6.6.54-rc1 review
Subsystems (7)
Greg Kroah-Hartman
maintainerPATCH 265/538 clk: imx: imx8qxp: Register dc0_bypass0_clk before disp clk
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit e61352d5ecdc0da2e7253121c15d9a3e040f78a1 ]
The initialization order of SCU clocks affects the sequence of SCU clock resume. If there are no other effects, the earlier the initialization, the earlier the resume. During SCU clock resume, the clock rate is restored. As SCFW guidelines, configure the parent clock rate before configuring the child rate.
--- drivers/clk/imx/clk-imx8qxp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/imx/clk-imx8qxp.c +2 -2
@@ -199,11 +199,11 @@ static int imx8qxp_clk_probe(struct platform_device *pdev)imx_clk_scu ("usb3_lpm_div" ,IMX_SC_R_USB_2 ,IMX_SC_PM_CLK_MISC );/* Display controller SS */ -imx_clk_scu2 ("dc0_disp0_clk" , dc0_sels,ARRAY_SIZE (dc0_sels),IMX_SC_R_DC_0 ,IMX_SC_PM_CLK_MISC0 ); -imx_clk_scu2 ("dc0_disp1_clk" , dc0_sels,ARRAY_SIZE (dc0_sels),IMX_SC_R_DC_0 ,IMX_SC_PM_CLK_MISC1 );imx_clk_scu ("dc0_pll0_clk" ,IMX_SC_R_DC_0_PLL_0 ,IMX_SC_PM_CLK_PLL );imx_clk_scu ("dc0_pll1_clk" ,IMX_SC_R_DC_0_PLL_1 ,IMX_SC_PM_CLK_PLL );imx_clk_scu ("dc0_bypass0_clk" ,IMX_SC_R_DC_0_VIDEO0 ,IMX_SC_PM_CLK_BYPASS ); +imx_clk_scu2 ("dc0_disp0_clk" , dc0_sels,ARRAY_SIZE (dc0_sels),IMX_SC_R_DC_0 ,IMX_SC_PM_CLK_MISC0 ); +imx_clk_scu2 ("dc0_disp1_clk" , dc0_sels,ARRAY_SIZE (dc0_sels),IMX_SC_R_DC_0 ,IMX_SC_PM_CLK_MISC1 );imx_clk_scu ("dc0_bypass1_clk" ,IMX_SC_R_DC_0_VIDEO1 ,IMX_SC_PM_CLK_BYPASS );imx_clk_scu2 ("dc1_disp0_clk" , dc1_sels,ARRAY_SIZE (dc1_sels),IMX_SC_R_DC_1 ,IMX_SC_PM_CLK_MISC0 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 266/538 clk: imx: imx8qxp: Parent should be initialized earlier than the clock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit 766c386c16c9899461b83573a06380d364c6e261 ]
The initialization order of SCU clocks affects the sequence of SCU clock resume. If there are no other effects, the earlier the initialization, the earlier the resume. During SCU clock resume, the clock rate is restored. As SCFW guidelines, configure the parent clock rate before configuring the child rate.
--- drivers/clk/imx/clk-imx8qxp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/clk/imx/clk-imx8qxp.c +3 -3
@@ -165,8 +165,8 @@ static int imx8qxp_clk_probe(struct platform_device *pdev)imx_clk_scu ("pwm_clk" ,IMX_SC_R_LCD_0_PWM_0 ,IMX_SC_PM_CLK_PER );imx_clk_scu ("elcdif_pll" ,IMX_SC_R_ELCDIF_PLL ,IMX_SC_PM_CLK_PLL );imx_clk_scu2 ("lcd_clk" , lcd_sels,ARRAY_SIZE (lcd_sels),IMX_SC_R_LCD_0 ,IMX_SC_PM_CLK_PER ); -imx_clk_scu2 ("lcd_pxl_clk" , lcd_pxl_sels,ARRAY_SIZE (lcd_pxl_sels),IMX_SC_R_LCD_0 ,IMX_SC_PM_CLK_MISC0 );imx_clk_scu ("lcd_pxl_bypass_div_clk" ,IMX_SC_R_LCD_0 ,IMX_SC_PM_CLK_BYPASS ); +imx_clk_scu2 ("lcd_pxl_clk" , lcd_pxl_sels,ARRAY_SIZE (lcd_pxl_sels),IMX_SC_R_LCD_0 ,IMX_SC_PM_CLK_MISC0 );/* Audio SS */ imx_clk_scu ("audio_pll0_clk" ,IMX_SC_R_AUDIO_PLL_0 ,IMX_SC_PM_CLK_PLL );
@@ -206,11 +206,11 @@ static int imx8qxp_clk_probe(struct platform_device *pdev)imx_clk_scu2 ("dc0_disp1_clk" , dc0_sels,ARRAY_SIZE (dc0_sels),IMX_SC_R_DC_0 ,IMX_SC_PM_CLK_MISC1 );imx_clk_scu ("dc0_bypass1_clk" ,IMX_SC_R_DC_0_VIDEO1 ,IMX_SC_PM_CLK_BYPASS ); -imx_clk_scu2 ("dc1_disp0_clk" , dc1_sels,ARRAY_SIZE (dc1_sels),IMX_SC_R_DC_1 ,IMX_SC_PM_CLK_MISC0 ); -imx_clk_scu2 ("dc1_disp1_clk" , dc1_sels,ARRAY_SIZE (dc1_sels),IMX_SC_R_DC_1 ,IMX_SC_PM_CLK_MISC1 );imx_clk_scu ("dc1_pll0_clk" ,IMX_SC_R_DC_1_PLL_0 ,IMX_SC_PM_CLK_PLL );imx_clk_scu ("dc1_pll1_clk" ,IMX_SC_R_DC_1_PLL_1 ,IMX_SC_PM_CLK_PLL );imx_clk_scu ("dc1_bypass0_clk" ,IMX_SC_R_DC_1_VIDEO0 ,IMX_SC_PM_CLK_BYPASS ); +imx_clk_scu2 ("dc1_disp0_clk" , dc1_sels,ARRAY_SIZE (dc1_sels),IMX_SC_R_DC_1 ,IMX_SC_PM_CLK_MISC0 ); +imx_clk_scu2 ("dc1_disp1_clk" , dc1_sels,ARRAY_SIZE (dc1_sels),IMX_SC_R_DC_1 ,IMX_SC_PM_CLK_MISC1 );imx_clk_scu ("dc1_bypass1_clk" ,IMX_SC_R_DC_1_VIDEO1 ,IMX_SC_PM_CLK_BYPASS );/* MIPI-LVDS SS */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 267/538 remoteproc: imx_rproc: Correct ddr alias for i.MX8M
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit c901f817792822eda9cec23814a4621fa3e66695 ]
The DDR Alias address should be 0x40000000 according to RM, so correct it.
--- drivers/remoteproc/imx_rproc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/remoteproc/imx_rproc.c +1 -1
@@ -213,7 +213,7 @@ static const struct imx_rproc_att imx_rproc_att_imx8mq[] = {/* QSPI Code - alias */ { 0x08000000, 0x08000000, 0x08000000, 0 },/* DDR (Code) - alias */ - { 0x10000000, 0x80000000, 0x0FFE0000, 0 }, + { 0x10000000, 0x40000000, 0x0FFE0000, 0 },/* TCML */ { 0x1FFE0000, 0x007E0000, 0x00020000, ATT_OWN | ATT_IOMEM}, /* TCMU */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 268/538 remoteproc: imx_rproc: Initialize workqueue earlier
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit 858e57c1d3dd7b92cc0fa692ba130a0a5d57e49d ]
Initialize workqueue before requesting mailbox channel, otherwise if mailbox interrupt comes before workqueue ready, the imx_rproc_rx_callback will trigger issue.
--- drivers/remoteproc/imx_rproc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/remoteproc/imx_rproc.c +2 -2
@@ -1134,6 +1134,8 @@ static int imx_rproc_probe(struct platform_device *pdev) goto err_put_rproc; } +INIT_WORK (&priv->rproc_work, imx_rproc_vq_work); + ret =imx_rproc_xtr_mbox_init (rproc);if (ret) goto err_put_wkq;
@@ -1152,8 +1154,6 @@ static int imx_rproc_probe(struct platform_device *pdev)if (ret) goto err_put_scu; -INIT_WORK (&priv->rproc_work, imx_rproc_vq_work); -if (rproc->state !=RPROC_DETACHED ) rproc->auto_boot =of_property_read_bool (np,"fsl,auto-boot" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 269/538 clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <[email protected]>
[ Upstream commit 1d34b9757523c1ad547bd6d040381f62d74a3189 ]
Similar to DCLK_LCDC on RK3328, the DCLK_VOP on RK3228 is typically parented by the hdmiphy clk and it is expected that the DCLK_VOP and hdmiphy clk rate are kept in sync.
Use CLK_SET_RATE_PARENT and CLK_SET_RATE_NO_REPARENT flags, same as used on RK3328, to make full use of all possible supported display modes.
--- drivers/clk/rockchip/clk-rk3228.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/rockchip/clk-rk3228.c +1 -1
@@ -409,7 +409,7 @@ static struct rockchip_clk_branch rk3228_clk_branches[] __initdata = { RK2928_CLKSEL_CON(29), 0, 3, DFLAGS),DIV (0 ,"sclk_vop_pre" ,"sclk_vop_src" ,0 ,RK2928_CLKSEL_CON (27 ),8 ,8 ,DFLAGS ), -MUX (DCLK_VOP ,"dclk_vop" , mux_dclk_vop_p,0 , +MUX (DCLK_VOP ,"dclk_vop" , mux_dclk_vop_p,CLK_SET_RATE_PARENT |CLK_SET_RATE_NO_REPARENT ,RK2928_CLKSEL_CON (27 ),1 ,1 ,MFLAGS ), FACTOR(0, "xin12m", "xin24m", 0, 1, 2),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 270/538 clk: qcom: dispcc-sm8550: fix several supposed typos
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 7b6a4b907297b28727933493b9e0c95494504634 ]
Fix seveal odd-looking places in SM8550's dispcc driver:
- duplicate entries in disp_cc_parent_map_4 and disp_cc_parent_map_5
- using &disp_cc_mdss_dptx0_link_div_clk_src as a source for disp_cc_mdss_dptx1_usb_router_link_intf_clk
The SM8650 driver has been used as a reference.
--- drivers/clk/qcom/dispcc-sm8550.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/qcom/dispcc-sm8550.c +2 -2
@@ -196,7 +196,7 @@ static const struct clk_parent_data disp_cc_parent_data_3[] = {static const struct parent_map disp_cc_parent_map_4[] = { {P_BI_TCXO ,0 }, {P_DP0_PHY_PLL_LINK_CLK ,1 }, - {P_DP1_PHY_PLL_VCO_DIV_CLK ,2 }, + {P_DP0_PHY_PLL_VCO_DIV_CLK ,2 }, {P_DP3_PHY_PLL_VCO_DIV_CLK ,3 }, {P_DP1_PHY_PLL_VCO_DIV_CLK ,4 }, {P_DP2_PHY_PLL_VCO_DIV_CLK ,6 },
@@ -213,7 +213,7 @@ static const struct clk_parent_data disp_cc_parent_data_4[] = {static const struct parent_map disp_cc_parent_map_5[] = { {P_BI_TCXO ,0 }, - {P_DSI0_PHY_PLL_OUT_BYTECLK ,4 }, + {P_DSI0_PHY_PLL_OUT_BYTECLK ,2 }, {P_DSI1_PHY_PLL_OUT_BYTECLK ,4 }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 271/538 clk: qcom: dispcc-sm8550: use rcg2_ops for mdss_dptx1_aux_clk_src
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit cb4c00698f2f27d99a69adcce659370ca286cf2a ]
clk_dp_ops should only be used for DisplayPort pixel clocks. Use clk_rcg2_ops for disp_cc_mdss_dptx1_aux_clk_src.
--- drivers/clk/qcom/dispcc-sm8550.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/qcom/dispcc-sm8550.c +1 -1
@@ -400,7 +400,7 @@ static struct clk_rcg2 disp_cc_mdss_dptx1_aux_clk_src = { .parent_data = disp_cc_parent_data_0, .num_parents = ARRAY_SIZE(disp_cc_parent_data_0), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_dp_ops, + .ops = &clk_rcg2_ops, }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 272/538 clk: qcom: dispcc-sm8650: Update the GDSC flags
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 7de10ddbdb9d03651cff5fbdc8cf01837c698526 ]
Add missing POLL_CFG_GDSCR to the MDSS GDSC flags.
--- drivers/clk/qcom/dispcc-sm8550.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/qcom/dispcc-sm8550.c +2 -2
@@ -1611,7 +1611,7 @@ static struct gdsc mdss_gdsc = { .name = "mdss_gdsc", }, .pwrsts = PWRSTS_OFF_ON, - .flags = HW_CTRL | RETAIN_FF_ENABLE, + .flags = POLL_CFG_GDSCR | HW_CTRL | RETAIN_FF_ENABLE, }; static struct gdsc mdss_int2_gdsc = {
@@ -1620,7 +1620,7 @@ static struct gdsc mdss_int2_gdsc = { .name = "mdss_int2_gdsc", }, .pwrsts = PWRSTS_OFF_ON, - .flags = HW_CTRL | RETAIN_FF_ENABLE, + .flags = POLL_CFG_GDSCR | HW_CTRL | RETAIN_FF_ENABLE, }; static struct clk_regmap *disp_cc_sm8550_clocks[] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 273/538 clk: qcom: dispcc-sm8550: use rcg2_shared_ops for ESC RCGs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit c8bee3ff6c9220092b646ff929f9c832c1adab6d ]
Follow the recommendations and park disp_cc_mdss_esc[01]_clk_src to the XO instead of disabling the clocks by using the clk_rcg2_shared_ops.
--- drivers/clk/qcom/dispcc-sm8550.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/qcom/dispcc-sm8550.c +2 -2
@@ -562,7 +562,7 @@ static struct clk_rcg2 disp_cc_mdss_esc0_clk_src = { .parent_data = disp_cc_parent_data_5, .num_parents = ARRAY_SIZE(disp_cc_parent_data_5), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
@@ -577,7 +577,7 @@ static struct clk_rcg2 disp_cc_mdss_esc1_clk_src = { .parent_data = disp_cc_parent_data_5, .num_parents = ARRAY_SIZE(disp_cc_parent_data_5), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_shared_ops, }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 274/538 leds: bd2606mvv: Fix device child node usage in bd2606mvv_probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
[ Upstream commit ffbf1fcb421429916a861cfc25dfe0c6387dda75 ]
The current implementation accesses the child fwnode handle outside of fwnode_for_each_available_child_node() without incrementing its refcount. Add the missing call to fwnode_handle_get(child).
The cleanup process where child is accessed is not right either because a single call to fwnode_handle_put() is carried out in case of an error, ignoring unasigned nodes at the point when the error happens. Keep child inside of the first loop, and use the helper pointer that receives references via fwnode_handle_get() to handle the child nodes within the second loop.
Moreover, the iterated nodes are direct children of the device node, and the device_for_each_child_node() macro accounts for child node availability. By restricting child to live within that loop, the scoped version of it can be used to simplify the error handling.
fwnode_for_each_available_child_node() is meant to access the child nodes of an fwnode, and therefore not direct child nodes of the device node.
Use device_for_each_child_node_scoped() to indicate device's direct child nodes.
--- drivers/leds/leds-bd2606mvv.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-)
drivers/leds/leds-bd2606mvv.c +10 -13
@@ -69,16 +69,14 @@ static const struct regmap_config bd2606mvv_regmap = {static int bd2606mvv_probe (struct i2c_client *client) { -struct fwnode_handle *np, *child;struct device *dev = &client->dev;struct bd2606mvv_priv *priv;struct fwnode_handle *led_fwnodes[BD2606_MAX_LEDS ] = {0 };int active_pairs[BD2606_MAX_LEDS /2 ] = {0 };int err, reg; -int i; +int i, j; - np =dev_fwnode (dev); -if (!np) +if (!dev_fwnode (dev))return -ENODEV ; priv =devm_kzalloc (dev,sizeof (*priv),GFP_KERNEL );
@@ -94,20 +92,18 @@ static int bd2606mvv_probe(struct i2c_client *client)i2c_set_clientdata (client, priv); -fwnode_for_each_available_child_node (np, child) { +device_for_each_child_node_scoped (dev, child) {struct bd2606mvv_led *led; err =fwnode_property_read_u32 (child,"reg" , ®); -if (err) { -fwnode_handle_put (child); +if (err)return err; - } -if (reg <0 || reg >=BD2606_MAX_LEDS || led_fwnodes[reg]) { -fwnode_handle_put (child); + +if (reg <0 || reg >=BD2606_MAX_LEDS || led_fwnodes[reg])return -EINVAL ; - } + led = &priv->leds[reg]; - led_fwnodes[reg] = child; + led_fwnodes[reg] =fwnode_handle_get (child); active_pairs[reg /2 ]++; led->priv = priv; led->led_no = reg;
@@ -130,7 +126,8 @@ static int bd2606mvv_probe(struct i2c_client *client) &priv->leds[i].ldev, &init_data);if (err <0 ) { -fwnode_handle_put (child); +for (j = i; j <BD2606_MAX_LEDS ; j++) +fwnode_handle_put (led_fwnodes[j]);return dev_err_probe (dev, err,"couldn't register LED %s\n" , priv->leds[i].ldev.name);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 275/538 pinctrl: ti: ti-iodelay: Convert to platform remove callback returning void
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 93650550dff9d1a3b88c553f8adb81dc89778977 ]
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks.
To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove().
Trivially convert this driver from always returning zero in the remove callback to the void returning variant.
Stable-dep-of: a9f2b249adee ("pinctrl: ti: ti-iodelay: Fix some error handling paths")
--- drivers/pinctrl/ti/pinctrl-ti-iodelay.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/pinctrl/ti/pinctrl-ti-iodelay.c +2 -6
@@ -900,23 +900,19 @@ static int ti_iodelay_probe(struct platform_device *pdev)/** * ti_iodelay_remove() - standard remove * @pdev: platform device -* -* Return: 0 if all went fine, else appropriate error value. */ -static int ti_iodelay_remove (struct platform_device *pdev) +static void ti_iodelay_remove (struct platform_device *pdev) {struct ti_iodelay_device *iod =platform_get_drvdata (pdev);ti_iodelay_pinconf_deinit_dev (iod);/* Expect other allocations to be freed by devm */ - -return 0 ; }static struct platform_driver ti_iodelay_driver = { .probe = ti_iodelay_probe, - .remove = ti_iodelay_remove, + .remove_new = ti_iodelay_remove, .driver = { .name =DRIVER_NAME , .of_match_table = ti_iodelay_of_match,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 276/538 pinctrl: Use device_get_match_data()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring <[email protected]>
[ Upstream commit 63bffc2d3a99eaabc786c513eea71be3f597f175 ]
Use preferred device_get_match_data() instead of of_match_device() to get the driver match data. With this, adjust the includes to explicitly include the correct headers.
Stable-dep-of: a9f2b249adee ("pinctrl: ti: ti-iodelay: Fix some error handling paths")
--- drivers/pinctrl/bcm/pinctrl-ns.c | 8 ++------ drivers/pinctrl/berlin/berlin-bg2.c | 8 +++----- drivers/pinctrl/berlin/berlin-bg2cd.c | 8 +++----- drivers/pinctrl/berlin/berlin-bg2q.c | 8 +++----- drivers/pinctrl/berlin/berlin-bg4ct.c | 9 +++++---- drivers/pinctrl/berlin/pinctrl-as370.c | 9 +++++---- drivers/pinctrl/mvebu/pinctrl-armada-38x.c | 9 ++------- drivers/pinctrl/mvebu/pinctrl-armada-39x.c | 9 ++------- drivers/pinctrl/mvebu/pinctrl-armada-ap806.c | 5 +---- drivers/pinctrl/mvebu/pinctrl-armada-cp110.c | 6 ++---- drivers/pinctrl/mvebu/pinctrl-armada-xp.c | 9 ++------- drivers/pinctrl/mvebu/pinctrl-dove.c | 6 ++---- drivers/pinctrl/mvebu/pinctrl-kirkwood.c | 7 ++----- drivers/pinctrl/mvebu/pinctrl-orion.c | 7 ++----- drivers/pinctrl/nomadik/pinctrl-abx500.c | 9 ++------- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 10 ++++------ drivers/pinctrl/pinctrl-at91.c | 11 +++++------ drivers/pinctrl/pinctrl-xway.c | 11 ++++------- drivers/pinctrl/ti/pinctrl-ti-iodelay.c | 18 ++++++++---------- 19 files changed, 59 insertions(+), 108 deletions(-)
drivers/pinctrl/bcm/pinctrl-ns.c +2 -6
@@ -7,11 +7,11 @@#include <linux/io.h> #include <linux/module.h> #include <linux/of.h> -#include <linux/of_device.h> #include <linux/pinctrl/pinconf-generic.h> #include <linux/pinctrl/pinctrl.h> #include <linux/pinctrl/pinmux.h> #include <linux/platform_device.h> +#include <linux/property.h> #include <linux/slab.h> #include "../core.h"
@@ -208,7 +208,6 @@ static const struct of_device_id ns_pinctrl_of_match_table[] = {static int ns_pinctrl_probe (struct platform_device *pdev) {struct device *dev = &pdev->dev; -const struct of_device_id *of_id;struct ns_pinctrl *ns_pinctrl;struct pinctrl_desc *pctldesc;struct pinctrl_pin_desc *pin;
@@ -225,10 +224,7 @@ static int ns_pinctrl_probe(struct platform_device *pdev) ns_pinctrl->dev = dev; - of_id =of_match_device (ns_pinctrl_of_match_table, dev); -if (!of_id) -return -EINVAL ; - ns_pinctrl->chipset_flag = (uintptr_t )of_id->data; + ns_pinctrl->chipset_flag = (uintptr_t )device_get_match_data (dev); res =platform_get_resource_byname (pdev,IORESOURCE_MEM ,"cru_gpio_control" );
drivers/pinctrl/berlin/berlin-bg2.c +3 -5
@@ -8,8 +8,9 @@*/ #include <linux/init.h> -#include <linux/of_device.h> +#include <linux/of.h> #include <linux/platform_device.h> +#include <linux/property.h> #include <linux/regmap.h> #include "berlin.h"
@@ -227,10 +228,7 @@ static const struct of_device_id berlin2_pinctrl_match[] = {static int berlin2_pinctrl_probe (struct platform_device *pdev) { -const struct of_device_id *match = -of_match_device (berlin2_pinctrl_match, &pdev->dev); - -return berlin_pinctrl_probe (pdev, match->data); +return berlin_pinctrl_probe (pdev,device_get_match_data (&pdev->dev)); }static struct platform_driver berlin2_pinctrl_driver = {
drivers/pinctrl/berlin/berlin-bg2cd.c +3 -5
@@ -8,8 +8,9 @@*/ #include <linux/init.h> -#include <linux/of_device.h> +#include <linux/of.h> #include <linux/platform_device.h> +#include <linux/property.h> #include <linux/regmap.h> #include "berlin.h"
@@ -172,10 +173,7 @@ static const struct of_device_id berlin2cd_pinctrl_match[] = {static int berlin2cd_pinctrl_probe (struct platform_device *pdev) { -const struct of_device_id *match = -of_match_device (berlin2cd_pinctrl_match, &pdev->dev); - -return berlin_pinctrl_probe (pdev, match->data); +return berlin_pinctrl_probe (pdev,device_get_match_data (&pdev->dev)); }static struct platform_driver berlin2cd_pinctrl_driver = {
drivers/pinctrl/berlin/berlin-bg2q.c +3 -5
@@ -8,8 +8,9 @@*/ #include <linux/init.h> -#include <linux/of_device.h> +#include <linux/of.h> #include <linux/platform_device.h> +#include <linux/property.h> #include <linux/regmap.h> #include "berlin.h"
@@ -389,10 +390,7 @@ static const struct of_device_id berlin2q_pinctrl_match[] = {static int berlin2q_pinctrl_probe (struct platform_device *pdev) { -const struct of_device_id *match = -of_match_device (berlin2q_pinctrl_match, &pdev->dev); - -return berlin_pinctrl_probe (pdev, match->data); +return berlin_pinctrl_probe (pdev,device_get_match_data (&pdev->dev)); }static struct platform_driver berlin2q_pinctrl_driver = {
drivers/pinctrl/berlin/berlin-bg4ct.c +5 -4
@@ -8,8 +8,9 @@*/ #include <linux/init.h> -#include <linux/of_device.h> +#include <linux/of.h> #include <linux/platform_device.h> +#include <linux/property.h> #include <linux/regmap.h> #include "berlin.h"
@@ -449,8 +450,8 @@ static const struct of_device_id berlin4ct_pinctrl_match[] = {static int berlin4ct_pinctrl_probe (struct platform_device *pdev) { -const struct of_device_id *match = -of_match_device (berlin4ct_pinctrl_match, &pdev->dev); +const struct berlin_pinctrl_desc *desc = +device_get_match_data (&pdev->dev);struct regmap_config *rmconfig;struct regmap *regmap;struct resource *res;
@@ -473,7 +474,7 @@ static int berlin4ct_pinctrl_probe(struct platform_device *pdev)if (IS_ERR (regmap))return PTR_ERR (regmap); -return berlin_pinctrl_probe_regmap (pdev, match->data, regmap); +return berlin_pinctrl_probe_regmap (pdev, desc, regmap); }static struct platform_driver berlin4ct_pinctrl_driver = {
drivers/pinctrl/berlin/pinctrl-as370.c +5 -4
@@ -8,8 +8,9 @@*/ #include <linux/init.h> -#include <linux/of_device.h> +#include <linux/of.h> #include <linux/platform_device.h> +#include <linux/property.h> #include <linux/regmap.h> #include "berlin.h"
@@ -330,8 +331,8 @@ static const struct of_device_id as370_pinctrl_match[] = {static int as370_pinctrl_probe (struct platform_device *pdev) { -const struct of_device_id *match = -of_match_device (as370_pinctrl_match, &pdev->dev); +const struct berlin_pinctrl_desc *desc = +device_get_match_data (&pdev->dev);struct regmap_config *rmconfig;struct regmap *regmap;struct resource *res;
@@ -354,7 +355,7 @@ static int as370_pinctrl_probe(struct platform_device *pdev)if (IS_ERR (regmap))return PTR_ERR (regmap); -return berlin_pinctrl_probe_regmap (pdev, match->data, regmap); +return berlin_pinctrl_probe_regmap (pdev, desc, regmap); }static struct platform_driver as370_pinctrl_driver = {
drivers/pinctrl/mvebu/pinctrl-armada-38x.c +2 -7
@@ -12,8 +12,8 @@#include <linux/io.h> #include <linux/platform_device.h> #include <linux/of.h> -#include <linux/of_device.h> #include <linux/pinctrl/pinctrl.h> +#include <linux/property.h> #include "pinctrl-mvebu.h"
@@ -404,13 +404,8 @@ static struct pinctrl_gpio_range armada_38x_mpp_gpio_ranges[] = {static int armada_38x_pinctrl_probe (struct platform_device *pdev) {struct mvebu_pinctrl_soc_info *soc = &armada_38x_pinctrl_info; -const struct of_device_id *match = -of_match_device (armada_38x_pinctrl_of_match, &pdev->dev); -if (!match) -return -ENODEV ; - - soc->variant = (unsigned ) match->data &0xff ; + soc->variant = (unsigned )device_get_match_data (&pdev->dev) &0xff ; soc->controls = armada_38x_mpp_controls; soc->ncontrols =ARRAY_SIZE (armada_38x_mpp_controls); soc->gpioranges = armada_38x_mpp_gpio_ranges;
drivers/pinctrl/mvebu/pinctrl-armada-39x.c +2 -7
@@ -12,8 +12,8 @@#include <linux/io.h> #include <linux/platform_device.h> #include <linux/of.h> -#include <linux/of_device.h> #include <linux/pinctrl/pinctrl.h> +#include <linux/property.h> #include "pinctrl-mvebu.h"
@@ -386,13 +386,8 @@ static struct pinctrl_gpio_range armada_39x_mpp_gpio_ranges[] = {static int armada_39x_pinctrl_probe (struct platform_device *pdev) {struct mvebu_pinctrl_soc_info *soc = &armada_39x_pinctrl_info; -const struct of_device_id *match = -of_match_device (armada_39x_pinctrl_of_match, &pdev->dev); -if (!match) -return -ENODEV ; - - soc->variant = (unsigned ) match->data &0xff ; + soc->variant = (unsigned )device_get_match_data (&pdev->dev) &0xff ; soc->controls = armada_39x_mpp_controls; soc->ncontrols =ARRAY_SIZE (armada_39x_mpp_controls); soc->gpioranges = armada_39x_mpp_gpio_ranges;
drivers/pinctrl/mvebu/pinctrl-armada-ap806.c +1 -4
@@ -13,7 +13,6 @@#include <linux/io.h> #include <linux/platform_device.h> #include <linux/of.h> -#include <linux/of_device.h> #include <linux/pinctrl/pinctrl.h> #include "pinctrl-mvebu.h"
@@ -106,10 +105,8 @@ static struct pinctrl_gpio_range armada_ap806_mpp_gpio_ranges[] = {static int armada_ap806_pinctrl_probe (struct platform_device *pdev) {struct mvebu_pinctrl_soc_info *soc = &armada_ap806_pinctrl_info; -const struct of_device_id *match = -of_match_device (armada_ap806_pinctrl_of_match, &pdev->dev); -if (!match || !pdev->dev.parent) +if (!pdev->dev.parent)return -ENODEV ; soc->variant =0 ;/* no variants for Armada AP806 */
drivers/pinctrl/mvebu/pinctrl-armada-cp110.c +2 -4
@@ -12,9 +12,9 @@#include <linux/io.h> #include <linux/mfd/syscon.h> #include <linux/of.h> -#include <linux/of_device.h> #include <linux/pinctrl/pinctrl.h> #include <linux/platform_device.h> +#include <linux/property.h> #include "pinctrl-mvebu.h"
@@ -638,8 +638,6 @@ static void mvebu_pinctrl_assign_variant(struct mvebu_mpp_mode *m,static int armada_cp110_pinctrl_probe (struct platform_device *pdev) {struct mvebu_pinctrl_soc_info *soc; -const struct of_device_id *match = -of_match_device (armada_cp110_pinctrl_of_match, &pdev->dev);int i;if (!pdev->dev.parent)
@@ -650,7 +648,7 @@ static int armada_cp110_pinctrl_probe(struct platform_device *pdev)if (!soc)return -ENOMEM ; - soc->variant = (unsigned long ) match->data &0xff ; + soc->variant = (unsigned long )device_get_match_data (&pdev->dev) &0xff ; soc->controls = armada_cp110_mpp_controls; soc->ncontrols =ARRAY_SIZE (armada_cp110_mpp_controls); soc->modes = armada_cp110_mpp_modes;
drivers/pinctrl/mvebu/pinctrl-armada-xp.c +2 -7
@@ -19,8 +19,8 @@#include <linux/platform_device.h> #include <linux/clk.h> #include <linux/of.h> -#include <linux/of_device.h> #include <linux/pinctrl/pinctrl.h> +#include <linux/property.h> #include <linux/bitops.h> #include "pinctrl-mvebu.h"
@@ -568,14 +568,9 @@ static int armada_xp_pinctrl_resume(struct platform_device *pdev)static int armada_xp_pinctrl_probe (struct platform_device *pdev) {struct mvebu_pinctrl_soc_info *soc = &armada_xp_pinctrl_info; -const struct of_device_id *match = -of_match_device (armada_xp_pinctrl_of_match, &pdev->dev);int nregs; -if (!match) -return -ENODEV ; - - soc->variant = (unsigned ) match->data &0xff ; + soc->variant = (unsigned )device_get_match_data (&pdev->dev) &0xff ;switch (soc->variant) {case V_MV78230 :
drivers/pinctrl/mvebu/pinctrl-dove.c +2 -4
@@ -12,9 +12,9 @@#include <linux/platform_device.h> #include <linux/clk.h> #include <linux/of.h> -#include <linux/of_device.h> #include <linux/mfd/syscon.h> #include <linux/pinctrl/pinctrl.h> +#include <linux/property.h> #include <linux/regmap.h> #include "pinctrl-mvebu.h"
@@ -765,13 +765,11 @@ static int dove_pinctrl_probe(struct platform_device *pdev) {struct resource *res, *mpp_res;struct resource fb_res; -const struct of_device_id *match = -of_match_device (dove_pinctrl_of_match, &pdev->dev);struct mvebu_mpp_ctrl_data *mpp_data;void __iomem *base;int i; - pdev->dev.platform_data = (void *)match->data; + pdev->dev.platform_data = (void *)device_get_match_data (&pdev->dev);/* * General MPP Configuration Register is part of pdma registers.
drivers/pinctrl/mvebu/pinctrl-kirkwood.c +2 -5
@@ -11,8 +11,8 @@#include <linux/platform_device.h> #include <linux/clk.h> #include <linux/of.h> -#include <linux/of_device.h> #include <linux/pinctrl/pinctrl.h> +#include <linux/property.h> #include "pinctrl-mvebu.h"
@@ -470,10 +470,7 @@ static const struct of_device_id kirkwood_pinctrl_of_match[] = {static int kirkwood_pinctrl_probe (struct platform_device *pdev) { -const struct of_device_id *match = -of_match_device (kirkwood_pinctrl_of_match, &pdev->dev); - - pdev->dev.platform_data = (void *)match->data; + pdev->dev.platform_data = (void *)device_get_match_data (&pdev->dev);return mvebu_pinctrl_simple_mmio_probe (pdev); }
drivers/pinctrl/mvebu/pinctrl-orion.c +2 -5
@@ -19,8 +19,8 @@#include <linux/platform_device.h> #include <linux/clk.h> #include <linux/of.h> -#include <linux/of_device.h> #include <linux/pinctrl/pinctrl.h> +#include <linux/property.h> #include "pinctrl-mvebu.h"
@@ -218,10 +218,7 @@ static const struct of_device_id orion_pinctrl_of_match[] = {static int orion_pinctrl_probe (struct platform_device *pdev) { -const struct of_device_id *match = -of_match_device (orion_pinctrl_of_match, &pdev->dev); - - pdev->dev.platform_data = (void *)match->data; + pdev->dev.platform_data = (void *)device_get_match_data (&pdev->dev); mpp_base =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (mpp_base))
drivers/pinctrl/nomadik/pinctrl-abx500.c +2 -7
@@ -17,6 +17,7 @@#include <linux/of.h> #include <linux/of_device.h> #include <linux/platform_device.h> +#include <linux/property.h> #include <linux/seq_file.h> #include <linux/slab.h> #include <linux/types.h>
@@ -985,7 +986,6 @@ static const struct of_device_id abx500_gpio_match[] = {static int abx500_gpio_probe (struct platform_device *pdev) {struct device_node *np = pdev->dev.of_node; -const struct of_device_id *match;struct abx500_pinctrl *pct;unsigned int id =-1 ;int ret;
@@ -1006,12 +1006,7 @@ static int abx500_gpio_probe(struct platform_device *pdev) pct->chip.parent = &pdev->dev; pct->chip.base =-1 ;/* Dynamic allocation */ - match =of_match_device (abx500_gpio_match, &pdev->dev); -if (!match) { -dev_err (&pdev->dev,"gpio dt not matching\n" ); -return -ENODEV ; - } - id = (unsigned long )match->data; + id = (unsigned long )device_get_match_data (&pdev->dev);/* Poke in other ASIC variants here */ switch (id) {
drivers/pinctrl/nomadik/pinctrl-nomadik.c +4 -6
@@ -16,9 +16,11 @@#include <linux/interrupt.h> #include <linux/io.h> #include <linux/kernel.h> +#include <linux/of.h> #include <linux/of_address.h> -#include <linux/of_device.h> +#include <linux/of_platform.h> #include <linux/platform_device.h> +#include <linux/property.h> #include <linux/seq_file.h> #include <linux/slab.h> #include <linux/spinlock.h>
@@ -1840,7 +1842,6 @@ static int nmk_pinctrl_resume(struct device *dev)static int nmk_pinctrl_probe (struct platform_device *pdev) { -const struct of_device_id *match;struct device_node *np = pdev->dev.of_node;struct device_node *prcm_np;struct nmk_pinctrl *npct;
@@ -1851,10 +1852,7 @@ static int nmk_pinctrl_probe(struct platform_device *pdev)if (!npct)return -ENOMEM ; - match =of_match_device (nmk_pinctrl_match, &pdev->dev); -if (!match) -return -ENODEV ; - version = (unsigned int ) match->data; + version = (unsigned int )device_get_match_data (&pdev->dev);/* Poke in other ASIC variants here */ if (version ==PINCTRL_NMK_STN8815 )
drivers/pinctrl/pinctrl-at91.c +5 -6
@@ -12,10 +12,9 @@#include <linux/interrupt.h> #include <linux/io.h> #include <linux/of.h> -#include <linux/of_address.h> -#include <linux/of_device.h> -#include <linux/of_irq.h> +#include <linux/platform_device.h> #include <linux/pm.h> +#include <linux/property.h> #include <linux/seq_file.h> #include <linux/slab.h> #include <linux/string_helpers.h>
@@ -1302,8 +1301,8 @@ static int at91_pinctrl_probe_dt(struct platform_device *pdev,if (!np)return -ENODEV ; - info->dev = dev; - info->ops =of_device_get_match_data (dev); + info->dev = &pdev->dev; + info->ops =device_get_match_data (&pdev->dev);at91_pinctrl_child_count (info, np);/*
@@ -1848,7 +1847,7 @@ static int at91_gpio_probe(struct platform_device *pdev)if (IS_ERR (at91_chip->regbase))return PTR_ERR (at91_chip->regbase); - at91_chip->ops =of_device_get_match_data (dev); + at91_chip->ops =device_get_match_data (dev); at91_chip->pioc_virq = irq; at91_chip->clock =devm_clk_get_enabled (dev,NULL );
drivers/pinctrl/pinctrl-xway.c +4 -7
@@ -11,12 +11,12 @@#include <linux/gpio/driver.h> #include <linux/slab.h> #include <linux/module.h> -#include <linux/of_platform.h> -#include <linux/of_address.h> +#include <linux/of.h> #include <linux/ioport.h> #include <linux/io.h> #include <linux/device.h> #include <linux/platform_device.h> +#include <linux/property.h> #include "pinctrl-lantiq.h"
@@ -1451,7 +1451,6 @@ MODULE_DEVICE_TABLE(of, xway_match);static int pinmux_xway_probe (struct platform_device *pdev) { -const struct of_device_id *match;const struct pinctrl_xway_soc *xway_soc;int ret, i;
@@ -1460,10 +1459,8 @@ static int pinmux_xway_probe(struct platform_device *pdev)if (IS_ERR (xway_info.membase[0 ]))return PTR_ERR (xway_info.membase[0 ]); - match =of_match_device (xway_match, &pdev->dev); -if (match) - xway_soc = (const struct pinctrl_xway_soc *) match->data; -else + xway_soc =device_get_match_data (&pdev->dev); +if (!xway_soc) xway_soc = &danube_pinctrl;/* find out how many pads we have */
drivers/pinctrl/ti/pinctrl-ti-iodelay.c +8 -10
@@ -14,7 +14,8 @@#include <linux/io.h> #include <linux/module.h> #include <linux/of.h> -#include <linux/of_device.h> +#include <linux/platform_device.h> +#include <linux/property.h> #include <linux/regmap.h> #include <linux/seq_file.h> #include <linux/slab.h>
@@ -822,7 +823,6 @@ static int ti_iodelay_probe(struct platform_device *pdev) {struct device *dev = &pdev->dev;struct device_node *np =of_node_get (dev->of_node); -const struct of_device_id *match;struct resource *res;struct ti_iodelay_device *iod;int ret =0 ;
@@ -833,20 +833,18 @@ static int ti_iodelay_probe(struct platform_device *pdev) goto exit_out; } - match =of_match_device (ti_iodelay_of_match, dev); -if (!match) { - ret = -EINVAL ; -dev_err (dev,"No DATA match\n" ); - goto exit_out; - } - iod =devm_kzalloc (dev,sizeof (*iod),GFP_KERNEL );if (!iod) { ret = -ENOMEM ; goto exit_out; } iod->dev = dev; - iod->reg_data = match->data; + iod->reg_data =device_get_match_data (dev); +if (!iod->reg_data) { + ret = -EINVAL ; +dev_err (dev,"No DATA match\n" ); + goto exit_out; + }/* So far We can assume there is only 1 bank of registers */ iod->reg_base =devm_platform_get_and_ioremap_resource (pdev,0 , &res);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 277/538 pinctrl: ti: iodelay: Use scope based of_node_put() cleanups
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit 791a8bb202a85f707c20ef04a471519e35f089dc ]
Use scope based of_node_put() cleanup to simplify code.
Stable-dep-of: a9f2b249adee ("pinctrl: ti: ti-iodelay: Fix some error handling paths")
--- drivers/pinctrl/ti/pinctrl-ti-iodelay.c | 43 +++++++++---------------- 1 file changed, 15 insertions(+), 28 deletions(-)
drivers/pinctrl/ti/pinctrl-ti-iodelay.c +15 -28
@@ -822,53 +822,48 @@ MODULE_DEVICE_TABLE(of, ti_iodelay_of_match);static int ti_iodelay_probe (struct platform_device *pdev) {struct device *dev = &pdev->dev; -struct device_node *np =of_node_get (dev->of_node); + struct device_node *np __free(device_node) = of_node_get(dev->of_node);struct resource *res;struct ti_iodelay_device *iod; -int ret =0 ; +int ret;if (!np) { - ret = -EINVAL ;dev_err (dev,"No OF node\n" ); - goto exit_out; +return -EINVAL ; } iod =devm_kzalloc (dev,sizeof (*iod),GFP_KERNEL ); -if (!iod) { - ret = -ENOMEM ; - goto exit_out; - } +if (!iod) +return -ENOMEM ; + iod->dev = dev; iod->reg_data =device_get_match_data (dev);if (!iod->reg_data) { - ret = -EINVAL ;dev_err (dev,"No DATA match\n" ); - goto exit_out; +return -EINVAL ; }/* So far We can assume there is only 1 bank of registers */ iod->reg_base =devm_platform_get_and_ioremap_resource (pdev,0 , &res); -if (IS_ERR (iod->reg_base)) { - ret =PTR_ERR (iod->reg_base); - goto exit_out; - } +if (IS_ERR (iod->reg_base)) +return PTR_ERR (iod->reg_base); + iod->phys_base = res->start; iod->regmap =devm_regmap_init_mmio (dev, iod->reg_base, iod->reg_data->regmap_config);if (IS_ERR (iod->regmap)) {dev_err (dev,"Regmap MMIO init failed.\n" ); - ret =PTR_ERR (iod->regmap); - goto exit_out; +return PTR_ERR (iod->regmap); } ret =ti_iodelay_pinconf_init_dev (iod);if (ret) - goto exit_out; +return ret; ret =ti_iodelay_alloc_pins (dev, iod, res->start);if (ret) - goto exit_out; +return ret; iod->desc.pctlops = &ti_iodelay_pinctrl_ops;/* no pinmux ops - we are pinconf */
@@ -879,20 +874,12 @@ static int ti_iodelay_probe(struct platform_device *pdev) ret =devm_pinctrl_register_and_init (dev, &iod->desc, iod, &iod->pctl);if (ret) {dev_err (dev,"Failed to register pinctrl\n" ); - goto exit_out; +return ret; }platform_set_drvdata (pdev, iod); - ret =pinctrl_enable (iod->pctl); -if (ret) - goto exit_out; - -return 0 ; - -exit_out: -of_node_put (np); -return ret; +return pinctrl_enable (iod->pctl); }/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 278/538 pinctrl: ti: ti-iodelay: Fix some error handling paths
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit a9f2b249adeef2b9744a884355fa8f5e581d507f ]
In the probe, if an error occurs after the ti_iodelay_pinconf_init_dev() call, it is likely that ti_iodelay_pinconf_deinit_dev() should be called, as already done in the remove function.
