6.11.3-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 6.11.3-rc1 review
This is the start of the stable review cycle for the 6.11.3 release. There are 558 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 10 Oct 2024 11:55:15 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.11.3-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.11.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.11.3-rc1
Geert Uytterhoeven <[email protected]>
pmdomain: core: Reduce debug summary table width
Namhyung Kim <[email protected]>
perf report: Fix segfault when 'sym' sort key is not used
Gabe Teeger <[email protected]>
drm/amd/display: Revert Avoid overflow assignment
Herbert Xu <[email protected]>
crypto: octeontx* - Select CRYPTO_AUTHENC
Takashi Iwai <[email protected]>
ALSA: control: Fix leftover snd_power_unref()
Haoran Zhang <[email protected]>
vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
David Howells <[email protected]>
rxrpc: Fix a race between socket set up and I/O thread creation
Christian König <[email protected]>
drm/sched: revert "Always increment correct scheduler score"
Jonathan Gray <[email protected]>
Revert "drm/amd/display: Skip Recompute DSC Params if no Stream on Link"
Matthew Auld <[email protected]>
drm/xe/vram: fix ccs offset calculation
Val Packett <[email protected]>
drm/rockchip: vop: enable VOP_FEATURE_INTERNAL_RGB on RK3066
Matthew Auld <[email protected]>
drm/xe/vm: move xa_alloc to prevent UAF
Matthew Brost <[email protected]>
drm/xe: Clean up VM / exec queue file lock usage.
Armin Wolf <[email protected]>
ACPI: battery: Fix possible crash when unregistering a battery hook
Armin Wolf <[email protected]>
ACPI: battery: Simplify battery hook locking
Heiner Kallweit <[email protected]>
r8169: add tally counter fields added with RTL8125
Colin Ian King <[email protected]>
r8169: Fix spelling mistake: "tx_underun" -> "tx_underrun"
Udit Kumar <[email protected]>
remoteproc: k3-r5: Delay notification of wakeup event
Beleswar Padhi <[email protected]>
remoteproc: k3-r5: Acquire mailbox handle during probe routine
Chuck Lever <[email protected]>
NFSD: Limit the number of concurrent async COPY operations
Chuck Lever <[email protected]>
NFSD: Async COPY result needs to return a write verifier
NeilBrown <[email protected]>
sunrpc: change sp_nrthreads from atomic_t to unsigned int.
Mario Limonciello <[email protected]>
drm/amd/display: Allow backlight to go below AMDGPU_DM_DEFAULT_MIN_BACKLIGHT
Yosry Ahmed <[email protected]>
mm: z3fold: deprecate CONFIG_Z3FOLD
Oleg Nesterov <[email protected]>
uprobes: fix kernel info leak via "[uprobes]" vma
Mark Rutland <[email protected]>
arm64: errata: Expand speculative SSBS workaround once more
Mark Rutland <[email protected]>
arm64: cputype: Add Neoverse-N3 definitions
Masahiro Yamada <[email protected]>
kconfig: qconf: fix buffer overflow in debug links
Masahiro Yamada <[email protected]>
kconfig: qconf: move conf_read() before drawing tree pain
Masahiro Yamada <[email protected]>
kconfig: fix infinite loop in sym_calc_choice()
Tom Chung <[email protected]>
drm/amd/display: Fix system hang while resume with TBT monitor
Yihan Zhu <[email protected]>
drm/amd/display: update DML2 policy EnhancedPrefetchScheduleAccelerationFinal DCN35
Leo Li <[email protected]>
drm/amd/display: Enable idle workqueue for more IPS modes
Alex Hung <[email protected]>
drm/amd/display: Add HDR workaround for specific eDP
Fangzhi Zuo <[email protected]>
drm/amd/display: Restore Optimized pbn Value if Failed to Disable DSC
Tvrtko Ursulin <[email protected]>
drm/sched: Always increment correct scheduler score
Tvrtko Ursulin <[email protected]>
drm/sched: Always wake up correct scheduler in drm_sched_entity_push_job
Tvrtko Ursulin <[email protected]>
drm/sched: Add locking to drm_sched_entity_modify_sched
Rob Clark <[email protected]>
drm/sched: Fix dynamic job-flow control race
Boris Brezillon <[email protected]>
drm/panthor: Don't declare a queue blocked if deferred operations are pending
Boris Brezillon <[email protected]>
drm/panthor: Fix access to uninitialized variable in tick_ctx_cleanup()
Boris Brezillon <[email protected]>
drm/panthor: Don't add write fences to the shared BOs
Jani Nikula <[email protected]>
drm/i915/gem: fix bitwise and logical AND mixup
Al Viro <[email protected]>
close_range(): fix the logics in descriptor table trimming
Thomas Zimmermann <[email protected]>
firmware/sysfb: Disable sysfb for firmware buffers with unknown parent
Eder Zulian <[email protected]>
rtla: Fix the help text in osnoise and timerlat top tools
Wei Li <[email protected]>
tracing/timerlat: Fix duplicated kthread creation due to CPU online/offline
Wei Li <[email protected]>
tracing/timerlat: Fix a race during cpuhp processing
Wei Li <[email protected]>
tracing/timerlat: Drop interface_lock in stop_kthread()
Wei Li <[email protected]>
tracing/hwlat: Fix a race during cpuhp processing
Patrick Donnelly <[email protected]>
ceph: fix cap ref leak via netfs init_request
Jens Axboe <[email protected]>
io_uring/net: harden multishot termination case for recv
Jiawei Ye <[email protected]>
mac802154: Fix potential RCU dereference issue in mac802154_scan_worker
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE
Jiawen Wu <[email protected]>
net: pcs: xpcs: fix the wrong register that was written back
Emanuele Ghidoli <[email protected]>
gpio: davinci: fix lazy disable
Uwe Kleine-König <[email protected]>
cpufreq: intel_pstate: Make hwp_notify_lock a raw spinlock
Miquel Sabaté Solà <[email protected]>
cpufreq: Avoid a bad reference count on CPU node
Filipe Manana <[email protected]>
btrfs: wait for fixup workers before stopping cleaner kthread during umount
Filipe Manana <[email protected]>
btrfs: send: fix invalid clone operation for file that got its size decreased
Josef Bacik <[email protected]>
btrfs: drop the backref cache during relocation if we commit
Qu Wenruo <[email protected]>
btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
Filipe Manana <[email protected]>
btrfs: send: fix buffer overflow detection when copying path to cache entry
Hans de Goede <[email protected]>
ACPI: resource: Add Asus ExpertBook B2502CVA to irq1_level_low_skip_override[]
Hans de Goede <[email protected]>
ACPI: resource: Add Asus Vivobook X1704VAP to irq1_level_low_skip_override[]
Hans de Goede <[email protected]>
ACPI: resource: Loosen the Asus E1404GAB DMI match to also cover the E1404GA
Hans de Goede <[email protected]>
ACPI: resource: Remove duplicate Asus E1504GAB IRQ override
Hans de Goede <[email protected]>
ACPI: video: Add backlight=native quirk for Dell OptiPlex 5480 AIO
Christian Brauner <[email protected]>
pidfs: check for valid pid namespace
Baokun Li <[email protected]>
cachefiles: fix dentry leak in cachefiles_open_file()
Benjamin Tissoires <[email protected]>
HID: bpf: fix cfi stubs for hid_bpf_ops
Nuno Sa <[email protected]>
Input: adp5589-keys - fix adp5589_gpio_get_value()
Nuno Sa <[email protected]>
Input: adp5589-keys - fix NULL pointer dereference
Steve Sistare <[email protected]>
mm/hugetlb: simplify refs in memfd_alloc_folio
Steve Sistare <[email protected]>
mm/gup: fix memfd_pin_folios alloc race panic
Steve Sistare <[email protected]>
mm/gup: fix memfd_pin_folios hugetlb page allocation
Steve Sistare <[email protected]>
mm/hugetlb: fix memfd_pin_folios resv_huge_pages leak
Steve Sistare <[email protected]>
mm/hugetlb: fix memfd_pin_folios free_huge_pages leak
Steve Sistare <[email protected]>
mm/filemap: fix filemap_get_folios_contig THP panic
Krzysztof Kozlowski <[email protected]>
rtc: at91sam9: fix OF node leak in probe() error path
KhaiWenTan <[email protected]>
net: stmmac: Fix zero-division error when disabling tc cbs
Muhammad Usama Anjum <[email protected]>
kselftests: mm: fix wrong __NR_userfaultfd value
Tetsuo Handa <[email protected]>
tomoyo: fallback to realpath if symlink's pathname does not exist
Willem de Bruijn <[email protected]>
gso: fix udp gso fraglist segmentation after pull from frag_list
Felix Fietkau <[email protected]>
net: gso: fix tcp fraglist segmentation after pull from frag_list
Willem de Bruijn <[email protected]>
vrf: revert "vrf: Remove unnecessary RCU-bh critical section"
Vasileios Amoiridis <[email protected]>
iio: pressure: bmp280: Fix waiting time for BMP3xx configuration
Vasileios Amoiridis <[email protected]>
iio: pressure: bmp280: Fix regmap for BMP280 device
Barnabás Czémán <[email protected]>
iio: magnetometer: ak8975: Fix reading for ak099xx sensors
Steve French <[email protected]>
smb3: fix incorrect mode displayed for read-only files
wangrong <[email protected]>
smb: client: use actual path when queryfs
Charlene Liu <[email protected]>
drm/amd/display: avoid set dispclk to 0
Ajit Pandey <[email protected]>
clk: qcom: clk-alpha-pll: Fix CAL_L_VAL override for LUCID EVO PLL
Satya Priya Kakitapalli <[email protected]>
clk: qcom: gcc-sc8180x: Fix the sdcc2 and sdcc4 clocks freq table
Bryan O'Donoghue <[email protected]>
media: qcom: camss: Fix ordering of pm_runtime_enable
Satya Priya Kakitapalli <[email protected]>
clk: qcom: gcc-sc8180x: Add GPLL9 support
Bryan O'Donoghue <[email protected]>
media: qcom: camss: Remove use_count guard in stop_streaming
Manivannan Sadhasivam <[email protected]>
clk: qcom: gcc-sm8250: Do not turn off PCIe GDSCs during gdsc_disable()
Zheng Wang <[email protected]>
media: venus: fix use after free bug in venus_remove due to race condition
Satya Priya Kakitapalli <[email protected]>
clk: qcom: gcc-sm8150: De-register gcc_cpuss_ahb_clk_src
David Virag <[email protected]>
clk: samsung: exynos7885: Update CLKS_NR_FSYS after bindings fix
Mike Tipton <[email protected]>
clk: qcom: clk-rpmh: Fix overflow in BCM vote
Satya Priya Kakitapalli <[email protected]>
clk: qcom: gcc-sc8180x: Register QUPv3 RCGs for DFS on sc8180x
Satya Priya Kakitapalli <[email protected]>
dt-bindings: clock: qcom: Add GPLL9 support on gcc-sc8180x
Hans Verkuil <[email protected]>
media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
Manivannan Sadhasivam <[email protected]>
clk: qcom: gcc-sm8450: Do not turn off PCIe GDSCs during gdsc_disable()
Laurent Pinchart <[email protected]>
media: sun4i_csi: Implement link validate for sun4i_csi subdev
Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8250: use CLK_SET_RATE_PARENT for branch clocks
Laurent Pinchart <[email protected]>
media: videobuf2: Drop minimum allocation requirement of 2 buffers
Julian Sun <[email protected]>
gfs2: fix double destroy_workqueue error
Jan Kiszka <[email protected]>
remoteproc: k3-r5: Fix error handling when power-up failed
Bastien Curutchet <[email protected]>
leds: pca9532: Remove irrelevant blink configuration error message
Sebastian Reichel <[email protected]>
clk: rockchip: fix error for unknown clocks
Bryan O'Donoghue <[email protected]>
media: ov5675: Fix power on/off delay timings
Umang Jain <[email protected]>
media: imx335: Fix reset-gpio handling
Chun-Yi Lee <[email protected]>
aoe: fix the potential use-after-free problem in more places
Alexandre Ghiti <[email protected]>
riscv: Fix kernel stack size when KASAN is enabled
Pu Lehui <[email protected]>
drivers/perf: riscv: Align errno for unsupported perf event
Long Li <[email protected]>
RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page
Long Li <[email protected]>
RDMA/mana_ib: use the correct page table index based on hardware page size
Thomas Weißschuh <[email protected]>
sysctl: avoid spurious permanent empty tables
Kaixin Wang <[email protected]>
i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition
Chuck Lever <[email protected]>
NFSD: Fix NFSv4's PUTPUBFH operation
Li Lingfeng <[email protected]>
nfsd: map the EBADMSG to nfserr_io to avoid warning
NeilBrown <[email protected]>
nfsd: fix delegation_blocked() to block correctly for at least 30 seconds
Matt Fleming <[email protected]>
perf hist: Update hist symbol when updating maps
Arnaldo Carvalho de Melo <[email protected]>
perf python: Disable -Wno-cast-function-type-mismatch if present on clang
Yuezhang Mo <[email protected]>
exfat: fix memory leak in exfat_load_bitmap()
Jisheng Zhang <[email protected]>
riscv: define ILLEGAL_POINTER_VALUE for 64bit
Johannes Weiner <[email protected]>
sched: psi: fix bogus pressure spikes from aggregation race
Youssef Esmat <[email protected]>
sched/core: Clear prev->dl_server in CFS pick fast path
Joel Fernandes (Google) <[email protected]>
sched/core: Add clearing of ->dl_server in put_prev_task_balance()
Daniel Bristot de Oliveira <[email protected]>
sched/deadline: Comment sched_dl_entity::dl_server variable
José Roberto de Souza <[email protected]>
drm/xe/oa: Don't reset OAC_CONTEXT_ENABLE on OA stream close
Matthew Auld <[email protected]>
drm/xe: fix UAF around queue destruction
Easwar Hariharan <[email protected]>
arm64: Subscribe Microsoft Azure Cobalt 100 to erratum 3194386
Mark Rutland <[email protected]>
arm64: fix selection of HAVE_DYNAMIC_FTRACE_WITH_ARGS
Kuan-Ying Lee <[email protected]>
scripts/gdb: fix lx-mounts command error
Kuan-Ying Lee <[email protected]>
scripts/gdb: add iteration function for rbtree
Kuan-Ying Lee <[email protected]>
scripts/gdb: fix timerlist parsing issue
Lizhi Xu <[email protected]>
ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
Julian Sun <[email protected]>
ocfs2: fix null-ptr-deref when journal load failed.
Lizhi Xu <[email protected]>
ocfs2: remove unreasonable unlock in ocfs2_read_blocks
Joseph Qi <[email protected]>
ocfs2: cancel dqi_sync_work before freeing oinfo
Gautham Ananthakrishna <[email protected]>
ocfs2: reserve space for inline xattr before attaching reflink tree
Joseph Qi <[email protected]>
ocfs2: fix uninit-value in ocfs2_get_block()
Heming Zhao <[email protected]>
ocfs2: fix the la space leak when unmounting an ocfs2 volume
Danilo Krummrich <[email protected]>
mm: krealloc: consider spare memory for __GFP_ZERO
Kemeng Shi <[email protected]>
jbd2: correctly compare tids with tid_geq function in jbd2_fc_begin_commit
Baokun Li <[email protected]>
jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
Andrii Nakryiko <[email protected]>
lib/buildid: harden build ID parsing logic
Huang Ying <[email protected]>
resource: fix region_intersects() vs add_memory_driver_managed()
Ma Ke <[email protected]>
drm: omapdrm: Add missing check for alloc_ordered_workqueue
Andrew Jones <[email protected]>
of/irq: Support #msi-cells=<0> in of_msi_get_domain
Thomas Weißschuh <[email protected]>
of: address: Report error on resource bounds overflow
Val Packett <[email protected]>
drm/rockchip: vop: clear DMA stop bit on RK3066
Helge Deller <[email protected]>
parisc: Fix stack start for ADDR_NO_RANDOMIZE personality
Helge Deller <[email protected]>
parisc: Allow mmap(MAP_STACK) memory to automatically expand upwards
Helge Deller <[email protected]>
parisc: Fix 64-bit userspace syscall path
Lucas De Marchi <[email protected]>
drm/xe: Generate oob before compiling anything
Baokun Li <[email protected]>
ext4: fix off by one issue in alloc_flex_gd()
Luis Henriques (SUSE) <[email protected]>
ext4: mark fc as ineligible using an handle in ext4_xattr_set()
Luis Henriques (SUSE) <[email protected]>
ext4: use handle to mark fc as ineligible in __track_dentry_update()
Luis Henriques (SUSE) <[email protected]>
ext4: fix fast commit inode enqueueing during a full journal commit
Luis Henriques (SUSE) <[email protected]>
ext4: fix incorrect tid assumption in jbd2_journal_shrink_checkpoint_list()
Luis Henriques (SUSE) <[email protected]>
ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit()
Baokun Li <[email protected]>
ext4: update orig_path in ext4_find_extent()
Luis Henriques (SUSE) <[email protected]>
ext4: fix access to uninitialised lock in fc replay path
Xiaxi Shen <[email protected]>
ext4: fix timer use-after-free on failed mount
Baokun Li <[email protected]>
ext4: fix double brelse() the buffer of the extents path
Baokun Li <[email protected]>
ext4: aovid use-after-free in ext4_ext_insert_extent()
Baokun Li <[email protected]>
ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
Luis Henriques (SUSE) <[email protected]>
ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space()
Zhihao Cheng <[email protected]>
ext4: dax: fix overflowing extents beyond inode size when partially writing
Luis Henriques (SUSE) <[email protected]>
ext4: fix incorrect tid assumption in ext4_fc_mark_ineligible()
Baokun Li <[email protected]>
ext4: propagate errors from ext4_find_extent() in ext4_insert_range()
Baokun Li <[email protected]>
ext4: fix slab-use-after-free in ext4_split_extent_at()
yao.ly <[email protected]>
ext4: correct encrypted dentry name hash when not casefolded
Edward Adam Davis <[email protected]>
ext4: no need to continue when the number of entries is 1
Abhishek Tamboli <[email protected]>
ALSA: hda/realtek: Add a quirk for HP Pavilion 15z-ec200
Ai Chao <[email protected]>
ALSA: hda/realtek: Add quirk for Huawei MateBook 13 KLV-WX9
Nikolai Afanasenkov <[email protected]>
ALSA: hda/realtek: fix mute/micmute LED for HP mt645 G8
Hans P. Moller <[email protected]>
ALSA: line6: add hw monitor volume control to POD HD500X
Jan Lalinsky <[email protected]>
ALSA: usb-audio: Add native DSD support for Luxman D-08u
Lianqin Hu <[email protected]>
ALSA: usb-audio: Add delay quirk for VIVO USB-C HEADSET
Jaroslav Kysela <[email protected]>
ALSA: core: add isascii() check to card ID generator
Baojun Xu <[email protected]>
ALSA: hda/tas2781: Add new quirk for Lenovo Y990 Laptop
Thomas Zimmermann <[email protected]>
drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS
Javier Carrasco <[email protected]>
drm/mediatek: ovl_adaptor: Add missing of_node_put()
Helge Deller <[email protected]>
parisc: Fix itlb miss handler for 64-bit programs
Tvrtko Ursulin <[email protected]>
drm/v3d: Prevent out of bounds access in performance query extensions
Luo Gengkun <[email protected]>
perf/core: Fix small negative period being ignored
Hans de Goede <[email protected]>
power: supply: Drop use_cnt check from power_supply_property_is_writeable()
Peng Fan <[email protected]>
mm, slub: avoid zeroing kmalloc redzone
Hans de Goede <[email protected]>
power: supply: hwmon: Fix missing temp1_max_alarm attribute
Jinjie Ruan <[email protected]>
spi: bcm63xx: Fix missing pm_runtime_disable()
Jinjie Ruan <[email protected]>
spi: bcm63xx: Fix module autoloading
David Virag <[email protected]>
dt-bindings: clock: exynos7885: Fix duplicated binding
Krzysztof Kozlowski <[email protected]>
memory: tegra186-emc: drop unused to_tegra186_emc()
Krzysztof Kozlowski <[email protected]>
firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()
Mike Baynton <[email protected]>
ovl: fail if trusted xattrs are needed but caller lacks permission
Alice Ryhl <[email protected]>
rust: sync: require T: Sync for LockedBy::access
Ard Biesheuvel <[email protected]>
i2c: synquacer: Deal with optional PCLK correctly
Kimriver Liu <[email protected]>
i2c: designware: fix controller is holding SCL low while ENABLE bit is disabled
Jinjie Ruan <[email protected]>
i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled
Heiner Kallweit <[email protected]>
i2c: core: Lock address during client device instantiation
Alexander Shiyan <[email protected]>
media: i2c: ar0521: Use cansleep version of gpiod_set_value()
Robert Hancock <[email protected]>
i2c: xiic: Wait for TX empty to avoid missed TX NAKs
Jinjie Ruan <[email protected]>
i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq()
Marek Vasut <[email protected]>
i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
Marc Zyngier <[email protected]>
KVM: arm64: Fix kvm_has_feat*() handling of negative features
Zach Wade <[email protected]>
platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
Hans de Goede <[email protected]>
platform/x86: x86-android-tablets: Fix use after free on platform_device_register() errors
Takashi Iwai <[email protected]>
Revert "ALSA: hda: Conditionally use snooping for AMD HDMI"
Daeho Jeong <[email protected]>
f2fs: forcibly migrate to secure space for zoned device file pinning
Daeho Jeong <[email protected]>
f2fs: do FG_GC when GC boosting is required for zoned devices
Daeho Jeong <[email protected]>
f2fs: increase BG GC migration window granularity when boosted for zoned devices
Daeho Jeong <[email protected]>
f2fs: introduce migration_window_granularity
Daeho Jeong <[email protected]>
f2fs: make BG GC more aggressive for zoned devices
Heiko Carstens <[email protected]>
selftests: vDSO: fix vdso_config for s390
Jens Remus <[email protected]>
selftests: vDSO: fix ELF hash table entry size for s390x
Christophe Leroy <[email protected]>
powerpc/vdso: Fix VDSO data access when running in a non-root time namespace
Chao Yu <[email protected]>
f2fs: fix to don't panic system for no free segment fault injection
Liao Yuanhong <[email protected]>
f2fs: add write priority option based on zone UFS
Arnd Bergmann <[email protected]>
nvme-tcp: fix link failure for TCP auth
David Hildenbrand <[email protected]>
selftests/mm: fix charge_reserved_hugetlb.sh test
Gabriel Krisman Bertazi <[email protected]>
ext4: fix error message when rejecting the default hash
Christophe Leroy <[email protected]>
selftests: vDSO: fix vDSO symbols lookup for powerpc64
Christophe Leroy <[email protected]>
selftests: vDSO: fix vdso_config for powerpc
Christophe Leroy <[email protected]>
selftests: vDSO: fix vDSO name for powerpc
Nirmoy Das <[email protected]>
drm/xe: Fix memory leak on xe_alloc_pf_queue failure
Matthew Auld <[email protected]>
drm/xe: fixup xe_alloc_pf_queue
Namhyung Kim <[email protected]>
perf: Really fix event_function_call() locking
Ian Rogers <[email protected]>
perf callchain: Fix stitch LBR memory leaks
Takashi Iwai <[email protected]>
ALSA: control: Fix power_ref lock order for compat code, too
Biju Das <[email protected]>
spi: rpc-if: Add missing MODULE_DEVICE_TABLE
Alexander F. Lent <[email protected]>
accel/ivpu: Add missing MODULE_FIRMWARE metadata
Yifei Liu <[email protected]>
selftests: breakpoints: use remaining time to check if suspend succeed
Alessandro Zanni <[email protected]>
kselftest/devices/probe: Fix SyntaxWarning in regex strings for Python3
Ben Dooks <[email protected]>
spi: s3c64xx: fix timeout counters in flush_fifo
Yun Lu <[email protected]>
selftest: hid: add missing run-hid-tools-tests.sh
Jinjie Ruan <[email protected]>
spi: spi-cadence: Fix missing spi_controller_is_target() check
Jinjie Ruan <[email protected]>
spi: spi-cadence: Fix pm_runtime_set_suspended() with runtime pm enabled
Jinjie Ruan <[email protected]>
spi: spi-imx: Fix pm_runtime_set_suspended() with runtime pm enabled
Ben Cheatham <[email protected]>
EINJ, CXL: Fix CXL device SBDF calculation
Yonghong Song <[email protected]>
bpf: Fix a sdiv overflow issue
Kuan-Wei Chiu <[email protected]>
bpftool: Fix undefined behavior in qsort(NULL, 0, ...)
Christoph Hellwig <[email protected]>
iomap: handle a post-direct I/O invalidate race in iomap_write_delalloc_release
Kuan-Wei Chiu <[email protected]>
bpftool: Fix undefined behavior caused by shifting into the sign bit
Artem Sadovnikov <[email protected]>
ext4: fix i_data_sem unlock order in ext4_ind_migrate()
Baokun Li <[email protected]>
ext4: avoid use-after-free in ext4_ext_show_leaf()
Thadeu Lima de Souza Cascardo <[email protected]>
ext4: ext4_search_dir should return a proper error
Juntong Deng <[email protected]>
bpf: Make the pointer returned by iter next method valid
Jan Kara <[email protected]>
ext4: don't set SB_RDONLY after filesystem errors
Lizhi Xu <[email protected]>
ext4: filesystems without casefold feature cannot be mounted with siphash
Hans de Goede <[email protected]>
platform/x86: x86-android-tablets: Adjust Xiaomi Pad 2 bottom bezel touch buttons LED
Luiz Capitulino <[email protected]>
platform/mellanox: mlxbf-pmc: fix lockdep warning
Namjae Jeon <[email protected]>
ksmbd: add refcnt to ksmbd_conn struct
Dmitry Torokhov <[email protected]>
HID: i2c-hid: ensure various commands do not interfere with each other
Zhu Jun <[email protected]>
tools/hv: Add memory allocation check in hv_fcopy_start
Gergo Koteles <[email protected]>
platform/x86: lenovo-ymc: Ignore the 0x0 state
Alex Deucher <[email protected]>
drm/amdgpu/gfx10: use rlc safe mode for soft recovery
Alex Deucher <[email protected]>
drm/amdgpu/gfx11: use rlc safe mode for soft recovery
Alex Deucher <[email protected]>
drm/amdgpu/gfx12: use rlc safe mode for soft recovery
Amir Goldstein <[email protected]>
ovl: fsync after metadata copy-up
Haren Myneni <[email protected]>
powerpc/pseries: Use correct data types from pseries_hp_errorlog struct
Ahmed, Muhammad <[email protected]>
drm/amd/display: guard write a 0 post_divider value to HW
Geert Uytterhoeven <[email protected]>
of/irq: Refer to actual buffer size in of_irq_parse_one()
Matthew Brost <[email protected]>
drm/xe: Drop warn on xe_guc_pc_gucrc_disable in guc pc fini
Hawking Zhang <[email protected]>
drm/amdkfd: Check int source id for utcl2 poison event
Tim Huang <[email protected]>
drm/amd/pm: ensure the fw_info is not null before using it
Stuart Summers <[email protected]>
drm/xe: Use topology to determine page fault queue size
Alex Deucher <[email protected]>
drm/amdgpu/gfx11: enter safe mode before touching CP_INT_CNTL
Alex Deucher <[email protected]>
drm/amdgpu/gfx9: use rlc safe mode for soft recovery
Victor Skvortsov <[email protected]>
drm/amdgpu: Block MMR_READ IOCTL in reset
Sunil Khatri <[email protected]>
drm/amdgpu: fix ptr check warning in gfx11 ip_dump
Sunil Khatri <[email protected]>
drm/amdgpu: fix ptr check warning in gfx10 ip_dump
Sunil Khatri <[email protected]>
drm/amdgpu: fix ptr check warning in gfx9 ip_dump
Austin Zheng <[email protected]>
drm/amd/display: Unlock Pipes Based On DET Allocation
Geert Uytterhoeven <[email protected]>
drm/radeon/r100: Handle unknown family in r100_cp_init_microcode()
Finn Thain <[email protected]>
scsi: NCR5380: Initialize buffer for MSG IN and STATUS transfers
Peter Zijlstra <[email protected]>
perf: Fix event_function_call() locking
Tim Huang <[email protected]>
drm/amdgpu: fix unchecked return value warning for amdgpu_atombios
Tim Huang <[email protected]>
drm/amdgpu: fix unchecked return value warning for amdgpu_gfx
Dillon Varone <[email protected]>
drm/amd/display: Force enable 3DLUT DMA check for dcn401 in DML
Justin Tee <[email protected]>
scsi: lpfc: Update PRLO handling in direct attached topology
Justin Tee <[email protected]>
scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology
Justin Tee <[email protected]>
scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths
Kees Cook <[email protected]>
scsi: aacraid: Rearrange order of struct aac_srb_unit
Andrii Nakryiko <[email protected]>
perf,x86: avoid missing caller address in stack traces captured in uprobe
Matthew Brost <[email protected]>
drm/printer: Allow NULL data in devcoredump printer
Alex Hung <[email protected]>
drm/amd/display: Initialize get_bytes_per_element's default to 1
Alex Hung <[email protected]>
drm/amd/display: Avoid overflow assignment in link_dp_cts
Alex Hung <[email protected]>
drm/amd/display: Check stream_status before it is used
Alex Hung <[email protected]>
drm/amd/display: Fix possible overflow in integer multiplication
Alex Deucher <[email protected]>
drm/amdgpu/gfx9: properly handle error ints on all pipes
Alex Deucher <[email protected]>
drm/amdgpu/gfx12: properly handle error ints on all pipes
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix index out of bounds in DCN30 color transformation
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Implement bounds check for stream encoder creation in DCN401
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix index out of bounds in degamma hardware format translation
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation
Alex Hung <[email protected]>
drm/amd/display: Increase array size of dummy_boolean
Chris Park <[email protected]>
drm/amd/display: Deallocate DML memory if allocation fails
Alex Hung <[email protected]>
drm/amd/display: Check stream before comparing them
Alex Hung <[email protected]>
drm/amd/display: Check phantom_stream before it is used
Alex Hung <[email protected]>
drm/amd/display: Check null-initialized variables
Alex Hung <[email protected]>
drm/amd/display: Initialize denominators' default to 1
Yannick Fertre <[email protected]>
drm/stm: ltdc: reset plane transparency after plane disable
Uma Shankar <[email protected]>
drm/xe/fbdev: Limit the usage of stolen for LNL+
Matthew Brost <[email protected]>
drm/xe: Add timeout to preempt fences
aln8 <[email protected]>
platform/x86/amd: pmf: Add quirk for TUF Gaming A14
Ckath <[email protected]>
platform/x86: touchscreen_dmi: add nanote-next quirk
Vishnu Sankar <[email protected]>
HID: multitouch: Add support for Thinkpad X12 Gen 2 Kbd Portfolio
Jesse Zhang <[email protected]>
drm/amdkfd: Fix resource leak in criu restore queue
Peng Liu <[email protected]>
drm/amdgpu: enable gfxoff quirk on HP 705G4
Peng Liu <[email protected]>
drm/amdgpu: add raven1 gfxoff quirk
Zhao Mengmeng <[email protected]>
jfs: Fix uninit-value access of new_ea in ea_buffer
Konrad Dybcio <[email protected]>
drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs
David Strahan <[email protected]>
scsi: smartpqi: add new controller PCI IDs
Mahesh Rajashekhara <[email protected]>
scsi: smartpqi: correct stream detection
Edward Adam Davis <[email protected]>
jfs: check if leafidx greater than num leaves per dmap tree
Edward Adam Davis <[email protected]>
jfs: Fix uaf in dbFreeBits
Remington Brasga <[email protected]>
jfs: UBSAN: shift-out-of-bounds in dbFindBits
Yang Wang <[email protected]>
drm/amdgpu: add list empty check to avoid null pointer issue
Tim Huang <[email protected]>
drm/amd/display: fix double free issue during amdgpu module unload
Matt Roper <[email protected]>
drm/xe: Name and document Wa_14019789679
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for 'afb' in amdgpu_dm_plane_handle_cursor_update (v2)
Rodrigo Siqueira <[email protected]>
drm/amd/display: Check null pointer before try to access it
Alex Hung <[email protected]>
drm/amd/display: Check null pointers before using dc->clk_mgr
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for 'afb' in amdgpu_dm_update_cursor (v2)
Aurabindo Pillai <[email protected]>
drm/amd/display: fix a UBSAN warning in DML2.1
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add NULL check for function pointer in dcn401_set_output_transfer_func
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream'
Daniel Sa <[email protected]>
drm/amd/display: Underflow Seen on DCN401 eGPU
Hans de Goede <[email protected]>
HID: Ignore battery for all ELAN I2C-HID devices
David Strahan <[email protected]>
scsi: smartpqi: Add new controller PCI IDs
Jiri Olsa <[email protected]>
selftests/bpf: fix uprobe.path leak in bpf_testmod
Damien Le Moal <[email protected]>
ata: sata_sil: Rename sil_blacklist to sil_quirks
Damien Le Moal <[email protected]>
ata: pata_serverworks: Do not use the term blacklist
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Use gpuvm_min_page_size_kbytes for DML2 surfaces
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe
Suraj Kandpal <[email protected]>
drm/xe/hdcp: Check GSC structure validity
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn401_init_hw
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer
Philip Yang <[email protected]>
drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
Pierre-Eric Pelloux-Prayer <[email protected]>
drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit
Alex Hung <[email protected]>
drm/amd/display: Check null pointers before multiple uses
Alex Hung <[email protected]>
drm/amd/display: Check null pointers before used
Alex Hung <[email protected]>
drm/amd/display: Check null pointers before using them
Alex Hung <[email protected]>
drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags
Katya Orlova <[email protected]>
drm/stm: Avoid use-after-free issues with crtc and plane
Michal Koutný <[email protected]>
cgroup: Disallow mounting v1 hierarchies without controller implementation
Jason Gunthorpe <[email protected]>
iommu/arm-smmu-v3: Do not use devm for the cd table allocations
Lu Baolu <[email protected]>
iommu/vt-d: Unconditionally flush device TLB for pasid table updates
Sanjay K Kumar <[email protected]>
iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
Lu Baolu <[email protected]>
iommu/vt-d: Always reserve a domain ID for identity setup
Mostafa Saleh <[email protected]>
iommu/arm-smmu-v3: Match Stall behaviour for S2
Andrew Davis <[email protected]>
power: reset: brcmstb: Do not go into infinite loop if reset fails
Paul E. McKenney <[email protected]>
rcuscale: Provide clear error when async specified without primitives
Ulf Hansson <[email protected]>
pmdomain: core: Use dev_name() instead of kobject_get_path() in debugfs
Ulf Hansson <[email protected]>
pmdomain: core: Don't hold the genpd-lock when calling dev_pm_domain_set()
Kaixin Wang <[email protected]>
fbdev: pxafb: Fix possible use after free in pxafb_task()
Thomas Weißschuh <[email protected]>
fbdev: efifb: Register sysfs groups through driver core
Denis Pauk <[email protected]>
hwmon: (nct6775) add G15CF to ASUS WMI monitoring list
Zqiang <[email protected]>
rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb()
Pierre-Louis Bossart <[email protected]>
ASoC: Intel: boards: always check the result of acpi_dev_get_first_match_dev()
Kees Cook <[email protected]>
x86/syscall: Avoid memcpy() for ia32 syscall_get_arguments()
Thomas Weißschuh <[email protected]>
selftests/nolibc: avoid passing NULL to printf("%s")
Thomas Weißschuh <[email protected]>
tools/nolibc: powerpc: limit stack-protector workaround to GCC
Takashi Iwai <[email protected]>
ALSA: hdsp: Break infinite MIDI input flush loop
Takashi Iwai <[email protected]>
ALSA: asihpi: Fix potential OOB array access
Steve Wahl <[email protected]>
x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
Tao Liu <[email protected]>
x86/kexec: Add EFI config table identity mapping for kexec kernel
Aruna Ramakrishna <[email protected]>
x86/pkeys: Restore altstack access in sigreturn()
Aruna Ramakrishna <[email protected]>
x86/pkeys: Add PKRU as a parameter in signal handling functions
Ahmed S. Darwish <[email protected]>
tools/x86/kcpuid: Protect against faulty "max subleaf" values
Takashi Iwai <[email protected]>
ALSA: control: Take power_ref lock primarily
Krzysztof Kozlowski <[email protected]>
ASoC: codecs: wsa883x: Handle reading version failure
Joshua Pius <[email protected]>
ALSA: usb-audio: Add logitech Audio profile quirk
Joshua Grisham <[email protected]>
ALSA: hda/realtek: Refactor and simplify Samsung Galaxy Book init
Asahi Lina <[email protected]>
ALSA: usb-audio: Add mixer quirk for RME Digiface USB
Cyan Nyan <[email protected]>
ALSA: usb-audio: Add quirk for RME Digiface USB
Takashi Iwai <[email protected]>
ALSA: usb-audio: Replace complex quirk lines with macros
Takashi Iwai <[email protected]>
ALSA: usb-audio: Define macros for quirk table entries
Karol Kosik <[email protected]>
ALSA: usb-audio: Support multiple control interfaces
Thomas Gleixner <[email protected]>
x86/apic: Remove logical destination mode for 64-bit
Thomas Gleixner <[email protected]>
x86/ioapic: Handle allocation failures gracefully
Takashi Iwai <[email protected]>
ALSA: usb-audio: Add input value sanity checks for standard types
Jinjie Ruan <[email protected]>
nfp: Use IRQF_NO_AUTOEN flag in request_irq()
David Howells <[email protected]>
netfs: Cancel dirty folios that have no storage destination
Gustavo A. R. Silva <[email protected]>
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
Felix Fietkau <[email protected]>
wifi: mt76: mt7915: hold dev->mt76.mutex while disabling tx worker
Benjamin Lin <[email protected]>
wifi: mt76: mt7915: add dummy HW offload of IEEE 802.11 fragmentation
Yang Shen <[email protected]>
crypto: hisilicon - fix missed error branch
Joe Damato <[email protected]>
net: napi: Prevent overflow of napi_defer_hard_irqs
David Kaplan <[email protected]>
x86/bugs: Fix handling when SRSO mitigation is disabled
Daniel Sneddon <[email protected]>
x86/bugs: Add missing NO_SSB flag
Zong-Zhe Yang <[email protected]>
wifi: rtw89: avoid reading out of bounds when loading TX power FW elements
Niklas Söderlund <[email protected]>
net: phy: Check for read errors in SIOCGMIIREG
Fares Mehanna <[email protected]>
arm64: trans_pgd: mark PTEs entries as valid to avoid dead kexec()
Huacai Chen <[email protected]>
cpufreq: loongson3: Use raw_smp_processor_id() in do_service_request()
Anastasia Belova <[email protected]>
cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value
Alexey Dobriyan <[email protected]>
block: fix integer overflow in BLKSECDISCARD
Marek Vasut <[email protected]>
wifi: wilc1000: Do not operate uninitialized hardware during suspend/resume
Joe Damato <[email protected]>
netdev-genl: Set extack and fix error on napi-get
Stefan Mätje <[email protected]>
can: netlink: avoid call to do_set_data_bittiming callback with stale can_priv::ctrlmode
Puranjay Mohan <[email protected]>
nvme: fix metadata handling in nvme-passthrough
James Clark <[email protected]>
drivers/perf: arm_spe: Use perf_allow_kernel() for permissions
Mateusz Guzik <[email protected]>
vfs: use RCU in ilookup
Adrian Ratiu <[email protected]>
proc: add config & param to block forcing mem writes
Aleksandrs Vinarskis <[email protected]>
ACPICA: iasl: handle empty connection_node
Johannes Berg <[email protected]>
wifi: mac80211: fix RCU list iterations
Nikunj A Dadhania <[email protected]>
virt: sev-guest: Ensure the SNP guest messages do not exceed a page
Miri Korenblit <[email protected]>
wifi: iwlwifi: mvm: avoid NULL pointer dereference
Anjaneyulu <[email protected]>
wifi: iwlwifi: allow only CN mcc from WRDD
Johannes Berg <[email protected]>
wifi: iwlwifi: mvm: use correct key iteration
Jason Xing <[email protected]>
tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process
Breno Leitao <[email protected]>
netpoll: Ensure clean state on setup failures
Herbert Xu <[email protected]>
crypto: simd - Do not call crypto_alloc_tfm during registration
Simon Horman <[email protected]>
net: atlantic: Avoid warning about potential string truncation
Hannes Reinecke <[email protected]>
nvme-tcp: check for invalidated or revoked key
Hannes Reinecke <[email protected]>
nvme-tcp: sanitize TLS key handling
Hannes Reinecke <[email protected]>
nvme-keyring: restrict match length for version '1' identifiers
Ido Schimmel <[email protected]>
ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: do not remove elements if set backend implements .abort
Ping-Ke Shih <[email protected]>
wifi: rtw89: correct base HT rate mask for firmware
Kuniyuki Iwashima <[email protected]>
ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR).
