (enable ?1 :0 )); + +if (enable) { +/* Unset the CLEAR_OVERFLOW bit to make sure the next step +* is switching the bit from 0 to 1 +*/ + tmp =REG_SET_FIELD (tmp,IH_RB_CNTL ,WPTR_OVERFLOW_CLEAR ,0 ); +if (amdgpu_sriov_vf (adev) &&amdgpu_sriov_reg_indirect_ih (adev)) { +if (psp_reg_program (&adev->psp, ih_regs->psp_reg_id, tmp)) +return -ETIMEDOUT ; + }else { +WREG32_NO_KIQ (ih_regs->ih_rb_cntl, tmp); + } + +/* Clear RB_OVERFLOW bit */ + tmp =REG_SET_FIELD (tmp,IH_RB_CNTL ,WPTR_OVERFLOW_CLEAR ,1 ); +if (amdgpu_sriov_vf (adev) &&amdgpu_sriov_reg_indirect_ih (adev)) { +if (psp_reg_program (&adev->psp, ih_regs->psp_reg_id, tmp)) +return -ETIMEDOUT ; + }else { +WREG32_NO_KIQ (ih_regs->ih_rb_cntl, tmp); + } + +/* Unset the CLEAR_OVERFLOW bit immediately so new overflows +* can be detected. +*/ + tmp =REG_SET_FIELD (tmp,IH_RB_CNTL ,WPTR_OVERFLOW_CLEAR ,0 ); + } +/* enable_intr field is only valid in ring0 */ if (ih == &adev->irq.ih) tmp =REG_SET_FIELD (tmp,IH_RB_CNTL ,ENABLE_INTR , (enable ?1 :0 ));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/375 crypto: qat - initialize user_input.lock for rate_limiting
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiwei Sun <[email protected]>
[ Upstream commit ccacbbc3176277bbfc324f85fa827d1a2656bedf ]
If the following configurations are set,CONFIG_DEBUG_RWSEMS=yCONFIG_DEBUG_LOCK_ALLOC=yCONFIG_RWSEM_SPIN_ON_OWNER=y
And run the following command,
[root@localhost sys]# cat /sys/devices/pci0000:6b/0000:6b:00.0/qat_rl/pir The following warning log appears,
------------[ cut here ]------------ DEBUG_RWSEMS_WARN_ON(sem->magic != sem): count = 0x0, magic = 0x0, owner = 0x1, curr 0xff11000119288040, list not empty WARNING: CPU: 131 PID: 1254984 at kernel/locking/rwsem.c:1280 down_read+0x439/0x7f0 CPU: 131 PID: 1254984 Comm: cat Kdump: loaded Tainted: G W 6.10.0-rc4+ #86 b2ae60c8ceabed15f4fd2dba03c1c5a5f7f4040c Hardware name: Lenovo ThinkServer SR660 V3/SR660 V3, BIOS T8E166X-2.54 05/30/2024 RIP: 0010:down_read+0x439/0x7f0 Code: 44 24 10 80 3c 02 00 0f 85 05 03 00 00 48 8b 13 41 54 48 c7 c6 a0 3e 0e b4 48 c7 c7 e0 3e 0e b4 4c 8b 4c 24 08 e8 77 d5 40 fd <0f> 0b 59 e9 bc fc ff ff 0f 1f 44 00 00 e9 e2 fd ff ff 4c 8d 7b 08 RSP: 0018:ffa0000035f67a78 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ff1100012b03a658 RCX: 0000000000000000 RDX: 0000000080000002 RSI: 0000000000000008 RDI: 0000000000000001 RBP: 1ff4000006becf53 R08: fff3fc0006becf17 R09: fff3fc0006becf17 R10: fff3fc0006becf16 R11: ffa0000035f678b7 R12: ffffffffb40e3e60 R13: ffffffffb627d1f4 R14: ff1100012b03a6d0 R15: ff1100012b03a6c8 FS: 00007fa9ff9a6740(0000) GS:ff1100081e600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa9ff984000 CR3: 00000002118ae006 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> pir_show+0x5d/0xe0 [intel_qat 9e297e249ab040329cf58b657b06f418fd5c5855] dev_attr_show+0x3f/0xc0 sysfs_kf_seq_show+0x1ce/0x400 seq_read_iter+0x3fa/0x10b0 vfs_read+0x6f5/0xb20 ksys_read+0xe9/0x1d0 do_syscall_64+0x8a/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fa9ff6fd9b2 Code: c0 e9 b2 fe ff ff 50 48 8d 3d ea 1d 0c 00 e8 c5 fd 01 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 RSP: 002b:00007ffc0616b968 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa9ff6fd9b2 RDX: 0000000000020000 RSI: 00007fa9ff985000 RDI: 0000000000000003 RBP: 00007fa9ff985000 R08: 00007fa9ff984010 R09: 0000000000000000 R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000022000 R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000 </TASK> irq event stamp: 0 hardirqs last enabled at (0): [<0000000000000000>] 0x0 hardirqs last disabled at (0): [<ffffffffb102c126>] copy_process+0x21e6/0x6e70 softirqs last enabled at (0): [<ffffffffb102c176>] copy_process+0x2236/0x6e70 softirqs last disabled at (0): [<0000000000000000>] 0x0 ---[ end trace 0000000000000000 ]---
The rate_limiting->user_input.lock rwsem lock is not initialized before use. Let's initialize it.