Also in ti_iodelay_pinconf_init_dev(), if an error occurs after the first regmap_update_bits() call, it is also likely that the deinit() function should be called.
The easier way to fix it is to add a devm_add_action_or_reset() at the rigtht place to have ti_iodelay_pinconf_deinit_dev() called when needed.
Doing so, the .remove() function can be removed, and the associated platform_set_drvdata() call in the probe as well.
--- drivers/pinctrl/ti/pinctrl-ti-iodelay.c | 52 ++++++++++--------------- 1 file changed, 21 insertions(+), 31 deletions(-)
drivers/pinctrl/ti/pinctrl-ti-iodelay.c +21 -31
@@ -273,6 +273,22 @@ static int ti_iodelay_pinconf_set(struct ti_iodelay_device *iod,return r; } +/** +* ti_iodelay_pinconf_deinit_dev() - deinit the iodelay device +* @data: IODelay device +* +* Deinitialize the IODelay device (basically just lock the region back up. +*/ +static void ti_iodelay_pinconf_deinit_dev (void *data) +{ +struct ti_iodelay_device *iod = data; +const struct ti_iodelay_reg_data *reg = iod->reg_data; + +/* lock the iodelay region back again */ +regmap_update_bits (iod->regmap, reg->reg_global_lock_offset, + reg->global_lock_mask, reg->global_lock_val); +} +/** * ti_iodelay_pinconf_init_dev() - Initialize IODelay device * @iod: iodelay device
@@ -295,6 +311,11 @@ static int ti_iodelay_pinconf_init_dev(struct ti_iodelay_device *iod)if (r)return r; + r =devm_add_action_or_reset (iod->dev, ti_iodelay_pinconf_deinit_dev, + iod); +if (r) +return r; +/* Read up Recalibration sequence done by bootloader */ r =regmap_read (iod->regmap, reg->reg_refclk_offset, &val);if (r)
@@ -353,21 +374,6 @@ static int ti_iodelay_pinconf_init_dev(struct ti_iodelay_device *iod)return 0 ; } -/** -* ti_iodelay_pinconf_deinit_dev() - deinit the iodelay device -* @iod: IODelay device -* -* Deinitialize the IODelay device (basically just lock the region back up. -*/ -static void ti_iodelay_pinconf_deinit_dev (struct ti_iodelay_device *iod) -{ -const struct ti_iodelay_reg_data *reg = iod->reg_data; - -/* lock the iodelay region back again */ -regmap_update_bits (iod->regmap, reg->reg_global_lock_offset, - reg->global_lock_mask, reg->global_lock_val); -} -/** * ti_iodelay_get_pingroup() - Find the group mapped by a group selector * @iod: iodelay device
@@ -877,27 +883,11 @@ static int ti_iodelay_probe(struct platform_device *pdev)return ret; } -platform_set_drvdata (pdev, iod); -return pinctrl_enable (iod->pctl); } -/** -* ti_iodelay_remove() - standard remove -* @pdev: platform device -*/ -static void ti_iodelay_remove (struct platform_device *pdev) -{ -struct ti_iodelay_device *iod =platform_get_drvdata (pdev); - -ti_iodelay_pinconf_deinit_dev (iod); - -/* Expect other allocations to be freed by devm */ -} -static struct platform_driver ti_iodelay_driver = { .probe = ti_iodelay_probe, - .remove_new = ti_iodelay_remove, .driver = { .name =DRIVER_NAME , .of_match_table = ti_iodelay_of_match,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 279/538 Input: ilitek_ts_i2c - avoid wrong input subsystem sync
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emanuele Ghidoli <[email protected]>
[ Upstream commit 7d0b18cd5dc7429917812963611d961fd93cb44d ]
For different reasons i2c transaction may fail or report id in the message may be wrong. Avoid closing the frame in this case as it will result in all contacts being dropped, indicating that nothing is touching the screen anymore, while usually it is not the case.
--- drivers/input/touchscreen/ilitek_ts_i2c.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
drivers/input/touchscreen/ilitek_ts_i2c.c +5 -6
@@ -160,15 +160,14 @@ static int ilitek_process_and_report_v6(struct ilitek_ts_data *ts) error =ilitek_i2c_write_and_read (ts,NULL ,0 ,0 , buf,64 );if (error) {dev_err (dev,"get touch info failed, err:%d\n" , error); - goto err_sync_frame; +return error; } report_max_point = buf[REPORT_COUNT_ADDRESS ];if (report_max_point > ts->max_tp) {dev_err (dev,"FW report max point:%d > panel info. max:%d\n" , report_max_point, ts->max_tp); - error = -EINVAL ; - goto err_sync_frame; +return -EINVAL ; } count =DIV_ROUND_UP (report_max_point, packet_max_point);
@@ -178,7 +177,7 @@ static int ilitek_process_and_report_v6(struct ilitek_ts_data *ts)if (error) {dev_err (dev,"get touch info. failed, cnt:%d, err:%d\n" , count, error); - goto err_sync_frame; +return error; } }
@@ -203,10 +202,10 @@ static int ilitek_process_and_report_v6(struct ilitek_ts_data *ts)ilitek_touch_down (ts, id, x, y); } -err_sync_frame:input_mt_sync_frame (input);input_sync (input); -return error; + +return 0 ; }/* APIs of cmds for ILITEK Touch IC */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 280/538 Input: ilitek_ts_i2c - add report id message validation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emanuele Ghidoli <[email protected]>
[ Upstream commit 208989744a6f01bed86968473312d4e650e600b3 ]
Ensure that the touchscreen response has correct "report id" byte before processing the touch data and discard other messages.
--- drivers/input/touchscreen/ilitek_ts_i2c.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/touchscreen/ilitek_ts_i2c.c +7 -0
@@ -37,6 +37,8 @@#define ILITEK_TP_CMD_GET_MCU_VER 0x61#define ILITEK_TP_CMD_GET_IC_MODE 0xC0 +#define ILITEK_TP_I2C_REPORT_ID 0x48 +#define REPORT_COUNT_ADDRESS 61#define ILITEK_SUPPORT_MAX_POINT 40
@@ -163,6 +165,11 @@ static int ilitek_process_and_report_v6(struct ilitek_ts_data *ts)return error; } +if (buf[0 ] !=ILITEK_TP_I2C_REPORT_ID ) { +dev_err (dev,"get touch info failed. Wrong id: 0x%02X\n" , buf[0 ]); +return -EINVAL ; + } + report_max_point = buf[REPORT_COUNT_ADDRESS ];if (report_max_point > ts->max_tp) { dev_err(dev, "FW report max point:%d > panel info. max:%d\n",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 281/538 drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junlin Li <[email protected]>
[ Upstream commit 8ae06f360cfaca2b88b98ca89144548b3186aab1 ]
Ensure index in rtl2832_pid_filter does not exceed 31 to prevent out-of-bounds access.
dev->filters is a 32-bit value, so set_bit and clear_bit functions should only operate on indices from 0 to 31. If index is 32, it will attempt to access a non-existent 33rd bit, leading to out-of-bounds access. Change the boundary check from index > 32 to index >= 32 to resolve this issue.
--- drivers/media/dvb-frontends/rtl2832.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/dvb-frontends/rtl2832.c +1 -1
@@ -983,7 +983,7 @@ static int rtl2832_pid_filter(struct dvb_frontend *fe, u8 index, u16 pid, index, pid, onoff, dev->slave_ts);/* skip invalid PIDs (0x2000) */ -if (pid >0x1fff || index >32 ) +if (pid >0x1fff || index >=32 )return 0 ;if (onoff)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 282/538 drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junlin Li <[email protected]>
[ Upstream commit 46d7ebfe6a75a454a5fa28604f0ef1491f9d8d14 ]
Ensure index in rtl2830_pid_filter does not exceed 31 to prevent out-of-bounds access.
dev->filters is a 32-bit value, so set_bit and clear_bit functions should only operate on indices from 0 to 31. If index is 32, it will attempt to access a non-existent 33rd bit, leading to out-of-bounds access. Change the boundary check from index > 32 to index >= 32 to resolve this issue.
--- drivers/media/dvb-frontends/rtl2830.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/dvb-frontends/rtl2830.c +1 -1
@@ -609,7 +609,7 @@ static int rtl2830_pid_filter(struct dvb_frontend *fe, u8 index, u16 pid, int on index, pid, onoff);/* skip invalid PIDs (0x2000) */ -if (pid >0x1fff || index >32 ) +if (pid >0x1fff || index >=32 )return 0 ;if (onoff)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 283/538 PCI: Wait for Link before restoring Downstream Buses
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 3e40aa29d47e231a54640addf6a09c1f64c5b63f ]
__pci_reset_bus() calls pci_bridge_secondary_bus_reset() to perform the reset and also waits for the Secondary Bus to become again accessible. __pci_reset_bus() then calls pci_bus_restore_locked() that restores the PCI devices connected to the bus, and if necessary, recursively restores also the subordinate buses and their devices.
The logic in pci_bus_restore_locked() does not take into account that after restoring a device on one level, there might be another Link Downstream that can only start to come up after restore has been performed for its Downstream Port device. That is, the Link may require additional wait until it becomes accessible.
Similarly, pci_slot_restore_locked() lacks wait.
Amend pci_bus_restore_locked() and pci_slot_restore_locked() to wait for the Secondary Bus before recursively performing the restore of that bus.
--- drivers/pci/pci.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/pci/pci.c +6 -2
@@ -5875,8 +5875,10 @@ static void pci_bus_restore_locked(struct pci_bus *bus)list_for_each_entry (dev, &bus->devices, bus_list) {pci_dev_restore (dev); -if (dev->subordinate) +if (dev->subordinate) { +pci_bridge_wait_for_secondary_bus (dev,"bus reset" );pci_bus_restore_locked (dev->subordinate); + } } }
@@ -5910,8 +5912,10 @@ static void pci_slot_restore_locked(struct pci_slot *slot)if (!dev->slot || dev->slot != slot)continue ;pci_dev_restore (dev); -if (dev->subordinate) +if (dev->subordinate) { +pci_bridge_wait_for_secondary_bus (dev,"slot reset" );pci_bus_restore_locked (dev->subordinate); + } } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 284/538 firewire: core: correct range of block for case of switch statement
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <[email protected]>
[ Upstream commit ebb9d3ca8f7efc1b6a2f1750d1058eda444883d0 ]
A commit d8527cab6c31 ("firewire: cdev: implement new event to notify response subaction with time stamp") adds an additional case, FW_CDEV_EVENT_RESPONSE2, into switch statement in complete_transaction(). However, the range of block is beyond to the case label and reaches neibour default label.
This commit corrects the range of block. Fortunately, it has few impacts in practice since the local variable in the scope under the label is not used in codes under default label.
--- drivers/firewire/core-cdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firewire/core-cdev.c +1 -1
@@ -598,11 +598,11 @@ static void complete_transaction(struct fw_card *card, int rcode, u32 request_tsqueue_event (client, &e->event, rsp,sizeof (*rsp) + rsp->length,NULL ,0 );break ; + }default :WARN_ON (1 );break ; } - }/* Drop the idr's reference */ client_put (client);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 285/538 PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 6188a1c762eb9bbd444f47696eda77a5eae6207a ]
This code accidentally uses && where || was intended. It potentially results in a NULL dereference.
Thus, fix the if-statement expression to use the correct condition.
--- drivers/pci/controller/dwc/pci-keystone.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/controller/dwc/pci-keystone.c +1 -1
@@ -579,7 +579,7 @@ static void ks_pcie_quirk(struct pci_dev *dev)*/ if (pci_match_id (am6_pci_devids, bridge)) { bridge_dev =pci_get_host_bridge_device (dev); -if (!bridge_dev && !bridge_dev->parent) +if (!bridge_dev || !bridge_dev->parent)return ; ks_pcie =dev_get_drvdata (bridge_dev->parent);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 286/538 clk: qcom: ipq5332: Register gcc_qdss_tsctr_clk_src
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Varadarajan Narayanan <[email protected]>
[ Upstream commit 0e1ac23dfa3f635e486fdeb08206b981cb0a2a6b ]
gcc_qdss_tsctr_clk_src (enabled in the boot loaders and dependent on gpll4_main) was not registered as one of the ipq5332 clocks. Hence clk_disable_unused() disabled 'gpll4_main' assuming there were no consumers for 'gpll4_main' resulting in system freeze or reboots.
--- drivers/clk/qcom/gcc-ipq5332.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/qcom/gcc-ipq5332.c +1 -0
@@ -3388,6 +3388,7 @@ static struct clk_regmap *gcc_ipq5332_clocks[] = { [GCC_QDSS_DAP_DIV_CLK_SRC] = &gcc_qdss_dap_div_clk_src.clkr, [GCC_QDSS_ETR_USB_CLK] = &gcc_qdss_etr_usb_clk.clkr, [GCC_QDSS_EUD_AT_CLK] = &gcc_qdss_eud_at_clk.clkr, + [GCC_QDSS_TSCTR_CLK_SRC] = &gcc_qdss_tsctr_clk_src.clkr, [GCC_QPIC_AHB_CLK] = &gcc_qpic_ahb_clk.clkr, [GCC_QPIC_CLK] = &gcc_qpic_clk.clkr, [GCC_QPIC_IO_MACRO_CLK] = &gcc_qpic_io_macro_clk.clkr,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 287/538 clk: qcom: dispcc-sm8250: use special function for Lucid 5LPE PLL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 362be5cbaec2a663eb86b7105313368b4a71fc1e ]
According to msm-5.10 the lucid 5lpe PLLs have require slightly different configuration that trion / lucid PLLs, it doesn't set PLL_UPDATE_BYPASS bit. Add corresponding function and use it for the display clock controller on Qualcomm SM8350 platform.
--- drivers/clk/qcom/clk-alpha-pll.c | 52 ++++++++++++++++++++++++++++++++ drivers/clk/qcom/clk-alpha-pll.h | 2 ++ drivers/clk/qcom/dispcc-sm8250.c | 9 ++++-- 3 files changed, 61 insertions(+), 2 deletions(-)
drivers/clk/qcom/clk-alpha-pll.c +52 -0
@@ -1757,6 +1757,58 @@ const struct clk_ops clk_alpha_pll_agera_ops = { };EXPORT_SYMBOL_GPL (clk_alpha_pll_agera_ops); +/** +* clk_lucid_5lpe_pll_configure - configure the lucid 5lpe pll +* +* @pll: clk alpha pll +* @regmap: register map +* @config: configuration to apply for pll +*/ +void clk_lucid_5lpe_pll_configure (struct clk_alpha_pll *pll,struct regmap *regmap, +const struct alpha_pll_config *config) +{ +/* +* If the bootloader left the PLL enabled it's likely that there are +* RCGs that will lock up if we disable the PLL below. +*/ +if (trion_pll_is_enabled (pll, regmap)) { +pr_debug ("Lucid 5LPE PLL is already enabled, skipping configuration\n" ); +return ; + } + +clk_alpha_pll_write_config (regmap,PLL_L_VAL (pll), config->l); +regmap_write (regmap,PLL_CAL_L_VAL (pll),TRION_PLL_CAL_VAL ); +clk_alpha_pll_write_config (regmap,PLL_ALPHA_VAL (pll), config->alpha); +clk_alpha_pll_write_config (regmap,PLL_CONFIG_CTL (pll), + config->config_ctl_val); +clk_alpha_pll_write_config (regmap,PLL_CONFIG_CTL_U (pll), + config->config_ctl_hi_val); +clk_alpha_pll_write_config (regmap,PLL_CONFIG_CTL_U1 (pll), + config->config_ctl_hi1_val); +clk_alpha_pll_write_config (regmap,PLL_USER_CTL (pll), + config->user_ctl_val); +clk_alpha_pll_write_config (regmap,PLL_USER_CTL_U (pll), + config->user_ctl_hi_val); +clk_alpha_pll_write_config (regmap,PLL_USER_CTL_U1 (pll), + config->user_ctl_hi1_val); +clk_alpha_pll_write_config (regmap,PLL_TEST_CTL (pll), + config->test_ctl_val); +clk_alpha_pll_write_config (regmap,PLL_TEST_CTL_U (pll), + config->test_ctl_hi_val); +clk_alpha_pll_write_config (regmap,PLL_TEST_CTL_U1 (pll), + config->test_ctl_hi1_val); + +/* Disable PLL output */ +regmap_update_bits (regmap,PLL_MODE (pll),PLL_OUTCTRL ,0 ); + +/* Set operation mode to OFF */ +regmap_write (regmap,PLL_OPMODE (pll),PLL_STANDBY ); + +/* Place the PLL in STANDBY mode */ +regmap_update_bits (regmap,PLL_MODE (pll),PLL_RESET_N ,PLL_RESET_N ); +} +EXPORT_SYMBOL_GPL (clk_lucid_5lpe_pll_configure); +static int alpha_pll_lucid_5lpe_enable (struct clk_hw *hw) {struct clk_alpha_pll *pll =to_clk_alpha_pll (hw);
drivers/clk/qcom/clk-alpha-pll.h +2 -0
@@ -198,6 +198,8 @@ void clk_agera_pll_configure(struct clk_alpha_pll *pll, struct regmap *regmap,void clk_zonda_pll_configure (struct clk_alpha_pll *pll,struct regmap *regmap,const struct alpha_pll_config *config); +void clk_lucid_5lpe_pll_configure (struct clk_alpha_pll *pll,struct regmap *regmap, +const struct alpha_pll_config *config);void clk_lucid_evo_pll_configure (struct clk_alpha_pll *pll,struct regmap *regmap,const struct alpha_pll_config *config); void clk_rivian_evo_pll_configure(struct clk_alpha_pll *pll, struct regmap *regmap,
drivers/clk/qcom/dispcc-sm8250.c +7 -2
@@ -1359,8 +1359,13 @@ static int disp_cc_sm8250_probe(struct platform_device *pdev) disp_cc_sm8250_clocks[DISP_CC_MDSS_EDP_GTC_CLK_SRC ] =NULL ; } -clk_lucid_pll_configure (&disp_cc_pll0, regmap, &disp_cc_pll0_config); -clk_lucid_pll_configure (&disp_cc_pll1, regmap, &disp_cc_pll1_config); +if (of_device_is_compatible (pdev->dev.of_node,"qcom,sm8350-dispcc" )) { +clk_lucid_5lpe_pll_configure (&disp_cc_pll0, regmap, &disp_cc_pll0_config); +clk_lucid_5lpe_pll_configure (&disp_cc_pll1, regmap, &disp_cc_pll1_config); + }else { +clk_lucid_pll_configure (&disp_cc_pll0, regmap, &disp_cc_pll0_config); +clk_lucid_pll_configure (&disp_cc_pll1, regmap, &disp_cc_pll1_config); + }/* Enable clock gating for MDP clocks */ regmap_update_bits (regmap,0x8000 ,0x10 ,0x10 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 288/538 leds: leds-pca995x: Add support for NXP PCA9956B
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pieterjan Camerlynck <[email protected]>
[ Upstream commit 68d6520d2e76998cdea58f6dd8782de5ab5b28af ]
Add support for PCA9956B chip, which belongs to the same family.
This chip features 24 instead of 16 outputs, so add a chipdef struct to deal with the different register layouts.
Stable-dep-of: 82c5ada1f9d0 ("leds: pca995x: Fix device child node usage in pca995x_probe()")
--- drivers/leds/leds-pca995x.c | 59 ++++++++++++++++++++++++------------- 1 file changed, 39 insertions(+), 20 deletions(-)
drivers/leds/leds-pca995x.c +39 -20
@@ -19,10 +19,6 @@#define PCA995X_MODE1 0x00#define PCA995X_MODE2 0x01#define PCA995X_LEDOUT0 0x02 -#define PCA9955B_PWM0 0x08 -#define PCA9952_PWM0 0x0A -#define PCA9952_IREFALL 0x43 -#define PCA9955B_IREFALL 0x45/* Auto-increment disabled. Normal mode */ #define PCA995X_MODE1_CFG 0x00
@@ -34,17 +30,38 @@#define PCA995X_LDRX_MASK 0x3#define PCA995X_LDRX_BITS 2 -#define PCA995X_MAX_OUTPUTS 16 +#define PCA995X_MAX_OUTPUTS 24#define PCA995X_OUTPUTS_PER_REG 4#define PCA995X_IREFALL_FULL_CFG 0xFF#define PCA995X_IREFALL_HALF_CFG (PCA995X_IREFALL_FULL_CFG / 2) -#define PCA995X_TYPE_NON_B 0 -#define PCA995X_TYPE_B 1 -#define ldev_to_led (c) container_of(c, struct pca995x_led, ldev) +struct pca995x_chipdef { +unsigned int num_leds; +u8 pwm_base; +u8 irefall; +}; + +static const struct pca995x_chipdef pca9952_chipdef = { + .num_leds =16 , + .pwm_base =0x0a , + .irefall =0x43 , +}; + +static const struct pca995x_chipdef pca9955b_chipdef = { + .num_leds =16 , + .pwm_base =0x08 , + .irefall =0x45 , +}; + +static const struct pca995x_chipdef pca9956b_chipdef = { + .num_leds =24 , + .pwm_base =0x0a , + .irefall =0x40 , +}; +struct pca995x_led {unsigned int led_no;struct led_classdev ldev;
@@ -54,7 +71,7 @@ struct pca995x_led {struct pca995x_chip {struct regmap *regmap;struct pca995x_led leds[PCA995X_MAX_OUTPUTS ]; -int btype; +const struct pca995x_chipdef *chipdef; }; static int pca995x_brightness_set(struct led_classdev *led_cdev,
@@ -62,10 +79,11 @@ static int pca995x_brightness_set(struct led_classdev *led_cdev, {struct pca995x_led *led =ldev_to_led (led_cdev);struct pca995x_chip *chip = led->chip; +const struct pca995x_chipdef *chipdef = chip->chipdef;u8 ledout_addr, pwmout_addr;int shift, ret; - pwmout_addr = (chip->btype ?PCA9955B_PWM0 :PCA9952_PWM0 ) + led->led_no; + pwmout_addr = chipdef->pwm_base + led->led_no; ledout_addr =PCA995X_LEDOUT0 + (led->led_no /PCA995X_OUTPUTS_PER_REG ); shift =PCA995X_LDRX_BITS * (led->led_no %PCA995X_OUTPUTS_PER_REG );
@@ -104,11 +122,12 @@ static int pca995x_probe(struct i2c_client *client)struct fwnode_handle *led_fwnodes[PCA995X_MAX_OUTPUTS ] = {0 };struct fwnode_handle *np, *child;struct device *dev = &client->dev; +const struct pca995x_chipdef *chipdef;struct pca995x_chip *chip;struct pca995x_led *led; -int i, btype, reg, ret; +int i, reg, ret; - btype = (unsigned long )device_get_match_data (&client->dev); + chipdef =device_get_match_data (&client->dev); np =dev_fwnode (dev);if (!np)
@@ -118,7 +137,7 @@ static int pca995x_probe(struct i2c_client *client)if (!chip)return -ENOMEM ; - chip->btype = btype; + chip->chipdef = chipdef; chip->regmap =devm_regmap_init_i2c (client, &pca995x_regmap);if (IS_ERR (chip->regmap))return PTR_ERR (chip->regmap);
@@ -170,21 +189,21 @@ static int pca995x_probe(struct i2c_client *client)return ret;/* IREF Output current value for all LEDn outputs */ -return regmap_write (chip->regmap, - btype ?PCA9955B_IREFALL :PCA9952_IREFALL , -PCA995X_IREFALL_HALF_CFG ); +return regmap_write (chip->regmap, chipdef->irefall,PCA995X_IREFALL_HALF_CFG ); }static const struct i2c_device_id pca995x_id[] = { - {"pca9952" , .driver_data = (kernel_ulong_t )PCA995X_TYPE_NON_B }, - {"pca9955b" , .driver_data = (kernel_ulong_t )PCA995X_TYPE_B }, + {"pca9952" , .driver_data = (kernel_ulong_t)&pca9952_chipdef }, + {"pca9955b" , .driver_data = (kernel_ulong_t)&pca9955b_chipdef }, + {"pca9956b" , .driver_data = (kernel_ulong_t)&pca9956b_chipdef }, {} };MODULE_DEVICE_TABLE (i2c, pca995x_id);static const struct of_device_id pca995x_of_match[] = { - { .compatible ="nxp,pca9952" , .data = (void *)PCA995X_TYPE_NON_B }, - { .compatible ="nxp,pca9955b" , .data = (void *)PCA995X_TYPE_B }, + { .compatible ="nxp,pca9952" , .data = &pca9952_chipdef }, + { .compatible ="nxp,pca9955b" , . data = &pca9955b_chipdef }, + { .compatible ="nxp,pca9956b" , .data = &pca9956b_chipdef }, {}, };MODULE_DEVICE_TABLE (of, pca995x_of_match);
Signature · 1 line
2.43.0
Re: [PATCH 6.6 288/538] leds: leds-pca995x: Add support for NXP PCA9956B
Quoted 4 lines · Greg Kroah-Hartman
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
Quoted 8 lines
From: Pieterjan Camerlynck <[email protected]>
[ Upstream commit
68d6520d2e76998cdea58f6dd8782de5ab5b28af]Add support for PCA9956B chip, which belongs to the same family.
This chip features 24 instead of 16 outputs, so add a chipdef struct to deal with the different register layouts.
Seems like a feature patch, not stable material ?
Greg Kroah-Hartman
maintainerRe: [PATCH 6.6 288/538] leds: leds-pca995x: Add support for NXP PCA9956B
Quoted 7 lines · Marek Vasut
Quoted 6 lines · Greg Kroah-Hartman
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pieterjan Camerlynck <[email protected]>
Quoted 7 lines
Quoted 6 lines
[ Upstream commit
68d6520d2e76998cdea58f6dd8782de5ab5b28af]Add support for PCA9956B chip, which belongs to the same family.
This chip features 24 instead of 16 outputs, so add a chipdef struct to deal with the different register layouts.
Seems like a feature patch, not stable material ?
As the patch said:
Stable-dep-of: 82c5ada1f9d0 ("leds: pca995x: Fix device child node usage in pca995x_probe()")it is needed for that one.
and we add new device ids or quirks all the time, this one seems sane.
thanks,
greg k-h
Greg Kroah-Hartman
maintainerPATCH 289/538 leds: pca995x: Use device_for_each_child_node() to access device child nodes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
[ Upstream commit 6eefd65ba6ae29ab801f6461e59c10f93dd496f8 ]
The iterated nodes are direct children of the device node, and the device_for_each_child_node() macro accounts for child node availability.
fwnode_for_each_available_child_node() is meant to access the child nodes of an fwnode, and therefore not direct child nodes of the device node.
Use device_for_each_child_node() to indicate device's direct child nodes.
Stable-dep-of: 82c5ada1f9d0 ("leds: pca995x: Fix device child node usage in pca995x_probe()")
--- drivers/leds/leds-pca995x.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-)
drivers/leds/leds-pca995x.c +5 -10
@@ -120,7 +120,7 @@ static const struct regmap_config pca995x_regmap = {static int pca995x_probe (struct i2c_client *client) {struct fwnode_handle *led_fwnodes[PCA995X_MAX_OUTPUTS ] = {0 }; -struct fwnode_handle *np, *child; +struct fwnode_handle *child;struct device *dev = &client->dev;const struct pca995x_chipdef *chipdef;struct pca995x_chip *chip;
@@ -129,8 +129,7 @@ static int pca995x_probe(struct i2c_client *client) chipdef =device_get_match_data (&client->dev); - np =dev_fwnode (dev); -if (!np) +if (!dev_fwnode (dev))return -ENODEV ; chip =devm_kzalloc (dev,sizeof (*chip),GFP_KERNEL );
@@ -144,17 +143,13 @@ static int pca995x_probe(struct i2c_client *client)i2c_set_clientdata (client, chip); -fwnode_for_each_available_child_node (np, child) { +device_for_each_child_node (dev, child) { ret =fwnode_property_read_u32 (child,"reg" , ®); -if (ret) { -fwnode_handle_put (child); +if (ret)return ret; - } -if (reg <0 || reg >=PCA995X_MAX_OUTPUTS || led_fwnodes[reg]) { -fwnode_handle_put (child); +if (reg <0 || reg >=PCA995X_MAX_OUTPUTS || led_fwnodes[reg])return -EINVAL ; - } led = &chip->leds[reg]; led_fwnodes[reg] = child;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 290/538 leds: pca995x: Fix device child node usage in pca995x_probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
[ Upstream commit 82c5ada1f9d05902a4ccb926c7ce34e2fe699283 ]
The current implementation accesses the child fwnode handle outside of device_for_each_child_node() without incrementing its refcount.
Add the missing call to fwnode_handle_get(child).
The cleanup process where child is accessed is not right either because a single call to fwnode_handle_put() is carried out in case of an error, ignoring unasigned nodes at the point when the error happens.
Keep child inside of the first loop, and use the helper pointer that receives references via fwnode_handle_get() to handle the child nodes within the second loop. Keeping child inside the first node has also the advantage that the scoped version of the loop can be used.
--- drivers/leds/leds-pca995x.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/leds/leds-pca995x.c +5 -5
@@ -120,12 +120,11 @@ static const struct regmap_config pca995x_regmap = {static int pca995x_probe (struct i2c_client *client) {struct fwnode_handle *led_fwnodes[PCA995X_MAX_OUTPUTS ] = {0 }; -struct fwnode_handle *child;struct device *dev = &client->dev;const struct pca995x_chipdef *chipdef;struct pca995x_chip *chip;struct pca995x_led *led; -int i, reg, ret; +int i, j, reg, ret; chipdef =device_get_match_data (&client->dev);
@@ -143,7 +142,7 @@ static int pca995x_probe(struct i2c_client *client)i2c_set_clientdata (client, chip); -device_for_each_child_node (dev, child) { +device_for_each_child_node_scoped (dev, child) { ret =fwnode_property_read_u32 (child,"reg" , ®);if (ret)return ret;
@@ -152,7 +151,7 @@ static int pca995x_probe(struct i2c_client *client)return -EINVAL ; led = &chip->leds[reg]; - led_fwnodes[reg] = child; + led_fwnodes[reg] =fwnode_handle_get (child); led->chip = chip; led->led_no = reg; led->ldev.brightness_set_blocking = pca995x_brightness_set;
@@ -171,7 +170,8 @@ static int pca995x_probe(struct i2c_client *client) &chip->leds[i].ldev, &init_data);if (ret <0 ) { -fwnode_handle_put (child); +for (j = i; j <PCA995X_MAX_OUTPUTS ; j++) +fwnode_handle_put (led_fwnodes[j]);return dev_err_probe (dev, ret,"Could not register LED %s\n" , chip->leds[i].ldev.name);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 291/538 x86/PCI: Check pcie_find_root_port() return for NULL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samasth Norway Ananda <[email protected]>
[ Upstream commit dbc3171194403d0d40e4bdeae666f6e76e428b53 ]
If pcie_find_root_port() is unable to locate a Root Port, it will return NULL. Check the pointer for NULL before dereferencing it.
This particular case is in a quirk for devices that are always below a Root Port, so this won't avoid a problem and doesn't need to be backported, but check as a matter of style and to prevent copy/paste mistakes.
--- arch/x86/pci/fixup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/pci/fixup.c +2 -2
@@ -980,7 +980,7 @@ static void amd_rp_pme_suspend(struct pci_dev *dev)return ; rp =pcie_find_root_port (dev); -if (!rp->pm_cap) +if (!rp || !rp->pm_cap)return ; rp->pme_support &= ~((PCI_PM_CAP_PME_D3hot|PCI_PM_CAP_PME_D3cold) >>
@@ -994,7 +994,7 @@ static void amd_rp_pme_resume(struct pci_dev *dev)u16 pmc; rp =pcie_find_root_port (dev); -if (!rp->pm_cap) +if (!rp || !rp->pm_cap)return ;pci_read_config_word (rp, rp->pm_cap +PCI_PM_PMC , &pmc);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 292/538 nvdimm: Fix devs leaks in scan_labels()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zhijian <[email protected]>
[ Upstream commit 62c2aa6b1f565d2fc1ec11a6e9e8336ce37a6426 ]
scan_labels() leaks memory when label scanning fails and it falls back to just creating a default "seed" namespace for userspace to configure. Root can force the kernel to leak memory.
Allocate the minimum resources unconditionally and release them when unneeded to avoid the memory leak.
A kmemleak reports:
unreferenced object 0xffff88800dda1980 (size 16):
comm "kworker/u10:5", pid 69, jiffies 4294671781 hex dump (first 16 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 0):
[<00000000c5dea560>] __kmalloc+0x32c/0x470
[<000000009ed43c83>] nd_region_register_namespaces+0x6fb/0x1120 [libnvdimm]
[<000000000e07a65c>] nd_region_probe+0xfe/0x210 [libnvdimm]
[<000000007b79ce5f>] nvdimm_bus_probe+0x7a/0x1e0 [libnvdimm]
[<00000000a5f3da2e>] really_probe+0xc6/0x390
[<00000000129e2a69>] __driver_probe_device+0x78/0x150
[<000000002dfed28b>] driver_probe_device+0x1e/0x90
[<00000000e7048de2>] __device_attach_driver+0x85/0x110
[<0000000032dca295>] bus_for_each_drv+0x85/0xe0
[<00000000391c5a7d>] __device_attach+0xbe/0x1e0
[<0000000026dabec0>] bus_probe_device+0x94/0xb0
[<00000000c590d936>] device_add+0x656/0x870
[<000000003d69bfaa>] nd_async_device_register+0xe/0x50 [libnvdimm]
[<000000003f4c52a4>] async_run_entry_fn+0x2e/0x110
[<00000000e201f4b0>] process_one_work+0x1ee/0x600
[<000000006d90d5a9>] worker_thread+0x183/0x350--- drivers/nvdimm/namespace_devs.c | 34 ++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-)
drivers/nvdimm/namespace_devs.c +17 -17
@@ -1927,12 +1927,16 @@ static int cmp_dpa(const void *a, const void *b)static struct device **scan_labels (struct nd_region *nd_region) {int i, count =0 ; -struct device *dev, **devs =NULL ; +struct device *dev, **devs;struct nd_label_ent *label_ent, *e;struct nd_mapping *nd_mapping = &nd_region->mapping[0 ];struct nvdimm_drvdata *ndd =to_ndd (nd_mapping);resource_size_t map_end = nd_mapping->start + nd_mapping->size -1 ; + devs =kcalloc (2 ,sizeof (dev),GFP_KERNEL ); +if (!devs) +return NULL ; +/* "safe" because create_namespace_pmem() might list_move() label_ent */ list_for_each_entry_safe (label_ent, e, &nd_mapping->labels, list) {struct nd_namespace_label *nd_label = label_ent->label;
@@ -1951,12 +1955,14 @@ static struct device **scan_labels(struct nd_region *nd_region) goto err;if (i < count)continue ; - __devs =kcalloc (count +2 ,sizeof (dev),GFP_KERNEL ); -if (!__devs) - goto err; -memcpy (__devs, devs,sizeof (dev) * count); -kfree (devs); - devs = __devs; +if (count) { + __devs =kcalloc (count +2 ,sizeof (dev),GFP_KERNEL ); +if (!__devs) + goto err; +memcpy (__devs, devs,sizeof (dev) * count); +kfree (devs); + devs = __devs; + } dev =create_namespace_pmem (nd_region, nd_mapping, nd_label);if (IS_ERR (dev)) {
@@ -1983,11 +1989,6 @@ static struct device **scan_labels(struct nd_region *nd_region)/* Publish a zero-sized namespace for userspace to configure. */ nd_mapping_free_labels (nd_mapping); - - devs =kcalloc (2 ,sizeof (dev),GFP_KERNEL ); -if (!devs) - goto err; - nspm =kzalloc (sizeof (*nspm),GFP_KERNEL );if (!nspm) goto err;
@@ -2026,11 +2027,10 @@ static struct device **scan_labels(struct nd_region *nd_region)return devs; err: -if (devs) { -for (i =0 ; devs[i]; i++) -namespace_pmem_release (devs[i]); -kfree (devs); - } +for (i =0 ; devs[i]; i++) +namespace_pmem_release (devs[i]); +kfree (devs); +return NULL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 293/538 PCI: xilinx-nwl: Fix register misspelling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit a437027ae1730b8dc379c75fa0dd7d3036917400 ]
MSIC -> MISC
--- drivers/pci/controller/pcie-xilinx-nwl.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/pci/controller/pcie-xilinx-nwl.c +6 -6
@@ -80,8 +80,8 @@#define MSGF_MISC_SR_NON_FATAL_DEV BIT(22)#define MSGF_MISC_SR_FATAL_DEV BIT(23)#define MSGF_MISC_SR_LINK_DOWN BIT(24) -#define MSGF_MSIC_SR_LINK_AUTO_BWIDTH BIT(25) -#define MSGF_MSIC_SR_LINK_BWIDTH BIT(26) +#define MSGF_MISC_SR_LINK_AUTO_BWIDTH BIT(25) +#define MSGF_MISC_SR_LINK_BWIDTH BIT(26)#define MSGF_MISC_SR_MASKALL (MSGF_MISC_SR_RXMSG_AVAIL | \ MSGF_MISC_SR_RXMSG_OVER | \
@@ -96,8 +96,8 @@ MSGF_MISC_SR_NON_FATAL_DEV | \ MSGF_MISC_SR_FATAL_DEV | \ MSGF_MISC_SR_LINK_DOWN | \ - MSGF_MSIC_SR_LINK_AUTO_BWIDTH | \ - MSGF_MSIC_SR_LINK_BWIDTH) + MSGF_MISC_SR_LINK_AUTO_BWIDTH | \ + MSGF_MISC_SR_LINK_BWIDTH)/* Legacy interrupt status mask bits */ #define MSGF_LEG_SR_INTA BIT(0)
@@ -301,10 +301,10 @@ static irqreturn_t nwl_pcie_misc_handler(int irq, void *data)if (misc_stat &MSGF_MISC_SR_FATAL_DEV )dev_err (dev,"Fatal Error Detected\n" ); -if (misc_stat &MSGF_MSIC_SR_LINK_AUTO_BWIDTH ) +if (misc_stat &MSGF_MISC_SR_LINK_AUTO_BWIDTH )dev_info (dev,"Link Autonomous Bandwidth Management Status bit set\n" ); -if (misc_stat &MSGF_MSIC_SR_LINK_BWIDTH ) +if (misc_stat &MSGF_MISC_SR_LINK_BWIDTH )dev_info (dev,"Link Bandwidth Management Status bit set\n" );/* Clear misc interrupt status */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 294/538 PCI: xilinx-nwl: Clean up clock on probe failure/removal
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit cfd67903977b13f63340a4eb5a1cc890994f2c62 ]
Make sure we turn off the clock on probe failure and device removal.
--- drivers/pci/controller/pcie-xilinx-nwl.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-)
drivers/pci/controller/pcie-xilinx-nwl.c +19 -4
@@ -790,6 +790,7 @@ static int nwl_pcie_probe(struct platform_device *pdev)return -ENODEV ; pcie =pci_host_bridge_priv (bridge); +platform_set_drvdata (pdev, pcie); pcie->dev = dev; pcie->ecam_value =NWL_ECAM_VALUE_DEFAULT ;
@@ -813,13 +814,13 @@ static int nwl_pcie_probe(struct platform_device *pdev) err =nwl_pcie_bridge_init (pcie);if (err) {dev_err (dev,"HW Initialization failed\n" ); -return err; + goto err_clk; } err =nwl_pcie_init_irq_domain (pcie);if (err) {dev_err (dev,"Failed creating IRQ Domain\n" ); -return err; + goto err_clk; } bridge->sysdata = pcie;
@@ -829,11 +830,24 @@ static int nwl_pcie_probe(struct platform_device *pdev) err =nwl_pcie_enable_msi (pcie);if (err <0 ) {dev_err (dev,"failed to enable MSI support: %d\n" , err); -return err; + goto err_clk; } } -return pci_host_probe (bridge); + err =pci_host_probe (bridge); +if (!err) +return 0 ; + +err_clk: +clk_disable_unprepare (pcie->clk); +return err; +} + +static void nwl_pcie_remove (struct platform_device *pdev) +{ +struct nwl_pcie *pcie =platform_get_drvdata (pdev); + +clk_disable_unprepare (pcie->clk); }static struct platform_driver nwl_pcie_driver = {
@@ -843,5 +857,6 @@ static struct platform_driver nwl_pcie_driver = { .of_match_table = nwl_pcie_of_match, }, .probe = nwl_pcie_probe, + .remove_new = nwl_pcie_remove, };builtin_platform_driver (nwl_pcie_driver);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 295/538 media: platform: rzg2l-cru: rzg2l-csi2: Add missing MODULE_DEVICE_TABLE
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 07668fb0f867388bfdac0b60dbf51a4ad789f8e7 ]
The rzg2l-csi2 driver can be compiled as a module, but lacks MODULE_DEVICE_TABLE() and will therefore not be loaded automatically. Fix this.
--- drivers/media/platform/renesas/rzg2l-cru/rzg2l-csi2.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/platform/renesas/rzg2l-cru/rzg2l-csi2.c +1 -0
@@ -854,6 +854,7 @@ static const struct of_device_id rzg2l_csi2_of_table[] = { { .compatible = "renesas,rzg2l-csi2", }, {/* sentinel */ } }; +MODULE_DEVICE_TABLE (of, rzg2l_csi2_of_table);static struct platform_driver rzg2l_csi2_pdrv = { .remove_new = rzg2l_csi2_remove,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 296/538 RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Yanjun <[email protected]>
[ Upstream commit 86dfdd8288907f03c18b7fb462e0e232c4f98d89 ]
In the commit aee2424246f9 ("RDMA/iwcm: Fix a use-after-free related to destroying CM IDs"), the function flush_workqueue is invoked to flush the work queue iwcm_wq.
But at that time, the work queue iwcm_wq was created via the function alloc_ordered_workqueue without the flag WQ_MEM_RECLAIM.
Because the current process is trying to flush the whole iwcm_wq, if iwcm_wq doesn't have the flag WQ_MEM_RECLAIM, verify that the current process is not reclaiming memory or running on a workqueue which doesn't have the flag WQ_MEM_RECLAIM as that can break forward-progress guarantee leading to a deadlock.
The call trace is as below:
[ 125.350876][ T1430] Call Trace: [ 125.356281][ T1430] <TASK> [ 125.361285][ T1430] ? __warn (kernel/panic.c:693) [ 125.367640][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.375689][ T1430] ? report_bug (lib/bug.c:180 lib/bug.c:219) [ 125.382505][ T1430] ? handle_bug (arch/x86/kernel/traps.c:239) [ 125.388987][ T1430] ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1)) [ 125.395831][ T1430] ? asm_exc_invalid_op (arch/x86/include/asm/idtentry.h:621) [ 125.403125][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.410984][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.418764][ T1430] __flush_workqueue (kernel/workqueue.c:3970) [ 125.426021][ T1430] ? __pfx___might_resched (kernel/sched/core.c:10151) [ 125.433431][ T1430] ? destroy_cm_id (drivers/infiniband/core/iwcm.c:375) iw_cm [ 125.441209][ T1430] ? __pfx___flush_workqueue (kernel/workqueue.c:3910) [ 125.473900][ T1430] ? _raw_spin_lock_irqsave (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:111 kernel/locking/spinlock.c:162) [ 125.473909][ T1430] ? __pfx__raw_spin_lock_irqsave (kernel/locking/spinlock.c:161) [ 125.482537][ T1430] _destroy_id (drivers/infiniband/core/cma.c:2044) rdma_cm [ 125.495072][ T1430] nvme_rdma_free_queue (drivers/nvme/host/rdma.c:656 drivers/nvme/host/rdma.c:650) nvme_rdma [ 125.505827][ T1430] nvme_rdma_reset_ctrl_work (drivers/nvme/host/rdma.c:2180) nvme_rdma [ 125.505831][ T1430] process_one_work (kernel/workqueue.c:3231) [ 125.515122][ T1430] worker_thread (kernel/workqueue.c:3306 kernel/workqueue.c:3393) [ 125.515127][ T1430] ? __pfx_worker_thread (kernel/workqueue.c:3339) [ 125.531837][ T1430] kthread (kernel/kthread.c:389) [ 125.539864][ T1430] ? __pfx_kthread (kernel/kthread.c:342) [ 125.550628][ T1430] ret_from_fork (arch/x86/kernel/process.c:147) [ 125.558840][ T1430] ? __pfx_kthread (kernel/kthread.c:342) [ 125.558844][ T1430] ret_from_fork_asm (arch/x86/entry/entry_64.S:257) [ 125.566487][ T1430] </TASK> [ 125.566488][ T1430] ---[ end trace 0000000000000000 ]---
--- drivers/infiniband/core/iwcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/core/iwcm.c +1 -1
@@ -1191,7 +1191,7 @@ static int __init iw_cm_init(void)if (ret)return ret; - iwcm_wq =alloc_ordered_workqueue ("iw_cm_wq" ,0 ); + iwcm_wq =alloc_ordered_workqueue ("iw_cm_wq" ,WQ_MEM_RECLAIM );if (!iwcm_wq) goto err_alloc;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 297/538 pinctrl: single: fix missing error code in pcs_probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <[email protected]>
[ Upstream commit cacd8cf79d7823b07619865e994a7916fcc8ae91 ]
If pinctrl_enable() fails in pcs_probe(), it should return the error code.