Simon Horman <[email protected]>
bnxt_en: Extend maximum length of version string by 1 byte
Simon Horman <[email protected]>
net: mvpp2: Increase size of queue_name buffer
Jakub Kicinski <[email protected]>
net: skbuff: sprinkle more __GFP_NOWARN on ingress allocs
Simon Horman <[email protected]>
tipc: guard against string buffer overrun
Pei Xiao <[email protected]>
ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()
Rafael J. Wysocki <[email protected]>
ACPI: EC: Do not release locks during operation region accesses
Ping-Ke Shih <[email protected]>
wifi: rtw89: 885xb: reset IDMEM mode to prevent download firmware failure
James Chapman <[email protected]>
l2tp: use rcu list add/del when updating lists
James Chapman <[email protected]>
l2tp: free sessions using rcu
Zong-Zhe Yang <[email protected]>
wifi: rtw88: select WANT_DEV_COREDUMP
Karthikeyan Periyasamy <[email protected]>
wifi: ath11k: fix array out-of-bound access in SoC stats
Karthikeyan Periyasamy <[email protected]>
wifi: ath12k: fix array out-of-bound access in SoC stats
Johannes Thumshirn <[email protected]>
btrfs: don't readahead the relocation inode on RST
Konstantin Ovsepian <[email protected]>
blk_iocost: fix more out of bound shifts
Mario Limonciello <[email protected]>
ACPI: CPPC: Add support for setting EPP register in FFH
Hans de Goede <[email protected]>
ACPI: video: Add force_vendor quirk for Panasonic Toughbook CF-18
Hilda Wu <[email protected]>
Bluetooth: btrtl: Set msft ext address filter quirk for RTL8852B
Hilda Wu <[email protected]>
Bluetooth: btusb: Add Realtek RTL8852C support ID 0x0489:0xe122
Dmitry Antipov <[email protected]>
net: sched: consistently use rcu_replace_pointer() in taprio_change()
Felix Fietkau <[email protected]>
wifi: mt76: mt7915: disable tx worker during tx BA session enable/disable
Tamim Khan <[email protected]>
ACPI: resource: Skip IRQ override on Asus Vivobook Go E1404GAB
Li Zhijian <[email protected]>
fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
Mateusz Guzik <[email protected]>
exec: don't WARN for racy path_noexec check
Armin Wolf <[email protected]>
ACPICA: Fix memory leak if acpi_ps_get_next_field() fails
Armin Wolf <[email protected]>
ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails
Seiji Nishikawa <[email protected]>
ACPI: PAD: fix crash in exit_round_robin()
Krzysztof Kozlowski <[email protected]>
net: hisilicon: hns_mdio: fix OF node leak in probe()
Krzysztof Kozlowski <[email protected]>
net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info()
Krzysztof Kozlowski <[email protected]>
net: hisilicon: hip04: fix OF node leak in probe()
Jeongjun Park <[email protected]>
net/xen-netback: prevent UAF in xenvif_flush_hash()
Issam Hamdi <[email protected]>
wifi: cfg80211: Set correct chandef when starting CAC
Johannes Berg <[email protected]>
wifi: iwlwifi: mvm: drop wrong STA selection in TX
Ilan Peer <[email protected]>
wifi: iwlwifi: mvm: Fix a race in scan abort flow
Aleksandr Mishin <[email protected]>
ice: Adjust over allocation of memory in ice_sched_add_root_node() and ice_sched_add_node()
Herbert Xu <[email protected]>
crypto: octeontx2 - Fix authenc setkey
Herbert Xu <[email protected]>
crypto: octeontx - Fix authenc setkey
Fangrui Song <[email protected]>
crypto: x86/sha256 - Add parentheses around macros' single arguments
Kai-Heng Feng <[email protected]>
intel_idle: Disable promotion to C1E on Jasper Lake and Elkhart Lake
Toke Høiland-Jørgensen <[email protected]>
wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
Chih-Kang Chang <[email protected]>
wifi: rtw89: avoid to add interface to list twice when SER
Dmitry Kandybka <[email protected]>
wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats()
James Chapman <[email protected]>
l2tp: prevent possible tunnel refcount underflow
Vitaly Lifshits <[email protected]>
e1000e: avoid failing the system during pm_suspend
Tom Chung <[email protected]>
drm/amd/display: Re-enable panel replay feature
Tom Chung <[email protected]>
drm/amd/display: Fix VRR cannot enable
Tom Chung <[email protected]>
drm/amd/display: Disable replay if VRR capability is false
Takashi Iwai <[email protected]>
ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
Christophe JAILLET <[email protected]>
ALSA: gus: Fix some error handling paths related to get_bpos() usage
Ben Hutchings <[email protected]>
tools/rtla: Fix installation from out-of-tree build
Lad Prabhakar <[email protected]>
gpiolib: Fix potential NULL pointer dereference in gpiod_get_label()
Pali Rohár <[email protected]>
cifs: Do not convert delimiter when parsing NFS-style symlinks
Pali Rohár <[email protected]>
cifs: Fix buffer overflow when parsing NFS reparse points
Zhanjun Dong <[email protected]>
drm/xe: Prevent null pointer access in xe_migrate_copy
Matthew Brost <[email protected]>
drm/xe: Resume TDR after GT reset
Matthew Auld <[email protected]>
drm/xe/guc_submit: add missing locking in wedged_fini
Rodrigo Vivi <[email protected]>
drm/xe: Restore pci state upon resume
Hui Wang <[email protected]>
ASoC: imx-card: Set card.owner to avoid a warning calltrace if SND=m
Takashi Iwai <[email protected]>
ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs
Boris Brezillon <[email protected]>
drm/panthor: Lock the VM resv before calling drm_gpuvm_bo_obtain_prealloc()
Bard Liao <[email protected]>
ASoC: Intel: soc-acpi-intel-rpl-match: add missing empty item
Pali Rohár <[email protected]>
cifs: Remove intermediate object of failed create reparse call
Oder Chiou <[email protected]>
ALSA: hda/realtek: Fix the push button function for the ALC257
Christophe JAILLET <[email protected]>
ALSA: mixer_oss: Remove some incorrect kfree_const() usages
Dirk Behme <[email protected]>
rust: mutex: fix __mutex_init() usage in case of PREEMPT_RT
Gary Guo <[email protected]>
rust: kbuild: auto generate helper exports
Andreas Hindborg <[email protected]>
rust: kbuild: split up helpers.c
Guixin Liu <[email protected]>
io_uring: fix memory leak when cache init fail
Derek Foreman <[email protected]>
drm/connector: hdmi: Fix writing Dynamic Range Mastering infoframes
Andrei Simion <[email protected]>
ASoC: atmel: mchp-pdmc: Skip ALSA restoration if substream runtime is uninitialized
Steven Price <[email protected]>
drm/panthor: Fix race when converting group handle to group object
Tang Bin <[email protected]>
ASoC: topology: Fix incorrect addressing assignments
Xin Long <[email protected]>
sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
Ravikanth Tuniki <[email protected]>
dt-bindings: net: xlnx,axi-ethernet: Add missing reg minItems
Darrick J. Wong <[email protected]>
iomap: constrain the file range passed to iomap_file_unshare
Eddie James <[email protected]>
net/ncsi: Disable the ncsi work before freeing the associated structure
Ido Schimmel <[email protected]>
bridge: mcast: Fail MDB get request on empty entry
Hui Wang <[email protected]>
net: phy: realtek: Check the index value in led_hw_control_get
Eric Dumazet <[email protected]>
ppp: do not assume bh is held in ppp_channel_bridge_input()
Eric Dumazet <[email protected]>
net: test for not too small csum_start in virtio_net_hdr_to_skb()
David Howells <[email protected]>
netfs: Fix missing wakeup after issuing writes
Anton Danilov <[email protected]>
ipv4: ip_gre: Fix drops of small packets in ipgre_xmit
Shenwei Wang <[email protected]>
net: stmmac: dwmac4: extend timeout for VLAN Tag register busy bit check
Eric Dumazet <[email protected]>
net: add more sanity checks to qdisc_pkt_len_init()
Eric Dumazet <[email protected]>
net: avoid potential underflow in qdisc_pkt_len_init() with UFO
Csókás, Bence <[email protected]>
net: fec: Reload PTP registers after link-state change
Csókás, Bence <[email protected]>
net: fec: Restart PPS after link state change
Aleksander Jan Bajkowski <[email protected]>
net: ethernet: lantiq_etop: fix memory disclosure
Daniel Borkmann <[email protected]>
net: Fix gso_features_check to check for both dev->gso_{ipv4_,}max_sizeDaniel Borkmann <[email protected]>
net: Add netif_get_gro_max_size helper for GRO
Vladimir Oltean <[email protected]>
net: dsa: improve shutdown sequence
David Howells <[email protected]>
afs: Fix the setting of the server responding flag
David Howells <[email protected]>
afs: Fix missing wire-up of afs_retry_request()
Jinjie Ruan <[email protected]>
Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix uaf in l2cap_connect
Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: Fix possible crash on mgmt_index_removed
zhang jiao <[email protected]>
selftests: netfilter: Add missing return value
Eric Dumazet <[email protected]>
netfilter: nf_tables: prevent nf_skb_duplicated corruption
Phil Sutter <[email protected]>
selftests: netfilter: Fix nft_audit.sh for newer nft binaries
Jinjie Ruan <[email protected]>
net: wwan: qcom_bam_dmux: Fix missing pm_runtime_disable()
Jinjie Ruan <[email protected]>
net: ieee802154: mcr20a: Use IRQF_NO_AUTOEN flag in request_irq()
Phil Sutter <[email protected]>
netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED
Jianbo Liu <[email protected]>
net/mlx5e: Fix crash caused by calling __xfrm_state_delete() twice
Dragos Tatulea <[email protected]>
net/mlx5e: SHAMPO, Fix overflow of hd_per_wq
Elena Salomatkina <[email protected]>
net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc()
Mohamed Khalfella <[email protected]>
net/mlx5: Added cond_resched() to crdump collection
Gerd Bayer <[email protected]>
net/mlx5: Fix error path in multi-packet WQE transmit
Aakash Menon <[email protected]>
net: sparx5: Fix invalid timestamps
Jinjie Ruan <[email protected]>
ieee802154: Fix build error
Ville Syrjälä <[email protected]>
drm/i915/dp: Fix colorimetry detection
Xiubo Li <[email protected]>
ceph: remove the incorrect Fw reference check when dirtying pages
Luis Henriques (SUSE) <[email protected]>
ceph: fix a memory leak on cap_auths in MDS client
Stefan Wahren <[email protected]>
mailbox: bcm2835: Fix timeout during suspend mode
Liao Chen <[email protected]>
mailbox: rockchip: fix a typo in module autoloading
Geert Uytterhoeven <[email protected]>
mailbox: ARM_MHU_V3 should depend on ARM64
Namjae Jeon <[email protected]>
ksmbd: fix warning: comparison of distinct pointer types lacks a cast
Tobias Jakobi <[email protected]>
drm/amd/display: handle nulled pipe context in DCE110's set_drr()
Asad Kamal <[email protected]>
drm/amdgpu: Fix get each xcp macro
Imre Deak <[email protected]>
drm/i915/dp: Fix AUX IO power enabling for eDP PSR
Arun R Murthy <[email protected]>
drm/i915/display: BMG supports UHBR13.5
Jouni Högander <[email protected]>
drm/i915/psr: Do not wait for PSR being idle on on Panel Replay
Daniel Wagner <[email protected]>
scsi: pm8001: Do not overwrite PCI queue mapping
Rafael Rocha <[email protected]>
scsi: st: Fix input/output error on empty drive reset
Peter Zijlstra <[email protected]>
jump_label: Fix static_key_slow_dec() yet again
Thomas Gleixner <[email protected]>
static_call: Replace pointless WARN_ON() in static_call_module_notify()
Thomas Gleixner <[email protected]>
static_call: Handle module init failure correctly in static_call_del_module()
-------------
Diffstat:
Documentation/ABI/testing/sysfs-fs-f2fs | 22 + Documentation/admin-guide/kernel-parameters.txt | 10 + Documentation/arch/arm64/silicon-errata.rst | 6 + .../devicetree/bindings/net/xlnx,axi-ethernet.yaml | 3 +- .../networking/net_cachelines/net_device.rst | 2 +- Documentation/rust/general-information.rst | 4 +- Makefile | 4 +- arch/arm/crypto/aes-ce-glue.c | 2 +- arch/arm/crypto/aes-neonbs-glue.c | 2 +- arch/arm64/Kconfig | 7 +- arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/kvm_host.h | 25 +- arch/arm64/kernel/cpu_errata.c | 3 + arch/arm64/mm/trans_pgd.c | 6 +- arch/loongarch/configs/loongson3_defconfig | 1 - arch/parisc/include/asm/mman.h | 14 + arch/parisc/kernel/entry.S | 6 +- arch/parisc/kernel/syscall.S | 14 +- arch/powerpc/configs/ppc64_defconfig | 1 - arch/powerpc/include/asm/vdso_datapage.h | 15 + arch/powerpc/kernel/asm-offsets.c | 2 + arch/powerpc/kernel/vdso/cacheflush.S | 2 +- arch/powerpc/kernel/vdso/datapage.S | 4 +- arch/powerpc/platforms/pseries/dlpar.c | 17 - arch/powerpc/platforms/pseries/hotplug-cpu.c | 2 +- arch/powerpc/platforms/pseries/hotplug-memory.c | 16 +- arch/powerpc/platforms/pseries/pmem.c | 2 +- arch/riscv/Kconfig | 8 +- arch/riscv/include/asm/thread_info.h | 7 +- arch/x86/crypto/sha256-avx2-asm.S | 16 +- arch/x86/events/core.c | 63 + arch/x86/include/asm/apic.h | 8 - arch/x86/include/asm/fpu/signal.h | 2 +- arch/x86/include/asm/sev.h | 2 +- arch/x86/include/asm/syscall.h | 7 +- arch/x86/kernel/apic/apic_flat_64.c | 119 +- arch/x86/kernel/apic/io_apic.c | 46 +- arch/x86/kernel/cpu/bugs.c | 14 +- arch/x86/kernel/cpu/common.c | 4 +- arch/x86/kernel/fpu/signal.c | 6 +- arch/x86/kernel/machine_kexec_64.c | 27 + arch/x86/kernel/signal.c | 3 +- arch/x86/kernel/signal_64.c | 6 +- arch/x86/mm/ident_map.c | 23 +- block/blk-iocost.c | 8 +- block/ioctl.c | 9 +- crypto/simd.c | 76 +- drivers/accel/ivpu/ivpu_fw.c | 4 + drivers/acpi/acpi_pad.c | 6 +- drivers/acpi/acpica/dbconvert.c | 2 + drivers/acpi/acpica/exprep.c | 3 + drivers/acpi/acpica/psargs.c | 47 + drivers/acpi/apei/einj-cxl.c | 2 +- drivers/acpi/battery.c | 28 +- drivers/acpi/cppc_acpi.c | 10 +- drivers/acpi/ec.c | 55 +- drivers/acpi/resource.c | 22 +- drivers/acpi/video_detect.c | 17 + drivers/ata/pata_serverworks.c | 16 +- drivers/ata/sata_sil.c | 12 +- drivers/block/aoe/aoecmd.c | 13 +- drivers/bluetooth/btmrvl_sdio.c | 3 +- drivers/bluetooth/btrtl.c | 1 + drivers/bluetooth/btusb.c | 2 + drivers/clk/qcom/clk-alpha-pll.c | 2 +- drivers/clk/qcom/clk-rpmh.c | 2 + drivers/clk/qcom/dispcc-sm8250.c | 3 + drivers/clk/qcom/gcc-sc8180x.c | 438 ++-- drivers/clk/qcom/gcc-sm8250.c | 6 +- drivers/clk/qcom/gcc-sm8450.c | 4 +- drivers/clk/rockchip/clk.c | 3 +- drivers/clk/samsung/clk-exynos7885.c | 2 +- drivers/cpufreq/amd-pstate.c | 14 +- drivers/cpufreq/intel_pstate.c | 16 +- drivers/cpufreq/loongson3_cpufreq.c | 2 +- drivers/crypto/hisilicon/sgl.c | 14 +- drivers/crypto/marvell/Kconfig | 2 + drivers/crypto/marvell/octeontx/otx_cptvf_algs.c | 265 +-- drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c | 256 +- drivers/firmware/sysfb.c | 4 +- drivers/firmware/tegra/bpmp.c | 6 - drivers/gpio/gpio-davinci.c | 8 +- drivers/gpio/gpiolib.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 10 + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 14 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 35 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 18 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 45 +- drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.h | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 8 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 12 +- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 132 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 54 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 50 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_device.c | 4 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c | 18 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 2 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 5 +- drivers/gpu/drm/amd/amdkfd/soc15_int.h | 1 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 86 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 4 + .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 20 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 3 +- .../amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c | 2 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 8 +- .../gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 96 +- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 34 +- drivers/gpu/drm/amd/display/dc/core/dc_state.c | 10 +- drivers/gpu/drm/amd/display/dc/dc_types.h | 1 + .../gpu/drm/amd/display/dc/dccg/dcn35/dcn35_dccg.c | 3 +- .../gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 2 + .../gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c | 4 + .../display/dc/dml/dcn20/display_rq_dlg_calc_20.c | 2 +- .../dc/dml/dcn20/display_rq_dlg_calc_20v2.c | 2 +- .../display/dc/dml/dcn21/display_rq_dlg_calc_21.c | 2 +- .../gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 7 +- .../amd/display/dc/dml/dml1_display_rq_dlg_calc.c | 2 +- .../dc/dml2/dml21/dml21_translation_helper.c | 6 +- .../dml21/src/dml2_core/dml2_core_dcn4_calcs.c | 89 +- .../dc/dml2/dml21/src/dml2_core/dml2_core_shared.c | 4 +- .../dml21/src/dml2_core/dml2_core_shared_types.h | 2 +- drivers/gpu/drm/amd/display/dc/dml2/dml2_policy.c | 1 - .../amd/display/dc/dml2/dml2_translation_helper.c | 20 +- drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.h | 1 + .../amd/display/dc/hubbub/dcn401/dcn401_hubbub.c | 23 + .../gpu/drm/amd/display/dc/hubp/dcn10/dcn10_hubp.c | 3 +- .../gpu/drm/amd/display/dc/hubp/dcn20/dcn20_hubp.c | 3 +- .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 24 +- .../drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c | 4 +- .../drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 48 +- .../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 7 +- .../drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c | 4 +- .../drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 11 +- .../drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 8 +- .../drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 111 +- .../drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.h | 2 + .../drm/amd/display/dc/hwss/dcn401/dcn401_init.c | 2 +- drivers/gpu/drm/amd/display/dc/inc/hw/dchubbub.h | 1 + drivers/gpu/drm/amd/display/dc/inc/resource.h | 5 + .../amd/display/dc/link/accessories/link_dp_cts.c | 5 +- .../drm/amd/display/dc/link/hwss/link_hwss_dio.c | 5 +- drivers/gpu/drm/amd/display/dc/link/link_factory.c | 2 +- .../display/dc/link/protocols/link_dp_capability.c | 2 +- .../display/dc/resource/dce112/dce112_resource.c | 5 +- .../amd/display/dc/resource/dcn20/dcn20_resource.c | 3 +- .../display/dc/resource/dcn201/dcn201_resource.c | 4 +- .../amd/display/dc/resource/dcn21/dcn21_resource.c | 3 +- .../amd/display/dc/resource/dcn32/dcn32_resource.c | 10 +- .../dc/resource/dcn32/dcn32_resource_helpers.c | 14 +- .../display/dc/resource/dcn351/dcn351_resource.c | 1 + .../display/dc/resource/dcn401/dcn401_resource.c | 3 +- .../drm/amd/pm/powerplay/hwmgr/processpptables.c | 2 + drivers/gpu/drm/display/drm_hdmi_state_helper.c | 4 +- drivers/gpu/drm/drm_atomic_uapi.c | 2 +- drivers/gpu/drm/drm_debugfs.c | 4 +- drivers/gpu/drm/drm_print.c | 13 +- drivers/gpu/drm/i915/display/intel_ddi.c | 2 +- drivers/gpu/drm/i915/display/intel_dp.c | 22 +- drivers/gpu/drm/i915/display/intel_psr.c | 32 +- drivers/gpu/drm/i915/display/intel_psr.h | 2 + drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 2 +- drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c | 4 +- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 1 + drivers/gpu/drm/msm/msm_gpu.c | 1 - drivers/gpu/drm/omapdrm/omap_drv.c | 5 + drivers/gpu/drm/panthor/panthor_mmu.c | 8 + drivers/gpu/drm/panthor/panthor_sched.c | 36 +- drivers/gpu/drm/radeon/r100.c | 70 +- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 4 + drivers/gpu/drm/rockchip/rockchip_drm_vop.h | 1 + drivers/gpu/drm/rockchip/rockchip_vop_reg.c | 2 + drivers/gpu/drm/scheduler/sched_entity.c | 14 +- drivers/gpu/drm/scheduler/sched_main.c | 7 +- drivers/gpu/drm/stm/drv.c | 3 +- drivers/gpu/drm/stm/ltdc.c | 76 +- drivers/gpu/drm/v3d/v3d_submit.c | 6 + drivers/gpu/drm/xe/Makefile | 24 +- drivers/gpu/drm/xe/display/intel_fbdev_fb.c | 6 +- drivers/gpu/drm/xe/display/xe_hdcp_gsc.c | 8 +- drivers/gpu/drm/xe/display/xe_plane_initial.c | 6 + drivers/gpu/drm/xe/xe_bo.c | 4 +- drivers/gpu/drm/xe/xe_device.c | 8 +- drivers/gpu/drm/xe/xe_device_types.h | 17 +- drivers/gpu/drm/xe/xe_drm_client.c | 9 +- drivers/gpu/drm/xe/xe_exec_queue.c | 2 - drivers/gpu/drm/xe/xe_exec_queue_types.h | 6 +- drivers/gpu/drm/xe/xe_execlist.c | 3 +- drivers/gpu/drm/xe/xe_gpu_scheduler.c | 5 + drivers/gpu/drm/xe/xe_gpu_scheduler.h | 2 + drivers/gpu/drm/xe/xe_gt_pagefault.c | 55 +- drivers/gpu/drm/xe/xe_gt_types.h | 9 +- drivers/gpu/drm/xe/xe_guc_pc.c | 2 +- drivers/gpu/drm/xe/xe_guc_submit.c | 76 +- drivers/gpu/drm/xe/xe_guc_types.h | 2 + drivers/gpu/drm/xe/xe_lrc.c | 35 +- drivers/gpu/drm/xe/xe_oa.c | 9 +- drivers/gpu/drm/xe/xe_pci.c | 2 + drivers/gpu/drm/xe/xe_preempt_fence.c | 12 +- drivers/gpu/drm/xe/xe_vm.c | 32 +- drivers/gpu/drm/xe/xe_vram.c | 1 + drivers/gpu/drm/xe/xe_wa_oob.rules | 3 + drivers/hid/bpf/hid_bpf_struct_ops.c | 14 + drivers/hid/hid-ids.h | 17 +- drivers/hid/hid-input.c | 37 +- drivers/hid/hid-multitouch.c | 6 + drivers/hid/i2c-hid/i2c-hid-core.c | 42 +- drivers/hwmon/nct6775-platform.c | 1 + drivers/i2c/busses/i2c-designware-common.c | 14 + drivers/i2c/busses/i2c-designware-core.h | 1 + drivers/i2c/busses/i2c-designware-master.c | 38 + drivers/i2c/busses/i2c-qcom-geni.c | 4 +- drivers/i2c/busses/i2c-stm32f7.c | 6 +- drivers/i2c/busses/i2c-synquacer.c | 5 +- drivers/i2c/busses/i2c-xiic.c | 21 +- drivers/i2c/i2c-core-base.c | 28 + drivers/i3c/master/svc-i3c-master.c | 1 + drivers/idle/intel_idle.c | 14 +- drivers/iio/magnetometer/ak8975.c | 32 +- drivers/iio/pressure/bmp280-core.c | 9 +- drivers/iio/pressure/bmp280-regmap.c | 45 +- drivers/iio/pressure/bmp280.h | 1 + drivers/infiniband/hw/mana/main.c | 8 +- drivers/input/keyboard/adp5589-keys.c | 22 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 37 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 1 + drivers/iommu/intel/dmar.c | 16 +- drivers/iommu/intel/iommu.c | 6 +- drivers/iommu/intel/pasid.c | 12 +- drivers/leds/leds-pca9532.c | 5 +- drivers/mailbox/Kconfig | 1 + drivers/mailbox/bcm2835-mailbox.c | 3 +- drivers/mailbox/rockchip-mailbox.c | 2 +- drivers/media/common/videobuf2/videobuf2-core.c | 7 - drivers/media/i2c/ar0521.c | 5 +- drivers/media/i2c/imx335.c | 9 +- drivers/media/i2c/ov5675.c | 12 +- drivers/media/platform/qcom/camss/camss-video.c | 6 - drivers/media/platform/qcom/camss/camss.c | 5 +- drivers/media/platform/qcom/venus/core.c | 1 + drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c | 5 + drivers/memory/tegra/tegra186-emc.c | 5 - drivers/net/can/dev/netlink.c | 102 +- .../net/ethernet/aquantia/atlantic/aq_ethtool.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- drivers/net/ethernet/freescale/fec.h | 9 + drivers/net/ethernet/freescale/fec_main.c | 11 +- drivers/net/ethernet/freescale/fec_ptp.c | 50 + drivers/net/ethernet/hisilicon/hip04_eth.c | 1 + drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 1 + drivers/net/ethernet/hisilicon/hns_mdio.c | 1 + drivers/net/ethernet/intel/e1000e/netdev.c | 19 +- drivers/net/ethernet/intel/ice/ice_sched.c | 6 +- drivers/net/ethernet/lantiq_etop.c | 4 +- drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en/tir.c | 3 + .../ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 8 +- drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 1 - .../net/ethernet/mellanox/mlx5/core/lib/pci_vsc.c | 10 + .../net/ethernet/microchip/sparx5/sparx5_packet.c | 6 +- .../net/ethernet/netronome/nfp/nfp_net_common.c | 5 +- drivers/net/ethernet/realtek/r8169_main.c | 31 +- drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 18 +- drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 1 + drivers/net/ieee802154/Kconfig | 1 + drivers/net/ieee802154/mcr20a.c | 5 +- drivers/net/pcs/pcs-xpcs-wx.c | 2 +- drivers/net/phy/phy.c | 17 +- drivers/net/phy/realtek.c | 3 + drivers/net/ppp/ppp_generic.c | 4 +- drivers/net/vrf.c | 2 + drivers/net/wireless/ath/ath11k/dp_rx.c | 2 +- drivers/net/wireless/ath/ath12k/dp_rx.c | 2 +- drivers/net/wireless/ath/ath9k/debug.c | 4 +- drivers/net/wireless/ath/ath9k/hif_usb.c | 6 +- drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 5 + drivers/net/wireless/intel/iwlwifi/fw/api/scan.h | 13 + drivers/net/wireless/intel/iwlwifi/fw/regulatory.h | 2 + drivers/net/wireless/intel/iwlwifi/fw/uefi.c | 2 +- drivers/net/wireless/intel/iwlwifi/fw/uefi.h | 2 - drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 16 +- drivers/net/wireless/intel/iwlwifi/mvm/mld-key.c | 12 +- drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 42 +- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 12 +- drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- drivers/net/wireless/marvell/mwifiex/scan.c | 3 +- drivers/net/wireless/mediatek/mt76/mt7915/init.c | 1 + drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7915/main.c | 7 + drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 10 +- drivers/net/wireless/microchip/wilc1000/sdio.c | 7 + drivers/net/wireless/realtek/rtw88/Kconfig | 1 + drivers/net/wireless/realtek/rtw89/core.h | 18 +- drivers/net/wireless/realtek/rtw89/mac.c | 2 +- drivers/net/wireless/realtek/rtw89/mac80211.c | 4 +- drivers/net/wireless/realtek/rtw89/phy.c | 4 +- drivers/net/wireless/realtek/rtw89/util.h | 18 + drivers/net/wwan/qcom_bam_dmux.c | 11 +- drivers/net/xen-netback/hash.c | 5 +- drivers/nvme/common/keyring.c | 58 +- drivers/nvme/host/Kconfig | 3 +- drivers/nvme/host/core.c | 1 - drivers/nvme/host/fabrics.c | 2 +- drivers/nvme/host/ioctl.c | 22 +- drivers/nvme/host/nvme.h | 2 +- drivers/nvme/host/sysfs.c | 4 +- drivers/nvme/host/tcp.c | 55 +- drivers/of/address.c | 5 + drivers/of/irq.c | 38 +- drivers/perf/arm_spe_pmu.c | 9 +- drivers/perf/riscv_pmu_legacy.c | 4 +- drivers/perf/riscv_pmu_sbi.c | 4 +- drivers/platform/mellanox/mlxbf-pmc.c | 5 + drivers/platform/x86/amd/pmf/pmf-quirks.c | 8 + .../x86/intel/speed_select_if/isst_if_common.c | 4 +- drivers/platform/x86/lenovo-ymc.c | 2 + drivers/platform/x86/touchscreen_dmi.c | 26 + drivers/platform/x86/x86-android-tablets/core.c | 6 +- drivers/platform/x86/x86-android-tablets/other.c | 10 +- drivers/pmdomain/core.c | 40 +- drivers/power/reset/brcmstb-reboot.c | 3 - drivers/power/supply/power_supply_core.c | 6 +- drivers/power/supply/power_supply_hwmon.c | 3 +- drivers/remoteproc/ti_k3_r5_remoteproc.c | 86 +- drivers/rtc/rtc-at91sam9.c | 1 + drivers/scsi/NCR5380.c | 4 + drivers/scsi/aacraid/aacraid.h | 2 +- drivers/scsi/lpfc/lpfc.h | 12 +- drivers/scsi/lpfc/lpfc_els.c | 73 +- drivers/scsi/lpfc/lpfc_hbadisc.c | 14 +- drivers/scsi/lpfc/lpfc_nportdisc.c | 22 +- drivers/scsi/lpfc/lpfc_scsi.c | 13 +- drivers/scsi/lpfc/lpfc_sli.c | 11 + drivers/scsi/pm8001/pm8001_init.c | 6 +- drivers/scsi/smartpqi/smartpqi_init.c | 130 +- drivers/scsi/st.c | 5 +- drivers/spi/spi-bcm63xx.c | 9 +- drivers/spi/spi-cadence.c | 8 +- drivers/spi/spi-imx.c | 2 +- drivers/spi/spi-rpc-if.c | 7 + drivers/spi/spi-s3c64xx.c | 4 +- drivers/vhost/scsi.c | 25 +- drivers/video/fbdev/efifb.c | 11 +- drivers/video/fbdev/pxafb.c | 1 + drivers/virt/coco/sev-guest/sev-guest.c | 2 + fs/afs/file.c | 1 + fs/afs/fs_operation.c | 2 +- fs/btrfs/backref.c | 12 +- fs/btrfs/disk-io.c | 11 + fs/btrfs/relocation.c | 99 +- fs/btrfs/send.c | 31 +- fs/cachefiles/namei.c | 7 +- fs/ceph/addr.c | 6 +- fs/ceph/mds_client.c | 12 + fs/dax.c | 6 +- fs/exec.c | 34 +- fs/exfat/balloc.c | 10 +- fs/ext4/dir.c | 14 +- fs/ext4/ext4.h | 1 + fs/ext4/extents.c | 55 +- fs/ext4/fast_commit.c | 49 +- fs/ext4/file.c | 8 +- fs/ext4/inode.c | 11 +- fs/ext4/migrate.c | 2 +- fs/ext4/move_extent.c | 1 - fs/ext4/namei.c | 14 +- fs/ext4/resize.c | 18 +- fs/ext4/super.c | 34 +- fs/ext4/xattr.c | 3 +- fs/f2fs/f2fs.h | 31 +- fs/f2fs/gc.c | 85 +- fs/f2fs/gc.h | 23 + fs/f2fs/segment.c | 31 +- fs/f2fs/super.c | 8 + fs/f2fs/sysfs.c | 18 + fs/file.c | 93 +- fs/gfs2/glock.c | 1 + fs/gfs2/ops_fstype.c | 3 +- fs/inode.c | 14 +- fs/iomap/buffered-io.c | 16 +- fs/jbd2/checkpoint.c | 21 +- fs/jbd2/journal.c | 4 +- fs/jfs/jfs_discard.c | 11 +- fs/jfs/jfs_dmap.c | 7 +- fs/jfs/xattr.c | 2 + fs/netfs/write_issue.c | 48 +- fs/nfsd/netns.h | 1 + fs/nfsd/nfs4proc.c | 36 +- fs/nfsd/nfs4state.c | 6 +- fs/nfsd/nfs4xdr.c | 10 +- fs/nfsd/nfsctl.c | 2 +- fs/nfsd/nfssvc.c | 2 +- fs/nfsd/vfs.c | 1 + fs/nfsd/xdr4.h | 1 + fs/ocfs2/aops.c | 5 +- fs/ocfs2/buffer_head_io.c | 4 +- fs/ocfs2/journal.c | 7 +- fs/ocfs2/localalloc.c | 19 + fs/ocfs2/quota_local.c | 8 +- fs/ocfs2/refcounttree.c | 26 +- fs/ocfs2/xattr.c | 11 +- fs/overlayfs/copy_up.c | 43 +- fs/overlayfs/params.c | 38 +- fs/pidfs.c | 5 +- fs/proc/base.c | 61 +- fs/proc/proc_sysctl.c | 11 +- fs/smb/client/cifsfs.c | 13 +- fs/smb/client/cifsglob.h | 2 +- fs/smb/client/inode.c | 19 +- fs/smb/client/reparse.c | 16 +- fs/smb/client/smb1ops.c | 2 +- fs/smb/client/smb2inode.c | 24 +- fs/smb/client/smb2ops.c | 19 +- fs/smb/server/connection.c | 4 +- fs/smb/server/connection.h | 1 + fs/smb/server/oplock.c | 55 +- fs/smb/server/smb2pdu.c | 5 +- fs/smb/server/vfs_cache.c | 3 + fs/smb/server/vfs_cache.h | 4 +- include/crypto/internal/simd.h | 12 +- include/drm/drm_print.h | 54 +- include/drm/gpu_scheduler.h | 2 +- include/dt-bindings/clock/exynos7885.h | 2 +- include/dt-bindings/clock/qcom,gcc-sc8180x.h | 1 + include/linux/cpufreq.h | 6 +- include/linux/fdtable.h | 8 +- include/linux/hdmi.h | 9 + include/linux/hugetlb.h | 10 + include/linux/i2c.h | 3 + include/linux/netdevice.h | 22 +- include/linux/nvme-keyring.h | 6 +- include/linux/perf_event.h | 8 +- include/linux/sched.h | 2 + include/linux/sunrpc/svc.h | 4 +- include/linux/uprobes.h | 2 + include/linux/virtio_net.h | 4 +- include/trace/events/netfs.h | 1 + include/uapi/linux/cec.h | 6 +- include/uapi/linux/netfilter/nf_tables.h | 2 +- io_uring/io_uring.c | 5 +- io_uring/net.c | 4 +- kernel/bpf/verifier.c | 119 +- kernel/cgroup/cgroup-v1.c | 12 +- kernel/events/core.c | 33 +- kernel/events/uprobes.c | 4 +- kernel/fork.c | 32 +- kernel/jump_label.c | 34 +- kernel/rcu/rcuscale.c | 4 +- kernel/rcu/tasks.h | 82 +- kernel/resource.c | 58 +- kernel/sched/core.c | 23 +- kernel/sched/psi.c | 26 +- kernel/static_call_inline.c | 13 +- kernel/trace/trace_hwlat.c | 2 + kernel/trace/trace_osnoise.c | 22 +- lib/buildid.c | 74 +- mm/Kconfig | 25 +- mm/filemap.c | 4 + mm/gup.c | 1 + mm/hugetlb.c | 17 + mm/memfd.c | 20 +- mm/slab_common.c | 7 + mm/slub.c | 100 +- net/bluetooth/hci_core.c | 2 + net/bluetooth/hci_event.c | 15 +- net/bluetooth/l2cap_core.c | 8 - net/bluetooth/mgmt.c | 23 +- net/bridge/br_mdb.c | 2 +- net/core/dev.c | 14 +- net/core/gro.c | 9 +- net/core/net-sysfs.c | 6 +- net/core/netdev-genl.c | 8 +- net/core/netpoll.c | 15 +- net/core/skbuff.c | 15 +- net/dsa/dsa.c | 7 + net/ipv4/devinet.c | 6 +- net/ipv4/fib_frontend.c | 2 +- net/ipv4/ip_gre.c | 6 +- net/ipv4/netfilter/nf_dup_ipv4.c | 7 +- net/ipv4/tcp_ipv4.c | 3 + net/ipv4/tcp_offload.c | 10 +- net/ipv4/udp_offload.c | 22 +- net/ipv6/netfilter/nf_dup_ipv6.c | 7 +- net/ipv6/tcpv6_offload.c | 10 +- net/l2tp/l2tp_core.c | 40 +- net/l2tp/l2tp_core.h | 4 +- net/l2tp/l2tp_netlink.c | 4 +- net/l2tp/l2tp_ppp.c | 3 +- net/mac80211/chan.c | 4 +- net/mac80211/mlme.c | 2 +- net/mac80211/scan.c | 2 +- net/mac80211/util.c | 4 +- net/mac802154/scan.c | 4 +- net/ncsi/ncsi-manage.c | 2 + net/netfilter/nf_tables_api.c | 5 +- net/rxrpc/ar-internal.h | 2 +- net/rxrpc/io_thread.c | 10 +- net/rxrpc/local_object.c | 2 +- net/sched/sch_taprio.c | 4 +- net/sctp/socket.c | 4 +- net/sunrpc/svc.c | 31 +- net/tipc/bearer.c | 8 +- net/wireless/nl80211.c | 15 +- rust/Makefile | 22 +- rust/exports.c | 1 + rust/helpers.c | 239 -- rust/helpers/blk.c | 14 + rust/helpers/bug.c | 8 + rust/helpers/build_assert.c | 25 + rust/helpers/build_bug.c | 9 + rust/helpers/err.c | 19 + rust/helpers/helpers.c | 25 + rust/helpers/kunit.c | 9 + rust/helpers/mutex.c | 15 + rust/helpers/page.c | 19 + rust/helpers/refcount.c | 19 + rust/helpers/signal.c | 9 + rust/helpers/slab.c | 9 + rust/helpers/spinlock.c | 24 + rust/helpers/task.c | 19 + rust/helpers/uaccess.c | 15 + rust/helpers/wait.c | 9 + rust/helpers/workqueue.c | 15 + rust/kernel/sync/locked_by.rs | 18 +- scripts/gdb/linux/proc.py | 4 +- scripts/gdb/linux/rbtree.py | 12 + scripts/gdb/linux/timerlist.py | 31 +- scripts/kconfig/parser.y | 10 +- scripts/kconfig/qconf.cc | 6 +- security/Kconfig | 32 + security/tomoyo/domain.c | 9 +- sound/core/control.c | 55 +- sound/core/control_compat.c | 45 +- sound/core/init.c | 14 +- sound/core/oss/mixer_oss.c | 4 +- sound/isa/gus/gus_pcm.c | 4 +- sound/pci/asihpi/hpimsgx.c | 2 +- sound/pci/hda/hda_controller.h | 2 +- sound/pci/hda/hda_generic.c | 4 +- sound/pci/hda/hda_intel.c | 10 +- sound/pci/hda/patch_conexant.c | 24 +- sound/pci/hda/patch_realtek.c | 156 +- sound/pci/hda/samsung_helper.c | 310 --- sound/pci/rme9652/hdsp.c | 6 +- sound/pci/rme9652/hdspm.c | 6 +- sound/soc/atmel/mchp-pdmc.c | 3 + sound/soc/codecs/wsa883x.c | 16 +- sound/soc/fsl/imx-card.c | 1 + sound/soc/intel/boards/bytcht_cx2072x.c | 4 + sound/soc/intel/boards/bytcht_da7213.c | 4 + sound/soc/intel/boards/bytcht_es8316.c | 2 +- sound/soc/intel/boards/bytcr_rt5640.c | 2 +- sound/soc/intel/boards/bytcr_rt5651.c | 2 +- sound/soc/intel/boards/cht_bsw_rt5645.c | 4 + sound/soc/intel/boards/cht_bsw_rt5672.c | 4 + sound/soc/intel/boards/sof_es8336.c | 2 +- sound/soc/intel/boards/sof_wm8804.c | 4 + sound/soc/intel/common/soc-acpi-intel-rpl-match.c | 1 + sound/soc/soc-topology.c | 4 +- sound/usb/card.c | 8 + sound/usb/clock.c | 62 +- sound/usb/format.c | 6 +- sound/usb/helper.c | 34 + sound/usb/helper.h | 10 +- sound/usb/line6/podhd.c | 2 +- sound/usb/mixer.c | 37 +- sound/usb/mixer.h | 1 + sound/usb/mixer_quirks.c | 430 +++- sound/usb/mixer_scarlett.c | 4 +- sound/usb/power.c | 3 +- sound/usb/power.h | 1 + sound/usb/quirks-table.h | 2455 +++++++------------- sound/usb/quirks.c | 62 + sound/usb/stream.c | 21 +- sound/usb/usbaudio.h | 12 + tools/arch/x86/kcpuid/kcpuid.c | 12 +- tools/bpf/bpftool/net.c | 11 +- tools/hv/hv_fcopy_uio_daemon.c | 7 + tools/include/nolibc/arch-powerpc.h | 2 +- tools/perf/util/hist.c | 7 +- tools/perf/util/machine.c | 17 +- tools/perf/util/setup.py | 2 + tools/perf/util/thread.c | 4 + tools/perf/util/thread.h | 1 + .../selftests/bpf/bpf_testmod/bpf_testmod.c | 1 + .../breakpoints/step_after_suspend_test.c | 5 +- .../devices/probe/test_discoverable_devices.py | 4 +- tools/testing/selftests/hid/Makefile | 2 + .../selftests/mm/charge_reserved_hugetlb.sh | 2 +- tools/testing/selftests/mm/pagemap_ioctl.c | 2 +- tools/testing/selftests/mm/write_to_hugetlbfs.c | 23 +- .../selftests/net/netfilter/conntrack_dump_flush.c | 1 + tools/testing/selftests/net/netfilter/nft_audit.sh | 57 +- tools/testing/selftests/nolibc/nolibc-test.c | 4 +- tools/testing/selftests/vDSO/parse_vdso.c | 17 +- tools/testing/selftests/vDSO/vdso_config.h | 10 +- .../testing/selftests/vDSO/vdso_test_correctness.c | 6 + tools/tracing/rtla/Makefile.rtla | 2 +- tools/tracing/rtla/src/osnoise_top.c | 2 +- tools/tracing/rtla/src/timerlat_top.c | 4 +- 605 files changed, 7495 insertions(+), 5321 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/558 static_call: Handle module init failure correctly in static_call_del_module()
6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit 4b30051c4864234ec57290c3d142db7c88f10d8a ]
Module insertion invokes static_call_add_module() to initialize the static calls in a module. static_call_add_module() invokes __static_call_init(), which allocates a struct static_call_mod to either encapsulate the built-in static call sites of the associated key into it so further modules can be added or to append the module to the module chain.
If that allocation fails the function returns with an error code and the module core invokes static_call_del_module() to clean up eventually added static_call_mod entries.
This works correctly, when all keys used by the module were converted over to a module chain before the failure. If not then static_call_del_module() causes a #GP as it blindly assumes that key::mods points to a valid struct static_call_mod.
The problem is that key::mods is not a individual struct member of struct static_call_key, it's part of a union to save space:
union {
/* bit 0: 0 = mods, 1 = sites */
unsigned long type;
struct static_call_mod *mods;
struct static_call_site *sites;
};key::sites is a pointer to the list of built-in usage sites of the static call. The type of the pointer is differentiated by bit 0. A mods pointer has the bit clear, the sites pointer has the bit set.
As static_call_del_module() blidly assumes that the pointer is a valid static_call_mod type, it fails to check for this failure case and dereferences the pointer to the list of built-in call sites, which is obviously bogus.
Cure it by checking whether the key has a sites or a mods pointer.
If it's a sites pointer then the key is not to be touched. As the sites are walked in the same order as in __static_call_init() the site walk can be terminated because all subsequent sites have not been touched by the init code due to the error exit.
If it was converted before the allocation fail, then the inner loop which searches for a module match will find nothing.
A fail in the second allocation in __static_call_init() is harmless and does not require special treatment. The first allocation succeeded and converted the key to a module chain. That first entry has mod::mod == NULL and mod::next == NULL, so the inner loop of static_call_del_module() will neither find a module match nor a module chain. The next site in the walk was either already converted, but can't match the module, or it will exit the outer loop because it has a static_call_site pointer and not a static_call_mod pointer.
--- kernel/static_call_inline.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
kernel/static_call_inline.c +11 -0
@@ -411,6 +411,17 @@ static void static_call_del_module(struct module *mod)for (site = start; site < stop; site++) { key =static_call_key (site); + +/* +* If the key was not updated due to a memory allocation +* failure in __static_call_init() then treating key::sites +* as key::mods in the code below would cause random memory +* access and #GP. In that case all subsequent sites have +* not been touched either, so stop iterating. +*/ +if (!static_call_key_has_mods (key)) +break ; +if (key == prev_key)continue ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/558 static_call: Replace pointless WARN_ON() in static_call_module_notify()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit fe513c2ef0a172a58f158e2e70465c4317f0a9a2 ]
static_call_module_notify() triggers a WARN_ON(), when memory allocation fails in __static_call_add_module().
That's not really justified, because the failure case must be correctly handled by the well known call chain and the error code is passed through to the initiating userspace application.
A memory allocation fail is not a fatal problem, but the WARN_ON() takes the machine out when panic_on_warn is set.
Replace it with a pr_warn().
--- kernel/static_call_inline.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/static_call_inline.c +1 -1
@@ -453,7 +453,7 @@ static int static_call_module_notify(struct notifier_block *nb,case MODULE_STATE_COMING : ret =static_call_add_module (mod);if (ret) { -WARN (1 ,"Failed to allocate memory for static calls" ); +pr_warn ("Failed to allocate memory for static calls\n" );static_call_del_module (mod); }break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/558 jump_label: Fix static_key_slow_dec() yet again
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 1d7f856c2ca449f04a22d876e36b464b7a9d28b6 ]
While commit 83ab38ef0a0b ("jump_label: Fix concurrency issues in static_key_slow_dec()") fixed one problem, it created yet another, notably the following is now possible:
slow_dec
if (try_dec) // dec_not_one-ish, false
// enabled == 1
slow_inc
if (inc_not_disabled) // inc_not_zero-ish
// enabled == 2
return
guard((mutex)(&jump_label_mutex);
if (atomic_cmpxchg(1,0)==1) // false, we're 2
slow_dec
if (try-dec) // dec_not_one, true
// enabled == 1
return
else
try_dec() // dec_not_one, false
WARNUse dec_and_test instead of cmpxchg(), like it was prior to 83ab38ef0a0b. Add a few WARNs for the paranoid.
--- kernel/jump_label.c | 34 +++++++++++++++++++++++++++------- 1 file changed, 27 insertions(+), 7 deletions(-)
kernel/jump_label.c +27 -7
@@ -168,7 +168,7 @@ bool static_key_slow_inc_cpuslocked(struct static_key *key)jump_label_update (key);/* * Ensure that when static_key_fast_inc_not_disabled() or -* static_key_slow_try_dec() observe the positive value, +* static_key_dec_not_one() observe the positive value, * they must also observe all the text changes. */ atomic_set_release (&key->enabled,1 );
@@ -250,7 +250,7 @@ void static_key_disable(struct static_key *key) }EXPORT_SYMBOL_GPL (static_key_disable); -static bool static_key_slow_try_dec (struct static_key *key) +static bool static_key_dec_not_one (struct static_key *key) {int v;
@@ -274,6 +274,14 @@ static bool static_key_slow_try_dec(struct static_key *key)* enabled. This suggests an ordering problem on the user side. */ WARN_ON_ONCE (v <0 ); + +/* +* Warn about underflow, and lie about success in an attempt to +* not make things worse. +*/ +if (WARN_ON_ONCE (v ==0 )) +return true; +if (v <=1 )return false; }while (!likely (atomic_try_cmpxchg (&key->enabled, &v, v -1 )));
@@ -284,15 +292,27 @@ static bool static_key_slow_try_dec(struct static_key *key)static void __static_key_slow_dec_cpuslocked (struct static_key *key) {lockdep_assert_cpus_held (); +int val; -if (static_key_slow_try_dec (key)) +if (static_key_dec_not_one (key))return ;guard (mutex)(&jump_label_mutex); -if (atomic_cmpxchg (&key->enabled,1 ,0 ) ==1 ) + val =atomic_read (&key->enabled); +/* +* It should be impossible to observe -1 with jump_label_mutex held, +* see static_key_slow_inc_cpuslocked(). +*/ +if (WARN_ON_ONCE (val ==-1 )) +return ; +/* +* Cannot already be 0, something went sideways. +*/ +if (WARN_ON_ONCE (val ==0 )) +return ; + +if (atomic_dec_and_test (&key->enabled))jump_label_update (key); -else -WARN_ON_ONCE (!static_key_slow_try_dec (key)); }static void __static_key_slow_dec (struct static_key *key)
@@ -329,7 +349,7 @@ void __static_key_slow_dec_deferred(struct static_key *key, {STATIC_KEY_CHECK_USE (key); -if (static_key_slow_try_dec (key)) +if (static_key_dec_not_one (key))return ;schedule_delayed_work (work, timeout);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/558 scsi: st: Fix input/output error on empty drive reset
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael Rocha <[email protected]>
[ Upstream commit 3d882cca73be830549833517ddccb3ac4668c04e ]
A previous change was introduced to prevent data loss during a power-on reset when a tape is present inside the drive. This commit set the "pos_unknown" flag to true to avoid operations that could compromise data by performing actions from an untracked position. The relevant change is commit 9604eea5bd3a ("scsi: st: Add third party poweron reset handling")
As a consequence of this change, a new issue has surfaced: the driver now returns an "Input/output error" even for empty drives when the drive, host, or bus is reset. This issue stems from the "flush_buffer" function, which first checks whether the "pos_unknown" flag is set. If the flag is set, the user will encounter an "Input/output error" until the tape position is known again. This behavior differs from the previous implementation, where empty drives were not affected at system start up time, allowing tape software to send commands to the driver to retrieve the drive's status and other information.
The current behavior prioritizes the "pos_unknown" flag over the "ST_NO_TAPE" status, leading to issues for software that detects drives during system startup. This software will receive an "Input/output error" until a tape is loaded and its position is known.
To resolve this, the "ST_NO_TAPE" status should take priority when the drive is empty, allowing communication with the drive following a power-on reset. At the same time, the change should continue to protect data by maintaining the "pos_unknown" flag when the drive contains a tape and its position is unknown.
--- drivers/scsi/st.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/scsi/st.c +3 -2
@@ -834,6 +834,9 @@ static int flush_buffer(struct scsi_tape *STp, int seek_next)int backspace, result;struct st_partstat *STps; +if (STp->ready !=ST_READY ) +return 0 ; +/* * If there was a bus reset, block further access * to this device.
@@ -841,8 +844,6 @@ static int flush_buffer(struct scsi_tape *STp, int seek_next)if (STp->pos_unknown)return (-EIO ); -if (STp->ready !=ST_READY ) -return 0 ; STps = &(STp->ps[STp->partition]);if (STps->rw ==ST_WRITING )/* Writing */ return st_flush_write_buffer (STp);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/558 scsi: pm8001: Do not overwrite PCI queue mapping
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <[email protected]>
[ Upstream commit a141c17a543332fc1238eb5cba562bfc66879126 ]
blk_mq_pci_map_queues() maps all queues but right after this, we overwrite these mappings by calling blk_mq_map_queues(). Just use one helper but not both.
--- drivers/scsi/pm8001/pm8001_init.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/scsi/pm8001/pm8001_init.c +4 -2
@@ -100,10 +100,12 @@ static void pm8001_map_queues(struct Scsi_Host *shost)struct pm8001_hba_info *pm8001_ha = sha->lldd_ha;struct blk_mq_queue_map *qmap = &shost->tag_set.map[HCTX_TYPE_DEFAULT ]; -if (pm8001_ha->number_of_intr >1 ) +if (pm8001_ha->number_of_intr >1 ) {blk_mq_pci_map_queues (qmap, pm8001_ha->pdev,1 ); +return ; + } -return blk_mq_map_queues (qmap); +blk_mq_map_queues (qmap); }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/558 drm/i915/psr: Do not wait for PSR being idle on on Panel Replay
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jouni Högander <[email protected]>
[ Upstream commit 9498f2e24ee0133d486667c9fa4c27ecdaadc272 ]
We do not have ALPM on DP Panel Replay. Due to this SRD_STATUS[SRD State] doesn't change from SRDENT_ON after Panel Replay is enabled until it gets disabled.
On eDP Panel Replay DEEP_SLEEP is not reached. _psr2_ready_for_pipe_update_locked is waiting DEEP_SLEEP bit getting reset.
Take these into account in Panel Replay code by not waiting PSR getting idle after enabling VBI.
--- drivers/gpu/drm/i915/display/intel_psr.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-)
drivers/gpu/drm/i915/display/intel_psr.c +2 -11
@@ -2746,13 +2746,6 @@ static int _psr1_ready_for_pipe_update_locked(struct intel_dp *intel_dp) EDP_PSR_STATUS_STATE_MASK, 50); } -static int _panel_replay_ready_for_pipe_update_locked (struct intel_dp *intel_dp) -{ -return intel_dp_is_edp (intel_dp) ? -_psr2_ready_for_pipe_update_locked (intel_dp) : -_psr1_ready_for_pipe_update_locked (intel_dp); -} -/** * intel_psr_wait_for_idle_locked - wait for PSR be ready for a pipe update * @new_crtc_state: new CRTC state
@@ -2775,12 +2768,10 @@ void intel_psr_wait_for_idle_locked(const struct intel_crtc_state *new_crtc_statlockdep_assert_held (&intel_dp->psr.lock); -if (!intel_dp->psr.enabled) +if (!intel_dp->psr.enabled || intel_dp->psr.panel_replay_enabled)continue ; -if (intel_dp->psr.panel_replay_enabled) - ret =_panel_replay_ready_for_pipe_update_locked (intel_dp); -else if (intel_dp->psr.sel_update_enabled) +if (intel_dp->psr.sel_update_enabled) ret =_psr2_ready_for_pipe_update_locked (intel_dp);else ret =_psr1_ready_for_pipe_update_locked (intel_dp);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/558 drm/i915/display: BMG supports UHBR13.5
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arun R Murthy <[email protected]>
[ Upstream commit fcd33d434d31a210bc9f209b5bfd92f3b91a2dda ]
UHBR20 is not supported by battlemage and the maximum link rate supported is UHBR13.5
v2: Replace IS_DGFX with IS_BATTLEMAGE (Jani)
HSD: 16023263677
--- drivers/gpu/drm/i915/display/intel_dp.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/display/intel_dp.c +11 -2
@@ -535,6 +535,10 @@ static void intel_dp_set_source_rates(struct intel_dp *intel_dp) {/* The values must be in increasing order */ +static const int bmg_rates[] = { +162000 ,216000 ,243000 ,270000 ,324000 ,432000 ,540000 ,675000 , +810000 ,1000000 ,1350000 , + };static const int mtl_rates[] = {162000 ,216000 ,243000 ,270000 ,324000 ,432000 ,540000 ,675000 ,810000 ,1000000 ,2000000 ,
@@ -565,8 +569,13 @@ intel_dp_set_source_rates(struct intel_dp *intel_dp) intel_dp->source_rates || intel_dp->num_source_rates);if (DISPLAY_VER (dev_priv) >=14 ) { - source_rates = mtl_rates; - size =ARRAY_SIZE (mtl_rates); +if (IS_BATTLEMAGE (dev_priv)) { + source_rates = bmg_rates; + size =ARRAY_SIZE (bmg_rates); + }else { + source_rates = mtl_rates; + size =ARRAY_SIZE (mtl_rates); + } max_rate =mtl_max_source_rate (intel_dp); }else if (DISPLAY_VER (dev_priv) >=11 ) { source_rates = icl_rates;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/558 drm/i915/dp: Fix AUX IO power enabling for eDP PSR
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Imre Deak <[email protected]>
[ Upstream commit ec2231b8dd2dc515912ff7816c420153b4a95e92 ]
Panel Self Refresh on eDP requires the AUX IO power to be enabled whenever the output (main link) is enabled. This is required by the AUX_PHY_WAKE/ML_PHY_LOCK signaling initiated by the HW automatically to re-enable the main link after it got disabled in power saving states (see eDP v1.4b, sections 5.1, 6.1.3.3.1.1).