--- drivers/crypto/intel/qat/qat_common/adf_rl.c | 1 + 1 file changed, 1 insertion(+)
drivers/crypto/intel/qat/qat_common/adf_rl.c +1 -0
@@ -1106,6 +1106,7 @@ int adf_rl_init(struct adf_accel_dev *accel_dev)mutex_init (&rl->rl_lock); rl->device_data = &accel_dev->hw_device->rl_data; rl->accel_dev = accel_dev; +init_rwsem (&rl->user_input.lock); accel_dev->rate_limiting = rl; err_ret:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/375 media: vivid: dont set HDMI TX controls if there are no HDMI outputs
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit 17763960b1784578e8fe915304b330922f646209 ]
When setting the EDID it would attempt to update two controls that are only present if there is an HDMI output configured.
If there isn't any (e.g. when the vivid module is loaded with node_types=1), then calling VIDIOC_S_EDID would crash.
Fix this by first checking if outputs are present.
--- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/media/test-drivers/vivid/vivid-vid-cap.c +8 -4
@@ -1554,8 +1554,10 @@ int vidioc_s_edid(struct file *file, void *_fh,return -EINVAL ;if (edid->blocks ==0 ) { dev->edid_blocks =0 ; -v4l2_ctrl_s_ctrl (dev->ctrl_tx_edid_present,0 ); -v4l2_ctrl_s_ctrl (dev->ctrl_tx_hotplug,0 ); +if (dev->num_outputs) { +v4l2_ctrl_s_ctrl (dev->ctrl_tx_edid_present,0 ); +v4l2_ctrl_s_ctrl (dev->ctrl_tx_hotplug,0 ); + } phys_addr =CEC_PHYS_ADDR_INVALID ; goto set_phys_addr; }
@@ -1579,8 +1581,10 @@ int vidioc_s_edid(struct file *file, void *_fh, display_present |= dev->display_present[i] << j++; -v4l2_ctrl_s_ctrl (dev->ctrl_tx_edid_present, display_present); -v4l2_ctrl_s_ctrl (dev->ctrl_tx_hotplug, display_present); +if (dev->num_outputs) { +v4l2_ctrl_s_ctrl (dev->ctrl_tx_edid_present, display_present); +v4l2_ctrl_s_ctrl (dev->ctrl_tx_hotplug, display_present); + } set_phys_addr:/* TODO: a proper hotplug detect cycle should be emulated here */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/375 vfio/spapr: Always clear TCEs before unsetting the window
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shivaprasad G Bhat <[email protected]>
[ Upstream commit 4ba2fdff2eb174114786784926d0efb6903c88a6 ]
The PAPR expects the TCE table to have no entries at the time of unset window(i.e. remove-pe). The TCE clear right now is done before freeing the iommu table. On pSeries, the unset window makes those entries inaccessible to the OS and the H_PUT/GET calls fail on them with H_CONSTRAINED.
On PowerNV, this has no side effect as the TCE clear can be done before the DMA window removal as well.
--- drivers/vfio/vfio_iommu_spapr_tce.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/vfio/vfio_iommu_spapr_tce.c +9 -4
@@ -364,7 +364,6 @@ static void tce_iommu_release(void *iommu_data)if (!tbl)continue ; -tce_iommu_clear (container, tbl, tbl->it_offset, tbl->it_size);tce_iommu_free_table (container, tbl); }
@@ -720,6 +719,8 @@ static long tce_iommu_remove_window(struct tce_container *container,BUG_ON (!tbl->it_size); +tce_iommu_clear (container, tbl, tbl->it_offset, tbl->it_size); +/* Detach groups from IOMMUs */ list_for_each_entry (tcegrp, &container->group_list, next) { table_group =iommu_group_get_iommudata (tcegrp->grp);
@@ -738,7 +739,6 @@ static long tce_iommu_remove_window(struct tce_container *container, }/* Free table */ -tce_iommu_clear (container, tbl, tbl->it_offset, tbl->it_size);tce_iommu_free_table (container, tbl); container->tables[num] =NULL ;
@@ -1197,9 +1197,14 @@ static void tce_iommu_release_ownership(struct tce_container *container,return ; } -for (i =0 ; i <IOMMU_TABLE_GROUP_MAX_TABLES ; ++i) -if (container->tables[i]) +for (i =0 ; i <IOMMU_TABLE_GROUP_MAX_TABLES ; ++i) { +if (container->tables[i]) { +tce_iommu_clear (container, container->tables[i], + container->tables[i]->it_offset, + container->tables[i]->it_size); table_group->ops->unset_window (table_group, i); + } + } } static long tce_iommu_take_ownership(struct tce_container *container,
Signature · 1 line
2.43.0