--- drivers/pinctrl/pinctrl-single.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pinctrl/pinctrl-single.c +2 -1
@@ -1918,7 +1918,8 @@ static int pcs_probe(struct platform_device *pdev)dev_info (pcs->dev,"%i pins, size %u\n" , pcs->desc.npins, pcs->size); -if (pinctrl_enable (pcs->pctl)) + ret =pinctrl_enable (pcs->pctl); +if (ret) goto free;return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 298/538 clk: at91: sama7g5: Allocate only the needed amount of memory for PLLs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
[ Upstream commit 2d6e9ee7cb3e79b1713783c633b13af9aeffc90c ]
The maximum number of PLL components on SAMA7G5 is 3 (one fractional part and 2 dividers). Allocate the needed amount of memory for sama7g5_plls 2d array. Previous code used to allocate 7 array entries for each PLL. While at it, replace 3 with PLL_COMPID_MAX in the loop which parses the sama7g5_plls 2d array.
--- drivers/clk/at91/sama7g5.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/clk/at91/sama7g5.c +3 -2
@@ -66,6 +66,7 @@ enum pll_component_id {PLL_COMPID_FRAC ,PLL_COMPID_DIV0 ,PLL_COMPID_DIV1 , + PLL_COMPID_MAX, };/*
@@ -165,7 +166,7 @@ static struct sama7g5_pll {u8 t;u8 eid;u8 safe_div; -} sama7g5_plls[][PLL_ID_MAX] = { +} sama7g5_plls[][PLL_COMPID_MAX] = { [PLL_ID_CPU] = { [PLL_COMPID_FRAC] = { .n = "cpupll_fracck",
@@ -1038,7 +1039,7 @@ static void __init sama7g5_pmc_setup(struct device_node *np) sama7g5_pmc->chws[PMC_MAIN ] = hw;for (i =0 ; i <PLL_ID_MAX ; i++) { -for (j =0 ; j <3 ; j++) { +for (j =0 ; j <PLL_COMPID_MAX ; j++) {struct clk_hw *parent_hw;if (!sama7g5_plls[i][j].n)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 299/538 media: mediatek: vcodec: Fix H264 multi stateless decoder smatch warning
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunfei Dong <[email protected]>
[ Upstream commit 9be85491619f1953b8a29590ca630be571941ffa ]
Fix a smatch static checker warning on vdec_h264_req_multi_if.c. Which leads to a kernel crash when fb is NULL.
--- .../vcodec/decoder/vdec/vdec_h264_req_multi_if.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req_multi_if.c +7 -2
@@ -724,11 +724,16 @@ static int vdec_h264_slice_single_decode(void *h_vdec, struct mtk_vcodec_mem *bsreturn vpu_dec_reset (vpu); fb = inst->ctx->dev->vdec_pdata->get_cap_buffer (inst->ctx); +if (!fb) { +mtk_vdec_err (inst->ctx,"fb buffer is NULL" ); +return -ENOMEM ; + } + src_buf_info = container_of(bs, struct mtk_video_dec_buf, bs_buffer); dst_buf_info = container_of(fb, struct mtk_video_dec_buf, frame_buffer); - y_fb_dma = fb ? (u64 )fb->base_y.dma_addr :0 ; - c_fb_dma = fb ? (u64 )fb->base_c.dma_addr :0 ; + y_fb_dma = fb->base_y.dma_addr; + c_fb_dma = fb->base_c.dma_addr;mtk_vdec_debug (inst->ctx,"[h264-dec] [%d] y_dma=%llx c_dma=%llx" , inst->ctx->decoded_frame_cnt, y_fb_dma, c_fb_dma);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 300/538 media: mediatek: vcodec: Fix VP8 stateless decoder smatch warning
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunfei Dong <[email protected]>
[ Upstream commit b113bc7c0e83b32f4dd2d291a2b6c4803e0a2c44 ]
Fix a smatch static checker warning on vdec_vp8_req_if.c. Which leads to a kernel crash when fb is NULL.
--- .../mediatek/vcodec/decoder/vdec/vdec_vp8_req_if.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp8_req_if.c +7 -3
@@ -335,14 +335,18 @@ static int vdec_vp8_slice_decode(void *h_vdec, struct mtk_vcodec_mem *bs, src_buf_info = container_of(bs, struct mtk_video_dec_buf, bs_buffer); fb = inst->ctx->dev->vdec_pdata->get_cap_buffer (inst->ctx); - dst_buf_info = container_of(fb, struct mtk_video_dec_buf, frame_buffer); +if (!fb) { +mtk_vdec_err (inst->ctx,"fb buffer is NULL" ); +return -ENOMEM ; + } - y_fb_dma = fb ? (u64 )fb->base_y.dma_addr :0 ; + dst_buf_info = container_of(fb, struct mtk_video_dec_buf, frame_buffer); + y_fb_dma = fb->base_y.dma_addr;if (inst->ctx->q_data[MTK_Q_DATA_DST ].fmt->num_planes ==1 ) c_fb_dma = y_fb_dma + inst->ctx->picinfo.buf_w * inst->ctx->picinfo.buf_h;else - c_fb_dma = fb ? (u64 )fb->base_c.dma_addr :0 ; + c_fb_dma = fb->base_c.dma_addr; inst->vsi->dec.bs_dma = (u64 )bs->dma_addr; inst->vsi->dec.bs_sz = bs->size;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 301/538 media: mediatek: vcodec: Fix H264 stateless decoder smatch warning
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunfei Dong <[email protected]>
[ Upstream commit 7878d3a385efab560dce793b595447867fb163f2 ]
Fix a smatch static checker warning on vdec_h264_req_if.c. Which leads to a kernel crash when fb is NULL.
--- .../mediatek/vcodec/decoder/vdec/vdec_h264_req_if.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_h264_req_if.c +7 -2
@@ -347,11 +347,16 @@ static int vdec_h264_slice_decode(void *h_vdec, struct mtk_vcodec_mem *bs,return vpu_dec_reset (vpu); fb = inst->ctx->dev->vdec_pdata->get_cap_buffer (inst->ctx); +if (!fb) { +mtk_vdec_err (inst->ctx,"fb buffer is NULL" ); +return -ENOMEM ; + } + src_buf_info = container_of(bs, struct mtk_video_dec_buf, bs_buffer); dst_buf_info = container_of(fb, struct mtk_video_dec_buf, frame_buffer); - y_fb_dma = fb ? (u64 )fb->base_y.dma_addr :0 ; - c_fb_dma = fb ? (u64 )fb->base_c.dma_addr :0 ; + y_fb_dma = fb->base_y.dma_addr; + c_fb_dma = fb->base_c.dma_addr;mtk_vdec_debug (inst->ctx,"+ [%d] FB y_dma=%llx c_dma=%llx va=%p" , inst->num_nalu, y_fb_dma, c_fb_dma, fb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 302/538 RDMA/rtrs: Reset hb_missed_cnt after receiving other traffic from peer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Wang <[email protected]>
[ Upstream commit 3258cbbd86deaa2675e1799bc3d18bd1ef472641 ]
Reset hb_missed_cnt after receiving traffic from other peer, so hb is more robust again high load on host or network.
--- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 3 ++- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 1 + 2 files changed, 3 insertions(+), 1 deletion(-)
drivers/infiniband/ulp/rtrs/rtrs-clt.c +2 -1
@@ -626,6 +626,7 @@ static void rtrs_clt_rdma_done(struct ib_cq *cq, struct ib_wc *wc)*/ if (WARN_ON (wc->wr_cqe->done != rtrs_clt_rdma_done))return ; + clt_path->s.hb_missed_cnt =0 ;rtrs_from_imm (be32_to_cpu (wc->ex.imm_data), &imm_type, &imm_payload); if (imm_type == RTRS_IO_RSP_IMM ||
@@ -643,7 +644,6 @@ static void rtrs_clt_rdma_done(struct ib_cq *cq, struct ib_wc *wc)return rtrs_clt_recv_done (con, wc); }else if (imm_type ==RTRS_HB_ACK_IMM ) {WARN_ON (con->c.cid); - clt_path->s.hb_missed_cnt =0 ; clt_path->s.hb_cur_latency =ktime_sub (ktime_get (), clt_path->s.hb_last_sent);if (clt_path->flags &RTRS_MSG_NEW_RKEY_F )
@@ -670,6 +670,7 @@ static void rtrs_clt_rdma_done(struct ib_cq *cq, struct ib_wc *wc)/* * Key invalidations from server side */ + clt_path->s.hb_missed_cnt =0 ;WARN_ON (!(wc->wc_flags &IB_WC_WITH_INVALIDATE || wc->wc_flags &IB_WC_WITH_IMM ));WARN_ON (wc->wr_cqe->done != rtrs_clt_rdma_done);
drivers/infiniband/ulp/rtrs/rtrs-srv.c +1 -0
@@ -1229,6 +1229,7 @@ static void rtrs_srv_rdma_done(struct ib_cq *cq, struct ib_wc *wc)*/ if (WARN_ON (wc->wr_cqe != &io_comp_cqe))return ; + srv_path->s.hb_missed_cnt =0 ; err =rtrs_post_recv_empty (&con->c, &io_comp_cqe);if (err) {rtrs_err (s,"rtrs_post_recv(), err: %d\n" , err);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 303/538 RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Md Haris Iqbal <[email protected]>
[ Upstream commit 3e4289b29e216a55d08a89e126bc0b37cbad9f38 ]
In the function init_conns(), after the create_con() and create_cm() for loop if something fails. In the cleanup for loop after the destroy tag, we access out of bound memory because cid is set to clt_path->s.con_num.
This commits resets the cid to clt_path->s.con_num - 1, to stay in bounds in the cleanup loop later.
--- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/infiniband/ulp/rtrs/rtrs-clt.c +6 -0
@@ -2342,6 +2342,12 @@ static int init_conns(struct rtrs_clt_path *clt_path)if (err) goto destroy; } + +/* +* Set the cid to con_num - 1, since if we fail later, we want to stay in bounds. +*/ + cid = clt_path->s.con_num -1 ; + err =alloc_path_reqs (clt_path);if (err) goto destroy;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 304/538 clk: ti: dra7-atl: Fix leak of of_nodes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 9d6e9f10e2e031fb7bfb3030a7d1afc561a28fea ]
This fix leaking the of_node references in of_dra7_atl_clk_probe().
The docs for of_parse_phandle_with_args() say that the caller must call of_node_put() on the returned node. This adds the missing of_node_put() to fix the leak.
--- drivers/clk/ti/clk-dra7-atl.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/ti/clk-dra7-atl.c +1 -0
@@ -240,6 +240,7 @@ static int of_dra7_atl_clk_probe(struct platform_device *pdev) } clk =of_clk_get_from_provider (&clkspec); +of_node_put (clkspec.np);if (IS_ERR (clk)) {pr_err ("%s: failed to get atl clock %d from provider\n" , __func__, i);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 305/538 clk: starfive: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Liu <[email protected]>
[ Upstream commit 55c312c1b2be6d43e39c280ad6ab4b711e545b89 ]
We need to call pm_runtime_put_noidle() when pm_runtime_get_sync() fails, so use pm_runtime_resume_and_get() instead. this function will handle this.
--- drivers/clk/starfive/clk-starfive-jh7110-vout.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/starfive/clk-starfive-jh7110-vout.c +1 -1
@@ -145,7 +145,7 @@ static int jh7110_voutcrg_probe(struct platform_device *pdev)/* enable power domain and clocks */ pm_runtime_enable (priv->dev); - ret =pm_runtime_get_sync (priv->dev); + ret =pm_runtime_resume_and_get (priv->dev);if (ret <0 )return dev_err_probe (priv->dev, ret,"failed to turn on power\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 306/538 clk: rockchip: rk3588: Fix 32k clock name for pmu_24m_32k_100m_src_p
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shiyan <[email protected]>
[ Upstream commit 0d02e8d284a45bfa8997ebe8764437b8eb6b108b ]
The 32kHz input clock is named "xin32k" in the driver, so the name "32k" appears to be a typo in this case. Lets fix this.
--- drivers/clk/rockchip/clk-rk3588.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/rockchip/clk-rk3588.c +1 -1
@@ -526,7 +526,7 @@ PNAME(pmu_200m_100m_p) = { "clk_pmu1_200m_src", "clk_pmu1_100m_src" };PNAME (pmu_300m_24m_p) = {"clk_300m_src" ,"xin24m" };PNAME (pmu_400m_24m_p) = {"clk_400m_src" ,"xin24m" };PNAME (pmu_100m_50m_24m_src_p) = {"clk_pmu1_100m_src" ,"clk_pmu1_50m_src" ,"xin24m" }; -PNAME (pmu_24m_32k_100m_src_p) = {"xin24m" ,"32k" ,"clk_pmu1_100m_src" }; +PNAME (pmu_24m_32k_100m_src_p) = {"xin24m" ,"xin32k" ,"clk_pmu1_100m_src" };PNAME (hclk_pmu1_root_p) = {"clk_pmu1_200m_src" ,"clk_pmu1_100m_src" ,"clk_pmu1_50m_src" ,"xin24m" };PNAME (hclk_pmu_cm0_root_p) = {"clk_pmu1_400m_src" ,"clk_pmu1_200m_src" ,"clk_pmu1_100m_src" ,"xin24m" };PNAME (mclk_pdm0_p) = {"clk_pmu1_300m_src" ,"clk_pmu1_200m_src" };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 307/538 nfsd: remove unneeded EEXIST error check in nfsd_do_file_acquire
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit 81a95c2b1d605743220f28db04b8da13a65c4059 ]
Given that we do the search and insertion while holding the i_lock, I don't think it's possible for us to get EEXIST here. Remove this case.
--- fs/nfsd/filecache.c | 2 -- 1 file changed, 2 deletions(-)
fs/nfsd/filecache.c +0 -2
@@ -1040,8 +1040,6 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp,if (likely (ret ==0 )) goto open_file; -if (ret == -EEXIST ) - goto retry;trace_nfsd_file_insert_err (rqstp, inode, may_flags, ret); status = nfserr_jukebox; goto construction_err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 308/538 nfsd: fix refcount leak when file is unhashed after being found
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit 8a7926176378460e0d91e02b03f0ff20a8709a60 ]
If we wait_for_construction and find that the file is no longer hashed, and we're going to retry the open, the old nfsd_file reference is currently leaked. Put the reference before retrying.
--- fs/nfsd/filecache.c | 1 + 1 file changed, 1 insertion(+)
fs/nfsd/filecache.c +1 -0
@@ -1054,6 +1054,7 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp, status = nfserr_jukebox; goto construction_err; } +nfsd_file_put (nf); open_retry = false;fh_put (fhp); goto retry;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 309/538 pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Jianzheng <[email protected]>
[ Upstream commit c25478419f6fd3f74c324a21ec007cf14f2688d7 ]
When an error occurs during the execution of the function __devinit_dove_pinctrl_probe, the clk is not properly disabled.
Fix this by calling clk_disable_unprepare before return.
--- drivers/pinctrl/mvebu/pinctrl-dove.c | 42 +++++++++++++++++++--------- 1 file changed, 29 insertions(+), 13 deletions(-)
drivers/pinctrl/mvebu/pinctrl-dove.c +29 -13
@@ -767,7 +767,7 @@ static int dove_pinctrl_probe(struct platform_device *pdev)struct resource fb_res;struct mvebu_mpp_ctrl_data *mpp_data;void __iomem *base; -int i; +int i, ret; pdev->dev.platform_data = (void *)device_get_match_data (&pdev->dev);
@@ -783,13 +783,17 @@ static int dove_pinctrl_probe(struct platform_device *pdev)clk_prepare_enable (clk); base =devm_platform_get_and_ioremap_resource (pdev,0 , &mpp_res); -if (IS_ERR (base)) -return PTR_ERR (base); +if (IS_ERR (base)) { + ret =PTR_ERR (base); + goto err_probe; + } mpp_data =devm_kcalloc (&pdev->dev, dove_pinctrl_info.ncontrols,sizeof (*mpp_data),GFP_KERNEL ); -if (!mpp_data) -return -ENOMEM ; +if (!mpp_data) { + ret = -ENOMEM ; + goto err_probe; + } dove_pinctrl_info.control_data = mpp_data;for (i =0 ; i <ARRAY_SIZE (dove_mpp_controls); i++)
@@ -808,8 +812,10 @@ static int dove_pinctrl_probe(struct platform_device *pdev) } mpp4_base =devm_ioremap_resource (&pdev->dev, res); -if (IS_ERR (mpp4_base)) -return PTR_ERR (mpp4_base); +if (IS_ERR (mpp4_base)) { + ret =PTR_ERR (mpp4_base); + goto err_probe; + } res =platform_get_resource (pdev,IORESOURCE_MEM ,2 );if (!res) {
@@ -820,8 +826,10 @@ static int dove_pinctrl_probe(struct platform_device *pdev) } pmu_base =devm_ioremap_resource (&pdev->dev, res); -if (IS_ERR (pmu_base)) -return PTR_ERR (pmu_base); +if (IS_ERR (pmu_base)) { + ret =PTR_ERR (pmu_base); + goto err_probe; + } gconfmap =syscon_regmap_lookup_by_compatible ("marvell,dove-global-config" );if (IS_ERR (gconfmap)) {
@@ -831,12 +839,17 @@ static int dove_pinctrl_probe(struct platform_device *pdev)adjust_resource (&fb_res, (mpp_res->start &INT_REGS_MASK ) +GC_REGS_OFFS ,0x14 ); gc_base =devm_ioremap_resource (&pdev->dev, &fb_res); -if (IS_ERR (gc_base)) -return PTR_ERR (gc_base); +if (IS_ERR (gc_base)) { + ret =PTR_ERR (gc_base); + goto err_probe; + } + gconfmap =devm_regmap_init_mmio (&pdev->dev, gc_base, &gc_regmap_config); -if (IS_ERR (gconfmap)) -return PTR_ERR (gconfmap); +if (IS_ERR (gconfmap)) { + ret =PTR_ERR (gconfmap); + goto err_probe; + } }/* Warn on any missing DT resource */
@@ -844,6 +857,9 @@ static int dove_pinctrl_probe(struct platform_device *pdev)dev_warn (&pdev->dev,FW_BUG "Missing pinctrl regs in DTB. Please update your firmware.\n" );return mvebu_pinctrl_probe (pdev); +err_probe: +clk_disable_unprepare (clk); +return ret; }static struct platform_driver dove_pinctrl_driver = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 310/538 IB/core: Fix ib_cache_setup_one error flow cleanup
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <[email protected]>
[ Upstream commit 1403c8b14765eab805377dd3b75e96ace8747aed ]
When ib_cache_update return an error, we exit ib_cache_setup_one instantly with no proper cleanup, even though before this we had already successfully done gid_table_setup_one, that results in the kernel WARN below.
Do proper cleanup using gid_table_cleanup_one before returning the err in order to fix the issue.
WARNING: CPU: 4 PID: 922 at drivers/infiniband/core/cache.c:806 gid_table_release_one+0x181/0x1a0 Modules linked in: CPU: 4 UID: 0 PID: 922 Comm: c_repro Not tainted 6.11.0-rc1+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:gid_table_release_one+0x181/0x1a0 Code: 44 8b 38 75 0c e8 2f cb 34 ff 4d 8b b5 28 05 00 00 e8 23 cb 34 ff 44 89 f9 89 da 4c 89 f6 48 c7 c7 d0 58 14 83 e8 4f de 21 ff <0f> 0b 4c 8b 75 30 e9 54 ff ff ff 48 8 3 c4 10 5b 5d 41 5c 41 5d 41 RSP: 0018:ffffc90002b835b0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff811c8527 RDX: 0000000000000000 RSI: ffffffff811c8534 RDI: 0000000000000001 RBP: ffff8881011b3d00 R08: ffff88810b3abe00 R09: 205d303839303631 R10: 666572207972746e R11: 72746e6520444947 R12: 0000000000000001 R13: ffff888106390000 R14: ffff8881011f2110 R15: 0000000000000001 FS: 00007fecc3b70800(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000340 CR3: 000000010435a001 CR4: 00000000003706b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? show_regs+0x94/0xa0 ? __warn+0x9e/0x1c0 ? gid_table_release_one+0x181/0x1a0 ? report_bug+0x1f9/0x340 ? gid_table_release_one+0x181/0x1a0 ? handle_bug+0xa2/0x110 ? exc_invalid_op+0x31/0xa0 ? asm_exc_invalid_op+0x16/0x20 ? __warn_printk+0xc7/0x180 ? __warn_printk+0xd4/0x180 ? gid_table_release_one+0x181/0x1a0 ib_device_release+0x71/0xe0 ? __pfx_ib_device_release+0x10/0x10 device_release+0x44/0xd0 kobject_put+0x135/0x3d0 put_device+0x20/0x30 rxe_net_add+0x7d/0xa0 rxe_newlink+0xd7/0x190 nldev_newlink+0x1b0/0x2a0 ? __pfx_nldev_newlink+0x10/0x10 rdma_nl_rcv_msg+0x1ad/0x2e0 rdma_nl_rcv_skb.constprop.0+0x176/0x210 netlink_unicast+0x2de/0x400 netlink_sendmsg+0x306/0x660 __sock_sendmsg+0x110/0x120 ____sys_sendmsg+0x30e/0x390 ___sys_sendmsg+0x9b/0xf0 ? kstrtouint+0x6e/0xa0 ? kstrtouint_from_user+0x7c/0xb0 ? get_pid_task+0xb0/0xd0 ? proc_fail_nth_write+0x5b/0x140 ? __fget_light+0x9a/0x200 ? preempt_count_add+0x47/0xa0 __sys_sendmsg+0x61/0xd0 do_syscall_64+0x50/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e
--- drivers/infiniband/core/cache.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/infiniband/core/cache.c +3 -1
@@ -1640,8 +1640,10 @@ int ib_cache_setup_one(struct ib_device *device) rdma_for_each_port (device, p) { err =ib_cache_update (device, p, true, true, true); -if (err) +if (err) { +gid_table_cleanup_one (device);return err; + } }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 311/538 PCI: kirin: Fix buffer overflow in kirin_pcie_parse_port()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandra Diupina <[email protected]>
[ Upstream commit c500a86693a126c9393e602741e348f80f1b0fc5 ]
Within kirin_pcie_parse_port(), the pcie->num_slots is compared to pcie->gpio_id_reset size (MAX_PCI_SLOTS) which is correct and would lead to an overflow.
Thus, fix condition to pcie->num_slots + 1 >= MAX_PCI_SLOTS and move pcie->num_slots increment below the if-statement to avoid out-of-bounds array access.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/pci/controller/dwc/pcie-kirin.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/controller/dwc/pcie-kirin.c +2 -2
@@ -415,12 +415,12 @@ static int kirin_pcie_parse_port(struct kirin_pcie *pcie,if (pcie->gpio_id_reset[i] <0 )continue ; - pcie->num_slots++; -if (pcie->num_slots >MAX_PCI_SLOTS ) { +if (pcie->num_slots +1 >=MAX_PCI_SLOTS ) {dev_err (dev,"Too many PCI slots!\n" ); ret = -EINVAL ; goto put_node; } + pcie->num_slots++; ret =of_pci_get_devfn (child);if (ret <0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 312/538 RDMA/erdma: Return QP state in erdma_query_qp
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cheng Xu <[email protected]>
[ Upstream commit e77127ff6416b17e0b3e630ac46ee5c9a6570f57 ]
Fix qp_state and cur_qp_state to return correct values in struct ib_qp_attr.
--- drivers/infiniband/hw/erdma/erdma_verbs.c | 25 ++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-)
drivers/infiniband/hw/erdma/erdma_verbs.c +24 -1
@@ -1540,11 +1540,31 @@ int erdma_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask,return ret; } +static enum ib_qp_state query_qp_state (struct erdma_qp *qp) +{ +switch (qp->attrs.state) { +case ERDMA_QP_STATE_IDLE : +return IB_QPS_INIT ; +case ERDMA_QP_STATE_RTR : +return IB_QPS_RTR ; +case ERDMA_QP_STATE_RTS : +return IB_QPS_RTS ; +case ERDMA_QP_STATE_CLOSING : +return IB_QPS_ERR ; +case ERDMA_QP_STATE_TERMINATE : +return IB_QPS_ERR ; +case ERDMA_QP_STATE_ERROR : +return IB_QPS_ERR ; +default : +return IB_QPS_ERR ; + } +} +int erdma_query_qp (struct ib_qp *ibqp,struct ib_qp_attr *qp_attr,int qp_attr_mask,struct ib_qp_init_attr *qp_init_attr) { -struct erdma_qp *qp;struct erdma_dev *dev; +struct erdma_qp *qp;if (ibqp && qp_attr && qp_init_attr) { qp =to_eqp (ibqp);
@@ -1571,6 +1591,9 @@ int erdma_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr, qp_init_attr->cap = qp_attr->cap; + qp_attr->qp_state =query_qp_state (qp); + qp_attr->cur_qp_state =query_qp_state (qp); +return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 313/538 RDMA/mlx5: Limit usage of over-sized mkeys from the MR cache
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Guralnik <[email protected]>
[ Upstream commit ee6d57a2e13d11ce9050cfc3e3b69ef707a44a63 ]
When searching the MR cache for suitable cache entries, don't use mkeys larger than twice the size required for the MR.
This should ensure the usage of mkeys closer to the minimal required size and reduce memory waste.
On driver init we create entries for mkeys with clear attributes and powers of 2 sizes from 4 to the max supported size.
This solves the issue for anyone using mkeys that fit these requirements.
In the use case where an MR is registered with different attributes, like an access flag we can't UMR, we'll create a new cache entry to store it upon dereg.
Without this fix, any later registration with same attributes and smaller size will use the newly created cache entry and it's mkeys, disregarding the memory waste of using mkeys larger than required.
For example, one worst-case scenario can be when registering and deregistering a 1GB mkey with ATS enabled which will cause the creation of a new cache entry to hold those type of mkeys. A user registering a 4k MR with ATS will end up using the new cache entry and an mkey that can support a 1GB MR, thus wasting x250k memory than actually needed in the HW.
Additionally, allow all small registration to use the smallest size cache entry that is initialized on driver load even if size is larger than twice the required size.
--- drivers/infiniband/hw/mlx5/mr.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/infiniband/hw/mlx5/mr.c +12 -2
@@ -48,6 +48,7 @@ enum { MAX_PENDING_REG_MR = 8, }; +#define MLX5_MR_CACHE_PERSISTENT_ENTRY_MIN_DESCS 4#define MLX5_UMR_ALIGN 2048 static void
@@ -715,6 +716,7 @@ mkey_cache_ent_from_rb_key(struct mlx5_ib_dev *dev, {struct rb_node *node = dev->cache.rb_root.rb_node;struct mlx5_cache_ent *cur, *smallest =NULL ; +u64 ndescs_limit;int cmp;/*
@@ -733,10 +735,18 @@ mkey_cache_ent_from_rb_key(struct mlx5_ib_dev *dev,return cur; } +/* +* Limit the usage of mkeys larger than twice the required size while +* also allowing the usage of smallest cache entry for small MRs. +*/ + ndescs_limit =max_t (u64, rb_key.ndescs *2 , +MLX5_MR_CACHE_PERSISTENT_ENTRY_MIN_DESCS ); +return (smallest && smallest->rb_key.access_mode == rb_key.access_mode && smallest->rb_key.access_flags == rb_key.access_flags && - smallest->rb_key.ats == rb_key.ats) ? + smallest->rb_key.ats == rb_key.ats && + smallest->rb_key.ndescs <= ndescs_limit) ? smallest :NULL ; }
@@ -986,7 +996,7 @@ int mlx5_mkey_cache_init(struct mlx5_ib_dev *dev)mlx5_mkey_cache_debugfs_init (dev);mutex_lock (&cache->rb_lock);for (i =0 ; i <=mkey_cache_max_order (dev); i++) { - rb_key.ndescs =1 << (i +2 ); + rb_key.ndescs =MLX5_MR_CACHE_PERSISTENT_ENTRY_MIN_DESCS << i; ent =mlx5r_cache_create_ent_locked (dev, rb_key, true);if (IS_ERR (ent)) { ret =PTR_ERR (ent);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 314/538 watchdog: imx_sc_wdt: Dont disable WDT in suspend
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Blixt <[email protected]>
[ Upstream commit 2d9d6d300fb0a4ae4431bb308027ac9385746d42 ]
Parts of the suspend and resume chain is left unprotected if we disable the WDT here.
Quoted 1 line
From experiments we can see that the SCU disables and re-enables the WDT
when we enter and leave suspend to ram. By not touching the WDT here we are protected by the WDT all the way to the SCU.
--- drivers/watchdog/imx_sc_wdt.c | 24 ------------------------ 1 file changed, 24 deletions(-)
drivers/watchdog/imx_sc_wdt.c +0 -24
@@ -213,29 +213,6 @@ static int imx_sc_wdt_probe(struct platform_device *pdev)return devm_watchdog_register_device (dev, wdog); } -static int __maybe_unused imx_sc_wdt_suspend (struct device *dev) -{ -struct imx_sc_wdt_device *imx_sc_wdd =dev_get_drvdata (dev); - -if (watchdog_active (&imx_sc_wdd->wdd)) -imx_sc_wdt_stop (&imx_sc_wdd->wdd); - -return 0 ; -} - -static int __maybe_unused imx_sc_wdt_resume (struct device *dev) -{ -struct imx_sc_wdt_device *imx_sc_wdd =dev_get_drvdata (dev); - -if (watchdog_active (&imx_sc_wdd->wdd)) -imx_sc_wdt_start (&imx_sc_wdd->wdd); - -return 0 ; -} - -static SIMPLE_DEV_PM_OPS(imx_sc_wdt_pm_ops, - imx_sc_wdt_suspend, imx_sc_wdt_resume); -static const struct of_device_id imx_sc_wdt_dt_ids[] = { { .compatible ="fsl,imx-sc-wdt" , }, {/* sentinel */ }
@@ -247,7 +224,6 @@ static struct platform_driver imx_sc_wdt_driver = { .driver = { .name = "imx-sc-wdt", .of_match_table = imx_sc_wdt_dt_ids, - .pm = &imx_sc_wdt_pm_ops, }, };module_platform_driver (imx_sc_wdt_driver);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 315/538 RDMA/hns: Dont modify rq next block addr in HIP09 QPC
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxian Huang <[email protected]>
[ Upstream commit 6928d264e328e0cb5ee7663003a6e46e4cba0a7e ]
The field 'rq next block addr' in QPC can be updated by driver only on HIP08. On HIP09 HW updates this field while driver is not allowed.
--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +8 -6
@@ -4391,12 +4391,14 @@ static int config_qp_rq_buf(struct hns_roce_dev *hr_dev, upper_32_bits(to_hr_hw_page_addr(mtts[0])));hr_reg_clear (qpc_mask,QPC_RQ_CUR_BLK_ADDR_H ); - context->rq_nxt_blk_addr =cpu_to_le32 (to_hr_hw_page_addr (mtts[1 ])); - qpc_mask->rq_nxt_blk_addr =0 ; - -hr_reg_write (context,QPC_RQ_NXT_BLK_ADDR_H , -upper_32_bits (to_hr_hw_page_addr (mtts[1 ]))); -hr_reg_clear (qpc_mask,QPC_RQ_NXT_BLK_ADDR_H ); +if (hr_dev->pci_dev->revision ==PCI_REVISION_ID_HIP08 ) { + context->rq_nxt_blk_addr = +cpu_to_le32 (to_hr_hw_page_addr (mtts[1 ])); + qpc_mask->rq_nxt_blk_addr =0 ; +hr_reg_write (context,QPC_RQ_NXT_BLK_ADDR_H , +upper_32_bits (to_hr_hw_page_addr (mtts[1 ]))); +hr_reg_clear (qpc_mask,QPC_RQ_NXT_BLK_ADDR_H ); + }return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 316/538 RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: wenglianfa <[email protected]>
[ Upstream commit fd8489294dd2beefb70f12ec4f6132aeec61a4d0 ]
Currently rsv_qp is freed before ib_unregister_device() is called on HIP08. During the time interval, users can still dereg MR and rsv_qp will be used in this process, leading to a UAF. Move the release of rsv_qp after calling ib_unregister_device() to fix it.
--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +3 -3
@@ -2932,6 +2932,9 @@ static int hns_roce_v2_init(struct hns_roce_dev *hr_dev)static void hns_roce_v2_exit (struct hns_roce_dev *hr_dev) { +if (hr_dev->pci_dev->revision ==PCI_REVISION_ID_HIP08 ) +free_mr_exit (hr_dev); +hns_roce_function_clear (hr_dev);if (!hr_dev->is_vf)
@@ -6779,9 +6782,6 @@ static void __hns_roce_hw_v2_uninit_instance(struct hnae3_handle *handle, hr_dev->state =HNS_ROCE_DEVICE_STATE_UNINIT ;hns_roce_handle_device_err (hr_dev); -if (hr_dev->pci_dev->revision ==PCI_REVISION_ID_HIP08 ) -free_mr_exit (hr_dev); -hns_roce_exit (hr_dev);kfree (hr_dev->priv);ib_dealloc_device (&hr_dev->ib_dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 317/538 RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: wenglianfa <[email protected]>
[ Upstream commit d586628b169d14bbf36be64d2b3ec9d9d2fe0432 ]
The max value of 'unit' and 'hop_num' is 2^24 and 2, so the value of 'step' may exceed the range of u32. Change the type of 'step' to u64.
--- drivers/infiniband/hw/hns/hns_roce_hem.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hem.c +6 -6
@@ -1098,9 +1098,9 @@ static bool hem_list_is_bottom_bt(int hopnum, int bt_level)* @bt_level: base address table level * @unit: ba entries per bt page */ -static u32 hem_list_calc_ba_range (int hopnum,int bt_level,int unit) +static u64 hem_list_calc_ba_range (int hopnum,int bt_level,int unit) { -u32 step; +u64 step;int max;int i;
@@ -1136,7 +1136,7 @@ int hns_roce_hem_list_calc_root_ba(const struct hns_roce_buf_region *regions, {struct hns_roce_buf_region *r;int total =0 ; -int step; +u64 step;int i;for (i =0 ; i < region_cnt; i++) {
@@ -1167,7 +1167,7 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev,int ret =0 ;int max_ofs;int level; -u32 step; +u64 step;int end;if (hopnum <=1 )
@@ -1204,7 +1204,7 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev, } start_aligned = (distance / step) * step + r->offset; - end =min_t (int, start_aligned + step -1 , max_ofs); + end =min_t (u64, start_aligned + step -1 , max_ofs); cur =hem_list_alloc_item (hr_dev, start_aligned, end, unit, true);if (!cur) {
@@ -1293,7 +1293,7 @@ static int setup_middle_bt(struct hns_roce_dev *hr_dev, void *cpu_base,struct hns_roce_hem_item *hem, *temp_hem;int total =0 ;int offset; -int step; +u64 step; step =hem_list_calc_ba_range (r->hopnum,1 , unit);if (step <1 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 318/538 RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengchang Tang <[email protected]>
[ Upstream commit 74d315b5af180220d561684d15897730135733a6 ]
Fix missuse of spin_lock_irq()/spin_unlock_irq() when spin_lock_irqsave()/spin_lock_irqrestore() was hold.
This was discovered through the lock debugging, and the corresponding log is as follows:
raw_local_irq_restore() called with IRQs enabled
WARNING: CPU: 96 PID: 2074 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x30/0x40 ... Call trace: warn_bogus_irq_restore+0x30/0x40 _raw_spin_unlock_irqrestore+0x84/0xc8 add_qp_to_list+0x11c/0x148 [hns_roce_hw_v2] hns_roce_create_qp_common.constprop.0+0x240/0x780 [hns_roce_hw_v2] hns_roce_create_qp+0x98/0x160 [hns_roce_hw_v2] create_qp+0x138/0x258 ib_create_qp_kernel+0x50/0xe8 create_mad_qp+0xa8/0x128 ib_mad_port_open+0x218/0x448 ib_mad_init_device+0x70/0x1f8 add_client_context+0xfc/0x220 enable_device_and_get+0xd0/0x140 ib_register_device.part.0+0xf4/0x1c8 ib_register_device+0x34/0x50 hns_roce_register_device+0x174/0x3d0 [hns_roce_hw_v2] hns_roce_init+0xfc/0x2c0 [hns_roce_hw_v2] __hns_roce_hw_v2_init_instance+0x7c/0x1d0 [hns_roce_hw_v2] hns_roce_hw_v2_init_instance+0x9c/0x180 [hns_roce_hw_v2]
--- drivers/infiniband/hw/hns/hns_roce_qp.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/infiniband/hw/hns/hns_roce_qp.c +8 -8
@@ -1379,19 +1379,19 @@ void hns_roce_lock_cqs(struct hns_roce_cq *send_cq, struct hns_roce_cq *recv_cq)__acquire (&send_cq->lock);__acquire (&recv_cq->lock); }else if (unlikely (send_cq !=NULL && recv_cq ==NULL )) { -spin_lock_irq (&send_cq->lock); +spin_lock (&send_cq->lock);__acquire (&recv_cq->lock); }else if (unlikely (send_cq ==NULL && recv_cq !=NULL )) { -spin_lock_irq (&recv_cq->lock); +spin_lock (&recv_cq->lock);__acquire (&send_cq->lock); }else if (send_cq == recv_cq) { -spin_lock_irq (&send_cq->lock); +spin_lock (&send_cq->lock);__acquire (&recv_cq->lock); }else if (send_cq->cqn < recv_cq->cqn) { -spin_lock_irq (&send_cq->lock); +spin_lock (&send_cq->lock);spin_lock_nested (&recv_cq->lock,SINGLE_DEPTH_NESTING ); }else { -spin_lock_irq (&recv_cq->lock); +spin_lock (&recv_cq->lock);spin_lock_nested (&send_cq->lock,SINGLE_DEPTH_NESTING ); } }
@@ -1411,13 +1411,13 @@ void hns_roce_unlock_cqs(struct hns_roce_cq *send_cq,spin_unlock (&recv_cq->lock); }else if (send_cq == recv_cq) {__release (&recv_cq->lock); -spin_unlock_irq (&send_cq->lock); +spin_unlock (&send_cq->lock); }else if (send_cq->cqn < recv_cq->cqn) {spin_unlock (&recv_cq->lock); -spin_unlock_irq (&send_cq->lock); +spin_unlock (&send_cq->lock); }else {spin_unlock (&send_cq->lock); -spin_unlock_irq (&recv_cq->lock); +spin_unlock (&recv_cq->lock); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 319/538 RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxian Huang <[email protected]>
[ Upstream commit 4321feefa5501a746ebf6a7d8b59e6b955ae1860 ]
In abnormal interrupt handler, a PF reset will be triggered even if the device is a VF. It should be a VF reset.
--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +5 -2
@@ -6070,6 +6070,7 @@ static irqreturn_t abnormal_interrupt_basic(struct hns_roce_dev *hr_dev,struct pci_dev *pdev = hr_dev->pci_dev;struct hnae3_ae_dev *ae_dev =pci_get_drvdata (pdev);const struct hnae3_ae_ops *ops = ae_dev->ops; +enum hnae3_reset_type reset_type;irqreturn_t int_work =IRQ_NONE ;u32 int_en;
@@ -6081,10 +6082,12 @@ static irqreturn_t abnormal_interrupt_basic(struct hns_roce_dev *hr_dev,roce_write (hr_dev,ROCEE_VF_ABN_INT_ST_REG ,1 <<HNS_ROCE_V2_VF_INT_ST_AEQ_OVERFLOW_S ); + reset_type = hr_dev->is_vf ? +HNAE3_VF_FUNC_RESET :HNAE3_FUNC_RESET ; +/* Set reset level for reset_event() */ if (ops->set_default_reset_request) - ops->set_default_reset_request (ae_dev, -HNAE3_FUNC_RESET ); + ops->set_default_reset_request (ae_dev, reset_type);if (ops->reset_event) ops->reset_event (pdev,NULL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 320/538 RDMA/hns: Fix 1bit-ECC recovery address in non-4K OS
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengchang Tang <[email protected]>
[ Upstream commit ce196f6297c7f3ab7780795e40efd6c521f60c8b ]
The 1bit-ECC recovery address read from HW only contain bits 64:12, so it should be fixed left-shifted 12 bits when used.
Currently, the driver will shift the address left by PAGE_SHIFT when used, which is wrong in non-4K OS.
--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +1 -1
@@ -6157,7 +6157,7 @@ static u64 fmea_get_ram_res_addr(u32 res_type, __le64 *data) res_type == ECC_RESOURCE_SCCC)return le64_to_cpu (*data); -return le64_to_cpu (*data) <<PAGE_SHIFT ; +return le64_to_cpu (*data) <<HNS_HW_PAGE_SHIFT ; } static int fmea_recover_others(struct hns_roce_dev *hr_dev, u32 res_type,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 321/538 RDMA/hns: Optimize hem allocation performance
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxian Huang <[email protected]>
[ Upstream commit fe51f6254d81f5a69c31df16353d6539b2b51630 ]
When allocating MTT hem, for each hop level of each hem that is being allocated, the driver iterates the hem list to find out whether the bt page has been allocated in this hop level. If not, allocate a new one and splice it to the list. The time complexity is O(n^2) in worst cases.
Currently the allocation for-loop uses 'unit' as the step size. This actually has taken into account the reuse of last-hop-level MTT bt pages by multiple buffer pages. Thus pages of last hop level will never have been allocated, so there is no need to iterate the hem list in last hop level.
Removing this unnecessary iteration can reduce the time complexity to O(n).
--- drivers/infiniband/hw/hns/hns_roce_hem.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hem.c +6 -4
@@ -1191,10 +1191,12 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev,/* config L1 bt to last bt and link them to corresponding parent */ for (level =1 ; level < hopnum; level++) { - cur =hem_list_search_item (&mid_bt[level], offset); -if (cur) { - hem_ptrs[level] = cur; -continue ; +if (!hem_list_is_bottom_bt (hopnum, level)) { + cur =hem_list_search_item (&mid_bt[level], offset); +if (cur) { + hem_ptrs[level] = cur; +continue ; + } } step =hem_list_calc_ba_range (hopnum, level, unit);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 322/538 RDMA/hns: Fix restricted __le16 degrades to integer issue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxian Huang <[email protected]>
[ Upstream commit f4ccc0a2a0c5977540f519588636b5bc81aae2db ]
Fix sparse warnings: restricted __le16 degrades to integer.