The Panel Replay mode on non-eDP outputs on the other hand is only supported by keeping the main link active, thus not requiring the above AUX_PHY_WAKE/ML_PHY_LOCK signaling (eDP v1.4b, section 6.1.3.3.1.2). Thus enabling the AUX IO power for this case is not required either.
Based on the above enable the AUX IO power only for eDP/PSR outputs.
Bspec: 49274, 53370
v2:
- Add a TODO comment to adjust the requirement for AUX IO based on whether the ALPM/main-link off mode gets enabled. (Rodrigo)
--- drivers/gpu/drm/i915/display/intel_ddi.c | 2 +- drivers/gpu/drm/i915/display/intel_psr.c | 19 +++++++++++++++++++ drivers/gpu/drm/i915/display/intel_psr.h | 2 ++ 3 files changed, 22 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/display/intel_ddi.c +1 -1
@@ -916,7 +916,7 @@ intel_ddi_main_link_aux_domain(struct intel_digital_port *dig_port,* instead of a specific AUX_IO_<port> reference without powering up any * extra wells. */ -if (intel_encoder_can_psr (&dig_port->base)) +if (intel_psr_needs_aux_io_power (&dig_port->base, crtc_state))return intel_display_power_aux_io_domain (i915, dig_port->aux_ch); else if (DISPLAY_VER(i915) < 14 && (intel_crtc_has_dp_encoder(crtc_state) ||
drivers/gpu/drm/i915/display/intel_psr.c +19 -0
@@ -203,6 +203,25 @@ bool intel_encoder_can_psr(struct intel_encoder *encoder)return false; } +bool intel_psr_needs_aux_io_power (struct intel_encoder *encoder, +const struct intel_crtc_state *crtc_state) +{ +/* +* For PSR/PR modes only eDP requires the AUX IO power to be enabled whenever +* the output is enabled. For non-eDP outputs the main link is always +* on, hence it doesn't require the HW initiated AUX wake-up signaling used +* for eDP. +* +* TODO: +* - Consider leaving AUX IO disabled for eDP / PR as well, in case +* the ALPM with main-link off mode is not enabled. +* - Leave AUX IO enabled for DP / PR, once support for ALPM with +* main-link off mode is added for it and this mode gets enabled. +*/ +return intel_crtc_has_type (crtc_state,INTEL_OUTPUT_EDP ) && +intel_encoder_can_psr (encoder); +} +static bool psr_global_enabled (struct intel_dp *intel_dp) {struct intel_connector *connector = intel_dp->attached_connector;
drivers/gpu/drm/i915/display/intel_psr.h +2 -0
@@ -25,6 +25,8 @@ struct intel_plane_state; (intel_dp)->psr.source_panel_replay_support)bool intel_encoder_can_psr (struct intel_encoder *encoder); +bool intel_psr_needs_aux_io_power (struct intel_encoder *encoder, +const struct intel_crtc_state *crtc_state);void intel_psr_init_dpcd (struct intel_dp *intel_dp);void intel_psr_enable_sink (struct intel_dp *intel_dp,const struct intel_crtc_state *crtc_state);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/558 drm/amdgpu: Fix get each xcp macro
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asad Kamal <[email protected]>
[ Upstream commit ef126c06a98bde1a41303970eb0fc0ac33c3cc02 ]
Fix get each xcp macro to loop over each partition correctly
--- drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.h +1 -1
@@ -180,6 +180,6 @@ amdgpu_get_next_xcp(struct amdgpu_xcp_mgr *xcp_mgr, int *from)#define for_each_xcp (xcp_mgr, xcp, i) \ for (i = 0, xcp = amdgpu_get_next_xcp(xcp_mgr, &i); xcp; \ - xcp = amdgpu_get_next_xcp(xcp_mgr, &i)) + ++i, xcp = amdgpu_get_next_xcp(xcp_mgr, &i))#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/558 drm/amd/display: handle nulled pipe context in DCE110s set_drr()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Jakobi <[email protected]>
[ Upstream commit e7d4e1438533abe448813bdc45691f9c230aa307 ]
As set_drr() is called from IRQ context, it can happen that the pipe context has been nulled by dc_state_destruct().
Apply the same protection here that is already present for dcn35_set_drr() and dcn10_set_drr(). I.e. fetch the tg pointer first (to avoid a race with dc_state_destruct()), and then check the local copy before using it.
--- .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 21 ++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +14 -7
@@ -2085,13 +2085,20 @@ static void set_drr(struct pipe_ctx **pipe_ctx,* as well. */ for (i =0 ; i < num_pipes; i++) { - pipe_ctx[i]->stream_res.tg->funcs->set_drr ( - pipe_ctx[i]->stream_res.tg, ¶ms); - -if (adjust.v_total_max !=0 && adjust.v_total_min !=0 ) - pipe_ctx[i]->stream_res.tg->funcs->set_static_screen_control ( - pipe_ctx[i]->stream_res.tg, - event_triggers, num_frames); +/* dc_state_destruct() might null the stream resources, so fetch tg +* here first to avoid a race condition. The lifetime of the pointee +* itself (the timing_generator object) is not a problem here. +*/ +struct timing_generator *tg = pipe_ctx[i]->stream_res.tg; + +if ((tg !=NULL ) && tg->funcs) { +if (tg->funcs->set_drr) + tg->funcs->set_drr (tg, ¶ms); +if (adjust.v_total_max !=0 && adjust.v_total_min !=0 ) +if (tg->funcs->set_static_screen_control) + tg->funcs->set_static_screen_control ( + tg, event_triggers, num_frames); + } } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/558 ksmbd: fix warning: comparison of distinct pointer types lacks a cast
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit 289ebd9afeb94862d96c89217068943f1937df5b ]
smb2pdu.c: In function ‘smb2_open’:./include/linux/minmax.h:20:28: warning: comparison of distinct pointer types lacks a cast
20 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1)))
| ^~./include/linux/minmax.h:26:4: note: in expansion of macro ‘__typecheck’
26 | (__typecheck(x, y) && __no_side_effects(x, y))
| ^~~~~~~~~~~
./include/linux/minmax.h:36:24: note: in expansion of macro ‘__safe_cmp’
36 | __builtin_choose_expr(__safe_cmp(x, y), \
| ^~~~~~~~~~
./include/linux/minmax.h:45:19: note: in expansion of macro ‘__careful_cmp’
45 | #define min(x, y) __careful_cmp(x, y, <)
| ^~~~~~~~~~~~~/home/linkinjeon/git/smbd_work/ksmbd/smb2pdu.c:3713:27: note: in expansion of macro ‘min’
3713 | fp->durable_timeout = min(dh_info.timeout,
--- fs/smb/server/smb2pdu.c | 5 +++-- fs/smb/server/vfs_cache.h | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-)
fs/smb/server/smb2pdu.c +3 -2
@@ -3531,8 +3531,9 @@ int smb2_open(struct ksmbd_work *work)memcpy (fp->create_guid, dh_info.CreateGuid,SMB2_CREATE_GUID_SIZE );if (dh_info.timeout) - fp->durable_timeout =min (dh_info.timeout, -DURABLE_HANDLE_MAX_TIMEOUT ); + fp->durable_timeout = + min_t(unsigned int, dh_info.timeout, +DURABLE_HANDLE_MAX_TIMEOUT );else fp->durable_timeout =60 ; }
fs/smb/server/vfs_cache.h +2 -2
@@ -100,8 +100,8 @@ struct ksmbd_file {struct list_head blocked_works;struct list_head lock_list; -int durable_timeout; -int durable_scavenger_timeout; +unsigned int durable_timeout; +unsigned int durable_scavenger_timeout;/* if ls is happening on directory, below is valid*/ struct ksmbd_readdir_data readdir_data;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/558 mailbox: ARM_MHU_V3 should depend on ARM64
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 0e4ed48292c55eeb0afab22f8930b556f17eaad2 ]
The ARM MHUv3 controller is only present on ARM64 SoCs. Hence add a dependency on ARM64, to prevent asking the user about this driver when configuring a kernel for a different architecture than ARM64.
--- drivers/mailbox/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/mailbox/Kconfig +1 -0
@@ -25,6 +25,7 @@ config ARM_MHU_V2 config ARM_MHU_V3 tristate "ARM MHUv3 Mailbox" + depends on ARM64 || COMPILE_TEST depends on HAS_IOMEM || COMPILE_TEST depends on OF help
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/558 mailbox: rockchip: fix a typo in module autoloading
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Chen <[email protected]>
[ Upstream commit e92d87c9c5d769e4cb1dd7c90faa38dddd7e52e3 ]
MODULE_DEVICE_TABLE(of, rockchip_mbox_of_match) could let the module properly autoloaded based on the alias from of_device_id table. It should be 'rockchip_mbox_of_match' instead of 'rockchp_mbox_of_match', just fix it.
--- drivers/mailbox/rockchip-mailbox.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mailbox/rockchip-mailbox.c +1 -1
@@ -159,7 +159,7 @@ static const struct of_device_id rockchip_mbox_of_match[] = { { .compatible = "rockchip,rk3368-mailbox", .data = &rk3368_drv_data}, { }, }; -MODULE_DEVICE_TABLE (of, rockchp_mbox_of_match); +MODULE_DEVICE_TABLE (of, rockchip_mbox_of_match);static int rockchip_mbox_probe (struct platform_device *pdev) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/558 mailbox: bcm2835: Fix timeout during suspend mode
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
[ Upstream commit dc09f007caed3b2f6a3b6bd7e13777557ae22bfd ]
During noirq suspend phase the Raspberry Pi power driver suffer of firmware property timeouts. The reason is that the IRQ of the underlying BCM2835 mailbox is disabled and rpi_firmware_property_list() will always run into a timeout [1].
Since the VideoCore side isn't consider as a wakeup source, set the IRQF_NO_SUSPEND flag for the mailbox IRQ in order to keep it enabled during suspend-resume cycle.
[1]
PM: late suspend of devices complete after 1.754 msecs
WARNING: CPU: 0 PID: 438 at drivers/firmware/raspberrypi.c:128 rpi_firmware_property_list+0x204/0x22c Firmware transaction 0x00028001 timeout Modules linked in: CPU: 0 PID: 438 Comm: bash Tainted: G C 6.9.3-dirty #17 Hardware name: BCM2835 Call trace: unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x34/0x44 dump_stack_lvl from __warn+0x88/0xec __warn from warn_slowpath_fmt+0x7c/0xb0 warn_slowpath_fmt from rpi_firmware_property_list+0x204/0x22c rpi_firmware_property_list from rpi_firmware_property+0x68/0x8c rpi_firmware_property from rpi_firmware_set_power+0x54/0xc0 rpi_firmware_set_power from _genpd_power_off+0xe4/0x148 _genpd_power_off from genpd_sync_power_off+0x7c/0x11c genpd_sync_power_off from genpd_finish_suspend+0xcc/0xe0 genpd_finish_suspend from dpm_run_callback+0x78/0xd0 dpm_run_callback from device_suspend_noirq+0xc0/0x238 device_suspend_noirq from dpm_suspend_noirq+0xb0/0x168 dpm_suspend_noirq from suspend_devices_and_enter+0x1b8/0x5ac suspend_devices_and_enter from pm_suspend+0x254/0x2e4 pm_suspend from state_store+0xa8/0xd4 state_store from kernfs_fop_write_iter+0x154/0x1a0 kernfs_fop_write_iter from vfs_write+0x12c/0x184 vfs_write from ksys_write+0x78/0xc0 ksys_write from ret_fast_syscall+0x0/0x54 Exception stack(0xcc93dfa8 to 0xcc93dff0)
[...]
PM: noirq suspend of devices complete after 3095.584 msecs
--- drivers/mailbox/bcm2835-mailbox.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mailbox/bcm2835-mailbox.c +2 -1
@@ -145,7 +145,8 @@ static int bcm2835_mbox_probe(struct platform_device *pdev)spin_lock_init (&mbox->lock); ret =devm_request_irq (dev,irq_of_parse_and_map (dev->of_node,0 ), - bcm2835_mbox_irq,0 ,dev_name (dev), mbox); + bcm2835_mbox_irq,IRQF_NO_SUSPEND ,dev_name (dev), + mbox);if (ret) {dev_err (dev,"Failed to register a mailbox IRQ handler: %d\n" , ret);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/558 ceph: fix a memory leak on cap_auths in MDS client
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luis Henriques (SUSE) <[email protected]>
[ Upstream commit d97079e97eab20e08afc507f2bed4501e2824717 ]
The cap_auths that are allocated during an MDS session opening are never released, causing a memory leak detected by kmemleak. Fix this by freeing the memory allocated when shutting down the MDS client.
--- fs/ceph/mds_client.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
fs/ceph/mds_client.c +12 -0
@@ -6015,6 +6015,18 @@ static void ceph_mdsc_stop(struct ceph_mds_client *mdsc)ceph_mdsmap_destroy (mdsc->mdsmap);kfree (mdsc->sessions);ceph_caps_finalize (mdsc); + +if (mdsc->s_cap_auths) { +int i; + +for (i =0 ; i < mdsc->s_cap_auths_num; i++) { +kfree (mdsc->s_cap_auths[i].match.gids); +kfree (mdsc->s_cap_auths[i].match.path); +kfree (mdsc->s_cap_auths[i].match.fs_name); + } +kfree (mdsc->s_cap_auths); + } +ceph_pool_perm_destroy (mdsc); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/558 ceph: remove the incorrect Fw reference check when dirtying pages
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiubo Li <[email protected]>
[ Upstream commit c08dfb1b49492c09cf13838c71897493ea3b424e ]
When doing the direct-io reads it will also try to mark pages dirty, but for the read path it won't hold the Fw caps and there is case will it get the Fw reference.
--- fs/ceph/addr.c | 1 - 1 file changed, 1 deletion(-)
fs/ceph/addr.c +0 -1
@@ -95,7 +95,6 @@ static bool ceph_dirty_folio(struct address_space *mapping, struct folio *folio)/* dirty the head */ spin_lock (&ci->i_ceph_lock); -BUG_ON (ci->i_wr_ref ==0 );// caller should hold Fw reference if (__ceph_have_pending_cap_snap (ci)) {struct ceph_cap_snap *capsnap = list_last_entry(&ci->i_cap_snaps,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/558 drm/i915/dp: Fix colorimetry detection
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <[email protected]>
[ Upstream commit e860513f56d8428fcb2bd0282ac8ab691a53fc6c ]
intel_dp_init_connector() is no place for detecting stuff via DPCD (except perhaps for eDP). Move the colorimetry stuff into a more appropriate place.
--- drivers/gpu/drm/i915/display/intel_dp.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/gpu/drm/i915/display/intel_dp.c +6 -3
@@ -3964,6 +3964,9 @@ intel_edp_init_dpcd(struct intel_dp *intel_dp, struct intel_connector *connector drm_dp_is_branch(intel_dp->dpcd));intel_init_dpcd_quirks (intel_dp, &intel_dp->desc.ident); + intel_dp->colorimetry_support = +intel_dp_get_colorimetry_status (intel_dp); +/* * Read the eDP display control registers. *
@@ -4077,6 +4080,9 @@ intel_dp_get_dpcd(struct intel_dp *intel_dp)intel_init_dpcd_quirks (intel_dp, &intel_dp->desc.ident); + intel_dp->colorimetry_support = +intel_dp_get_colorimetry_status (intel_dp); +intel_dp_update_sink_caps (intel_dp); }
@@ -6861,9 +6867,6 @@ intel_dp_init_connector(struct intel_digital_port *dig_port, "HDCP init failed, skipping.\n"); } - intel_dp->colorimetry_support = -intel_dp_get_colorimetry_status (intel_dp); - intel_dp->frl.is_trained = false; intel_dp->frl.trained_rate_gbps =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/558 ieee802154: Fix build error
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit addf89774e48c992316449ffab4f29c2309ebefb ]
If REGMAP_SPI is m and IEEE802154_MCR20A is y,
mcr20a.c:(.text+0x3ed6c5b): undefined reference to `__devm_regmap_init_spi' ld: mcr20a.c:(.text+0x3ed6cb5): undefined reference to `__devm_regmap_init_spi'
Select REGMAP_SPI for IEEE802154_MCR20A to fix it.
--- drivers/net/ieee802154/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/net/ieee802154/Kconfig +1 -0
@@ -101,6 +101,7 @@ config IEEE802154_CA8210_DEBUGFS config IEEE802154_MCR20A tristate "MCR20A transceiver driver" + select REGMAP_SPI depends on IEEE802154_DRIVERS && MAC802154 depends on SPI help
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/558 net: sparx5: Fix invalid timestamps
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aakash Menon <[email protected]>
[ Upstream commit 151ac45348afc5b56baa584c7cd4876addf461ff ]
Bit 270-271 are occasionally unexpectedly set by the hardware. This issue was observed with 10G SFPs causing huge time errors (> 30ms) in PTP. Only 30 bits are needed for the nanosecond part of the timestamp, clear 2 most significant bits before extracting timestamp from the internal frame header.
--- drivers/net/ethernet/microchip/sparx5/sparx5_packet.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/microchip/sparx5/sparx5_packet.c +5 -1
@@ -45,8 +45,12 @@ void sparx5_ifh_parse(u32 *ifh, struct frame_info *info) fwd = (fwd >>5 ); info->src_port =FIELD_GET (GENMASK (7 ,1 ), fwd); +/* +* Bit 270-271 are occasionally unexpectedly set by the hardware, +* clear bits before extracting timestamp +*/ info->timestamp = - ((u64 )xtr_hdr[2 ] <<24 ) | + ((u64)(xtr_hdr[2 ] &GENMASK (5 ,0 )) <<24 ) | ((u64 )xtr_hdr[3 ] <<16 ) | ((u64 )xtr_hdr[4 ] <<8 ) | ((u64 )xtr_hdr[5 ] <<0 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/558 net/mlx5: Fix error path in multi-packet WQE transmit
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerd Bayer <[email protected]>
[ Upstream commit 2bcae12c795f32ddfbf8c80d1b5f1d3286341c32 ]
Remove the erroneous unmap in case no DMA mapping was established
The multi-packet WQE transmit code attempts to obtain a DMA mapping for the skb. This could fail, e.g. under memory pressure, when the IOMMU driver just can't allocate more memory for page tables. While the code tries to handle this in the path below the err_unmap label it erroneously unmaps one entry from the sq's FIFO list of active mappings. Since the current map attempt failed this unmap is removing some random DMA mapping that might still be required. If the PCI function now presents that IOVA, the IOMMU may assumes a rogue DMA access and e.g. on s390 puts the PCI function in error state.
The erroneous behavior was seen in a stress-test environment that created memory pressure.
--- drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +0 -1
@@ -642,7 +642,6 @@ mlx5e_sq_xmit_mpwqe(struct mlx5e_txqsq *sq, struct sk_buff *skb,return ; err_unmap: -mlx5e_dma_unmap_wqe_err (sq,1 ); sq->stats->dropped++;dev_kfree_skb_any (skb);mlx5e_tx_flush (sq);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/558 net/mlx5: Added cond_resched() to crdump collection
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohamed Khalfella <[email protected]>
[ Upstream commit ec793155894140df7421d25903de2e6bc12c695b ]
Collecting crdump involves reading vsc registers from pci config space of mlx device, which can take long time to complete. This might result in starving other threads waiting to run on the cpu.
Numbers I got from testing ConnectX-5 Ex MCX516A-CDAT in the lab:
- mlx5_vsc_gw_read_block_fast() was called with length = 1310716.
- mlx5_vsc_gw_read_fast() reads 4 bytes at a time. It was not used to read the entire 1310716 bytes. It was called 53813 times because there are jumps in read_addr.
- On average mlx5_vsc_gw_read_fast() took 35284.4ns.
- In total mlx5_vsc_wait_on_flag() called vsc_read() 54707 times. The average time for each call was 17548.3ns. In some instances vsc_read() was called more than one time when the flag was not set. As expected the thread released the cpu after 16 iterations in mlx5_vsc_wait_on_flag().
- Total time to read crdump was 35284.4ns * 53813 ~= 1.898s.
It was seen in the field that crdump can take more than 5 seconds to complete. During that time mlx5_vsc_wait_on_flag() did not release the cpu because it did not complete 16 iterations. It is believed that pci config reads were slow. Adding cond_resched() every 128 register read improves the situation. In the common case the, crdump takes ~1.8989s, the thread yields the cpu every ~4.51ms. If crdump takes ~5s, the thread yields the cpu every ~18.0ms.
--- drivers/net/ethernet/mellanox/mlx5/core/lib/pci_vsc.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/lib/pci_vsc.c +10 -0
@@ -24,6 +24,11 @@ pci_write_config_dword((dev)->pdev, (dev)->vsc_addr + (offset), (val))#define VSC_MAX_RETRIES 2048 +/* Reading VSC registers can take relatively long time. +* Yield the cpu every 128 registers read. +*/ +#define VSC_GW_READ_BLOCK_COUNT 128 +enum {VSC_CTRL_OFFSET =0x4 ,VSC_COUNTER_OFFSET =0x8 ,
@@ -273,6 +278,7 @@ int mlx5_vsc_gw_read_block_fast(struct mlx5_core_dev *dev, u32 *data, {unsigned int next_read_addr =0 ;unsigned int read_addr =0 ; +unsigned int count =0 ;while (read_addr < length) { if (mlx5_vsc_gw_read_fast(dev, read_addr, &next_read_addr,
@@ -280,6 +286,10 @@ int mlx5_vsc_gw_read_block_fast(struct mlx5_core_dev *dev, u32 *data,return read_addr; read_addr = next_read_addr; +if (++count ==VSC_GW_READ_BLOCK_COUNT ) { +cond_resched (); + count =0 ; + } }return length; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/558 net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Elena Salomatkina <[email protected]>
[ Upstream commit f25389e779500cf4a59ef9804534237841bce536 ]
In mlx5e_tir_builder_alloc() kvzalloc() may return NULL which is dereferenced on the next line in a reference to the modify field.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/ethernet/mellanox/mlx5/core/en/tir.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en/tir.c +3 -0
@@ -23,6 +23,9 @@ struct mlx5e_tir_builder *mlx5e_tir_builder_alloc(bool modify)struct mlx5e_tir_builder *builder; builder =kvzalloc (sizeof (*builder),GFP_KERNEL ); +if (!builder) +return NULL ; + builder->modify = modify;return builder;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/558 net/mlx5e: SHAMPO, Fix overflow of hd_per_wq
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragos Tatulea <[email protected]>
[ Upstream commit 023d2a43ed0d9ab73d4a35757121e4c8e01298e5 ]
When having larger RQ sizes and small MTUs sizes, the hd_per_wq variable can overflow. Like in the following case:
$> ethtool --set-ring eth1 rx 8192
$> ip link set dev eth1 mtu 144
$> ethtool --features eth1 rx-gro-hw on
... yields in dmesg:
mlx5_core 0000:08:00.1: mlx5_cmd_out_err:808:(pid 194797): CREATE_MKEY(0x200) op_mod(0x0) failed, status bad parameter(0x3), syndrome (0x3bf6f), err(-22)
because hd_per_wq is 64K which overflows to 0 and makes the command fail.
This patch increases the variable size to 32 bit.
--- drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en.h +1 -1
@@ -627,7 +627,7 @@ struct mlx5e_shampo_hd {struct mlx5e_dma_info *info;struct mlx5e_frag_page *pages;u16 curr_page_index; -u16 hd_per_wq; +u32 hd_per_wq;u16 hd_per_wqe;unsigned long *bitmap;u16 pi;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/558 net/mlx5e: Fix crash caused by calling __xfrm_state_delete() twice
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <[email protected]>
[ Upstream commit 7b124695db40d5c9c5295a94ae928a8d67a01c3d ]
The km.state is not checked in driver's delayed work. When xfrm_state_check_expire() is called, the state can be reset to XFRM_STATE_EXPIRED, even if it is XFRM_STATE_DEAD already. This happens when xfrm state is deleted, but not freed yet. As __xfrm_state_delete() is called again in xfrm timer, the following crash occurs.
To fix this issue, skip xfrm_state_check_expire() if km.state is not XFRM_STATE_VALID.
Oops: general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] SMP CPU: 5 UID: 0 PID: 7448 Comm: kworker/u102:2 Not tainted 6.11.0-rc2+ #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5e_ipsec: eth%d mlx5e_ipsec_handle_sw_limits [mlx5_core] RIP: 0010:__xfrm_state_delete+0x3d/0x1b0 Code: 0f 84 8b 01 00 00 48 89 fd c6 87 c8 00 00 00 05 48 8d bb 40 10 00 00 e8 11 04 1a 00 48 8b 95 b8 00 00 00 48 8b 85 c0 00 00 00 <48> 89 42 08 48 89 10 48 8b 55 10 48 b8 00 01 00 00 00 00 ad de 48 RSP: 0018:ffff88885f945ec8 EFLAGS: 00010246 RAX: dead000000000122 RBX: ffffffff82afa940 RCX: 0000000000000036 RDX: dead000000000100 RSI: 0000000000000000 RDI: ffffffff82afb980 RBP: ffff888109a20340 R08: ffff88885f945ea0 R09: 0000000000000000 R10: 0000000000000000 R11: ffff88885f945ff8 R12: 0000000000000246 R13: ffff888109a20340 R14: ffff88885f95f420 R15: ffff88885f95f400 FS: 0000000000000000(0000) GS:ffff88885f940000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2163102430 CR3: 00000001128d6001 CR4: 0000000000370eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> ? die_addr+0x33/0x90 ? exc_general_protection+0x1a2/0x390 ? asm_exc_general_protection+0x22/0x30 ? __xfrm_state_delete+0x3d/0x1b0 ? __xfrm_state_delete+0x2f/0x1b0 xfrm_timer_handler+0x174/0x350 ? __xfrm_state_delete+0x1b0/0x1b0 __hrtimer_run_queues+0x121/0x270 hrtimer_run_softirq+0x88/0xd0 handle_softirqs+0xcc/0x270 do_softirq+0x3c/0x50 </IRQ> <TASK> __local_bh_enable_ip+0x47/0x50 mlx5e_ipsec_handle_sw_limits+0x7d/0x90 [mlx5_core] process_one_work+0x137/0x2d0 worker_thread+0x28d/0x3a0 ? rescuer_thread+0x480/0x480 kthread+0xb8/0xe0 ? kthread_park+0x80/0x80 ret_from_fork+0x2d/0x50 ? kthread_park+0x80/0x80 ret_from_fork_asm+0x11/0x20 </TASK>
--- drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +7 -1
@@ -67,7 +67,6 @@ static void mlx5e_ipsec_handle_sw_limits(struct work_struct *_work)return ;spin_lock_bh (&x->lock); -xfrm_state_check_expire (x);if (x->km.state ==XFRM_STATE_EXPIRED ) { sa_entry->attrs.drop = true;spin_unlock_bh (&x->lock);
@@ -75,6 +74,13 @@ static void mlx5e_ipsec_handle_sw_limits(struct work_struct *_work)mlx5e_accel_ipsec_fs_modify (sa_entry);return ; } + +if (x->km.state !=XFRM_STATE_VALID ) { +spin_unlock_bh (&x->lock); +return ; + } + +xfrm_state_check_expire (x);spin_unlock_bh (&x->lock); queue_delayed_work(sa_entry->ipsec->wq, &dwork->dwork,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/558 netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Sutter <[email protected]>
[ Upstream commit 76f1ed087b562a469f2153076f179854b749c09a ]
Fix the comment which incorrectly defines it as NLA_U32.
--- include/uapi/linux/netfilter/nf_tables.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/netfilter/nf_tables.h +1 -1
@@ -1694,7 +1694,7 @@ enum nft_flowtable_flags {* * @NFTA_FLOWTABLE_TABLE: name of the table containing the expression (NLA_STRING) * @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING) -* @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32) +* @NFTA_FLOWTABLE_HOOK: netfilter hook configuration (NLA_NESTED) * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32) * @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64) * @NFTA_FLOWTABLE_FLAGS: flags (NLA_U32)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/558 net: ieee802154: mcr20a: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 09573b1cc76e7ff8f056ab29ea1cdc152ec8c653 ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/net/ieee802154/mcr20a.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/net/ieee802154/mcr20a.c +1 -4
@@ -1302,16 +1302,13 @@ mcr20a_probe(struct spi_device *spi) irq_type =IRQF_TRIGGER_FALLING ; ret =devm_request_irq (&spi->dev, spi->irq, mcr20a_irq_isr, - irq_type,dev_name (&spi->dev), lp); + irq_type |IRQF_NO_AUTOEN ,dev_name (&spi->dev), lp);if (ret) {dev_err (&spi->dev,"could not request_irq for mcr20a\n" ); ret = -ENODEV ; goto free_dev; } -/* disable_irq by default and wait for starting hardware */ -disable_irq (spi->irq); - ret =ieee802154_register_hw (hw);if (ret) {dev_crit (&spi->dev,"ieee802154_register_hw failed\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/558 net: wwan: qcom_bam_dmux: Fix missing pm_runtime_disable()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit d505d3593b52b6c43507f119572409087416ba28 ]
It's important to undo pm_runtime_use_autosuspend() with pm_runtime_dont_use_autosuspend() at driver exit time.
But the pm_runtime_disable() and pm_runtime_dont_use_autosuspend() is missing in the error path for bam_dmux_probe(). So add it.
Found by code review. Compile-tested only.
--- drivers/net/wwan/qcom_bam_dmux.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/net/wwan/qcom_bam_dmux.c +8 -3
@@ -823,17 +823,17 @@ static int bam_dmux_probe(struct platform_device *pdev) ret =devm_request_threaded_irq (dev, pc_ack_irq,NULL , bam_dmux_pc_ack_irq,IRQF_ONESHOT ,NULL , dmux);if (ret) -return ret; + goto err_disable_pm; ret =devm_request_threaded_irq (dev, dmux->pc_irq,NULL , bam_dmux_pc_irq,IRQF_ONESHOT ,NULL , dmux);if (ret) -return ret; + goto err_disable_pm; ret =irq_get_irqchip_state (dmux->pc_irq,IRQCHIP_STATE_LINE_LEVEL , &dmux->pc_state);if (ret) -return ret; + goto err_disable_pm;/* Check if remote finished initialization before us */ if (dmux->pc_state) {
@@ -844,6 +844,11 @@ static int bam_dmux_probe(struct platform_device *pdev) }return 0 ; + +err_disable_pm: +pm_runtime_disable (dev); +pm_runtime_dont_use_autosuspend (dev); +return ret; }static void bam_dmux_remove (struct platform_device *pdev)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/558 selftests: netfilter: Fix nft_audit.sh for newer nft binaries
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Sutter <[email protected]>
[ Upstream commit 8a89015644513ef69193a037eb966f2d55fe385a ]
As a side-effect of nftables' commit dbff26bfba833 ("cache: consolidate reset command"), audit logs changed when more objects were reset than fit into a single netlink message.
Since the objects' distribution in netlink messages is not relevant, implement a summarizing function which combines repeated audit logs into a single one with summed up 'entries=' value.
--- .../selftests/net/netfilter/nft_audit.sh | 57 ++++++++++--------- 1 file changed, 29 insertions(+), 28 deletions(-)
tools/testing/selftests/net/netfilter/nft_audit.sh +29 -28
@@ -48,12 +48,31 @@ logread_pid=$! trap 'kill $logread_pid; rm -f $logfile $rulefile' EXIT exec 3<"$logfile" +lsplit='s/^\(.*\) entries=\([^ ]*\) \(.*\)$/pfx="\1"\nval="\2"\nsfx="\3"/' +summarize_logs() { + sum=0 + while read line; do + eval $(sed "$lsplit" <<< "$line") + [[ $sum -gt 0 ]] && { + [[ "$pfx $sfx" == "$tpfx $tsfx" ]] && { + let "sum += val" + continue + } + echo "$tpfx entries=$sum $tsfx" + } + tpfx="$pfx" + tsfx="$sfx" + sum=$val + done + echo "$tpfx entries=$sum $tsfx" +} + do_test() { # (cmd, log) echo -n "testing for cmd: $1 ... " cat <&3 >/dev/null $1 >/dev/null || exit 1 sleep 0.1 - res=$(diff -a -u <(echo "$2") - <&3) + res=$(diff -a -u <(echo "$2") <(summarize_logs <&3)) [ $? -eq 0 ] && { echo "OK"; return; } echo "FAIL" grep -v '^\(---\|+++\|@@\)' <<< "$res"
@@ -152,31 +171,17 @@ do_test 'nft reset rules t1 c2' \ 'table=t1 family=2 entries=3 op=nft_reset_rule' do_test 'nft reset rules table t1' \ -'table=t1 family=2 entries=3 op=nft_reset_rule -table=t1 family=2 entries=3 op=nft_reset_rule -table=t1 family=2 entries=3 op=nft_reset_rule' +'table=t1 family=2 entries=9 op=nft_reset_rule' do_test 'nft reset rules t2 c3' \ -'table=t2 family=2 entries=189 op=nft_reset_rule -table=t2 family=2 entries=188 op=nft_reset_rule -table=t2 family=2 entries=126 op=nft_reset_rule' +'table=t2 family=2 entries=503 op=nft_reset_rule' do_test 'nft reset rules t2' \ -'table=t2 family=2 entries=3 op=nft_reset_rule -table=t2 family=2 entries=3 op=nft_reset_rule -table=t2 family=2 entries=186 op=nft_reset_rule -table=t2 family=2 entries=188 op=nft_reset_rule -table=t2 family=2 entries=129 op=nft_reset_rule' +'table=t2 family=2 entries=509 op=nft_reset_rule' do_test 'nft reset rules' \ -'table=t1 family=2 entries=3 op=nft_reset_rule -table=t1 family=2 entries=3 op=nft_reset_rule -table=t1 family=2 entries=3 op=nft_reset_rule -table=t2 family=2 entries=3 op=nft_reset_rule -table=t2 family=2 entries=3 op=nft_reset_rule -table=t2 family=2 entries=180 op=nft_reset_rule -table=t2 family=2 entries=188 op=nft_reset_rule -table=t2 family=2 entries=135 op=nft_reset_rule' +'table=t1 family=2 entries=9 op=nft_reset_rule +table=t2 family=2 entries=509 op=nft_reset_rule' # resetting sets and elements
@@ -200,13 +205,11 @@ do_test 'nft reset counters t1' \ 'table=t1 family=2 entries=1 op=nft_reset_obj' do_test 'nft reset counters t2' \ -'table=t2 family=2 entries=342 op=nft_reset_obj -table=t2 family=2 entries=158 op=nft_reset_obj' +'table=t2 family=2 entries=500 op=nft_reset_obj' do_test 'nft reset counters' \ 'table=t1 family=2 entries=1 op=nft_reset_obj -table=t2 family=2 entries=341 op=nft_reset_obj -table=t2 family=2 entries=159 op=nft_reset_obj' +table=t2 family=2 entries=500 op=nft_reset_obj' # resetting quotas
@@ -217,13 +220,11 @@ do_test 'nft reset quotas t1' \ 'table=t1 family=2 entries=1 op=nft_reset_obj' do_test 'nft reset quotas t2' \ -'table=t2 family=2 entries=315 op=nft_reset_obj -table=t2 family=2 entries=185 op=nft_reset_obj' +'table=t2 family=2 entries=500 op=nft_reset_obj' do_test 'nft reset quotas' \ 'table=t1 family=2 entries=1 op=nft_reset_obj -table=t2 family=2 entries=314 op=nft_reset_obj -table=t2 family=2 entries=186 op=nft_reset_obj' +table=t2 family=2 entries=500 op=nft_reset_obj' # deleting rules
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/558 netfilter: nf_tables: prevent nf_skb_duplicated corruption
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 92ceba94de6fb4cee2bf40b485979c342f44a492 ]
syzbot found that nf_dup_ipv4() or nf_dup_ipv6() could write per-cpu variable nf_skb_duplicated in an unsafe way [1].
Disabling preemption as hinted by the splat is not enough, we have to disable soft interrupts as well.
[1]
BUG: using __this_cpu_write() in preemptible [00000000] code: syz.4.282/6316 caller is nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87 CPU: 0 UID: 0 PID: 6316 Comm: syz.4.282 Not tainted 6.11.0-rc7-syzkaller-00104-g7052622fccb1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 check_preemption_disabled+0x10e/0x120 lib/smp_processor_id.c:49 nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87 nft_dup_ipv4_eval+0x1db/0x300 net/ipv4/netfilter/nft_dup_ipv4.c:30 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x4ad/0x1da0 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x202/0x320 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626 nf_hook+0x2c4/0x450 include/linux/netfilter.h:269 NF_HOOK_COND include/linux/netfilter.h:302 [inline] ip_output+0x185/0x230 net/ipv4/ip_output.c:433 ip_local_out net/ipv4/ip_output.c:129 [inline] ip_send_skb+0x74/0x100 net/ipv4/ip_output.c:1495 udp_send_skb+0xacf/0x1650 net/ipv4/udp.c:981 udp_sendmsg+0x1c21/0x2a60 net/ipv4/udp.c:1269 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597 ___sys_sendmsg net/socket.c:2651 [inline] __sys_sendmmsg+0x3b2/0x740 net/socket.c:2737 __do_sys_sendmmsg net/socket.c:2766 [inline] __se_sys_sendmmsg net/socket.c:2763 [inline] __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2763 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4ce4f7def9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4ce5d4a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f4ce5135f80 RCX: 00007f4ce4f7def9 RDX: 0000000000000001 RSI: 0000000020005d40 RDI: 0000000000000006 RBP: 00007f4ce4ff0b76 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f4ce5135f80 R15: 00007ffd4cbc6d68 </TASK>
--- net/ipv4/netfilter/nf_dup_ipv4.c | 7 +++++-- net/ipv6/netfilter/nf_dup_ipv6.c | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-)
net/ipv4/netfilter/nf_dup_ipv4.c +5 -2
@@ -52,8 +52,9 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum, {struct iphdr *iph; +local_bh_disable ();if (this_cpu_read (nf_skb_duplicated)) -return ; + goto out;/* * Copy the skb, and route the copy. Will later return %XT_CONTINUE for * the original skb, which should continue on its way as if nothing has
@@ -61,7 +62,7 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum,*/ skb =pskb_copy (skb,GFP_ATOMIC );if (skb ==NULL ) -return ; + goto out;#if IS_ENABLED (CONFIG_NF_CONNTRACK )/* Avoid counting cloned packets towards the original connection. */
@@ -90,6 +91,8 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum, }else {kfree_skb (skb); } +out: +local_bh_enable (); }EXPORT_SYMBOL_GPL (nf_dup_ipv4);
net/ipv6/netfilter/nf_dup_ipv6.c +5 -2
@@ -47,11 +47,12 @@ static bool nf_dup_ipv6_route(struct net *net, struct sk_buff *skb,void nf_dup_ipv6 (struct net *net,struct sk_buff *skb,unsigned int hooknum,const struct in6_addr *gw,int oif) { +local_bh_disable ();if (this_cpu_read (nf_skb_duplicated)) -return ; + goto out; skb =pskb_copy (skb,GFP_ATOMIC );if (skb ==NULL ) -return ; + goto out;#if IS_ENABLED (CONFIG_NF_CONNTRACK )nf_reset_ct (skb);
@@ -69,6 +70,8 @@ void nf_dup_ipv6(struct net *net, struct sk_buff *skb, unsigned int hooknum, }else {kfree_skb (skb); } +out: +local_bh_enable (); }EXPORT_SYMBOL_GPL (nf_dup_ipv6);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/558 selftests: netfilter: Add missing return value
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhang jiao <[email protected]>
[ Upstream commit 10dbd23633f0433f8d13c2803d687b36a675ef60 ]
There is no return value in count_entries, just add it.
--- tools/testing/selftests/net/netfilter/conntrack_dump_flush.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/net/netfilter/conntrack_dump_flush.c +1 -0
@@ -207,6 +207,7 @@ static int conntrack_data_generate_v6(struct mnl_socket *sock,static int count_entries (const struct nlmsghdr *nlh,void *data) { reply_counter++; +return MNL_CB_OK ; }static int conntracK_count_zone (struct mnl_socket *sock,uint16_t zone)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/558 Bluetooth: MGMT: Fix possible crash on mgmt_index_removed
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit f53e1c9c726d83092167f2226f32bd3b73f26c21 ]
If mgmt_index_removed is called while there are commands queued on cmd_sync it could lead to crashes like the bellow trace:
0x0000053D: __list_del_entry_valid_or_report+0x98/0xdc 0x0000053D: mgmt_pending_remove+0x18/0x58 [bluetooth] 0x0000053E: mgmt_remove_adv_monitor_complete+0x80/0x108 [bluetooth] 0x0000053E: hci_cmd_sync_work+0xbc/0x164 [bluetooth]
So while handling mgmt_index_removed this attempts to dequeue commands passed as user_data to cmd_sync.
--- net/bluetooth/mgmt.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
net/bluetooth/mgmt.c +14 -9
@@ -1453,10 +1453,15 @@ static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)static void cmd_complete_rsp (struct mgmt_pending_cmd *cmd,void *data) { -if (cmd->cmd_complete) { -u8 *status = data; +struct cmd_lookup *match = data; + +/* dequeue cmd_sync entries using cmd as data as that is about to be +* removed/freed. +*/ +hci_cmd_sync_dequeue (match->hdev,NULL , cmd,NULL ); - cmd->cmd_complete (cmd, *status); +if (cmd->cmd_complete) { + cmd->cmd_complete (cmd, match->mgmt_status);mgmt_pending_remove (cmd);return ;
@@ -9394,12 +9399,12 @@ void mgmt_index_added(struct hci_dev *hdev)void mgmt_index_removed (struct hci_dev *hdev) {struct mgmt_ev_ext_index ev; -u8 status =MGMT_STATUS_INVALID_INDEX ; +struct cmd_lookup match = {NULL , hdev,MGMT_STATUS_INVALID_INDEX };if (test_bit (HCI_QUIRK_RAW_DEVICE , &hdev->quirks))return ; -mgmt_pending_foreach (0 , hdev, cmd_complete_rsp, &status); +mgmt_pending_foreach (0 , hdev, cmd_complete_rsp, &match);if (hci_dev_test_flag (hdev,HCI_UNCONFIGURED )) { mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0,
@@ -9450,7 +9455,7 @@ void mgmt_power_on(struct hci_dev *hdev, int err)void __mgmt_power_off (struct hci_dev *hdev) {struct cmd_lookup match = {NULL , hdev }; -u8 status, zero_cod[] = {0 ,0 ,0 }; +u8 zero_cod[] = {0 ,0 ,0 };mgmt_pending_foreach (MGMT_OP_SET_POWERED , hdev, settings_rsp, &match);
@@ -9462,11 +9467,11 @@ void __mgmt_power_off(struct hci_dev *hdev)* status responses. */ if (hci_dev_test_flag (hdev,HCI_UNREGISTER )) - status =MGMT_STATUS_INVALID_INDEX ; + match.mgmt_status =MGMT_STATUS_INVALID_INDEX ;else - status =MGMT_STATUS_NOT_POWERED ; + match.mgmt_status =MGMT_STATUS_NOT_POWERED ; -mgmt_pending_foreach (0 , hdev, cmd_complete_rsp, &status); +mgmt_pending_foreach (0 , hdev, cmd_complete_rsp, &match);if (memcmp (hdev->dev_class, zero_cod,sizeof (zero_cod)) !=0 ) { mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/558 Bluetooth: L2CAP: Fix uaf in l2cap_connect
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 333b4fd11e89b29c84c269123f871883a30be586 ]
[Syzbot reported]
BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949 Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54 CPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-00268-g788220eee30d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Workqueue: hci2 hci_rx_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949 l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline] l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline] l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6825 l2cap_recv_acldata+0x9b4/0xb70 net/bluetooth/l2cap_core.c:7514 hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline] hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
...
Freed by task 5245: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579 poison_slab_object+0xf7/0x160 mm/kasan/common.c:240 __kasan_slab_free+0x32/0x50 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2256 [inline] slab_free mm/slub.c:4477 [inline] kfree+0x12a/0x3b0 mm/slub.c:4598 l2cap_conn_free net/bluetooth/l2cap_core.c:1810 [inline] kref_put include/linux/kref.h:65 [inline] l2cap_conn_put net/bluetooth/l2cap_core.c:1822 [inline] l2cap_conn_del+0x59d/0x730 net/bluetooth/l2cap_core.c:1802 l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7241 hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline] hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265 hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583 abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917 hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
--- net/bluetooth/hci_core.c | 2 ++ net/bluetooth/hci_event.c | 2 +- net/bluetooth/l2cap_core.c | 8 -------- 3 files changed, 3 insertions(+), 9 deletions(-)
net/bluetooth/hci_core.c +2 -0
@@ -3782,6 +3782,8 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)hci_dev_lock (hdev); conn =hci_conn_hash_lookup_handle (hdev, handle); +if (conn &&hci_dev_test_flag (hdev,HCI_MGMT )) +mgmt_device_connected (hdev, conn,NULL ,0 );hci_dev_unlock (hdev);if (conn) {
net/bluetooth/hci_event.c +1 -1
@@ -3706,7 +3706,7 @@ static void hci_remote_features_evt(struct hci_dev *hdev, void *data, goto unlock; } -if (!ev->status && !test_bit (HCI_CONN_MGMT_CONNECTED , &conn->flags)) { +if (!ev->status) {struct hci_cp_remote_name_req cp;memset (&cp,0 ,sizeof (cp));bacpy (&cp.bdaddr, &conn->dst);
net/bluetooth/l2cap_core.c +0 -8
@@ -4066,17 +4066,9 @@ static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd,static int l2cap_connect_req (struct l2cap_conn *conn,struct l2cap_cmd_hdr *cmd,u16 cmd_len,u8 *data) { -struct hci_dev *hdev = conn->hcon->hdev; -struct hci_conn *hcon = conn->hcon; -if (cmd_len <sizeof (struct l2cap_conn_req ))return -EPROTO ; -hci_dev_lock (hdev); -if (hci_dev_test_flag (hdev,HCI_MGMT )) -mgmt_device_connected (hdev, hcon,NULL ,0 ); -hci_dev_unlock (hdev); -l2cap_connect (conn, cmd, data,L2CAP_CONN_RSP );return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/558 Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 7b1ab460592ca818e7b52f27cd3ec86af79220d1 ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/bluetooth/btmrvl_sdio.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/bluetooth/btmrvl_sdio.c +1 -2
@@ -92,7 +92,7 @@ static int btmrvl_sdio_probe_of(struct device *dev, }else { ret =devm_request_irq (dev, cfg->irq_bt, btmrvl_wake_irq_bt, -0 ,"bt_wake" , card); +IRQF_NO_AUTOEN ,"bt_wake" , card);if (ret) { dev_err(dev, "Failed to request irq_bt %d (%d)\n",
@@ -101,7 +101,6 @@ static int btmrvl_sdio_probe_of(struct device *dev,/* Configure wakeup (enabled by default) */ device_init_wakeup (dev, true); -disable_irq (cfg->irq_bt); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/558 afs: Fix missing wire-up of afs_retry_request()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 2cf36327ee1e47733aba96092d7bd082a4056ff5 ]
afs_retry_request() is supposed to be pointed to by the afs_req_ops netfs operations table, but the pointer got lost somewhere. The function is used during writeback to rotate through the authentication keys that were in force when the file was modified locally.
Fix this by adding the pointer to the function.
--- fs/afs/file.c | 1 + 1 file changed, 1 insertion(+)
fs/afs/file.c +1 -0
@@ -404,6 +404,7 @@ const struct netfs_request_ops afs_req_ops = { .begin_writeback = afs_begin_writeback, .prepare_write = afs_prepare_write, .issue_write = afs_issue_write, + .retry_request = afs_retry_request, };static void afs_add_open_mmap (struct afs_vnode *vnode)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/558 afs: Fix the setting of the server responding flag
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit ff98751bae40faed1ba9c6a7287e84430f7dec64 ]
In afs_wait_for_operation(), we set transcribe the call responded flag to the server record that we used after doing the fileserver iteration loop - but it's possible to exit the loop having had a response from the server that we've discarded (e.g. it returned an abort or we started receiving data, but the call didn't complete).
This means that op->server might be NULL, but we don't check that before attempting to set the server flag.
--- fs/afs/fs_operation.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/afs/fs_operation.c +1 -1
@@ -201,7 +201,7 @@ void afs_wait_for_operation(struct afs_operation *op) } } -if (op->call_responded) +if (op->call_responded && op->server)set_bit (AFS_SERVER_FL_RESPONDING , &op->server->flags);if (!afs_op_error (op)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/558 net: dsa: improve shutdown sequence
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit 6c24a03a61a245fe34d47582898331fa034b6ccd ]
Alexander Sverdlin presents 2 problems during shutdown with the lan9303 driver. One is specific to lan9303 and the other just happens to reproduce there.
The first problem is that lan9303 is unique among DSA drivers in that it calls dev_get_drvdata() at "arbitrary runtime" (not probe, not shutdown, not remove):
phy_state_machine()
-> ...
-> dsa_user_phy_read()
-> ds->ops->phy_read()
-> lan9303_phy_read()
-> chip->ops->phy_read()
-> lan9303_mdio_phy_read()
-> dev_get_drvdata()But we never stop the phy_state_machine(), so it may continue to run after dsa_switch_shutdown(). Our common pattern in all DSA drivers is to set drvdata to NULL to suppress the remove() method that may come afterwards. But in this case it will result in an NPD.
The second problem is that the way in which we set dp->conduit->dsa_ptr = NULL; is concurrent with receive packet processing. dsa_switch_rcv() checks once whether dev->dsa_ptr is NULL, but afterwards, rather than continuing to use that non-NULL value, dev->dsa_ptr is dereferenced again and again without NULL checks:dsa_conduit_find_user() and many other places. In between dereferences, there is no locking to ensure that what was valid once continues to be valid.
Both problems have the common aspect that closing the conduit interface solves them.
In the first case, dev_close(conduit) triggers the NETDEV_GOING_DOWN event in dsa_user_netdevice_event() which closes user ports as well. dsa_port_disable_rt() calls phylink_stop(), which synchronously stops the phylink state machine, and ds->ops->phy_read() will thus no longer call into the driver after this point.
In the second case, dev_close(conduit) should do this, as per Documentation/networking/driver.rst:
| Quiescence | ---------- | | After the ndo_stop routine has been called, the hardware must | not receive or transmit any data. All in flight packets must | be aborted. If necessary, poll or wait for completion of | any reset commands.
So it should be sufficient to ensure that later, when we zeroize conduit->dsa_ptr, there will be no concurrent dsa_switch_rcv() call on this conduit.
The addition of the netif_device_detach() function is to ensure that ioctls, rtnetlinks and ethtool requests on the user ports no longer propagate down to the driver - we're no longer prepared to handle them.
The race condition actually did not exist when commit 0650bf52b31f ("net: dsa: be compatible with masters which unregister on shutdown") first introduced dsa_switch_shutdown(). It was created later, when we stopped unregistering the user interfaces from a bad spot, and we just replaced that sequence with a racy zeroization of conduit->dsa_ptr (one which doesn't ensure that the interfaces aren't up).
--- net/dsa/dsa.c | 7 +++++++ 1 file changed, 7 insertions(+)
net/dsa/dsa.c +7 -0
@@ -1577,6 +1577,7 @@ EXPORT_SYMBOL_GPL(dsa_unregister_switch);void dsa_switch_shutdown (struct dsa_switch *ds) {struct net_device *conduit, *user_dev; +LIST_HEAD (close_list);struct dsa_port *dp;mutex_lock (&dsa2_mutex);
@@ -1586,10 +1587,16 @@ void dsa_switch_shutdown(struct dsa_switch *ds)rtnl_lock (); +dsa_switch_for_each_cpu_port (dp, ds) +list_add (&dp->conduit->close_list, &close_list); + +dev_close_many (&close_list, true); +dsa_switch_for_each_user_port (dp, ds) { conduit =dsa_port_to_conduit (dp); user_dev = dp->user; +netif_device_detach (user_dev);netdev_upper_dev_unlink (conduit, user_dev); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/558 net: Add netif_get_gro_max_size helper for GRO
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit e8d4d34df715133c319fabcf63fdec684be75ff8 ]
Add a small netif_get_gro_max_size() helper which returns the maximum IPv4 or IPv6 GRO size of the netdevice.
We later add a netif_get_gso_max_size() equivalent as well for GSO, so that these helpers can be used consistently instead of open-coded checks.
Stable-dep-of: e609c959a939 ("net: Fix gso_features_check to check for both dev->gso_{ipv4_,}max_size")
--- include/linux/netdevice.h | 9 +++++++++ net/core/gro.c | 9 ++------- 2 files changed, 11 insertions(+), 7 deletions(-)
include/linux/netdevice.h +9 -0
@@ -5026,6 +5026,15 @@ void netif_set_tso_max_segs(struct net_device *dev, unsigned int segs);void netif_inherit_tso_max (struct net_device *to,const struct net_device *from); +static inline unsigned int +netif_get_gro_max_size (const struct net_device *dev,const struct sk_buff *skb) +{ +/* pairs with WRITE_ONCE() in netif_set_gro(_ipv4)_max_size() */ +return skb->protocol ==htons (ETH_P_IPV6 ) ? +READ_ONCE (dev->gro_max_size) : +READ_ONCE (dev->gro_ipv4_max_size); +} +static inline bool netif_is_macsec (const struct net_device *dev) {return dev->priv_flags &IFF_MACSEC ;
net/core/gro.c +2 -7
@@ -98,7 +98,6 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)unsigned int headlen =skb_headlen (skb);unsigned int len =skb_gro_len (skb);unsigned int delta_truesize; -unsigned int gro_max_size;unsigned int new_truesize;struct sk_buff *lp;int segs;
@@ -112,12 +111,8 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)if (p->pp_recycle != skb->pp_recycle)return -ETOOMANYREFS ; -/* pairs with WRITE_ONCE() in netif_set_gro(_ipv4)_max_size() */ - gro_max_size = p->protocol ==htons (ETH_P_IPV6 ) ? -READ_ONCE (p->dev->gro_max_size) : -READ_ONCE (p->dev->gro_ipv4_max_size); - -if (unlikely (p->len + len >= gro_max_size ||NAPI_GRO_CB (skb)->flush)) +if (unlikely (p->len + len >=netif_get_gro_max_size (p->dev, p) || +NAPI_GRO_CB (skb)->flush))return -E2BIG ;if (unlikely (p->len + len >=GRO_LEGACY_MAX_SIZE )) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/558 net: Fix gso_features_check to check for both dev->gso_{ipv4_,}max_size
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit e609c959a939660c7519895f853dfa5624c6827a ]
Commit 24ab059d2ebd ("net: check dev->gso_max_size in gso_features_check()") added a dev->gso_max_size test to gso_features_check() in order to fall back to GSO when needed.
This was added as it was noticed that some drivers could misbehave if TSO packets get too big. However, the check doesn't respect dev->gso_ipv4_max_size limit. For instance, a device could be configured with BIG TCP for IPv4, but not IPv6.
Therefore, add a netif_get_gso_max_size() equivalent to netif_get_gro_max_size() and use the helper to respect both limits before falling back to GSO engine.
--- include/linux/netdevice.h | 9 +++++++++ net/core/dev.c | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-)
include/linux/netdevice.h +9 -0
@@ -5035,6 +5035,15 @@ netif_get_gro_max_size(const struct net_device *dev, const struct sk_buff *skb)READ_ONCE (dev->gro_ipv4_max_size); } +static inline unsigned int +netif_get_gso_max_size (const struct net_device *dev,const struct sk_buff *skb) +{ +/* pairs with WRITE_ONCE() in netif_set_gso(_ipv4)_max_size() */ +return skb->protocol ==htons (ETH_P_IPV6 ) ? +READ_ONCE (dev->gso_max_size) : +READ_ONCE (dev->gso_ipv4_max_size); +} +static inline bool netif_is_macsec (const struct net_device *dev) {return dev->priv_flags &IFF_MACSEC ;
net/core/dev.c +1 -1
@@ -3504,7 +3504,7 @@ static netdev_features_t gso_features_check(const struct sk_buff *skb,if (gso_segs >READ_ONCE (dev->gso_max_segs))return features & ~NETIF_F_GSO_MASK ; -if (unlikely (skb->len >=READ_ONCE (dev->gso_max_size))) +if (unlikely (skb->len >=netif_get_gso_max_size (dev, skb)))return features & ~NETIF_F_GSO_MASK ;if (!skb_shinfo (skb)->gso_type) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/558 net: ethernet: lantiq_etop: fix memory disclosure
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit 45c0de18ff2dc9af01236380404bbd6a46502c69 ]
When applying padding, the buffer is not zeroed, which results in memory disclosure. The mentioned data is observed on the wire. This patch uses skb_put_padto() to pad Ethernet frames properly. The mentioned function zeroes the expanded buffer.
In case the packet cannot be padded it is silently dropped. Statistics are also not incremented. This driver does not support statistics in the old 32-bit format or the new 64-bit format. These will be added in the future. In its current form, the patch should be easily backported to stable versions.
Ethernet MACs on Amazon-SE and Danube cannot do padding of the packets in hardware, so software padding must be applied.
--- drivers/net/ethernet/lantiq_etop.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/lantiq_etop.c +3 -1
@@ -482,7 +482,9 @@ ltq_etop_tx(struct sk_buff *skb, struct net_device *dev)unsigned long flags;u32 byte_offset; - len = skb->len <ETH_ZLEN ?ETH_ZLEN : skb->len; +if (skb_put_padto (skb,ETH_ZLEN )) +return NETDEV_TX_OK ; + len = skb->len;if ((desc->ctl & (LTQ_DMA_OWN |LTQ_DMA_C )) || ch->skb[ch->dma.desc]) {netdev_err (dev,"tx ring full\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/558 net: fec: Restart PPS after link state change
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Csókás, Bence <[email protected]>
[ Upstream commit a1477dc87dc4996dcf65a4893d4e2c3a6b593002 ]
On link state change, the controller gets reset,
causing PPS to drop out. Re-enable PPS if it was
enabled before the controller reset.
--- drivers/net/ethernet/freescale/fec.h | 6 +++++ drivers/net/ethernet/freescale/fec_main.c | 11 ++++++++- drivers/net/ethernet/freescale/fec_ptp.c | 30 +++++++++++++++++++++++ 3 files changed, 46 insertions(+), 1 deletion(-)
drivers/net/ethernet/freescale/fec.h +6 -0
@@ -691,10 +691,16 @@ struct fec_enet_private {/* XDP BPF Program */ struct bpf_prog *xdp_prog; +struct { +int pps_enable; + } ptp_saved_state; +u64 ethtool_stats[]; };void fec_ptp_init (struct platform_device *pdev,int irq_idx); +void fec_ptp_restore_state (struct fec_enet_private *fep); +void fec_ptp_save_state (struct fec_enet_private *fep);void fec_ptp_stop (struct platform_device *pdev);void fec_ptp_start_cyclecounter (struct net_device *ndev); int fec_ptp_set(struct net_device *ndev, struct kernel_hwtstamp_config *config,
drivers/net/ethernet/freescale/fec_main.c +10 -1
@@ -1077,6 +1077,8 @@ fec_restart(struct net_device *ndev)u32 rcntl =OPT_FRAME_SIZE |0x04 ;u32 ecntl =FEC_ECR_ETHEREN ; +fec_ptp_save_state (fep); +/* Whack a reset. We should wait for this. * For i.MX6SX SOC, enet use AXI bus, we use disable MAC * instead of reset MAC itself.
@@ -1244,8 +1246,10 @@ fec_restart(struct net_device *ndev)writel (ecntl, fep->hwp +FEC_ECNTRL );fec_enet_active_rxring (ndev); -if (fep->bufdesc_ex) +if (fep->bufdesc_ex) {fec_ptp_start_cyclecounter (ndev); +fec_ptp_restore_state (fep); + }/* Enable interrupts we wish to service */ if (fep->link)
@@ -1336,6 +1340,8 @@ fec_stop(struct net_device *ndev)netdev_err (ndev,"Graceful transmit stop did not complete!\n" ); } +fec_ptp_save_state (fep); +/* Whack a reset. We should wait for this. * For i.MX6SX SOC, enet use AXI bus, we use disable MAC * instead of reset MAC itself.
@@ -1366,6 +1372,9 @@ fec_stop(struct net_device *ndev) val =readl (fep->hwp +FEC_ECNTRL ); val |=FEC_ECR_EN1588 ;writel (val, fep->hwp +FEC_ECNTRL ); + +fec_ptp_start_cyclecounter (ndev); +fec_ptp_restore_state (fep); } }
drivers/net/ethernet/freescale/fec_ptp.c +30 -0
@@ -770,6 +770,36 @@ void fec_ptp_init(struct platform_device *pdev, int irq_idx)schedule_delayed_work (&fep->time_keep,HZ ); } +void fec_ptp_save_state (struct fec_enet_private *fep) +{ +unsigned long flags; + +spin_lock_irqsave (&fep->tmreg_lock, flags); + + fep->ptp_saved_state.pps_enable = fep->pps_enable; + +spin_unlock_irqrestore (&fep->tmreg_lock, flags); +} + +/* Restore PTP functionality after a reset */ +void fec_ptp_restore_state (struct fec_enet_private *fep) +{ +unsigned long flags; + +spin_lock_irqsave (&fep->tmreg_lock, flags); + +/* Reset turned it off, so adjust our status flag */ + fep->pps_enable =0 ; + +spin_unlock_irqrestore (&fep->tmreg_lock, flags); + +/* Restart PPS if needed */ +if (fep->ptp_saved_state.pps_enable) { +/* Re-enable PPS */ +fec_ptp_enable_pps (fep,1 ); + } +} +void fec_ptp_stop (struct platform_device *pdev) {struct net_device *ndev =platform_get_drvdata (pdev);
Signature · 1 line
2.43.0
Re: [PATCH 6.11 040/558] net: fec: Restart PPS after link state change
Hi!
Quoted 12 lines · Greg Kroah-Hartman
6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Csókás, Bence <[email protected]>
[ Upstream commit
a1477dc87dc4996dcf65a4893d4e2c3a6b593002]On link state change, the controller gets reset,
causing PPS to drop out. Re-enable PPS if it was
enabled before the controller reset.
Quoted 5 lines
Fixes 6605b730c061 ("FEC: Add time stamping code and a PTP hardware clock")Signed-off-by Csókás, Bence <[email protected]>Signed-off-by Paolo Abeni <[email protected]>Signed-off-by Sasha Levin <[email protected]>
There is a patch waiting to be merged that Fixes: this commit.
Bence
Greg Kroah-Hartman
maintainerPATCH 41/558 net: fec: Reload PTP registers after link-state change
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Csókás, Bence <[email protected]>
[ Upstream commit d9335d0232d2da605585eea1518ac6733518f938 ]
On link-state change, the controller gets reset, which clears all PTP registers, including PHC time, calibrated clock correction values etc. For correct IEEE 1588 operation we need to restore these after the reset.
--- drivers/net/ethernet/freescale/fec.h | 3 +++ drivers/net/ethernet/freescale/fec_ptp.c | 20 ++++++++++++++++++++ 2 files changed, 23 insertions(+)
drivers/net/ethernet/freescale/fec.h +3 -0
@@ -693,6 +693,9 @@ struct fec_enet_private {struct {int pps_enable; +u64 ns_sys, ns_phc; +u32 at_corr; +u8 at_inc_corr; } ptp_saved_state;u64 ethtool_stats[];
drivers/net/ethernet/freescale/fec_ptp.c +20 -0
@@ -773,24 +773,44 @@ void fec_ptp_init(struct platform_device *pdev, int irq_idx)void fec_ptp_save_state (struct fec_enet_private *fep) {unsigned long flags; +u32 atime_inc_corr;spin_lock_irqsave (&fep->tmreg_lock, flags); fep->ptp_saved_state.pps_enable = fep->pps_enable; + fep->ptp_saved_state.ns_phc =timecounter_read (&fep->tc); + fep->ptp_saved_state.ns_sys =ktime_get_ns (); + + fep->ptp_saved_state.at_corr =readl (fep->hwp +FEC_ATIME_CORR ); + atime_inc_corr =readl (fep->hwp +FEC_ATIME_INC ) &FEC_T_INC_CORR_MASK ; + fep->ptp_saved_state.at_inc_corr = (u8)(atime_inc_corr >>FEC_T_INC_CORR_OFFSET ); +spin_unlock_irqrestore (&fep->tmreg_lock, flags); }/* Restore PTP functionality after a reset */ void fec_ptp_restore_state (struct fec_enet_private *fep) { +u32 atime_inc =readl (fep->hwp +FEC_ATIME_INC ) &FEC_T_INC_MASK ;unsigned long flags; +u32 counter; +u64 ns;spin_lock_irqsave (&fep->tmreg_lock, flags);/* Reset turned it off, so adjust our status flag */ fep->pps_enable =0 ; +writel (fep->ptp_saved_state.at_corr, fep->hwp +FEC_ATIME_CORR ); + atime_inc |= ((u32 )fep->ptp_saved_state.at_inc_corr) <<FEC_T_INC_CORR_OFFSET ; +writel (atime_inc, fep->hwp +FEC_ATIME_INC ); + + ns =ktime_get_ns () - fep->ptp_saved_state.ns_sys + fep->ptp_saved_state.ns_phc; + counter = ns & fep->cc.mask; +writel (counter, fep->hwp +FEC_ATIME ); +timecounter_init (&fep->tc, &fep->cc, ns); +spin_unlock_irqrestore (&fep->tmreg_lock, flags);/* Restart PPS if needed */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/558 net: avoid potential underflow in qdisc_pkt_len_init() with UFO
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit c20029db28399ecc50e556964eaba75c43b1e2f1 ]
After commit 7c6d2ecbda83 ("net: be more gentle about silly gso requests coming from user") virtio_net_hdr_to_skb() had sanity check to detect malicious attempts from user space to cook a bad GSO packet.
Then commit cf9acc90c80ec ("net: virtio_net_hdr_to_skb: count transport header in UFO") while fixing one issue, allowed user space to cook a GSO packet with the following characteristic :
IPv4 SKB_GSO_UDP, gso_size=3, skb->len = 28.
When this packet arrives in qdisc_pkt_len_init(), we end up with hdr_len = 28 (IPv4 header + UDP header), matching skb->len
Then the following sets gso_segs to 0 :
gso_segs = DIV_ROUND_UP(skb->len - hdr_len,
shinfo->gso_size);
Then later we set qdisc_skb_cb(skb)->pkt_len to back to zero :/
qdisc_skb_cb(skb)->pkt_len += (gso_segs - 1) * hdr_len;
This leads to the following crash in fq_codel [1]
qdisc_pkt_len_init() is best effort, we only want an estimation of the bytes sent on the wire, not crashing the kernel.
This patch is fixing this particular issue, a following one adds more sanity checks for another potential bug.
[1]
[ 70.724101] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 70.724561] #PF: supervisor read access in kernel mode [ 70.724561] #PF: error_code(0x0000) - not-present page [ 70.724561] PGD 10ac61067 P4D 10ac61067 PUD 107ee2067 PMD 0 [ 70.724561] Oops: Oops: 0000 [#1] SMP NOPTI [ 70.724561] CPU: 11 UID: 0 PID: 2163 Comm: b358537762 Not tainted 6.11.0-virtme #991 [ 70.724561] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.724561] RIP: 0010:fq_codel_enqueue (net/sched/sch_fq_codel.c:120 net/sched/sch_fq_codel.c:168 net/sched/sch_fq_codel.c:230) sch_fq_codel [ 70.724561] Code: 24 08 49 c1 e1 06 44 89 7c 24 18 45 31 ed 45 31 c0 31 ff 89 44 24 14 4c 03 8b 90 01 00 00 eb 04 39 ca 73 37 4d 8b 39 83 c7 01 <49> 8b 17 49 89 11 41 8b 57 28 45 8b 5f 34 49 c7 07 00 00 00 00 49 All code ======== 0: 24 08 and $0x8,%al 2: 49 c1 e1 06 shl $0x6,%r9 6: 44 89 7c 24 18 mov %r15d,0x18(%rsp) b: 45 31 ed xor %r13d,%r13d e: 45 31 c0 xor %r8d,%r8d 11: 31 ff xor %edi,%edi 13: 89 44 24 14 mov %eax,0x14(%rsp) 17: 4c 03 8b 90 01 00 00 add 0x190(%rbx),%r9 1e: eb 04 jmp 0x24 20: 39 ca cmp %ecx,%edx 22: 73 37 jae 0x5b 24: 4d 8b 39 mov (%r9),%r15 27: 83 c7 01 add $0x1,%edi 2a:* 49 8b 17 mov (%r15),%rdx <-- trapping instruction 2d: 49 89 11 mov %rdx,(%r9) 30: 41 8b 57 28 mov 0x28(%r15),%edx 34: 45 8b 5f 34 mov 0x34(%r15),%r11d 38: 49 c7 07 00 00 00 00 movq $0x0,(%r15)
3f: 49 rex.WB
Code starting with the faulting instruction
===========================================
0: 49 8b 17 mov (%r15),%rdx 3: 49 89 11 mov %rdx,(%r9) 6: 41 8b 57 28 mov 0x28(%r15),%edx a: 45 8b 5f 34 mov 0x34(%r15),%r11d e: 49 c7 07 00 00 00 00 movq $0x0,(%r15) 15: 49 rex.WB [ 70.724561] RSP: 0018:ffff95ae85e6fb90 EFLAGS: 00000202 [ 70.724561] RAX: 0000000002000000 RBX: ffff95ae841de000 RCX: 0000000000000000 [ 70.724561] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 70.724561] RBP: ffff95ae85e6fbf8 R08: 0000000000000000 R09: ffff95b710a30000 [ 70.724561] R10: 0000000000000000 R11: bdf289445ce31881 R12: ffff95ae85e6fc58 [ 70.724561] R13: 0000000000000000 R14: 0000000000000040 R15: 0000000000000000 [ 70.724561] FS: 000000002c5c1380(0000) GS:ffff95bd7fcc0000(0000) knlGS:0000000000000000 [ 70.724561] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 70.724561] CR2: 0000000000000000 CR3: 000000010c568000 CR4: 00000000000006f0 [ 70.724561] Call Trace: [ 70.724561] <TASK> [ 70.724561] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434) [ 70.724561] ? page_fault_oops (arch/x86/mm/fault.c:715) [ 70.724561] ? exc_page_fault (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:147 arch/x86/mm/fault.c:1489 arch/x86/mm/fault.c:1539) [ 70.724561] ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:623) [ 70.724561] ? fq_codel_enqueue (net/sched/sch_fq_codel.c:120 net/sched/sch_fq_codel.c:168 net/sched/sch_fq_codel.c:230) sch_fq_codel [ 70.724561] dev_qdisc_enqueue (net/core/dev.c:3784) [ 70.724561] __dev_queue_xmit (net/core/dev.c:3880 (discriminator 2) net/core/dev.c:4390 (discriminator 2)) [ 70.724561] ? irqentry_enter (kernel/entry/common.c:237) [ 70.724561] ? sysvec_apic_timer_interrupt (./arch/x86/include/asm/hardirq.h:74 (discriminator 2) arch/x86/kernel/apic/apic.c:1043 (discriminator 2) arch/x86/kernel/apic/apic.c:1043 (discriminator 2)) [ 70.724561] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:58 (discriminator 4)) [ 70.724561] ? asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:702) [ 70.724561] ? virtio_net_hdr_to_skb.constprop.0 (./include/linux/virtio_net.h:129 (discriminator 1)) [ 70.724561] packet_sendmsg (net/packet/af_packet.c:3145 (discriminator 1) net/packet/af_packet.c:3177 (discriminator 1)) [ 70.724561] ? _raw_spin_lock_bh (./arch/x86/include/asm/atomic.h:107 (discriminator 4) ./include/linux/atomic/atomic-arch-fallback.h:2170 (discriminator 4) ./include/linux/atomic/atomic-instrumented.h:1302 (discriminator 4) ./include/asm-generic/qspinlock.h:111 (discriminator 4) ./include/linux/spinlock.h:187 (discriminator 4) ./include/linux/spinlock_api_smp.h:127 (discriminator 4) kernel/locking/spinlock.c:178 (discriminator 4)) [ 70.724561] ? netdev_name_node_lookup_rcu (net/core/dev.c:325 (discriminator 1)) [ 70.724561] __sys_sendto (net/socket.c:730 (discriminator 1) net/socket.c:745 (discriminator 1) net/socket.c:2210 (discriminator 1)) [ 70.724561] ? __sys_setsockopt (./include/linux/file.h:34 net/socket.c:2355) [ 70.724561] __x64_sys_sendto (net/socket.c:2222 (discriminator 1) net/socket.c:2218 (discriminator 1) net/socket.c:2218 (discriminator 1)) [ 70.724561] do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1)) [ 70.724561] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 70.724561] RIP: 0033:0x41ae09
--- net/core/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/dev.c +1 -1
@@ -3750,7 +3750,7 @@ static void qdisc_pkt_len_init(struct sk_buff *skb) sizeof(_tcphdr), &_tcphdr);if (likely (th)) hdr_len +=__tcp_hdrlen (th); - }else { + }else if (shinfo->gso_type &SKB_GSO_UDP_L4 ) {struct udphdr _udphdr; if (skb_header_pointer(skb, hdr_len,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/558 net: add more sanity checks to qdisc_pkt_len_init()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit ab9a9a9e9647392a19e7a885b08000e89c86b535 ]
One path takes care of SKB_GSO_DODGY, assumingskb->len is bigger than hdr_len.
virtio_net_hdr_to_skb() does not fully dissect TCP headers, it only make sure it is at least 20 bytes.
It is possible for an user to provide a malicious 'GSO' packet, total length of 80 bytes.
- 20 bytes of IPv4 header
- 60 bytes TCP header
- a small gso_size like 8
virtio_net_hdr_to_skb() would declare this packet as a normal GSO packet, because it would see 40 bytes of payload, bigger than gso_size.
We need to make detect this case to not underflow
qdisc_skb_cb(skb)->pkt_len.
--- net/core/dev.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/core/dev.c +7 -3
@@ -3758,10 +3758,14 @@ static void qdisc_pkt_len_init(struct sk_buff *skb) hdr_len +=sizeof (struct udphdr ); } -if (shinfo->gso_type &SKB_GSO_DODGY ) - gso_segs =DIV_ROUND_UP (skb->len - hdr_len, - shinfo->gso_size); +if (unlikely (shinfo->gso_type &SKB_GSO_DODGY )) { +int payload = skb->len - hdr_len; +/* Malicious packet. */ +if (payload <=0 ) +return ; + gso_segs =DIV_ROUND_UP (payload, shinfo->gso_size); + }qdisc_skb_cb (skb)->pkt_len += (gso_segs -1 ) * hdr_len; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/558 net: stmmac: dwmac4: extend timeout for VLAN Tag register busy bit check
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shenwei Wang <[email protected]>
[ Upstream commit 4c1b56671b68ffcbe6b78308bfdda6bcce6491ae ]
Increase the timeout for checking the busy bit of the VLAN Tag register from 10µs to 500ms. This change is necessary to accommodate scenarios where Energy Efficient Ethernet (EEE) is enabled.
Overnight testing revealed that when EEE is active, the busy bit can remain set for up to approximately 300ms. The new 500ms timeout provides a safety margin.
--- .../net/ethernet/stmicro/stmmac/dwmac4_core.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +9 -9
@@ -14,6 +14,7 @@#include <linux/slab.h> #include <linux/ethtool.h> #include <linux/io.h> +#include <linux/iopoll.h> #include "stmmac.h" #include "stmmac_pcs.h" #include "dwmac4.h"
@@ -475,7 +476,7 @@ static int dwmac4_write_vlan_filter(struct net_device *dev, u8 index, u32 data) { void __iomem *ioaddr = (void __iomem *)dev->base_addr; -int i, timeout =10 ; +int ret;u32 val;if (index >= hw->num_vlan)
@@ -491,16 +492,15 @@ static int dwmac4_write_vlan_filter(struct net_device *dev,writel (val, ioaddr +GMAC_VLAN_TAG ); -for (i =0 ; i < timeout; i++) { - val =readl (ioaddr +GMAC_VLAN_TAG ); -if (!(val &GMAC_VLAN_TAG_CTRL_OB )) -return 0 ; -udelay (1 ); + ret =readl_poll_timeout (ioaddr +GMAC_VLAN_TAG , val, + !(val &GMAC_VLAN_TAG_CTRL_OB ), +1000 ,500000 ); +if (ret) { +netdev_err (dev,"Timeout accessing MAC_VLAN_Tag_Filter\n" ); +return -EBUSY ; } -netdev_err (dev,"Timeout accessing MAC_VLAN_Tag_Filter\n" ); - -return -EBUSY ; +return 0 ; } static int dwmac4_add_hw_vlan_rx_fltr(struct net_device *dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/558 ipv4: ip_gre: Fix drops of small packets in ipgre_xmit
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Danilov <[email protected]>
[ Upstream commit c4a14f6d9d17ad1e41a36182dd3b8a5fd91efbd7 ]
Regression Description:
Depending on the options specified for the GRE tunnel device, small packets may be dropped. This occurs because the pskb_network_may_pull function fails due to the packet's insufficient length.
For example, if only the okey option is specified for the tunnel device, original (before encapsulation) packets smaller than 28 bytes (including the IPv4 header) will be dropped. This happens because the required length is calculated relative to the network header, not the skb->head.
Here is how the required length is computed and checked:
* The pull_len variable is set to 28 bytes, consisting of:
* IPv4 header: 20 bytes
* GRE header with Key field: 8 bytes
* The pskb_network_may_pull function adds the network offset, shifting the checkable space further to the beginning of the network header and extending it to the beginning of the packet. As a result, the end of the checkable space occurs beyond the actual end of the packet.
Instead of ensuring that 28 bytes are present in skb->head, the function is requesting these 28 bytes starting from the network header. For small packets, this requested length exceeds the actual packet size, causing the check to fail and the packets to be dropped.
This issue affects both locally originated and forwarded packets in DMVPN-like setups.
How to reproduce (for local originated packets):
ip link add dev gre1 type gre ikey 1.9.8.4 okey 1.9.8.4 \
local <your-ip> remote 0.0.0.0 ip link set mtu 1400 dev gre1
ip link set up dev gre1
ip address add 192.168.13.1/24 dev gre1
ip neighbor add 192.168.13.2 lladdr <remote-ip> dev gre1 ping -s 1374 -c 10 192.168.13.2
tcpdump -vni gre1
tcpdump -vni <your-ext-iface> 'ip proto 47'
ip -s -s -d link show dev gre1
Solution:
Use the pskb_may_pull function instead the pskb_network_may_pull.
--- net/ipv4/ip_gre.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/ipv4/ip_gre.c +3 -3
@@ -661,11 +661,11 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,if (skb_cow_head (skb,0 )) goto free_skb; - tnl_params = (const struct iphdr *)skb->data; - -if (!pskb_network_may_pull (skb, pull_len)) +if (!pskb_may_pull (skb, pull_len)) goto free_skb; + tnl_params = (const struct iphdr *)skb->data; +/* ip_tunnel_xmit() needs skb->data pointing to gre header. */ skb_pull (skb, pull_len);skb_reset_mac_header (skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/558 netfs: Fix missing wakeup after issuing writes
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 1ca4169c391c370e0f3a92938df2862900575096 ]
After dividing up a proposed write into subrequests, netfslib sets NETFS_RREQ_ALL_QUEUED to indicate to the collector that it can move on to the final cleanup once it has emptied the subrequest queues.
Now, whilst the collector will normally end up running at least once after this bit is set just because it takes a while to process all the write subrequests before the collector runs out of subrequests, there exists the possibility that the issuing thread will be forced to sleep and the collector thread will clean up all the subrequests before ALL_QUEUED gets set.
In such a case, the collector thread will not get triggered again and will never clear NETFS_RREQ_IN_PROGRESS thus leaving a request uncompleted and causing a potential futute hang.
Fix this by scheduling the write collector if all the subrequest queues are empty (and thus no writes pending issuance).
Note that we'd do this ideally before queuing the subrequest, but in the case of buffered writeback, at least, we can't find out that we've run out of folios until after we've called writeback_iter() and it has returned NULL - at which point we might not actually have any subrequests still under construction.
--- fs/netfs/write_issue.c | 42 +++++++++++++++++++++++++++--------------- 1 file changed, 27 insertions(+), 15 deletions(-)
fs/netfs/write_issue.c +27 -15
@@ -494,6 +494,30 @@ static int netfs_write_folio(struct netfs_io_request *wreq,return 0 ; } +/* +* End the issuing of writes, letting the collector know we're done. +*/ +static void netfs_end_issue_write (struct netfs_io_request *wreq) +{ +bool needs_poke = true; + +smp_wmb ();/* Write subreq lists before ALL_QUEUED. */ +set_bit (NETFS_RREQ_ALL_QUEUED , &wreq->flags); + +for (int s =0 ; s <NR_IO_STREAMS ; s++) { +struct netfs_io_stream *stream = &wreq->io_streams[s]; + +if (!stream->active) +continue ; +if (!list_empty (&stream->subrequests)) + needs_poke = false; +netfs_issue_write (wreq, stream); + } + +if (needs_poke) +netfs_wake_write_collector (wreq, false); +} +/* * Write some of the pending data back to the server */
@@ -541,10 +565,7 @@ int netfs_writepages(struct address_space *mapping,break ; }while ((folio =writeback_iter (mapping, wbc, folio, &error))); -for (int s =0 ; s <NR_IO_STREAMS ; s++) -netfs_issue_write (wreq, &wreq->io_streams[s]); -smp_wmb ();/* Write lists before ALL_QUEUED. */ -set_bit (NETFS_RREQ_ALL_QUEUED , &wreq->flags); +netfs_end_issue_write (wreq);mutex_unlock (&ictx->wb_lock);
@@ -632,10 +653,7 @@ int netfs_end_writethrough(struct netfs_io_request *wreq, struct writeback_contrif (writethrough_cache)netfs_write_folio (wreq, wbc, writethrough_cache); -netfs_issue_write (wreq, &wreq->io_streams[0 ]); -netfs_issue_write (wreq, &wreq->io_streams[1 ]); -smp_wmb ();/* Write lists before ALL_QUEUED. */ -set_bit (NETFS_RREQ_ALL_QUEUED , &wreq->flags); +netfs_end_issue_write (wreq);mutex_unlock (&ictx->wb_lock);
@@ -680,13 +698,7 @@ int netfs_unbuffered_write(struct netfs_io_request *wreq, bool may_wait, size_tbreak ; } -netfs_issue_write (wreq, upload); - -smp_wmb ();/* Write lists before ALL_QUEUED. */ -set_bit (NETFS_RREQ_ALL_QUEUED , &wreq->flags); -if (list_empty (&upload->subrequests)) -netfs_wake_write_collector (wreq, false); - +netfs_end_issue_write (wreq);_leave (" = %d" , error);return error; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/558 net: test for not too small csum_start in virtio_net_hdr_to_skb()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 49d14b54a527289d09a9480f214b8c586322310a ]
syzbot was able to trigger this warning [1], after injecting a malicious packet through af_packet, setting skb->csum_start and thus the transport header to an incorrect value.
We can at least make sure the transport header is after the end of the network header (with a estimated minimal size).
[1]
[ 67.873027] skb len=4096 headroom=16 headlen=14 tailroom=0
mac=(-1,-1) mac_len=0 net=(16,-6) trans=10 shinfo(txflags=0 nr_frags=1 gso(size=0 type=0 segs=0)) csum(0xa start=10 offset=0 ip_summed=3 complete_sw=0 valid=0 level=0) hash(0x0 sw=0 l4=0) proto=0x0800 pkttype=0 iif=0 priority=0x0 mark=0x0 alloc_cpu=10 vlan_all=0x0 encapsulation=0 inner(proto=0x0000, mac=0, net=0, trans=0)
[ 67.877172] dev name=veth0_vlan feat=0x000061164fdd09e9 [ 67.877764] sk family=17 type=3 proto=0 [ 67.878279] skb linear: 00000000: 00 00 10 00 00 00 00 00 0f 00 00 00 08 00 [ 67.879128] skb frag: 00000000: 0e 00 07 00 00 00 28 00 08 80 1c 00 04 00 00 02 [ 67.879877] skb frag: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.880647] skb frag: 00000020: 00 00 02 00 00 00 08 00 1b 00 00 00 00 00 00 00 [ 67.881156] skb frag: 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.881753] skb frag: 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.882173] skb frag: 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.882790] skb frag: 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.883171] skb frag: 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.883733] skb frag: 00000080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.884206] skb frag: 00000090: 00 00 00 00 00 00 00 00 00 00 69 70 76 6c 61 6e [ 67.884704] skb frag: 000000a0: 31 00 00 00 00 00 00 00 00 00 2b 00 00 00 00 00 [ 67.885139] skb frag: 000000b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.885677] skb frag: 000000c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.886042] skb frag: 000000d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.886408] skb frag: 000000e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.887020] skb frag: 000000f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.887384] skb frag: 00000100: 00 00 [ 67.887878] ------------[ cut here ]------------ [ 67.887908] offset (-6) >= skb_headlen() (14) [ 67.888445] WARNING: CPU: 10 PID: 2088 at net/core/dev.c:3332 skb_checksum_help (net/core/dev.c:3332 (discriminator 2)) [ 67.889353] Modules linked in: macsec macvtap macvlan hsr wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 libchacha poly1305_x86_64 dummy bridge sr_mod cdrom evdev pcspkr i2c_piix4 9pnet_virtio 9p 9pnet netfs [ 67.890111] CPU: 10 UID: 0 PID: 2088 Comm: b363492833 Not tainted 6.11.0-virtme #1011 [ 67.890183] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 67.890309] RIP: 0010:skb_checksum_help (net/core/dev.c:3332 (discriminator 2)) [ 67.891043] Call Trace: [ 67.891173] <TASK> [ 67.891274] ? __warn (kernel/panic.c:741) [ 67.891320] ? skb_checksum_help (net/core/dev.c:3332 (discriminator 2)) [ 67.891333] ? report_bug (lib/bug.c:180 lib/bug.c:219) [ 67.891348] ? handle_bug (arch/x86/kernel/traps.c:239) [ 67.891363] ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1)) [ 67.891372] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) [ 67.891388] ? skb_checksum_help (net/core/dev.c:3332 (discriminator 2)) [ 67.891399] ? skb_checksum_help (net/core/dev.c:3332 (discriminator 2)) [ 67.891416] ip_do_fragment (net/ipv4/ip_output.c:777 (discriminator 1)) [ 67.891448] ? __ip_local_out (./include/linux/skbuff.h:1146 ./include/net/l3mdev.h:196 ./include/net/l3mdev.h:213 net/ipv4/ip_output.c:113) [ 67.891459] ? __pfx_ip_finish_output2 (net/ipv4/ip_output.c:200) [ 67.891470] ? ip_route_output_flow (./arch/x86/include/asm/preempt.h:84 (discriminator 13) ./include/linux/rcupdate.h:96 (discriminator 13) ./include/linux/rcupdate.h:871 (discriminator 13) net/ipv4/route.c:2625 (discriminator 13) ./include/net/route.h:141 (discriminator 13) net/ipv4/route.c:2852 (discriminator 13)) [ 67.891484] ipvlan_process_v4_outbound (drivers/net/ipvlan/ipvlan_core.c:445 (discriminator 1)) [ 67.891581] ipvlan_queue_xmit (drivers/net/ipvlan/ipvlan_core.c:542 drivers/net/ipvlan/ipvlan_core.c:604 drivers/net/ipvlan/ipvlan_core.c:670) [ 67.891596] ipvlan_start_xmit (drivers/net/ipvlan/ipvlan_main.c:227) [ 67.891607] dev_hard_start_xmit (./include/linux/netdevice.h:4916 ./include/linux/netdevice.h:4925 net/core/dev.c:3588 net/core/dev.c:3604) [ 67.891620] __dev_queue_xmit (net/core/dev.h:168 (discriminator 25) net/core/dev.c:4425 (discriminator 25)) [ 67.891630] ? skb_copy_bits (./include/linux/uaccess.h:233 (discriminator 1) ./include/linux/uaccess.h:260 (discriminator 1) ./include/linux/highmem-internal.h:230 (discriminator 1) net/core/skbuff.c:3018 (discriminator 1)) [ 67.891645] ? __pskb_pull_tail (net/core/skbuff.c:2848 (discriminator 4)) [ 67.891655] ? skb_partial_csum_set (net/core/skbuff.c:5657) [ 67.891666] ? virtio_net_hdr_to_skb.constprop.0 (./include/linux/skbuff.h:2791 (discriminator 3) ./include/linux/skbuff.h:2799 (discriminator 3) ./include/linux/virtio_net.h:109 (discriminator 3)) [ 67.891684] packet_sendmsg (net/packet/af_packet.c:3145 (discriminator 1) net/packet/af_packet.c:3177 (discriminator 1)) [ 67.891700] ? _raw_spin_lock_bh (./arch/x86/include/asm/atomic.h:107 (discriminator 4) ./include/linux/atomic/atomic-arch-fallback.h:2170 (discriminator 4) ./include/linux/atomic/atomic-instrumented.h:1302 (discriminator 4) ./include/asm-generic/qspinlock.h:111 (discriminator 4) ./include/linux/spinlock.h:187 (discriminator 4) ./include/linux/spinlock_api_smp.h:127 (discriminator 4) kernel/locking/spinlock.c:178 (discriminator 4)) [ 67.891716] __sys_sendto (net/socket.c:730 (discriminator 1) net/socket.c:745 (discriminator 1) net/socket.c:2210 (discriminator 1)) [ 67.891734] ? do_sock_setsockopt (net/socket.c:2335) [ 67.891747] ? __sys_setsockopt (./include/linux/file.h:34 net/socket.c:2355) [ 67.891761] __x64_sys_sendto (net/socket.c:2222 (discriminator 1) net/socket.c:2218 (discriminator 1) net/socket.c:2218 (discriminator 1)) [ 67.891772] do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1)) [ 67.891785] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
--- include/linux/virtio_net.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
include/linux/virtio_net.h +3 -1
@@ -103,8 +103,10 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,if (!skb_partial_csum_set (skb, start, off))return -EINVAL ; +if (skb_transport_offset (skb) < nh_min_len) +return -EINVAL ; - nh_min_len =max_t (u32, nh_min_len,skb_transport_offset (skb)); + nh_min_len =skb_transport_offset (skb); p_off = nh_min_len + thlen;if (!pskb_may_pull (skb, p_off))return -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/558 ppp: do not assume bh is held in ppp_channel_bridge_input()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit aec7291003df78cb71fd461d7b672912bde55807 ]
Networking receive path is usually handled from BH handler. However, some protocols need to acquire the socket lock, and packets might be stored in the socket backlog is the socket was owned by a user process.
In this case, release_sock(), __release_sock(), and sk_backlog_rcv() might call the sk->sk_backlog_rcv() handler in process context.
sybot caught ppp was not considering this case inppp_channel_bridge_input() :
WARNING: inconsistent lock state
6.11.0-rc7-syzkaller-g5f5673607153 #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
ksoftirqd/1/24 [HC0[0]:SC1[1]:HE1:SE0] takes:
ffff0000db7f11e0 (&pch->downl){+.?.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff0000db7f11e0 (&pch->downl){+.?.}-{2:2}, at: ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline] ffff0000db7f11e0 (&pch->downl){+.?.}-{2:2}, at: ppp_input+0x16c/0x854 drivers/net/ppp/ppp_generic.c:2304
{SOFTIRQ-ON-W} state was registered at:
lock_acquire+0x240/0x728 kernel/locking/lockdep.c:5759 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline] ppp_input+0x16c/0x854 drivers/net/ppp/ppp_generic.c:2304 pppoe_rcv_core+0xfc/0x314 drivers/net/ppp/pppoe.c:379 sk_backlog_rcv include/net/sock.h:1111 [inline] __release_sock+0x1a8/0x3d8 net/core/sock.c:3004 release_sock+0x68/0x1b8 net/core/sock.c:3558 pppoe_sendmsg+0xc8/0x5d8 drivers/net/ppp/pppoe.c:903 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x374/0x4f4 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __arm64_sys_sendto+0xd8/0xf8 net/socket.c:2212 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 irq event stamp: 282914 hardirqs last enabled at (282914): [<ffff80008b42e30c>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (282914): [<ffff80008b42e30c>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:194 hardirqs last disabled at (282913): [<ffff80008b42e13c>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (282913): [<ffff80008b42e13c>] _raw_spin_lock_irqsave+0x2c/0x7c kernel/locking/spinlock.c:162 softirqs last enabled at (282904): [<ffff8000801f8e88>] softirq_handle_end kernel/softirq.c:400 [inline] softirqs last enabled at (282904): [<ffff8000801f8e88>] handle_softirqs+0xa3c/0xbfc kernel/softirq.c:582 softirqs last disabled at (282909): [<ffff8000801fbdf8>] run_ksoftirqd+0x70/0x158 kernel/softirq.c:928
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&pch->downl);
<Interrupt>
lock(&pch->downl);*** DEADLOCK ***
1 lock held by ksoftirqd/1/24:
#0: ffff80008f74dfa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:325
stack backtrace: CPU: 1 UID: 0 PID: 24 Comm: ksoftirqd/1 Not tainted 6.11.0-rc7-syzkaller-g5f5673607153 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call trace: dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:319 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:326 __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:119 dump_stack+0x1c/0x28 lib/dump_stack.c:128 print_usage_bug+0x698/0x9ac kernel/locking/lockdep.c:4000 mark_lock_irq+0x980/0xd2c mark_lock+0x258/0x360 kernel/locking/lockdep.c:4677 __lock_acquire+0xf48/0x779c kernel/locking/lockdep.c:5096 lock_acquire+0x240/0x728 kernel/locking/lockdep.c:5759 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline] ppp_input+0x16c/0x854 drivers/net/ppp/ppp_generic.c:2304 ppp_async_process+0x98/0x150 drivers/net/ppp/ppp_async.c:495 tasklet_action_common+0x318/0x3f4 kernel/softirq.c:785 tasklet_action+0x68/0x8c kernel/softirq.c:811 handle_softirqs+0x2e4/0xbfc kernel/softirq.c:554 run_ksoftirqd+0x70/0x158 kernel/softirq.c:928 smpboot_thread_fn+0x4b0/0x90c kernel/smpboot.c:164 kthread+0x288/0x310 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
--- drivers/net/ppp/ppp_generic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ppp/ppp_generic.c +2 -2
@@ -2269,7 +2269,7 @@ static bool ppp_channel_bridge_input(struct channel *pch, struct sk_buff *skb)if (!pchb) goto out_rcu; -spin_lock (&pchb->downl); +spin_lock_bh (&pchb->downl);if (!pchb->chan) {/* channel got unregistered */ kfree_skb (skb);
@@ -2281,7 +2281,7 @@ static bool ppp_channel_bridge_input(struct channel *pch, struct sk_buff *skb)kfree_skb (skb); outl: -spin_unlock (&pchb->downl); +spin_unlock_bh (&pchb->downl); out_rcu:rcu_read_unlock ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/558 net: phy: realtek: Check the index value in led_hw_control_get
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <[email protected]>
[ Upstream commit c283782fc5d60c4d8169137c6f955aa3553d3b3d ]
Just like rtl8211f_led_hw_is_supported() and rtl8211f_led_hw_control_set(), the rtl8211f_led_hw_control_get() also needs to check the index value, otherwise the caller is likely to get an incorrect rules.