--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +2 -2
@@ -1653,8 +1653,8 @@ static int hns_roce_hw_v2_query_counter(struct hns_roce_dev *hr_dev,for (i =0 ; i <HNS_ROCE_HW_CNT_TOTAL && i < *num_counters; i++) { bd_idx = i /CNT_PER_DESC ; -if (!(desc[bd_idx].flag &HNS_ROCE_CMD_FLAG_NEXT ) && - bd_idx !=HNS_ROCE_HW_CNT_TOTAL /CNT_PER_DESC ) +if (bd_idx !=HNS_ROCE_HW_CNT_TOTAL /CNT_PER_DESC && + !(desc[bd_idx].flag &cpu_to_le16 (HNS_ROCE_CMD_FLAG_NEXT )))break ; cnt_data = (__le64 *)&desc[bd_idx].data[0 ];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 323/538 RDMA/mlx5: Obtain upper net device only when needed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Bloch <[email protected]>
[ Upstream commit 3ed7f9e239938a0cfaf3689e2f545229ecabec06 ]
Report the upper device's state as the RDMA port state only in RoCE LAG or switchdev LAG.
--- drivers/infiniband/hw/mlx5/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/mlx5/main.c +1 -1
@@ -539,7 +539,7 @@ static int mlx5_query_port_roce(struct ib_device *device, u32 port_num,if (!ndev) goto out; -if (dev->lag_active) { +if (mlx5_lag_is_roce (mdev) ||mlx5_lag_is_sriov (mdev)) {rcu_read_lock (); upper =netdev_master_upper_dev_get_rcu (ndev);if (upper) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 324/538 riscv: Fix fp alignment bug in perf_callchain_user()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 22ab08955ea13be04a8efd20cc30890e0afaa49c ]
The standard RISC-V calling convention said:
"The stack grows downward and the stack pointer is always kept 16-byte aligned".
So perf_callchain_user() should check whether 16-byte aligned for fp.
--- arch/riscv/kernel/perf_callchain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/kernel/perf_callchain.c +1 -1
@@ -62,7 +62,7 @@ void perf_callchain_user(struct perf_callchain_entry_ctx *entry,perf_callchain_store (entry, regs->epc); fp =user_backtrace (entry, fp, regs->ra); -while (fp && !(fp &0x3 ) && entry->nr < entry->max_stack) +while (fp && !(fp &0x7 ) && entry->nr < entry->max_stack) fp =user_backtrace (entry, fp,0 ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 325/538 RDMA/cxgb4: Added NULL check for lookup_atid
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Lobanov <[email protected]>
[ Upstream commit e766e6a92410ca269161de059fff0843b8ddd65f ]
The lookup_atid() function can return NULL if the ATID is invalid or does not exist in the identifier table, which could lead to dereferencing a null pointer without a check in the act_establish() and act_open_rpl() functions. Add a NULL check to prevent null pointer dereferencing.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/infiniband/hw/cxgb4/cm.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/infiniband/hw/cxgb4/cm.c +5 -0
@@ -1222,6 +1222,8 @@ static int act_establish(struct c4iw_dev *dev, struct sk_buff *skb)int ret; ep =lookup_atid (t, atid); +if (!ep) +return -EINVAL ;pr_debug ("ep %p tid %u snd_isn %u rcv_isn %u\n" , ep, tid,be32_to_cpu (req->snd_isn),be32_to_cpu (req->rcv_isn));
@@ -2279,6 +2281,9 @@ static int act_open_rpl(struct c4iw_dev *dev, struct sk_buff *skb)int ret =0 ; ep =lookup_atid (t, atid); +if (!ep) +return -EINVAL ; + la = (struct sockaddr_in *)&ep->com.local_addr; ra = (struct sockaddr_in *)&ep->com.remote_addr; la6 = (struct sockaddr_in6 *)&ep->com.local_addr;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 326/538 RDMA/irdma: fix error message in irdma_modify_qp_roce()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaliy Shevtsov <[email protected]>
[ Upstream commit 9f0eafe86ea0a589676209d0cff1a1ed49a037d3 ]
Use a correct field max_dest_rd_atomic instead of max_rd_atomic for the error output.
Found by Linux Verification Center (linuxtesting.org) with Svace.
--- drivers/infiniband/hw/irdma/verbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/irdma/verbs.c +1 -1
@@ -1347,7 +1347,7 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr,if (attr->max_dest_rd_atomic > dev->hw_attrs.max_hw_ird) {ibdev_err (&iwdev->ibdev,"rd_atomic = %d, above max_hw_ird=%d\n" , - attr->max_rd_atomic, + attr->max_dest_rd_atomic, dev->hw_attrs.max_hw_ird);return -EINVAL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 327/538 ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit e229897d373a87ee09ec5cc4ecd4bb2f895fc16b ]
The debugfs_create_dir() function returns error pointers. It never returns NULL. So use IS_ERR() to check it.
--- drivers/ntb/hw/intel/ntb_hw_gen1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ntb/hw/intel/ntb_hw_gen1.c +1 -1
@@ -778,7 +778,7 @@ static void ndev_init_debugfs(struct intel_ntb_dev *ndev) ndev->debugfs_dir =debugfs_create_dir (pci_name (ndev->ntb.pdev), debugfs_dir); -if (!ndev->debugfs_dir) +if (IS_ERR (ndev->debugfs_dir)) ndev->debugfs_info =NULL ;else ndev->debugfs_info =
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 328/538 ntb_perf: Fix printk format
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Hawking <[email protected]>
[ Upstream commit 1501ae7479c8d0f66efdbfdc9ae8d6136cefbd37 ]
The correct printk format is %pa or %pap, but not %pa[p].
--- drivers/ntb/test/ntb_perf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ntb/test/ntb_perf.c +1 -1
@@ -1227,7 +1227,7 @@ static ssize_t perf_dbgfs_read_info(struct file *filep, char __user *ubuf, "\tOut buffer addr 0x%pK\n", peer->outbuf); pos +=scnprintf (buf + pos, buf_size - pos, -"\tOut buff phys addr %pa[p]\n" , &peer->out_phys_addr); +"\tOut buff phys addr %pap\n" , &peer->out_phys_addr); pos +=scnprintf (buf + pos, buf_size - pos,"\tOut buffer size %pa\n" , &peer->outbuf_size);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 329/538 ntb: Force physically contiguous allocation of rx ring buffers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <[email protected]>
[ Upstream commit 061a785a114f159e990ea8ed8d1b7dca4b41120f ]
Physical addresses under IOVA on x86 platform are mapped contiguously as a side effect before the patch that removed CONFIG_DMA_REMAP. The NTB rx buffer ring is a single chunk DMA buffer that is allocated against the NTB PCI device. If the receive side is using a DMA device, then the buffers are remapped against the DMA device before being submitted via the dmaengine API. This scheme becomes a problem when the physical memory is discontiguous. When dma_map_page() is called on the kernel virtual address from the dma_alloc_coherent() call, the new IOVA mapping no longer points to all the physical memory allocated due to being discontiguous. Change dma_alloc_coherent() to dma_alloc_attrs() in order to force DMA_ATTR_FORCE_CONTIGUOUS attribute. This is the best fix for the circumstance. A potential future solution may be having the DMA mapping API providing a way to alias an existing IOVA mapping to a new device perhaps.
This fix is not to fix the patch pointed to by the fixes tag, but to fix the issue arised in the ntb_transport driver on x86 platforms after the said patch is applied.
--- drivers/ntb/ntb_transport.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-)
drivers/ntb/ntb_transport.c +18 -5
@@ -807,16 +807,29 @@ static void ntb_free_mw(struct ntb_transport_ctx *nt, int num_mw) }static int ntb_alloc_mw_buffer (struct ntb_transport_mw *mw, -struct device *dma_dev,size_t align) +struct device *ntb_dev,size_t align) {dma_addr_t dma_addr;void *alloc_addr, *virt_addr;int rc; - alloc_addr =dma_alloc_coherent (dma_dev, mw->alloc_size, - &dma_addr,GFP_KERNEL ); +/* +* The buffer here is allocated against the NTB device. The reason to +* use dma_alloc_*() call is to allocate a large IOVA contiguous buffer +* backing the NTB BAR for the remote host to write to. During receive +* processing, the data is being copied out of the receive buffer to +* the kernel skbuff. When a DMA device is being used, dma_map_page() +* is called on the kvaddr of the receive buffer (from dma_alloc_*()) +* and remapped against the DMA device. It appears to be a double +* DMA mapping of buffers, but first is mapped to the NTB device and +* second is to the DMA device. DMA_ATTR_FORCE_CONTIGUOUS is necessary +* in order for the later dma_map_page() to not fail. +*/ + alloc_addr =dma_alloc_attrs (ntb_dev, mw->alloc_size, + &dma_addr,GFP_KERNEL , +DMA_ATTR_FORCE_CONTIGUOUS );if (!alloc_addr) { -dev_err (dma_dev,"Unable to alloc MW buff of size %zu\n" , +dev_err (ntb_dev,"Unable to alloc MW buff of size %zu\n" , mw->alloc_size);return -ENOMEM ; }
@@ -845,7 +858,7 @@ static int ntb_alloc_mw_buffer(struct ntb_transport_mw *mw,return 0 ; err: -dma_free_coherent (dma_dev, mw->alloc_size, alloc_addr, dma_addr); +dma_free_coherent (ntb_dev, mw->alloc_size, alloc_addr, dma_addr);return rc; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 330/538 nfsd: call cache_put if xdr_reserve_space returns NULL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoqing Jiang <[email protected]>
[ Upstream commit d078cbf5c38de83bc31f83c47dcd2184c04a50c7 ]
If not enough buffer space available, but idmap_lookup has triggered lookup_fn which calls cache_get and returns successfully. Then we missed to call cache_put here which pairs with cache_get.
--- fs/nfsd/nfs4idmap.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
fs/nfsd/nfs4idmap.c +9 -4
@@ -581,6 +581,7 @@ static __be32 idmap_id_to_name(struct xdr_stream *xdr, .id = id, .type = type, }; +__be32 status = nfs_ok;__be32 *p;int ret;struct nfsd_net *nn =net_generic (SVC_NET (rqstp), nfsd_net_id);
@@ -593,12 +594,16 @@ static __be32 idmap_id_to_name(struct xdr_stream *xdr,return nfserrno (ret); ret =strlen (item->name);WARN_ON_ONCE (ret >IDMAP_NAMESZ ); + p =xdr_reserve_space (xdr, ret +4 ); -if (!p) -return nfserr_resource; - p =xdr_encode_opaque (p, item->name, ret); +if (unlikely (!p)) { + status = nfserr_resource; + goto out_put; + } +xdr_encode_opaque (p, item->name, ret); +out_put:cache_put (&item->h, nn->idtoname_cache); -return 0 ; +return status; } static bool
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 331/538 nfsd: return -EINVAL when namelen is 0
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Lingfeng <[email protected]>
[ Upstream commit 22451a16b7ab7debefce660672566be887db1637 ]
When we have a corrupted main.sqlite in /var/lib/nfs/nfsdcld/, it may result in namelen being 0, which will cause memdup_user() to return ZERO_SIZE_PTR.
When we access the name.data that has been assigned the value of ZERO_SIZE_PTR in nfs4_client_to_reclaim(), null pointer dereference is triggered.
[ T1205] ==================================================================
[ T1205] BUG: KASAN: null-ptr-deref in nfs4_client_to_reclaim+0xe9/0x260
[ T1205] Read of size 1 at addr 0000000000000010 by task nfsdcld/1205
[ T1205]
[ T1205] CPU: 11 PID: 1205 Comm: nfsdcld Not tainted 5.10.0-00003-g2c1423731b8d #406
[ T1205] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 [ T1205] Call Trace:
[ T1205] dump_stack+0x9a/0xd0 [ T1205] ? nfs4_client_to_reclaim+0xe9/0x260 [ T1205] __kasan_report.cold+0x34/0x84 [ T1205] ? nfs4_client_to_reclaim+0xe9/0x260 [ T1205] kasan_report+0x3a/0x50 [ T1205] nfs4_client_to_reclaim+0xe9/0x260 [ T1205] ? nfsd4_release_lockowner+0x410/0x410 [ T1205] cld_pipe_downcall+0x5ca/0x760 [ T1205] ? nfsd4_cld_tracking_exit+0x1d0/0x1d0 [ T1205] ? down_write_killable_nested+0x170/0x170 [ T1205] ? avc_policy_seqno+0x28/0x40 [ T1205] ? selinux_file_permission+0x1b4/0x1e0 [ T1205] rpc_pipe_write+0x84/0xb0 [ T1205] vfs_write+0x143/0x520 [ T1205] ksys_write+0xc9/0x170 [ T1205] ? __ia32_sys_read+0x50/0x50 [ T1205] ? ktime_get_coarse_real_ts64+0xfe/0x110 [ T1205] ? ktime_get_coarse_real_ts64+0xa2/0x110 [ T1205] do_syscall_64+0x33/0x40 [ T1205] entry_SYSCALL_64_after_hwframe+0x67/0xd1
[ T1205] RIP: 0033:0x7fdbdb761bc7
[ T1205] Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 514 [ T1205] RSP: 002b:00007fff8c4b7248 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ T1205] RAX: ffffffffffffffda RBX: 000000000000042b RCX: 00007fdbdb761bc7
[ T1205] RDX: 000000000000042b RSI: 00007fff8c4b75f0 RDI: 0000000000000008
[ T1205] RBP: 00007fdbdb761bb0 R08: 0000000000000000 R09: 0000000000000001
[ T1205] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000042b
[ T1205] R13: 0000000000000008 R14: 00007fff8c4b75f0 R15: 0000000000000000
[ T1205] ==================================================================
Fix it by checking namelen.
--- fs/nfsd/nfs4recover.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/nfsd/nfs4recover.c +8 -0
@@ -806,6 +806,10 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg, ci = &cmsg->cm_u.cm_clntinfo;if (get_user (namelen, &ci->cc_name.cn_len))return -EFAULT ; +if (!namelen) { +dprintk ("%s: namelen should not be zero" , __func__); +return -EINVAL ; + } name.data =memdup_user (&ci->cc_name.cn_id, namelen);if (IS_ERR (name.data))return PTR_ERR (name.data);
@@ -828,6 +832,10 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg, cnm = &cmsg->cm_u.cm_name;if (get_user (namelen, &cnm->cn_len))return -EFAULT ; +if (!namelen) { +dprintk ("%s: namelen should not be zero" , __func__); +return -EINVAL ; + } name.data =memdup_user (&cnm->cn_id, namelen);if (IS_ERR (name.data))return PTR_ERR (name.data);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 332/538 crypto: caam - Pad SG length when allocating hash edesc
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 5124bc96162667766f6120b19f57a640c2eccb2a ]
Because hardware will read in multiples of 4 SG entries, ensure the allocated length is always padded. This was already done by some callers of ahash_edesc_alloc, but ahash_digest was conspicuously missing.
In any case, doing it in the allocation function ensures that the memory is always there.
--- drivers/crypto/caam/caamhash.c | 1 + 1 file changed, 1 insertion(+)
drivers/crypto/caam/caamhash.c +1 -0
@@ -708,6 +708,7 @@ static struct ahash_edesc *ahash_edesc_alloc(struct ahash_request *req, GFP_KERNEL :GFP_ATOMIC ;struct ahash_edesc *edesc; + sg_num =pad_sg_nents (sg_num); edesc =kzalloc (struct_size (edesc, sec4_sg, sg_num), flags);if (!edesc)return NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 333/538 crypto: powerpc/p10-aes-gcm - Disable CRYPTO_AES_GCM_P10
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danny Tsen <[email protected]>
[ Upstream commit 44ac4625ea002deecd0c227336c95b724206c698 ]
Data mismatch found when testing ipsec tunnel with AES/GCM crypto. Disabling CRYPTO_AES_GCM_P10 in Kconfig for this feature.
--- arch/powerpc/crypto/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/crypto/Kconfig +1 -0
@@ -96,6 +96,7 @@ config CRYPTO_AES_PPC_SPE config CRYPTO_AES_GCM_P10 tristate "Stitched AES/GCM acceleration support on P10 or later CPU (PPC)" + depends on BROKEN depends on PPC64 && CPU_LITTLE_ENDIAN && VSX select CRYPTO_LIB_AES select CRYPTO_ALGAPI
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 334/538 f2fs: atomic: fix to avoid racing w/ GC
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 1a0bd289a5db1df8df8fab949633a0b8d3f235ee ]
Case #1:
SQLite App GC Thread Kworker Shrinker
- f2fs_ioc_start_atomic_write
- f2fs_ioc_commit_atomic_write
- f2fs_commit_atomic_write
- filemap_write_and_wait_range
: write atomic_file's data to cow_inode
echo 3 > drop_caches to drop atomic_file's cache.
- f2fs_gc
- gc_data_segment
- move_data_page
- set_page_dirty
- writepages
- f2fs_do_write_data_page : overwrite atomic_file's data to cow_inode
- f2fs_down_write(&fi->i_gc_rwsem[WRITE])
- __f2fs_commit_atomic_write
- f2fs_up_write(&fi->i_gc_rwsem[WRITE])
Case #2:
SQLite App GC Thread Kworker
- f2fs_ioc_start_atomic_write
- __writeback_single_inode
- do_writepages
- f2fs_write_cache_pages
- f2fs_write_single_data_page
- f2fs_do_write_data_page : write atomic_file's data to cow_inode
- f2fs_gc
- gc_data_segment
- move_data_page
- set_page_dirty
- writepages
- f2fs_do_write_data_page
: overwrite atomic_file's data to cow_inode
- f2fs_ioc_commit_atomic_write
In above cases racing in between atomic_write and GC, previous data in atomic_file may be overwrited to cow_file, result in data corruption.
This patch introduces PAGE_PRIVATE_ATOMIC_WRITE bit flag in page.private, and use it to indicate that there is last dirty data in atomic file, and the data should be writebacked into cow_file, if the flag is not tagged in page, we should never write data across files.
--- fs/f2fs/data.c | 10 +++++++++- fs/f2fs/f2fs.h | 8 +++++++- 2 files changed, 16 insertions(+), 2 deletions(-)
fs/f2fs/data.c +9 -1
@@ -2623,10 +2623,13 @@ int f2fs_do_write_data_page(struct f2fs_io_info *fio)struct dnode_of_data dn;struct node_info ni;bool ipu_force = false; +bool atomic_commit;int err =0 ;/* Use COW inode to make dnode_of_data for atomic write */ -if (f2fs_is_atomic_file (inode)) + atomic_commit =f2fs_is_atomic_file (inode) && +page_private_atomic (fio->page); +if (atomic_commit)set_new_dnode (&dn,F2FS_I (inode)->cow_inode,NULL ,NULL ,0 );else set_new_dnode (&dn, inode,NULL ,NULL ,0 );
@@ -2730,6 +2733,8 @@ int f2fs_do_write_data_page(struct f2fs_io_info *fio)f2fs_outplace_write_data (&dn, fio);trace_f2fs_do_write_data_page (page,OPU );set_inode_flag (inode,FI_APPEND_WRITE ); +if (atomic_commit) +clear_page_private_atomic (page); out_writepage:f2fs_put_dnode (&dn); out:
@@ -3700,6 +3705,9 @@ static int f2fs_write_end(struct file *file,set_page_dirty (page); +if (f2fs_is_atomic_file (inode)) +set_page_private_atomic (page); +if (pos + copied >i_size_read (inode) && !f2fs_verity_in_progress (inode)) {f2fs_i_size_write (inode, pos + copied);
fs/f2fs/f2fs.h +7 -1
@@ -1411,7 +1411,8 @@ static inline void f2fs_clear_bit(unsigned int nr, char *addr);* bit 1 PAGE_PRIVATE_ONGOING_MIGRATION * bit 2 PAGE_PRIVATE_INLINE_INODE * bit 3 PAGE_PRIVATE_REF_RESOURCE -* bit 4- f2fs private data +* bit 4 PAGE_PRIVATE_ATOMIC_WRITE +* bit 5- f2fs private data * * Layout B: lowest bit should be 0 * page.private is a wrapped pointer.
@@ -1421,6 +1422,7 @@ enum {PAGE_PRIVATE_ONGOING_MIGRATION ,/* data page which is on-going migrating */ PAGE_PRIVATE_INLINE_INODE ,/* inode page contains inline data */ PAGE_PRIVATE_REF_RESOURCE ,/* dirty page has referenced resources */ +PAGE_PRIVATE_ATOMIC_WRITE ,/* data page from atomic write path */ PAGE_PRIVATE_MAX };
@@ -2386,14 +2388,17 @@ static inline void clear_page_private_##name(struct page *page) \PAGE_PRIVATE_GET_FUNC (nonpointer,NOT_POINTER );PAGE_PRIVATE_GET_FUNC (inline,INLINE_INODE );PAGE_PRIVATE_GET_FUNC (gcing,ONGOING_MIGRATION ); +PAGE_PRIVATE_GET_FUNC (atomic,ATOMIC_WRITE );PAGE_PRIVATE_SET_FUNC (reference,REF_RESOURCE );PAGE_PRIVATE_SET_FUNC (inline,INLINE_INODE );PAGE_PRIVATE_SET_FUNC (gcing,ONGOING_MIGRATION ); +PAGE_PRIVATE_SET_FUNC (atomic,ATOMIC_WRITE );PAGE_PRIVATE_CLEAR_FUNC (reference,REF_RESOURCE );PAGE_PRIVATE_CLEAR_FUNC (inline,INLINE_INODE );PAGE_PRIVATE_CLEAR_FUNC (gcing,ONGOING_MIGRATION ); +PAGE_PRIVATE_CLEAR_FUNC (atomic,ATOMIC_WRITE );static inline unsigned long get_page_private_data (struct page *page) {
@@ -2425,6 +2430,7 @@ static inline void clear_page_private_all(struct page *page)clear_page_private_reference (page);clear_page_private_gcing (page);clear_page_private_inline (page); +clear_page_private_atomic (page);f2fs_bug_on (F2FS_P_SB (page),page_private (page)); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 335/538 f2fs: reduce expensive checkpoint trigger frequency
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit aaf8c0b9ae042494cb4585883b15c1332de77840 ]
We may trigger high frequent checkpoint for below case:
1. mkdir /mnt/dir1; set dir1 encrypted
2. touch /mnt/file1; fsync /mnt/file1
3. mkdir /mnt/dir2; set dir2 encrypted
4. touch /mnt/file2; fsync /mnt/file2
...
Although, newly created dir and file are not related, due to commit bbf156f7afa7 ("f2fs: fix lost xattrs of directories"), we will trigger checkpoint whenever fsync() comes after a new encrypted dir created.
In order to avoid such performance regression issue, let's record an entry including directory's ino in global cache whenever we update directory's xattr data, and then triggerring checkpoint() only if xattr metadata of target file's parent was updated.
This patch updates to cover below no encryption case as well:
1) parent is checkpointed
2) set_xattr(dir) w/ new xnid
3) create(file)
4) fsync(file)
--- fs/f2fs/f2fs.h | 2 ++ fs/f2fs/file.c | 3 +++ fs/f2fs/xattr.c | 14 ++++++++++++-- include/trace/events/f2fs.h | 3 ++- 4 files changed, 19 insertions(+), 3 deletions(-)
fs/f2fs/f2fs.h +2 -0
@@ -282,6 +282,7 @@ enum {APPEND_INO ,/* for append ino list */ UPDATE_INO ,/* for update ino list */ TRANS_DIR_INO ,/* for transactions dir ino list */ +XATTR_DIR_INO ,/* for xattr updated dir ino list */ FLUSH_INO ,/* for multiple device flushing */ MAX_INO_ENTRY, /* max. list */ };
@@ -1149,6 +1150,7 @@ enum cp_reason_type {CP_FASTBOOT_MODE ,CP_SPEC_LOG_NUM ,CP_RECOVER_DIR , + CP_XATTR_DIR, }; enum iostat_type {
fs/f2fs/file.c +3 -0
@@ -213,6 +213,9 @@ static inline enum cp_reason_type need_do_checkpoint(struct inode *inode) f2fs_exist_written_data(sbi, F2FS_I(inode)->i_pino, TRANS_DIR_INO)) cp_reason =CP_RECOVER_DIR ; + else if (f2fs_exist_written_data(sbi, F2FS_I(inode)->i_pino, +XATTR_DIR_INO )) + cp_reason =CP_XATTR_DIR ;return cp_reason; }
fs/f2fs/xattr.c +12 -2
@@ -629,6 +629,7 @@ static int __f2fs_setxattr(struct inode *inode, int index, const char *name, const void *value, size_t size, struct page *ipage, int flags) { + struct f2fs_sb_info *sbi = F2FS_I_SB(inode);struct f2fs_xattr_entry *here, *last;void *base_addr, *last_base_addr;int found, newsize;
@@ -772,9 +773,18 @@ static int __f2fs_setxattr(struct inode *inode, int index,if (index ==F2FS_XATTR_INDEX_ENCRYPTION && !strcmp (name,F2FS_XATTR_NAME_ENCRYPTION_CONTEXT ))f2fs_set_encrypted_inode (inode); -if (S_ISDIR (inode->i_mode)) -set_sbi_flag (F2FS_I_SB (inode),SBI_NEED_CP ); +if (!S_ISDIR (inode->i_mode)) + goto same; +/* +* In restrict mode, fsync() always try to trigger checkpoint for all +* metadata consistency, in other mode, it triggers checkpoint when +* parent's xattr metadata was updated. +*/ +if (F2FS_OPTION (sbi).fsync_mode ==FSYNC_MODE_STRICT ) +set_sbi_flag (sbi,SBI_NEED_CP ); +else +f2fs_add_ino_entry (sbi, inode->i_ino,XATTR_DIR_INO ); same:if (is_inode_flag_set (inode,FI_ACL_MODE )) { inode->i_mode =F2FS_I (inode)->i_acl_mode;
include/trace/events/f2fs.h +2 -1
@@ -139,7 +139,8 @@ TRACE_DEFINE_ENUM(EX_BLOCK_AGE); { CP_NODE_NEED_CP, "node needs cp" }, \ { CP_FASTBOOT_MODE, "fastboot mode" }, \ { CP_SPEC_LOG_NUM, "log type is 2" }, \ - { CP_RECOVER_DIR, "dir needs recovery" }) + { CP_RECOVER_DIR, "dir needs recovery" }, \ + { CP_XATTR_DIR, "dir's xattr updated" }) #define show_shutdown_mode(type) \ __print_symbolic(type, \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 336/538 f2fs: fix to avoid racing in between read and OPU dio write
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 0cac51185e65dc2a20686184e02f3cafc99eb202 ]
If lfs mode is on, buffered read may race w/ OPU dio write as below, it may cause buffered read hits unwritten data unexpectly, and for dio read, the race condition exists as well.
Thread A Thread B
- f2fs_file_write_iter
- f2fs_dio_write_iter
- __iomap_dio_rw
- f2fs_iomap_begin
- f2fs_map_blocks
- __allocate_data_block
- allocated blkaddr #x
- iomap_dio_submit_bio
- f2fs_file_read_iter
- filemap_read
- f2fs_read_data_folio
- f2fs_mpage_readpages
- f2fs_map_blocks
: get blkaddr #x
- f2fs_submit_read_bio
IRQ
- f2fs_read_end_io
: read IO on blkaddr #x complete
IRQ
- iomap_dio_bio_end_io
: direct write IO on blkaddr #x complete
In LFS mode, if there is inflight dio, let's wait for its completion, this policy won't cover all race cases, however it is a tradeoff which avoids abusing lock around IO paths.
--- fs/f2fs/file.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/f2fs/file.c +4 -0
@@ -4541,6 +4541,10 @@ static ssize_t f2fs_file_read_iter(struct kiocb *iocb, struct iov_iter *to)f2fs_trace_rw_file_path (iocb->ki_filp, iocb->ki_pos,iov_iter_count (to),READ ); +/* In LFS mode, if there is inflight dio, wait for its completion */ +if (f2fs_lfs_mode (F2FS_I_SB (inode))) +inode_dio_wait (inode); +if (f2fs_should_use_dio (inode, iocb, to)) { ret =f2fs_dio_read_iter (iocb, to); }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 337/538 f2fs: Create COW inode from parent dentry for atomic write
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yeongjin Gil <[email protected]>
[ Upstream commit 8c1b787938fd86bab27a1492fa887408c75fec2b ]
The i_pino in f2fs_inode_info has the previous parent's i_ino when inode was renamed, which may cause f2fs_ioc_start_atomic_write to fail. If file_wrong_pino is true and i_nlink is 1, then to find a valid pino, we should refer to the dentry from inode.
To resolve this issue, let's get parent inode using parent dentry directly.
--- fs/f2fs/file.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-)
fs/f2fs/file.c +3 -9
@@ -2097,7 +2097,6 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)struct mnt_idmap *idmap =file_mnt_idmap (filp);struct f2fs_inode_info *fi =F2FS_I (inode);struct f2fs_sb_info *sbi =F2FS_I_SB (inode); -struct inode *pinode;loff_t isize;int ret;
@@ -2146,15 +2145,10 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)/* Check if the inode already has a COW inode */ if (fi->cow_inode ==NULL ) {/* Create a COW inode for atomic write */ - pinode =f2fs_iget (inode->i_sb, fi->i_pino); -if (IS_ERR (pinode)) { -f2fs_up_write (&fi->i_gc_rwsem[WRITE ]); - ret =PTR_ERR (pinode); - goto out; - } +struct dentry *dentry =file_dentry (filp); +struct inode *dir =d_inode (dentry->d_parent); - ret =f2fs_get_tmpfile (idmap, pinode, &fi->cow_inode); -iput (pinode); + ret =f2fs_get_tmpfile (idmap, dir, &fi->cow_inode);if (ret) {f2fs_up_write (&fi->i_gc_rwsem[WRITE ]); goto out;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 338/538 f2fs: fix to wait page writeback before setting gcing flag
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit a4d7f2b3238fd5f76b9e6434a0bd5d2e29049cff ]
Soft IRQ Thread
- f2fs_write_end_io
- f2fs_defragment_range
- set_page_private_gcing
- type = WB_DATA_TYPE(page, false);
: assign type w/ F2FS_WB_CP_DATA
due to page_private_gcing() is true
- dec_page_count() w/ wrong type
- end_page_writeback()
Value of F2FS_WB_CP_DATA reference count may become negative under above race condition, the root cause is we missed to wait page writeback before setting gcing page private flag, let's fix it.
--- fs/f2fs/file.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/f2fs/file.c +4 -0
@@ -2743,6 +2743,8 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi, goto clear_out; } +f2fs_wait_on_page_writeback (page,DATA , true, true); +set_page_dirty (page);set_page_private_gcing (page);f2fs_put_page (page,1 );
@@ -4137,6 +4139,8 @@ static int redirty_blocks(struct inode *inode, pgoff_t page_idx, int len)/* It will never fail, when page has pinned above */ f2fs_bug_on (F2FS_I_SB (inode), !page); +f2fs_wait_on_page_writeback (page,DATA , true, true); +set_page_dirty (page);set_page_private_gcing (page);f2fs_put_page (page,1 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 339/538 f2fs: atomic: fix to truncate pagecache before on-disk metadata truncation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit ebd3309aec6271c4616573b0cb83ea25e623070a ]
We should always truncate pagecache while truncating on-disk data.
--- fs/f2fs/file.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/f2fs/file.c +4 -0
@@ -2161,6 +2161,10 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)F2FS_I (fi->cow_inode)->atomic_inode = inode; }else {/* Reuse the already created COW inode */ +f2fs_bug_on (sbi,get_dirty_pages (fi->cow_inode)); + +invalidate_mapping_pages (fi->cow_inode->i_mapping,0 ,-1 ); + ret =f2fs_do_truncate_blocks (fi->cow_inode,0 , true);if (ret) {f2fs_up_write (&fi->i_gc_rwsem[WRITE ]);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 340/538 f2fs: support .shutdown in f2fs_sops
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit ee745e4736fbf33079d0d0808e1343c2280fd59a ]
Support .shutdown callback in f2fs_sops, then, it can be called to shut down the file system when underlying block device is marked dead.
Stable-dep-of: c7f114d864ac ("f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()")
--- fs/f2fs/f2fs.h | 2 ++ fs/f2fs/file.c | 70 ++++++++++++++++++++++++++++++------------------- fs/f2fs/super.c | 6 +++++ 3 files changed, 51 insertions(+), 27 deletions(-)
fs/f2fs/f2fs.h +2 -0
@@ -3507,6 +3507,8 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, struct iattr *attr);int f2fs_truncate_hole (struct inode *inode,pgoff_t pg_start,pgoff_t pg_end);void f2fs_truncate_data_blocks_range (struct dnode_of_data *dn,int count); +int f2fs_do_shutdown (struct f2fs_sb_info *sbi,unsigned int flag, +bool readonly);int f2fs_precache_extents (struct inode *inode);int f2fs_fileattr_get (struct dentry *dentry,struct fileattr *fa); int f2fs_fileattr_set(struct mnt_idmap *idmap,
fs/f2fs/file.c +43 -27
93 lines not on this page · raw message
fs/f2fs/super.c +6 -0
@@ -2543,6 +2543,11 @@ static int f2fs_remount(struct super_block *sb, int *flags, char *data)return err; } +static void f2fs_shutdown (struct super_block *sb) +{ +f2fs_do_shutdown (F2FS_SB (sb),F2FS_GOING_DOWN_NOSYNC , false); +} +#ifdef CONFIG_QUOTA static bool f2fs_need_recovery (struct f2fs_sb_info *sbi) {
@@ -3142,6 +3147,7 @@ static const struct super_operations f2fs_sops = { .unfreeze_fs = f2fs_unfreeze, .statfs = f2fs_statfs, .remount_fs = f2fs_remount, + .shutdown = f2fs_shutdown, };#ifdef CONFIG_FS_ENCRYPTION
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 341/538 f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit c7f114d864ac91515bb07ac271e9824a20f5ed95 ]
syzbot reports a f2fs bug as below:
__dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_report+0xe8/0x550 mm/kasan/report.c:491 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline] __refcount_add include/linux/refcount.h:184 [inline] __refcount_inc include/linux/refcount.h:241 [inline] refcount_inc include/linux/refcount.h:258 [inline] get_task_struct include/linux/sched/task.h:118 [inline] kthread_stop+0xca/0x630 kernel/kthread.c:704 f2fs_stop_gc_thread+0x65/0xb0 fs/f2fs/gc.c:210 f2fs_do_shutdown+0x192/0x540 fs/f2fs/file.c:2283 f2fs_ioc_shutdown fs/f2fs/file.c:2325 [inline] __f2fs_ioctl+0x443a/0xbe60 fs/f2fs/file.c:4325 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
The root cause is below race condition, it may cause use-after-free issue in sbi->gc_th pointer.
- remount
- f2fs_remount
- f2fs_stop_gc_thread
- kfree(gc_th)
- f2fs_ioc_shutdown
- f2fs_do_shutdown
- f2fs_stop_gc_thread
- kthread_stop(gc_th->f2fs_gc_task)
: sbi->gc_thread = NULL;
We will call f2fs_do_shutdown() in two paths:
- for f2fs_ioc_shutdown() path, we should grab sb->s_umount semaphore for fixing.
- for f2fs_shutdown() path, it's safe since caller has already grabbed sb->s_umount semaphore.
--- fs/f2fs/f2fs.h | 2 +- fs/f2fs/file.c | 11 +++++++++-- fs/f2fs/super.c | 2 +- 3 files changed, 11 insertions(+), 4 deletions(-)
fs/f2fs/f2fs.h +1 -1
@@ -3508,7 +3508,7 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,int f2fs_truncate_hole (struct inode *inode,pgoff_t pg_start,pgoff_t pg_end);void f2fs_truncate_data_blocks_range (struct dnode_of_data *dn,int count);int f2fs_do_shutdown (struct f2fs_sb_info *sbi,unsigned int flag, -bool readonly); +bool readonly,bool need_lock);int f2fs_precache_extents (struct inode *inode);int f2fs_fileattr_get (struct dentry *dentry,struct fileattr *fa); int f2fs_fileattr_set(struct mnt_idmap *idmap,
fs/f2fs/file.c +9 -2
@@ -2257,7 +2257,7 @@ static int f2fs_ioc_abort_atomic_write(struct file *filp) }int f2fs_do_shutdown (struct f2fs_sb_info *sbi,unsigned int flag, -bool readonly) +bool readonly,bool need_lock) {struct super_block *sb = sbi->sb;int ret =0 ;
@@ -2299,12 +2299,19 @@ int f2fs_do_shutdown(struct f2fs_sb_info *sbi, unsigned int flag,if (readonly) goto out; +/* grab sb->s_umount to avoid racing w/ remount() */ +if (need_lock) +down_read (&sbi->sb->s_umount); +f2fs_stop_gc_thread (sbi);f2fs_stop_discard_thread (sbi);f2fs_drop_discard_cmd (sbi);clear_opt (sbi,DISCARD ); +if (need_lock) +up_read (&sbi->sb->s_umount); +f2fs_update_time (sbi,REQ_TIME ); out:
@@ -2341,7 +2348,7 @@ static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg) } } - ret =f2fs_do_shutdown (sbi, in, readonly); + ret =f2fs_do_shutdown (sbi, in, readonly, true);if (need_drop)mnt_drop_write_file (filp);
fs/f2fs/super.c +1 -1
@@ -2545,7 +2545,7 @@ static int f2fs_remount(struct super_block *sb, int *flags, char *data)static void f2fs_shutdown (struct super_block *sb) { -f2fs_do_shutdown (F2FS_SB (sb),F2FS_GOING_DOWN_NOSYNC , false); +f2fs_do_shutdown (F2FS_SB (sb),F2FS_GOING_DOWN_NOSYNC , false, false); }#ifdef CONFIG_QUOTA
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 342/538 f2fs: compress: do sanity check on cluster when CONFIG_F2FS_CHECK_FS is on
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 2aaea533bf063ed3b442df5fe5f6abfc538054c9 ]
This patch covers sanity check logic on cluster w/ CONFIG_F2FS_CHECK_FS, otherwise, there will be performance regression while querying cluster mapping info.
Callers of f2fs_is_compressed_cluster() only care about whether cluster is compressed or not, rather than # of valid blocks in compressed cluster, so, let's adjust f2fs_is_compressed_cluster()'s logic according to caller's requirement.
Stable-dep-of: f785cec298c9 ("f2fs: compress: don't redirty sparse cluster during {,de}compress")
--- fs/f2fs/compress.c | 61 ++++++++++++++++++++++++++-------------------- fs/f2fs/data.c | 4 +-- 2 files changed, 35 insertions(+), 30 deletions(-)
fs/f2fs/compress.c +34 -27
@@ -887,14 +887,15 @@ static bool cluster_has_invalid_data(struct compress_ctx *cc)bool f2fs_sanity_check_cluster (struct dnode_of_data *dn) { +#ifdef CONFIG_F2FS_CHECK_FS struct f2fs_sb_info *sbi =F2FS_I_SB (dn->inode);unsigned int cluster_size =F2FS_I (dn->inode)->i_cluster_size; -bool compressed = dn->data_blkaddr ==COMPRESS_ADDR ;int cluster_end =0 ; +unsigned int count;int i;char *reason ="" ; -if (!compressed) +if (dn->data_blkaddr !=COMPRESS_ADDR )return false;/* [..., COMPR_ADDR, ...] */
@@ -903,7 +904,7 @@ bool f2fs_sanity_check_cluster(struct dnode_of_data *dn) goto out; } -for (i =1 ; i < cluster_size; i++) { +for (i =1 , count =1 ; i < cluster_size; i++, count++) {block_t blkaddr =data_blkaddr (dn->inode, dn->node_page, dn->ofs_in_node + i);
@@ -923,19 +924,42 @@ bool f2fs_sanity_check_cluster(struct dnode_of_data *dn) goto out; } } + +f2fs_bug_on (F2FS_I_SB (dn->inode), count != cluster_size && + !is_inode_flag_set (dn->inode,FI_COMPRESS_RELEASED )); +return false; out:f2fs_warn (sbi,"access invalid cluster, ino:%lu, nid:%u, ofs_in_node:%u, reason:%s" , dn->inode->i_ino, dn->nid, dn->ofs_in_node, reason);set_sbi_flag (sbi,SBI_NEED_FSCK );return true; +#else +return false; +#endif +} + +static int __f2fs_get_cluster_blocks (struct inode *inode, +struct dnode_of_data *dn) +{ +unsigned int cluster_size =F2FS_I (inode)->i_cluster_size; +int count, i; + +for (i =1 , count =1 ; i < cluster_size; i++) { +block_t blkaddr =data_blkaddr (dn->inode, dn->node_page, + dn->ofs_in_node + i); + +if (__is_valid_data_blkaddr (blkaddr)) + count++; + } + +return count; }static int __f2fs_cluster_blocks (struct inode *inode, -unsigned int cluster_idx,bool compr) +unsigned int cluster_idx,bool compr_blks) {struct dnode_of_data dn; -unsigned int cluster_size =F2FS_I (inode)->i_cluster_size;unsigned int start_idx = cluster_idx <<F2FS_I (inode)->i_log_cluster_size;int ret;
@@ -950,31 +974,14 @@ static int __f2fs_cluster_blocks(struct inode *inode,if (f2fs_sanity_check_cluster (&dn)) { ret = -EFSCORRUPTED ; -f2fs_handle_error (F2FS_I_SB (inode),ERROR_CORRUPTED_CLUSTER ); goto fail; }if (dn.data_blkaddr ==COMPRESS_ADDR ) { -int i; - - ret =1 ; -for (i =1 ; i < cluster_size; i++) { -block_t blkaddr; - - blkaddr =data_blkaddr (dn.inode, - dn.node_page, dn.ofs_in_node + i); -if (compr) { -if (__is_valid_data_blkaddr (blkaddr)) - ret++; - }else { -if (blkaddr !=NULL_ADDR ) - ret++; - } - } - -f2fs_bug_on (F2FS_I_SB (inode), - !compr && ret != cluster_size && - !is_inode_flag_set (inode,FI_COMPRESS_RELEASED )); +if (compr_blks) + ret =__f2fs_get_cluster_blocks (inode, &dn); +else + ret =1 ; } fail:f2fs_put_dnode (&dn);
@@ -987,7 +994,7 @@ static int f2fs_compressed_blocks(struct compress_ctx *cc)return __f2fs_cluster_blocks (cc->inode, cc->cluster_idx, true); } -/* return # of valid blocks in compressed cluster */ +/* return whether cluster is compressed one or not */ int f2fs_is_compressed_cluster (struct inode *inode,pgoff_t index) { return __f2fs_cluster_blocks(inode,
fs/f2fs/data.c +1 -3
@@ -1614,9 +1614,7 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag) map->m_flags |=F2FS_MAP_NEW ; }else if (is_hole) {if (f2fs_compressed_file (inode) && -f2fs_sanity_check_cluster (&dn) && - (flag !=F2FS_GET_BLOCK_FIEMAP || -IS_ENABLED (CONFIG_F2FS_CHECK_FS ))) { +f2fs_sanity_check_cluster (&dn)) { err = -EFSCORRUPTED ;f2fs_handle_error (sbi,ERROR_CORRUPTED_CLUSTER );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 343/538 f2fs: compress: dont redirty sparse cluster during {,de}compress
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yeongjin Gil <[email protected]>
[ Upstream commit f785cec298c95d00058560c0715233294a04b8f3 ]
In f2fs_do_write_data_page, when the data block is NULL_ADDR, it skips writepage considering that it has been already truncated. This results in an infinite loop as the PAGECACHE_TAG_TOWRITE tag is not cleared during the writeback process for a compressed file including NULL_ADDR in compress_mode=user.
This is the reproduction process:
1. dd if=/dev/zero bs=4096 count=1024 seek=1024 of=testfile
2. f2fs_io compress testfile
3. dd if=/dev/zero bs=4096 count=1 conv=notrunc of=testfile
4. f2fs_io decompress testfile
To prevent the problem, let's check whether the cluster is fully allocated before redirty its pages.
--- fs/f2fs/compress.c | 36 ++++++++++++++++++++++++++++-------- fs/f2fs/f2fs.h | 12 ++++++++++++ fs/f2fs/file.c | 39 +++++++++++++++++++++------------------ 3 files changed, 61 insertions(+), 26 deletions(-)
fs/f2fs/compress.c +28 -8
@@ -945,7 +945,7 @@ static int __f2fs_get_cluster_blocks(struct inode *inode,unsigned int cluster_size =F2FS_I (inode)->i_cluster_size;int count, i; -for (i =1 , count =1 ; i < cluster_size; i++) { +for (i =0 , count =0 ; i < cluster_size; i++) {block_t blkaddr =data_blkaddr (dn->inode, dn->node_page, dn->ofs_in_node + i);
@@ -956,8 +956,8 @@ static int __f2fs_get_cluster_blocks(struct inode *inode,return count; } -static int __f2fs_cluster_blocks (struct inode *inode, -unsigned int cluster_idx,bool compr_blks) +static int __f2fs_cluster_blocks (struct inode *inode,unsigned int cluster_idx, +enum cluster_check_type type) {struct dnode_of_data dn; unsigned int start_idx = cluster_idx <<
@@ -978,10 +978,12 @@ static int __f2fs_cluster_blocks(struct inode *inode, }if (dn.data_blkaddr ==COMPRESS_ADDR ) { -if (compr_blks) - ret =__f2fs_get_cluster_blocks (inode, &dn); -else +if (type ==CLUSTER_COMPR_BLKS ) + ret =1 +__f2fs_get_cluster_blocks (inode, &dn); +else if (type ==CLUSTER_IS_COMPR ) ret =1 ; + }else if (type ==CLUSTER_RAW_BLKS ) { + ret =__f2fs_get_cluster_blocks (inode, &dn); } fail:f2fs_put_dnode (&dn);
@@ -991,7 +993,16 @@ static int __f2fs_cluster_blocks(struct inode *inode,/* return # of compressed blocks in compressed cluster */ static int f2fs_compressed_blocks (struct compress_ctx *cc) { -return __f2fs_cluster_blocks (cc->inode, cc->cluster_idx, true); +return __f2fs_cluster_blocks (cc->inode, cc->cluster_idx, +CLUSTER_COMPR_BLKS ); +} + +/* return # of raw blocks in non-compressed cluster */ +static int f2fs_decompressed_blocks (struct inode *inode, +unsigned int cluster_idx) +{ +return __f2fs_cluster_blocks (inode, cluster_idx, +CLUSTER_RAW_BLKS ); }/* return whether cluster is compressed one or not */
@@ -999,7 +1010,16 @@ int f2fs_is_compressed_cluster(struct inode *inode, pgoff_t index) {return __f2fs_cluster_blocks (inode, index >>F2FS_I (inode)->i_log_cluster_size, - false); +CLUSTER_IS_COMPR ); +} + +/* return whether cluster contains non raw blocks or not */ +bool f2fs_is_sparse_cluster (struct inode *inode,pgoff_t index) +{ +unsigned int cluster_idx = index >>F2FS_I (inode)->i_log_cluster_size; + +return f2fs_decompressed_blocks (inode, cluster_idx) != +F2FS_I (inode)->i_cluster_size; }static bool cluster_may_compress (struct compress_ctx *cc)
fs/f2fs/f2fs.h +12 -0
@@ -4284,6 +4284,11 @@ static inline bool f2fs_meta_inode_gc_required(struct inode *inode)* compress.c */ #ifdef CONFIG_F2FS_FS_COMPRESSION +enum cluster_check_type { +CLUSTER_IS_COMPR ,/* check only if compressed cluster */ +CLUSTER_COMPR_BLKS ,/* return # of compressed blocks in a cluster */ +CLUSTER_RAW_BLKS /* return # of raw blocks in a cluster */ +};bool f2fs_is_compressed_page (struct page *page);struct page *f2fs_compress_control_page (struct page *page); int f2fs_prepare_compress_overwrite(struct inode *inode,
@@ -4310,6 +4315,7 @@ int f2fs_write_multi_pages(struct compress_ctx *cc,struct writeback_control *wbc, enum iostat_type io_type);int f2fs_is_compressed_cluster (struct inode *inode,pgoff_t index); +bool f2fs_is_sparse_cluster (struct inode *inode,pgoff_t index);void f2fs_update_read_extent_tree_range_compressed (struct inode *inode,pgoff_t fofs,block_t blkaddr,unsigned int llen,unsigned int c_len);
@@ -4396,6 +4402,12 @@ static inline bool f2fs_load_compressed_page(struct f2fs_sb_info *sbi,static inline void f2fs_invalidate_compress_pages (struct f2fs_sb_info *sbi,nid_t ino) { }#define inc_compr_inode_stat (inode) do { } while (0) +static inline int f2fs_is_compressed_cluster ( +struct inode *inode, +pgoff_t index) {return 0 ; } +static inline bool f2fs_is_sparse_cluster ( +struct inode *inode, +pgoff_t index) {return true; } static inline void f2fs_update_read_extent_tree_range_compressed( struct inode *inode, pgoff_t fofs, block_t blkaddr,
fs/f2fs/file.c +21 -18
@@ -4182,9 +4182,8 @@ static int f2fs_ioc_decompress_file(struct file *filp)struct inode *inode =file_inode (filp);struct f2fs_sb_info *sbi =F2FS_I_SB (inode);struct f2fs_inode_info *fi =F2FS_I (inode); -pgoff_t page_idx =0 , last_idx; -int cluster_size = fi->i_cluster_size; -int count, ret; +pgoff_t page_idx =0 , last_idx, cluster_idx; +int ret;if (!f2fs_sb_has_compression (sbi) ||F2FS_OPTION (sbi).compress_mode !=COMPR_MODE_USER )
@@ -4217,10 +4216,15 @@ static int f2fs_ioc_decompress_file(struct file *filp) goto out; last_idx =DIV_ROUND_UP (i_size_read (inode),PAGE_SIZE ); + last_idx >>= fi->i_log_cluster_size; + +for (cluster_idx =0 ; cluster_idx < last_idx; cluster_idx++) { + page_idx = cluster_idx << fi->i_log_cluster_size; + +if (!f2fs_is_compressed_cluster (inode, page_idx)) +continue ; - count = last_idx - page_idx; -while (count && count >= cluster_size) { - ret =redirty_blocks (inode, page_idx, cluster_size); + ret =redirty_blocks (inode, page_idx, fi->i_cluster_size);if (ret <0 )break ;
@@ -4230,9 +4234,6 @@ static int f2fs_ioc_decompress_file(struct file *filp)break ; } - count -= cluster_size; - page_idx += cluster_size; -cond_resched ();if (fatal_signal_pending (current)) { ret = -EINTR ;
@@ -4258,9 +4259,9 @@ static int f2fs_ioc_compress_file(struct file *filp) {struct inode *inode =file_inode (filp);struct f2fs_sb_info *sbi =F2FS_I_SB (inode); -pgoff_t page_idx =0 , last_idx; -int cluster_size =F2FS_I (inode)->i_cluster_size; -int count, ret; +struct f2fs_inode_info *fi =F2FS_I (inode); +pgoff_t page_idx =0 , last_idx, cluster_idx; +int ret;if (!f2fs_sb_has_compression (sbi) ||F2FS_OPTION (sbi).compress_mode !=COMPR_MODE_USER )
@@ -4292,10 +4293,15 @@ static int f2fs_ioc_compress_file(struct file *filp)set_inode_flag (inode,FI_ENABLE_COMPRESS ); last_idx =DIV_ROUND_UP (i_size_read (inode),PAGE_SIZE ); + last_idx >>= fi->i_log_cluster_size; - count = last_idx - page_idx; -while (count && count >= cluster_size) { - ret =redirty_blocks (inode, page_idx, cluster_size); +for (cluster_idx =0 ; cluster_idx < last_idx; cluster_idx++) { + page_idx = cluster_idx << fi->i_log_cluster_size; + +if (f2fs_is_sparse_cluster (inode, page_idx)) +continue ; + + ret =redirty_blocks (inode, page_idx, fi->i_cluster_size);if (ret <0 )break ;
@@ -4305,9 +4311,6 @@ static int f2fs_ioc_compress_file(struct file *filp)break ; } - count -= cluster_size; - page_idx += cluster_size; -cond_resched ();if (fatal_signal_pending (current)) { ret = -EINTR ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 344/538 f2fs: prevent atomic file from being dirtied before commit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daeho Jeong <[email protected]>
[ Upstream commit fccaa81de87e80b1809906f7e438e5766fbdc172 ]
Keep atomic file clean while updating and make it dirtied during commit in order to avoid unnecessary and excessive inode updates in the previous fix.
--- fs/f2fs/f2fs.h | 2 +- fs/f2fs/inode.c | 5 +++++ fs/f2fs/segment.c | 8 ++++++++ 3 files changed, 14 insertions(+), 1 deletion(-)
fs/f2fs/f2fs.h +1 -1
@@ -798,6 +798,7 @@ enum {FI_ALIGNED_WRITE ,/* enable aligned write */ FI_COW_FILE ,/* indicate COW file */ FI_ATOMIC_COMMITTED ,/* indicate atomic commit completed except disk sync */ +FI_ATOMIC_DIRTIED ,/* indicate atomic file is dirtied */ FI_ATOMIC_REPLACE ,/* indicate atomic replace */ FI_OPENED_FILE ,/* indicate file has been opened */ FI_MAX, /* max flag, never be used */
@@ -3039,7 +3040,6 @@ static inline void __mark_inode_dirty_flag(struct inode *inode,case FI_INLINE_DOTS :case FI_PIN_FILE :case FI_COMPRESS_RELEASED : -case FI_ATOMIC_COMMITTED :f2fs_mark_inode_dirty_sync (inode, true); } }
fs/f2fs/inode.c +5 -0
@@ -35,6 +35,11 @@ void f2fs_mark_inode_dirty_sync(struct inode *inode, bool sync)if (f2fs_inode_dirtied (inode, sync))return ; +if (f2fs_is_atomic_file (inode)) { +set_inode_flag (inode,FI_ATOMIC_DIRTIED ); +return ; + } +mark_inode_dirty_sync (inode); }
fs/f2fs/segment.c +8 -0
@@ -199,6 +199,10 @@ void f2fs_abort_atomic_write(struct inode *inode, bool clean)clear_inode_flag (inode,FI_ATOMIC_COMMITTED );clear_inode_flag (inode,FI_ATOMIC_REPLACE );clear_inode_flag (inode,FI_ATOMIC_FILE ); +if (is_inode_flag_set (inode,FI_ATOMIC_DIRTIED )) { +clear_inode_flag (inode,FI_ATOMIC_DIRTIED ); +f2fs_mark_inode_dirty_sync (inode, true); + }stat_dec_atomic_inode (inode);F2FS_I (inode)->atomic_write_task =NULL ;
@@ -368,6 +372,10 @@ static int __f2fs_commit_atomic_write(struct inode *inode) }else { sbi->committed_atomic_block += fi->atomic_write_cnt;set_inode_flag (inode,FI_ATOMIC_COMMITTED ); +if (is_inode_flag_set (inode,FI_ATOMIC_DIRTIED )) { +clear_inode_flag (inode,FI_ATOMIC_DIRTIED ); +f2fs_mark_inode_dirty_sync (inode, true); + } }__complete_revoke_list (inode, &revoke_list, ret ? true : false);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 345/538 f2fs: clean up w/ dotdot_name
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit ff6584ac2c4b4ee8e1fca20bffaaa387d8fe2974 ]
Just cleanup, no logic changes.
Stable-dep-of: 884ee6dc85b9 ("f2fs: get rid of online repaire on corrupted directory")
--- fs/f2fs/namei.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
fs/f2fs/namei.c +2 -3
@@ -459,7 +459,6 @@ static int __recover_dot_dentries(struct inode *dir, nid_t pino) {struct f2fs_sb_info *sbi =F2FS_I_SB (dir);struct qstr dot =QSTR_INIT ("." ,1 ); -struct qstr dotdot =QSTR_INIT (".." ,2 );struct f2fs_dir_entry *de;struct page *page;int err =0 ;
@@ -497,13 +496,13 @@ static int __recover_dot_dentries(struct inode *dir, nid_t pino) goto out; } - de =f2fs_find_entry (dir, &dotdot, &page); + de =f2fs_find_entry (dir, &dotdot_name, &page);if (de)f2fs_put_page (page,0 );else if (IS_ERR (page)) err =PTR_ERR (page);else - err =f2fs_do_add_link (dir, &dotdot,NULL , pino,S_IFDIR ); + err =f2fs_do_add_link (dir, &dotdot_name,NULL , pino,S_IFDIR ); out:if (!err)clear_inode_flag (dir,FI_INLINE_DOTS );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 346/538 f2fs: get rid of online repaire on corrupted directory
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 884ee6dc85b959bc152f15bca80c30f06069e6c4 ]
syzbot reports a f2fs bug as below:
kernel BUG at fs/f2fs/inode.c:896!
RIP: 0010:f2fs_evict_inode+0x1598/0x15c0 fs/f2fs/inode.c:896 Call Trace: evict+0x532/0x950 fs/inode.c:704 dispose_list fs/inode.c:747 [inline] evict_inodes+0x5f9/0x690 fs/inode.c:797 generic_shutdown_super+0x9d/0x2d0 fs/super.c:627 kill_block_super+0x44/0x90 fs/super.c:1696 kill_f2fs_super+0x344/0x690 fs/f2fs/super.c:4898 deactivate_locked_super+0xc4/0x130 fs/super.c:473 cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1373 task_work_run+0x24f/0x310 kernel/task_work.c:228 ptrace_notify+0x2d2/0x380 kernel/signal.c:2402 ptrace_report_syscall include/linux/ptrace.h:415 [inline] ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline] syscall_exit_work+0xc6/0x190 kernel/entry/common.c:173 syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline] syscall_exit_to_user_mode+0x279/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0010:f2fs_evict_inode+0x1598/0x15c0 fs/f2fs/inode.c:896
Online repaire on corrupted directory in f2fs_lookup() can generate dirty data/meta while racing w/ readonly remount, it may leave dirty inode after filesystem becomes readonly, however, checkpoint() will skips flushing dirty inode in a state of readonly mode, result in above panic.
Let's get rid of online repaire in f2fs_lookup(), and leave the work to fsck.f2fs.
--- fs/f2fs/f2fs.h | 11 ------- fs/f2fs/namei.c | 68 ----------------------------------------- include/linux/f2fs_fs.h | 2 +- 3 files changed, 1 insertion(+), 80 deletions(-)
fs/f2fs/f2fs.h +0 -11
@@ -780,7 +780,6 @@ enum {FI_NEED_IPU ,/* used for ipu per file */ FI_ATOMIC_FILE ,/* indicate atomic file */ FI_DATA_EXIST ,/* indicate data exists */ -FI_INLINE_DOTS ,/* indicate inline dot dentries */ FI_SKIP_WRITES ,/* should skip data page writeback */ FI_OPU_WRITE ,/* used for opu per file */ FI_DIRTY_FILE, /* indicate regular/symlink has dirty pages */
@@ -3037,7 +3036,6 @@ static inline void __mark_inode_dirty_flag(struct inode *inode,return ; fallthrough;case FI_DATA_EXIST : -case FI_INLINE_DOTS :case FI_PIN_FILE :case FI_COMPRESS_RELEASED :f2fs_mark_inode_dirty_sync (inode, true);
@@ -3161,8 +3159,6 @@ static inline void get_inline_info(struct inode *inode, struct f2fs_inode *ri)set_bit (FI_INLINE_DENTRY , fi->flags);if (ri->i_inline &F2FS_DATA_EXIST )set_bit (FI_DATA_EXIST , fi->flags); -if (ri->i_inline &F2FS_INLINE_DOTS ) -set_bit (FI_INLINE_DOTS , fi->flags);if (ri->i_inline &F2FS_EXTRA_ATTR )set_bit (FI_EXTRA_ATTR , fi->flags);if (ri->i_inline &F2FS_PIN_FILE )
@@ -3183,8 +3179,6 @@ static inline void set_raw_inline(struct inode *inode, struct f2fs_inode *ri) ri->i_inline |=F2FS_INLINE_DENTRY ;if (is_inode_flag_set (inode,FI_DATA_EXIST )) ri->i_inline |=F2FS_DATA_EXIST ; -if (is_inode_flag_set (inode,FI_INLINE_DOTS )) - ri->i_inline |=F2FS_INLINE_DOTS ;if (is_inode_flag_set (inode,FI_EXTRA_ATTR )) ri->i_inline |=F2FS_EXTRA_ATTR ;if (is_inode_flag_set (inode,FI_PIN_FILE ))
@@ -3271,11 +3265,6 @@ static inline int f2fs_exist_data(struct inode *inode)return is_inode_flag_set (inode,FI_DATA_EXIST ); } -static inline int f2fs_has_inline_dots (struct inode *inode) -{ -return is_inode_flag_set (inode,FI_INLINE_DOTS ); -} -static inline int f2fs_is_mmap_file (struct inode *inode) {return is_inode_flag_set (inode,FI_MMAP_FILE );
fs/f2fs/namei.c +0 -68
86 lines not on this page · raw message
include/linux/f2fs_fs.h +1 -1
@@ -262,7 +262,7 @@ struct f2fs_extent {#define F2FS_INLINE_DATA 0x02/* file inline data flag */ #define F2FS_INLINE_DENTRY 0x04/* file inline dentry flag */ #define F2FS_DATA_EXIST 0x08/* file inline data exist flag */ -#define F2FS_INLINE_DOTS 0x10/* file having implicit dot dentries */ +#define F2FS_INLINE_DOTS 0x10/* file having implicit dot dentries (obsolete) */ #define F2FS_EXTRA_ATTR 0x20/* file having extra attribute */ #define F2FS_PIN_FILE 0x40/* file should not be gced */ #define F2FS_COMPRESS_RELEASED 0x80/* file released compressed blocks */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 347/538 f2fs: fix to dont set SB_RDONLY in f2fs_handle_critical_error()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 930c6ab93492c4b15436524e704950b364b2930c ]
syzbot reports a f2fs bug as below:
------------[ cut here ]------------ WARNING: CPU: 1 PID: 58 at kernel/rcu/sync.c:177 rcu_sync_dtor+0xcd/0x180 kernel/rcu/sync.c:177 CPU: 1 UID: 0 PID: 58 Comm: kworker/1:2 Not tainted 6.10.0-syzkaller-12562-g1722389b0d86 #0 Workqueue: events destroy_super_work RIP: 0010:rcu_sync_dtor+0xcd/0x180 kernel/rcu/sync.c:177 Call Trace: percpu_free_rwsem+0x41/0x80 kernel/locking/percpu-rwsem.c:42 destroy_super_work+0xec/0x130 fs/super.c:282 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
As Christian Brauner pointed out [1]: the root cause is f2fs sets SB_RDONLY flag in internal function, rather than setting the flag covered w/ sb->s_umount semaphore via remount procedure, then below race condition causes this bug:
- freeze_super()
- sb_wait_write(sb, SB_FREEZE_WRITE)
- sb_wait_write(sb, SB_FREEZE_PAGEFAULT)
- sb_wait_write(sb, SB_FREEZE_FS)
- f2fs_handle_critical_error
- sb->s_flags |= SB_RDONLY
- thaw_super
- thaw_super_locked
- sb_rdonly() is true, so it skips
sb_freeze_unlock(sb, SB_FREEZE_FS)
- deactivate_locked_super
Since f2fs has almost the same logic as ext4 [2] when handling critical error in filesystem if it mounts w/ errors=remount-ro option:
- set CP_ERROR_FLAG flag which indicates filesystem is stopped
- record errors to superblock
- set SB_RDONLY falg
Once we set CP_ERROR_FLAG flag, all writable interfaces can detect the flag and stop any further updates on filesystem. So, it is safe to not set SB_RDONLY flag, let's remove the logic and keep in line w/ ext4 [3].
[1] https://lore.kernel.org/all/20240729-himbeeren-funknetz-96e62f9c7aee@brauner
[2] https://lore.kernel.org/all/20240729132721.hxih6ehigadqf7wx@quack3
[3] https://lore.kernel.org/linux-ext4/[email protected]
--- fs/f2fs/super.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
fs/f2fs/super.c +6 -4
@@ -4137,12 +4137,14 @@ void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason, }f2fs_warn (sbi,"Remounting filesystem read-only" ); +/* -* Make sure updated value of ->s_mount_flags will be visible before -* ->s_flags update +* We have already set CP_ERROR_FLAG flag to stop all updates +* to filesystem, so it doesn't need to set SB_RDONLY flag here +* because the flag should be set covered w/ sb->s_umount semaphore +* via remount procedure, otherwise, it will confuse code like +* freeze_super() which will lead to deadlocks and other problems. */ -smp_wmb (); - sb->s_flags |=SB_RDONLY ; }static void f2fs_record_error_work (struct work_struct *work)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 348/538 spi: atmel-quadspi: Undo runtime PM changes at driver exit time
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 438efb23f9581659495b85f1f6c7d5946200660c ]
It's important to undo pm_runtime_use_autosuspend() with pm_runtime_dont_use_autosuspend() at driver exit time unless driver initially enabled pm_runtime with devm_pm_runtime_enable() (which handles it for you).
Hence, call pm_runtime_dont_use_autosuspend() at driver exit time to fix it.
--- drivers/spi/atmel-quadspi.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/atmel-quadspi.c +1 -0
@@ -726,6 +726,7 @@ static void atmel_qspi_remove(struct platform_device *pdev)clk_unprepare (aq->pclk);pm_runtime_disable (&pdev->dev); +pm_runtime_dont_use_autosuspend (&pdev->dev);pm_runtime_put_noidle (&pdev->dev); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 349/538 spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 3b577de206d52dbde9428664b6d823d35a803d75 ]
It's important to undo pm_runtime_use_autosuspend() with pm_runtime_dont_use_autosuspend() at driver exit time unless driver initially enabled pm_runtime with devm_pm_runtime_enable() (which handles it for you).
Hence, call pm_runtime_dont_use_autosuspend() at driver exit time to fix it.
--- drivers/spi/spi-fsl-lpspi.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-fsl-lpspi.c +1 -0
@@ -988,6 +988,7 @@ static void fsl_lpspi_remove(struct platform_device *pdev)fsl_lpspi_dma_exit (controller); +pm_runtime_dont_use_autosuspend (fsl_lpspi->dev);pm_runtime_disable (fsl_lpspi->dev); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 350/538 lib/sbitmap: define swap_lock as raw_spinlock_t
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
[ Upstream commit 65f666c6203600053478ce8e34a1db269a8701c9 ]
When called from sbitmap_queue_get(), sbitmap_deferred_clear() may be run with preempt disabled. In RT kernel, spin_lock() can sleep, then warning of "BUG: sleeping function called from invalid context" can be triggered.
Fix it by replacing it with raw_spin_lock.
--- include/linux/sbitmap.h | 2 +- lib/sbitmap.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
include/linux/sbitmap.h +1 -1
@@ -40,7 +40,7 @@ struct sbitmap_word {/** * @swap_lock: serializes simultaneous updates of ->word and ->cleared */ -spinlock_t swap_lock; +raw_spinlock_t swap_lock; }____cacheline_aligned_in_smp ;/**
lib/sbitmap.c +2 -2
@@ -65,7 +65,7 @@ static inline bool sbitmap_deferred_clear(struct sbitmap_word *map, {unsigned long mask, word_mask; -guard (spinlock_irqsave)(&map->swap_lock); +guard (raw_spinlock_irqsave)(&map->swap_lock);if (!map->cleared) {if (depth ==0 )
@@ -136,7 +136,7 @@ int sbitmap_init_node(struct sbitmap *sb, unsigned int depth, int shift, }for (i =0 ; i < sb->map_nr; i++) -spin_lock_init (&sb->map[i].swap_lock); +raw_spin_lock_init (&sb->map[i].swap_lock);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 351/538 spi: atmel-quadspi: Avoid overwriting delay register settings
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Dahl <[email protected]>
[ Upstream commit 329ca3eed4a9a161515a8714be6ba182321385c7 ]
Previously the MR and SCR registers were just set with the supposedly required values, from cached register values (cached reg content initialized to zero).
All parts fixed here did not consider the current register (cache) content, which would make future support of cs_setup, cs_hold, and cs_inactive impossible.
Setting SCBR in atmel_qspi_setup() erases a possible DLYBS setting from atmel_qspi_set_cs_timing(). The DLYBS setting is applied by ORing over the current setting, without resetting the bits first. All writes to MR did not consider possible settings of DLYCS and DLYBCT.
--- drivers/spi/atmel-quadspi.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/spi/atmel-quadspi.c +8 -6
@@ -375,9 +375,9 @@ static int atmel_qspi_set_cfg(struct atmel_qspi *aq,* If the QSPI controller is set in regular SPI mode, set it in * Serial Memory Mode (SMM). */ -if (aq->mr !=QSPI_MR_SMM ) { -atmel_qspi_write (QSPI_MR_SMM , aq,QSPI_MR ); - aq->mr =QSPI_MR_SMM ; +if (!(aq->mr &QSPI_MR_SMM )) { + aq->mr |=QSPI_MR_SMM ; +atmel_qspi_write (aq->scr, aq,QSPI_MR ); }/* Clear pending interrupts */
@@ -501,7 +501,8 @@ static int atmel_qspi_setup(struct spi_device *spi)if (ret <0 )return ret; - aq->scr =QSPI_SCR_SCBR (scbr); + aq->scr &= ~QSPI_SCR_SCBR_MASK ; + aq->scr |=QSPI_SCR_SCBR (scbr);atmel_qspi_write (aq->scr, aq,QSPI_SCR );pm_runtime_mark_last_busy (ctrl->dev.parent);
@@ -534,6 +535,7 @@ static int atmel_qspi_set_cs_timing(struct spi_device *spi)if (ret <0 )return ret; + aq->scr &= ~QSPI_SCR_DLYBS_MASK ; aq->scr |=QSPI_SCR_DLYBS (cs_setup);atmel_qspi_write (aq->scr, aq,QSPI_SCR );
@@ -549,8 +551,8 @@ static void atmel_qspi_init(struct atmel_qspi *aq)atmel_qspi_write (QSPI_CR_SWRST , aq,QSPI_CR );/* Set the QSPI controller by default in Serial Memory Mode */ -atmel_qspi_write (QSPI_MR_SMM , aq,QSPI_MR ); - aq->mr =QSPI_MR_SMM ; + aq->mr |=QSPI_MR_SMM ; +atmel_qspi_write (aq->mr, aq,QSPI_MR );/* Enable the QSPI controller */ atmel_qspi_write (QSPI_CR_QSPIEN , aq,QSPI_CR );
Signature · 1 line
2.43.0
Re: [PATCH 6.6 351/538] spi: atmel-quadspi: Avoid overwriting delay register settings
Hello Greg,
Am Wed, Oct 02, 2024 at 02:59:50PM +0200 schrieb Greg Kroah-Hartman:
Quoted 1 line
6.6-stable review patch. If anyone has any objections, please let me know.
Same as for 6.11, if you take this, please also take <[email protected]>.
Thanks
Alex
Quoted 80 lines
------------------
From: Alexander Dahl <[email protected]>
[ Upstream commit
329ca3eed4a9a161515a8714be6ba182321385c7]Previously the MR and SCR registers were just set with the supposedly required values, from cached register values (cached reg content initialized to zero).
All parts fixed here did not consider the current register (cache) content, which would make future support of
cs_setup,cs_hold, andcs_inactiveimpossible.Setting SCBR in
atmel_qspi_setup()erases a possible DLYBS setting fromatmel_qspi_set_cs_timing(). The DLYBS setting is applied by ORing over the current setting, without resetting the bits first. All writes to MR did not consider possible settings of DLYCS and DLYBCT.Signed-off-by Alexander Dahl <[email protected]>Fixes f732646d0ccd ("spi: atmel-quadspi: Add support for configuring CS timing")Signed-off-by Mark Brown <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- drivers/spi/atmel-quadspi.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)drivers/spi/atmel-quadspi.c +8
-6@@ -375,9 +375,9 @@ static int atmel_qspi_set_cfg(struct atmel_qspi *aq,* If the QSPI controller is set in regular SPI mode, set it in * Serial Memory Mode (SMM). */ -if (aq->mr !=QSPI_MR_SMM ) { -atmel_qspi_write (QSPI_MR_SMM , aq,QSPI_MR ); - aq->mr =QSPI_MR_SMM ; +if (!(aq->mr &QSPI_MR_SMM )) { + aq->mr |=QSPI_MR_SMM ; +atmel_qspi_write (aq->scr, aq,QSPI_MR ); }/* Clear pending interrupts */ @@ -501,7 +501,8 @@ static int atmel_qspi_setup(struct spi_device *spi)if (ret <0 )return ret; - aq->scr =QSPI_SCR_SCBR (scbr); + aq->scr &= ~QSPI_SCR_SCBR_MASK ; + aq->scr |=QSPI_SCR_SCBR (scbr);atmel_qspi_write (aq->scr, aq,QSPI_SCR );pm_runtime_mark_last_busy (ctrl->dev.parent);@@ -534,6 +535,7 @@ static int atmel_qspi_set_cs_timing(struct spi_device *spi)if (ret <0 )return ret; + aq->scr &= ~QSPI_SCR_DLYBS_MASK ; aq->scr |=QSPI_SCR_DLYBS (cs_setup);atmel_qspi_write (aq->scr, aq,QSPI_SCR );@@ -549,8 +551,8 @@ static void atmel_qspi_init(struct atmel_qspi *aq)atmel_qspi_write (QSPI_CR_SWRST , aq,QSPI_CR );/* Set the QSPI controller by default in Serial Memory Mode */ -atmel_qspi_write (QSPI_MR_SMM , aq,QSPI_MR ); - aq->mr =QSPI_MR_SMM ; + aq->mr |=QSPI_MR_SMM ; +atmel_qspi_write (aq->mr, aq,QSPI_MR );/* Enable the QSPI controller */ atmel_qspi_write (QSPI_CR_QSPIEN , aq,QSPI_CR );Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 352/538 nvme-multipath: system fails to create generic nvme device
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Reinecke <[email protected]>
[ Upstream commit 63bcf9014e95a7d279d10d8e2caa5d88db2b1855 ]
NVME_NSHEAD_DISK_LIVE is a flag for struct nvme_ns_head, not nvme_ns. The current code has a typo causing NVME_NSHEAD_DISK_LIVE never to be cleared once device_add_disk_fails, causing the system never to create the 'generic' character device. Even several rescan attempts will change the situation and the system has to be rebooted to fix the issue.
--- drivers/nvme/host/multipath.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/multipath.c +1 -1
@@ -585,7 +585,7 @@ static void nvme_mpath_set_live(struct nvme_ns *ns) rc =device_add_disk (&head->subsys->dev, head->disk, nvme_ns_id_attr_groups);if (rc) { -clear_bit (NVME_NSHEAD_DISK_LIVE , &ns->flags); +clear_bit (NVME_NSHEAD_DISK_LIVE , &head->flags);return ; }nvme_add_ns_head_cdev (head);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 353/538 iio: adc: ad7606: fix oversampling gpio array
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Stols <[email protected]>
[ Upstream commit 8dc4594b54dbaaba40dc8884ad3d42083de39434 ]
gpiod_set_array_value was misused here: the implementation relied on the assumption that an unsigned long was required for each gpio, while the function expects a bit array stored in "as much unsigned long as needed for storing one bit per GPIO", i.e it is using a bit field.
This leaded to incorrect parameter passed to gpiod_set_array_value, that would set 1 value instead of 3.
It also prevents to select the software mode correctly for the AD7606B.
--- drivers/iio/adc/ad7606.c | 4 ++-- drivers/iio/adc/ad7606_spi.c | 5 +++-- 2 files changed, 5 insertions(+), 4 deletions(-)
drivers/iio/adc/ad7606.c +2 -2
@@ -215,9 +215,9 @@ static int ad7606_write_os_hw(struct iio_dev *indio_dev, int val)struct ad7606_state *st =iio_priv (indio_dev);DECLARE_BITMAP (values,3 ); - values[0 ] = val; + values[0 ] = val &GENMASK (2 ,0 ); -gpiod_set_array_value (ARRAY_SIZE (values), st->gpio_os->desc, +gpiod_set_array_value (st->gpio_os->ndescs, st->gpio_os->desc, st->gpio_os->info, values);/* AD7616 requires a reset to update value */
drivers/iio/adc/ad7606_spi.c +3 -2
@@ -249,8 +249,9 @@ static int ad7616_sw_mode_config(struct iio_dev *indio_dev)static int ad7606B_sw_mode_config (struct iio_dev *indio_dev) {struct ad7606_state *st =iio_priv (indio_dev); -unsigned long os[3 ] = {1 }; +DECLARE_BITMAP (os,3 ); +bitmap_fill (os,3 );/* * Software mode is enabled when all three oversampling * pins are set to high. If oversampling gpios are defined
@@ -258,7 +259,7 @@ static int ad7606B_sw_mode_config(struct iio_dev *indio_dev)* otherwise, they must be hardwired to VDD */ if (st->gpio_os) { -gpiod_set_array_value (ARRAY_SIZE (os), +gpiod_set_array_value (st->gpio_os->ndescs, st->gpio_os->desc, st->gpio_os->info, os); }/* OS of 128 and 256 are available only in software mode */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 354/538 iio: adc: ad7606: fix standby gpio state to match the documentation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Stols <[email protected]>
[ Upstream commit 059fe4f8bbdf5cad212e1aeeb3e8968c80b9ff3b ]
The binding's documentation specifies that "As the line is active low, it should be marked GPIO_ACTIVE_LOW". However, in the driver, it was handled the opposite way. This commit sets the driver's behaviour in sync with the documentation
--- drivers/iio/adc/ad7606.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iio/adc/ad7606.c +2 -2
@@ -422,7 +422,7 @@ static int ad7606_request_gpios(struct ad7606_state *st)return PTR_ERR (st->gpio_range); st->gpio_standby =devm_gpiod_get_optional (dev,"standby" , -GPIOD_OUT_HIGH ); +GPIOD_OUT_LOW );if (IS_ERR (st->gpio_standby))return PTR_ERR (st->gpio_standby);
@@ -665,7 +665,7 @@ static int ad7606_suspend(struct device *dev)if (st->gpio_standby) {gpiod_set_value (st->gpio_range,1 ); -gpiod_set_value (st->gpio_standby,0 ); +gpiod_set_value (st->gpio_standby,1 ); }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 355/538 driver core: Fix error handling in driver API device_rename()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
[ Upstream commit 6d8249ac29bc23260dfa9747eb398ce76012d73c ]
For class-device, device_rename() failure maybe cause unexpected link name within its class folder as explained below:
/sys/class/.../old_name -> /sys/devices/.../old_name device_rename(..., new_name) and failed /sys/class/.../new_name -> /sys/devices/.../old_name
Fixed by undoing renaming link if renaming kobject failed.
--- drivers/base/core.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/base/core.c +10 -5
@@ -4485,9 +4485,11 @@ EXPORT_SYMBOL_GPL(device_destroy);*/ int device_rename (struct device *dev,const char *new_name) { +struct subsys_private *sp =NULL ;struct kobject *kobj = &dev->kobj;char *old_device_name =NULL ;int error; +bool is_link_renamed = false; dev =get_device (dev);if (!dev)
@@ -4502,7 +4504,7 @@ int device_rename(struct device *dev, const char *new_name) }if (dev->class) { -struct subsys_private *sp =class_to_subsys (dev->class); + sp =class_to_subsys (dev->class);if (!sp) { error = -EINVAL ;
@@ -4511,16 +4513,19 @@ int device_rename(struct device *dev, const char *new_name) error =sysfs_rename_link_ns (&sp->subsys.kobj, kobj, old_device_name, new_name,kobject_namespace (kobj)); -subsys_put (sp);if (error) goto out; + + is_link_renamed = true; } error =kobject_rename (kobj, new_name); -if (error) - goto out; - out: +if (error && is_link_renamed) +sysfs_rename_link_ns (&sp->subsys.kobj, kobj, new_name, + old_device_name,kobject_namespace (kobj)); +subsys_put (sp); +put_device (dev);kfree (old_device_name);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 356/538 ABI: testing: fix admv8818 attr description
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antoniu Miclaus <[email protected]>
[ Upstream commit 7d34b4ad8cd2867b130b5b8d7d76d0d6092bd019 ]
Fix description of the filter_mode_available attribute by pointing to the correct name of the attribute that can be written with valid values.
--- Documentation/ABI/testing/sysfs-bus-iio-filter-admv8818 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/ABI/testing/sysfs-bus-iio-filter-admv8818 +1 -1
@@ -3,7 +3,7 @@ KernelVersion: Contact: [email protected] Description: Reading this returns the valid values that can be written to the - on_altvoltage0_mode attribute: + filter_mode attribute: - auto -> Adjust bandpass filter to track changes in input clock rate. - manual -> disable/unregister the clock rate notifier / input clock tracking.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 357/538 iio: chemical: bme680: Fix read/write ops to device by adding mutexes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasileios Amoiridis <[email protected]>
[ Upstream commit 77641e5a477d428335cd094b88ac54e09ccb70f4 ]
Add mutexes in the {read/write}_raw() functions of the device to guard the read/write of data from/to the device. This is necessary because for any operation other than temperature, multiple reads need to take place from the device. Even though regmap has a locking by itself, it won't protect us from multiple applications trying to read at the same time temperature and pressure since the pressure reading includes an internal temperature reading and there is nothing to ensure that this temperature+pressure reading will happen sequentially without any other operation interfering in the meantime.
--- drivers/iio/chemical/bme680_core.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/iio/chemical/bme680_core.c +7 -0
@@ -10,6 +10,7 @@*/ #include <linux/acpi.h> #include <linux/bitfield.h> +#include <linux/cleanup.h> #include <linux/delay.h> #include <linux/device.h> #include <linux/module.h>
@@ -52,6 +53,7 @@ struct bme680_calib {struct bme680_data {struct regmap *regmap;struct bme680_calib bme680; +struct mutex lock;/* Protect multiple serial R/W ops to device. */ u8 oversampling_temp;u8 oversampling_press;u8 oversampling_humid;
@@ -827,6 +829,8 @@ static int bme680_read_raw(struct iio_dev *indio_dev, {struct bme680_data *data =iio_priv (indio_dev); +guard (mutex)(&data->lock); +switch (mask) {case IIO_CHAN_INFO_PROCESSED :switch (chan->type) {
@@ -871,6 +875,8 @@ static int bme680_write_raw(struct iio_dev *indio_dev, {struct bme680_data *data =iio_priv (indio_dev); +guard (mutex)(&data->lock); +if (val2 !=0 )return -EINVAL ;
@@ -967,6 +973,7 @@ int bme680_core_probe(struct device *dev, struct regmap *regmap, name =bme680_match_acpi_device (dev); data =iio_priv (indio_dev); +mutex_init (&data->lock);dev_set_drvdata (dev, indio_dev); data->regmap = regmap; indio_dev->name = name;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 358/538 iio: magnetometer: ak8975: Convert enum->pointer for data in the match tables
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 4f9ea93afde190a0f906ee624fc9a45cf784551b ]
Convert enum->pointer for data in the match tables to simplify the probe() by replacing device_get_match_data() and i2c_client_get_device_id by i2c_get_match_data() as we have similar I2C, ACPI and DT matching table.
Stable-dep-of: da6e3160df23 ("iio: magnetometer: ak8975: drop incorrect AK09116 compatible")
--- drivers/iio/magnetometer/ak8975.c | 75 +++++++++++++------------------ 1 file changed, 30 insertions(+), 45 deletions(-)
drivers/iio/magnetometer/ak8975.c +30 -45
@@ -813,13 +813,13 @@ static const struct iio_info ak8975_info = { };static const struct acpi_device_id ak_acpi_match[] = { - {"AK8975" ,AK8975 }, - {"AK8963" ,AK8963 }, - {"INVN6500" ,AK8963 }, - {"AK009911" ,AK09911 }, - {"AK09911" ,AK09911 }, - {"AKM9911" ,AK09911 }, - {"AK09912" ,AK09912 }, + {"AK8975" , (kernel_ulong_t)&ak_def_array[AK8975 ] }, + {"AK8963" , (kernel_ulong_t)&ak_def_array[AK8963 ] }, + {"INVN6500" , (kernel_ulong_t)&ak_def_array[AK8963 ] }, + {"AK009911" , (kernel_ulong_t)&ak_def_array[AK09911 ] }, + {"AK09911" , (kernel_ulong_t)&ak_def_array[AK09911 ] }, + {"AKM9911" , (kernel_ulong_t)&ak_def_array[AK09911 ] }, + {"AK09912" , (kernel_ulong_t)&ak_def_array[AK09912 ] }, { } };MODULE_DEVICE_TABLE (acpi, ak_acpi_match);
@@ -883,10 +883,7 @@ static int ak8975_probe(struct i2c_client *client)struct iio_dev *indio_dev;struct gpio_desc *eoc_gpiod;struct gpio_desc *reset_gpiod; -const void *match; -unsigned int i;int err; -enum asahi_compass_chipset chipset;const char *name =NULL ;/*
@@ -928,27 +925,15 @@ static int ak8975_probe(struct i2c_client *client)return err;/* id will be NULL when enumerated via ACPI */ - match =device_get_match_data (&client->dev); -if (match) { - chipset = (uintptr_t )match; - name =dev_name (&client->dev); - }else if (id) { - chipset = (enum asahi_compass_chipset )(id->driver_data); - name = id->name; - }else -return -ENOSYS ; - -for (i =0 ; i <ARRAY_SIZE (ak_def_array); i++) -if (ak_def_array[i].type == chipset) -break ; - -if (i ==ARRAY_SIZE (ak_def_array)) { -dev_err (&client->dev,"AKM device type unsupported: %d\n" , - chipset); + data->def =i2c_get_match_data (client); +if (!data->def)return -ENODEV ; - } - data->def = &ak_def_array[i]; +/* If enumerated via firmware node, fix the ABI */ +if (dev_fwnode (&client->dev)) + name =dev_name (&client->dev); +else + name = id->name;/* Fetch the regulators */ data->vdd =devm_regulator_get (&client->dev,"vdd" );
@@ -1077,28 +1062,28 @@ static DEFINE_RUNTIME_DEV_PM_OPS(ak8975_dev_pm_ops, ak8975_runtime_suspend, ak8975_runtime_resume, NULL);static const struct i2c_device_id ak8975_id[] = { - {"ak8975" ,AK8975 }, - {"ak8963" ,AK8963 }, - {"AK8963" ,AK8963 }, - {"ak09911" ,AK09911 }, - {"ak09912" ,AK09912 }, - {"ak09916" ,AK09916 }, + {"ak8975" , (kernel_ulong_t)&ak_def_array[AK8975 ] }, + {"ak8963" , (kernel_ulong_t)&ak_def_array[AK8963 ] }, + {"AK8963" , (kernel_ulong_t)&ak_def_array[AK8963 ] }, + {"ak09911" , (kernel_ulong_t)&ak_def_array[AK09911 ] }, + {"ak09912" , (kernel_ulong_t)&ak_def_array[AK09912 ] }, + {"ak09916" , (kernel_ulong_t)&ak_def_array[AK09916 ] }, {} };MODULE_DEVICE_TABLE (i2c, ak8975_id);static const struct of_device_id ak8975_of_match[] = { - { .compatible ="asahi-kasei,ak8975" , }, - { .compatible ="ak8975" , }, - { .compatible ="asahi-kasei,ak8963" , }, - { .compatible ="ak8963" , }, - { .compatible ="asahi-kasei,ak09911" , }, - { .compatible ="ak09911" , }, - { .compatible ="asahi-kasei,ak09912" , }, - { .compatible ="ak09912" , }, - { .compatible ="asahi-kasei,ak09916" , }, - { .compatible ="ak09916" , }, + { .compatible ="asahi-kasei,ak8975" , .data = &ak_def_array[AK8975 ] }, + { .compatible ="ak8975" , .data = &ak_def_array[AK8975 ] }, + { .compatible ="asahi-kasei,ak8963" , .data = &ak_def_array[AK8963 ] }, + { .compatible ="ak8963" , .data = &ak_def_array[AK8963 ] }, + { .compatible ="asahi-kasei,ak09911" , .data = &ak_def_array[AK09911 ] }, + { .compatible ="ak09911" , .data = &ak_def_array[AK09911 ] }, + { .compatible ="asahi-kasei,ak09912" , .data = &ak_def_array[AK09912 ] }, + { .compatible ="ak09912" , .data = &ak_def_array[AK09912 ] }, + { .compatible ="asahi-kasei,ak09916" , .data = &ak_def_array[AK09916 ] }, + { .compatible ="ak09916" , .data = &ak_def_array[AK09916 ] }, {} };MODULE_DEVICE_TABLE (of, ak8975_of_match);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 359/538 iio: magnetometer: ak8975: drop incorrect AK09116 compatible
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit da6e3160df230692bbd48a6d52318035f19595e2 ]
All compatibles in this binding without prefixes were deprecated, so adding a new deprecated one after some time is not allowed, because it defies the core logic of deprecating things.