--- drivers/net/phy/realtek.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/phy/realtek.c +3 -0
@@ -527,6 +527,9 @@ static int rtl8211f_led_hw_control_get(struct phy_device *phydev, u8 index, {int val; +if (index >=RTL8211F_LED_COUNT ) +return -EINVAL ; + val =phy_read_paged (phydev,0xd04 ,RTL8211F_LEDCR );if (val <0 )return val;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/558 bridge: mcast: Fail MDB get request on empty entry
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 555f45d24ba7cd5527716553031641cdebbe76c7 ]
When user space deletes a port from an MDB entry, the port is removed synchronously. If this was the last port in the entry and the entry is not joined by the host itself, then the entry is scheduled for deletion via a timer.
The above means that it is possible for the MDB get netlink request to retrieve an empty entry which is scheduled for deletion. This is problematic as after deleting the last port in an entry, user space cannot rely on a non-zero return code from the MDB get request as an indication that the port was successfully removed.
Fix by returning an error when the entry's port list is empty and the entry is not joined by the host.
--- net/bridge/br_mdb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bridge/br_mdb.c +1 -1
@@ -1674,7 +1674,7 @@ int br_mdb_get(struct net_device *dev, struct nlattr *tb[], u32 portid, u32 seq,spin_lock_bh (&br->multicast_lock); mp =br_mdb_ip_get (br, &group); -if (!mp) { +if (!mp || (!mp->ports && !mp->host_joined)) {NL_SET_ERR_MSG_MOD (extack,"MDB entry not found" ); err = -ENOENT ; goto unlock;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/558 net/ncsi: Disable the ncsi work before freeing the associated structure
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eddie James <[email protected]>
[ Upstream commit a0ffa68c70b367358b2672cdab6fa5bc4c40de2c ]
The work function can run after the ncsi device is freed, resulting in use-after-free bugs or kernel panic.
--- net/ncsi/ncsi-manage.c | 2 ++ 1 file changed, 2 insertions(+)
net/ncsi/ncsi-manage.c +2 -0
@@ -1954,6 +1954,8 @@ void ncsi_unregister_dev(struct ncsi_dev *nd)list_del_rcu (&ndp->node);spin_unlock_irqrestore (&ncsi_dev_lock, flags); +disable_work_sync (&ndp->work); +kfree (ndp); }EXPORT_SYMBOL_GPL (ncsi_unregister_dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/558 iomap: constrain the file range passed to iomap_file_unshare
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <[email protected]>
[ Upstream commit a311a08a4237241fb5b9d219d3e33346de6e83e0 ]
File contents can only be shared (i.e. reflinked) below EOF, so it makes no sense to try to unshare ranges beyond EOF. Constrain the file range parameters here so that we don't have to do that in the callers.
--- fs/dax.c | 6 +++++- fs/iomap/buffered-io.c | 6 +++++- 2 files changed, 10 insertions(+), 2 deletions(-)
fs/dax.c +5 -1
@@ -1305,11 +1305,15 @@ int dax_file_unshare(struct inode *inode, loff_t pos, loff_t len,struct iomap_iter iter = { .inode = inode, .pos = pos, - .len = len, .flags =IOMAP_WRITE |IOMAP_UNSHARE |IOMAP_DAX , }; +loff_t size =i_size_read (inode);int ret; +if (pos <0 || pos >= size) +return 0 ; + + iter.len =min (len, size - pos);while ((ret =iomap_iter (&iter, ops)) >0 ) iter.processed =dax_unshare_iter (&iter);return ret;
fs/iomap/buffered-io.c +5 -1
@@ -1382,11 +1382,15 @@ iomap_file_unshare(struct inode *inode, loff_t pos, loff_t len,struct iomap_iter iter = { .inode = inode, .pos = pos, - .len = len, .flags =IOMAP_WRITE |IOMAP_UNSHARE , }; +loff_t size =i_size_read (inode);int ret; +if (pos <0 || pos >= size) +return 0 ; + + iter.len =min (len, size - pos);while ((ret =iomap_iter (&iter, ops)) >0 ) iter.processed =iomap_unshare_iter (&iter);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/558 dt-bindings: net: xlnx,axi-ethernet: Add missing reg minItems
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ravikanth Tuniki <[email protected]>
[ Upstream commit c6929644c1e0d6108e57061d427eb966e1746351 ]
Add missing reg minItems as based on current binding document only ethernet MAC IO space is a supported configuration.
There is a bug in schema, current examples contain 64-bit addressing as well as 32-bit addressing. The schema validation does pass incidentally considering one 64-bit reg address as two 32-bit reg address entries. If we change axi_ethernet_eth1 example node reg addressing to 32-bit schema validation reports:
Documentation/devicetree/bindings/net/xlnx,axi-ethernet.example.dtb:
ethernet@40000000: reg: [[1073741824, 262144]] is too short
To fix it add missing reg minItems constraints and to make things clearer stick to 32-bit addressing in examples.
--- Documentation/devicetree/bindings/net/xlnx,axi-ethernet.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
Documentation/devicetree/bindings/net/xlnx,axi-ethernet.yaml +2 -1
@@ -34,6 +34,7 @@ properties: and length of the AXI DMA controller IO space, unless axistream-connected is specified, in which case the reg attribute of the node referenced by it is used. + minItems: 1 maxItems: 2 interrupts:
@@ -181,7 +182,7 @@ examples: clock-names = "s_axi_lite_clk", "axis_clk", "ref_clk", "mgt_clk"; clocks = <&axi_clk>, <&axi_clk>, <&pl_enet_ref_clk>, <&mgt_clk>; phy-mode = "mii"; - reg = <0x00 0x40000000 0x00 0x40000>; + reg = <0x40000000 0x40000>; xlnx,rxcsum = <0x2>; xlnx,rxmem = <0x800>; xlnx,txcsum = <0x2>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/558 sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 8beee4d8dee76b67c75dc91fd8185d91e845c160 ]
In sctp_listen_start() invoked by sctp_inet_listen(), it should set the sk_state back to CLOSED if sctp_autobind() fails due to whatever reason.
Otherwise, next time when calling sctp_inet_listen(), if sctp_sk(sk)->reuse is already set via setsockopt(SCTP_REUSE_PORT), sctp_sk(sk)->bind_hash will be dereferenced as sk_state is LISTENING, which causes a crash as bind_hash is NULL.
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:sctp_inet_listen+0x7f0/0xa20 net/sctp/socket.c:8617 Call Trace: <TASK> __sys_listen_socket net/socket.c:1883 [inline] __sys_listen+0x1b7/0x230 net/socket.c:1894 __do_sys_listen net/socket.c:1902 [inline]
--- net/sctp/socket.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/sctp/socket.c +3 -1
@@ -8557,8 +8557,10 @@ static int sctp_listen_start(struct sock *sk, int backlog)*/ inet_sk_set_state (sk,SCTP_SS_LISTENING );if (!ep->base.bind_addr.port) { -if (sctp_autobind (sk)) +if (sctp_autobind (sk)) { +inet_sk_set_state (sk,SCTP_SS_CLOSED );return -EAGAIN ; + } }else {if (sctp_get_port (sk,inet_sk (sk)->inet_num)) {inet_sk_set_state (sk,SCTP_SS_CLOSED );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/558 ASoC: topology: Fix incorrect addressing assignments
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tang Bin <[email protected]>
[ Upstream commit 85109780543b5100aba1d0842b6a7c3142be74d2 ]
The variable 'kc' is handled in the function soc_tplg_control_dbytes_create(), and 'kc->private_value' is assigned to 'sbe', so In the function soc_tplg_dbytes_create(), the right 'sbe' should be 'kc.private_value', the same logical error in the function soc_tplg_dmixer_create(), thus fix them.
--- sound/soc/soc-topology.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/soc-topology.c +2 -2
@@ -889,7 +889,7 @@ static int soc_tplg_dbytes_create(struct soc_tplg *tplg, size_t size)return ret;/* register dynamic object */ - sbe = (struct soc_bytes_ext *)&kc.private_value; + sbe = (struct soc_bytes_ext *)kc.private_value;INIT_LIST_HEAD (&sbe->dobj.list); sbe->dobj.type =SND_SOC_DOBJ_BYTES ;
@@ -923,7 +923,7 @@ static int soc_tplg_dmixer_create(struct soc_tplg *tplg, size_t size)return ret;/* register dynamic object */ - sm = (struct soc_mixer_control *)&kc.private_value; + sm = (struct soc_mixer_control *)kc.private_value;INIT_LIST_HEAD (&sm->dobj.list); sm->dobj.type =SND_SOC_DOBJ_MIXER ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/558 drm/panthor: Fix race when converting group handle to group object
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Price <[email protected]>
[ Upstream commit cac075706f298948898b1f63e81709df42afa75d ]
XArray provides it's own internal lock which protects the internal array when entries are being simultaneously added and removed. However there is still a race between retrieving the pointer from the XArray and incrementing the reference count.
To avoid this race simply hold the internal XArray lock when incrementing the reference count, this ensures there cannot be a racing call to xa_erase().
--- drivers/gpu/drm/panthor/panthor_sched.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/gpu/drm/panthor/panthor_sched.c +14 -2
@@ -3242,6 +3242,18 @@ int panthor_group_destroy(struct panthor_file *pfile, u32 group_handle)return 0 ; } +static struct panthor_group *group_from_handle (struct panthor_group_pool *pool, +u32 group_handle) +{ +struct panthor_group *group; + +xa_lock (&pool->xa); + group =group_get (xa_load (&pool->xa, group_handle)); +xa_unlock (&pool->xa); + +return group; +} +int panthor_group_get_state (struct panthor_file *pfile,struct drm_panthor_group_get_state *get_state) {
@@ -3253,7 +3265,7 @@ int panthor_group_get_state(struct panthor_file *pfile,if (get_state->pad)return -EINVAL ; - group =group_get (xa_load (&gpool->xa, get_state->group_handle)); + group =group_from_handle (gpool, get_state->group_handle);if (!group)return -EINVAL ;
@@ -3384,7 +3396,7 @@ panthor_job_create(struct panthor_file *pfile, job->call_info.latest_flush = qsubmit->latest_flush;INIT_LIST_HEAD (&job->node); - job->group =group_get (xa_load (&gpool->xa, group_handle)); + job->group =group_from_handle (gpool, group_handle);if (!job->group) { ret = -EINVAL ; goto err_put_job;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/558 ASoC: atmel: mchp-pdmc: Skip ALSA restoration if substream runtime is uninitialized
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Simion <[email protected]>
[ Upstream commit 09cfc6a532d249a51d3af5022d37ebbe9c3d31f6 ]
Update the driver to prevent alsa-restore.service from failing when reading data from /var/lib/alsa/asound.state at boot. Ensure that the restoration of ALSA mixer configurations is skipped if substream->runtime is NULL.
--- sound/soc/atmel/mchp-pdmc.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/atmel/mchp-pdmc.c +3 -0
@@ -285,6 +285,9 @@ static int mchp_pdmc_chmap_ctl_put(struct snd_kcontrol *kcontrol,if (!substream)return -ENODEV ; +if (!substream->runtime) +return 0 ;/* just for avoiding error from alsactl restore */ + map =mchp_pdmc_chmap_get (substream, info);if (!map)return -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/558 drm/connector: hdmi: Fix writing Dynamic Range Mastering infoframes
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Derek Foreman <[email protected]>
[ Upstream commit f0fa69b5011a45394554fb8061d74fee4d7cd72c ]
The largest infoframe we create is the DRM (Dynamic Range Mastering) infoframe which is 26 bytes + a 4 byte header, for a total of 30 bytes.
With HDMI_MAX_INFOFRAME_SIZE set to 29 bytes, as it is now, we allocate too little space to pack a DRM infoframe in write_device_infoframe(), leading to an ENOSPC return from hdmi_infoframe_pack(), and never calling the connector's write_infoframe() vfunc.
Instead of having HDMI_MAX_INFOFRAME_SIZE defined in two places, replace HDMI_MAX_INFOFRAME_SIZE with HDMI_INFOFRAME_SIZE(MAX) and make MAX 27 bytes - which is defined by the HDMI specification to be the largest infoframe payload.
--- drivers/gpu/drm/display/drm_hdmi_state_helper.c | 4 +--- drivers/gpu/drm/drm_debugfs.c | 4 +--- include/linux/hdmi.h | 9 +++++++++ 3 files changed, 11 insertions(+), 6 deletions(-)
drivers/gpu/drm/display/drm_hdmi_state_helper.c +1 -3
@@ -521,8 +521,6 @@ int drm_atomic_helper_connector_hdmi_check(struct drm_connector *connector, }EXPORT_SYMBOL (drm_atomic_helper_connector_hdmi_check); -#define HDMI_MAX_INFOFRAME_SIZE 29 -static int clear_device_infoframe (struct drm_connector *connector,enum hdmi_infoframe_type type) {
@@ -563,7 +561,7 @@ static int write_device_infoframe(struct drm_connector *connector, {const struct drm_connector_hdmi_funcs *funcs = connector->hdmi.funcs;struct drm_device *dev = connector->dev; -u8 buffer[HDMI_MAX_INFOFRAME_SIZE ]; +u8 buffer[HDMI_INFOFRAME_SIZE (MAX )];int ret;int len;
drivers/gpu/drm/drm_debugfs.c +1 -3
@@ -520,8 +520,6 @@ static const struct file_operations drm_connector_fops = { .write = connector_write }; -#define HDMI_MAX_INFOFRAME_SIZE 29 -static ssize_t audio_infoframe_read (struct file *filp,char __user *ubuf,size_t count,loff_t *ppos) {
@@ -579,7 +577,7 @@ static ssize_t _f##_read_infoframe(struct file *filp, \struct drm_connector *connector; \union hdmi_infoframe *frame; \struct drm_device *dev; \ -u8 buf[HDMI_MAX_INFOFRAME_SIZE ]; \ +u8 buf[HDMI_INFOFRAME_SIZE (MAX )]; \ssize_t len =0 ; \ \ connector = filp->private_data; \
include/linux/hdmi.h +9 -0
@@ -59,6 +59,15 @@ enum hdmi_infoframe_type {#define HDMI_DRM_INFOFRAME_SIZE 26#define HDMI_VENDOR_INFOFRAME_SIZE 4 +/* +* HDMI 1.3a table 5-14 states that the largest InfoFrame_length is 27, +* not including the packet header or checksum byte. We include the +* checksum byte in HDMI_INFOFRAME_HEADER_SIZE, so this should allow +* HDMI_INFOFRAME_SIZE(MAX) to be the largest buffer we could ever need +* for any HDMI infoframe. +*/ +#define HDMI_MAX_INFOFRAME_SIZE 27 +#define HDMI_INFOFRAME_SIZE (type) \ (HDMI_INFOFRAME_HEADER_SIZE + HDMI_ ## type ## _INFOFRAME_SIZE)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/558 io_uring: fix memory leak when cache init fail
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixin Liu <[email protected]>
[ Upstream commit 3a87e264290d71ec86a210ab3e8d23b715ad266d ]
Exit the percpu ref when cache init fails to free the data memory with in struct percpu_ref.
--- io_uring/io_uring.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
io_uring/io_uring.c +4 -1
@@ -321,7 +321,7 @@ static __cold struct io_ring_ctx *io_ring_ctx_alloc(struct io_uring_params *p) sizeof(struct io_kiocb)); ret |=io_futex_cache_init (ctx);if (ret) - goto err; + goto free_ref;init_completion (&ctx->ref_comp);xa_init_flags (&ctx->personalities,XA_FLAGS_ALLOC1 );mutex_init (&ctx->uring_lock);
@@ -349,6 +349,9 @@ static __cold struct io_ring_ctx *io_ring_ctx_alloc(struct io_uring_params *p)io_napi_init (ctx);return ctx; + +free_ref: +percpu_ref_exit (&ctx->refs); err:io_alloc_cache_free (&ctx->rsrc_node_cache, kfree);io_alloc_cache_free (&ctx->apoll_cache, kfree);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/558 rust: kbuild: split up helpers.c
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Hindborg <[email protected]>
[ Upstream commit 876346536c1b59a5b1b5e44477b1b3ece77647fd ]
This patch splits up the rust helpers C file. When rebasing patch sets on upstream linux, merge conflicts in helpers.c is common and time consuming [1]. Thus, split the file so that each kernel component can live in a separate file.
This patch lists helper files explicitly and thus conflicts in the file list is still likely. However, they should be more simple to resolve than the conflicts usually seen in helpers.c.
[ Removed README.md and undeleted the original comment since now,
in v3 of the series, we have a helpers.c again; which also allows us to keep the "Sorted alphabetically" line and makes the diff easier.
In addition, updated the Documentation/ mentions of the file, reworded title and removed blank lines at the end of page.c. - Miguel ]
Stable-dep-of: d065cc76054d ("rust: mutex: fix __mutex_init() usage in case of PREEMPT_RT")
--- Documentation/rust/general-information.rst | 4 +- rust/Makefile | 6 +- rust/helpers.c | 239 --------------------- rust/helpers/blk.c | 16 ++ rust/helpers/bug.c | 9 + rust/helpers/build_assert.c | 25 +++ rust/helpers/build_bug.c | 10 + rust/helpers/err.c | 22 ++ rust/helpers/helpers.c | 38 ++++ rust/helpers/kunit.c | 10 + rust/helpers/mutex.c | 10 + rust/helpers/page.c | 22 ++ rust/helpers/refcount.c | 22 ++ rust/helpers/signal.c | 10 + rust/helpers/slab.c | 10 + rust/helpers/spinlock.c | 27 +++ rust/helpers/task.c | 22 ++ rust/helpers/uaccess.c | 17 ++ rust/helpers/wait.c | 10 + rust/helpers/workqueue.c | 16 ++ 20 files changed, 301 insertions(+), 244 deletions(-) delete mode 100644 rust/helpers.c create mode 100644 rust/helpers/blk.c create mode 100644 rust/helpers/bug.c create mode 100644 rust/helpers/build_assert.c create mode 100644 rust/helpers/build_bug.c create mode 100644 rust/helpers/err.c create mode 100644 rust/helpers/helpers.c create mode 100644 rust/helpers/kunit.c create mode 100644 rust/helpers/mutex.c create mode 100644 rust/helpers/page.c create mode 100644 rust/helpers/refcount.c create mode 100644 rust/helpers/signal.c create mode 100644 rust/helpers/slab.c create mode 100644 rust/helpers/spinlock.c create mode 100644 rust/helpers/task.c create mode 100644 rust/helpers/uaccess.c create mode 100644 rust/helpers/wait.c create mode 100644 rust/helpers/workqueue.c
Documentation/rust/general-information.rst +2 -2
@@ -75,7 +75,7 @@ should provide as-safe-as-possible abstractions as needed. .. code-block:: rust/bindings/ - (rust/helpers.c) + (rust/helpers/) include/ -----+ <-+ | |
@@ -112,7 +112,7 @@ output files in the ``rust/bindings/`` directory. For parts of the C header that ``bindgen`` does not auto generate, e.g. C ``inline`` functions or non-trivial macros, it is acceptable to add a small -wrapper function to ``rust/helpers.c`` to make it available for the Rust side as +wrapper function to ``rust/helpers/`` to make it available for the Rust side as well. Abstractions
rust/Makefile +3 -3
@@ -8,8 +8,8 @@ always-$(CONFIG_RUST) += exports_core_generated.h # Missing prototypes are expected in the helpers since these are exported # for Rust only, thus there is no header nor prototypes. -obj-$(CONFIG_RUST) += helpers.o -CFLAGS_REMOVE_helpers.o = -Wmissing-prototypes -Wmissing-declarations +obj-$(CONFIG_RUST) += helpers/helpers.o +CFLAGS_REMOVE_helpers/helpers.o = -Wmissing-prototypes -Wmissing-declarations always-$(CONFIG_RUST) += libmacros.so no-clean-files += libmacros.so
@@ -299,7 +299,7 @@ $(obj)/bindings/bindings_helpers_generated.rs: private bindgen_target_cflags = \ -I$(objtree)/$(obj) -Wno-missing-prototypes -Wno-missing-declarations $(obj)/bindings/bindings_helpers_generated.rs: private bindgen_target_extra = ; \ sed -Ei 's/pub fn rust_helper_([a-zA-Z0-9_]*)/#[link_name="rust_helper_\1"]\n pub fn \1/g' $@ -$(obj)/bindings/bindings_helpers_generated.rs: $(src)/helpers.c FORCE +$(obj)/bindings/bindings_helpers_generated.rs: $(src)/helpers/helpers.c FORCE $(call if_changed_dep,bindgen) quiet_cmd_exports = EXPORTS $@
rust/helpers.c deleted +0 -239
239 lines not on this page · raw message
rust/helpers/blk.c new file +16 -0
@@ -0,0 +1,16 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <linux/blk-mq.h> +#include <linux/blkdev.h> + +void *rust_helper_blk_mq_rq_to_pdu (struct request *rq) +{ +return blk_mq_rq_to_pdu (rq); +} +EXPORT_SYMBOL_GPL (rust_helper_blk_mq_rq_to_pdu); + +struct request *rust_helper_blk_mq_rq_from_pdu (void *pdu) +{ +return blk_mq_rq_from_pdu (pdu); +} +EXPORT_SYMBOL_GPL (rust_helper_blk_mq_rq_from_pdu);
rust/helpers/bug.c new file +9 -0
@@ -0,0 +1,9 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <linux/bug.h> + +__noreturn void rust_helper_BUG (void ) +{ +BUG (); +} +EXPORT_SYMBOL_GPL (rust_helper_BUG);
rust/helpers/build_assert.c new file +25 -0
@@ -0,0 +1,25 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <linux/build_bug.h> + +/* +* `bindgen` binds the C `size_t` type as the Rust `usize` type, so we can +* use it in contexts where Rust expects a `usize` like slice (array) indices. +* `usize` is defined to be the same as C's `uintptr_t` type (can hold any +* pointer) but not necessarily the same as `size_t` (can hold the size of any +* single object). Most modern platforms use the same concrete integer type for +* both of them, but in case we find ourselves on a platform where +* that's not true, fail early instead of risking ABI or +* integer-overflow issues. +* +* If your platform fails this assertion, it means that you are in +* danger of integer-overflow bugs (even if you attempt to add +* `--no-size_t-is-usize`). It may be easiest to change the kernel ABI on +* your platform such that `size_t` matches `uintptr_t` (i.e., to increase +* `size_t`, because `uintptr_t` has to be at least as big as `size_t`). +*/ +static_assert ( +sizeof (size_t ) ==sizeof (uintptr_t ) && + __alignof__(size_t ) == __alignof__(uintptr_t ), +"Rust code expects C `size_t` to match Rust `usize`" +);
rust/helpers/build_bug.c new file +10 -0
@@ -0,0 +1,10 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <linux/export.h> +#include <linux/errname.h> + +const char *rust_helper_errname (int err) +{ +return errname (err); +} +EXPORT_SYMBOL_GPL (rust_helper_errname);
rust/helpers/err.c new file +22 -0
@@ -0,0 +1,22 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <linux/err.h> +#include <linux/export.h> + +__force void *rust_helper_ERR_PTR (long err) +{ +return ERR_PTR (err); +} +EXPORT_SYMBOL_GPL (rust_helper_ERR_PTR); + +bool rust_helper_IS_ERR (__force const void *ptr) +{ +return IS_ERR (ptr); +} +EXPORT_SYMBOL_GPL (rust_helper_IS_ERR); + +long rust_helper_PTR_ERR (__force const void *ptr) +{ +return PTR_ERR (ptr); +} +EXPORT_SYMBOL_GPL (rust_helper_PTR_ERR);
rust/helpers/helpers.c new file +38 -0
@@ -0,0 +1,38 @@ +// SPDX-License-Identifier: GPL-2.0 +/* +* Non-trivial C macros cannot be used in Rust. Similarly, inlined C functions +* cannot be called either. This file explicitly creates functions ("helpers") +* that wrap those so that they can be called from Rust. +* +* Even though Rust kernel modules should never use the bindings directly, some +* of these helpers need to be exported because Rust generics and inlined +* functions may not get their code generated in the crate where they are +* defined. Other helpers, called from non-inline functions, may not be +* exported, in principle. However, in general, the Rust compiler does not +* guarantee codegen will be performed for a non-inline function either. +* Therefore, this file exports all the helpers. In the future, this may be +* revisited to reduce the number of exports after the compiler is informed +* about the places codegen is required. +* +* All symbols are exported as GPL-only to guarantee no GPL-only feature is +* accidentally exposed. +* +* Sorted alphabetically. +*/ + +#include "blk.c" +#include "bug.c" +#include "build_assert.c" +#include "build_bug.c" +#include "err.c" +#include "kunit.c" +#include "mutex.c" +#include "page.c" +#include "refcount.c" +#include "signal.c" +#include "slab.c" +#include "spinlock.c" +#include "task.c" +#include "uaccess.c" +#include "wait.c" +#include "workqueue.c"
rust/helpers/kunit.c new file +10 -0
@@ -0,0 +1,10 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <kunit/test-bug.h> +#include <linux/export.h> + +struct kunit *rust_helper_kunit_get_current_test (void ) +{ +return kunit_get_current_test (); +} +EXPORT_SYMBOL_GPL (rust_helper_kunit_get_current_test);
rust/helpers/mutex.c new file +10 -0
@@ -0,0 +1,10 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <linux/export.h> +#include <linux/mutex.h> + +void rust_helper_mutex_lock (struct mutex *lock) +{ +mutex_lock (lock); +} +EXPORT_SYMBOL_GPL (rust_helper_mutex_lock);
rust/helpers/page.c new file +22 -0
@@ -0,0 +1,22 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <linux/gfp.h> +#include <linux/highmem.h> + +struct page *rust_helper_alloc_pages (gfp_t gfp_mask,unsigned int order) +{ +return alloc_pages (gfp_mask, order); +} +EXPORT_SYMBOL_GPL (rust_helper_alloc_pages); + +void *rust_helper_kmap_local_page (struct page *page) +{ +return kmap_local_page (page); +} +EXPORT_SYMBOL_GPL (rust_helper_kmap_local_page); + +void rust_helper_kunmap_local (const void *addr) +{ +kunmap_local (addr); +} +EXPORT_SYMBOL_GPL (rust_helper_kunmap_local);
rust/helpers/refcount.c new file +22 -0
@@ -0,0 +1,22 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <linux/export.h> +#include <linux/refcount.h> + +refcount_t rust_helper_REFCOUNT_INIT (int n) +{ +return (refcount_t )REFCOUNT_INIT (n); +} +EXPORT_SYMBOL_GPL (rust_helper_REFCOUNT_INIT); + +void rust_helper_refcount_inc (refcount_t *r) +{ +refcount_inc (r); +} +EXPORT_SYMBOL_GPL (rust_helper_refcount_inc); + +bool rust_helper_refcount_dec_and_test (refcount_t *r) +{ +return refcount_dec_and_test (r); +} +EXPORT_SYMBOL_GPL (rust_helper_refcount_dec_and_test);
rust/helpers/signal.c new file +10 -0
@@ -0,0 +1,10 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <linux/export.h> +#include <linux/sched/signal.h> + +int rust_helper_signal_pending (struct task_struct *t) +{ +return signal_pending (t); +} +EXPORT_SYMBOL_GPL (rust_helper_signal_pending);
rust/helpers/slab.c new file +10 -0
@@ -0,0 +1,10 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <linux/slab.h> + +void * __must_check __realloc_size(2) +rust_helper_krealloc(const void *objp, size_t new_size, gfp_t flags) +{ +return krealloc (objp, new_size, flags); +} +EXPORT_SYMBOL_GPL (rust_helper_krealloc);
rust/helpers/spinlock.c new file +27 -0
@@ -0,0 +1,27 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <linux/export.h> +#include <linux/spinlock.h> + +void rust_helper___spin_lock_init (spinlock_t *lock,const char *name, +struct lock_class_key *key) +{ +#ifdef CONFIG_DEBUG_SPINLOCK +__raw_spin_lock_init (spinlock_check (lock), name, key,LD_WAIT_CONFIG ); +#else +spin_lock_init (lock); +#endif +} +EXPORT_SYMBOL_GPL (rust_helper___spin_lock_init); + +void rust_helper_spin_lock (spinlock_t *lock) +{ +spin_lock (lock); +} +EXPORT_SYMBOL_GPL (rust_helper_spin_lock); + +void rust_helper_spin_unlock (spinlock_t *lock) +{ +spin_unlock (lock); +} +EXPORT_SYMBOL_GPL (rust_helper_spin_unlock);
rust/helpers/task.c new file +22 -0
@@ -0,0 +1,22 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <linux/export.h> +#include <linux/sched/task.h> + +struct task_struct *rust_helper_get_current (void ) +{ +return current; +} +EXPORT_SYMBOL_GPL (rust_helper_get_current); + +void rust_helper_get_task_struct (struct task_struct *t) +{ +get_task_struct (t); +} +EXPORT_SYMBOL_GPL (rust_helper_get_task_struct); + +void rust_helper_put_task_struct (struct task_struct *t) +{ +put_task_struct (t); +} +EXPORT_SYMBOL_GPL (rust_helper_put_task_struct);
rust/helpers/uaccess.c new file +17 -0
@@ -0,0 +1,17 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <linux/uaccess.h> + +unsigned long rust_helper_copy_from_user (void *to,const void __user *from, +unsigned long n) +{ +return copy_from_user (to, from, n); +} +EXPORT_SYMBOL_GPL (rust_helper_copy_from_user); + +unsigned long rust_helper_copy_to_user (void __user *to,const void *from, +unsigned long n) +{ +return copy_to_user (to, from, n); +} +EXPORT_SYMBOL_GPL (rust_helper_copy_to_user);
rust/helpers/wait.c new file +10 -0
@@ -0,0 +1,10 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <linux/export.h> +#include <linux/wait.h> + +void rust_helper_init_wait (struct wait_queue_entry *wq_entry) +{ +init_wait (wq_entry); +} +EXPORT_SYMBOL_GPL (rust_helper_init_wait);
rust/helpers/workqueue.c new file +16 -0
@@ -0,0 +1,16 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <linux/export.h> +#include <linux/workqueue.h> + +void rust_helper_init_work_with_key (struct work_struct *work,work_func_t func, +bool onstack,const char *name, +struct lock_class_key *key) +{ +__init_work (work, onstack); + work->data = (atomic_long_t )WORK_DATA_INIT (); +lockdep_init_map (&work->lockdep_map, name, key,0 ); +INIT_LIST_HEAD (&work->entry); + work->func = func; +} +EXPORT_SYMBOL_GPL (rust_helper_init_work_with_key);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/558 rust: kbuild: auto generate helper exports
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gary Guo <[email protected]>
[ Upstream commit e26fa546042add70944d018b930530d16b3cf626 ]
This removes the need to explicitly export all symbols.
Generate helper exports similarly to what's currently done for Rust crates. These helpers are exclusively called from within Rust code and therefore can be treated similar as other Rust symbols.
[ Fixed dependency path, reworded slightly, edited comment a bit and
rebased on top of the changes made when applying Andreas' patch (e.g. no README.md anymore, so moved the edits). - Miguel ]
Stable-dep-of: d065cc76054d ("rust: mutex: fix __mutex_init() usage in case of PREEMPT_RT")
--- rust/Makefile | 16 ++++++++++++++-- rust/exports.c | 1 + rust/helpers/blk.c | 2 -- rust/helpers/bug.c | 1 - rust/helpers/build_bug.c | 1 - rust/helpers/err.c | 3 --- rust/helpers/helpers.c | 13 ------------- rust/helpers/kunit.c | 1 - rust/helpers/mutex.c | 1 - rust/helpers/page.c | 3 --- rust/helpers/refcount.c | 3 --- rust/helpers/signal.c | 1 - rust/helpers/slab.c | 1 - rust/helpers/spinlock.c | 3 --- rust/helpers/task.c | 3 --- rust/helpers/uaccess.c | 2 -- rust/helpers/wait.c | 1 - rust/helpers/workqueue.c | 1 - 18 files changed, 15 insertions(+), 42 deletions(-)
rust/Makefile +14 -2
@@ -16,8 +16,8 @@ no-clean-files += libmacros.so always-$(CONFIG_RUST) += bindings/bindings_generated.rs bindings/bindings_helpers_generated.rs obj-$(CONFIG_RUST) += alloc.o bindings.o kernel.o -always-$(CONFIG_RUST) += exports_alloc_generated.h exports_bindings_generated.h \ - exports_kernel_generated.h +always-$(CONFIG_RUST) += exports_alloc_generated.h exports_helpers_generated.h \ + exports_bindings_generated.h exports_kernel_generated.h always-$(CONFIG_RUST) += uapi/uapi_generated.rs obj-$(CONFIG_RUST) += uapi.o
@@ -313,6 +313,18 @@ $(obj)/exports_core_generated.h: $(obj)/core.o FORCE $(obj)/exports_alloc_generated.h: $(obj)/alloc.o FORCE $(call if_changed,exports) +# Even though Rust kernel modules should never use the bindings directly, +# symbols from the `bindings` crate and the C helpers need to be exported +# because Rust generics and inlined functions may not get their code generated +# in the crate where they are defined. Other helpers, called from non-inline +# functions, may not be exported, in principle. However, in general, the Rust +# compiler does not guarantee codegen will be performed for a non-inline +# function either. Therefore, we export all symbols from helpers and bindings. +# In the future, this may be revisited to reduce the number of exports after +# the compiler is informed about the places codegen is required. +$(obj)/exports_helpers_generated.h: $(obj)/helpers/helpers.o FORCE + $(call if_changed,exports) + $(obj)/exports_bindings_generated.h: $(obj)/bindings.o FORCE $(call if_changed,exports)
rust/exports.c +1 -0
@@ -17,6 +17,7 @@#include "exports_core_generated.h" #include "exports_alloc_generated.h" +#include "exports_helpers_generated.h" #include "exports_bindings_generated.h" #include "exports_kernel_generated.h"
rust/helpers/blk.c +0 -2
@@ -7,10 +7,8 @@ void *rust_helper_blk_mq_rq_to_pdu(struct request *rq) {return blk_mq_rq_to_pdu (rq); } -EXPORT_SYMBOL_GPL (rust_helper_blk_mq_rq_to_pdu);struct request *rust_helper_blk_mq_rq_from_pdu (void *pdu) {return blk_mq_rq_from_pdu (pdu); } -EXPORT_SYMBOL_GPL (rust_helper_blk_mq_rq_from_pdu);
rust/helpers/bug.c +0 -1
@@ -6,4 +6,3 @@ __noreturn void rust_helper_BUG(void) {BUG (); } -EXPORT_SYMBOL_GPL (rust_helper_BUG);
rust/helpers/build_bug.c +0 -1
@@ -7,4 +7,3 @@ const char *rust_helper_errname(int err) {return errname (err); } -EXPORT_SYMBOL_GPL (rust_helper_errname);
rust/helpers/err.c +0 -3
@@ -7,16 +7,13 @@ __force void *rust_helper_ERR_PTR(long err) {return ERR_PTR (err); } -EXPORT_SYMBOL_GPL (rust_helper_ERR_PTR);bool rust_helper_IS_ERR (__force const void *ptr) {return IS_ERR (ptr); } -EXPORT_SYMBOL_GPL (rust_helper_IS_ERR);long rust_helper_PTR_ERR (__force const void *ptr) {return PTR_ERR (ptr); } -EXPORT_SYMBOL_GPL (rust_helper_PTR_ERR);
rust/helpers/helpers.c +0 -13
@@ -4,19 +4,6 @@* cannot be called either. This file explicitly creates functions ("helpers") * that wrap those so that they can be called from Rust. * -* Even though Rust kernel modules should never use the bindings directly, some -* of these helpers need to be exported because Rust generics and inlined -* functions may not get their code generated in the crate where they are -* defined. Other helpers, called from non-inline functions, may not be -* exported, in principle. However, in general, the Rust compiler does not -* guarantee codegen will be performed for a non-inline function either. -* Therefore, this file exports all the helpers. In the future, this may be -* revisited to reduce the number of exports after the compiler is informed -* about the places codegen is required. -* -* All symbols are exported as GPL-only to guarantee no GPL-only feature is -* accidentally exposed. -* * Sorted alphabetically. */
rust/helpers/kunit.c +0 -1
@@ -7,4 +7,3 @@ struct kunit *rust_helper_kunit_get_current_test(void) {return kunit_get_current_test (); } -EXPORT_SYMBOL_GPL (rust_helper_kunit_get_current_test);
rust/helpers/mutex.c +0 -1
@@ -7,4 +7,3 @@ void rust_helper_mutex_lock(struct mutex *lock) {mutex_lock (lock); } -EXPORT_SYMBOL_GPL (rust_helper_mutex_lock);
rust/helpers/page.c +0 -3
@@ -7,16 +7,13 @@ struct page *rust_helper_alloc_pages(gfp_t gfp_mask, unsigned int order) {return alloc_pages (gfp_mask, order); } -EXPORT_SYMBOL_GPL (rust_helper_alloc_pages);void *rust_helper_kmap_local_page (struct page *page) {return kmap_local_page (page); } -EXPORT_SYMBOL_GPL (rust_helper_kmap_local_page);void rust_helper_kunmap_local (const void *addr) {kunmap_local (addr); } -EXPORT_SYMBOL_GPL (rust_helper_kunmap_local);
rust/helpers/refcount.c +0 -3
@@ -7,16 +7,13 @@ refcount_t rust_helper_REFCOUNT_INIT(int n) {return (refcount_t )REFCOUNT_INIT (n); } -EXPORT_SYMBOL_GPL (rust_helper_REFCOUNT_INIT);void rust_helper_refcount_inc (refcount_t *r) {refcount_inc (r); } -EXPORT_SYMBOL_GPL (rust_helper_refcount_inc);bool rust_helper_refcount_dec_and_test (refcount_t *r) {return refcount_dec_and_test (r); } -EXPORT_SYMBOL_GPL (rust_helper_refcount_dec_and_test);
rust/helpers/signal.c +0 -1
@@ -7,4 +7,3 @@ int rust_helper_signal_pending(struct task_struct *t) {return signal_pending (t); } -EXPORT_SYMBOL_GPL (rust_helper_signal_pending);
rust/helpers/slab.c +0 -1
@@ -7,4 +7,3 @@ rust_helper_krealloc(const void *objp, size_t new_size, gfp_t flags) {return krealloc (objp, new_size, flags); } -EXPORT_SYMBOL_GPL (rust_helper_krealloc);
rust/helpers/spinlock.c +0 -3
@@ -12,16 +12,13 @@ void rust_helper___spin_lock_init(spinlock_t *lock, const char *name,spin_lock_init (lock);#endif } -EXPORT_SYMBOL_GPL (rust_helper___spin_lock_init);void rust_helper_spin_lock (spinlock_t *lock) {spin_lock (lock); } -EXPORT_SYMBOL_GPL (rust_helper_spin_lock);void rust_helper_spin_unlock (spinlock_t *lock) {spin_unlock (lock); } -EXPORT_SYMBOL_GPL (rust_helper_spin_unlock);
rust/helpers/task.c +0 -3
@@ -7,16 +7,13 @@ struct task_struct *rust_helper_get_current(void) {return current; } -EXPORT_SYMBOL_GPL (rust_helper_get_current);void rust_helper_get_task_struct (struct task_struct *t) {get_task_struct (t); } -EXPORT_SYMBOL_GPL (rust_helper_get_task_struct);void rust_helper_put_task_struct (struct task_struct *t) {put_task_struct (t); } -EXPORT_SYMBOL_GPL (rust_helper_put_task_struct);
rust/helpers/uaccess.c +0 -2
@@ -7,11 +7,9 @@ unsigned long rust_helper_copy_from_user(void *to, const void __user *from, {return copy_from_user (to, from, n); } -EXPORT_SYMBOL_GPL (rust_helper_copy_from_user);unsigned long rust_helper_copy_to_user (void __user *to,const void *from,unsigned long n) {return copy_to_user (to, from, n); } -EXPORT_SYMBOL_GPL (rust_helper_copy_to_user);
rust/helpers/wait.c +0 -1
@@ -7,4 +7,3 @@ void rust_helper_init_wait(struct wait_queue_entry *wq_entry) {init_wait (wq_entry); } -EXPORT_SYMBOL_GPL (rust_helper_init_wait);
rust/helpers/workqueue.c +0 -1
@@ -13,4 +13,3 @@ void rust_helper_init_work_with_key(struct work_struct *work, work_func_t func,INIT_LIST_HEAD (&work->entry); work->func = func; } -EXPORT_SYMBOL_GPL (rust_helper_init_work_with_key);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/558 rust: mutex: fix __mutex_init() usage in case of PREEMPT_RT
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dirk Behme <[email protected]>
[ Upstream commit d065cc76054d21e48a839a2a19ba99dbc51a4d11 ]
In case CONFIG_PREEMPT_RT is enabled __mutex_init() becomes a macro instead of an extern function (simplified from include/linux/mutex.h):
#ifndef CONFIG_PREEMPT_RT
extern void __mutex_init(struct mutex *lock, const char *name,
struct lock_class_key *key);
#else
#define __mutex_init(mutex, name, key) \
do { \
rt_mutex_base_init(&(mutex)->rtmutex); \
__mutex_rt_init((mutex), name, key); \
} while (0)
#endifThe macro isn't resolved by bindgen, then. What results in a build error:
error[E0425]: cannot find function __mutex_init in crate bindings
--> rust/kernel/sync/lock/mutex.rs:104:28
|
104 | unsafe { bindings::__mutex_init(ptr, name, key) }
| ^^^^^^^^^^^^ help: a function with a similar name exists: `__mutex_rt_init`
|
::: rust/bindings/bindings_generated.rs:23722:5
|
23722 | / pub fn __mutex_rt_init(
23723 | | lock: *mut mutex,
23724 | | name: *const core::ffi::c_char,
23725 | | key: *mut lock_class_key,
23726 | | );
| |_____- similarly named function `__mutex_rt_init` defined hereFix this by adding a helper.
As explained by Gary Guo in [1] no #ifdef CONFIG_PREEMPT_RT is needed here as rust/bindings/lib.rs prefers externed function to helpers if an externed function exists.
--- rust/helpers/mutex.c | 6 ++++++ 1 file changed, 6 insertions(+)
rust/helpers/mutex.c +6 -0
@@ -7,3 +7,9 @@ void rust_helper_mutex_lock(struct mutex *lock) {mutex_lock (lock); } + +void rust_helper___mutex_init (struct mutex *mutex,const char *name, +struct lock_class_key *key) +{ +__mutex_init (mutex, name, key); +}
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/558 ALSA: mixer_oss: Remove some incorrect kfree_const() usages
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 368e4663c557de4a33f321b44e7eeec0a21b2e4e ]
"assigned" and "assigned->name" are allocated in snd_mixer_oss_proc_write() using kmalloc() and kstrdup(), so there is no point in using kfree_const() to free these resources.
Switch to the more standard kfree() to free these resources.
This could avoid a memory leak.
--- sound/core/oss/mixer_oss.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/core/oss/mixer_oss.c +2 -2
@@ -901,8 +901,8 @@ static void snd_mixer_oss_slot_free(struct snd_mixer_oss_slot *chn)struct slot *p = chn->private_data;if (p) {if (p->allocated && p->assigned) { -kfree_const (p->assigned->name); -kfree_const (p->assigned); +kfree (p->assigned->name); +kfree (p->assigned); }kfree (p); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/558 ALSA: hda/realtek: Fix the push button function for the ALC257
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oder Chiou <[email protected]>
[ Upstream commit 05df9732a0894846c46d0062d4af535c5002799d ]
The headset push button cannot work properly in case of the ALC257. This patch reverted the previous commit to correct the side effect.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -586,6 +586,7 @@ static void alc_shutup_pins(struct hda_codec *codec)switch (codec->core.vendor_id) {case 0x10ec0236 :case 0x10ec0256 : +case 0x10ec0257 :case 0x19e58326 :case 0x10ec0283 :case 0x10ec0285 :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/558 cifs: Remove intermediate object of failed create reparse call
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pali Rohár <[email protected]>
[ Upstream commit c9432ad5e32f066875b1bf95939c363bc46d6a45 ]
If CREATE was successful but SMB2_OP_SET_REPARSE failed then remove the intermediate object created by CREATE. Otherwise empty object stay on the server when reparse call failed.
This ensures that if the creating of special files is unsupported by the server then no empty file stay on the server as a result of unsupported operation.
--- fs/smb/client/smb2inode.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-)
fs/smb/client/smb2inode.c +22 -2
@@ -1205,9 +1205,12 @@ struct inode *smb2_get_reparse_inode(struct cifs_open_info_data *data,struct cifs_sb_info *cifs_sb =CIFS_SB (sb);struct cifsFileInfo *cfile;struct inode *new =NULL ; +int out_buftype[4 ] = {}; +struct kvec out_iov[4 ] = {};struct kvec in_iov[2 ];int cmds[2 ];int rc; +int i; oparms = CIFS_OPARMS(cifs_sb, tcon, full_path, SYNCHRONIZE | DELETE |
@@ -1228,7 +1231,7 @@ struct inode *smb2_get_reparse_inode(struct cifs_open_info_data *data, cmds[1 ] =SMB2_OP_POSIX_QUERY_INFO ;cifs_get_writable_path (tcon, full_path,FIND_WR_ANY , &cfile); rc =smb2_compound_op (xid, tcon, cifs_sb, full_path, &oparms, - in_iov, cmds,2 , cfile,NULL ,NULL ,NULL ); + in_iov, cmds,2 , cfile, out_iov, out_buftype,NULL );if (!rc) { rc =smb311_posix_get_inode_info (&new, full_path, data, sb, xid);
@@ -1237,12 +1240,29 @@ struct inode *smb2_get_reparse_inode(struct cifs_open_info_data *data, cmds[1 ] =SMB2_OP_QUERY_INFO ;cifs_get_writable_path (tcon, full_path,FIND_WR_ANY , &cfile); rc =smb2_compound_op (xid, tcon, cifs_sb, full_path, &oparms, - in_iov, cmds,2 , cfile,NULL ,NULL ,NULL ); + in_iov, cmds,2 , cfile, out_iov, out_buftype,NULL );if (!rc) { rc =cifs_get_inode_info (&new, full_path, data, sb, xid,NULL ); } } + + +/* +* If CREATE was successful but SMB2_OP_SET_REPARSE failed then +* remove the intermediate object created by CREATE. Otherwise +* empty object stay on the server when reparse call failed. +*/ +if (rc && + out_iov[0 ].iov_base !=NULL && out_buftype[0 ] !=CIFS_NO_BUFFER && + ((struct smb2_hdr *)out_iov[0 ].iov_base)->Status ==STATUS_SUCCESS && + (out_iov[1 ].iov_base ==NULL || out_buftype[1 ] ==CIFS_NO_BUFFER || + ((struct smb2_hdr *)out_iov[1 ].iov_base)->Status !=STATUS_SUCCESS )) +smb2_unlink (xid, tcon, full_path, cifs_sb,NULL ); + +for (i =0 ; i <ARRAY_SIZE (out_buftype); i++) +free_rsp_buf (out_buftype[i], out_iov[i].iov_base); +return rc ?ERR_PTR (rc) : new; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/558 ASoC: Intel: soc-acpi-intel-rpl-match: add missing empty item
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bard Liao <[email protected]>
[ Upstream commit 5afc29ba44fdd1bcbad4e07246c395d946301580 ]
There is no links_num in struct snd_soc_acpi_mach {}, and we test !link->num_adr as a condition to end the loop in hda_sdw_machine_select(). So an empty item in struct snd_soc_acpi_link_adr array is required.
--- sound/soc/intel/common/soc-acpi-intel-rpl-match.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/intel/common/soc-acpi-intel-rpl-match.c +1 -0
@@ -198,6 +198,7 @@ static const struct snd_soc_acpi_link_adr rpl_cs42l43_l0[] = { .num_adr = ARRAY_SIZE(cs42l43_0_adr), .adr_d = cs42l43_0_adr, }, + {} }; static const struct snd_soc_acpi_link_adr rpl_sdca_3_in_1[] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/558 drm/panthor: Lock the VM resv before calling drm_gpuvm_bo_obtain_prealloc()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Brezillon <[email protected]>
[ Upstream commit fa998a9eac8809da4f219aad49836fcad2a9bf5c ]
drm_gpuvm_bo_obtain_prealloc() will call drm_gpuvm_bo_put() on our pre-allocated BO if the <BO,VM> association exists. Given we only have one ref on preallocated_vm_bo, drm_gpuvm_bo_destroy() will be called immediately, and we have to hold the VM resv lock when calling this function.
--- drivers/gpu/drm/panthor/panthor_mmu.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/panthor/panthor_mmu.c +8 -0
@@ -1251,9 +1251,17 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx, goto err_cleanup; } +/* drm_gpuvm_bo_obtain_prealloc() will call drm_gpuvm_bo_put() on our +* pre-allocated BO if the <BO,VM> association exists. Given we +* only have one ref on preallocated_vm_bo, drm_gpuvm_bo_destroy() will +* be called immediately, and we have to hold the VM resv lock when +* calling this function. +*/ +dma_resv_lock (panthor_vm_resv (vm),NULL );mutex_lock (&bo->gpuva_list_lock); op_ctx->map.vm_bo =drm_gpuvm_bo_obtain_prealloc (preallocated_vm_bo);mutex_unlock (&bo->gpuva_list_lock); +dma_resv_unlock (panthor_vm_resv (vm));/* If the a vm_bo for this <VM,BO> combination exists, it already * retains a pin ref, and we can release the one we took earlier.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/558 ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 1c801e7f77445bc56e5e1fec6191fd4503534787 ]
Some time ago, we introduced the obey_preferred_dacs flag for choosing the DAC/pin pairs specified by the driver instead of parsing the paths. This works as expected, per se, but there have been a few cases where we forgot to set this flag while preferred_dacs table is already set up. It ended up with incorrect wiring and made us wondering why it doesn't work.
Basically, when the preferred_dacs table is provided, it means that the driver really wants to wire up to follow that. That is, the presence of the preferred_dacs table itself is already a "do-it" flag.
In this patch, we simply replace the evaluation of obey_preferred_dacs flag with the presence of preferred_dacs table for fixing the misbehavior. Another patch to drop of the obsoleted flag will follow.
--- sound/pci/hda/hda_generic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/hda_generic.c +2 -2
@@ -1383,7 +1383,7 @@ static int try_assign_dacs(struct hda_codec *codec, int num_outs,struct nid_path *path;hda_nid_t pin = pins[i]; -if (!spec->obey_preferred_dacs) { +if (!spec->preferred_dacs) { path =snd_hda_get_path_from_idx (codec, path_idx[i]);if (path) { badness +=assign_out_path_ctls (codec, path);
@@ -1395,7 +1395,7 @@ static int try_assign_dacs(struct hda_codec *codec, int num_outs,if (dacs[i]) {if (is_dac_already_used (codec, dacs[i])) badness += bad->shared_primary; - }else if (spec->obey_preferred_dacs) { + }else if (spec->preferred_dacs) { badness +=BAD_NO_PRIMARY_DAC ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/558 ASoC: imx-card: Set card.owner to avoid a warning calltrace if SND=m
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <[email protected]>
[ Upstream commit 47d7d3fd72afc7dcd548806291793ee6f3848215 ]
In most Linux distribution kernels, the SND is set to m, in such a case, when booting the kernel on i.MX8MP EVK board, there is a warning calltrace like below:
Call trace: snd_card_init+0x484/0x4cc [snd] snd_card_new+0x70/0xa8 [snd] snd_soc_bind_card+0x310/0xbd0 [snd_soc_core] snd_soc_register_card+0xf0/0x108 [snd_soc_core] devm_snd_soc_register_card+0x4c/0xa4 [snd_soc_core]
That is because the card.owner is not set, a warning calltrace is raised in the snd_card_init() due to it.
--- sound/soc/fsl/imx-card.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/fsl/imx-card.c +1 -0
@@ -713,6 +713,7 @@ static int imx_card_probe(struct platform_device *pdev) data->plat_data = plat_data; data->card.dev = &pdev->dev; + data->card.owner =THIS_MODULE ;dev_set_drvdata (&pdev->dev, &data->card);snd_soc_card_set_drvdata (&data->card, data);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/558 drm/xe: Restore pci state upon resume
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rodrigo Vivi <[email protected]>
[ Upstream commit cffa8e83df9fe525afad1e1099097413f9174f57 ]
The pci state was saved, but not restored. Restore right after the power state transition request like every other driver.
v2: Use right fixes tag, since this was there initialy, but
accidentally removed.
--- drivers/gpu/drm/xe/xe_pci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/xe/xe_pci.c +2 -0
@@ -924,6 +924,8 @@ static int xe_pci_resume(struct device *dev)if (err)return err; +pci_restore_state (pdev); + err =pci_enable_device (pdev);if (err)return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/558 drm/xe/guc_submit: add missing locking in wedged_fini
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Auld <[email protected]>
[ Upstream commit 790533e44bfc7af929842fccd9674c9f424d4627 ]
Any non-wedged queue can have a zero refcount here and can be running concurrently with an async queue destroy, therefore dereferencing the queue ptr to check wedge status after the lookup can trigger UAF if queue is not wedged. Fix this by keeping the submission_state lock held around the check to postpone the free and make the check safe, before dropping again around the put() to avoid the deadlock.
--- drivers/gpu/drm/xe/xe_guc_submit.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/gpu/drm/xe/xe_guc_submit.c +8 -2
@@ -290,9 +290,15 @@ static void guc_submit_wedged_fini(void *arg)struct xe_exec_queue *q;unsigned long index; -xa_for_each (&guc->submission_state.exec_queue_lookup, index, q) -if (exec_queue_wedged (q)) +mutex_lock (&guc->submission_state.lock); +xa_for_each (&guc->submission_state.exec_queue_lookup, index, q) { +if (exec_queue_wedged (q)) { +mutex_unlock (&guc->submission_state.lock);xe_exec_queue_put (q); +mutex_lock (&guc->submission_state.lock); + } + } +mutex_unlock (&guc->submission_state.lock); }static const struct xe_exec_queue_ops guc_exec_queue_ops;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/558 drm/xe: Resume TDR after GT reset
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Brost <[email protected]>
[ Upstream commit 1b30f87e088b499eb74298db256da5c98e8276e2 ]
Not starting the TDR after GT reset on exec queue which have been restarted can lead to jobs being able to be run forever. Fix this by restarting the TDR.
--- drivers/gpu/drm/xe/xe_gpu_scheduler.c | 5 +++++ drivers/gpu/drm/xe/xe_gpu_scheduler.h | 2 ++ drivers/gpu/drm/xe/xe_guc_submit.c | 1 + 3 files changed, 8 insertions(+)
drivers/gpu/drm/xe/xe_gpu_scheduler.c +5 -0
@@ -90,6 +90,11 @@ void xe_sched_submission_stop(struct xe_gpu_scheduler *sched)cancel_work_sync (&sched->work_process_msg); } +void xe_sched_submission_resume_tdr (struct xe_gpu_scheduler *sched) +{ +drm_sched_resume_timeout (&sched->base, sched->base.timeout); +} +void xe_sched_add_msg (struct xe_gpu_scheduler *sched,struct xe_sched_msg *msg) {
drivers/gpu/drm/xe/xe_gpu_scheduler.h +2 -0
@@ -22,6 +22,8 @@ void xe_sched_fini(struct xe_gpu_scheduler *sched);void xe_sched_submission_start (struct xe_gpu_scheduler *sched);void xe_sched_submission_stop (struct xe_gpu_scheduler *sched); +void xe_sched_submission_resume_tdr (struct xe_gpu_scheduler *sched); +void xe_sched_add_msg (struct xe_gpu_scheduler *sched,struct xe_sched_msg *msg);
drivers/gpu/drm/xe/xe_guc_submit.c +1 -0
@@ -1740,6 +1740,7 @@ static void guc_exec_queue_start(struct xe_exec_queue *q) }xe_sched_submission_start (sched); +xe_sched_submission_resume_tdr (sched); }int xe_guc_submit_start (struct xe_guc *guc)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/558 drm/xe: Prevent null pointer access in xe_migrate_copy
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhanjun Dong <[email protected]>
[ Upstream commit 7257d9c9a3c6cfe26c428e9b7ae21d61f2f55a79 ]
xe_migrate_copy designed to copy content of TTM resources. When source resource is null, it will trigger a NULL pointer dereference in xe_migrate_copy. To avoid this situation, update lacks source flag to true for this case, the flag will trigger xe_migrate_clear rather than xe_migrate_copy.
Issue trace:
<7> [317.089847] xe 0000:00:02.0: [drm:xe_migrate_copy [xe]] Pass 14,
sizes: 4194304 & 4194304
<7> [317.089945] xe 0000:00:02.0: [drm:xe_migrate_copy [xe]] Pass 15,
sizes: 4194304 & 4194304
<1> [317.128055] BUG: kernel NULL pointer dereference, address:
0000000000000010
<1> [317.128064] #PF: supervisor read access in kernel mode <1> [317.128066] #PF: error_code(0x0000) - not-present page <6> [317.128069] PGD 0 P4D 0
<4> [317.128071] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
<4> [317.128074] CPU: 1 UID: 0 PID: 1440 Comm: kunit_try_catch Tainted:
G U N 6.11.0-rc7-xe #1
<4> [317.128078] Tainted: [U]=USER, [N]=TEST
<4> [317.128080] Hardware name: Intel Corporation Lunar Lake Client
Platform/LNL-M LP5 RVP1, BIOS LNLMFWI1.R00.3221.D80.2407291239 07/29/2024
<4> [317.128082] RIP: 0010:xe_migrate_copy+0x66/0x13e0 [xe] <4> [317.128158] Code: 00 00 48 89 8d e0 fe ff ff 48 8b 40 10 4c 89 85 c8
fe ff ff 44 88 8d bd fe ff ff 65 48 8b 3c 25 28 00 00 00 48 89 7d d0 31 ff <8b> 79 10 48 89 85 a0 fe ff ff 48 8b 00 48 89 b5 d8 fe ff ff 83 ff
<4> [317.128162] RSP: 0018:ffffc9000167f9f0 EFLAGS: 00010246 <4> [317.128164] RAX: ffff8881120d8028 RBX: ffff88814d070428 RCX:
0000000000000000
<4> [317.128166] RDX: ffff88813cb99c00 RSI: 0000000004000000 RDI:
0000000000000000
<4> [317.128168] RBP: ffffc9000167fbb8 R08: ffff88814e7b1f08 R09:
0000000000000001
<4> [317.128170] R10: 0000000000000001 R11: 0000000000000001 R12:
ffff88814e7b1f08
<4> [317.128172] R13: ffff88814e7b1f08 R14: ffff88813cb99c00 R15:
0000000000000001
<4> [317.128174] FS: 0000000000000000(0000) GS:ffff88846f280000(0000)
knlGS:0000000000000000
<4> [317.128176] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4> [317.128178] CR2: 0000000000000010 CR3: 000000011f676004 CR4:
0000000000770ef0
<4> [317.128180] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
<4> [317.128182] DR3: 0000000000000000 DR6: 00000000ffff07f0 DR7:
0000000000000400
<4> [317.128184] PKRU: 55555554
<4> [317.128185] Call Trace:
<4> [317.128187] <TASK> <4> [317.128189] ? show_regs+0x67/0x70 <4> [317.128194] ? __die_body+0x20/0x70 <4> [317.128196] ? __die+0x2b/0x40 <4> [317.128198] ? page_fault_oops+0x15f/0x4e0 <4> [317.128203] ? do_user_addr_fault+0x3fb/0x970 <4> [317.128205] ? lock_acquire+0xc7/0x2e0 <4> [317.128209] ? exc_page_fault+0x87/0x2b0 <4> [317.128212] ? asm_exc_page_fault+0x27/0x30 <4> [317.128216] ? xe_migrate_copy+0x66/0x13e0 [xe] <4> [317.128263] ? __lock_acquire+0xb9d/0x26f0 <4> [317.128265] ? __lock_acquire+0xb9d/0x26f0 <4> [317.128267] ? sg_free_append_table+0x20/0x80 <4> [317.128271] ? lock_acquire+0xc7/0x2e0 <4> [317.128273] ? mark_held_locks+0x4d/0x80 <4> [317.128275] ? trace_hardirqs_on+0x1e/0xd0 <4> [317.128278] ? _raw_spin_unlock_irqrestore+0x31/0x60 <4> [317.128281] ? __pm_runtime_resume+0x60/0xa0 <4> [317.128284] xe_bo_move+0x682/0xc50 [xe] <4> [317.128315] ? lock_is_held_type+0xaa/0x120 <4> [317.128318] ttm_bo_handle_move_mem+0xe5/0x1a0 [ttm] <4> [317.128324] ttm_bo_validate+0xd1/0x1a0 [ttm] <4> [317.128328] shrink_test_run_device+0x721/0xc10 [xe] <4> [317.128360] ? find_held_lock+0x31/0x90 <4> [317.128363] ? lock_release+0xd1/0x2a0 <4> [317.128365] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [kunit] <4> [317.128370] xe_bo_shrink_kunit+0x11/0x20 [xe] <4> [317.128397] kunit_try_run_case+0x6e/0x150 [kunit] <4> [317.128400] ? trace_hardirqs_on+0x1e/0xd0 <4> [317.128402] ? _raw_spin_unlock_irqrestore+0x31/0x60 <4> [317.128404] kunit_generic_run_threadfn_adapter+0x1e/0x40 [kunit] <4> [317.128407] kthread+0xf5/0x130 <4> [317.128410] ? __pfx_kthread+0x10/0x10 <4> [317.128412] ret_from_fork+0x39/0x60 <4> [317.128415] ? __pfx_kthread+0x10/0x10 <4> [317.128416] ret_from_fork_asm+0x1a/0x30 <4> [317.128420] </TASK>
--- drivers/gpu/drm/xe/xe_bo.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/xe/xe_bo.c +2 -2
@@ -680,8 +680,8 @@ static int xe_bo_move(struct ttm_buffer_object *ttm_bo, bool evict, tt_has_data = ttm && (ttm_tt_is_populated (ttm) || (ttm->page_flags &TTM_TT_FLAG_SWAPPED )); - move_lacks_source = handle_system_ccs ? (!bo->ccs_cleared) : - (!mem_type_is_vram (old_mem_type) && !tt_has_data); + move_lacks_source = !old_mem || (handle_system_ccs ? (!bo->ccs_cleared) : + (!mem_type_is_vram (old_mem_type) && !tt_has_data)); needs_clear = (ttm && ttm->page_flags &TTM_TT_FLAG_ZERO_ALLOC ) || (!ttm && ttm_bo->type == ttm_bo_type_device);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/558 cifs: Fix buffer overflow when parsing NFS reparse points
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pali Rohár <[email protected]>
[ Upstream commit e2a8910af01653c1c268984855629d71fb81f404 ]
ReparseDataLength is sum of the InodeType size and DataBuffer size. So to get DataBuffer size it is needed to subtract InodeType's size from ReparseDataLength.
Function cifs_strndup_from_utf16() is currentlly accessing buf->DataBuffer at position after the end of the buffer because it does not subtract InodeType size from the length. Fix this problem and correctly subtract variable len.
Member InodeType is present only when reparse buffer is large enough. Check for ReparseDataLength before accessing InodeType to prevent another invalid memory access.
Major and minor rdev values are present also only when reparse buffer is large enough. Check for reparse buffer size before calling reparse_mkdev().
--- fs/smb/client/reparse.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
fs/smb/client/reparse.c +14 -1
@@ -320,9 +320,16 @@ static int parse_reparse_posix(struct reparse_posix_data *buf,unsigned int len;u64 type; + len =le16_to_cpu (buf->ReparseDataLength); +if (len <sizeof (buf->InodeType)) { +cifs_dbg (VFS ,"srv returned malformed nfs buffer\n" ); +return -EIO ; + } + + len -=sizeof (buf->InodeType); +switch ((type =le64_to_cpu (buf->InodeType))) {case NFS_SPECFILE_LNK : - len =le16_to_cpu (buf->ReparseDataLength); data->symlink_target =cifs_strndup_from_utf16 (buf->DataBuffer, len, true, cifs_sb->local_nls);
@@ -482,12 +489,18 @@ bool cifs_reparse_point_to_fattr(struct cifs_sb_info *cifs_sb,u32 tag = data->reparse.tag;if (tag ==IO_REPARSE_TAG_NFS && buf) { +if (le16_to_cpu (buf->ReparseDataLength) <sizeof (buf->InodeType)) +return false;switch (le64_to_cpu (buf->InodeType)) {case NFS_SPECFILE_CHR : +if (le16_to_cpu (buf->ReparseDataLength) !=sizeof (buf->InodeType) +8 ) +return false; fattr->cf_mode |=S_IFCHR ; fattr->cf_rdev =reparse_nfs_mkdev (buf);break ;case NFS_SPECFILE_BLK : +if (le16_to_cpu (buf->ReparseDataLength) !=sizeof (buf->InodeType) +8 ) +return false; fattr->cf_mode |=S_IFBLK ; fattr->cf_rdev =reparse_nfs_mkdev (buf);break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/558 cifs: Do not convert delimiter when parsing NFS-style symlinks
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pali Rohár <[email protected]>
[ Upstream commit d3a49f60917323228f8fdeee313260ef14f94df7 ]
NFS-style symlinks have target location always stored in NFS/UNIX form where backslash means the real UNIX backslash and not the SMB path separator.
So do not mangle slash and backslash content of NFS-style symlink during readlink() syscall as it is already in the correct Linux form.
This fixes interoperability of NFS-style symlinks with backslashes created by Linux NFS3 client throw Windows NFS server and retrieved by Linux SMB client throw Windows SMB server, where both Windows servers exports the same directory.
--- fs/smb/client/reparse.c | 1 - 1 file changed, 1 deletion(-)
fs/smb/client/reparse.c +0 -1
@@ -335,7 +335,6 @@ static int parse_reparse_posix(struct reparse_posix_data *buf, cifs_sb->local_nls);if (!data->symlink_target)return -ENOMEM ; -convert_delimiter (data->symlink_target,'/' );cifs_dbg (FYI ,"%s: target path: %s\n" , __func__, data->symlink_target);break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/558 gpiolib: Fix potential NULL pointer dereference in gpiod_get_label()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <[email protected]>
[ Upstream commit 7b99b5ab885993bff010ebcd93be5e511c56e28a ]
In gpiod_get_label(), it is possible that srcu_dereference_check() may return a NULL pointer, leading to a scenario where label->str is accessed without verifying if label itself is NULL.
This patch adds a proper NULL check for label before accessing label->str. The check for label->str != NULL is removed because label->str can never be NULL if label is not NULL.
This fixes the issue where the label name was being printed as (efault) when dumping the sysfs GPIO file when label == NULL.
--- drivers/gpio/gpiolib.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpio/gpiolib.c +2 -2
@@ -115,12 +115,12 @@ const char *gpiod_get_label(struct gpio_desc *desc) srcu_read_lock_held(&desc->gdev->desc_srcu));if (test_bit (FLAG_USED_AS_IRQ , &flags)) -return label->str ?:"interrupt" ; +return label ? label->str :"interrupt" ;if (!test_bit (FLAG_REQUESTED , &flags))return NULL ; -return label->str; +return label ? label->str :NULL ; }static void desc_free_label (struct rcu_head *rh)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/558 tools/rtla: Fix installation from out-of-tree build
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
[ Upstream commit f771d5369f1dbfe32c93bcb4f5d7ca8322b15389 ]
rtla now supports out-of-tree builds, but installation fails as it still tries to install the rtla binary from the source tree. Use the existing macro $(RTLA) to refer to the binary.
--- tools/tracing/rtla/Makefile.rtla | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/tracing/rtla/Makefile.rtla +1 -1
@@ -38,7 +38,7 @@ BINDIR := /usr/bin .PHONY: install install: doc_install @$(MKDIR) -p $(DESTDIR)$(BINDIR) - $(call QUIET_INSTALL,rtla)$(INSTALL) rtla -m 755 $(DESTDIR)$(BINDIR) + $(call QUIET_INSTALL,rtla)$(INSTALL) $(RTLA) -m 755 $(DESTDIR)$(BINDIR) @$(STRIP) $(DESTDIR)$(BINDIR)/rtla @test ! -f $(DESTDIR)$(BINDIR)/osnoise || $(RM) $(DESTDIR)$(BINDIR)/osnoise @$(LN) rtla $(DESTDIR)$(BINDIR)/osnoise
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/558 ALSA: gus: Fix some error handling paths related to get_bpos() usage
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 9df39a872c462ea07a3767ebd0093c42b2ff78a2 ]
If get_bpos() fails, it is likely that the corresponding error code should be returned.
--- sound/isa/gus/gus_pcm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/isa/gus/gus_pcm.c +2 -2
@@ -378,7 +378,7 @@ static int snd_gf1_pcm_playback_copy(struct snd_pcm_substream *substream, bpos =get_bpos (pcmp, voice, pos, len);if (bpos <0 ) -return pos; +return bpos;if (copy_from_iter (runtime->dma_area + bpos, len, src) != len)return -EFAULT ;return playback_copy_ack (substream, bpos, len);
@@ -395,7 +395,7 @@ static int snd_gf1_pcm_playback_silence(struct snd_pcm_substream *substream, bpos =get_bpos (pcmp, voice, pos, len);if (bpos <0 ) -return pos; +return bpos;snd_pcm_format_set_silence (runtime->format, runtime->dma_area + bpos,bytes_to_samples (runtime, count));return playback_copy_ack (substream, bpos, len);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/558 ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit b3ebb007060f89d5a45c9b99f06a55e36a1945b5 ]
We received a regression report for System76 Pangolin (pang14) due to the recent fix for Tuxedo Sirius devices to support the top speaker. The reason was the conflicting PCI SSID, as often seen.
As a workaround, now the codec SSID is checked and the quirk is applied conditionally only to Sirius devices.
--- sound/pci/hda/patch_conexant.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-)
sound/pci/hda/patch_conexant.c +19 -5
@@ -816,6 +816,23 @@ static const struct hda_pintbl cxt_pincfg_sws_js201d[] = { {} }; +/* pincfg quirk for Tuxedo Sirius; +* unfortunately the (PCI) SSID conflicts with System76 Pangolin pang14, +* which has incompatible pin setup, so we check the codec SSID (luckily +* different one!) and conditionally apply the quirk here +*/ +static void cxt_fixup_sirius_top_speaker (struct hda_codec *codec, +const struct hda_fixup *fix, +int action) +{ +/* ignore for incorrectly picked-up pang14 */ +if (codec->core.subsystem_id ==0x278212b3 ) +return ; +/* set up the top speaker pin */ +if (action ==HDA_FIXUP_ACT_PRE_PROBE ) +snd_hda_codec_set_pincfg (codec,0x1d ,0x82170111 ); +} +static const struct hda_fixup cxt_fixups[] = { [CXT_PINCFG_LENOVO_X200 ] = { .type =HDA_FIXUP_PINS ,
@@ -976,11 +993,8 @@ static const struct hda_fixup cxt_fixups[] = { .v.pins = cxt_pincfg_sws_js201d, }, [CXT_PINCFG_TOP_SPEAKER] = { - .type = HDA_FIXUP_PINS, - .v.pins = (const struct hda_pintbl []) { - {0x1d ,0x82170111 }, - { } - }, + .type = HDA_FIXUP_FUNC, + .v.func = cxt_fixup_sirius_top_speaker, }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/558 drm/amd/display: Disable replay if VRR capability is false
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Chung <[email protected]>
[ Upstream commit b68417613d4134b9e39fff95e72ca726268b47db ]
[Why]
The VRR need to be supported for panel replay feature. If VRR capability is false, panel replay capability also need to be disabled.
[How]
After update the vrr capability, the panel replay capability also need to be check if need.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +6 -0
@@ -12240,6 +12240,12 @@ void amdgpu_dm_update_freesync_caps(struct drm_connector *connector,if (dm_con_state) dm_con_state->freesync_capable = freesync_capable; +if (connector->state && amdgpu_dm_connector->dc_link && !freesync_capable && + amdgpu_dm_connector->dc_link->replay_settings.config.replay_supported) { + amdgpu_dm_connector->dc_link->replay_settings.config.replay_supported = false; + amdgpu_dm_connector->dc_link->replay_settings.replay_feature_enabled = false; + } +if (connector->vrr_capable_property)drm_connector_set_vrr_capable_property (connector, freesync_capable);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/558 drm/amd/display: Fix VRR cannot enable
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Chung <[email protected]>
[ Upstream commit f91a9af09dea850d83d4b217b8acbafd97b5c61f ]
[Why]
Sometimes the VRR cannot enable after login to the desktop.
User space may call the DRM_IOCTL_MODE_GETCONNECTOR right after the DRM_IOCTL_MODE_RMFB.
After calling DRM_IOCTL_MODE_RMFB to remove all the frame buffer and it will cause the driver to disable the crtc and disable the link while calling the link_set_dpms_off().
It will cause the dpcd read failed in amdgpu_dm_update_freesync_caps() while try to get the DP_MSA_TIMING_PAR_IGNORED capability and think the sink side does not support VRR.
[How]
Use the dpcd_caps.allow_invalid_MSA_timing_param flag instead of reading from dpcd directly.
dpcd_caps.allow_invalid_MSA_timing_param flag is updated during HPD. It is safe to replace the original method.
--- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 23 ++----------------- 1 file changed, 2 insertions(+), 21 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +2 -21
@@ -11812,25 +11812,6 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev,return ret; } -static bool is_dp_capable_without_timing_msa (struct dc *dc, -struct amdgpu_dm_connector *amdgpu_dm_connector) -{ -u8 dpcd_data; -bool capable = false; - -if (amdgpu_dm_connector->dc_link && -dm_helpers_dp_read_dpcd ( -NULL , - amdgpu_dm_connector->dc_link, -DP_DOWN_STREAM_PORT_COUNT , - &dpcd_data, -sizeof (dpcd_data))) { - capable = (dpcd_data &DP_MSA_TIMING_PAR_IGNORED ) ? true:false; - } - -return capable; -} - static bool dm_edid_parser_send_cea(struct amdgpu_display_manager *dm, unsigned int offset, unsigned int total_length,
@@ -12133,8 +12114,8 @@ void amdgpu_dm_update_freesync_caps(struct drm_connector *connector, sink->sink_signal == SIGNAL_TYPE_EDP)) {bool edid_check_required = false; -if (is_dp_capable_without_timing_msa (adev->dm.dc, - amdgpu_dm_connector)) { +if (amdgpu_dm_connector->dc_link && + amdgpu_dm_connector->dc_link->dpcd_caps.allow_invalid_MSA_timing_param) {if (edid->features &DRM_EDID_FEATURE_CONTINUOUS_FREQ ) { amdgpu_dm_connector->min_vfreq = connector->display_info.monitor_range.min_vfreq; amdgpu_dm_connector->max_vfreq = connector->display_info.monitor_range.max_vfreq;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/558 drm/amd/display: Re-enable panel replay feature
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Chung <[email protected]>
[ Upstream commit be64336307a6c3ee71fe1337c1b9f0495aa83c50 ]
[Why & How]
Fixed the replay issues and now re-enable the panel replay feature.
--- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 20 ++++++++----------- 1 file changed, 8 insertions(+), 12 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +8 -12
@@ -4919,18 +4919,14 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev)/* Determine whether to enable Replay support by default. */ if (!(amdgpu_dc_debug_mask &DC_DISABLE_REPLAY )) {switch (amdgpu_ip_version (adev,DCE_HWIP ,0 )) { -/* -* Disabled by default due to https://gitlab.freedesktop.org/drm/amd/-/issues/3344 -* case IP_VERSION(3, 1, 4): -* case IP_VERSION(3, 1, 5): -* case IP_VERSION(3, 1, 6): -* case IP_VERSION(3, 2, 0): -* case IP_VERSION(3, 2, 1): -* case IP_VERSION(3, 5, 0): -* case IP_VERSION(3, 5, 1): -* replay_feature_enabled = true; -* break; -*/ +case IP_VERSION (3 ,1 ,4 ): +case IP_VERSION (3 ,2 ,0 ): +case IP_VERSION (3 ,2 ,1 ): +case IP_VERSION (3 ,5 ,0 ): +case IP_VERSION (3 ,5 ,1 ): + replay_feature_enabled = true; +break ; +default : replay_feature_enabled = amdgpu_dc_feature_mask &DC_REPLAY_MASK ;break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/558 e1000e: avoid failing the system during pm_suspend
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Lifshits <[email protected]>
[ Upstream commit 0a6ad4d9e1690c7faa3a53f762c877e477093657 ]
Occasionally when the system goes into pm_suspend, the suspend might fail due to a PHY access error on the network adapter. Previously, this would have caused the whole system to fail to go to a low power state. An example of this was reported in the following Bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=205015
[ 1663.694828] e1000e 0000:00:19.0 eth0: Failed to disable ULP [ 1664.731040] asix 2-3:1.0 eth1: link up, 100Mbps, full-duplex, lpa 0xC1E1 [ 1665.093513] e1000e 0000:00:19.0 eth0: Hardware Error [ 1665.596760] e1000e 0000:00:19.0: pci_pm_resume+0x0/0x80 returned 0 after 2975399 usecs
and then the system never recovers from it, and all the following suspend failed due to this
[22909.393854] PM: pci_pm_suspend(): e1000e_pm_suspend+0x0/0x760 [e1000e] returns -2 [22909.393858] PM: dpm_run_callback(): pci_pm_suspend+0x0/0x160 returns -2 [22909.393861] PM: Device 0000:00:1f.6 failed to suspend async: error -2
This can be avoided by changing the return values of __e1000_shutdown and e1000e_pm_suspend functions so that they always return 0 (success). This is consistent with what other drivers do.
If the e1000e driver encounters a hardware error during suspend, potential side effects include slightly higher power draw or non-working wake on LAN. This is preferred to a system-level suspend failure, and a warning message is written to the system log, so that the user can be aware that the LAN controller experienced a problem during suspend.
--- drivers/net/ethernet/intel/e1000e/netdev.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
drivers/net/ethernet/intel/e1000e/netdev.c +11 -8
@@ -6671,8 +6671,10 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool runtime)if (adapter->flags2 &FLAG2_HAS_PHY_WAKEUP ) {/* enable wakeup by the PHY */ retval =e1000_init_phy_wakeup (adapter, wufc); -if (retval) -return retval; +if (retval) { +e_err ("Failed to enable wakeup\n" ); + goto skip_phy_configurations; + } }else {/* enable wakeup by the MAC */ ew32 (WUFC , wufc);
@@ -6693,8 +6695,10 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool runtime)* or broadcast. */ retval =e1000_enable_ulp_lpt_lp (hw, !runtime); -if (retval) -return retval; +if (retval) { +e_err ("Failed to enable ULP\n" ); + goto skip_phy_configurations; + } } }
@@ -6726,6 +6730,7 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool runtime) hw->phy.ops.release (hw); } +skip_phy_configurations:/* Release control of h/w to f/w. If f/w is AMT enabled, this * would have already happened in close and is redundant. */
@@ -6968,15 +6973,13 @@ static int e1000e_pm_suspend(struct device *dev)e1000e_pm_freeze (dev); rc =__e1000_shutdown (pdev, false); -if (rc) { -e1000e_pm_thaw (dev); - }else { +if (!rc) {/* Introduce S0ix implementation */ if (adapter->flags2 &FLAG2_ENABLE_S0IX_FLOWS )e1000e_s0ix_entry_flow (adapter); } -return rc; +return 0 ; }static int e1000e_pm_resume (struct device *dev)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/558 l2tp: prevent possible tunnel refcount underflow
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Chapman <[email protected]>
[ Upstream commit 24256415d18695b46da06c93135f5b51c548b950 ]
When a session is created, it sets a backpointer to its tunnel. When the session refcount drops to 0, l2tp_session_free drops the tunnel refcount if session->tunnel is non-NULL. However, session->tunnel is set in l2tp_session_create, before the tunnel refcount is incremented by l2tp_session_register, which leaves a small window where session->tunnel is non-NULL when the tunnel refcount hasn't been bumped.
Moving the assignment to l2tp_session_register is trivial but l2tp_session_create calls l2tp_session_set_header_len which uses session->tunnel to get the tunnel's encap. Add an encap arg to l2tp_session_set_header_len to avoid using session->tunnel.
If l2tpv3 sessions have colliding IDs, it is possible for l2tp_v3_session_get to race with l2tp_session_register and fetch a session which doesn't yet have session->tunnel set. Add a check for this case.
--- net/l2tp/l2tp_core.c | 24 +++++++++++++++++------- net/l2tp/l2tp_core.h | 3 ++- net/l2tp/l2tp_netlink.c | 4 +++- net/l2tp/l2tp_ppp.c | 3 ++- 4 files changed, 24 insertions(+), 10 deletions(-)
net/l2tp/l2tp_core.c +17 -7
@@ -254,7 +254,14 @@ struct l2tp_session *l2tp_v3_session_get(const struct net *net, struct sock *sk,hash_for_each_possible_rcu (pn->l2tp_v3_session_htable, session, hlist, key) { -if (session->tunnel->sock == sk && +/* session->tunnel may be NULL if another thread is in +* l2tp_session_register and has added an item to +* l2tp_v3_session_htable but hasn't yet added the +* session to its tunnel's session_list. +*/ +struct l2tp_tunnel *tunnel =READ_ONCE (session->tunnel); + +if (tunnel && tunnel->sock == sk &&refcount_inc_not_zero (&session->ref_count)) {rcu_read_unlock_bh ();return session;
@@ -482,6 +489,7 @@ int l2tp_session_register(struct l2tp_session *session, }l2tp_tunnel_inc_refcount (tunnel); +WRITE_ONCE (session->tunnel, tunnel);list_add (&session->list, &tunnel->session_list);if (tunnel->version ==L2TP_HDR_VER_3 ) {
@@ -797,7 +805,8 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,if (!session->lns_mode && !session->send_seq) {trace_session_seqnum_lns_enable (session); session->send_seq =1 ; -l2tp_session_set_header_len (session, tunnel->version); +l2tp_session_set_header_len (session, tunnel->version, + tunnel->encap); } }else {/* No sequence numbers.
@@ -818,7 +827,8 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,if (!session->lns_mode && session->send_seq) {trace_session_seqnum_lns_disable (session); session->send_seq =0 ; -l2tp_session_set_header_len (session, tunnel->version); +l2tp_session_set_header_len (session, tunnel->version, + tunnel->encap); }else if (session->send_seq) {pr_debug_ratelimited ("%s: recv data has no seq numbers when required. Discarding.\n" , session->name);
@@ -1663,7 +1673,8 @@ EXPORT_SYMBOL_GPL(l2tp_session_delete);/* We come here whenever a session's send_seq, cookie_len or * l2specific_type parameters are set. */ -void l2tp_session_set_header_len (struct l2tp_session *session,int version) +void l2tp_session_set_header_len (struct l2tp_session *session,int version, +enum l2tp_encap_type encap) {if (version ==L2TP_HDR_VER_2 ) { session->hdr_len =6 ;
@@ -1672,7 +1683,7 @@ void l2tp_session_set_header_len(struct l2tp_session *session, int version) }else { session->hdr_len =4 + session->cookie_len; session->hdr_len +=l2tp_get_l2specific_len (session); -if (session->tunnel->encap ==L2TP_ENCAPTYPE_UDP ) +if (encap ==L2TP_ENCAPTYPE_UDP ) session->hdr_len +=4 ; } }
@@ -1686,7 +1697,6 @@ struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunn session =kzalloc (sizeof (*session) + priv_size,GFP_KERNEL );if (session) { session->magic =L2TP_SESSION_MAGIC ; - session->tunnel = tunnel; session->session_id = session_id; session->peer_session_id = peer_session_id;
@@ -1724,7 +1734,7 @@ struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnmemcpy (&session->peer_cookie[0 ], &cfg->peer_cookie[0 ], cfg->peer_cookie_len); } -l2tp_session_set_header_len (session, tunnel->version); +l2tp_session_set_header_len (session, tunnel->version, tunnel->encap);refcount_set (&session->ref_count,1 );
net/l2tp/l2tp_core.h +2 -1
@@ -260,7 +260,8 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,int l2tp_udp_encap_recv (struct sock *sk,struct sk_buff *skb);/* Transmit path helpers for sending packets over the tunnel socket. */ -void l2tp_session_set_header_len (struct l2tp_session *session,int version); +void l2tp_session_set_header_len (struct l2tp_session *session,int version, +enum l2tp_encap_type encap);int l2tp_xmit_skb (struct l2tp_session *session,struct sk_buff *skb);/* Pseudowire management.
net/l2tp/l2tp_netlink.c +3 -1
@@ -692,8 +692,10 @@ static int l2tp_nl_cmd_session_modify(struct sk_buff *skb, struct genl_info *inf session->recv_seq =nla_get_u8 (info->attrs[L2TP_ATTR_RECV_SEQ ]);if (info->attrs[L2TP_ATTR_SEND_SEQ ]) { +struct l2tp_tunnel *tunnel = session->tunnel; + session->send_seq =nla_get_u8 (info->attrs[L2TP_ATTR_SEND_SEQ ]); -l2tp_session_set_header_len (session, session->tunnel->version); +l2tp_session_set_header_len (session, tunnel->version, tunnel->encap); }if (info->attrs[L2TP_ATTR_LNS_MODE ])
net/l2tp/l2tp_ppp.c +2 -1
@@ -1205,7 +1205,8 @@ static int pppol2tp_session_setsockopt(struct sock *sk, po->chan.hdrlen = val ?PPPOL2TP_L2TP_HDR_SIZE_SEQ :PPPOL2TP_L2TP_HDR_SIZE_NOSEQ ; } -l2tp_session_set_header_len (session, session->tunnel->version); +l2tp_session_set_header_len (session, session->tunnel->version, + session->tunnel->encap);break ;case PPPOL2TP_SO_LNSMODE :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/558 wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Kandybka <[email protected]>
[ Upstream commit 3f66f26703093886db81f0610b97a6794511917c ]
In 'ath9k_get_et_stats()', promote TX stats counters to 'u64' to avoid possible integer overflow. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wireless/ath/ath9k/debug.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/debug.c +2 -2
@@ -1325,11 +1325,11 @@ void ath9k_get_et_stats(struct ieee80211_hw *hw,struct ath_softc *sc = hw->priv;int i =0 ; - data[i++] = (sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BE )].tx_pkts_all + + data[i++] = ((u64 )sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BE )].tx_pkts_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BK )].tx_pkts_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_VI )].tx_pkts_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_VO )].tx_pkts_all); - data[i++] = (sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BE )].tx_bytes_all + + data[i++] = ((u64 )sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BE )].tx_bytes_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BK )].tx_bytes_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_VI )].tx_bytes_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_VO )].tx_bytes_all);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/558 wifi: rtw89: avoid to add interface to list twice when SER
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chih-Kang Chang <[email protected]>
[ Upstream commit 7dd5d2514a8ea58f12096e888b0bd050d7eae20a ]
If SER L2 occurs during the WoWLAN resume flow, the add interface flow is triggered by ieee80211_reconfig(). However, due to rtw89_wow_resume() return failure, it will cause the add interface flow to be executed again, resulting in a double add list and causing a kernel panic. Therefore, we have added a check to prevent double adding of the list.
list_add double add: new=ffff99d6992e2010, prev=ffff99d6992e2010, next=ffff99d695302628.
------------[ cut here ]------------ kernel BUG at lib/list_debug.c:37! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W O 6.6.30-02659-gc18865c4dfbd #1 770df2933251a0e3c888ba69d1053a817a6376a7 Hardware name: HP Grunt/Grunt, BIOS Google_Grunt.11031.169.0 06/24/2021 Workqueue: events_freezable ieee80211_restart_work [mac80211] RIP: 0010:__list_add_valid_or_report+0x5e/0xb0 Code: c7 74 18 48 39 ce 74 13 b0 01 59 5a 5e 5f 41 58 41 59 41 5a 5d e9 e2 d6 03 00 cc 48 c7 c7 8d 4f 17 83 48 89 c2 e8 02 c0 00 00 <0f> 0b 48 c7 c7 aa 8c 1c 83 e8 f4 bf 00 00 0f 0b 48 c7 c7 c8 bc 12 RSP: 0018:ffffa91b8007bc50 EFLAGS: 00010246 RAX: 0000000000000058 RBX: ffff99d6992e0900 RCX: a014d76c70ef3900 RDX: ffffa91b8007bae8 RSI: 00000000ffffdfff RDI: 0000000000000001 RBP: ffffa91b8007bc88 R08: 0000000000000000 R09: ffffa91b8007bae0 R10: 00000000ffffdfff R11: ffffffff83a79800 R12: ffff99d695302060 R13: ffff99d695300900 R14: ffff99d6992e1be0 R15: ffff99d6992e2010 FS: 0000000000000000(0000) GS:ffff99d6aac00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000078fbdba43480 CR3: 000000010e464000 CR4: 00000000001506f0 Call Trace: <TASK> ? __die_body+0x1f/0x70 ? die+0x3d/0x60 ? do_trap+0xa4/0x110 ? __list_add_valid_or_report+0x5e/0xb0 ? do_error_trap+0x6d/0x90 ? __list_add_valid_or_report+0x5e/0xb0 ? handle_invalid_op+0x30/0x40 ? __list_add_valid_or_report+0x5e/0xb0 ? exc_invalid_op+0x3c/0x50 ? asm_exc_invalid_op+0x16/0x20 ? __list_add_valid_or_report+0x5e/0xb0 rtw89_ops_add_interface+0x309/0x310 [rtw89_core 7c32b1ee6854761c0321027c8a58c5160e41f48f] drv_add_interface+0x5c/0x130 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc] ieee80211_reconfig+0x241/0x13d0 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc] ? finish_wait+0x3e/0x90 ? synchronize_rcu_expedited+0x174/0x260 ? sync_rcu_exp_done_unlocked+0x50/0x50 ? wake_bit_function+0x40/0x40 ieee80211_restart_work+0xf0/0x140 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc] process_scheduled_works+0x1e5/0x480 worker_thread+0xea/0x1e0 kthread+0xdb/0x110 ? move_linked_works+0x90/0x90 ? kthread_associate_blkcg+0xa0/0xa0 ret_from_fork+0x3b/0x50 ? kthread_associate_blkcg+0xa0/0xa0 ret_from_fork_asm+0x11/0x20 </TASK> Modules linked in: dm_integrity async_xor xor async_tx lz4 lz4_compress zstd zstd_compress zram zsmalloc rfcomm cmac uinput algif_hash algif_skcipher af_alg btusb btrtl iio_trig_hrtimer industrialio_sw_trigger btmtk industrialio_configfs btbcm btintel uvcvideo videobuf2_vmalloc iio_trig_sysfs videobuf2_memops videobuf2_v4l2 videobuf2_common uvc snd_hda_codec_hdmi veth snd_hda_intel snd_intel_dspcfg acpi_als snd_hda_codec industrialio_triggered_buffer kfifo_buf snd_hwdep industrialio i2c_piix4 snd_hda_core designware_i2s ip6table_nat snd_soc_max98357a xt_MASQUERADE xt_cgroup snd_soc_acp_rt5682_mach fuse rtw89_8922ae(O) rtw89_8922a(O) rtw89_pci(O) rtw89_core(O) 8021q mac80211(O) bluetooth ecdh_generic ecc cfg80211 r8152 mii joydev gsmi: Log Shutdown Reason 0x03 ---[ end trace 0000000000000000 ]---
--- drivers/net/wireless/realtek/rtw89/mac80211.c | 4 +++- drivers/net/wireless/realtek/rtw89/util.h | 18 ++++++++++++++++++ 2 files changed, 21 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtw89/mac80211.c +3 -1
@@ -126,7 +126,9 @@ static int rtw89_ops_add_interface(struct ieee80211_hw *hw, rtwvif->rtwdev = rtwdev; rtwvif->roc.state =RTW89_ROC_IDLE ; rtwvif->offchan = false; -list_add_tail (&rtwvif->list, &rtwdev->rtwvifs_list); +if (!rtw89_rtwvif_in_list (rtwdev, rtwvif)) +list_add_tail (&rtwvif->list, &rtwdev->rtwvifs_list); +INIT_WORK (&rtwvif->update_beacon_work, rtw89_core_update_beacon_work);INIT_DELAYED_WORK (&rtwvif->roc.roc_work, rtw89_roc_work);rtw89_leave_ps_mode (rtwdev);
drivers/net/wireless/realtek/rtw89/util.h +18 -0
@@ -16,6 +16,24 @@#define rtw89_for_each_rtwvif (rtwdev, rtwvif) \ list_for_each_entry(rtwvif, &(rtwdev)->rtwvifs_list, list) +/* Before adding rtwvif to list, we need to check if it already exist, beacase +* in some case such as SER L2 happen during WoWLAN flow, calling reconfig +* twice cause the list to be added twice. +*/ +static inline bool rtw89_rtwvif_in_list (struct rtw89_dev *rtwdev, +struct rtw89_vif *new) +{ +struct rtw89_vif *rtwvif; + +lockdep_assert_held (&rtwdev->mutex); + +rtw89_for_each_rtwvif (rtwdev, rtwvif) +if (rtwvif == new) +return true; + +return false; +} +/* The result of negative dividend and positive divisor is undefined, but it * should be one case of round-down or round-up. So, make it round-down if the * result is round-up.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/558 wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 94745807f3ebd379f23865e6dab196f220664179 ]
Syzbot points out that skb_trim() has a sanity check on the existing length of the skb, which can be uninitialised in some error paths. The intent here is clearly just to reset the length to zero before resubmitting, so switch to calling __skb_set_length(skb, 0) directly. In addition, __skb_set_length() already contains a call to skb_reset_tail_pointer(), so remove the redundant call.
The syzbot report came from ath9k_hif_usb_reg_in_cb(), but there's a similar usage of skb_trim() in ath9k_hif_usb_rx_cb(), change both while we're at it.
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +2 -4
@@ -716,8 +716,7 @@ static void ath9k_hif_usb_rx_cb(struct urb *urb) } resubmit: -skb_reset_tail_pointer (skb); -skb_trim (skb,0 ); +__skb_set_length (skb,0 );usb_anchor_urb (urb, &hif_dev->rx_submitted); ret =usb_submit_urb (urb,GFP_ATOMIC );
@@ -754,8 +753,7 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)case -ESHUTDOWN : goto free_skb;default : -skb_reset_tail_pointer (skb); -skb_trim (skb,0 ); +__skb_set_length (skb,0 ); goto resubmit; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/558 intel_idle: Disable promotion to C1E on Jasper Lake and Elkhart Lake
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai-Heng Feng <[email protected]>
[ Upstream commit 5bb33212b5c664396e5de4cd5a2999abb84a3978 ]
PCIe ethernet throughut is sub-optimal on Jasper Lake and Elkhart Lake.
The CPU can take long time to exit to C0 to handle IRQ and perform DMA when C1E has been entered.
For this reason, adjust intel_idle to disable promotion to C1E and still use C-states from ACPI _CST on those two platforms.
--- drivers/idle/intel_idle.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/idle/intel_idle.c +12 -2
@@ -1530,6 +1530,10 @@ static const struct idle_cpu idle_cpu_dnv __initconst = { .use_acpi = true, }; +static const struct idle_cpu idle_cpu_tmt__initconst = { + .disable_promotion_to_c1e = true, +}; +static const struct idle_cpu idle_cpu_snr__initconst = { .state_table = snr_cstates, .disable_promotion_to_c1e = true,
@@ -1594,6 +1598,8 @@ static const struct x86_cpu_id intel_idle_ids[] __initconst = {X86_MATCH_VFM (INTEL_ATOM_GOLDMONT , &idle_cpu_bxt),X86_MATCH_VFM (INTEL_ATOM_GOLDMONT_PLUS , &idle_cpu_bxt),X86_MATCH_VFM (INTEL_ATOM_GOLDMONT_D , &idle_cpu_dnv), +X86_MATCH_VFM (INTEL_ATOM_TREMONT , &idle_cpu_tmt), +X86_MATCH_VFM (INTEL_ATOM_TREMONT_L , &idle_cpu_tmt),X86_MATCH_VFM (INTEL_ATOM_TREMONT_D , &idle_cpu_snr),X86_MATCH_VFM (INTEL_ATOM_CRESTMONT , &idle_cpu_grr), X86_MATCH_VFM(INTEL_ATOM_CRESTMONT_X, &idle_cpu_srf),
@@ -2142,7 +2148,7 @@ static void __init intel_idle_cpuidle_driver_init(struct cpuidle_driver *drv) drv->state_count =1 ; -if (icpu) +if (icpu && icpu->state_table)intel_idle_init_cstates_icpu (drv);else intel_idle_init_cstates_acpi (drv);
@@ -2276,7 +2282,11 @@ static int __init intel_idle_init(void) icpu = (const struct idle_cpu *)id->driver_data;if (icpu) { - cpuidle_state_table = icpu->state_table; +if (icpu->state_table) + cpuidle_state_table = icpu->state_table; +else if (!intel_idle_acpi_cst_extract ()) +return -ENODEV ; + auto_demotion_disable_flags = icpu->auto_demotion_disable_flags;if (icpu->disable_promotion_to_c1e) c1e_promotion =C1E_PROMOTION_DISABLE ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/558 crypto: x86/sha256 - Add parentheses around macros single arguments
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fangrui Song <[email protected]>
[ Upstream commit 3363c460ef726ba693704dbcd73b7e7214ccc788 ]
The macros FOUR_ROUNDS_AND_SCHED and DO_4ROUNDS rely on an unexpected/undocumented behavior of the GNU assembler, which might change in the future
(https://sourceware.org/bugzilla/show_bug.cgi?id=32073).
M (1) (2) // 1 arg !? Future: 2 args
M 1 + 2 // 1 arg !? Future: 3 args
M 1 2 // 2 argsAdd parentheses around the single arguments to support future GNU assembler and LLVM integrated assembler (when the IsOperator hack from the following link is dropped).
--- arch/x86/crypto/sha256-avx2-asm.S | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
arch/x86/crypto/sha256-avx2-asm.S +8 -8
@@ -592,22 +592,22 @@ SYM_TYPED_FUNC_START(sha256_transform_rorx) leaq K256+0*32(%rip), INP ## reuse INP as scratch reg vpaddd (INP, SRND), X0, XFER vmovdqa XFER, 0*32+_XFER(%rsp, SRND) - FOUR_ROUNDS_AND_SCHED _XFER + 0*32 + FOUR_ROUNDS_AND_SCHED (_XFER + 0*32) leaq K256+1*32(%rip), INP vpaddd (INP, SRND), X0, XFER vmovdqa XFER, 1*32+_XFER(%rsp, SRND) - FOUR_ROUNDS_AND_SCHED _XFER + 1*32 + FOUR_ROUNDS_AND_SCHED (_XFER + 1*32) leaq K256+2*32(%rip), INP vpaddd (INP, SRND), X0, XFER vmovdqa XFER, 2*32+_XFER(%rsp, SRND) - FOUR_ROUNDS_AND_SCHED _XFER + 2*32 + FOUR_ROUNDS_AND_SCHED (_XFER + 2*32) leaq K256+3*32(%rip), INP vpaddd (INP, SRND), X0, XFER vmovdqa XFER, 3*32+_XFER(%rsp, SRND) - FOUR_ROUNDS_AND_SCHED _XFER + 3*32 + FOUR_ROUNDS_AND_SCHED (_XFER + 3*32) add $4*32, SRND cmp $3*4*32, SRND
@@ -618,12 +618,12 @@ SYM_TYPED_FUNC_START(sha256_transform_rorx) leaq K256+0*32(%rip), INP vpaddd (INP, SRND), X0, XFER vmovdqa XFER, 0*32+_XFER(%rsp, SRND) - DO_4ROUNDS _XFER + 0*32 + DO_4ROUNDS (_XFER + 0*32) leaq K256+1*32(%rip), INP vpaddd (INP, SRND), X1, XFER vmovdqa XFER, 1*32+_XFER(%rsp, SRND) - DO_4ROUNDS _XFER + 1*32 + DO_4ROUNDS (_XFER + 1*32) add $2*32, SRND vmovdqa X2, X0
@@ -651,8 +651,8 @@ SYM_TYPED_FUNC_START(sha256_transform_rorx) xor SRND, SRND .align 16 .Lloop3: - DO_4ROUNDS _XFER + 0*32 + 16 - DO_4ROUNDS _XFER + 1*32 + 16 + DO_4ROUNDS (_XFER + 0*32 + 16) + DO_4ROUNDS (_XFER + 1*32 + 16) add $2*32, SRND cmp $4*4*32, SRND jb .Lloop3
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/558 crypto: octeontx - Fix authenc setkey
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 311eea7e37c4c0b44b557d0c100860a03b4eab65 ]
Use the generic crypto_authenc_extractkeys helper instead of custom parsing code that is slightly broken. Also fix a number of memory leaks by moving memory allocation from setkey to init_tfm (setkey can be called multiple times over the life of a tfm).
Finally accept all hash key lengths by running the digest over extra-long keys.
--- .../crypto/marvell/octeontx/otx_cptvf_algs.c | 261 +++++++----------- 1 file changed, 93 insertions(+), 168 deletions(-)
drivers/crypto/marvell/octeontx/otx_cptvf_algs.c +93 -168
@@ -17,7 +17,6 @@#include <crypto/sha2.h> #include <crypto/xts.h> #include <crypto/scatterwalk.h> -#include <linux/rtnetlink.h> #include <linux/sort.h> #include <linux/module.h> #include "otx_cptvf.h"
@@ -66,6 +65,8 @@ static struct cpt_device_table ae_devices = { .count = ATOMIC_INIT(0) }; +static struct otx_cpt_sdesc *alloc_sdesc (struct crypto_shash *alg); +static inline int get_se_device (struct pci_dev **pdev,int *cpu_num) {int count, ret =0 ;
@@ -509,44 +510,61 @@ static int cpt_aead_init(struct crypto_aead *tfm, u8 cipher_type, u8 mac_type) ctx->cipher_type = cipher_type; ctx->mac_type = mac_type; +switch (ctx->mac_type) { +case OTX_CPT_SHA1 : + ctx->hashalg =crypto_alloc_shash ("sha1" ,0 ,0 ); +break ; + +case OTX_CPT_SHA256 : + ctx->hashalg =crypto_alloc_shash ("sha256" ,0 ,0 ); +break ; + +case OTX_CPT_SHA384 : + ctx->hashalg =crypto_alloc_shash ("sha384" ,0 ,0 ); +break ; + +case OTX_CPT_SHA512 : + ctx->hashalg =crypto_alloc_shash ("sha512" ,0 ,0 ); +break ; + } + +if (IS_ERR (ctx->hashalg)) +return PTR_ERR (ctx->hashalg); + +crypto_aead_set_reqsize_dma (tfm,sizeof (struct otx_cpt_req_ctx )); + +if (!ctx->hashalg) +return 0 ; +/* * When selected cipher is NULL we use HMAC opcode instead of * FLEXICRYPTO opcode therefore we don't need to use HASH algorithms * for calculating ipad and opad */ if (ctx->cipher_type !=OTX_CPT_CIPHER_NULL ) { -switch (ctx->mac_type) { -case OTX_CPT_SHA1 : - ctx->hashalg =crypto_alloc_shash ("sha1" ,0 , -CRYPTO_ALG_ASYNC ); -if (IS_ERR (ctx->hashalg)) -return PTR_ERR (ctx->hashalg); -break ; - -case OTX_CPT_SHA256 : - ctx->hashalg =crypto_alloc_shash ("sha256" ,0 , -CRYPTO_ALG_ASYNC ); -if (IS_ERR (ctx->hashalg)) -return PTR_ERR (ctx->hashalg); -break ; +int ss =crypto_shash_statesize (ctx->hashalg); -case OTX_CPT_SHA384 : - ctx->hashalg =crypto_alloc_shash ("sha384" ,0 , -CRYPTO_ALG_ASYNC ); -if (IS_ERR (ctx->hashalg)) -return PTR_ERR (ctx->hashalg); -break ; + ctx->ipad =kzalloc (ss,GFP_KERNEL ); +if (!ctx->ipad) { +crypto_free_shash (ctx->hashalg); +return -ENOMEM ; + } -case OTX_CPT_SHA512 : - ctx->hashalg =crypto_alloc_shash ("sha512" ,0 , -CRYPTO_ALG_ASYNC ); -if (IS_ERR (ctx->hashalg)) -return PTR_ERR (ctx->hashalg); -break ; + ctx->opad =kzalloc (ss,GFP_KERNEL ); +if (!ctx->opad) { +kfree (ctx->ipad); +crypto_free_shash (ctx->hashalg); +return -ENOMEM ; } } -crypto_aead_set_reqsize_dma (tfm,sizeof (struct otx_cpt_req_ctx )); + ctx->sdesc =alloc_sdesc (ctx->hashalg); +if (!ctx->sdesc) { +kfree (ctx->opad); +kfree (ctx->ipad); +crypto_free_shash (ctx->hashalg); +return -ENOMEM ; + }return 0 ; }
@@ -602,8 +620,7 @@ static void otx_cpt_aead_exit(struct crypto_aead *tfm)kfree (ctx->ipad);kfree (ctx->opad); -if (ctx->hashalg) -crypto_free_shash (ctx->hashalg); +crypto_free_shash (ctx->hashalg);kfree (ctx->sdesc); }
@@ -699,7 +716,7 @@ static inline void swap_data64(void *buf, u32 len) *dst =cpu_to_be64p (src); } -static int copy_pad (u8 mac_type,u8 *out_pad,u8 *in_pad) +static int swap_pad (u8 mac_type,u8 *pad) {struct sha512_state *sha512;struct sha256_state *sha256;
@@ -707,22 +724,19 @@ static int copy_pad(u8 mac_type, u8 *out_pad, u8 *in_pad)switch (mac_type) {case OTX_CPT_SHA1 : - sha1 = (struct sha1_state *) in_pad; + sha1 = (struct sha1_state *)pad;swap_data32 (sha1->state,SHA1_DIGEST_SIZE ); -memcpy (out_pad, &sha1->state,SHA1_DIGEST_SIZE );break ;case OTX_CPT_SHA256 : - sha256 = (struct sha256_state *) in_pad; + sha256 = (struct sha256_state *)pad;swap_data32 (sha256->state,SHA256_DIGEST_SIZE ); -memcpy (out_pad, &sha256->state,SHA256_DIGEST_SIZE );break ;case OTX_CPT_SHA384 :case OTX_CPT_SHA512 : - sha512 = (struct sha512_state *) in_pad; + sha512 = (struct sha512_state *)pad;swap_data64 (sha512->state,SHA512_DIGEST_SIZE ); -memcpy (out_pad, &sha512->state,SHA512_DIGEST_SIZE );break ;default :
@@ -732,55 +746,53 @@ static int copy_pad(u8 mac_type, u8 *out_pad, u8 *in_pad)return 0 ; } -static int aead_hmac_init (struct crypto_aead *cipher) +static int aead_hmac_init (struct crypto_aead *cipher, +struct crypto_authenc_keys *keys) {struct otx_cpt_aead_ctx *ctx =crypto_aead_ctx_dma (cipher); -int state_size =crypto_shash_statesize (ctx->hashalg);int ds =crypto_shash_digestsize (ctx->hashalg);int bs =crypto_shash_blocksize (ctx->hashalg); -int authkeylen = ctx->auth_key_len; +int authkeylen = keys->authkeylen;u8 *ipad =NULL , *opad =NULL ; -int ret =0 , icount =0 ; +int icount =0 ; +int ret; - ctx->sdesc =alloc_sdesc (ctx->hashalg); -if (!ctx->sdesc) -return -ENOMEM ; +if (authkeylen > bs) { + ret =crypto_shash_digest (&ctx->sdesc->shash, keys->authkey, + authkeylen, ctx->key); +if (ret) +return ret; + authkeylen = ds; + }else +memcpy (ctx->key, keys->authkey, authkeylen); - ctx->ipad =kzalloc (bs,GFP_KERNEL ); -if (!ctx->ipad) { - ret = -ENOMEM ; - goto calc_fail; - } + ctx->enc_key_len = keys->enckeylen; + ctx->auth_key_len = authkeylen; - ctx->opad =kzalloc (bs,GFP_KERNEL ); -if (!ctx->opad) { - ret = -ENOMEM ; - goto calc_fail; - } +if (ctx->cipher_type ==OTX_CPT_CIPHER_NULL ) +return keys->enckeylen ? -EINVAL :0 ; - ipad =kzalloc (state_size,GFP_KERNEL ); -if (!ipad) { - ret = -ENOMEM ; - goto calc_fail; +switch (keys->enckeylen) { +case AES_KEYSIZE_128 : + ctx->key_type =OTX_CPT_AES_128_BIT ; +break ; +case AES_KEYSIZE_192 : + ctx->key_type =OTX_CPT_AES_192_BIT ; +break ; +case AES_KEYSIZE_256 : + ctx->key_type =OTX_CPT_AES_256_BIT ; +break ; +default : +/* Invalid key length */ +return -EINVAL ; } - opad =kzalloc (state_size,GFP_KERNEL ); -if (!opad) { - ret = -ENOMEM ; - goto calc_fail; - } +memcpy (ctx->key + authkeylen, keys->enckey, keys->enckeylen); -if (authkeylen > bs) { - ret =crypto_shash_digest (&ctx->sdesc->shash, ctx->key, - authkeylen, ipad); -if (ret) - goto calc_fail; - - authkeylen = ds; - }else { -memcpy (ipad, ctx->key, authkeylen); - } + ipad = ctx->ipad; + opad = ctx->opad; +memcpy (ipad, ctx->key, authkeylen);memset (ipad + authkeylen,0 , bs - authkeylen);memcpy (opad, ipad, bs);
@@ -798,7 +810,7 @@ static int aead_hmac_init(struct crypto_aead *cipher)crypto_shash_init (&ctx->sdesc->shash);crypto_shash_update (&ctx->sdesc->shash, ipad, bs);crypto_shash_export (&ctx->sdesc->shash, ipad); - ret =copy_pad (ctx->mac_type, ctx->ipad, ipad); + ret =swap_pad (ctx->mac_type, ipad);if (ret) goto calc_fail;
@@ -806,25 +818,9 @@ static int aead_hmac_init(struct crypto_aead *cipher)crypto_shash_init (&ctx->sdesc->shash);crypto_shash_update (&ctx->sdesc->shash, opad, bs);crypto_shash_export (&ctx->sdesc->shash, opad); - ret =copy_pad (ctx->mac_type, ctx->opad, opad); -if (ret) - goto calc_fail; - -kfree (ipad); -kfree (opad); - -return 0 ; + ret =swap_pad (ctx->mac_type, opad); calc_fail: -kfree (ctx->ipad); - ctx->ipad =NULL ; -kfree (ctx->opad); - ctx->opad =NULL ; -kfree (ipad); -kfree (opad); -kfree (ctx->sdesc); - ctx->sdesc =NULL ; -return ret; }
@@ -832,57 +828,15 @@ static int otx_cpt_aead_cbc_aes_sha_setkey(struct crypto_aead *cipher, const unsigned char *key, unsigned int keylen) { -struct otx_cpt_aead_ctx *ctx =crypto_aead_ctx_dma (cipher); -struct crypto_authenc_key_param *param; -int enckeylen =0 , authkeylen =0 ; -struct rtattr *rta = (void *)key; -int status = -EINVAL ; - -if (!RTA_OK (rta, keylen)) - goto badkey; - -if (rta->rta_type !=CRYPTO_AUTHENC_KEYA_PARAM ) - goto badkey; - -if (RTA_PAYLOAD (rta) <sizeof (*param)) - goto badkey; - - param =RTA_DATA (rta); - enckeylen =be32_to_cpu (param->enckeylen); - key +=RTA_ALIGN (rta->rta_len); - keylen -=RTA_ALIGN (rta->rta_len); -if (keylen < enckeylen) - goto badkey; +struct crypto_authenc_keys authenc_keys; +int status; -if (keylen >OTX_CPT_MAX_KEY_SIZE ) - goto badkey; - - authkeylen = keylen - enckeylen; -memcpy (ctx->key, key, keylen); - -switch (enckeylen) { -case AES_KEYSIZE_128 : - ctx->key_type =OTX_CPT_AES_128_BIT ; -break ; -case AES_KEYSIZE_192 : - ctx->key_type =OTX_CPT_AES_192_BIT ; -break ; -case AES_KEYSIZE_256 : - ctx->key_type =OTX_CPT_AES_256_BIT ; -break ; -default : -/* Invalid key length */ - goto badkey; - } - - ctx->enc_key_len = enckeylen; - ctx->auth_key_len = authkeylen; - - status =aead_hmac_init (cipher); + status =crypto_authenc_extractkeys (&authenc_keys, key, keylen);if (status) goto badkey; -return 0 ; + status =aead_hmac_init (cipher, &authenc_keys); + badkey:return status; }
@@ -891,36 +845,7 @@ static int otx_cpt_aead_ecb_null_sha_setkey(struct crypto_aead *cipher,const unsigned char *key, unsigned int keylen) { -struct otx_cpt_aead_ctx *ctx =crypto_aead_ctx_dma (cipher); -struct crypto_authenc_key_param *param; -struct rtattr *rta = (void *)key; -int enckeylen =0 ; - -if (!RTA_OK (rta, keylen)) - goto badkey; - -if (rta->rta_type !=CRYPTO_AUTHENC_KEYA_PARAM ) - goto badkey; - -if (RTA_PAYLOAD (rta) <sizeof (*param)) - goto badkey; - - param =RTA_DATA (rta); - enckeylen =be32_to_cpu (param->enckeylen); - key +=RTA_ALIGN (rta->rta_len); - keylen -=RTA_ALIGN (rta->rta_len); -if (enckeylen !=0 ) - goto badkey; - -if (keylen >OTX_CPT_MAX_KEY_SIZE ) - goto badkey; - -memcpy (ctx->key, key, keylen); - ctx->enc_key_len = enckeylen; - ctx->auth_key_len = keylen; -return 0 ; -badkey: -return -EINVAL ; + return otx_cpt_aead_cbc_aes_sha_setkey(cipher, key, keylen); } static int otx_cpt_aead_gcm_aes_setkey(struct crypto_aead *cipher,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/558 crypto: octeontx2 - Fix authenc setkey
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 7ccb750dcac8abbfc7743aab0db6a72c1c3703c7 ]
Use the generic crypto_authenc_extractkeys helper instead of custom parsing code that is slightly broken. Also fix a number of memory leaks by moving memory allocation from setkey to init_tfm (setkey can be called multiple times over the life of a tfm).
Finally accept all hash key lengths by running the digest over extra-long keys.
--- .../marvell/octeontx2/otx2_cptvf_algs.c | 254 +++++++----------- 1 file changed, 90 insertions(+), 164 deletions(-)
drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c +90 -164
@@ -11,7 +11,6 @@#include <crypto/xts.h> #include <crypto/gcm.h> #include <crypto/scatterwalk.h> -#include <linux/rtnetlink.h> #include <linux/sort.h> #include <linux/module.h> #include "otx2_cptvf.h"
@@ -55,6 +54,8 @@ static struct cpt_device_table se_devices = { .count = ATOMIC_INIT(0) }; +static struct otx2_cpt_sdesc *alloc_sdesc (struct crypto_shash *alg); +static inline int get_se_device (struct pci_dev **pdev,int *cpu_num) {int count;
@@ -598,40 +599,56 @@ static int cpt_aead_init(struct crypto_aead *atfm, u8 cipher_type, u8 mac_type) ctx->cipher_type = cipher_type; ctx->mac_type = mac_type; +switch (ctx->mac_type) { +case OTX2_CPT_SHA1 : + ctx->hashalg =crypto_alloc_shash ("sha1" ,0 ,0 ); +break ; + +case OTX2_CPT_SHA256 : + ctx->hashalg =crypto_alloc_shash ("sha256" ,0 ,0 ); +break ; + +case OTX2_CPT_SHA384 : + ctx->hashalg =crypto_alloc_shash ("sha384" ,0 ,0 ); +break ; + +case OTX2_CPT_SHA512 : + ctx->hashalg =crypto_alloc_shash ("sha512" ,0 ,0 ); +break ; + } + +if (IS_ERR (ctx->hashalg)) +return PTR_ERR (ctx->hashalg); + +if (ctx->hashalg) { + ctx->sdesc =alloc_sdesc (ctx->hashalg); +if (!ctx->sdesc) { +crypto_free_shash (ctx->hashalg); +return -ENOMEM ; + } + } +/* * When selected cipher is NULL we use HMAC opcode instead of * FLEXICRYPTO opcode therefore we don't need to use HASH algorithms * for calculating ipad and opad */ -if (ctx->cipher_type !=OTX2_CPT_CIPHER_NULL ) { -switch (ctx->mac_type) { -case OTX2_CPT_SHA1 : - ctx->hashalg =crypto_alloc_shash ("sha1" ,0 , -CRYPTO_ALG_ASYNC ); -if (IS_ERR (ctx->hashalg)) -return PTR_ERR (ctx->hashalg); -break ; - -case OTX2_CPT_SHA256 : - ctx->hashalg =crypto_alloc_shash ("sha256" ,0 , -CRYPTO_ALG_ASYNC ); -if (IS_ERR (ctx->hashalg)) -return PTR_ERR (ctx->hashalg); -break ; +if (ctx->cipher_type !=OTX2_CPT_CIPHER_NULL && ctx->hashalg) { +int ss =crypto_shash_statesize (ctx->hashalg); -case OTX2_CPT_SHA384 : - ctx->hashalg =crypto_alloc_shash ("sha384" ,0 , -CRYPTO_ALG_ASYNC ); -if (IS_ERR (ctx->hashalg)) -return PTR_ERR (ctx->hashalg); -break ; + ctx->ipad =kzalloc (ss,GFP_KERNEL ); +if (!ctx->ipad) { +kfree (ctx->sdesc); +crypto_free_shash (ctx->hashalg); +return -ENOMEM ; + } -case OTX2_CPT_SHA512 : - ctx->hashalg =crypto_alloc_shash ("sha512" ,0 , -CRYPTO_ALG_ASYNC ); -if (IS_ERR (ctx->hashalg)) -return PTR_ERR (ctx->hashalg); -break ; + ctx->opad =kzalloc (ss,GFP_KERNEL ); +if (!ctx->opad) { +kfree (ctx->ipad); +kfree (ctx->sdesc); +crypto_free_shash (ctx->hashalg); +return -ENOMEM ; } }switch (ctx->cipher_type) {
@@ -713,8 +730,7 @@ static void otx2_cpt_aead_exit(struct crypto_aead *tfm)kfree (ctx->ipad);kfree (ctx->opad); -if (ctx->hashalg) -crypto_free_shash (ctx->hashalg); +crypto_free_shash (ctx->hashalg);kfree (ctx->sdesc);if (ctx->fbk_cipher) {
@@ -788,7 +804,7 @@ static inline void swap_data64(void *buf, u32 len)cpu_to_be64s (src); } -static int copy_pad (u8 mac_type,u8 *out_pad,u8 *in_pad) +static int swap_pad (u8 mac_type,u8 *pad) {struct sha512_state *sha512;struct sha256_state *sha256;
@@ -796,22 +812,19 @@ static int copy_pad(u8 mac_type, u8 *out_pad, u8 *in_pad)switch (mac_type) {case OTX2_CPT_SHA1 : - sha1 = (struct sha1_state *) in_pad; + sha1 = (struct sha1_state *)pad;swap_data32 (sha1->state,SHA1_DIGEST_SIZE ); -memcpy (out_pad, &sha1->state,SHA1_DIGEST_SIZE );break ;case OTX2_CPT_SHA256 : - sha256 = (struct sha256_state *) in_pad; + sha256 = (struct sha256_state *)pad;swap_data32 (sha256->state,SHA256_DIGEST_SIZE ); -memcpy (out_pad, &sha256->state,SHA256_DIGEST_SIZE );break ;case OTX2_CPT_SHA384 :case OTX2_CPT_SHA512 : - sha512 = (struct sha512_state *) in_pad; + sha512 = (struct sha512_state *)pad;swap_data64 (sha512->state,SHA512_DIGEST_SIZE ); -memcpy (out_pad, &sha512->state,SHA512_DIGEST_SIZE );break ;default :
@@ -821,55 +834,54 @@ static int copy_pad(u8 mac_type, u8 *out_pad, u8 *in_pad)return 0 ; } -static int aead_hmac_init (struct crypto_aead *cipher) +static int aead_hmac_init (struct crypto_aead *cipher, +struct crypto_authenc_keys *keys) {struct otx2_cpt_aead_ctx *ctx =crypto_aead_ctx_dma (cipher); -int state_size =crypto_shash_statesize (ctx->hashalg);int ds =crypto_shash_digestsize (ctx->hashalg);int bs =crypto_shash_blocksize (ctx->hashalg); -int authkeylen = ctx->auth_key_len; +int authkeylen = keys->authkeylen;u8 *ipad =NULL , *opad =NULL ; -int ret =0 , icount =0 ; +int icount =0 ; +int ret; - ctx->sdesc =alloc_sdesc (ctx->hashalg); -if (!ctx->sdesc) -return -ENOMEM ; +if (authkeylen > bs) { + ret =crypto_shash_digest (&ctx->sdesc->shash, keys->authkey, + authkeylen, ctx->key); +if (ret) + goto calc_fail; - ctx->ipad =kzalloc (bs,GFP_KERNEL ); -if (!ctx->ipad) { - ret = -ENOMEM ; - goto calc_fail; - } + authkeylen = ds; + }else +memcpy (ctx->key, keys->authkey, authkeylen); - ctx->opad =kzalloc (bs,GFP_KERNEL ); -if (!ctx->opad) { - ret = -ENOMEM ; - goto calc_fail; - } + ctx->enc_key_len = keys->enckeylen; + ctx->auth_key_len = authkeylen; - ipad =kzalloc (state_size,GFP_KERNEL ); -if (!ipad) { - ret = -ENOMEM ; - goto calc_fail; - } +if (ctx->cipher_type ==OTX2_CPT_CIPHER_NULL ) +return keys->enckeylen ? -EINVAL :0 ; - opad =kzalloc (state_size,GFP_KERNEL ); -if (!opad) { - ret = -ENOMEM ; - goto calc_fail; +switch (keys->enckeylen) { +case AES_KEYSIZE_128 : + ctx->key_type =OTX2_CPT_AES_128_BIT ; +break ; +case AES_KEYSIZE_192 : + ctx->key_type =OTX2_CPT_AES_192_BIT ; +break ; +case AES_KEYSIZE_256 : + ctx->key_type =OTX2_CPT_AES_256_BIT ; +break ; +default : +/* Invalid key length */ +return -EINVAL ; } -if (authkeylen > bs) { - ret =crypto_shash_digest (&ctx->sdesc->shash, ctx->key, - authkeylen, ipad); -if (ret) - goto calc_fail; +memcpy (ctx->key + authkeylen, keys->enckey, keys->enckeylen); - authkeylen = ds; - }else { -memcpy (ipad, ctx->key, authkeylen); - } + ipad = ctx->ipad; + opad = ctx->opad; +memcpy (ipad, ctx->key, authkeylen);memset (ipad + authkeylen,0 , bs - authkeylen);memcpy (opad, ipad, bs);
@@ -887,7 +899,7 @@ static int aead_hmac_init(struct crypto_aead *cipher)crypto_shash_init (&ctx->sdesc->shash);crypto_shash_update (&ctx->sdesc->shash, ipad, bs);crypto_shash_export (&ctx->sdesc->shash, ipad); - ret =copy_pad (ctx->mac_type, ctx->ipad, ipad); + ret =swap_pad (ctx->mac_type, ipad);if (ret) goto calc_fail;
@@ -895,25 +907,9 @@ static int aead_hmac_init(struct crypto_aead *cipher)crypto_shash_init (&ctx->sdesc->shash);crypto_shash_update (&ctx->sdesc->shash, opad, bs);crypto_shash_export (&ctx->sdesc->shash, opad); - ret =copy_pad (ctx->mac_type, ctx->opad, opad); -if (ret) - goto calc_fail; - -kfree (ipad); -kfree (opad); - -return 0 ; + ret =swap_pad (ctx->mac_type, opad); calc_fail: -kfree (ctx->ipad); - ctx->ipad =NULL ; -kfree (ctx->opad); - ctx->opad =NULL ; -kfree (ipad); -kfree (opad); -kfree (ctx->sdesc); - ctx->sdesc =NULL ; -return ret; }
@@ -921,87 +917,17 @@ static int otx2_cpt_aead_cbc_aes_sha_setkey(struct crypto_aead *cipher, const unsigned char *key, unsigned int keylen) { -struct otx2_cpt_aead_ctx *ctx =crypto_aead_ctx_dma (cipher); -struct crypto_authenc_key_param *param; -int enckeylen =0 , authkeylen =0 ; -struct rtattr *rta = (void *)key; - -if (!RTA_OK (rta, keylen)) -return -EINVAL ; +struct crypto_authenc_keys authenc_keys; -if (rta->rta_type !=CRYPTO_AUTHENC_KEYA_PARAM ) -return -EINVAL ; - -if (RTA_PAYLOAD (rta) <sizeof (*param)) -return -EINVAL ; - - param =RTA_DATA (rta); - enckeylen =be32_to_cpu (param->enckeylen); - key +=RTA_ALIGN (rta->rta_len); - keylen -=RTA_ALIGN (rta->rta_len); -if (keylen < enckeylen) -return -EINVAL ; - -if (keylen >OTX2_CPT_MAX_KEY_SIZE ) -return -EINVAL ; - - authkeylen = keylen - enckeylen; -memcpy (ctx->key, key, keylen); - -switch (enckeylen) { -case AES_KEYSIZE_128 : - ctx->key_type =OTX2_CPT_AES_128_BIT ; -break ; -case AES_KEYSIZE_192 : - ctx->key_type =OTX2_CPT_AES_192_BIT ; -break ; -case AES_KEYSIZE_256 : - ctx->key_type =OTX2_CPT_AES_256_BIT ; -break ; -default : -/* Invalid key length */ -return -EINVAL ; - } - - ctx->enc_key_len = enckeylen; - ctx->auth_key_len = authkeylen; - -return aead_hmac_init (cipher); +return crypto_authenc_extractkeys (&authenc_keys, key, keylen) ?: +aead_hmac_init (cipher, &authenc_keys); }static int otx2_cpt_aead_ecb_null_sha_setkey (struct crypto_aead *cipher,const unsigned char *key,unsigned int keylen) { -struct otx2_cpt_aead_ctx *ctx =crypto_aead_ctx_dma (cipher); -struct crypto_authenc_key_param *param; -struct rtattr *rta = (void *)key; -int enckeylen =0 ; - -if (!RTA_OK (rta, keylen)) -return -EINVAL ; - -if (rta->rta_type !=CRYPTO_AUTHENC_KEYA_PARAM ) -return -EINVAL ; - -if (RTA_PAYLOAD (rta) <sizeof (*param)) -return -EINVAL ; - - param =RTA_DATA (rta); - enckeylen =be32_to_cpu (param->enckeylen); - key +=RTA_ALIGN (rta->rta_len); - keylen -=RTA_ALIGN (rta->rta_len); -if (enckeylen !=0 ) -return -EINVAL ; - -if (keylen >OTX2_CPT_MAX_KEY_SIZE ) -return -EINVAL ; - -memcpy (ctx->key, key, keylen); - ctx->enc_key_len = enckeylen; - ctx->auth_key_len = keylen; - -return 0 ; +return otx2_cpt_aead_cbc_aes_sha_setkey (cipher, key, keylen); } static int otx2_cpt_aead_gcm_aes_setkey(struct crypto_aead *cipher,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/558 ice: Adjust over allocation of memory in ice_sched_add_root_node() and ice_sched_add_node()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit 62fdaf9e8056e9a9e6fe63aa9c816ec2122d60c6 ]
In ice_sched_add_root_node() and ice_sched_add_node() there are calls to devm_kcalloc() in order to allocate memory for array of pointers to 'ice_sched_node' structure. But incorrect types are used as sizeof() arguments in these calls (structures instead of pointers) which leads to over allocation of memory.
Adjust over allocation of memory by correcting types in devm_kcalloc() sizeof() arguments.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/ethernet/intel/ice/ice_sched.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/ice/ice_sched.c +2 -4
@@ -28,9 +28,8 @@ ice_sched_add_root_node(struct ice_port_info *pi,if (!root)return -ENOMEM ; -/* coverity[suspicious_sizeof] */ root->children =devm_kcalloc (ice_hw_to_dev (hw), hw->max_children[0 ], -sizeof (*root),GFP_KERNEL ); +sizeof (*root->children),GFP_KERNEL );if (!root->children) {devm_kfree (ice_hw_to_dev (hw), root);return -ENOMEM ;
@@ -186,10 +185,9 @@ ice_sched_add_node(struct ice_port_info *pi, u8 layer,if (!node)return -ENOMEM ;if (hw->max_children[layer]) { -/* coverity[suspicious_sizeof] */ node->children =devm_kcalloc (ice_hw_to_dev (hw), hw->max_children[layer], -sizeof (*node),GFP_KERNEL ); +sizeof (*node->children),GFP_KERNEL );if (!node->children) {devm_kfree (ice_hw_to_dev (hw), node);return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/558 wifi: iwlwifi: mvm: Fix a race in scan abort flow
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilan Peer <[email protected]>
[ Upstream commit 87c1c28a9aa149489e1667f5754fc24f4973d2d0 ]
When the upper layer requests to cancel an ongoing scan, a race is possible in which by the time the driver starts to handle the upper layers scan cancel flow, the FW already completed handling the scan request and the driver received the scan complete notification but still did not handle the notification. In such a case the FW will simply ignore the scan abort request coming from the driver, no notification would arrive from the FW and the entire abort flow would be considered a failure.
To better handle this, check the status code returned by the FW for the scan abort command. In case the status indicates that no scan was aborted, complete the scan abort flow with success, i.e., the scan was aborted, as the flow is expected to consume the scan complete notification.
--- .../net/wireless/intel/iwlwifi/fw/api/scan.h | 13 ++++++ drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 42 +++++++++++++++---- 2 files changed, 47 insertions(+), 8 deletions(-)
drivers/net/wireless/intel/iwlwifi/fw/api/scan.h +13 -0
@@ -1132,6 +1132,19 @@ struct iwl_umac_scan_abort {__le32 flags; } __packed;/* SCAN_ABORT_CMD_UMAC_API_S_VER_1 */ +/** +* enum iwl_umac_scan_abort_status +* +* @IWL_UMAC_SCAN_ABORT_STATUS_SUCCESS: scan was successfully aborted +* @IWL_UMAC_SCAN_ABORT_STATUS_IN_PROGRESS: scan abort is in progress +* @IWL_UMAC_SCAN_ABORT_STATUS_NOT_FOUND: nothing to abort +*/ +enum iwl_umac_scan_abort_status { +IWL_UMAC_SCAN_ABORT_STATUS_SUCCESS =0 , +IWL_UMAC_SCAN_ABORT_STATUS_IN_PROGRESS , +IWL_UMAC_SCAN_ABORT_STATUS_NOT_FOUND , +}; +/** * struct iwl_umac_scan_complete * @uid: scan id, &enum iwl_umac_scan_uid_offsets
drivers/net/wireless/intel/iwlwifi/mvm/scan.c +34 -8
83 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/558 wifi: iwlwifi: mvm: drop wrong STA selection in TX
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 1c7e1068a7c9c39ed27636db93e71911e0045419 ]
This shouldn't happen at all, since in station mode all MMPDUs go through the TXQ for the STA, and not this function. There may or may not be a race in mac80211 through which this might happen for some frames while a station is being added, but in that case we can also just drop the frame and pretend the STA didn't exist yet.
Also, the code is simply wrong since it uses deflink, and it's not easy to fix it since the mvmvif->ap_sta pointer cannot be used without the mutex, and perhaps the right link might not even be known.
Just drop the frame at that point instead of trying to fix it up.
--- .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +3 -13
@@ -838,20 +838,10 @@ void iwl_mvm_mac_tx(struct ieee80211_hw *hw,if (ieee80211_is_mgmt (hdr->frame_control)) sta =NULL ; -/* If there is no sta, and it's not offchannel - send through AP */ +/* this shouldn't even happen: just drop */ if (!sta && info->control.vif->type ==NL80211_IFTYPE_STATION && - !offchannel) { -struct iwl_mvm_vif *mvmvif = -iwl_mvm_vif_from_mac80211 (info->control.vif); -u8 ap_sta_id =READ_ONCE (mvmvif->deflink.ap_sta_id); - -if (ap_sta_id < mvm->fw->ucode_capa.num_stations) { -/* mac80211 holds rcu read lock */ - sta =rcu_dereference (mvm->fw_id_to_mac_id[ap_sta_id]); -if (IS_ERR_OR_NULL (sta)) - goto drop; - } - } + !offchannel) + goto drop;if (tmp_sta && !sta && link_id !=IEEE80211_LINK_UNSPECIFIED && !ieee80211_is_probe_resp (hdr->frame_control)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/558 wifi: cfg80211: Set correct chandef when starting CAC
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Issam Hamdi <[email protected]>
[ Upstream commit 20361712880396e44ce80aaeec2d93d182035651 ]
When starting CAC in a mode other than AP mode, it return a "WARNING: CPU: 0 PID: 63 at cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]" caused by the chandef.chan being null at the end of CAC.
Solution: Ensure the channel definition is set for the different modes when starting CAC to avoid getting a NULL 'chan' at the end of CAC.
Call Trace: ? show_regs.part.0+0x14/0x16 ? __warn+0x67/0xc0 ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211] ? report_bug+0xa7/0x130 ? exc_overflow+0x30/0x30 ? handle_bug+0x27/0x50 ? exc_invalid_op+0x18/0x60 ? handle_exception+0xf6/0xf6 ? exc_overflow+0x30/0x30 ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211] ? exc_overflow+0x30/0x30 ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211] ? regulatory_propagate_dfs_state.cold+0x1b/0x4c [cfg80211] ? cfg80211_propagate_cac_done_wk+0x1a/0x30 [cfg80211] ? process_one_work+0x165/0x280 ? worker_thread+0x120/0x3f0 ? kthread+0xc2/0xf0 ? process_one_work+0x280/0x280 ? kthread_complete_and_exit+0x20/0x20 ? ret_from_fork+0x19/0x24
--- net/wireless/nl80211.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
net/wireless/nl80211.c +14 -1
@@ -10144,7 +10144,20 @@ static int nl80211_start_radar_detection(struct sk_buff *skb, err =rdev_start_radar_detection (rdev, dev, &chandef, cac_time_ms);if (!err) { - wdev->links[0 ].ap.chandef = chandef; +switch (wdev->iftype) { +case NL80211_IFTYPE_AP : +case NL80211_IFTYPE_P2P_GO : + wdev->links[0 ].ap.chandef = chandef; +break ; +case NL80211_IFTYPE_ADHOC : + wdev->u.ibss.chandef = chandef; +break ; +case NL80211_IFTYPE_MESH_POINT : + wdev->u.mesh.chandef = chandef; +break ; +default : +break ; + } wdev->cac_started = true; wdev->cac_start_time = jiffies; wdev->cac_time_ms = cac_time_ms;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/558 net/xen-netback: prevent UAF in xenvif_flush_hash()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
[ Upstream commit 0fa5e94a1811d68fbffa0725efe6d4ca62c03d12 ]
During the list_for_each_entry_rcu iteration call of xenvif_flush_hash, kfree_rcu does not exist inside the rcu read critical section, so if kfree_rcu is called when the rcu grace period ends during the iteration, UAF occurs when accessing head->next after the entry becomes free.
Therefore, to solve this, you need to change it to list_for_each_entry_safe.
--- drivers/net/xen-netback/hash.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/xen-netback/hash.c +2 -3
@@ -95,7 +95,7 @@ static u32 xenvif_new_hash(struct xenvif *vif, const u8 *data,static void xenvif_flush_hash (struct xenvif *vif) { -struct xenvif_hash_cache_entry *entry; +struct xenvif_hash_cache_entry *entry, *n;unsigned long flags;if (xenvif_hash_cache_size ==0 )
@@ -103,8 +103,7 @@ static void xenvif_flush_hash(struct xenvif *vif)spin_lock_irqsave (&vif->hash.cache.lock, flags); -list_for_each_entry_rcu (entry, &vif->hash.cache.list, link, -lockdep_is_held (&vif->hash.cache.lock)) { +list_for_each_entry_safe (entry, n, &vif->hash.cache.list, link) {list_del_rcu (&entry->link); vif->hash.cache.count--;kfree_rcu (entry, rcu);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/558 net: hisilicon: hip04: fix OF node leak in probe()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 17555297dbd5bccc93a01516117547e26a61caf1 ]
Driver is leaking OF node reference fromof_parse_phandle_with_fixed_args() in probe().
--- drivers/net/ethernet/hisilicon/hip04_eth.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/hisilicon/hip04_eth.c +1 -0
@@ -947,6 +947,7 @@ static int hip04_mac_probe(struct platform_device *pdev) priv->tx_coalesce_timer.function = tx_done; priv->map =syscon_node_to_regmap (arg.np); +of_node_put (arg.np);if (IS_ERR (priv->map)) {dev_warn (d,"no syscon hisilicon,hip04-ppe\n" ); ret =PTR_ERR (priv->map);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/558 net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 5680cf8d34e1552df987e2f4bb1bff0b2a8c8b11 ]
Driver is leaking OF node reference from of_parse_phandle_with_fixed_args() in hns_mac_get_info().
--- drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c +1 -0
@@ -933,6 +933,7 @@ static int hns_mac_get_info(struct hns_mac_cb *mac_cb) mac_cb->cpld_ctrl =NULL ; }else { syscon =syscon_node_to_regmap (cpld_args.np); +of_node_put (cpld_args.np);if (IS_ERR_OR_NULL (syscon)) {dev_dbg (mac_cb->dev,"no cpld-syscon found!\n" ); mac_cb->cpld_ctrl =NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/558 net: hisilicon: hns_mdio: fix OF node leak in probe()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit e62beddc45f487b9969821fad3a0913d9bc18a2f ]
Driver is leaking OF node reference fromof_parse_phandle_with_fixed_args() in probe().
--- drivers/net/ethernet/hisilicon/hns_mdio.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/hisilicon/hns_mdio.c +1 -0
@@ -575,6 +575,7 @@ static int hns_mdio_probe(struct platform_device *pdev)MDIO_SC_RESET_ST ; } } +of_node_put (reg_args.np); }else {dev_warn (&pdev->dev,"find syscon ret = %#x\n" , ret); mdio_dev->subctrl_vbase =NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/558 ACPI: PAD: fix crash in exit_round_robin()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seiji Nishikawa <[email protected]>
[ Upstream commit 0a2ed70a549e61c5181bad5db418d223b68ae932 ]
The kernel occasionally crashes in cpumask_clear_cpu(), which is called within exit_round_robin(), because when executing clear_bit(nr, addr) with nr set to 0xffffffff, the address calculation may cause misalignment within the memory, leading to access to an invalid memory address.
----------
BUG: unable to handle kernel paging request at ffffffffe0740618
...
CPU: 3 PID: 2919323 Comm: acpi_pad/14 Kdump: loaded Tainted: G OE X --------- - - 4.18.0-425.19.2.el8_7.x86_64 #1
...
RIP: 0010:power_saving_thread+0x313/0x411 [acpi_pad]
Code: 89 cd 48 89 d3 eb d1 48 c7 c7 55 70 72 c0 e8 64 86 b0 e4 c6 05 0d a1 02 00 01 e9 bc fd ff ff 45 89 e4 42 8b 04 a5 20 82 72 c0 <f0> 48 0f b3 05 f4 9c 01 00 42 c7 04 a5 20 82 72 c0 ff ff ff ff 31
RSP: 0018:ff72a5d51fa77ec8 EFLAGS: 00010202
RAX: 00000000ffffffff RBX: ff462981e5d8cb80 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246
RBP: ff46297556959d80 R08: 0000000000000382 R09: ff46297c8d0f38d8
R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000000e
R13: 0000000000000000 R14: ffffffffffffffff R15: 000000000000000e
FS: 0000000000000000(0000) GS:ff46297a800c0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffe0740618 CR3: 0000007e20410004 CR4: 0000000000771ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
? acpi_pad_add+0x120/0x120 [acpi_pad]
kthread+0x10b/0x130
? set_kthread_struct+0x50/0x50
ret_from_fork+0x1f/0x40
...CR2: ffffffffe0740618
crash> dis -lr ffffffffc0726923
...
/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 1140xffffffffc0726918 <power_saving_thread+776>: mov %r12d,%r12d/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 3250xffffffffc072691b <power_saving_thread+779>: mov -0x3f8d7de0(,%r12,4),%eax/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./arch/x86/include/asm/bitops.h: 800xffffffffc0726923 <power_saving_thread+787>: lock btr %rax,0x19cf4(%rip) # 0xffffffffc0740620 <pad_busy_cpus_bits>
crash> px tsk_in_cpu[14]
$66 = 0xffffffff
crash> px 0xffffffffc072692c+0x19cf4
$99 = 0xffffffffc0740620
crash> sym 0xffffffffc0740620 ffffffffc0740620 (b) pad_busy_cpus_bits [acpi_pad]
crash> px pad_busy_cpus_bits[0]
$42 = 0xfffc0
----------
To fix this, ensure that tsk_in_cpu[tsk_index] != -1 before calling cpumask_clear_cpu() in exit_round_robin(), just as it is done in round_robin_cpu().
--- drivers/acpi/acpi_pad.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/acpi/acpi_pad.c +4 -2
@@ -136,8 +136,10 @@ static void exit_round_robin(unsigned int tsk_index) {struct cpumask *pad_busy_cpus =to_cpumask (pad_busy_cpus_bits); -cpumask_clear_cpu (tsk_in_cpu[tsk_index], pad_busy_cpus); - tsk_in_cpu[tsk_index] =-1 ; +if (tsk_in_cpu[tsk_index] !=-1 ) { +cpumask_clear_cpu (tsk_in_cpu[tsk_index], pad_busy_cpus); + tsk_in_cpu[tsk_index] =-1 ; + } }static unsigned int idle_pct =5 ;/* percentage */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/558 ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 5accb265f7a1b23e52b0ec42313d1e12895552f4 ]
ACPICA commit 2802af722bbde7bf1a7ac68df68e179e2555d361
If acpi_ps_get_next_namepath() fails, the previously allocated union acpi_parse_object needs to be freed before returning the status code.
The issue was first being reported on the Linux ACPI mailing list:
--- drivers/acpi/acpica/psargs.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/acpica/psargs.c +8 -0
@@ -820,6 +820,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,acpi_ps_get_next_namepath (walk_state, parser_state, arg,ACPI_NOT_METHOD_CALL ); +if (ACPI_FAILURE (status)) { +acpi_ps_free_op (arg); +return_ACPI_STATUS (status); + } }else {/* Single complex argument, nothing returned */
@@ -854,6 +858,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,acpi_ps_get_next_namepath (walk_state, parser_state, arg,ACPI_POSSIBLE_METHOD_CALL ); +if (ACPI_FAILURE (status)) { +acpi_ps_free_op (arg); +return_ACPI_STATUS (status); + }if (arg->common.aml_opcode ==AML_INT_METHODCALL_OP ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/558 ACPICA: Fix memory leak if acpi_ps_get_next_field() fails
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit e6169a8ffee8a012badd8c703716e761ce851b15 ]
ACPICA commit 1280045754264841b119a5ede96cd005bc09b5a7
If acpi_ps_get_next_field() fails, the previously created field list needs to be properly disposed before returning the status code.
--- drivers/acpi/acpica/psargs.c | 39 ++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+)
drivers/acpi/acpica/psargs.c +39 -0
@@ -25,6 +25,8 @@ acpi_ps_get_next_package_length(struct acpi_parse_state *parser_state);static union acpi_parse_object *acpi_ps_get_next_field (struct acpi_parse_state *parser_state); +static void acpi_ps_free_field_list (union acpi_parse_object *start); +/******************************************************************************* * * FUNCTION: acpi_ps_get_next_package_length
@@ -683,6 +685,39 @@ static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_statereturn_PTR (field); } +/******************************************************************************* +* +* FUNCTION: acpi_ps_free_field_list +* +* PARAMETERS: start - First Op in field list +* +* RETURN: None. +* +* DESCRIPTION: Free all Op objects inside a field list. +* +******************************************************************************/ + +static void acpi_ps_free_field_list (union acpi_parse_object *start) +{ +union acpi_parse_object *cur = start; +union acpi_parse_object *next; +union acpi_parse_object *arg; + +while (cur) { + next = cur->common.next; + +/* AML_INT_CONNECTION_OP can have a single argument */ + + arg =acpi_ps_get_arg (cur,0 ); +if (arg) { +acpi_ps_free_op (arg); + } + +acpi_ps_free_op (cur); + cur = next; + } +} +/******************************************************************************* * * FUNCTION: acpi_ps_get_next_arg
@@ -751,6 +786,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,while (parser_state->aml < parser_state->pkg_end) { field =acpi_ps_get_next_field (parser_state);if (!field) { +if (arg) { +acpi_ps_free_field_list (arg); + } +return_ACPI_STATUS (AE_NO_MEMORY ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/558 exec: dont WARN for racy path_noexec check
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mateusz Guzik <[email protected]>
[ Upstream commit 0d196e7589cefe207d5d41f37a0a28a1fdeeb7c6 ]
Both i_mode and noexec checks wrapped in WARN_ON stem from an artifact of the previous implementation. They used to legitimately check for the condition, but that got moved up in two commits:633fb6ac3980 ("exec: move S_ISREG() check earlier") 0fd338b2d2cd ("exec: move path_noexec() check earlier")
Instead of being removed said checks are WARN_ON'ed instead, which has some debug value.
However, the spurious path_noexec check is racy, resulting in unwarranted warnings should someone race with setting the noexec flag.
One can note there is more to perm-checking whether execve is allowed and none of the conditions are guaranteed to still hold after they were tested for.
Additionally this does not validate whether the code path did any perm checking to begin with -- it will pass if the inode happens to be regular.
Keep the redundant path_noexec() check even though it's mindless nonsense checking for guarantee that isn't given so drop the WARN.
Reword the commentary and do small tidy ups while here.
--- fs/exec.c | 31 ++++++++++++------------------- 1 file changed, 12 insertions(+), 19 deletions(-)
fs/exec.c +12 -19
@@ -145,13 +145,11 @@ SYSCALL_DEFINE1(uselib, const char __user *, library) goto out;/* -* may_open() has already checked for this, so it should be -* impossible to trip now. But we need to be extra cautious -* and check again at the very end too. +* Check do_open_execat() for an explanation. */ error = -EACCES ; -if (WARN_ON_ONCE (!S_ISREG (file_inode (file)->i_mode) || -path_noexec (&file->f_path))) +if (WARN_ON_ONCE (!S_ISREG (file_inode (file)->i_mode)) || +path_noexec (&file->f_path)) goto exit; error = -ENOEXEC ;
@@ -954,7 +952,6 @@ EXPORT_SYMBOL(transfer_args_to_stack);static struct file *do_open_execat (int fd,struct filename *name,int flags) {struct file *file; -int err;struct open_flags open_exec_flags = { .open_flag =O_LARGEFILE |O_RDONLY | __FMODE_EXEC, .acc_mode =MAY_EXEC ,
@@ -971,24 +968,20 @@ static struct file *do_open_execat(int fd, struct filename *name, int flags) file =do_filp_open (fd, name, &open_exec_flags);if (IS_ERR (file)) - goto out; +return file;/* -* may_open() has already checked for this, so it should be -* impossible to trip now. But we need to be extra cautious -* and check again at the very end too. +* In the past the regular type check was here. It moved to may_open() in +* 633fb6ac3980 ("exec: move S_ISREG() check earlier"). Since then it is +* an invariant that all non-regular files error out before we get here. */ - err = -EACCES ; -if (WARN_ON_ONCE (!S_ISREG (file_inode (file)->i_mode) || -path_noexec (&file->f_path))) - goto exit; +if (WARN_ON_ONCE (!S_ISREG (file_inode (file)->i_mode)) || +path_noexec (&file->f_path)) { +fput (file); +return ERR_PTR (-EACCES ); + } -out:return file; - -exit: -fput (file); -return ERR_PTR (err); }/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/558 fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zhijian <[email protected]>
[ Upstream commit 7f7b850689ac06a62befe26e1fd1806799e7f152 ]
It's observed that a crash occurs during hot-remove a memory device, in which user is accessing the hugetlb. See calltrace as following:
------------[ cut here ]------------ WARNING: CPU: 1 PID: 14045 at arch/x86/mm/fault.c:1278 do_user_addr_fault+0x2a0/0x790 Modules linked in: kmem device_dax cxl_mem cxl_pmem cxl_port cxl_pci dax_hmem dax_pmem nd_pmem cxl_acpi nd_btt cxl_core crc32c_intel nvme virtiofs fuse nvme_core nfit libnvdimm dm_multipath scsi_dh_rdac scsi_dh_emc s mirror dm_region_hash dm_log dm_mod CPU: 1 PID: 14045 Comm: daxctl Not tainted 6.10.0-rc2-lizhijian+ #492 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:do_user_addr_fault+0x2a0/0x790 Code: 48 8b 00 a8 04 0f 84 b5 fe ff ff e9 1c ff ff ff 4c 89 e9 4c 89 e2 be 01 00 00 00 bf 02 00 00 00 e8 b5 ef 24 00 e9 42 fe ff ff <0f> 0b 48 83 c4 08 4c 89 ea 48 89 ee 4c 89 e7 5b 5d 41 5c 41 5d 41 RSP: 0000:ffffc90000a575f0 EFLAGS: 00010046 RAX: ffff88800c303600 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000001000 RSI: ffffffff82504162 RDI: ffffffff824b2c36 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffc90000a57658 R13: 0000000000001000 R14: ffff88800bc2e040 R15: 0000000000000000 FS: 00007f51cb57d880(0000) GS:ffff88807fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000001000 CR3: 00000000072e2004 CR4: 00000000001706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __warn+0x8d/0x190 ? do_user_addr_fault+0x2a0/0x790 ? report_bug+0x1c3/0x1d0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? do_user_addr_fault+0x2a0/0x790 ? exc_page_fault+0x31/0x200 exc_page_fault+0x68/0x200 <...snip...> BUG: unable to handle page fault for address: 0000000000001000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 800000000ad92067 P4D 800000000ad92067 PUD 7677067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI ---[ end trace 0000000000000000 ]--- BUG: unable to handle page fault for address: 0000000000001000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 800000000ad92067 P4D 800000000ad92067 PUD 7677067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 14045 Comm: daxctl Kdump: loaded Tainted: G W 6.10.0-rc2-lizhijian+ #492 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:dentry_name+0x1f4/0x440 <...snip...> ? dentry_name+0x2fa/0x440 vsnprintf+0x1f3/0x4f0 vprintk_store+0x23a/0x540 vprintk_emit+0x6d/0x330 _printk+0x58/0x80 dump_mapping+0x10b/0x1a0 ? __pfx_free_object_rcu+0x10/0x10 __dump_page+0x26b/0x3e0 ? vprintk_emit+0xe0/0x330 ? _printk+0x58/0x80 ? dump_page+0x17/0x50 dump_page+0x17/0x50 do_migrate_range+0x2f7/0x7f0 ? do_migrate_range+0x42/0x7f0 ? offline_pages+0x2f4/0x8c0 offline_pages+0x60a/0x8c0 memory_subsys_offline+0x9f/0x1c0 ? lockdep_hardirqs_on+0x77/0x100 ? _raw_spin_unlock_irqrestore+0x38/0x60 device_offline+0xe3/0x110 state_store+0x6e/0xc0 kernfs_fop_write_iter+0x143/0x200 vfs_write+0x39f/0x560 ksys_write+0x65/0xf0 do_syscall_64+0x62/0x130
Previously, some sanity check have been done in dump_mapping() before the print facility parsing '%pd' though, it's still possible to run into an invalid dentry.d_name.name.
Since dump_mapping() only needs to dump the filename only, retrieve it by itself in a safer way to prevent an unnecessary crash.
Note that either retrieving the filename with '%pd' or strncpy_from_kernel_nofault(), the filename could be unreliable.
--- fs/inode.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
fs/inode.c +7 -3
@@ -595,6 +595,7 @@ void dump_mapping(const struct address_space *mapping)struct hlist_node *dentry_first;struct dentry *dentry_ptr;struct dentry dentry; +char fname[64 ] = {};unsigned long ino;/*
@@ -631,11 +632,14 @@ void dump_mapping(const struct address_space *mapping)return ; } +if (strncpy_from_kernel_nofault (fname, dentry.d_name.name,63 ) <0 ) +strscpy (fname,"<invalid>" );/* -* if dentry is corrupted, the %pd handler may still crash, -* but it's unlikely that we reach here with a corrupt mapping +* Even if strncpy_from_kernel_nofault() succeeded, +* the fname could be unreliable */ -pr_warn ("aops:%ps ino:%lx dentry name:\"%pd\"\n" , a_ops, ino, &dentry); +pr_warn ("aops:%ps ino:%lx dentry name(?):\"%s\"\n" , + a_ops, ino, fname); }void clear_inode (struct inode *inode)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/558 ACPI: resource: Skip IRQ override on Asus Vivobook Go E1404GAB
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tamim Khan <[email protected]>
[ Upstream commit 49e9cc315604972cc14868cb67831e3e8c3f1470 ]
Like other Asus Vivobooks, the Asus Vivobook Go E1404GAB has a DSDT that describes IRQ 1 as ActiveLow, while the kernel overrides to Edge_High.
This override prevents the internal keyboard from working.
Fix the problem by adding this laptop to the table that prevents the kernel from overriding the IRQ.
--- drivers/acpi/resource.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/acpi/resource.c +7 -0
@@ -503,6 +503,13 @@ static const struct dmi_system_id irq1_level_low_skip_override[] = { DMI_MATCH(DMI_BOARD_NAME, "B2502FBA"), }, }, + { +/* Asus Vivobook Go E1404GAB */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_BOARD_NAME, "E1404GAB"), + }, + }, {/* Asus Vivobook E1504GA */ .matches = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/558 wifi: mt76: mt7915: disable tx worker during tx BA session enable/disable
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 256cbd26fbafb30ba3314339106e5c594e9bd5f9 ]
Avoids firmware race condition.
--- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +7 -3
@@ -690,13 +690,17 @@ int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev, {struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;struct mt7915_vif *mvif = msta->vif; +int ret; +mt76_worker_disable (&dev->mt76.tx_worker);if (enable && !params->amsdu) msta->wcid.amsdu = false; + ret =mt76_connac_mcu_sta_ba (&dev->mt76, &mvif->mt76, params, +MCU_EXT_CMD (STA_REC_UPDATE ), + enable, true); +mt76_worker_enable (&dev->mt76.tx_worker); -return mt76_connac_mcu_sta_ba (&dev->mt76, &mvif->mt76, params, -MCU_EXT_CMD (STA_REC_UPDATE ), - enable, true); +return ret; } int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/558 net: sched: consistently use rcu_replace_pointer() in taprio_change()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit d5c4546062fd6f5dbce575c7ea52ad66d1968678 ]
According to Vinicius (and carefully looking through the whole
https://syzkaller.appspot.com/bug?extid=b65e0af58423fc8a73aa
once again), txtime branch of 'taprio_change()' is not going to race against 'advance_sched()'. But using 'rcu_replace_pointer()' in the former may be a good idea as well.
--- net/sched/sch_taprio.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/sched/sch_taprio.c +3 -1
@@ -1952,7 +1952,9 @@ static int taprio_change(struct Qdisc *sch, struct nlattr *opt, goto unlock; } -rcu_assign_pointer (q->admin_sched, new_admin); +/* Not going to race against advance_sched(), but still */ + admin =rcu_replace_pointer (q->admin_sched, new_admin, +lockdep_rtnl_is_held ());if (admin)call_rcu (&admin->rcu, taprio_free_sched_cb); }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/558 Bluetooth: btusb: Add Realtek RTL8852C support ID 0x0489:0xe122
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hilda Wu <[email protected]>
[ Upstream commit bdf9557f70e7512bb2f754abf90d9e9958745316 ]
Add the support ID (0x0489, 0xe122) to usb_device_id table for Realtek RTL8852C.
The device info from /sys/kernel/debug/usb/devices as below.
T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e122 Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
--- drivers/bluetooth/btusb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bluetooth/btusb.c +2 -0
@@ -540,6 +540,8 @@ static const struct usb_device_id quirks_table[] = { BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x13d3, 0x3592), .driver_info = BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0489, 0xe122), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, /* Realtek 8852BE Bluetooth devices */ { USB_DEVICE(0x0cb8, 0xc559), .driver_info = BTUSB_REALTEK |
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/558 Bluetooth: btrtl: Set msft ext address filter quirk for RTL8852B
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hilda Wu <[email protected]>
[ Upstream commit 9a0570948c5def5c59e588dc0e009ed850a1f5a1 ]
For tracking multiple devices concurrently with a condition. The patch enables the HCI_QUIRK_USE_MSFT_EXT_ADDRESS_FILTER quirk on RTL8852B controller.
The quirk setting is based on commit 9e14606d8f38 ("Bluetooth: msft:
Extended monitor tracking by address filter")
With this setting, when a pattern monitor detects a device, this feature issues an address monitor for tracking that device. Let the original pattern monitor keep monitor new devices.
--- drivers/bluetooth/btrtl.c | 1 + 1 file changed, 1 insertion(+)
drivers/bluetooth/btrtl.c +1 -0
@@ -1296,6 +1296,7 @@ void btrtl_set_quirks(struct hci_dev *hdev, struct btrtl_device_info *btrtl_dev)btrealtek_set_flag (hdev,REALTEK_ALT6_CONTINUOUS_TX_CHIP );if (btrtl_dev->project_id ==CHIP_ID_8852A || + btrtl_dev->project_id ==CHIP_ID_8852B || btrtl_dev->project_id ==CHIP_ID_8852C )set_bit (HCI_QUIRK_USE_MSFT_EXT_ADDRESS_FILTER , &hdev->quirks);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/558 ACPI: video: Add force_vendor quirk for Panasonic Toughbook CF-18
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit eb7b0f12e13ba99e64e3a690c2166895ed63b437 ]
The Panasonic Toughbook CF-18 advertises both native and vendor backlight control interfaces. But only the vendor one actually works.
acpi_video_get_backlight_type() will pick the non working native backlight by default, add a quirk to select the working vendor backlight instead.
--- drivers/acpi/video_detect.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/video_detect.c +8 -0
@@ -254,6 +254,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "PCG-FRV35"), }, }, + { + .callback = video_detect_force_vendor, + /* Panasonic Toughbook CF-18 */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Matsushita Electric Industrial"), + DMI_MATCH(DMI_PRODUCT_NAME, "CF-18"), + }, + },/* * Toshiba models with Transflective display, these need to use
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/558 ACPI: CPPC: Add support for setting EPP register in FFH
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit aaf21ac93909e08a12931173336bdb52ac8499f1 ]
Some Asus AMD systems are reported to not be able to change EPP values because the BIOS doesn't advertise support for the CPPC MSR and the PCC region is not configured.
However the ACPI 6.2 specification allows CPC registers to be declared in FFH:
``` Starting with ACPI Specification 6.2, all _CPC registers can be in PCC, System Memory, System IO, or Functional Fixed Hardware address spaces. OSPM support for this more flexible register space scheme is indicated by the “Flexible Address Space for CPPC Registers” _OSC bit. ```
If this _OSC has been set allow using FFH to configure EPP.
--- drivers/acpi/cppc_acpi.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/acpi/cppc_acpi.c +9 -1
@@ -103,6 +103,11 @@ static DEFINE_PER_CPU(struct cpc_desc *, cpc_desc_ptr); (cpc)->cpc_entry.reg.space_id == \ ACPI_ADR_SPACE_PLATFORM_COMM) +/* Check if a CPC register is in FFH */ +#define CPC_IN_FFH (cpc) ((cpc)->type == ACPI_TYPE_BUFFER && \ + (cpc)->cpc_entry.reg.space_id == \ + ACPI_ADR_SPACE_FIXED_HARDWARE) +/* Check if a CPC register is in SystemMemory */ #define CPC_IN_SYSTEM_MEMORY (cpc) ((cpc)->type == ACPI_TYPE_BUFFER && \ (cpc)->cpc_entry.reg.space_id == \
@@ -1521,9 +1526,12 @@ int cppc_set_epp_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls, bool enable)/* after writing CPC, transfer the ownership of PCC to platform */ ret =send_pcc_cmd (pcc_ss_id,CMD_WRITE );up_write (&pcc_ss_data->pcc_lock); + }else if (osc_cpc_flexible_adr_space_confirmed && +CPC_SUPPORTED (epp_set_reg) &&CPC_IN_FFH (epp_set_reg)) { + ret =cpc_write (cpu, epp_set_reg, perf_ctrls->energy_perf); }else { ret = -ENOTSUPP ; -pr_debug ("_CPC in PCC is not supported\n" ); +pr_debug ("_CPC in PCC and _CPC in FFH are not supported\n" ); }return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/558 blk_iocost: fix more out of bound shifts
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Ovsepian <[email protected]>
[ Upstream commit 9bce8005ec0dcb23a58300e8522fe4a31da606fa ]
Recently running UBSAN caught few out of bound shifts in the ioc_forgive_debts() function:
UBSAN: shift-out-of-bounds in block/blk-iocost.c:2142:38 shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... UBSAN: shift-out-of-bounds in block/blk-iocost.c:2144:30 shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... Call Trace: <IRQ> dump_stack_lvl+0xca/0x130 __ubsan_handle_shift_out_of_bounds+0x22c/0x280 ? __lock_acquire+0x6441/0x7c10 ioc_timer_fn+0x6cec/0x7750 ? blk_iocost_init+0x720/0x720 ? call_timer_fn+0x5d/0x470 call_timer_fn+0xfa/0x470 ? blk_iocost_init+0x720/0x720 __run_timer_base+0x519/0x700
...
Actual impact of this issue was not identified but I propose to fix the undefined behaviour.
The proposed fix to prevent those out of bound shifts consist of precalculating exponent before using it the shift operations by taking min value from the actual exponent and maximum possible number of bits.
--- block/blk-iocost.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
block/blk-iocost.c +5 -3
@@ -2076,7 +2076,7 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors, struct ioc_now *now) {struct ioc_gq *iocg; -u64 dur, usage_pct, nr_cycles; +u64 dur, usage_pct, nr_cycles, nr_cycles_shift;/* if no debtor, reset the cycle */ if (!nr_debtors) {
@@ -2138,10 +2138,12 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors, old_debt = iocg->abs_vdebt; old_delay = iocg->delay; + nr_cycles_shift =min_t (u64, nr_cycles,BITS_PER_LONG -1 );if (iocg->abs_vdebt) - iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles ?:1 ; + iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles_shift ?:1 ; +if (iocg->delay) - iocg->delay = iocg->delay >> nr_cycles ?:1 ; + iocg->delay = iocg->delay >> nr_cycles_shift ?:1 ;iocg_kick_waitq (iocg, true, now);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/558 btrfs: dont readahead the relocation inode on RST
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Thumshirn <[email protected]>
[ Upstream commit 04915240e2c3a018e4c7f23418478d27226c8957 ]
On relocation we're doing readahead on the relocation inode, but if the filesystem is backed by a RAID stripe tree we can get ENOENT (e.g. due to preallocated extents not being mapped in the RST) from the lookup.
But readahead doesn't handle the error and submits invalid reads to the device, causing an assertion in the scatter-gather list code:
BTRFS info (device nvme1n1): balance: start -d -m -s
BTRFS info (device nvme1n1): relocating block group 6480920576 flags data|raid0
BTRFS error (device nvme1n1): cannot find raid-stripe for logical [6481928192, 6481969152] devid 2, profile raid0
------------[ cut here ]------------ kernel BUG at include/linux/scatterlist.h:115! Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 1012 Comm: btrfs Not tainted 6.10.0-rc7+ #567 RIP: 0010:__blk_rq_map_sg+0x339/0x4a0 RSP: 0018:ffffc90001a43820 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802 RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000 RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8 R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000 FS: 00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002cd11000 CR3: 00000001109ea001 CR4: 0000000000370eb0 Call Trace: <TASK> ? __die_body.cold+0x14/0x25 ? die+0x2e/0x50 ? do_trap+0xca/0x110 ? do_error_trap+0x65/0x80 ? __blk_rq_map_sg+0x339/0x4a0 ? exc_invalid_op+0x50/0x70 ? __blk_rq_map_sg+0x339/0x4a0 ? asm_exc_invalid_op+0x1a/0x20 ? __blk_rq_map_sg+0x339/0x4a0 nvme_prep_rq.part.0+0x9d/0x770 nvme_queue_rq+0x7d/0x1e0 __blk_mq_issue_directly+0x2a/0x90 ? blk_mq_get_budget_and_tag+0x61/0x90 blk_mq_try_issue_list_directly+0x56/0xf0 blk_mq_flush_plug_list.part.0+0x52b/0x5d0 __blk_flush_plug+0xc6/0x110 blk_finish_plug+0x28/0x40 read_pages+0x160/0x1c0 page_cache_ra_unbounded+0x109/0x180 relocate_file_extent_cluster+0x611/0x6a0 ? btrfs_search_slot+0xba4/0xd20 ? balance_dirty_pages_ratelimited_flags+0x26/0xb00 relocate_data_extent.constprop.0+0x134/0x160 relocate_block_group+0x3f2/0x500 btrfs_relocate_block_group+0x250/0x430 btrfs_relocate_chunk+0x3f/0x130 btrfs_balance+0x71b/0xef0 ? kmalloc_trace_noprof+0x13b/0x280 btrfs_ioctl+0x2c2e/0x3030 ? kvfree_call_rcu+0x1e6/0x340 ? list_lru_add_obj+0x66/0x80 ? mntput_no_expire+0x3a/0x220 __x64_sys_ioctl+0x96/0xc0 do_syscall_64+0x54/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fcc04514f9b Code: Unable to access opcode bytes at 0x7fcc04514f71. RSP: 002b:00007ffeba923370 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fcc04514f9b RDX: 00007ffeba923460 RSI: 00000000c4009420 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000013 R09: 0000000000000001 R10: 00007fcc043fbba8 R11: 0000000000000246 R12: 00007ffeba924fc5 R13: 00007ffeba923460 R14: 0000000000000002 R15: 00000000004d4bb0 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__blk_rq_map_sg+0x339/0x4a0 RSP: 0018:ffffc90001a43820 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802 RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000 RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8 R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000 FS: 00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcc04514f71 CR3: 00000001109ea001 CR4: 0000000000370eb0 Kernel panic - not syncing: Fatal exception Kernel Offset: disabled ---[ end Kernel panic - not syncing: Fatal exception ]---
So in case of a relocation on a RAID stripe-tree based file system, skip the readahead.
--- fs/btrfs/relocation.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-)
fs/btrfs/relocation.c +18 -4
@@ -36,6 +36,7 @@#include "relocation.h" #include "super.h" #include "tree-checker.h" +#include "raid-stripe-tree.h" /* * Relocation overview
@@ -2965,21 +2966,34 @@ static int relocate_one_folio(struct reloc_control *rc,u64 folio_end;u64 cur;int ret; +const bool use_rst =btrfs_need_stripe_tree_update (fs_info, rc->block_group->flags);ASSERT (index <= last_index); folio =filemap_lock_folio (inode->i_mapping, index);if (IS_ERR (folio)) { -page_cache_sync_readahead (inode->i_mapping, ra,NULL , - index, last_index +1 - index); + +/* +* On relocation we're doing readahead on the relocation inode, +* but if the filesystem is backed by a RAID stripe tree we can +* get ENOENT (e.g. due to preallocated extents not being +* mapped in the RST) from the lookup. +* +* But readahead doesn't handle the error and submits invalid +* reads to the device, causing a assertion failures. +*/ +if (!use_rst) +page_cache_sync_readahead (inode->i_mapping, ra,NULL , + index, last_index +1 - index); folio =__filemap_get_folio (inode->i_mapping, index, -FGP_LOCK |FGP_ACCESSED |FGP_CREAT , mask); +FGP_LOCK |FGP_ACCESSED |FGP_CREAT , + mask);if (IS_ERR (folio))return PTR_ERR (folio); }WARN_ON (folio_order (folio)); -if (folio_test_readahead (folio)) +if (folio_test_readahead (folio) && !use_rst)page_cache_async_readahead (inode->i_mapping, ra,NULL , folio, last_index +1 - index);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/558 wifi: ath12k: fix array out-of-bound access in SoC stats
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karthikeyan Periyasamy <[email protected]>
[ Upstream commit e106b7ad13c1d246adaa57df73edb8f8b8acb240 ]
Currently, the ath12k_soc_dp_stats::hal_reo_error array is defined with a maximum size of DP_REO_DST_RING_MAX. However, the ath12k_dp_rx_process() function access ath12k_soc_dp_stats::hal_reo_error using the REO destination SRNG ring ID, which is incorrect. SRNG ring ID differ from normal ring ID, and this usage leads to out-of-bounds array access. To fix this issue, modify ath12k_dp_rx_process() to use the normal ring ID directly instead of the SRNG ring ID to avoid out-of-bounds array access.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath12k/dp_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath12k/dp_rx.c +1 -1
@@ -2681,7 +2681,7 @@ int ath12k_dp_rx_process(struct ath12k_base *ab, int ring_id,if (push_reason !=HAL_REO_DEST_RING_PUSH_REASON_ROUTING_INSTRUCTION ) {dev_kfree_skb_any (msdu); - ab->soc_stats.hal_reo_error[dp->reo_dst_ring[ring_id].ring_id]++; + ab->soc_stats.hal_reo_error[ring_id]++;continue ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/558 wifi: ath11k: fix array out-of-bound access in SoC stats
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karthikeyan Periyasamy <[email protected]>
[ Upstream commit 69f253e46af98af17e3efa3e5dfa72fcb7d1983d ]
Currently, the ath11k_soc_dp_stats::hal_reo_error array is defined with a maximum size of DP_REO_DST_RING_MAX. However, the ath11k_dp_process_rx() function access ath11k_soc_dp_stats::hal_reo_error using the REO destination SRNG ring ID, which is incorrect. SRNG ring ID differ from normal ring ID, and this usage leads to out-of-bounds array access. To fix this issue, modify ath11k_dp_process_rx() to use the normal ring ID directly instead of the SRNG ring ID to avoid out-of-bounds array access.
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath11k/dp_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath11k/dp_rx.c +1 -1
@@ -2697,7 +2697,7 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id,if (unlikely (push_reason !=HAL_REO_DEST_RING_PUSH_REASON_ROUTING_INSTRUCTION )) {dev_kfree_skb_any (msdu); - ab->soc_stats.hal_reo_error[dp->reo_dst_ring[ring_id].ring_id]++; + ab->soc_stats.hal_reo_error[ring_id]++;continue ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/558 wifi: rtw88: select WANT_DEV_COREDUMP
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zong-Zhe Yang <[email protected]>
[ Upstream commit 7e989b0c1e33210c07340bf5228aa83ea52515b5 ]
We have invoked device coredump when fw crash.
Should select WANT_DEV_COREDUMP by ourselves.
--- drivers/net/wireless/realtek/rtw88/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/realtek/rtw88/Kconfig +1 -0
@@ -12,6 +12,7 @@ if RTW88 config RTW88_CORE tristate + select WANT_DEV_COREDUMP config RTW88_PCI tristate
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/558 l2tp: free sessions using rcu
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Chapman <[email protected]>
[ Upstream commit d17e89999574aca143dd4ede43e4382d32d98724 ]
l2tp sessions may be accessed under an rcu read lock. Have them freed via rcu and remove the now unneeded synchronize_rcu when a session is removed.
--- net/l2tp/l2tp_core.c | 4 +--- net/l2tp/l2tp_core.h | 1 + 2 files changed, 2 insertions(+), 3 deletions(-)
net/l2tp/l2tp_core.c +1 -3
@@ -152,7 +152,7 @@ static void l2tp_session_free(struct l2tp_session *session)trace_free_session (session);if (session->tunnel)l2tp_tunnel_dec_refcount (session->tunnel); -kfree (session); +kfree_rcu (session, rcu); }struct l2tp_tunnel *l2tp_sk_to_tunnel (struct sock *sk)
@@ -1298,8 +1298,6 @@ static void l2tp_session_unhash(struct l2tp_session *session)spin_unlock_bh (&pn->l2tp_session_idr_lock);spin_unlock_bh (&tunnel->list_lock); - -synchronize_rcu (); } }
net/l2tp/l2tp_core.h +1 -0
@@ -67,6 +67,7 @@ struct l2tp_session_coll_list {struct l2tp_session {int magic;/* should be L2TP_SESSION_MAGIC */ long dead; +struct rcu_head rcu;struct l2tp_tunnel *tunnel;/* back pointer to tunnel context */ u32 session_id;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/558 l2tp: use rcu list add/del when updating lists
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Chapman <[email protected]>
[ Upstream commit 89b768ec2dfefaeba5212de14fc71368e12d06ba ]
l2tp_v3_session_htable and tunnel->session_list are read by lockless getters using RCU. Use rcu list variants when adding or removing list items.
--- net/l2tp/l2tp_core.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
net/l2tp/l2tp_core.c +6 -6
@@ -394,12 +394,12 @@ static int l2tp_session_collision_add(struct l2tp_net *pn,/* If existing session isn't already in the session hlist, add it. */ if (!hash_hashed (&session2->hlist)) -hash_add (pn->l2tp_v3_session_htable, &session2->hlist, - session2->hlist_key); +hash_add_rcu (pn->l2tp_v3_session_htable, &session2->hlist, + session2->hlist_key);/* Add new session to the hlist and collision list */ -hash_add (pn->l2tp_v3_session_htable, &session1->hlist, - session1->hlist_key); +hash_add_rcu (pn->l2tp_v3_session_htable, &session1->hlist, + session1->hlist_key);refcount_inc (&clist->ref_count);l2tp_session_coll_list_add (clist, session1);
@@ -415,7 +415,7 @@ static void l2tp_session_collision_del(struct l2tp_net *pn,lockdep_assert_held (&pn->l2tp_session_idr_lock); -hash_del (&session->hlist); +hash_del_rcu (&session->hlist);if (clist) {/* Remove session from its collision list. If there
@@ -490,7 +490,7 @@ int l2tp_session_register(struct l2tp_session *session,l2tp_tunnel_inc_refcount (tunnel);WRITE_ONCE (session->tunnel, tunnel); -list_add (&session->list, &tunnel->session_list); +list_add_rcu (&session->list, &tunnel->session_list);if (tunnel->version ==L2TP_HDR_VER_3 ) {if (!other_session)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/558 wifi: rtw89: 885xb: reset IDMEM mode to prevent download firmware failure
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping-Ke Shih <[email protected]>
[ Upstream commit 80fb81bb46a57daedd5decbcc253ea48428a254e ]
For different firmware type, it could change IDMEM mode, so reset it to default to avoid encountering error for RTL8851B/RTL8852B/RTL8852BT if that kind of firmware was downloaded before.
rtw89_8851be 0000:02:00.0: Firmware version 0.29.41.3, cmd version 0, type 5
rtw89_8851be 0000:02:00.0: Firmware version 0.29.41.3, cmd version 0, type 3
rtw89_8851be 0000:02:00.0: MAC has already powered on
rtw89_8851be 0000:02:00.0: fw security fail
rtw89_8851be 0000:02:00.0: download firmware fail
rtw89_8851be 0000:02:00.0: [ERR]fwdl 0x1E0 = 0x62
rtw89_8851be 0000:02:00.0: [ERR]fwdl 0x83F2 = 0x8
rtw89_8851be 0000:02:00.0: [ERR]fw PC = 0xb892f51c
rtw89_8851be 0000:02:00.0: [ERR]fw PC = 0xb892f524
rtw89_8851be 0000:02:00.0: [ERR]fw PC = 0xb892f51c
rtw89_8851be 0000:02:00.0: [ERR]fw PC = 0xb892f500
rtw89_8851be 0000:02:00.0: [ERR]fw PC = 0xb892f51c
rtw89_8851be 0000:02:00.0: [ERR]fw PC = 0xb892f53c
rtw89_8851be 0000:02:00.0: [ERR]fw PC = 0xb892f520
rtw89_8851be 0000:02:00.0: [ERR]fw PC = 0xb892f520
rtw89_8851be 0000:02:00.0: [ERR]fw PC = 0xb892f508
rtw89_8851be 0000:02:00.0: [ERR]fw PC = 0xb892f534
rtw89_8851be 0000:02:00.0: [ERR]fw PC = 0xb892f520
rtw89_8851be 0000:02:00.0: [ERR]fw PC = 0xb892f534
rtw89_8851be 0000:02:00.0: [ERR]fw PC = 0xb892f508
rtw89_8851be 0000:02:00.0: [ERR]fw PC = 0xb892f53c
rtw89_8851be 0000:02:00.0: [ERR]fw PC = 0xb892f524
rtw89_8851be 0000:02:00.0: failed to setup chip information
rtw89_8851be: probe of 0000:02:00.0 failed with error -16--- drivers/net/wireless/realtek/rtw89/mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/realtek/rtw89/mac.c +1 -1
@@ -3788,7 +3788,7 @@ static int rtw89_mac_enable_cpu_ax(struct rtw89_dev *rtwdev, u8 boot_reason,rtw89_write32 (rtwdev,R_AX_WCPU_FW_CTRL , val); -if (rtwdev->chip->chip_id ==RTL8852B ) +if (rtw89_is_rtl885xb (rtwdev))rtw89_write32_mask (rtwdev,R_AX_SEC_CTRL ,B_AX_SEC_IDMEM_SIZE_CONFIG_MASK ,0x2 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/558 ACPI: EC: Do not release locks during operation region accesses
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit dc171114926ec390ab90f46534545420ec03e458 ]
It is not particularly useful to release locks (the EC mutex and the ACPI global lock, if present) and re-acquire them immediately thereafter during EC address space accesses in acpi_ec_space_handler().
First, releasing them for a while before grabbing them again does not really help anyone because there may not be enough time for another thread to acquire them.
Second, if another thread successfully acquires them and carries out a new EC write or read in the middle if an operation region access in progress, it may confuse the EC firmware, especially after the burst mode has been enabled.
Finally, manipulating the locks after writing or reading every single byte of data is overhead that it is better to avoid.
Accordingly, modify the code to carry out EC address space accesses entirely without releasing the locks.
--- drivers/acpi/ec.c | 55 +++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 49 insertions(+), 6 deletions(-)
drivers/acpi/ec.c +49 -6
@@ -783,6 +783,9 @@ static int acpi_ec_transaction_unlocked(struct acpi_ec *ec,unsigned long tmp;int ret =0 ; +if (t->rdata) +memset (t->rdata,0 , t->rlen); +/* start transaction */ spin_lock_irqsave (&ec->lock, tmp);/* Enable GPE for command processing (IBF=0/OBF=1) */
@@ -819,8 +822,6 @@ static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t)if (!ec || (!t) || (t->wlen && !t->wdata) || (t->rlen && !t->rdata))return -EINVAL ; -if (t->rdata) -memset (t->rdata,0 , t->rlen);mutex_lock (&ec->mutex);if (ec->global_lock) {
@@ -847,7 +848,7 @@ static int acpi_ec_burst_enable(struct acpi_ec *ec) .wdata = NULL, .rdata = &d, .wlen = 0, .rlen = 1}; -return acpi_ec_transaction (ec, &t); +return acpi_ec_transaction_unlocked (ec, &t); }static int acpi_ec_burst_disable (struct acpi_ec *ec)
@@ -857,7 +858,7 @@ static int acpi_ec_burst_disable(struct acpi_ec *ec) .wlen = 0, .rlen = 0};return (acpi_ec_read_status (ec) &ACPI_EC_FLAG_BURST ) ? -acpi_ec_transaction (ec, &t) :0 ; +acpi_ec_transaction_unlocked (ec, &t) :0 ; }static int acpi_ec_read (struct acpi_ec *ec,u8 address,u8 *data)
@@ -873,6 +874,19 @@ static int acpi_ec_read(struct acpi_ec *ec, u8 address, u8 *data)return result; } +static int acpi_ec_read_unlocked (struct acpi_ec *ec,u8 address,u8 *data) +{ +int result; +u8 d; +struct transaction t = {.command =ACPI_EC_COMMAND_READ , + .wdata = &address, .rdata = &d, + .wlen =1 , .rlen =1 }; + + result =acpi_ec_transaction_unlocked (ec, &t); + *data = d; +return result; +} +static int acpi_ec_write (struct acpi_ec *ec,u8 address,u8 data) {u8 wdata[2 ] = { address, data };
@@ -883,6 +897,16 @@ static int acpi_ec_write(struct acpi_ec *ec, u8 address, u8 data)return acpi_ec_transaction (ec, &t); } +static int acpi_ec_write_unlocked (struct acpi_ec *ec,u8 address,u8 data) +{ +u8 wdata[2 ] = { address, data }; +struct transaction t = {.command =ACPI_EC_COMMAND_WRITE , + .wdata = wdata, .rdata =NULL , + .wlen =2 , .rlen =0 }; + +return acpi_ec_transaction_unlocked (ec, &t); +} +int ec_read (u8 addr,u8 *val) {int err;
@@ -1323,6 +1347,7 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address,struct acpi_ec *ec = handler_context;int result =0 , i, bytes = bits /8 ;u8 *value = (u8 *)value64; +u32 glk;if ((address >0xFF ) || !value || !handler_context)return AE_BAD_PARAMETER ;
@@ -1330,13 +1355,25 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address,if (function !=ACPI_READ && function !=ACPI_WRITE )return AE_BAD_PARAMETER ; +mutex_lock (&ec->mutex); + +if (ec->global_lock) { +acpi_status status; + + status =acpi_acquire_global_lock (ACPI_EC_UDELAY_GLK , &glk); +if (ACPI_FAILURE (status)) { + result = -ENODEV ; + goto unlock; + } + } +if (ec->busy_polling || bits >8 )acpi_ec_burst_enable (ec);for (i =0 ; i < bytes; ++i, ++address, ++value) { result = (function ==ACPI_READ ) ? -acpi_ec_read (ec, address, value) : -acpi_ec_write (ec, address, *value); +acpi_ec_read_unlocked (ec, address, value) : +acpi_ec_write_unlocked (ec, address, *value);if (result <0 )break ; }
@@ -1344,6 +1381,12 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address,if (ec->busy_polling || bits >8 )acpi_ec_burst_disable (ec); +if (ec->global_lock) +acpi_release_global_lock (glk); + +unlock: +mutex_unlock (&ec->mutex); +switch (result) {case -EINVAL :return AE_BAD_PARAMETER ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/558 ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <[email protected]>
[ Upstream commit a5242874488eba2b9062985bf13743c029821330 ]
ACPICA commit 4d4547cf13cca820ff7e0f859ba83e1a610b9fd0
ACPI_ALLOCATE_ZEROED() may fail, elements might be NULL and will cause NULL pointer dereference later.
--- drivers/acpi/acpica/dbconvert.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/acpi/acpica/dbconvert.c +2 -0
@@ -174,6 +174,8 @@ acpi_status acpi_db_convert_to_package(char *string, union acpi_object *object) elements =ACPI_ALLOCATE_ZEROED (DB_DEFAULT_PKG_ELEMENTS *sizeof (union acpi_object )); +if (!elements) +return (AE_NO_MEMORY ); this = string;for (i =0 ; i < (DB_DEFAULT_PKG_ELEMENTS -1 ); i++) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/558 tipc: guard against string buffer overrun
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit 6555a2a9212be6983d2319d65276484f7c5f431a ]
Smatch reports that copying media_name and if_name to name_parts may overwrite the destination.
.../bearer.c:166 bearer_name_validate() error: strcpy() 'media_name' too large for 'name_parts->media_name' (32 vs 16) .../bearer.c:167 bearer_name_validate() error: strcpy() 'if_name' too large for 'name_parts->if_name' (1010102 vs 16)
This does seem to be the case so guard against this possibility by using strscpy() and failing if truncation occurs.
Introduced by commit b97bf3fd8f6a ("[TIPC] Initial merge")
Compile tested only.
--- net/tipc/bearer.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/tipc/bearer.c +6 -2
@@ -163,8 +163,12 @@ static int bearer_name_validate(const char *name,/* return bearer name components, if necessary */ if (name_parts) { -strcpy (name_parts->media_name, media_name); -strcpy (name_parts->if_name, if_name); +if (strscpy (name_parts->media_name, media_name, +TIPC_MAX_MEDIA_NAME ) <0 ) +return 0 ; +if (strscpy (name_parts->if_name, if_name, +TIPC_MAX_IF_NAME ) <0 ) +return 0 ; }return 1 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/558 net: skbuff: sprinkle more __GFP_NOWARN on ingress allocs
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit c89cca307b20917da739567a255a68a0798ee129 ]
build_skb() and frag allocations done with GFP_ATOMIC will fail in real life, when system is under memory pressure, and there's nothing we can do about that. So no point printing warnings.
--- net/core/skbuff.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
net/core/skbuff.c +9 -6
@@ -314,8 +314,8 @@ void *__napi_alloc_frag_align(unsigned int fragsz, unsigned int align_mask) fragsz =SKB_DATA_ALIGN (fragsz);local_lock_nested_bh (&napi_alloc_cache.bh_lock); - data =__page_frag_alloc_align (&nc->page, fragsz,GFP_ATOMIC , - align_mask); + data =__page_frag_alloc_align (&nc->page, fragsz, +GFP_ATOMIC | __GFP_NOWARN, align_mask);local_unlock_nested_bh (&napi_alloc_cache.bh_lock);return data;
@@ -330,7 +330,8 @@ void *__netdev_alloc_frag_align(unsigned int fragsz, unsigned int align_mask)struct page_frag_cache *nc =this_cpu_ptr (&netdev_alloc_cache); fragsz =SKB_DATA_ALIGN (fragsz); - data =__page_frag_alloc_align (nc, fragsz,GFP_ATOMIC , + data =__page_frag_alloc_align (nc, fragsz, +GFP_ATOMIC | __GFP_NOWARN, align_mask); }else {local_bh_disable ();
@@ -349,7 +350,7 @@ static struct sk_buff *napi_skb_cache_get(void)local_lock_nested_bh (&napi_alloc_cache.bh_lock);if (unlikely (!nc->skb_count)) { nc->skb_count =kmem_cache_alloc_bulk (net_hotdata.skbuff_cache, -GFP_ATOMIC , +GFP_ATOMIC | __GFP_NOWARN,NAPI_SKB_CACHE_BULK , nc->skb_cache);if (unlikely (!nc->skb_count)) {
@@ -418,7 +419,8 @@ struct sk_buff *slab_build_skb(void *data)struct sk_buff *skb;unsigned int size; - skb =kmem_cache_alloc (net_hotdata.skbuff_cache,GFP_ATOMIC ); + skb =kmem_cache_alloc (net_hotdata.skbuff_cache, +GFP_ATOMIC | __GFP_NOWARN);if (unlikely (!skb))return NULL ;
@@ -469,7 +471,8 @@ struct sk_buff *__build_skb(void *data, unsigned int frag_size) {struct sk_buff *skb; - skb =kmem_cache_alloc (net_hotdata.skbuff_cache,GFP_ATOMIC ); + skb =kmem_cache_alloc (net_hotdata.skbuff_cache, +GFP_ATOMIC | __GFP_NOWARN);if (unlikely (!skb))return NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/558 net: mvpp2: Increase size of queue_name buffer
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit 91d516d4de48532d967a77967834e00c8c53dfe6 ]
Increase size of queue_name buffer from 30 to 31 to accommodate the largest string written to it. This avoids truncation in the possibly unlikely case where the string is name is the maximum size.
Flagged by gcc-14:
.../mvpp2_main.c: In function 'mvpp2_probe':
.../mvpp2_main.c:7636:32: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
7636 | "stats-wq-%s%s", netdev_name(priv->port_list[0]->dev),
| ^
.../mvpp2_main.c:7635:9: note: 'snprintf' output between 10 and 31 bytes into a destination of size 30
7635 | snprintf(priv->queue_name, sizeof(priv->queue_name),
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
7636 | "stats-wq-%s%s", netdev_name(priv->port_list[0]->dev),
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
7637 | priv->port_count > 1 ? "+" : "");
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Introduced by commit 118d6298f6f0 ("net: mvpp2: add ethtool GOP statistics"). I am not flagging this as a bug as I am not aware that it is one.
Compile tested only.
--- drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/mvpp2/mvpp2.h +1 -1
@@ -1088,7 +1088,7 @@ struct mvpp2 {unsigned int max_port_rxqs;/* Workqueue to gather hardware statistics */ -char queue_name[30 ]; +char queue_name[31 ];struct workqueue_struct *stats_queue;/* Debugfs root entry */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/558 bnxt_en: Extend maximum length of version string by 1 byte
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit ffff7ee843c351ce71d6e0d52f0f20bea35e18c9 ]
This corrects an out-by-one error in the maximum length of the package version string. The size argument of snprintf includes space for the trailing '\0' byte, so there is no need to allow extra space for it by reducing the value of the size argument by 1.
Found by inspection.
Compile tested only.
--- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +1 -1
@@ -4157,7 +4157,7 @@ static void bnxt_get_pkgver(struct net_device *dev)if (!bnxt_get_pkginfo (dev, buf,sizeof (buf))) { len =strlen (bp->fw_ver_str); -snprintf (bp->fw_ver_str + len,FW_VER_STR_LEN - len -1 , +snprintf (bp->fw_ver_str + len,FW_VER_STR_LEN - len,"/pkg %s" , buf); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/558 ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR).
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit e3af3d3c5b26c33a7950e34e137584f6056c4319 ]
dev->ip_ptr could be NULL if we set an invalid MTU.
Even then, if we issue ioctl(SIOCSIFADDR) for a new IPv4 address, devinet_ioctl() allocates struct in_ifaddr and fails later in inet_set_ifa() because in_dev is NULL.
Let's move the check earlier.
--- net/ipv4/devinet.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
net/ipv4/devinet.c +2 -4
@@ -574,10 +574,6 @@ static int inet_set_ifa(struct net_device *dev, struct in_ifaddr *ifa)ASSERT_RTNL (); -if (!in_dev) { -inet_free_ifa (ifa); -return -ENOBUFS ; - }ipv4_devconf_setall (in_dev);neigh_parms_data_state_setall (in_dev->arp_parms);if (ifa->ifa_dev != in_dev) {
@@ -1184,6 +1180,8 @@ int devinet_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr)if (!ifa) { ret = -ENOBUFS ; +if (!in_dev) +break ; ifa =inet_alloc_ifa ();if (!ifa)break ;
Signature · 1 line
2.43.0