Drop the AK09916 vendorless compatible.
--- drivers/iio/magnetometer/ak8975.c | 1 - 1 file changed, 1 deletion(-)
drivers/iio/magnetometer/ak8975.c +0 -1
@@ -1083,7 +1083,6 @@ static const struct of_device_id ak8975_of_match[] = { { .compatible = "asahi-kasei,ak09912", .data = &ak_def_array[AK09912] }, { .compatible = "ak09912", .data = &ak_def_array[AK09912] }, { .compatible = "asahi-kasei,ak09916", .data = &ak_def_array[AK09916] }, - { .compatible = "ak09916", .data = &ak_def_array[AK09916] }, {} };MODULE_DEVICE_TABLE (of, ak8975_of_match);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 360/538 dt-bindings: iio: asahi-kasei,ak8975: drop incorrect AK09116 compatible
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit c7668ac67bc21aebdd8e2d7f839bfffba31b7713 ]
All compatibles in this binding without prefixes were deprecated, so adding a new deprecated one after some time is not allowed, because it defies the core logic of deprecating things.
Drop the AK09916 vendorless compatible.
--- .../devicetree/bindings/iio/magnetometer/asahi-kasei,ak8975.yaml | 1 - 1 file changed, 1 deletion(-)
Documentation/devicetree/bindings/iio/magnetometer/asahi-kasei,ak8975.yaml +0 -1
@@ -23,7 +23,6 @@ properties: - ak8963 - ak09911 - ak09912 - - ak09916 deprecated: true reg:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 361/538 driver core: Fix a potential null-ptr-deref in module_add_driver()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 18ec12c97b39ff6aa15beb8d2b25d15cd44b87d8 ]
Inject fault while probing of-fpga-region, if kasprintf() fails in module_add_driver(), the second sysfs_remove_link() in exit path will cause null-ptr-deref as below because kernfs_name_hash() will call strlen() with NULL driver_name.
Fix it by releasing resources based on the exit path sequence.
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [dfffffc000000000] address between user and kernel address ranges Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: of_fpga_region(+) fpga_region fpga_bridge cfg80211 rfkill 8021q garp mrp stp llc ipv6 [last unloaded: of_fpga_region] CPU: 2 UID: 0 PID: 2036 Comm: modprobe Not tainted 6.11.0-rc2-g6a0e38264012 #295 Hardware name: linux,dummy-virt (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : strlen+0x24/0xb0 lr : kernfs_name_hash+0x1c/0xc4 sp : ffffffc081f97380 x29: ffffffc081f97380 x28: ffffffc081f97b90 x27: ffffff80c821c2a0 x26: ffffffedac0be418 x25: 0000000000000000 x24: ffffff80c09d2000 x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000 x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000001840 x17: 0000000000000000 x16: 0000000000000000 x15: 1ffffff8103f2e42 x14: 00000000f1f1f1f1 x13: 0000000000000004 x12: ffffffb01812d61d x11: 1ffffff01812d61c x10: ffffffb01812d61c x9 : dfffffc000000000 x8 : 0000004fe7ed29e4 x7 : ffffff80c096b0e7 x6 : 0000000000000001 x5 : ffffff80c096b0e0 x4 : 1ffffffdb990efa2 x3 : 0000000000000000 x2 : 0000000000000000 x1 : dfffffc000000000 x0 : 0000000000000000 Call trace: strlen+0x24/0xb0 kernfs_name_hash+0x1c/0xc4 kernfs_find_ns+0x118/0x2e8 kernfs_remove_by_name_ns+0x80/0x100 sysfs_remove_link+0x74/0xa8 module_add_driver+0x278/0x394 bus_add_driver+0x1f0/0x43c driver_register+0xf4/0x3c0 __platform_driver_register+0x60/0x88 of_fpga_region_init+0x20/0x1000 [of_fpga_region] do_one_initcall+0x110/0x788 do_init_module+0x1dc/0x5c8 load_module+0x3c38/0x4cac init_module_from_file+0xd4/0x128 idempotent_init_module+0x2cc/0x528 __arm64_sys_finit_module+0xac/0x100 invoke_syscall+0x6c/0x258 el0_svc_common.constprop.0+0x160/0x22c do_el0_svc+0x44/0x5c el0_svc+0x48/0xb8 el0t_64_sync_handler+0x13c/0x158 el0t_64_sync+0x190/0x194 Code: f2fbffe1 a90157f4 12000802 aa0003f5 (38e16861) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception
--- drivers/base/module.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
drivers/base/module.c +9 -5
@@ -66,27 +66,31 @@ int module_add_driver(struct module *mod, struct device_driver *drv) driver_name =make_driver_name (drv);if (!driver_name) { ret = -ENOMEM ; - goto out; + goto out_remove_kobj; }module_create_drivers_dir (mk);if (!mk->drivers_dir) { ret = -EINVAL ; - goto out; + goto out_free_driver_name; } ret =sysfs_create_link (mk->drivers_dir, &drv->p->kobj, driver_name);if (ret) - goto out; + goto out_remove_drivers_dir;kfree (driver_name);return 0 ; -out: -sysfs_remove_link (&drv->p->kobj,"module" ); + +out_remove_drivers_dir:sysfs_remove_link (mk->drivers_dir, driver_name); + +out_free_driver_name:kfree (driver_name); +out_remove_kobj: +sysfs_remove_link (&drv->p->kobj,"module" );return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 362/538 serial: 8250: omap: Cleanup on error in request_irq
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Schneider-Pargmann <[email protected]>
[ Upstream commit 35e648a16018b747897be2ccc3ce95ff23237bb5 ]
If devm_request_irq fails, the code does not cleanup many things that were setup before. Instead of directly returning ret we should jump to err.
--- drivers/tty/serial/8250/8250_omap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/8250/8250_omap.c +1 -1
@@ -1567,7 +1567,7 @@ static int omap8250_probe(struct platform_device *pdev) ret =devm_request_irq (&pdev->dev, irq, omap8250_irq,0 ,dev_name (&pdev->dev), priv);if (ret <0 ) -return ret; + goto err; priv->wakeirq =irq_of_parse_and_map (np,1 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 363/538 coresight: tmc: sg: Do not leak sg_table
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suzuki K Poulose <[email protected]>
[ Upstream commit c58dc5a1f886f2fcc1133746d0cbaa1fe7fd44ff ]
Running perf with cs_etm on Juno triggers the following kmemleak warning !
:~# cat /sys/kernel/debug/kmemleak unreferenced object 0xffffff8806b6d720 (size 96): comm "perf", pid 562, jiffies 4297810960 hex dump (first 32 bytes): 38 d8 13 07 88 ff ff ff 00 d0 9e 85 c0 ff ff ff 8............... 00 10 00 88 c0 ff ff ff 00 f0 ff f7 ff 00 00 00 ................ backtrace (crc 1dbf6e00): [<ffffffc08107381c>] kmemleak_alloc+0xbc/0xd8 [<ffffffc0802f9798>] kmalloc_trace_noprof+0x220/0x2e8 [<ffffffc07bb71948>] tmc_alloc_sg_table+0x48/0x208 [coresight_tmc] [<ffffffc07bb71cbc>] tmc_etr_alloc_sg_buf+0xac/0x240 [coresight_tmc] [<ffffffc07bb72538>] tmc_alloc_etr_buf.constprop.0+0x1f0/0x260 [coresight_tmc] [<ffffffc07bb7280c>] alloc_etr_buf.constprop.0.isra.0+0x74/0xa8 [coresight_tmc] [<ffffffc07bb72950>] tmc_alloc_etr_buffer+0x110/0x260 [coresight_tmc] [<ffffffc07bb38afc>] etm_setup_aux+0x204/0x3b0 [coresight] [<ffffffc08025837c>] rb_alloc_aux+0x20c/0x318 [<ffffffc08024dd84>] perf_mmap+0x2e4/0x7a0 [<ffffffc0802cceb0>] mmap_region+0x3b0/0xa08 [<ffffffc0802cd8a8>] do_mmap+0x3a0/0x500 [<ffffffc080295328>] vm_mmap_pgoff+0x100/0x1d0 [<ffffffc0802cadf8>] ksys_mmap_pgoff+0xb8/0x110 [<ffffffc080020688>] __arm64_sys_mmap+0x38/0x58 [<ffffffc080028fc0>] invoke_syscall.constprop.0+0x58/0x100
This due to the fact that we do not free the "sg_table" itself while freeing up the SG table and data pages. Fix this by freeing the sg_table in tmc_free_sg_table().
--- drivers/hwtracing/coresight/coresight-tmc-etr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwtracing/coresight/coresight-tmc-etr.c +1 -1
@@ -255,6 +255,7 @@ void tmc_free_sg_table(struct tmc_sg_table *sg_table) {tmc_free_table_pages (sg_table);tmc_free_data_pages (sg_table); +kfree (sg_table); }EXPORT_SYMBOL_GPL (tmc_free_sg_table);
@@ -336,7 +337,6 @@ struct tmc_sg_table *tmc_alloc_sg_table(struct device *dev, rc =tmc_alloc_table_pages (sg_table);if (rc) {tmc_free_sg_table (sg_table); -kfree (sg_table);return ERR_PTR (rc); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 364/538 interconnect: icc-clk: Add missed num_nodes initialization
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit c801ed86840ec38b2a9bcafeee3d7c9e14c743f3 ]
With the new __counted_by annotation, the "num_nodes" struct member must be set before accessing the "nodes" array. This initialization was done in other places where a new struct icc_onecell_data is allocated, but this case in icc_clk_register() was missed. Set "num_nodes" after allocation.
--- drivers/interconnect/icc-clk.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/interconnect/icc-clk.c +1 -2
@@ -87,6 +87,7 @@ struct icc_provider *icc_clk_register(struct device *dev, onecell =devm_kzalloc (dev,struct_size (onecell, nodes,2 * num_clocks),GFP_KERNEL );if (!onecell)return ERR_PTR (-ENOMEM ); + onecell->num_nodes =2 * num_clocks; qp =devm_kzalloc (dev,struct_size (qp, clocks, num_clocks),GFP_KERNEL );if (!qp)
@@ -133,8 +134,6 @@ struct icc_provider *icc_clk_register(struct device *dev, onecell->nodes[j++] = node; } - onecell->num_nodes = j; - ret =icc_provider_register (provider);if (ret) goto err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 365/538 cxl/pci: Fix to record only non-zero ranges
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yanfei Xu <[email protected]>
[ Upstream commit 55e268694e8b07026c88191f9b6949b6887d9ce3 ]
The function cxl_dvsec_rr_decode() retrieves and records DVSEC ranges into info->dvsec_range[], regardless of whether it is non-zero range, and the variable info->ranges indicates the number of non-zero ranges. However, in cxl_hdm_decode_init(), the validation for info->dvsec_range[] occurs in a for loop that iterates based on info->ranges. It may result in zero range to be validated but non-zero range not be validated, in turn, the number of allowed ranges is to be
0. Address it by only record non-zero ranges.
This fix is not urgent as it requires a configuration that zeroes out the first dvsec range while populating the second. This has not been observed, but it is theoretically possible. If this gets picked up for -stable, no harm done, but there is no urgency to backport.
--- drivers/cxl/core/pci.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/cxl/core/pci.c +1 -7
@@ -388,10 +388,6 @@ int cxl_dvsec_rr_decode(struct device *dev, int d, size |= temp &CXL_DVSEC_MEM_SIZE_LOW_MASK ;if (!size) { - info->dvsec_range[i] = (struct range ) { - .start =0 , - .end =CXL_RESOURCE_NONE , - };continue ; }
@@ -409,12 +405,10 @@ int cxl_dvsec_rr_decode(struct device *dev, int d, base |= temp &CXL_DVSEC_MEM_BASE_LOW_MASK ; - info->dvsec_range[i] = (struct range ) { + info->dvsec_range[ranges++] = (struct range ) { .start = base, .end = base + size -1 }; - - ranges++; } info->ranges = ranges;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 366/538 vhost_vdpa: assign irq bypass producer token correctly
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <[email protected]>
[ Upstream commit 02e9e9366fefe461719da5d173385b6685f70319 ]
We used to call irq_bypass_unregister_producer() in vhost_vdpa_setup_vq_irq() which is problematic as we don't know if the token pointer is still valid or not.
Actually, we use the eventfd_ctx as the token so the life cycle of the token should be bound to the VHOST_SET_VRING_CALL instead of vhost_vdpa_setup_vq_irq() which could be called by set_status().
Fixing this by setting up irq bypass producer's token when handling VHOST_SET_VRING_CALL and un-registering the producer before calling vhost_vring_ioctl() to prevent a possible use after free as eventfd could have been released in vhost_vring_ioctl(). And such registering and unregistering will only be done if DRIVER_OK is set.
Message-Id: <[email protected]>
--- drivers/vhost/vdpa.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/vhost/vdpa.c +13 -3
@@ -191,11 +191,9 @@ static void vhost_vdpa_setup_vq_irq(struct vhost_vdpa *v, u16 qid)if (irq <0 )return ; -irq_bypass_unregister_producer (&vq->call_ctx.producer);if (!vq->call_ctx.ctx)return ; - vq->call_ctx.producer.token = vq->call_ctx.ctx; vq->call_ctx.producer.irq = irq; ret =irq_bypass_register_producer (&vq->call_ctx.producer);if (unlikely (ret))
@@ -627,6 +625,14 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd, vq->last_avail_idx = vq_state.split.avail_index; }break ; +case VHOST_SET_VRING_CALL : +if (vq->call_ctx.ctx) { +if (ops->get_status (vdpa) & +VIRTIO_CONFIG_S_DRIVER_OK ) +vhost_vdpa_unsetup_vq_irq (v, idx); + vq->call_ctx.producer.token =NULL ; + } +break ; } r =vhost_vring_ioctl (&v->vdev, cmd, argp);
@@ -659,13 +665,16 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd, cb.callback = vhost_vdpa_virtqueue_cb; cb.private = vq; cb.trigger = vq->call_ctx.ctx; + vq->call_ctx.producer.token = vq->call_ctx.ctx; +if (ops->get_status (vdpa) & +VIRTIO_CONFIG_S_DRIVER_OK ) +vhost_vdpa_setup_vq_irq (v, idx); }else { cb.callback =NULL ; cb.private =NULL ; cb.trigger =NULL ; } ops->set_vq_cb (vdpa, idx, &cb); -vhost_vdpa_setup_vq_irq (v, idx);break ;case VHOST_SET_VRING_NUM :
@@ -1316,6 +1325,7 @@ static int vhost_vdpa_open(struct inode *inode, struct file *filep)for (i =0 ; i < nvqs; i++) { vqs[i] = &v->vqs[i]; vqs[i]->handle_kick = handle_vq_kick; + vqs[i]->call_ctx.ctx =NULL ; }vhost_dev_init (dev, vqs, nvqs,0 ,0 ,0 , false, vhost_vdpa_process_iotlb_msg);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 367/538 ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit c7f06284a6427475e3df742215535ec3f6cd9662 ]
The psc->div[] array has psc->num_div elements. These values come from when we call clk_hw_register_div(). It's adc_divisors and ARRAY_SIZE(adc_divisors)) and so on. So this condition needs to be >= instead of > to prevent an out of bounds read.
--- arch/arm/mach-ep93xx/clock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mach-ep93xx/clock.c +1 -1
@@ -359,7 +359,7 @@ static unsigned long ep93xx_div_recalc_rate(struct clk_hw *hw,u32 val =__raw_readl (psc->reg);u8 index = (val & psc->mask) >> psc->shift; -if (index > psc->num_div) +if (index >= psc->num_div)return 0 ;return DIV_ROUND_UP_ULL (parent_rate, psc->div[index]);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 368/538 Revert "dm: requeue IO if mapping table not yet available"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
[ Upstream commit c8691cd0fc11197515ed148de0780d927bfca38b ]
This reverts commit fa247089de9936a46e290d4724cb5f0b845600f5.
The following sequence of commands causes a livelock - there will be workqueue process looping and consuming 100% CPU:
dmsetup create --notable test
truncate -s 1MiB testdata
losetup /dev/loop0 testdata
dmsetup load test --table '0 2048 linear /dev/loop0 0' dd if=/dev/zero of=/dev/dm-0 bs=16k count=1 conv=fdatasync
The livelock is caused by the commit fa247089de99. The commit claims that it fixes a race condition, however, it is unknown what the actual race condition is and what program is involved in the race condition.
When the inactive table is loaded, the nodes /dev/dm-0 and /sys/block/dm-0 are created. /dev/dm-0 has zero size at this point. When the device is suspended and resumed, the nodes /dev/mapper/test and /dev/disk/* are created.
If some program opens a block device before it is created by dmsetup or lvm, the program is buggy, so dm could just report an error as it used to do before.
--- drivers/md/dm-rq.c | 4 +++- drivers/md/dm.c | 11 ++++++++--- 2 files changed, 11 insertions(+), 4 deletions(-)
drivers/md/dm-rq.c +3 -1
@@ -496,8 +496,10 @@ static blk_status_t dm_mq_queue_rq(struct blk_mq_hw_ctx *hctx, map =dm_get_live_table (md, &srcu_idx);if (unlikely (!map)) { +DMERR_LIMIT ("%s: mapping table unavailable, erroring io" , +dm_device_name (md));dm_put_live_table (md, srcu_idx); -return BLK_STS_RESOURCE ; +return BLK_STS_IOERR ; } ti =dm_table_find_target (map,0 );dm_put_live_table (md, srcu_idx);
drivers/md/dm.c +8 -3
@@ -1817,10 +1817,15 @@ static void dm_submit_bio(struct bio *bio)struct dm_table *map; map =dm_get_live_table (md, &srcu_idx); +if (unlikely (!map)) { +DMERR_LIMIT ("%s: mapping table unavailable, erroring io" , +dm_device_name (md)); +bio_io_error (bio); + goto out; + } -/* If suspended, or map not yet available, queue this IO for later */ -if (unlikely (test_bit (DMF_BLOCK_IO_FOR_SUSPEND , &md->flags)) || -unlikely (!map)) { +/* If suspended, queue this IO for later */ +if (unlikely (test_bit (DMF_BLOCK_IO_FOR_SUSPEND , &md->flags))) {if (bio->bi_opf &REQ_NOWAIT )bio_wouldblock_error (bio);else if (bio->bi_opf &REQ_RAHEAD )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 369/538 net: xilinx: axienet: Schedule NAPI in two steps
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit ba0da2dc934ec5ac32bbeecbd0670da16ba03565 ]
As advised by Documentation/networking/napi.rst, masking IRQs after calling napi_schedule can be racy. Avoid this by only masking/scheduling if napi_schedule_prep returns true.
--- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/net/ethernet/xilinx/xilinx_axienet_main.c +8 -6
@@ -1042,9 +1042,10 @@ static irqreturn_t axienet_tx_irq(int irq, void *_ndev)u32 cr = lp->tx_dma_cr; cr &= ~(XAXIDMA_IRQ_IOC_MASK |XAXIDMA_IRQ_DELAY_MASK ); -axienet_dma_out32 (lp,XAXIDMA_TX_CR_OFFSET , cr); - -napi_schedule (&lp->napi_tx); +if (napi_schedule_prep (&lp->napi_tx)) { +axienet_dma_out32 (lp,XAXIDMA_TX_CR_OFFSET , cr); +__napi_schedule (&lp->napi_tx); + } }return IRQ_HANDLED ;
@@ -1086,9 +1087,10 @@ static irqreturn_t axienet_rx_irq(int irq, void *_ndev)u32 cr = lp->rx_dma_cr; cr &= ~(XAXIDMA_IRQ_IOC_MASK |XAXIDMA_IRQ_DELAY_MASK ); -axienet_dma_out32 (lp,XAXIDMA_RX_CR_OFFSET , cr); - -napi_schedule (&lp->napi_rx); +if (napi_schedule_prep (&lp->napi_rx)) { +axienet_dma_out32 (lp,XAXIDMA_RX_CR_OFFSET , cr); +__napi_schedule (&lp->napi_rx); + } }return IRQ_HANDLED ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 370/538 net: xilinx: axienet: Fix packet counting
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit 5a6caa2cfabb559309b5ce29ee7c8e9ce1a9a9df ]
axienet_free_tx_chain returns the number of DMA descriptors it's handled. However, axienet_tx_poll treats the return as the number of packets. When scatter-gather SKBs are enabled, a single packet may use multiple DMA descriptors, which causes incorrect packet counts. Fix this by explicitly keepting track of the number of packets processed as separate from the DMA descriptors.
Budget does not affect the number of Tx completions we can process for NAPI, so we use the ring size as the limit instead of budget. As we no longer return the number of descriptors processed to axienet_tx_poll, we now update tx_bd_ci in axienet_free_tx_chain.
--- .../net/ethernet/xilinx/xilinx_axienet_main.c | 23 +++++++++++-------- 1 file changed, 14 insertions(+), 9 deletions(-)
drivers/net/ethernet/xilinx/xilinx_axienet_main.c +14 -9
@@ -652,15 +652,15 @@ static int axienet_device_reset(struct net_device *ndev)* * Would either be called after a successful transmit operation, or after * there was an error when setting up the chain. -* Returns the number of descriptors handled. +* Returns the number of packets handled. */ static int axienet_free_tx_chain (struct axienet_local *lp,u32 first_bd,int nr_bds,bool force,u32 *sizep,int budget) {struct axidma_bd *cur_p;unsigned int status; +int i, packets =0 ;dma_addr_t phys; -int i;for (i =0 ; i < nr_bds; i++) { cur_p = &lp->tx_bd_v[(first_bd + i) % lp->tx_bd_num];
@@ -679,8 +679,10 @@ static int axienet_free_tx_chain(struct axienet_local *lp, u32 first_bd, (cur_p->cntrl &XAXIDMA_BD_CTRL_LENGTH_MASK ), DMA_TO_DEVICE); -if (cur_p->skb && (status &XAXIDMA_BD_STS_COMPLETE_MASK )) +if (cur_p->skb && (status &XAXIDMA_BD_STS_COMPLETE_MASK )) {napi_consume_skb (cur_p->skb, budget); + packets++; + } cur_p->app0 =0 ; cur_p->app1 =0 ;
@@ -696,7 +698,13 @@ static int axienet_free_tx_chain(struct axienet_local *lp, u32 first_bd, *sizep += status &XAXIDMA_BD_STS_ACTUAL_LEN_MASK ; } -return i; +if (!force) { + lp->tx_bd_ci += i; +if (lp->tx_bd_ci >= lp->tx_bd_num) + lp->tx_bd_ci %= lp->tx_bd_num; + } + +return packets; }/**
@@ -747,13 +755,10 @@ static int axienet_tx_poll(struct napi_struct *napi, int budget)u32 size =0 ;int packets; - packets =axienet_free_tx_chain (lp, lp->tx_bd_ci, budget, false, &size, budget); + packets =axienet_free_tx_chain (lp, lp->tx_bd_ci, lp->tx_bd_num, false, + &size, budget);if (packets) { - lp->tx_bd_ci += packets; -if (lp->tx_bd_ci >= lp->tx_bd_num) - lp->tx_bd_ci %= lp->tx_bd_num; -u64_stats_update_begin (&lp->tx_stat_sync);u64_stats_add (&lp->tx_packets, packets);u64_stats_add (&lp->tx_bytes, size);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 371/538 netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 9c778fe48d20ef362047e3376dee56d77f8500d4 ]
syzbot reported that nf_reject_ip6_tcphdr_put() was possibly sending garbage on the four reserved tcp bits (th->res1)
Use skb_put_zero() to clear the whole TCP header,
as done in nf_reject_ip_tcphdr_put()
BUG: KMSAN: uninit-value in nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255 nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255 nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775 process_backlog+0x4ad/0xa50 net/core/dev.c:6108 __napi_poll+0xe7/0x980 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963 handle_softirqs+0x1ce/0x800 kernel/softirq.c:554 __do_softirq+0x14/0x1a kernel/softirq.c:588 do_softirq+0x9a/0x100 kernel/softirq.c:455 __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:382 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:908 [inline] __dev_queue_xmit+0x2692/0x5610 net/core/dev.c:4450 dev_queue_xmit include/linux/netdevice.h:3105 [inline] neigh_resolve_output+0x9ca/0xae0 net/core/neighbour.c:1565 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x2347/0x2ba0 net/ipv6/ip6_output.c:141 __ip6_finish_output net/ipv6/ip6_output.c:215 [inline] ip6_finish_output+0xbb8/0x14b0 net/ipv6/ip6_output.c:226 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x356/0x620 net/ipv6/ip6_output.c:247 dst_output include/net/dst.h:450 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip6_xmit+0x1ba6/0x25d0 net/ipv6/ip6_output.c:366 inet6_csk_xmit+0x442/0x530 net/ipv6/inet6_connection_sock.c:135 __tcp_transmit_skb+0x3b07/0x4880 net/ipv4/tcp_output.c:1466 tcp_transmit_skb net/ipv4/tcp_output.c:1484 [inline] tcp_connect+0x35b6/0x7130 net/ipv4/tcp_output.c:4143 tcp_v6_connect+0x1bcc/0x1e40 net/ipv6/tcp_ipv6.c:333 __inet_stream_connect+0x2ef/0x1730 net/ipv4/af_inet.c:679 inet_stream_connect+0x6a/0xd0 net/ipv4/af_inet.c:750 __sys_connect_file net/socket.c:2061 [inline] __sys_connect+0x606/0x690 net/socket.c:2078 __do_sys_connect net/socket.c:2088 [inline] __se_sys_connect net/socket.c:2085 [inline] __x64_sys_connect+0x91/0xe0 net/socket.c:2085 x64_sys_call+0x27a5/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:43 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was stored to memory at:
nf_reject_ip6_tcphdr_put+0x60c/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:249 nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775 process_backlog+0x4ad/0xa50 net/core/dev.c:6108 __napi_poll+0xe7/0x980 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963 handle_softirqs+0x1ce/0x800 kernel/softirq.c:554 __do_softirq+0x14/0x1a kernel/softirq.c:588
Uninit was stored to memory at:
nf_reject_ip6_tcphdr_put+0x2ca/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:231 nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775 process_backlog+0x4ad/0xa50 net/core/dev.c:6108 __napi_poll+0xe7/0x980 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963 handle_softirqs+0x1ce/0x800 kernel/softirq.c:554 __do_softirq+0x14/0x1a kernel/softirq.c:588
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3998 [inline] slab_alloc_node mm/slub.c:4041 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4084 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:674 alloc_skb include/linux/skbuff.h:1320 [inline] nf_send_reset6+0x98d/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:327 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775 process_backlog+0x4ad/0xa50 net/core/dev.c:6108 __napi_poll+0xe7/0x980 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963 handle_softirqs+0x1ce/0x800 kernel/softirq.c:554 __do_softirq+0x14/0x1a kernel/softirq.c:588
--- net/ipv6/netfilter/nf_reject_ipv6.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-)
net/ipv6/netfilter/nf_reject_ipv6.c +2 -12
@@ -223,33 +223,23 @@ void nf_reject_ip6_tcphdr_put(struct sk_buff *nskb, const struct tcphdr *oth, unsigned int otcplen) { struct tcphdr *tcph; -int needs_ack;skb_reset_transport_header (nskb); - tcph =skb_put (nskb,sizeof (struct tcphdr )); + tcph =skb_put_zero (nskb,sizeof (struct tcphdr ));/* Truncate to length (no data) */ tcph->doff =sizeof (struct tcphdr )/4 ; tcph->source = oth->dest; tcph->dest = oth->source;if (oth->ack) { - needs_ack =0 ; tcph->seq = oth->ack_seq; - tcph->ack_seq =0 ; }else { - needs_ack =1 ; tcph->ack_seq =htonl (ntohl (oth->seq) + oth->syn + oth->fin + otcplen - (oth->doff<<2 )); - tcph->seq =0 ; + tcph->ack =1 ; } -/* Reset flags */ - ((u_int8_t *)tcph)[13 ] =0 ; tcph->rst =1 ; - tcph->ack = needs_ack; - tcph->window =0 ; - tcph->urg_ptr =0 ; - tcph->check =0 ;/* Adjust TCP checksum */ tcph->check = csum_ipv6_magic(&ipv6_hdr(nskb)->saddr,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 372/538 net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaixin Wang <[email protected]>
[ Upstream commit b5109b60ee4fcb2f2bb24f589575e10cc5283ad4 ]
In the ether3_probe function, a timer is initialized with a callback function ether3_ledoff, bound to &prev(dev)->timer. Once the timer is started, there is a risk of a race condition if the module or device is removed, triggering the ether3_remove function to perform cleanup. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| ether3_ledoff
ether3_remove |
free_netdev(dev); |
put_devic |
kfree(dev); |
| ether3_outw(priv(dev)->regs.config2 |= CFG2_CTRLO, REG_CONFIG2);
| // use devFix it by ensuring that the timer is canceled before proceeding with the cleanup in ether3_remove.
--- drivers/net/ethernet/seeq/ether3.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/seeq/ether3.c +2 -0
@@ -847,9 +847,11 @@ static void ether3_remove(struct expansion_card *ec) {struct net_device *dev =ecard_get_drvdata (ec); +ether3_outw (priv (dev)->regs.config2 |=CFG2_CTRLO ,REG_CONFIG2 );ecard_set_drvdata (ec,NULL );unregister_netdev (dev); +del_timer_sync (&priv (dev)->timer);free_netdev (dev);ecard_release_resources (ec); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 373/538 net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 93c21077bb9ba08807c459982d440dbbee4c7af3 ]
The rpl sr tunnel code contains calls to dst_cache_*() which are only present when the dst cache is built.
Select DST_CACHE to build the dst cache, similar to other kconfig options in the same file.
Compiling the rpl sr tunnel without DST_CACHE will lead to linker errors.
--- net/ipv6/Kconfig | 1 + 1 file changed, 1 insertion(+)
net/ipv6/Kconfig +1 -0
@@ -323,6 +323,7 @@ config IPV6_RPL_LWTUNNEL bool "IPv6: RPL Source Routing Header support" depends on IPV6 select LWTUNNEL + select DST_CACHE help Support for RFC6554 RPL Source Routing Header using the lightweight tunnels mechanism.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 374/538 tcp: check skb is non-NULL in tcp_rto_delta_us()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Hunt <[email protected]>
[ Upstream commit c8770db2d54437a5f49417ae7b46f7de23d14db6 ]
We have some machines running stock Ubuntu 20.04.6 which is their 5.4.0-174-generic kernel that are running ceph and recently hit a null ptr dereference in tcp_rearm_rto(). Initially hitting it from the TLP path, but then later we also saw it getting hit from the RACK case as well. Here are examples of the oops messages we saw in each of those cases:
Jul 26 15:05:02 rx [11061395.780353] BUG: kernel NULL pointer dereference, address: 0000000000000020 Jul 26 15:05:02 rx [11061395.787572] #PF: supervisor read access in kernel mode Jul 26 15:05:02 rx [11061395.792971] #PF: error_code(0x0000) - not-present page Jul 26 15:05:02 rx [11061395.798362] PGD 0 P4D 0 Jul 26 15:05:02 rx [11061395.801164] Oops: 0000 [#1] SMP NOPTI Jul 26 15:05:02 rx [11061395.805091] CPU: 0 PID: 9180 Comm: msgr-worker-1 Tainted: G W 5.4.0-174-generic #193-Ubuntu Jul 26 15:05:02 rx [11061395.814996] Hardware name: Supermicro SMC 2x26 os-gen8 64C NVME-Y 256G/H12SSW-NTR, BIOS 2.5.V1.2U.NVMe.UEFI 05/09/2023 Jul 26 15:05:02 rx [11061395.825952] RIP: 0010:tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061395.830656] Code: 87 ca 04 00 00 00 5b 41 5c 41 5d 5d c3 c3 49 8b bc 24 40 06 00 00 eb 8d 48 bb cf f7 53 e3 a5 9b c4 20 4c 89 ef e8 0c fe 0e 00 <48> 8b 78 20 48 c1 ef 03 48 89 f8 41 8b bc 24 80 04 00 00 48 f7 e3 Jul 26 15:05:02 rx [11061395.849665] RSP: 0018:ffffb75d40003e08 EFLAGS: 00010246 Jul 26 15:05:02 rx [11061395.855149] RAX: 0000000000000000 RBX: 20c49ba5e353f7cf RCX: 0000000000000000 Jul 26 15:05:02 rx [11061395.862542] RDX: 0000000062177c30 RSI: 000000000000231c RDI: ffff9874ad283a60 Jul 26 15:05:02 rx [11061395.869933] RBP: ffffb75d40003e20 R08: 0000000000000000 R09: ffff987605e20aa8 Jul 26 15:05:02 rx [11061395.877318] R10: ffffb75d40003f00 R11: ffffb75d4460f740 R12: ffff9874ad283900 Jul 26 15:05:02 rx [11061395.884710] R13: ffff9874ad283a60 R14: ffff9874ad283980 R15: ffff9874ad283d30 Jul 26 15:05:02 rx [11061395.892095] FS: 00007f1ef4a2e700(0000) GS:ffff987605e00000(0000) knlGS:0000000000000000 Jul 26 15:05:02 rx [11061395.900438] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Jul 26 15:05:02 rx [11061395.906435] CR2: 0000000000000020 CR3: 0000003e450ba003 CR4: 0000000000760ef0 Jul 26 15:05:02 rx [11061395.913822] PKRU: 55555554 Jul 26 15:05:02 rx [11061395.916786] Call Trace: Jul 26 15:05:02 rx [11061395.919488] Jul 26 15:05:02 rx [11061395.921765] ? show_regs.cold+0x1a/0x1f Jul 26 15:05:02 rx [11061395.925859] ? __die+0x90/0xd9 Jul 26 15:05:02 rx [11061395.929169] ? no_context+0x196/0x380 Jul 26 15:05:02 rx [11061395.933088] ? ip6_protocol_deliver_rcu+0x4e0/0x4e0 Jul 26 15:05:02 rx [11061395.938216] ? ip6_sublist_rcv_finish+0x3d/0x50 Jul 26 15:05:02 rx [11061395.943000] ? __bad_area_nosemaphore+0x50/0x1a0 Jul 26 15:05:02 rx [11061395.947873] ? bad_area_nosemaphore+0x16/0x20 Jul 26 15:05:02 rx [11061395.952486] ? do_user_addr_fault+0x267/0x450 Jul 26 15:05:02 rx [11061395.957104] ? ipv6_list_rcv+0x112/0x140 Jul 26 15:05:02 rx [11061395.961279] ? __do_page_fault+0x58/0x90 Jul 26 15:05:02 rx [11061395.965458] ? do_page_fault+0x2c/0xe0 Jul 26 15:05:02 rx [11061395.969465] ? page_fault+0x34/0x40 Jul 26 15:05:02 rx [11061395.973217] ? tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061395.977313] ? tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061395.981408] tcp_send_loss_probe+0x10b/0x220 Jul 26 15:05:02 rx [11061395.985937] tcp_write_timer_handler+0x1b4/0x240 Jul 26 15:05:02 rx [11061395.990809] tcp_write_timer+0x9e/0xe0 Jul 26 15:05:02 rx [11061395.994814] ? tcp_write_timer_handler+0x240/0x240 Jul 26 15:05:02 rx [11061395.999866] call_timer_fn+0x32/0x130 Jul 26 15:05:02 rx [11061396.003782] __run_timers.part.0+0x180/0x280 Jul 26 15:05:02 rx [11061396.008309] ? recalibrate_cpu_khz+0x10/0x10 Jul 26 15:05:02 rx [11061396.012841] ? native_x2apic_icr_write+0x30/0x30 Jul 26 15:05:02 rx [11061396.017718] ? lapic_next_event+0x21/0x30 Jul 26 15:05:02 rx [11061396.021984] ? clockevents_program_event+0x8f/0xe0 Jul 26 15:05:02 rx [11061396.027035] run_timer_softirq+0x2a/0x50 Jul 26 15:05:02 rx [11061396.031212] __do_softirq+0xd1/0x2c1 Jul 26 15:05:02 rx [11061396.035044] do_softirq_own_stack+0x2a/0x40 Jul 26 15:05:02 rx [11061396.039480] Jul 26 15:05:02 rx [11061396.041840] do_softirq.part.0+0x46/0x50 Jul 26 15:05:02 rx [11061396.046022] __local_bh_enable_ip+0x50/0x60 Jul 26 15:05:02 rx [11061396.050460] _raw_spin_unlock_bh+0x1e/0x20 Jul 26 15:05:02 rx [11061396.054817] nf_conntrack_tcp_packet+0x29e/0xbe0 [nf_conntrack] Jul 26 15:05:02 rx [11061396.060994] ? get_l4proto+0xe7/0x190 [nf_conntrack] Jul 26 15:05:02 rx [11061396.066220] nf_conntrack_in+0xe9/0x670 [nf_conntrack] Jul 26 15:05:02 rx [11061396.071618] ipv6_conntrack_local+0x14/0x20 [nf_conntrack] Jul 26 15:05:02 rx [11061396.077356] nf_hook_slow+0x45/0xb0 Jul 26 15:05:02 rx [11061396.081098] ip6_xmit+0x3f0/0x5d0 Jul 26 15:05:02 rx [11061396.084670] ? ipv6_anycast_cleanup+0x50/0x50 Jul 26 15:05:02 rx [11061396.089282] ? __sk_dst_check+0x38/0x70 Jul 26 15:05:02 rx [11061396.093381] ? inet6_csk_route_socket+0x13b/0x200 Jul 26 15:05:02 rx [11061396.098346] inet6_csk_xmit+0xa7/0xf0 Jul 26 15:05:02 rx [11061396.102263] __tcp_transmit_skb+0x550/0xb30 Jul 26 15:05:02 rx [11061396.106701] tcp_write_xmit+0x3c6/0xc20 Jul 26 15:05:02 rx [11061396.110792] ? __alloc_skb+0x98/0x1d0 Jul 26 15:05:02 rx [11061396.114708] __tcp_push_pending_frames+0x37/0x100 Jul 26 15:05:02 rx [11061396.119667] tcp_push+0xfd/0x100 Jul 26 15:05:02 rx [11061396.123150] tcp_sendmsg_locked+0xc70/0xdd0 Jul 26 15:05:02 rx [11061396.127588] tcp_sendmsg+0x2d/0x50 Jul 26 15:05:02 rx [11061396.131245] inet6_sendmsg+0x43/0x70 Jul 26 15:05:02 rx [11061396.135075] __sock_sendmsg+0x48/0x70 Jul 26 15:05:02 rx [11061396.138994] ____sys_sendmsg+0x212/0x280 Jul 26 15:05:02 rx [11061396.143172] ___sys_sendmsg+0x88/0xd0 Jul 26 15:05:02 rx [11061396.147098] ? __seccomp_filter+0x7e/0x6b0 Jul 26 15:05:02 rx [11061396.151446] ? __switch_to+0x39c/0x460 Jul 26 15:05:02 rx [11061396.155453] ? __switch_to_asm+0x42/0x80 Jul 26 15:05:02 rx [11061396.159636] ? __switch_to_asm+0x5a/0x80 Jul 26 15:05:02 rx [11061396.163816] __sys_sendmsg+0x5c/0xa0 Jul 26 15:05:02 rx [11061396.167647] __x64_sys_sendmsg+0x1f/0x30 Jul 26 15:05:02 rx [11061396.171832] do_syscall_64+0x57/0x190 Jul 26 15:05:02 rx [11061396.175748] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 Jul 26 15:05:02 rx [11061396.181055] RIP: 0033:0x7f1ef692618d Jul 26 15:05:02 rx [11061396.184893] Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 ca ee ff ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2f 44 89 c7 48 89 44 24 08 e8 fe ee ff ff 48 Jul 26 15:05:02 rx [11061396.203889] RSP: 002b:00007f1ef4a26aa0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e Jul 26 15:05:02 rx [11061396.211708] RAX: ffffffffffffffda RBX: 000000000000084b RCX: 00007f1ef692618d Jul 26 15:05:02 rx [11061396.219091] RDX: 0000000000004000 RSI: 00007f1ef4a26b10 RDI: 0000000000000275 Jul 26 15:05:02 rx [11061396.226475] RBP: 0000000000004000 R08: 0000000000000000 R09: 0000000000000020 Jul 26 15:05:02 rx [11061396.233859] R10: 0000000000000000 R11: 0000000000000293 R12: 000000000000084b Jul 26 15:05:02 rx [11061396.241243] R13: 00007f1ef4a26b10 R14: 0000000000000275 R15: 000055592030f1e8 Jul 26 15:05:02 rx [11061396.248628] Modules linked in: vrf bridge stp llc vxlan ip6_udp_tunnel udp_tunnel nls_iso8859_1 amd64_edac_mod edac_mce_amd kvm_amd kvm crct10dif_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper wmi_bmof ipmi_ssif input_leds joydev rndis_host cdc_ether usbnet mii ast drm_vram_helper ttm drm_kms_helper i2c_algo_bit fb_sys_fops syscopyarea sysfillrect sysimgblt ccp mac_hid ipmi_si ipmi_devintf ipmi_msghandler nft_ct sch_fq_codel nf_tables_set nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink ramoops reed_solomon efi_pstore drm ip_tables x_tables autofs4 raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid0 multipath linear mlx5_ib ib_uverbs ib_core raid1 mlx5_core hid_generic pci_hyperv_intf crc32_pclmul tls usbhid ahci mlxfw bnxt_en libahci hid nvme i2c_piix4 nvme_core wmi Jul 26 15:05:02 rx [11061396.324334] CR2: 0000000000000020 Jul 26 15:05:02 rx [11061396.327944] ---[ end trace 68a2b679d1cfb4f1 ]--- Jul 26 15:05:02 rx [11061396.433435] RIP: 0010:tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061396.438137] Code: 87 ca 04 00 00 00 5b 41 5c 41 5d 5d c3 c3 49 8b bc 24 40 06 00 00 eb 8d 48 bb cf f7 53 e3 a5 9b c4 20 4c 89 ef e8 0c fe 0e 00 <48> 8b 78 20 48 c1 ef 03 48 89 f8 41 8b bc 24 80 04 00 00 48 f7 e3 Jul 26 15:05:02 rx [11061396.457144] RSP: 0018:ffffb75d40003e08 EFLAGS: 00010246 Jul 26 15:05:02 rx [11061396.462629] RAX: 0000000000000000 RBX: 20c49ba5e353f7cf RCX: 0000000000000000 Jul 26 15:05:02 rx [11061396.470012] RDX: 0000000062177c30 RSI: 000000000000231c RDI: ffff9874ad283a60 Jul 26 15:05:02 rx [11061396.477396] RBP: ffffb75d40003e20 R08: 0000000000000000 R09: ffff987605e20aa8 Jul 26 15:05:02 rx [11061396.484779] R10: ffffb75d40003f00 R11: ffffb75d4460f740 R12: ffff9874ad283900 Jul 26 15:05:02 rx [11061396.492164] R13: ffff9874ad283a60 R14: ffff9874ad283980 R15: ffff9874ad283d30 Jul 26 15:05:02 rx [11061396.499547] FS: 00007f1ef4a2e700(0000) GS:ffff987605e00000(0000) knlGS:0000000000000000 Jul 26 15:05:02 rx [11061396.507886] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Jul 26 15:05:02 rx [11061396.513884] CR2: 0000000000000020 CR3: 0000003e450ba003 CR4: 0000000000760ef0 Jul 26 15:05:02 rx [11061396.521267] PKRU: 55555554 Jul 26 15:05:02 rx [11061396.524230] Kernel panic - not syncing: Fatal exception in interrupt Jul 26 15:05:02 rx [11061396.530885] Kernel Offset: 0x1b200000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) Jul 26 15:05:03 rx [11061396.660181] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
After we hit this we disabled TLP by setting tcp_early_retrans to 0 and then hit the crash in the RACK case:
Aug 7 07:26:16 rx [1006006.265582] BUG: kernel NULL pointer dereference, address: 0000000000000020
Aug 7 07:26:16 rx [1006006.272719] #PF: supervisor read access in kernel mode
Aug 7 07:26:16 rx [1006006.278030] #PF: error_code(0x0000) - not-present page
Aug 7 07:26:16 rx [1006006.283343] PGD 0 P4D 0
Aug 7 07:26:16 rx [1006006.286057] Oops: 0000 [#1] SMP NOPTI
Aug 7 07:26:16 rx [1006006.289896] CPU: 5 PID: 0 Comm: swapper/5 Tainted: G W 5.4.0-174-generic #193-Ubuntu
Aug 7 07:26:16 rx [1006006.299107] Hardware name: Supermicro SMC 2x26 os-gen8 64C NVME-Y 256G/H12SSW-NTR, BIOS 2.5.V1.2U.NVMe.UEFI 05/09/2023
Aug 7 07:26:16 rx [1006006.309970] RIP: 0010:tcp_rearm_rto+0xe4/0x160
Aug 7 07:26:16 rx [1006006.314584] Code: 87 ca 04 00 00 00 5b 41 5c 41 5d 5d c3 c3 49 8b bc 24 40 06 00 00 eb 8d 48 bb cf f7 53 e3 a5 9b c4 20 4c 89 ef e8 0c fe 0e 00 <48> 8b 78 20 48 c1 ef 03 48 89 f8 41 8b bc 24 80 04 00 00 48 f7 e3
Aug 7 07:26:16 rx [1006006.333499] RSP: 0018:ffffb42600a50960 EFLAGS: 00010246
Aug 7 07:26:16 rx [1006006.338895] RAX: 0000000000000000 RBX: 20c49ba5e353f7cf RCX: 0000000000000000
Aug 7 07:26:16 rx [1006006.346193] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff92d687ed8160
Aug 7 07:26:16 rx [1006006.353489] RBP: ffffb42600a50978 R08: 0000000000000000 R09: 00000000cd896dcc
Aug 7 07:26:16 rx [1006006.360786] R10: ffff92dc3404f400 R11: 0000000000000001 R12: ffff92d687ed8000
Aug 7 07:26:16 rx [1006006.368084] R13: ffff92d687ed8160 R14: 00000000cd896dcc R15: 00000000cd8fca81
Aug 7 07:26:16 rx [1006006.375381] FS: 0000000000000000(0000) GS:ffff93158ad40000(0000) knlGS:0000000000000000
Aug 7 07:26:16 rx [1006006.383632] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Aug 7 07:26:16 rx [1006006.389544] CR2: 0000000000000020 CR3: 0000003e775ce006 CR4: 0000000000760ee0
Aug 7 07:26:16 rx [1006006.396839] PKRU: 55555554
Aug 7 07:26:16 rx [1006006.399717] Call Trace:
Aug 7 07:26:16 rx [1006006.402335]
Aug 7 07:26:16 rx [1006006.404525] ? show_regs.cold+0x1a/0x1f
Aug 7 07:26:16 rx [1006006.408532] ? __die+0x90/0xd9
Aug 7 07:26:16 rx [1006006.411760] ? no_context+0x196/0x380
Aug 7 07:26:16 rx [1006006.415599] ? __bad_area_nosemaphore+0x50/0x1a0
Aug 7 07:26:16 rx [1006006.420392] ? _raw_spin_lock+0x1e/0x30
Aug 7 07:26:16 rx [1006006.424401] ? bad_area_nosemaphore+0x16/0x20
Aug 7 07:26:16 rx [1006006.428927] ? do_user_addr_fault+0x267/0x450
Aug 7 07:26:16 rx [1006006.433450] ? __do_page_fault+0x58/0x90
Aug 7 07:26:16 rx [1006006.437542] ? do_page_fault+0x2c/0xe0
Aug 7 07:26:16 rx [1006006.441470] ? page_fault+0x34/0x40
Aug 7 07:26:16 rx [1006006.445134] ? tcp_rearm_rto+0xe4/0x160
Aug 7 07:26:16 rx [1006006.449145] tcp_ack+0xa32/0xb30
Aug 7 07:26:16 rx [1006006.452542] tcp_rcv_established+0x13c/0x670
Aug 7 07:26:16 rx [1006006.456981] ? sk_filter_trim_cap+0x48/0x220
Aug 7 07:26:16 rx [1006006.461419] tcp_v6_do_rcv+0xdb/0x450
Aug 7 07:26:16 rx [1006006.465257] tcp_v6_rcv+0xc2b/0xd10
Aug 7 07:26:16 rx [1006006.468918] ip6_protocol_deliver_rcu+0xd3/0x4e0
Aug 7 07:26:16 rx [1006006.473706] ip6_input_finish+0x15/0x20
Aug 7 07:26:16 rx [1006006.477710] ip6_input+0xa2/0xb0
Aug 7 07:26:16 rx [1006006.481109] ? ip6_protocol_deliver_rcu+0x4e0/0x4e0
Aug 7 07:26:16 rx [1006006.486151] ip6_sublist_rcv_finish+0x3d/0x50
Aug 7 07:26:16 rx [1006006.490679] ip6_sublist_rcv+0x1aa/0x250
Aug 7 07:26:16 rx [1006006.494779] ? ip6_rcv_finish_core.isra.0+0xa0/0xa0
Aug 7 07:26:16 rx [1006006.499828] ipv6_list_rcv+0x112/0x140
Aug 7 07:26:16 rx [1006006.503748] __netif_receive_skb_list_core+0x1a4/0x250
Aug 7 07:26:16 rx [1006006.509057] netif_receive_skb_list_internal+0x1a1/0x2b0
Aug 7 07:26:16 rx [1006006.514538] gro_normal_list.part.0+0x1e/0x40
Aug 7 07:26:16 rx [1006006.519068] napi_complete_done+0x91/0x130
Aug 7 07:26:16 rx [1006006.523352] mlx5e_napi_poll+0x18e/0x610 [mlx5_core]
Aug 7 07:26:16 rx [1006006.528481] net_rx_action+0x142/0x390
Aug 7 07:26:16 rx [1006006.532398] __do_softirq+0xd1/0x2c1
Aug 7 07:26:16 rx [1006006.536142] irq_exit+0xae/0xb0
Aug 7 07:26:16 rx [1006006.539452] do_IRQ+0x5a/0xf0
Aug 7 07:26:16 rx [1006006.542590] common_interrupt+0xf/0xf
Aug 7 07:26:16 rx [1006006.546421]
Aug 7 07:26:16 rx [1006006.548695] RIP: 0010:native_safe_halt+0xe/0x10
Aug 7 07:26:16 rx [1006006.553399] Code: 7b ff ff ff eb bd 90 90 90 90 90 90 e9 07 00 00 00 0f 00 2d 36 2c 50 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d 26 2c 50 00 fb f4 90 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 53 e8 dd 5e 61 ff 65
Aug 7 07:26:16 rx [1006006.572309] RSP: 0018:ffffb42600177e70 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffc2
Aug 7 07:26:16 rx [1006006.580040] RAX: ffffffff8ed08b20 RBX: 0000000000000005 RCX: 0000000000000001
Aug 7 07:26:16 rx [1006006.587337] RDX: 00000000f48eeca2 RSI: 0000000000000082 RDI: 0000000000000082
Aug 7 07:26:16 rx [1006006.594635] RBP: ffffb42600177e90 R08: 0000000000000000 R09: 000000000000020f
Aug 7 07:26:16 rx [1006006.601931] R10: 0000000000100000 R11: 0000000000000000 R12: 0000000000000005
Aug 7 07:26:16 rx [1006006.609229] R13: ffff93157deb5f00 R14: 0000000000000000 R15: 0000000000000000
Aug 7 07:26:16 rx [1006006.616530] ? __cpuidle_text_start+0x8/0x8
Aug 7 07:26:16 rx [1006006.620886] ? default_idle+0x20/0x140
Aug 7 07:26:16 rx [1006006.624804] arch_cpu_idle+0x15/0x20
Aug 7 07:26:16 rx [1006006.628545] default_idle_call+0x23/0x30
Aug 7 07:26:16 rx [1006006.632640] do_idle+0x1fb/0x270
Aug 7 07:26:16 rx [1006006.636035] cpu_startup_entry+0x20/0x30
Aug 7 07:26:16 rx [1006006.640126] start_secondary+0x178/0x1d0
Aug 7 07:26:16 rx [1006006.644218] secondary_startup_64+0xa4/0xb0
Aug 7 07:26:17 rx [1006006.648568] Modules linked in: vrf bridge stp llc vxlan ip6_udp_tunnel udp_tunnel nls_iso8859_1 nft_ct amd64_edac_mod edac_mce_amd kvm_amd kvm crct10dif_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper wmi_bmof ipmi_ssif input_leds joydev rndis_host cdc_ether usbnet ast mii drm_vram_helper ttm drm_kms_helper i2c_algo_bit fb_sys_fops syscopyarea sysfillrect sysimgblt ccp mac_hid ipmi_si ipmi_devintf ipmi_msghandler sch_fq_codel nf_tables_set nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink ramoops reed_solomon efi_pstore drm ip_tables x_tables autofs4 raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid0 multipath linear mlx5_ib ib_uverbs ib_core raid1 hid_generic mlx5_core pci_hyperv_intf crc32_pclmul usbhid ahci tls mlxfw bnxt_en hid libahci nvme i2c_piix4 nvme_core wmi [last unloaded: cpuid] Aug 7 07:26:17 rx [1006006.726180] CR2: 0000000000000020
Aug 7 07:26:17 rx [1006006.729718] ---[ end trace e0e2e37e4e612984 ]---
Prior to seeing the first crash and on other machines we also see the warning in tcp_send_loss_probe() where packets_out is non-zero, but both transmit and retrans queues are empty so we know the box is seeing some accounting issue in this area:
Jul 26 09:15:27 kernel: ------------[ cut here ]------------ Jul 26 09:15:27 kernel: invalid inflight: 2 state 1 cwnd 68 mss 8988 Jul 26 09:15:27 kernel: WARNING: CPU: 16 PID: 0 at net/ipv4/tcp_output.c:2605 tcp_send_loss_probe+0x214/0x220 Jul 26 09:15:27 kernel: Modules linked in: vrf bridge stp llc vxlan ip6_udp_tunnel udp_tunnel nls_iso8859_1 nft_ct amd64_edac_mod edac_mce_amd kvm_amd kvm crct10dif_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper wmi_bmof ipmi_ssif joydev input_leds rndis_host cdc_ether usbnet mii ast drm_vram_helper ttm drm_kms_he> Jul 26 09:15:27 kernel: CPU: 16 PID: 0 Comm: swapper/16 Not tainted 5.4.0-174-generic #193-Ubuntu Jul 26 09:15:27 kernel: Hardware name: Supermicro SMC 2x26 os-gen8 64C NVME-Y 256G/H12SSW-NTR, BIOS 2.5.V1.2U.NVMe.UEFI 05/09/2023 Jul 26 09:15:27 kernel: RIP: 0010:tcp_send_loss_probe+0x214/0x220 Jul 26 09:15:27 kernel: Code: 08 26 01 00 75 e2 41 0f b6 54 24 12 41 8b 8c 24 c0 06 00 00 45 89 f0 48 c7 c7 e0 b4 20 a7 c6 05 8d 08 26 01 01 e8 4a c0 0f 00 <0f> 0b eb ba 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 Jul 26 09:15:27 kernel: RSP: 0018:ffffb7838088ce00 EFLAGS: 00010286 Jul 26 09:15:27 kernel: RAX: 0000000000000000 RBX: ffff9b84b5630430 RCX: 0000000000000006 Jul 26 09:15:27 kernel: RDX: 0000000000000007 RSI: 0000000000000096 RDI: ffff9b8e4621c8c0 Jul 26 09:15:27 kernel: RBP: ffffb7838088ce18 R08: 0000000000000927 R09: 0000000000000004 Jul 26 09:15:27 kernel: R10: 0000000000000000 R11: 0000000000000001 R12: ffff9b84b5630000 Jul 26 09:15:27 kernel: R13: 0000000000000000 R14: 000000000000231c R15: ffff9b84b5630430 Jul 26 09:15:27 kernel: FS: 0000000000000000(0000) GS:ffff9b8e46200000(0000) knlGS:0000000000000000 Jul 26 09:15:27 kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Jul 26 09:15:27 kernel: CR2: 000056238cec2380 CR3: 0000003e49ede005 CR4: 0000000000760ee0 Jul 26 09:15:27 kernel: PKRU: 55555554 Jul 26 09:15:27 kernel: Call Trace: Jul 26 09:15:27 kernel: <IRQ> Jul 26 09:15:27 kernel: ? show_regs.cold+0x1a/0x1f Jul 26 09:15:27 kernel: ? __warn+0x98/0xe0 Jul 26 09:15:27 kernel: ? tcp_send_loss_probe+0x214/0x220 Jul 26 09:15:27 kernel: ? report_bug+0xd1/0x100 Jul 26 09:15:27 kernel: ? do_error_trap+0x9b/0xc0 Jul 26 09:15:27 kernel: ? do_invalid_op+0x3c/0x50 Jul 26 09:15:27 kernel: ? tcp_send_loss_probe+0x214/0x220 Jul 26 09:15:27 kernel: ? invalid_op+0x1e/0x30 Jul 26 09:15:27 kernel: ? tcp_send_loss_probe+0x214/0x220 Jul 26 09:15:27 kernel: tcp_write_timer_handler+0x1b4/0x240 Jul 26 09:15:27 kernel: tcp_write_timer+0x9e/0xe0 Jul 26 09:15:27 kernel: ? tcp_write_timer_handler+0x240/0x240 Jul 26 09:15:27 kernel: call_timer_fn+0x32/0x130 Jul 26 09:15:27 kernel: __run_timers.part.0+0x180/0x280 Jul 26 09:15:27 kernel: ? timerqueue_add+0x9b/0xb0 Jul 26 09:15:27 kernel: ? enqueue_hrtimer+0x3d/0x90 Jul 26 09:15:27 kernel: ? do_error_trap+0x9b/0xc0 Jul 26 09:15:27 kernel: ? do_invalid_op+0x3c/0x50 Jul 26 09:15:27 kernel: ? tcp_send_loss_probe+0x214/0x220 Jul 26 09:15:27 kernel: ? invalid_op+0x1e/0x30 Jul 26 09:15:27 kernel: ? tcp_send_loss_probe+0x214/0x220 Jul 26 09:15:27 kernel: tcp_write_timer_handler+0x1b4/0x240 Jul 26 09:15:27 kernel: tcp_write_timer+0x9e/0xe0 Jul 26 09:15:27 kernel: ? tcp_write_timer_handler+0x240/0x240 Jul 26 09:15:27 kernel: call_timer_fn+0x32/0x130 Jul 26 09:15:27 kernel: __run_timers.part.0+0x180/0x280 Jul 26 09:15:27 kernel: ? timerqueue_add+0x9b/0xb0 Jul 26 09:15:27 kernel: ? enqueue_hrtimer+0x3d/0x90 Jul 26 09:15:27 kernel: ? recalibrate_cpu_khz+0x10/0x10 Jul 26 09:15:27 kernel: ? ktime_get+0x3e/0xa0 Jul 26 09:15:27 kernel: ? native_x2apic_icr_write+0x30/0x30 Jul 26 09:15:27 kernel: run_timer_softirq+0x2a/0x50 Jul 26 09:15:27 kernel: __do_softirq+0xd1/0x2c1 Jul 26 09:15:27 kernel: irq_exit+0xae/0xb0 Jul 26 09:15:27 kernel: smp_apic_timer_interrupt+0x7b/0x140 Jul 26 09:15:27 kernel: apic_timer_interrupt+0xf/0x20 Jul 26 09:15:27 kernel: </IRQ> Jul 26 09:15:27 kernel: RIP: 0010:native_safe_halt+0xe/0x10 Jul 26 09:15:27 kernel: Code: 7b ff ff ff eb bd 90 90 90 90 90 90 e9 07 00 00 00 0f 00 2d 36 2c 50 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d 26 2c 50 00 fb f4 <c3> 90 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 53 e8 dd 5e 61 ff 65 Jul 26 09:15:27 kernel: RSP: 0018:ffffb783801cfe70 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 Jul 26 09:15:27 kernel: RAX: ffffffffa6908b20 RBX: 0000000000000010 RCX: 0000000000000001 Jul 26 09:15:27 kernel: RDX: 000000006fc0c97e RSI: 0000000000000082 RDI: 0000000000000082 Jul 26 09:15:27 kernel: RBP: ffffb783801cfe90 R08: 0000000000000000 R09: 0000000000000225 Jul 26 09:15:27 kernel: R10: 0000000000100000 R11: 0000000000000000 R12: 0000000000000010 Jul 26 09:15:27 kernel: R13: ffff9b8e390b0000 R14: 0000000000000000 R15: 0000000000000000 Jul 26 09:15:27 kernel: ? __cpuidle_text_start+0x8/0x8 Jul 26 09:15:27 kernel: ? default_idle+0x20/0x140 Jul 26 09:15:27 kernel: arch_cpu_idle+0x15/0x20 Jul 26 09:15:27 kernel: default_idle_call+0x23/0x30 Jul 26 09:15:27 kernel: do_idle+0x1fb/0x270 Jul 26 09:15:27 kernel: cpu_startup_entry+0x20/0x30 Jul 26 09:15:27 kernel: start_secondary+0x178/0x1d0 Jul 26 09:15:27 kernel: secondary_startup_64+0xa4/0xb0 Jul 26 09:15:27 kernel: ---[ end trace e7ac822987e33be1 ]---
The NULL ptr deref is coming from tcp_rto_delta_us() attempting to pull an skb off the head of the retransmit queue and then dereferencing that skb to get the skb_mstamp_ns value via tcp_skb_timestamp_us(skb).
The crash is the same one that was reported a # of years ago here:
https://lore.kernel.org/netdev/[email protected]/T/#t
and the kernel we're running has the fix which was added to resolve this issue.
Unfortunately we've been unsuccessful so far in reproducing this problem in the lab and do not have the luxury of pushing out a new kernel to try and test if newer kernels resolve this issue at the moment. I realize this is a report against both an Ubuntu kernel and also an older 5.4 kernel. I have reported this issue to Ubuntu here: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2077657
however I feel like since this issue has possibly cropped up again it makes sense to build in some protection in this path (even on the latest kernel versions) since the code in question just blindly assumes there's a valid skb without testing if it's NULL b/f it looks at the timestamp.
Given we have seen crashes in this path before and now this case it seems like we should protect ourselves for when packets_out accounting is incorrect. While we should fix that root cause we should also just make sure the skb is not NULL before dereferencing it. Also add a warn once here to capture some information if/when the problem case is hit again.
--- include/net/tcp.h | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-)
include/net/tcp.h +19 -2
@@ -2230,9 +2230,26 @@ static inline s64 tcp_rto_delta_us(const struct sock *sk) {const struct sk_buff *skb =tcp_rtx_queue_head (sk);u32 rto =inet_csk (sk)->icsk_rto; -u64 rto_time_stamp_us =tcp_skb_timestamp_us (skb) +jiffies_to_usecs (rto); -return rto_time_stamp_us -tcp_sk (sk)->tcp_mstamp; +if (likely (skb)) { +u64 rto_time_stamp_us =tcp_skb_timestamp_us (skb) +jiffies_to_usecs (rto); + +return rto_time_stamp_us -tcp_sk (sk)->tcp_mstamp; + }else { +WARN_ONCE (1 , +"rtx queue emtpy: " +"out:%u sacked:%u lost:%u retrans:%u " +"tlp_high_seq:%u sk_state:%u ca_state:%u " +"advmss:%u mss_cache:%u pmtu:%u\n" , +tcp_sk (sk)->packets_out,tcp_sk (sk)->sacked_out, +tcp_sk (sk)->lost_out,tcp_sk (sk)->retrans_out, +tcp_sk (sk)->tlp_high_seq, sk->sk_state, +inet_csk (sk)->icsk_ca_state, +tcp_sk (sk)->advmss,tcp_sk (sk)->mss_cache, +inet_csk (sk)->icsk_pmtu_cookie); +return jiffies_to_usecs (rto); + } + }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 375/538 net: qrtr: Update packets cloning when broadcasting
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Youssef Samir <[email protected]>
[ Upstream commit f011b313e8ebd5b7abd8521b5119aecef403de45 ]
When broadcasting data to multiple nodes via MHI, using skb_clone() causes all nodes to receive the same header data. This can result in packets being discarded by endpoints, leading to lost data.
This issue occurs when a socket is closed, and a QRTR_TYPE_DEL_CLIENT packet is broadcasted. All nodes receive the same destination node ID, causing the node connected to the client to discard the packet and remain unaware of the client's deletion.
Replace skb_clone() with pskb_copy(), to create a separate copy of the header for each sk_buff.
--- net/qrtr/af_qrtr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/qrtr/af_qrtr.c +1 -1
@@ -884,7 +884,7 @@ static int qrtr_bcast_enqueue(struct qrtr_node *node, struct sk_buff *skb,mutex_lock (&qrtr_node_lock);list_for_each_entry (node, &qrtr_all_nodes, item) { - skbn =skb_clone (skb,GFP_KERNEL ); + skbn =pskb_copy (skb,GFP_KERNEL );if (!skbn)break ;skb_set_owner_w (skbn, skb->sk);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 376/538 bonding: Fix unnecessary warnings and logs from bond_xdp_get_xmit_slave()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiwon Kim <[email protected]>
[ Upstream commit 0cbfd45fbcf0cb26d85c981b91c62fe73cdee01c ]
syzbot reported a WARNING in bond_xdp_get_xmit_slave. To reproduce this[1], one bond device (bond1) has xdpdrv, which increases bpf_master_redirect_enabled_key. Another bond device (bond0) which is unsupported by XDP but its slave (veth3) has xdpgeneric that returns XDP_TX. This triggers WARN_ON_ONCE() from the xdp_master_redirect(). To reduce unnecessary warnings and improve log management, we need to delete the WARN_ON_ONCE() and add ratelimit to the netdev_err().
[1] Steps to reproduce:
# Needs tx_xdp with return XDP_TX;
ip l add veth0 type veth peer veth1
ip l add veth3 type veth peer veth4
ip l add bond0 type bond mode 6 # BOND_MODE_ALB, unsupported by XDP ip l add bond1 type bond # BOND_MODE_ROUNDROBIN by default ip l set veth0 master bond1
ip l set bond1 up
# Increases bpf_master_redirect_enabled_key
ip l set dev bond1 xdpdrv object tx_xdp.o section xdp_tx ip l set veth3 master bond0
ip l set bond0 up
ip l set veth4 up
# Triggers WARN_ON_ONCE() from the xdp_master_redirect() ip l set veth3 xdpgeneric object tx_xdp.o section xdp_tx
--- drivers/net/bonding/bond_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/bonding/bond_main.c +3 -3
@@ -5534,9 +5534,9 @@ bond_xdp_get_xmit_slave(struct net_device *bond_dev, struct xdp_buff *xdp)break ;default : -/* Should never happen. Mode guarded by bond_xdp_check() */ -netdev_err (bond_dev,"Unknown bonding mode %d for xdp xmit\n" ,BOND_MODE (bond)); -WARN_ON_ONCE (1 ); +if (net_ratelimit ()) +netdev_err (bond_dev,"Unknown bonding mode %d for xdp xmit\n" , +BOND_MODE (bond));return NULL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 377/538 virtio_net: Fix mismatched buf address when unmapping for small packets
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenbo Li <[email protected]>
[ Upstream commit c11a49d58ad229a1be1ebe08a2b68fedf83db6c8 ]
Currently, the virtio-net driver will perform a pre-dma-mapping for small or mergeable RX buffer. But for small packets, a mismatched address without VIRTNET_RX_PAD and xdp_headroom is used for unmapping.
That will result in unsynchronized buffers when SWIOTLB is enabled, for example, when running as a TDX guest.
This patch unifies the address passed to the virtio core as the address of the virtnet header and fixes the mismatched buffer address.
Changes from v2: unify the buf that passed to the virtio core in small and merge mode.
Changes from v1: Use ctx to get xdp_headroom.
--- drivers/net/virtio_net.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/net/virtio_net.c +8 -2
@@ -1269,6 +1269,11 @@ static struct sk_buff *receive_small(struct net_device *dev,struct page *page =virt_to_head_page (buf);struct sk_buff *skb; +/* We passed the address of virtnet header to virtio-core, +* so truncate the padding. +*/ + buf -=VIRTNET_RX_PAD + xdp_headroom; + len -= vi->hdr_len;u64_stats_add (&stats->bytes, len);
@@ -1859,8 +1864,9 @@ static int add_recvbuf_small(struct virtnet_info *vi, struct receive_queue *rq,if (unlikely (!buf))return -ENOMEM ; -virtnet_rq_init_one_sg (rq, buf +VIRTNET_RX_PAD + xdp_headroom, - vi->hdr_len +GOOD_PACKET_LEN ); + buf +=VIRTNET_RX_PAD + xdp_headroom; + +virtnet_rq_init_one_sg (rq, buf, vi->hdr_len +GOOD_PACKET_LEN ); err =virtqueue_add_inbuf_ctx (rq->vq, rq->sg,1 , buf, ctx, gfp);if (err <0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 378/538 net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Furong Xu <[email protected]>
[ Upstream commit b514c47ebf41a6536551ed28a05758036e6eca7c ]
Commit 5fabb01207a2 ("net: stmmac: Add initial XDP support") sets PP_FLAG_DMA_SYNC_DEV flag for page_pool unconditionally, page_pool_recycle_direct() will call page_pool_dma_sync_for_device() on every page even the page is not going to be reused by XDP program.
When XDP is not enabled, the page which holds the received buffer will be recycled once the buffer is copied into new SKB by skb_copy_to_linear_data(), then the MAC core will never reuse this page any longer. Always setting PP_FLAG_DMA_SYNC_DEV wastes CPU cycles on unnecessary calling of page_pool_dma_sync_for_device().
After this patch, up to 9% noticeable performance improvement was observed on certain platforms.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +1 -1
@@ -2018,7 +2018,7 @@ static int __alloc_dma_rx_desc_resources(struct stmmac_priv *priv, rx_q->queue_index = queue; rx_q->priv_data = priv; - pp_params.flags =PP_FLAG_DMA_MAP |PP_FLAG_DMA_SYNC_DEV ; + pp_params.flags =PP_FLAG_DMA_MAP | (xdp_prog ?PP_FLAG_DMA_SYNC_DEV :0 ); pp_params.pool_size = dma_conf->dma_rx_size; num_pages =DIV_ROUND_UP (dma_conf->dma_buf_sz,PAGE_SIZE ); pp_params.order =ilog2 (num_pages);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 379/538 netfilter: nf_tables: Keep deleted flowtable hooks until after RCU
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Sutter <[email protected]>
[ Upstream commit 642c89c475419b4d0c0d90e29d9c1a0e4351f379 ]
Documentation of list_del_rcu() warns callers to not immediately free the deleted list item. While it seems not necessary to use the RCU-variant of list_del() here in the first place, doing so seems to require calling kfree_rcu() on the deleted item as well.
--- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +1 -1
@@ -8943,7 +8943,7 @@ static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) flowtable->data.type->setup (&flowtable->data, hook->ops.dev,FLOW_BLOCK_UNBIND );list_del_rcu (&hook->list); -kfree (hook); +kfree_rcu (hook, rcu); }kfree (flowtable->name);module_put (flowtable->data.type->owner);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 380/538 netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit e1f1ee0e9ad8cbe660f5c104e791c5f1a7cf4c31 ]
Only provide ctnetlink_label_size when it is used, which is when CONFIG_NF_CONNTRACK_EVENTS is configured.
Flagged by clang-18 W=1 builds as:
.../nf_conntrack_netlink.c:385:19: warning: unused function 'ctnetlink_label_size' [-Wunused-function]
385 | static inline int ctnetlink_label_size(const struct nf_conn *ct)
| ^~~~~~~~~~~~~~~~~~~~
The condition on CONFIG_NF_CONNTRACK_LABELS being removed by this patch guards compilation of non-trivial implementations of ctnetlink_dump_labels() and ctnetlink_label_size().
However, this is not necessary as each of these functions will always return 0 if CONFIG_NF_CONNTRACK_LABELS is not defined as each function starts with the equivalent of:
struct nf_conn_labels *labels = nf_ct_labels_find(ct); if (!labels) return 0;
And nf_ct_labels_find always returns NULL if CONFIG_NF_CONNTRACK_LABELS is not enabled. So I believe that the compiler optimises the code away in such cases anyway.
Found by inspection.
Compile tested only.
Originally splitted in two patches, Pablo Neira Ayuso collapsed them and added Fixes: tag.
--- net/netfilter/nf_conntrack_netlink.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
net/netfilter/nf_conntrack_netlink.c +2 -5
@@ -381,7 +381,7 @@ static int ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct)#define ctnetlink_dump_secctx (a, b) (0)#endif -#ifdef CONFIG_NF_CONNTRACK_LABELS +#ifdef CONFIG_NF_CONNTRACK_EVENTS static inline int ctnetlink_label_size (const struct nf_conn *ct) {struct nf_conn_labels *labels =nf_ct_labels_find (ct);
@@ -390,6 +390,7 @@ static inline int ctnetlink_label_size(const struct nf_conn *ct)return 0 ; return nla_total_size(sizeof(labels->bits)); } +#endif static int ctnetlink_dump_labels (struct sk_buff *skb,const struct nf_conn *ct)
@@ -410,10 +411,6 @@ ctnetlink_dump_labels(struct sk_buff *skb, const struct nf_conn *ct)return 0 ; } -#else -#define ctnetlink_dump_labels (a, b) (0) -#define ctnetlink_label_size (a) (0) -#endif #define master_tuple (ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 381/538 netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 4ffcf5ca81c3b83180473eb0d3c010a1a7c6c4de ]
Lockless iteration over hook list is possible from netlink dump path, use rcu variant to iterate over the hook list as is done with flowtable hooks.
--- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +1 -1
@@ -1778,7 +1778,7 @@ static int nft_dump_basechain_hook(struct sk_buff *skb, int family,if (!hook_list) hook_list = &basechain->hook_list; -list_for_each_entry (hook, hook_list, list) { +list_for_each_entry_rcu (hook, hook_list, list) {if (!first) first = hook;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 382/538 io_uring/sqpoll: do not allow pinning outside of cpuset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Moessbauer <[email protected]>
commit f011c9cf04c06f16b24f583d313d3c012e589e50 upstream.
The submit queue polling threads are userland threads that just never exit to the userland. When creating the thread with IORING_SETUP_SQ_AFF, the affinity of the poller thread is set to the cpu specified in sq_thread_cpu. However, this CPU can be outside of the cpuset defined by the cgroup cpuset controller. This violates the rules defined by the cpuset controller and is a potential issue for realtime applications.
In b7ed6d8ffd6 we fixed the default affinity of the poller thread, in case no explicit pinning is required by inheriting the one of the creating task. In case of explicit pinning, the check is more complicated, as also a cpu outside of the parent cpumask is allowed. We implemented this by using cpuset_cpus_allowed (that has support for cgroup cpusets) and testing if the requested cpu is in the set.
--- io_uring/sqpoll.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
io_uring/sqpoll.c +4 -1
@@ -10,6 +10,7 @@#include <linux/slab.h> #include <linux/audit.h> #include <linux/security.h> +#include <linux/cpuset.h> #include <linux/io_uring.h> #include <uapi/linux/io_uring.h>
@@ -401,10 +402,12 @@ __cold int io_sq_offload_create(struct ireturn 0 ;if (p->flags &IORING_SETUP_SQ_AFF ) { +struct cpumask allowed_mask;int cpu = p->sq_thread_cpu; ret = -EINVAL ; -if (cpu >= nr_cpu_ids || !cpu_online (cpu)) +cpuset_cpus_allowed (current, &allowed_mask); +if (!cpumask_test_cpu (cpu, &allowed_mask)) goto err_sqpoll; sqd->sq_cpu = cpu; }else {
Greg Kroah-Hartman
maintainerPATCH 383/538 io_uring: check for presence of task_work rather than TIF_NOTIFY_SIGNAL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
commit 04beb6e0e08c30c6f845f50afb7d7953603d7a6f upstream.
If some part of the kernel adds task_work that needs executing, in terms of signaling it'll generally use TWA_SIGNAL or TWA_RESUME. Those two directly translate to TIF_NOTIFY_SIGNAL or TIF_NOTIFY_RESUME, and can be used for a variety of use case outside of task_work.
However, io_cqring_wait_schedule() only tests explicitly for TIF_NOTIFY_SIGNAL. This means it can miss if task_work got added for the task, but used a different kind of signaling mechanism (or none at all). Normally this doesn't matter as any task_work will be run once the task exits to userspace, except if:
1) The ring is setup with DEFER_TASKRUN
2) The local work item may generate normal task_work
For condition 2, this can happen when closing a file and it's the final put of that file, for example. This can cause stalls where a task is waiting to make progress inside io_cqring_wait(), but there's nothing else that will wake it up. Hence change the "should we schedule or loop around" check to check for the presence of task_work explicitly, rather than just TIF_NOTIFY_SIGNAL as the mechanism. While in there, also change the ordering of what type of task_work first in terms of ordering, to both make it consistent with other task_work runs in io_uring, but also to better handle the case of defer task_work generating normal task_work, like in the above example.
--- io_uring/io_uring.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
io_uring/io_uring.c +2 -2
@@ -2514,7 +2514,7 @@ static inline int io_cqring_wait_schedulreturn 1 ;if (unlikely (!llist_empty (&ctx->work_llist)))return 1 ; -if (unlikely (test_thread_flag (TIF_NOTIFY_SIGNAL ))) +if (unlikely (task_work_pending (current)))return 1 ;if (unlikely (task_sigpending (current)))return -EINTR ;
@@ -2610,9 +2610,9 @@ static int io_cqring_wait(struct io_ring* If we got woken because of task_work being processed, run it * now rather than let the caller do another wait loop. */ -io_run_task_work ();if (!llist_empty (&ctx->work_llist))io_run_local_work (ctx, nr_wait); +io_run_task_work ();/* * Non-local task_work will be run on exit to userspace, but
Greg Kroah-Hartman
maintainerPATCH 384/538 mm: call the security_mmap_file() LSM hook in remap_file_pages()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shu Han <[email protected]>
commit ea7e2d5e49c05e5db1922387b09ca74aa40f46e2 upstream.
The remap_file_pages syscall handler calls do_mmap() directly, which doesn't contain the LSM security check. And if the process has called personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for RW pages, this will actually result in remapping the pages to RWX, bypassing a W^X policy enforced by SELinux.
So we should check prot by security_mmap_file LSM hook in the remap_file_pages syscall handler before do_mmap() is called. Otherwise, it potentially permits an attacker to bypass a W^X policy enforced by SELinux.
The bypass is similar to CVE-2016-10044, which bypass the same thing via AIO and can be found in [1].
The PoC:
$ cat > test.c
int main(void) {
size_t pagesz = sysconf(_SC_PAGE_SIZE);
int mfd = syscall(SYS_memfd_create, "test", 0);
const char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,
MAP_SHARED, mfd, 0);
unsigned int old = syscall(SYS_personality, 0xffffffff);
syscall(SYS_personality, READ_IMPLIES_EXEC | old);
syscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0);
syscall(SYS_personality, old);
// show the RWX page exists even if W^X policy is enforced
int fd = open("/proc/self/maps", O_RDONLY);
unsigned char buf2[1024];
while (1) {
int ret = read(fd, buf2, 1024);
if (ret <= 0) break;
write(1, buf2, ret);
}
close(fd);
}$ gcc test.c -o test $ ./test | grep rwx 7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)
--- mm/mmap.c | 4 ++++ 1 file changed, 4 insertions(+)
mm/mmap.c +4 -0
@@ -3025,8 +3025,12 @@ SYSCALL_DEFINE5(remap_file_pages, unsign flags |=MAP_LOCKED ; file =get_file (vma->vm_file); + ret =security_mmap_file (vma->vm_file, prot, flags); +if (ret) + goto out_fput; ret =do_mmap (vma->vm_file, start, size, prot, flags,0 , pgoff, &populate,NULL ); +out_fput:fput (file); out:mmap_write_unlock (mm);
Greg Kroah-Hartman
maintainerPATCH 385/538 drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fangzhi Zuo <[email protected]>
commit 4437936c6b696b98f3fe1d8679a2788c41b4df77 upstream.
Synaptics Cascaded Panamera topology needs to unconditionally acquire root aux for dsc decoding.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +1 -1
@@ -246,7 +246,7 @@ static bool validate_dsc_caps_on_connect aconnector->dsc_aux = &aconnector->mst_root->dm_dp_aux.aux;/* synaptics cascaded MST hub case */ -if (!aconnector->dsc_aux &&is_synaptics_cascaded_panamera (aconnector->dc_link, port)) +if (is_synaptics_cascaded_panamera (aconnector->dc_link, port)) aconnector->dsc_aux = port->mgr->aux;if (!aconnector->dsc_aux)
Greg Kroah-Hartman
maintainerPATCH 386/538 drm/vmwgfx: Prevent unmapping active read buffers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zack Rusin <[email protected]>
commit aba07b9a0587f50e5d3346eaa19019cf3f86c0ea upstream.
The kms paths keep a persistent map active to read and compare the cursor buffer. These maps can race with each other in simple scenario where:
a) buffer "a" mapped for update
b) buffer "a" mapped for compare
c) do the compare
d) unmap "a" for compare
e) update the cursor
f) unmap "a" for update
At step "e" the buffer has been unmapped and the read contents is bogus.
Prevent unmapping of active read buffers by simply keeping a count of how many paths have currently active maps and unmap only when the count reaches 0.
--- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 13 +++++++++++-- drivers/gpu/drm/vmwgfx/vmwgfx_bo.h | 3 +++ 2 files changed, 14 insertions(+), 2 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_bo.c +11 -2
@@ -331,6 +331,8 @@ void *vmw_bo_map_and_cache(struct vmw_bovoid *virtual;int ret; +atomic_inc (&vbo->map_count); + virtual =ttm_kmap_obj_virtual (&vbo->map, ¬_used);if (virtual)return virtual;
@@ -353,11 +355,17 @@ void *vmw_bo_map_and_cache(struct vmw_bo*/ void vmw_bo_unmap (struct vmw_bo *vbo) { +int map_count; +if (vbo->map.bo ==NULL )return ; -ttm_bo_kunmap (&vbo->map); - vbo->map.bo =NULL ; + map_count =atomic_dec_return (&vbo->map_count); + +if (!map_count) { +ttm_bo_kunmap (&vbo->map); + vbo->map.bo =NULL ; + } }
@@ -390,6 +398,7 @@ static int vmw_bo_init(struct vmw_privatBUILD_BUG_ON (TTM_MAX_BO_PRIORITY <=3 ); vmw_bo->tbo.priority =3 ; vmw_bo->res_tree =RB_ROOT ; +atomic_set (&vmw_bo->map_count,0 ); params->size =ALIGN (params->size,PAGE_SIZE );drm_gem_private_object_init (vdev, &vmw_bo->tbo.base, params->size);
drivers/gpu/drm/vmwgfx/vmwgfx_bo.h +3 -0
@@ -68,6 +68,8 @@ struct vmw_bo_params {* @map: Kmap object for semi-persistent mappings * @res_tree: RB tree of resources using this buffer object as a backing MOB * @res_prios: Eviction priority counts for attached resources +* @map_count: The number of currently active maps. Will differ from the +* cpu_writers because it includes kernel maps. * @cpu_writers: Number of synccpu write grabs. Protected by reservation when * increased. May be decreased without reservation. * @dx_query_ctx: DX context if this buffer object is used as a DX query MOB
@@ -86,6 +88,7 @@ struct vmw_bo {struct rb_root res_tree;u32 res_prios[TTM_MAX_BO_PRIORITY ]; +atomic_t map_count;atomic_t cpu_writers;/* Not ref-counted. Protected by binding_mutex */ struct vmw_resource *dx_query_ctx;
Greg Kroah-Hartman
maintainerPATCH 387/538 Revert "net: libwx: fix alloc msix vectors failed"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duanqiang Wen <[email protected]>
This reverts commit 69197dfc64007b5292cc960581548f41ccd44828. commit 937d46ecc5f9 ("net: wangxun: add ethtool_ops for channel number") changed NIC misc irq from most significant bit to least significant bit, the former condition is not required to apply this patch, because we only need to set irq affinity for NIC queue irq vectors.
this patch is required after commit 937d46ecc5f9 ("net: wangxun:
add ethtool_ops for channel number") was applied, so this is only relevant to 6.6.y branch.
--- drivers/net/ethernet/wangxun/libwx/wx_lib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/wangxun/libwx/wx_lib.c +1 -1
@@ -1585,7 +1585,7 @@ static void wx_set_num_queues(struct wx*/ static int wx_acquire_msix_vectors (struct wx *wx) { -struct irq_affinity affd = { .pre_vectors =1 }; +struct irq_affinity affd = {0 , };int nvecs, i; nvecs =min_t (int,num_online_cpus (), wx->mac.max_msix_vectors);
Greg Kroah-Hartman
maintainerPATCH 388/538 xen: move checks for e820 conflicts further up
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <[email protected]>
commit c4498ae316da5b5786ccd448fc555f3339b8e4ca upstream.
Move the checks for e820 memory map conflicts using the xen_chk_is_e820_usable() helper further up in order to prepare resolving some of the possible conflicts by doing some e820 map modifications, which must happen before evaluating the RAM layout.
--- arch/x86/xen/setup.c | 44 ++++++++++++++++++++++---------------------- 1 file changed, 22 insertions(+), 22 deletions(-)
arch/x86/xen/setup.c +22 -22
@@ -855,6 +855,28 @@ char * __init xen_memory_setup(void)/* Make sure the Xen-supplied memory map is well-ordered. */ e820__update_table (&xen_e820_table); +/* +* Check whether the kernel itself conflicts with the target E820 map. +* Failing now is better than running into weird problems later due +* to relocating (and even reusing) pages with kernel text or data. +*/ +xen_chk_is_e820_usable (__pa_symbol (_text), +__pa_symbol (_end) -__pa_symbol (_text), +"kernel" ); + +/* +* Check for a conflict of the xen_start_info memory with the target +* E820 map. +*/ +xen_chk_is_e820_usable (__pa (xen_start_info),sizeof (*xen_start_info), +"xen_start_info" ); + +/* +* Check for a conflict of the hypervisor supplied page tables with +* the target E820 map. +*/ +xen_pt_check_e820 (); + max_pages =xen_get_max_pages ();/* How many extra pages do we need due to remapping? */
@@ -927,28 +949,6 @@ char * __init xen_memory_setup(void)e820__update_table (e820_table); -/* -* Check whether the kernel itself conflicts with the target E820 map. -* Failing now is better than running into weird problems later due -* to relocating (and even reusing) pages with kernel text or data. -*/ -xen_chk_is_e820_usable (__pa_symbol (_text), -__pa_symbol (_end) -__pa_symbol (_text), -"kernel" ); - -/* -* Check for a conflict of the xen_start_info memory with the target -* E820 map. -*/ -xen_chk_is_e820_usable (__pa (xen_start_info),sizeof (*xen_start_info), -"xen_start_info" ); - -/* -* Check for a conflict of the hypervisor supplied page tables with -* the target E820 map. -*/ -xen_pt_check_e820 (); -xen_reserve_xen_mfnlist ();/* Check for a conflict of the initrd with the target E820 map. */
Greg Kroah-Hartman
maintainerPATCH 389/538 xen: allow mapping ACPI data using a different physical address
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <[email protected]>
commit 9221222c717dbddac1e3c49906525475d87a3a44 upstream.
When running as a Xen PV dom0 the system needs to map ACPI data of the host using host physical addresses, while those addresses can conflict with the guest physical addresses of the loaded linux kernel. The same problem might apply in case a PV guest is configured to use the host memory map.
This conflict can be solved by mapping the ACPI data to a different guest physical address, but mapping the data via acpi_os_ioremap() must still be possible using the host physical address, as this address might be generated by AML when referencing some of the ACPI data.
When configured to support running as a Xen PV domain, have an implementation of acpi_os_ioremap() being aware of the possibility to need above mentioned translation of a host physical address to the guest physical address.
This modification requires to #include linux/acpi.h in some sources which need to include asm/acpi.h directly.
--- arch/x86/include/asm/acpi.h | 8 ++++++++ arch/x86/kernel/acpi/boot.c | 11 +++++++++++ arch/x86/kernel/jailhouse.c | 1 + arch/x86/kernel/mmconf-fam10h_64.c | 1 + arch/x86/kernel/smpboot.c | 1 + arch/x86/kernel/x86_init.c | 1 + arch/x86/xen/p2m.c | 35 +++++++++++++++++++++++++++++++++++ arch/x86/xen/setup.c | 2 +- 8 files changed, 59 insertions(+), 1 deletion(-)
arch/x86/include/asm/acpi.h +8 -0
@@ -165,6 +165,14 @@ void acpi_generic_reduced_hw_init(void);void x86_default_set_root_pointer (u64 addr);u64 x86_default_get_root_pointer (void ); +#ifdef CONFIG_XEN_PV +/* A Xen PV domain needs a special acpi_os_ioremap() handling. */ +extern void __iomem * (*acpi_os_ioremap)(acpi_physical_address phys, +acpi_size size); +void __iomem *x86_acpi_os_ioremap (acpi_physical_address phys,acpi_size size); +#define acpi_os_ioremap acpi_os_ioremap +#endif +#else /* !CONFIG_ACPI */ #define acpi_lapic 0
arch/x86/kernel/acpi/boot.c +11 -0
@@ -1901,3 +1901,14 @@ u64 x86_default_get_root_pointer(void) {return boot_params.acpi_rsdp_addr; } + +#ifdef CONFIG_XEN_PV +void __iomem *x86_acpi_os_ioremap (acpi_physical_address phys,acpi_size size) +{ +return ioremap_cache (phys, size); +} + +void __iomem * (*acpi_os_ioremap)(acpi_physical_address phys,acpi_size size) = + x86_acpi_os_ioremap; +EXPORT_SYMBOL_GPL (acpi_os_ioremap); +#endif
arch/x86/kernel/jailhouse.c +1 -0
@@ -12,6 +12,7 @@#include <linux/kernel.h> #include <linux/reboot.h> #include <linux/serial_8250.h> +#include <linux/acpi.h> #include <asm/apic.h> #include <asm/io_apic.h> #include <asm/acpi.h>
arch/x86/kernel/mmconf-fam10h_64.c +1 -0
@@ -9,6 +9,7 @@#include <linux/pci.h> #include <linux/dmi.h> #include <linux/range.h> +#include <linux/acpi.h> #include <asm/pci-direct.h> #include <linux/sort.h>
arch/x86/kernel/smpboot.c +1 -0
@@ -60,6 +60,7 @@#include <linux/stackprotector.h> #include <linux/cpuhotplug.h> #include <linux/mc146818rtc.h> +#include <linux/acpi.h> #include <asm/acpi.h> #include <asm/cacheinfo.h>
arch/x86/kernel/x86_init.c +1 -0
@@ -8,6 +8,7 @@#include <linux/ioport.h> #include <linux/export.h> #include <linux/pci.h> +#include <linux/acpi.h> #include <asm/acpi.h> #include <asm/bios_ebda.h>
arch/x86/xen/p2m.c +35 -0
@@ -70,6 +70,7 @@#include <linux/memblock.h> #include <linux/slab.h> #include <linux/vmalloc.h> +#include <linux/acpi.h> #include <asm/cache.h> #include <asm/setup.h>
@@ -836,6 +837,34 @@ void __init xen_do_remap_nonram(void)pr_info ("Remapped %u non-RAM page(s)\n" , remapped); } +#ifdef CONFIG_ACPI +/* +* Xen variant of acpi_os_ioremap() taking potentially remapped non-RAM +* regions into account. +* Any attempt to map an area crossing a remap boundary will produce a +* WARN() splat. +* phys is related to remap->maddr on input and will be rebased to remap->paddr. +*/ +static void __iomem *xen_acpi_os_ioremap (acpi_physical_address phys, +acpi_size size) +{ +unsigned int i; +const struct nonram_remap *remap = xen_nonram_remap; + +for (i =0 ; i < nr_nonram_remap; i++) { +if (phys + size > remap->maddr && + phys < remap->maddr + remap->size) { +WARN_ON (phys < remap->maddr || + phys + size > remap->maddr + remap->size); + phys += remap->paddr - remap->maddr; +break ; + } + } + +return x86_acpi_os_ioremap (phys, size); +} +#endif /* CONFIG_ACPI */ +/* * Add a new non-RAM remap entry. * In case of no free entry found, just crash the system.
@@ -850,6 +879,12 @@ void __init xen_add_remap_nonram(phys_adBUG (); } +#ifdef CONFIG_ACPI +/* Switch to the Xen acpi_os_ioremap() variant. */ +if (nr_nonram_remap ==0 ) + acpi_os_ioremap = xen_acpi_os_ioremap; +#endif + xen_nonram_remap[nr_nonram_remap].maddr = maddr; xen_nonram_remap[nr_nonram_remap].paddr = paddr; xen_nonram_remap[nr_nonram_remap].size = size;
arch/x86/xen/setup.c +1 -1
@@ -15,12 +15,12 @@#include <linux/cpuidle.h> #include <linux/cpufreq.h> #include <linux/memory_hotplug.h> +#include <linux/acpi.h> #include <asm/elf.h> #include <asm/vdso.h> #include <asm/e820/api.h> #include <asm/setup.h> -#include <asm/acpi.h> #include <asm/numa.h> #include <asm/idtentry.h> #include <asm/xen/hypervisor.h>
Greg Kroah-Hartman
maintainerPATCH 390/538 io_uring/sqpoll: retain test for whether the CPU is valid
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
commit a09c17240bdf2e9fa6d0591afa9448b59785f7d4 upstream.
A recent commit ensured that SQPOLL cannot be setup with a CPU that isn't in the current tasks cpuset, but it also dropped testing whether the CPU is valid in the first place. Without that, if a task passes in a CPU value that is too high, the following KASAN splat can get triggered:
BUG: KASAN: stack-out-of-bounds in io_sq_offload_create+0x858/0xaa4 Read of size 8 at addr ffff800089bc7b90 by task wq-aff.t/1391 CPU: 4 UID: 1000 PID: 1391 Comm: wq-aff.t Not tainted 6.11.0-rc7-00227-g371c468f4db6 #7080 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace.part.0+0xcc/0xe0 show_stack+0x14/0x1c dump_stack_lvl+0x58/0x74 print_report+0x16c/0x4c8 kasan_report+0x9c/0xe4 __asan_report_load8_noabort+0x1c/0x24 io_sq_offload_create+0x858/0xaa4 io_uring_setup+0x1394/0x17c4 __arm64_sys_io_uring_setup+0x6c/0x180 invoke_syscall+0x6c/0x260 el0_svc_common.constprop.0+0x158/0x224 do_el0_svc+0x3c/0x5c el0_svc+0x34/0x70 el0t_64_sync_handler+0x118/0x124 el0t_64_sync+0x168/0x16c The buggy address belongs to stack of task wq-aff.t/1391 and is located at offset 48 in frame: io_sq_offload_create+0x0/0xaa4
This frame has 1 object:
[32, 40) 'allowed_mask'
The buggy address belongs to the virtual mapping at
[ffff800089bc0000, ffff800089bc9000) created by:
kernel_clone+0x124/0x7e0
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff0000d740af80 pfn:0x11740a
memcg:ffff0000c2706f02
flags: 0xbffe00000000000(node=0|zone=2|lastcpupid=0x1fff)
raw: 0bffe00000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffff0000d740af80 0000000000000000 00000001ffffffff ffff0000c2706f02
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff800089bc7a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff800089bc7b00: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
>ffff800089bc7b80: 00 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff800089bc7c00: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
ffff800089bc7c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3--- io_uring/sqpoll.c | 2 ++ 1 file changed, 2 insertions(+)
io_uring/sqpoll.c +2 -0
@@ -406,6 +406,8 @@ __cold int io_sq_offload_create(struct iint cpu = p->sq_thread_cpu; ret = -EINVAL ; +if (cpu >= nr_cpu_ids || !cpu_online (cpu)) + goto err_sqpoll;cpuset_cpus_allowed (current, &allowed_mask);if (!cpumask_test_cpu (cpu, &allowed_mask)) goto err_sqpoll;
Greg Kroah-Hartman
maintainerPATCH 391/538 io_uring/sqpoll: do not put cpumask on stack
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Moessbauer <[email protected]>
commit 7f44beadcc11adb98220556d2ddbe9c97aa6d42d upstream.
Putting the cpumask on the stack is deprecated for a long time (since 2d3854a37e8), as these can be big. Given that, change the on-stack allocation of allowed_mask to be dynamically allocated.
--- io_uring/sqpoll.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
io_uring/sqpoll.c +10 -3
@@ -402,15 +402,22 @@ __cold int io_sq_offload_create(struct ireturn 0 ;if (p->flags &IORING_SETUP_SQ_AFF ) { -struct cpumask allowed_mask; +cpumask_var_t allowed_mask;int cpu = p->sq_thread_cpu; ret = -EINVAL ;if (cpu >= nr_cpu_ids || !cpu_online (cpu)) goto err_sqpoll; -cpuset_cpus_allowed (current, &allowed_mask); -if (!cpumask_test_cpu (cpu, &allowed_mask)) + ret = -ENOMEM ; +if (!alloc_cpumask_var (&allowed_mask,GFP_KERNEL )) goto err_sqpoll; + ret = -EINVAL ; +cpuset_cpus_allowed (current, allowed_mask); +if (!cpumask_test_cpu (cpu, allowed_mask)) { +free_cpumask_var (allowed_mask); + goto err_sqpoll; + } +free_cpumask_var (allowed_mask); sqd->sq_cpu = cpu; }else { sqd->sq_cpu =-1 ;
Greg Kroah-Hartman
maintainerPATCH 392/538 Remove *.orig pattern from .gitignore
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <[email protected]>
commit 76be4f5a784533c71afbbb1b8f2963ef9e2ee258 upstream.
Commit 3f1b0e1f2875 (".gitignore update") added *.orig and *.rej patterns to .gitignore in v2.6.23. The commit message didn't give a rationale. Later on, commit 1f5d3a6b6532 ("Remove *.rej pattern from .gitignore") removed the *.rej pattern in v2.6.26, on the rationale that *.rej files indicated something went really wrong and should not be ignored.
The *.rej files are now shown by git status, which helps located conflicts when applying patches and lowers the probability that they will go unnoticed. It is however still easy to overlook the *.orig files which slowly polute the source tree. That's not as big of a deal as not noticing a conflict, but it's still not nice.
Drop the *.orig pattern from .gitignore to avoid this and help keep the source tree clean.
[[email protected]:
I do not have a strong opinion about this. Perhaps some people may have a different opinion.
If you are someone who wants to ignore *.orig, it is likely you would want to do so across all projects. Then, $XDG_CONFIG_HOME/git/ignore would be more suitable for your needs. gitignore(5) suggests, "Patterns which a user wants Git to ignore in all situations generally go into a file specified by core.excludesFile in the user's ~/.gitconfig".
Please note that you cannot do the opposite; if *.orig is ignored by the project's .gitignore, you cannot override the decision because $XDG_CONFIG_HOME/git/ignore has a lower priority.
If *.orig is sitting on the fence, I'd leave it to the users. ]
--- .gitignore | 1 - 1 file changed, 1 deletion(-)
.gitignore +0 -1
@@ -135,7 +135,6 @@ GTAGS # id-utils files ID -*.orig *~ \#*#
Greg Kroah-Hartman
maintainerPATCH 393/538 PCI: Revert to the original speed after PCIe failed link retraining
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit f68dea13405c94381d08f42dbf0416261622bdad upstream.
When `pcie_failed_link_retrain' has failed to retrain the link by hand it leaves the link speed restricted to 2.5GT/s, which will then affect any device that has been plugged in later on, which may not suffer from the problem that caused the speed restriction to have been attempted. Consequently such a downstream device will suffer from an unnecessary communication throughput limitation and therefore performance loss.
Remove the speed restriction then and revert the Link Control 2 register to its original state if link retraining with the speed restriction in place has failed. Retrain the link again afterwards so as to remove any residual state, waiting on LT rather than DLLLA to avoid an excessive delay and ignoring the result as this training is supposed to fail anyway.
--- drivers/pci/quirks.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/pci/quirks.c +10 -1
@@ -66,7 +66,7 @@* apply this erratum workaround to any downstream ports as long as they * support Link Active reporting and have the Link Control 2 register. * Restrict the speed to 2.5GT/s then with the Target Link Speed field, -* request a retrain and wait 200ms for the data link to go up. +* request a retrain and check the result. * * If this turns out successful and we know by the Vendor:Device ID it is * safe to do so, then lift the restriction, letting the devices negotiate
@@ -74,6 +74,10 @@* firmware may have already arranged and lift it with ports that already * report their data link being up. * +* Otherwise revert the speed to the original setting and request a retrain +* again to remove any residual state, ignoring the result as it's supposed +* to fail anyway. +* * Return TRUE if the link has been successfully retrained, otherwise FALSE. */ bool pcie_failed_link_retrain (struct pci_dev *dev)
@@ -92,6 +96,8 @@ bool pcie_failed_link_retrain(struct pci_dev *dev)pcie_capability_read_word (dev,PCI_EXP_LNKSTA , &lnksta);if ((lnksta & (PCI_EXP_LNKSTA_LBMS |PCI_EXP_LNKSTA_DLLLA )) ==PCI_EXP_LNKSTA_LBMS ) { +u16 oldlnkctl2 = lnkctl2; +pci_info (dev,"broken device, retraining non-functional downstream link at 2.5GT/s\n" ); lnkctl2 &= ~PCI_EXP_LNKCTL2_TLS ;
@@ -100,6 +106,9 @@ bool pcie_failed_link_retrain(struct pci_dev *dev)if (pcie_retrain_link (dev, false)) {pci_info (dev,"retraining failed\n" ); +pcie_capability_write_word (dev,PCI_EXP_LNKCTL2 , + oldlnkctl2); +pcie_retrain_link (dev, true);return false; }
Signature · 1 line
2.46.2
Greg Kroah-Hartman
maintainerPATCH 394/538 PCI: Clear the LBMS bit after a link retrain
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit 8037ac08c2bbb3186f83a5a924f52d1048dbaec5 upstream.
The LBMS bit, where implemented, is set by hardware either in response to the completion of retraining caused by writing 1 to the Retrain Link bit or whenever hardware has changed the link speed or width in attempt to correct unreliable link operation. It is never cleared by hardware other than by software writing 1 to the bit position in the Link Status register and we never do such a write.
We currently have two places, namely apply_bad_link_workaround() and pcie_failed_link_retrain() in drivers/pci/controller/dwc/pcie-tegra194.c and drivers/pci/quirks.c respectively where we check the state of the LBMS bit and neither is interested in the state of the bit resulting from the completion of retraining, both check for a link fault.
And in particular pcie_failed_link_retrain() causes issues consequently, by trying to retrain a link where there's no downstream device anymore and the state of 1 in the LBMS bit has been retained from when there was a device downstream that has since been removed.
Clear the LBMS bit then at the conclusion of pcie_retrain_link(), so that we have a single place that controls it and that our code can track link speed or width changes resulting from unreliable link operation.
--- drivers/pci/pci.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/pci/pci.c +9 -1
@@ -5017,7 +5017,15 @@ int pcie_retrain_link(struct pci_dev *pdpcie_capability_clear_word (pdev,PCI_EXP_LNKCTL ,PCI_EXP_LNKCTL_RL ); } -return pcie_wait_for_link_status (pdev, use_lt, !use_lt); + rc =pcie_wait_for_link_status (pdev, use_lt, !use_lt); + +/* +* Clear LBMS after a manual retrain so that the bit can be used +* to track link speed or width changes made by hardware itself +* in attempt to correct unreliable link operation. +*/ +pcie_capability_write_word (pdev,PCI_EXP_LNKSTA ,PCI_EXP_LNKSTA_LBMS ); +return rc; }/**
Greg Kroah-Hartman
maintainerPATCH 395/538 PCI: dra7xx: Fix threaded IRQ request for "dra7xx-pcie-main" IRQ
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <[email protected]>
commit 03f84b3baba7836bdfc162c19288d5ce1aa92890 upstream.
Commit da87d35a6e51 ("PCI: dra7xx: Use threaded IRQ handler for "dra7xx-pcie-main" IRQ") switched from devm_request_irq() to devm_request_threaded_irq() for the "dra7xx-pcie-main" interrupt.
Since the primary handler was set to NULL, the "IRQF_ONESHOT" flag should have also been set. Fix this.
--- drivers/pci/controller/dwc/pci-dra7xx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pci/controller/dwc/pci-dra7xx.c +2 -1
@@ -841,7 +841,8 @@ static int dra7xx_pcie_probe(struct plat dra7xx->mode = mode; ret =devm_request_threaded_irq (dev, irq,NULL , dra7xx_pcie_irq_handler, -IRQF_SHARED ,"dra7xx-pcie-main" , dra7xx); +IRQF_SHARED |IRQF_ONESHOT , +"dra7xx-pcie-main" , dra7xx);if (ret) {dev_err (dev,"failed to request irq\n" ); goto err_gpio;
Greg Kroah-Hartman
maintainerPATCH 396/538 PCI: imx6: Fix missing call to phy_power_off() in error handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
commit 5b04d44d5c74e4d8aab1678496b84700b4b343fe upstream.
Fix missing call to phy_power_off() in the error path of imx6_pcie_host_init(). Remove unnecessary check for imx6_pcie->phy as the PHY API already handles NULL pointers.
--- drivers/pci/controller/dwc/pci-imx6.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/pci/controller/dwc/pci-imx6.c +4 -3
@@ -997,7 +997,7 @@ static int imx6_pcie_host_init(struct dw ret =phy_power_on (imx6_pcie->phy);if (ret) {dev_err (dev,"waiting for PHY ready timeout!\n" ); - goto err_phy_off; + goto err_phy_exit; } }
@@ -1012,8 +1012,9 @@ static int imx6_pcie_host_init(struct dwreturn 0 ; err_phy_off: -if (imx6_pcie->phy) -phy_exit (imx6_pcie->phy); +phy_power_off (imx6_pcie->phy); +err_phy_exit: +phy_exit (imx6_pcie->phy); err_clk_disable:imx6_pcie_clk_disable (imx6_pcie); err_reg_disable:
Greg Kroah-Hartman
maintainerPATCH 397/538 PCI: Correct error reporting with PCIe failed link retraining
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit 712e49c967064a3a7a5738c6f65ac540a3f6a1df upstream.
Only return successful completion status from pcie_failed_link_retrain() if retraining has actually been done, preventing excessive delays from being triggered at call sites in a hope that communication will finally be established with the downstream device where in fact nothing has been done about the link in question that would justify such a hope.
--- drivers/pci/quirks.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/pci/quirks.c +8 -4
@@ -78,7 +78,8 @@* again to remove any residual state, ignoring the result as it's supposed * to fail anyway. * -* Return TRUE if the link has been successfully retrained, otherwise FALSE. +* Return TRUE if the link has been successfully retrained. Return FALSE +* if retraining was not needed or we attempted a retrain and it failed. */ bool pcie_failed_link_retrain (struct pci_dev *dev) {
@@ -87,6 +88,7 @@ bool pcie_failed_link_retrain(struct pci {} };u16 lnksta, lnkctl2; +bool ret = false;if (!pci_is_pcie (dev) || !pcie_downstream_port (dev) || !pcie_cap_has_lnkctl2 (dev) || !dev->link_active_reporting)
@@ -104,7 +106,8 @@ bool pcie_failed_link_retrain(struct pci lnkctl2 |=PCI_EXP_LNKCTL2_TLS_2_5GT ;pcie_capability_write_word (dev,PCI_EXP_LNKCTL2 , lnkctl2); -if (pcie_retrain_link (dev, false)) { + ret =pcie_retrain_link (dev, false) ==0 ; +if (!ret) {pci_info (dev,"retraining failed\n" );pcie_capability_write_word (dev,PCI_EXP_LNKCTL2 , oldlnkctl2);
@@ -126,13 +129,14 @@ bool pcie_failed_link_retrain(struct pci lnkctl2 |= lnkcap &PCI_EXP_LNKCAP_SLS ;pcie_capability_write_word (dev,PCI_EXP_LNKCTL2 , lnkctl2); -if (pcie_retrain_link (dev, false)) { + ret =pcie_retrain_link (dev, false) ==0 ; +if (!ret) {pci_info (dev,"retraining failed\n" );return false; } } -return true; +return ret; } static ktime_t fixup_debug_start(struct pci_dev *dev,
Greg Kroah-Hartman
maintainerPATCH 398/538 PCI: Use an error code with PCIe failed link retraining
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <[email protected]>
commit 59100eb248c0b15585affa546c7f6834b30eb5a4 upstream.
Given how the call place in pcie_wait_for_link_delay() got structured now, and that pcie_retrain_link() returns a potentially useful error code, convert pcie_failed_link_retrain() to return an error code rather than a boolean status, fixing handling at the call site mentioned. Update the other call site accordingly.
--- drivers/pci/pci.c | 2 +- drivers/pci/pci.h | 6 +++--- drivers/pci/quirks.c | 20 ++++++++++---------- 3 files changed, 14 insertions(+), 14 deletions(-)
drivers/pci/pci.c +1 -1
@@ -1208,7 +1208,7 @@ static int pci_dev_wait(struct pci_dev *if (delay >PCI_RESET_WAIT ) {if (retrain) { retrain = false; -if (pcie_failed_link_retrain (bridge)) { +if (pcie_failed_link_retrain (bridge) ==0 ) { delay =1 ;continue ; }
drivers/pci/pci.h +3 -3
@@ -530,7 +530,7 @@ void pci_acs_init(struct pci_dev *dev);int pci_dev_specific_acs_enabled (struct pci_dev *dev,u16 acs_flags);int pci_dev_specific_enable_acs (struct pci_dev *dev);int pci_dev_specific_disable_acs_redir (struct pci_dev *dev); -bool pcie_failed_link_retrain (struct pci_dev *dev); +int pcie_failed_link_retrain (struct pci_dev *dev);#else static inline int pci_dev_specific_acs_enabled (struct pci_dev *dev,u16 acs_flags)
@@ -545,9 +545,9 @@ static inline int pci_dev_specific_disab {return -ENOTTY ; } -static inline bool pcie_failed_link_retrain (struct pci_dev *dev) +static inline int pcie_failed_link_retrain (struct pci_dev *dev) { -return false; +return -ENOTTY ; }#endif
drivers/pci/quirks.c +10 -10
@@ -78,21 +78,21 @@* again to remove any residual state, ignoring the result as it's supposed * to fail anyway. * -* Return TRUE if the link has been successfully retrained. Return FALSE +* Return 0 if the link has been successfully retrained. Return an error * if retraining was not needed or we attempted a retrain and it failed. */ -bool pcie_failed_link_retrain (struct pci_dev *dev) +int pcie_failed_link_retrain (struct pci_dev *dev) {static const struct pci_device_id ids[] = { {PCI_VDEVICE (ASMEDIA ,0x2824 ) },/* ASMedia ASM2824 */ {} };u16 lnksta, lnkctl2; -bool ret = false; +int ret = -ENOTTY ;if (!pci_is_pcie (dev) || !pcie_downstream_port (dev) || !pcie_cap_has_lnkctl2 (dev) || !dev->link_active_reporting) -return false; +return ret;pcie_capability_read_word (dev,PCI_EXP_LNKCTL2 , &lnkctl2);pcie_capability_read_word (dev,PCI_EXP_LNKSTA , &lnksta);
@@ -106,13 +106,13 @@ bool pcie_failed_link_retrain(struct pci lnkctl2 |=PCI_EXP_LNKCTL2_TLS_2_5GT ;pcie_capability_write_word (dev,PCI_EXP_LNKCTL2 , lnkctl2); - ret =pcie_retrain_link (dev, false) ==0 ; -if (!ret) { + ret =pcie_retrain_link (dev, false); +if (ret) {pci_info (dev,"retraining failed\n" );pcie_capability_write_word (dev,PCI_EXP_LNKCTL2 , oldlnkctl2);pcie_retrain_link (dev, true); -return false; +return ret; }pcie_capability_read_word (dev,PCI_EXP_LNKSTA , &lnksta);
@@ -129,10 +129,10 @@ bool pcie_failed_link_retrain(struct pci lnkctl2 |= lnkcap &PCI_EXP_LNKCAP_SLS ;pcie_capability_write_word (dev,PCI_EXP_LNKCTL2 , lnkctl2); - ret =pcie_retrain_link (dev, false) ==0 ; -if (!ret) { + ret =pcie_retrain_link (dev, false); +if (ret) {pci_info (dev,"retraining failed\n" ); -return false; +return ret; } }
Greg Kroah-Hartman
maintainerPATCH 399/538 PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
commit 0199d2f2bd8cd97b310f7ed82a067247d7456029 upstream.
MSGF_LEG_MASK is laid out with INTA in bit 0, INTB in bit 1, INTC in bit 2, and INTD in bit 3. Hardware IRQ numbers start at 0, and we register PCI_NUM_INTX IRQs. So to enable INTA (aka hwirq 0) we should set bit 0. Remove the subtraction of one.
This bug would cause INTx interrupts not to be delivered, as enabling INTB would actually enable INTA, and enabling INTA wouldn't enable anything at all. It is likely that this got overlooked for so long since most PCIe hardware uses MSIs. This fixes the following UBSAN error:
UBSAN: shift-out-of-bounds in ../drivers/pci/controller/pcie-xilinx-nwl.c:389:11 shift exponent 18446744073709551615 is too large for 32-bit type 'int' CPU: 1 PID: 61 Comm: kworker/u10:1 Not tainted 6.6.20+ #268 Hardware name: xlnx,zynqmp (DT) Workqueue: events_unbound deferred_probe_work_func Call trace: dump_backtrace (arch/arm64/kernel/stacktrace.c:235) show_stack (arch/arm64/kernel/stacktrace.c:242) dump_stack_lvl (lib/dump_stack.c:107) dump_stack (lib/dump_stack.c:114) __ubsan_handle_shift_out_of_bounds (lib/ubsan.c:218 lib/ubsan.c:387) nwl_unmask_leg_irq (drivers/pci/controller/pcie-xilinx-nwl.c:389 (discriminator 1)) irq_enable (kernel/irq/internals.h:234 kernel/irq/chip.c:170 kernel/irq/chip.c:439 kernel/irq/chip.c:432 kernel/irq/chip.c:345) __irq_startup (kernel/irq/internals.h:239 kernel/irq/chip.c:180 kernel/irq/chip.c:250) irq_startup (kernel/irq/chip.c:270) __setup_irq (kernel/irq/manage.c:1800) request_threaded_irq (kernel/irq/manage.c:2206) pcie_pme_probe (include/linux/interrupt.h:168 drivers/pci/pcie/pme.c:348)
--- drivers/pci/controller/pcie-xilinx-nwl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/controller/pcie-xilinx-nwl.c +2 -2
@@ -373,7 +373,7 @@ static void nwl_mask_leg_irq(struct irq_u32 mask;u32 val; - mask =1 << (data->hwirq -1 ); + mask =1 << data->hwirq;raw_spin_lock_irqsave (&pcie->leg_mask_lock, flags); val =nwl_bridge_readl (pcie,MSGF_LEG_MASK );nwl_bridge_writel (pcie, (val & (~mask)),MSGF_LEG_MASK );
@@ -387,7 +387,7 @@ static void nwl_unmask_leg_irq(struct iru32 mask;u32 val; - mask =1 << (data->hwirq -1 ); + mask =1 << data->hwirq;raw_spin_lock_irqsave (&pcie->leg_mask_lock, flags); val =nwl_bridge_readl (pcie,MSGF_LEG_MASK );nwl_bridge_writel (pcie, (val | mask),MSGF_LEG_MASK );
Greg Kroah-Hartman
maintainerPATCH 400/538 Revert "soc: qcom: smd-rpm: Match rpmsg channel instead of compatible"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
commit b17155133391d7f6dd18d3fb94a7d492fdec18fa upstream.
The rpm_requests device nodes have the compatible node. As such the rpmsg core uses OF modalias instead of a native rpmsg modalias. Thus if smd-rpm is built as a module, it doesn't get autoloaded for the device.
Revert the commit bcabe1e09135 ("soc: qcom: smd-rpm: Match rpmsg channel instead of compatible")
--- drivers/soc/qcom/smd-rpm.c | 35 ++++++++++++++++++++++++++--------- 1 file changed, 26 insertions(+), 9 deletions(-)
drivers/soc/qcom/smd-rpm.c +26 -9
@@ -196,9 +196,6 @@ static int qcom_smd_rpm_probe(struct rpmsg_device *rpdev) {struct qcom_smd_rpm *rpm; -if (!rpdev->dev.of_node) -return -EINVAL ; - rpm =devm_kzalloc (&rpdev->dev,sizeof (*rpm),GFP_KERNEL );if (!rpm)return -ENOMEM ;
@@ -218,18 +215,38 @@ static void qcom_smd_rpm_remove(struct rpmsg_device *rpdev)of_platform_depopulate (&rpdev->dev); } -static const struct rpmsg_device_id qcom_smd_rpm_id_table[] = { - { .name ="rpm_requests" , }, - {/* sentinel */ } +static const struct of_device_id qcom_smd_rpm_of_match[] = { + { .compatible ="qcom,rpm-apq8084" }, + { .compatible ="qcom,rpm-ipq6018" }, + { .compatible ="qcom,rpm-ipq9574" }, + { .compatible ="qcom,rpm-msm8226" }, + { .compatible ="qcom,rpm-msm8909" }, + { .compatible ="qcom,rpm-msm8916" }, + { .compatible ="qcom,rpm-msm8936" }, + { .compatible ="qcom,rpm-msm8953" }, + { .compatible ="qcom,rpm-msm8974" }, + { .compatible ="qcom,rpm-msm8976" }, + { .compatible ="qcom,rpm-msm8994" }, + { .compatible ="qcom,rpm-msm8996" }, + { .compatible ="qcom,rpm-msm8998" }, + { .compatible ="qcom,rpm-sdm660" }, + { .compatible ="qcom,rpm-sm6115" }, + { .compatible ="qcom,rpm-sm6125" }, + { .compatible ="qcom,rpm-sm6375" }, + { .compatible ="qcom,rpm-qcm2290" }, + { .compatible ="qcom,rpm-qcs404" }, + {} }; -MODULE_DEVICE_TABLE (rpmsg, qcom_smd_rpm_id_table); +MODULE_DEVICE_TABLE (of, qcom_smd_rpm_of_match);static struct rpmsg_driver qcom_smd_rpm_driver = { .probe = qcom_smd_rpm_probe, .remove = qcom_smd_rpm_remove, .callback = qcom_smd_rpm_callback, - .id_table = qcom_smd_rpm_id_table, - .drv.name ="qcom_smd_rpm" , + .drv = { + .name ="qcom_smd_rpm" , + .of_match_table = qcom_smd_rpm_of_match, + }, };static int __init qcom_smd_rpm_init (void )
Signature · 1 line
2.46.2
Greg Kroah-Hartman
maintainerPATCH 401/538 ASoC: rt5682: Return devm_of_clk_add_hw_provider to transfer the error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit fcca6d05ef49d5650514ea1dcfd12e4ae3ff2be6 upstream.
Return devm_of_clk_add_hw_provider() in order to transfer the error, if it fails due to resource allocation failure or device tree clock provider registration failure.
--- sound/soc/codecs/rt5682.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/soc/codecs/rt5682.c +3 -1
@@ -2903,8 +2903,10 @@ int rt5682_register_dai_clks(struct rt56 }if (dev->of_node) { -devm_of_clk_add_hw_provider (dev, of_clk_hw_simple_get, + ret =devm_of_clk_add_hw_provider (dev, of_clk_hw_simple_get, dai_clk_hw); +if (ret) +return ret; }else { ret = devm_clk_hw_register_clkdev(dev, dai_clk_hw, init.name,
Greg Kroah-Hartman
maintainerPATCH 402/538 soc: fsl: cpm1: tsa: Fix tsa_write8()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herve Codina <[email protected]>
commit 47a347bae9a491b467ab3543e4725a3e4fbe30f5 upstream.
The tsa_write8() parameter is an u32 value. This is not consistent with the function itself. Indeed, tsa_write8() writes an 8bits value.
Be consistent and use an u8 parameter value.
--- drivers/soc/fsl/qe/tsa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/fsl/qe/tsa.c +1 -1
@@ -140,7 +140,7 @@ static inline void tsa_write32(void __iomem *addr, u32 val)iowrite32be (val, addr); } -static inline void tsa_write8 (void __iomem *addr,u32 val) +static inline void tsa_write8 (void __iomem *addr,u8 val) {iowrite8 (val, addr); }
Signature · 1 line
2.46.2
Greg Kroah-Hartman
maintainerPATCH 403/538 soc: versatile: integrator: fix OF node leak in probe() error path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 874c5b601856adbfda10846b9770a6c66c41e229 upstream.
Driver is leaking OF node reference obtained fromof_find_matching_node().
--- drivers/soc/versatile/soc-integrator.c | 1 + 1 file changed, 1 insertion(+)
drivers/soc/versatile/soc-integrator.c +1 -0
@@ -113,6 +113,7 @@ static int __init integrator_soc_init(voreturn -ENODEV ; syscon_regmap =syscon_node_to_regmap (np); +of_node_put (np);if (IS_ERR (syscon_regmap))return PTR_ERR (syscon_regmap);
Greg Kroah-Hartman
maintainerPATCH 404/538 Revert "media: tuners: fix error return code of hybrid_tuner_request_state()"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Smirnov <[email protected]>
commit e25cc4be4616fcf5689622b3226d648aab253cdb upstream.
This reverts commit b9302fa7ed979e84b454e4ca92192cf485a4ed41.
As Fedor Pchelkin pointed out, this commit violates the convention of using the macro return value, which causes errors. For example, in functions tda18271_attach(), xc5000_attach(), simple_tuner_attach().
--- drivers/media/tuners/tuner-i2c.h | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/media/tuners/tuner-i2c.h +1 -3
@@ -133,10 +133,8 @@ static inline int tuner_i2c_xfer_send_re } \if (0 == __ret) { \ state =kzalloc (sizeof (type),GFP_KERNEL ); \ -if (!state) { \ - __ret = -ENOMEM ; \ +if (NULL == state) \ goto __fail; \ - } \ state->i2c_props.addr = i2caddr; \ state->i2c_props.adap = i2cadap; \ state->i2c_props.name = devname; \
Greg Kroah-Hartman
maintainerPATCH 405/538 iommufd: Protect against overflow of ALIGN() during iova allocation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
commit 8f6887349b2f829a4121c518aeb064fc922714e4 upstream.
Userspace can supply an iova and uptr such that the target iova alignment becomes really big and ALIGN() overflows which corrupts the selected area range during allocation. CONFIG_IOMMUFD_TEST can detect this:
WARNING: CPU: 1 PID: 5092 at drivers/iommu/iommufd/io_pagetable.c:268 iopt_alloc_area_pages drivers/iommu/iommufd/io_pagetable.c:268 [inline]
WARNING: CPU: 1 PID: 5092 at drivers/iommu/iommufd/io_pagetable.c:268 iopt_map_pages+0xf95/0x1050 drivers/iommu/iommufd/io_pagetable.c:352
Modules linked in:
CPU: 1 PID: 5092 Comm: syz-executor294 Not tainted 6.10.0-rc5-syzkaller-00294-g3ffea9a7a6f7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
RIP: 0010:iopt_alloc_area_pages drivers/iommu/iommufd/io_pagetable.c:268 [inline]
RIP: 0010:iopt_map_pages+0xf95/0x1050 drivers/iommu/iommufd/io_pagetable.c:352
Code: fc e9 a4 f3 ff ff e8 1a 8b 4c fc 41 be e4 ff ff ff e9 8a f3 ff ff e8 0a 8b 4c fc 90 0f 0b 90 e9 37 f5 ff ff e8 fc 8a 4c fc 90 <0f> 0b 90 e9 68 f3 ff ff 48 c7 c1 ec 82 ad 8f 80 e1 07 80 c1 03 38
RSP: 0018:ffffc90003ebf9e0 EFLAGS: 00010293
RAX: ffffffff85499fa4 RBX: 00000000ffffffef RCX: ffff888079b49e00
RDX: 0000000000000000 RSI: 00000000ffffffef RDI: 0000000000000000
RBP: ffffc90003ebfc50 R08: ffffffff85499b30 R09: ffffffff85499942
R10: 0000000000000002 R11: ffff888079b49e00 R12: ffff8880228e0010
R13: 0000000000000000 R14: 1ffff920007d7f68 R15: ffffc90003ebfd00
FS: 000055557d760380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000005fdeb8 CR3: 000000007404a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
iommufd_ioas_copy+0x610/0x7b0 drivers/iommu/iommufd/ioas.c:274
iommufd_fops_ioctl+0x4d9/0x5a0 drivers/iommu/iommufd/main.c:421
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7fCap the automatic alignment to the huge page size, which is probably a better idea overall. Huge automatic alignments can fragment and chew up the available IOVA space without any reason.
--- drivers/iommu/iommufd/io_pagetable.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/iommu/iommufd/io_pagetable.c +8 -0
@@ -111,6 +111,7 @@ static int iopt_alloc_iova(struct io_pagunsigned long page_offset = uptr %PAGE_SIZE ;struct interval_tree_double_span_iter used_span;struct interval_tree_span_iter allowed_span; +unsigned long max_alignment =PAGE_SIZE ;unsigned long iova_alignment;lockdep_assert_held (&iopt->iova_rwsem);
@@ -130,6 +131,13 @@ static int iopt_alloc_iova(struct io_pagroundup_pow_of_two (length), 1UL << __ffs64(uptr)); +#ifdef CONFIG_TRANSPARENT_HUGEPAGE + max_alignment =HPAGE_SIZE ; +#endif +/* Protect against ALIGN() overflow */ +if (iova_alignment >= max_alignment) + iova_alignment = max_alignment; +if (iova_alignment < iopt->iova_alignment)return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 406/538 Input: adp5588-keys - fix check on return code
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Sa <[email protected]>
commit eb017f4ea13b1a5ad7f4332279f2e4c67b44bdea upstream.
During adp5588_setup(), we read all the events to clear the event FIFO. However, adp5588_read() just calls i2c_smbus_read_byte_data() which returns the byte read in case everything goes well. Hence, we need to explicitly check for a negative error code instead of checking for something different than 0.
--- drivers/input/keyboard/adp5588-keys.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/keyboard/adp5588-keys.c +1 -1
@@ -627,7 +627,7 @@ static int adp5588_setup(struct adp5588_for (i =0 ; i <KEYP_MAX_EVENT ; i++) { ret =adp5588_read (client,KEY_EVENTA ); -if (ret) +if (ret <0 )return ret; }
Greg Kroah-Hartman
maintainerPATCH 407/538 Input: i8042 - add TUXEDO Stellaris 16 Gen5 AMD to i8042 quirk table
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Werner Sembach <[email protected]>
commit e06edf96dea065dd1d9df695bf8b92784992333e upstream.
Some TongFang barebones have touchpad and/or keyboard issues after suspend, fixable with nomux + reset + noloop + nopnp. Luckily, none of them have an external PS/2 port so this can safely be set for all of them.
I'm not entirely sure if every device listed really needs all four quirks, but after testing and production use, no negative effects could be observed when setting all four.
--- drivers/input/serio/i8042-acpipnpio.h | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
drivers/input/serio/i8042-acpipnpio.h +23 -0
@@ -1121,6 +1121,29 @@ static const struct dmi_system_id i8042_ .driver_data = (void *)(SERIO_QUIRK_NOLOOP) },/* +* Some TongFang barebones have touchpad and/or keyboard issues after +* suspend fixable with nomux + reset + noloop + nopnp. Luckily, none of +* them have an external PS/2 port so this can safely be set for all of +* them. +* TongFang barebones come with board_vendor and/or system_vendor set to +* a different value for each individual reseller. The only somewhat +* universal way to identify them is by board_name. +*/ + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "GM6XGxX"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX |SERIO_QUIRK_RESET_ALWAYS | +SERIO_QUIRK_NOLOOP |SERIO_QUIRK_NOPNP ) + }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "GMxXGxX"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX |SERIO_QUIRK_RESET_ALWAYS | +SERIO_QUIRK_NOLOOP |SERIO_QUIRK_NOPNP ) + }, +/* * A lot of modern Clevo barebones have touchpad and/or keyboard issues * after suspend fixable with nomux + reset + noloop + nopnp. Luckily, * none of them have an external PS/2 port so this can safely be set for
Greg Kroah-Hartman
maintainerPATCH 408/538 Input: i8042 - add TUXEDO Stellaris 15 Slim Gen6 AMD to i8042 quirk table
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Werner Sembach <[email protected]>
commit 3870e2850b56306d1d1e435c5a1ccbccd7c59291 upstream.
The Gen6 devices have the same problem and the same Solution as the Gen5 ones.
Some TongFang barebones have touchpad and/or keyboard issues after suspend, fixable with nomux + reset + noloop + nopnp. Luckily, none of them have an external PS/2 port so this can safely be set for all of them.
I'm not entirely sure if every device listed really needs all four quirks, but after testing and production use, no negative effects could be observed when setting all four.
--- drivers/input/serio/i8042-acpipnpio.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/serio/i8042-acpipnpio.h +7 -0
@@ -1143,6 +1143,13 @@ static const struct dmi_system_id i8042_ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "GMxHGxx"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, /* * A lot of modern Clevo barebones have touchpad and/or keyboard issues * after suspend fixable with nomux + reset + noloop + nopnp. Luckily,
Greg Kroah-Hartman
maintainerPATCH 409/538 Input: i8042 - add another board name for TUXEDO Stellaris Gen5 AMD line
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Werner Sembach <[email protected]>
commit 01eed86d50af9fab27d876fd677b86259ebe9de3 upstream.
There might be devices out in the wild where the board name is GMxXGxx instead of GMxXGxX.
Adding both to be on the safe side.
--- drivers/input/serio/i8042-acpipnpio.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/serio/i8042-acpipnpio.h +7 -0
@@ -1138,6 +1138,13 @@ static const struct dmi_system_id i8042_ }, { .matches = { + DMI_MATCH(DMI_BOARD_NAME, "GMxXGxx"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX |SERIO_QUIRK_RESET_ALWAYS | +SERIO_QUIRK_NOLOOP |SERIO_QUIRK_NOPNP ) + }, + { + .matches = { DMI_MATCH(DMI_BOARD_NAME, "GMxXGxX"), }, .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |