6.11.4-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 6.11.4-rc1 review
This is the start of the stable review cycle for the 6.11.4 release. There are 214 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 16 Oct 2024 14:09:57 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.11.4-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.11.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.11.4-rc1
Jens Axboe <[email protected]>
io_uring/rw: fix cflags posting for single issue multishot read
Manivannan Sadhasivam <[email protected]>
PCI: Pass domain number to pci_bus_release_domain_nr() explicitly
Patrick Roy <[email protected]>
secretmem: disable memfd_secret() if arch cannot set direct map
Alexander Gordeev <[email protected]>
fs/proc/kcore.c: allow translation of physical memory addresses
Frederic Weisbecker <[email protected]>
kthread: unpark only parked kthread
Joshua Hay <[email protected]>
idpf: use actual mbx receive payload length
Ulf Hansson <[email protected]>
PM: domains: Fix alloc/free in dev_pm_domain_attach|detach_list()
Luca Stefani <[email protected]>
btrfs: add cancellation points to trim loops
Luca Stefani <[email protected]>
btrfs: split remaining space to discard in chunks
Mathieu Desnoyers <[email protected]>
selftests/rseq: Fix mm_cid test failure
Donet Tom <[email protected]>
selftests/mm: fix incorrect buffer->mirror size in hmm2 double_map test
Zhang Rui <[email protected]>
powercap: intel_rapl_tpmi: Fix bogus register reading
Yonatan Maman <[email protected]>
nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error
Gui-Dong Han <[email protected]>
ice: Fix improper handling of refcount in ice_sriov_set_msix_vec_count()
Gui-Dong Han <[email protected]>
ice: Fix improper handling of refcount in ice_dpll_init_rclk_pins()
Kun(llfl) <[email protected]>
device-dax: correct pgoff align in dax_set_mapping()
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: do not remove closing subflows
Paolo Abeni <[email protected]>
mptcp: handle consistently DSS corruption
Heiner Kallweit <[email protected]>
net: phy: realtek: Fix MMD access on RTL8126A-integrated PHY
Christian Marangi <[email protected]>
net: phy: Remove LED entry from LEDs list on unregister
Anatolij Gustschin <[email protected]>
net: dsa: lan9303: ensure chip reset and wait for READY status
Anastasia Kovaleva <[email protected]>
net: Fix an unsafe loop on the list
Ignat Korchagin <[email protected]>
net: explicitly clear the sk pointer, when pf->create fails
Dan Carpenter <[email protected]>
OPP: fix error code in dev_pm_opp_set_config()
Niklas Cassel <[email protected]>
ata: libata: avoid superfluous disk spin down + spin up during hibernation
Matthieu Baerts (NGI0) <[email protected]>
mptcp: fallback when MPTCP opts are dropped after 1st data
Michal Wilczynski <[email protected]>
mmc: sdhci-of-dwcmshc: Prevent stale command interrupt handling
Linus Walleij <[email protected]>
Revert "mmc: mvsdio: Use sg_miter for PIO"
Avri Altman <[email protected]>
scsi: ufs: Use pre-calculated offsets in ufshcd_init_lrb()
Martin Wilck <[email protected]>
scsi: fnic: Move flush_work initialization out of if block
Daniel Palmer <[email protected]>
scsi: wd33c93: Don't use stale scsi_pointer value
Rafael J. Wysocki <[email protected]>
thermal: core: Free tzp copy along with the thermal zone
Rafael J. Wysocki <[email protected]>
thermal: core: Reference count the zone in thermal_zone_get_by_id()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync
Matthew Auld <[email protected]>
drm/xe/ct: fix xa_store() error checking
Matthew Auld <[email protected]>
drm/xe/ct: prevent UAF in send_recv()
Jani Nikula <[email protected]>
drm/i915/hdcp: fix connector refcounting
Matthew Auld <[email protected]>
drm/xe/guc_submit: fix xa_store() error checking
Hamza Mahfooz <[email protected]>
drm/amd/display: fix hibernate entry for DCN35+
Lang Yu <[email protected]>
drm/amdkfd: Fix an eviction fence leak
Maíra Canal <[email protected]>
drm/vc4: Stop the active perfmon before being destroyed
Maíra Canal <[email protected]>
drm/v3d: Stop the active perfmon before being destroyed
Josip Pavic <[email protected]>
drm/amd/display: Clear update flags after update has been applied
Alex Deucher <[email protected]>
drm/amdgpu: partially revert powerplay __counted_by changes
Hans de Goede <[email protected]>
ACPI: resource: Make Asus ExpertBook B2502 matches cover more models
Hans de Goede <[email protected]>
ACPI: resource: Make Asus ExpertBook B2402 matches cover more models
SurajSonawane2415 <[email protected]>
hid: intel-ish-hid: Fix uninitialized variable 'rv' in ish_fw_xfer_direct_dma
John Keeping <[email protected]>
usb: gadget: core: force synchronous registration
Roy Luo <[email protected]>
usb: dwc3: re-enable runtime PM after failed resume
Icenowy Zheng <[email protected]>
usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip
Jose Alberto Reguero <[email protected]>
usb: xhci: Fix problem with xhci resume from suspend
Selvarasu Ganesan <[email protected]>
usb: dwc3: core: Stop processing of pending events if controller is halted
Oliver Neukum <[email protected]>
Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant"
Jason Gerecke <[email protected]>
HID: wacom: Hardcode (non-inverted) AES pens as BTN_TOOL_PEN
Wade Wang <[email protected]>
HID: plantronics: Workaround for an unexcepted opposite volume key
Basavaraj Natikar <[email protected]>
HID: amd_sfh: Switch to device-managed dmam_alloc_coherent()
Javier Carrasco <[email protected]>
hwmon: (ltc2991) Add missing dependency on REGMAP_I2C
Javier Carrasco <[email protected]>
hwmon: (adt7470) Add missing dependency on REGMAP_I2C
Javier Carrasco <[email protected]>
hwmon: (adm9240) Add missing dependency on REGMAP_I2C
Javier Carrasco <[email protected]>
hwmon: (mc34vr500) Add missing dependency on REGMAP_I2C
Guenter Roeck <[email protected]>
hwmon: (tmp513) Add missing dependency on REGMAP_I2C
Peter Colberg <[email protected]>
hwmon: intel-m10-bmc-hwmon: relabel Columbiaville to CVL Die Temperature
He Lugang <[email protected]>
HID: multitouch: Add support for lenovo Y9000P Touchpad
Shyam Sundar S K <[email protected]>
x86/amd_nb: Add new PCI IDs for AMD family 1Ah model 60h
Frederic Weisbecker <[email protected]>
rcu/nocb: Fix rcuog wake-up from offline softirq
Eric Dumazet <[email protected]>
slip: make slhc_remember() more robust against malicious packets
D. Wythe <[email protected]>
net/smc: fix lacks of icsk_syn_mss with IPPROTO_SMC
Eric Dumazet <[email protected]>
ppp: fix ppp_async_encode() illegal access
Kuniyuki Iwashima <[email protected]>
phonet: Handle error of rtnl_register_module().
Kuniyuki Iwashima <[email protected]>
mpls: Handle error of rtnl_register_module().
Kuniyuki Iwashima <[email protected]>
mctp: Handle error of rtnl_register_module().
Kuniyuki Iwashima <[email protected]>
bridge: Handle error of rtnl_register_module().
Kuniyuki Iwashima <[email protected]>
vxlan: Handle error of rtnl_register_module().
Kuniyuki Iwashima <[email protected]>
rtnetlink: Add bulk registration helpers for rtnetlink message handlers.
Eric Dumazet <[email protected]>
net: do not delay dst_entries_add() in dst_release()
Janne Grunau <[email protected]>
drm/fbdev-dma: Only cleanup deferred I/O if necessary
Breno Leitao <[email protected]>
net: netconsole: fix wrong warning
Vladimir Oltean <[email protected]>
net: dsa: refuse cross-chip mirroring operations
Rosen Penev <[email protected]>
net: ibm: emac: mal: add dcr_unmap to _remove
Florian Westphal <[email protected]>
netfilter: fib: check correct rtable in vrf setups
Florian Westphal <[email protected]>
netfilter: xtables: avoid NFPROTO_UNSPEC where needed
Xin Long <[email protected]>
sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start
Filipe Manana <[email protected]>
btrfs: zoned: fix missing RCU locking in error message when loading zone info
MD Danish Anwar <[email protected]>
net: ti: icssg-prueth: Fix race condition for VLAN table access
Rosen Penev <[email protected]>
net: ibm: emac: mal: fix wrong goto
Matt Roper <[email protected]>
drm/xe: Make wedged_mode debugfs writable
Vinay Belgaumkar <[email protected]>
drm/xe: Restore GT freq on GSC load error
Eric Dumazet <[email protected]>
net/sched: accept TCA_STAB only for root qdisc
Vitaly Lifshits <[email protected]>
e1000e: change I219 (19) devices to ADP
Mohamed Khalfella <[email protected]>
igb: Do not bring the device up after non-fatal error
Aleksandr Loktionov <[email protected]>
i40e: Fix macvlan leak by synchronizing access to mac_filter_hash
Marcin Szycik <[email protected]>
ice: Fix increasing MSI-X on VF
Wojciech Drewek <[email protected]>
ice: Flush FDB entries before reset
Marcin Szycik <[email protected]>
ice: Fix netif_is_ice() in Safe Mode
Marcin Szycik <[email protected]>
ice: Fix entering Safe Mode
Zhang Rui <[email protected]>
powercap: intel_rapl_tpmi: Ignore minor version change
Juergen Gross <[email protected]>
x86/xen: mark boot CPU of PV guest in MSR_IA32_APICBASE
Billy Tsai <[email protected]>
gpio: aspeed: Use devm_clk api to manage clock source
Billy Tsai <[email protected]>
gpio: aspeed: Add the flush write to ensure the write complete.
Yonatan Maman <[email protected]>
nouveau/dmem: Fix privileged error in copy engine channel
Ben Skeggs <[email protected]>
drm/nouveau: pass cli to nouveau_channel_new() instead of drm+device
Jonas Gorski <[email protected]>
net: dsa: b53: fix jumbo frames on 10/100 ports
Jonas Gorski <[email protected]>
net: dsa: b53: allow lower MTUs on BCM5325/5365
Jonas Gorski <[email protected]>
net: dsa: b53: fix max MTU for BCM5325/BCM5365
Jonas Gorski <[email protected]>
net: dsa: b53: fix max MTU for 1g switches
Jonas Gorski <[email protected]>
net: dsa: b53: fix jumbo frame mtu check
Christophe JAILLET <[email protected]>
net: ethernet: adi: adin1110: Fix some error handling path in adin1110_read_fifo()
Jakub Kicinski <[email protected]>
Revert "net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled"
Zhang Rui <[email protected]>
thermal: intel: int340x: processor: Fix warning during module unload
Olga Kornievskaia <[email protected]>
nfsd: fix possible badness in FREE_STATEID
Christophe JAILLET <[email protected]>
net: phy: bcm84881: Fix some error handling paths
Luiz Augusto von Dentz <[email protected]>
Bluetooth: btusb: Don't fail external suspend requests
Luiz Augusto von Dentz <[email protected]>
Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
Kory Maincent <[email protected]>
net: pse-pd: Fix enabled status mismatch
Kacper Ludwinski <[email protected]>
selftests: net: no_forwarding: fix VID for $swp2 in one_bridge_two_pvids() test
Andy Roulin <[email protected]>
netfilter: br_netfilter: fix panic with metadata_dst skb
Vladimir Oltean <[email protected]>
net: dsa: sja1105: fix reception from VLAN-unaware bridges
David Howells <[email protected]>
rxrpc: Fix uninitialised variable in rxrpc_send_data()
Neal Cardwell <[email protected]>
tcp: fix TFO SYN_RECV to not zero retrans_stamp with retransmits out
Neal Cardwell <[email protected]>
tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe
Neal Cardwell <[email protected]>
tcp: fix to allow timestamp undo if no retransmits were sent
Abhishek Chauhan <[email protected]>
net: phy: aquantia: remove usage of phy_set_max_speed
Abhishek Chauhan <[email protected]>
net: phy: aquantia: AQR115c fix up PMA capabilities
Sebastian Andrzej Siewior <[email protected]>
sfc: Don't invoke xdp_do_flush() from netpoll.
Ingo van Lil <[email protected]>
net: phy: dp83869: fix memory corruption when enabling fiber
Yanjun Zhang <[email protected]>
NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
Dan Carpenter <[email protected]>
SUNRPC: Fix integer overflow in decode_rc_list()
Dave Ertman <[email protected]>
ice: fix VLAN replay after reset
Arkadiusz Kubalewski <[email protected]>
ice: disallow DPLL_PIN_STATE_SELECTABLE for dpll output pins
Przemek Kitszel <[email protected]>
ice: fix memleak in ice_init_tx_topology()
Michal Swiatkowski <[email protected]>
ice: clear port vlan config during reset
Michal Swiatkowski <[email protected]>
ice: set correct dst VSI in only LAN filters
NeilBrown <[email protected]>
nfsd: nfsd_destroy_serv() must call svc_destroy() even if nfsd_startup_net() failed
Chuck Lever <[email protected]>
NFSD: Mark filecache "down" if init fails
Andrey Shumilin <[email protected]>
fbdev: sisfb: Fix strbuf array overflow
Enzo Matsumiya <[email protected]>
smb: client: fix UAF in async decryption
Qianqiang Liu <[email protected]>
fbcon: Fix a NULL pointer dereference issue in fbcon_putcs
Alex Hung <[email protected]>
drm/amd/display: Check null pointer before dereferencing se
Christian König <[email protected]>
drm/amdgpu: nuke the VM PD/PT shadow handling
José Roberto de Souza <[email protected]>
drm/xe/oa: Fix overflow in oa batch buffer
Justin Tee <[email protected]>
scsi: lpfc: Revise TRACE_EVENT log flag severities from KERN_ERR to KERN_WARNING
Justin Tee <[email protected]>
scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance
Justin Tee <[email protected]>
scsi: lpfc: Add ELS_RSP cmd to the list of WQEs to flush in lpfc_els_flush_cmd()
Zijun Hu <[email protected]>
driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute
Zijun Hu <[email protected]>
driver core: bus: Fix double free in driver API bus_register()
Ken Raeburn <[email protected]>
dm vdo: don't refer to dedupe_context after releasing it
Abhishek Tamboli <[email protected]>
usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c
Riyan Dhiman <[email protected]>
staging: vme_user: added bound check to geoid
Zhu Jun <[email protected]>
tools/iio: Add memory allocation failure check for trigger_name
Philip Chen <[email protected]>
virtio_pmem: Check device status before requesting flush
Simon Horman <[email protected]>
netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n
Florian Westphal <[email protected]>
netfilter: nf_nat: don't try nat source port reallocation for reverse dir clash
Wentao Guan <[email protected]>
LoongArch: Fix memleak in pci_acpi_scan_root()
Ruffalo Lavoisier <[email protected]>
comedi: ni_routing: tools: Check when the file could not be opened
Frank Li <[email protected]>
usb: host: xhci-plat: Parse xhci-missing_cas_quirk and apply quirk
Mathias Nyman <[email protected]>
xhci: dbc: Fix STALL transfer event handling
Shawn Shao <[email protected]>
usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the Crashkernel Scenario
Xu Yang <[email protected]>
usb: chipidea: udc: enable suspend interrupt after usb reset
Heikki Krogerus <[email protected]>
usb: typec: ucsi: Don't truncate the reads
Wadim Egorov <[email protected]>
usb: typec: tipd: Free IRQ only if it was requested before
Jiri Slaby (SUSE) <[email protected]>
serial: protect uart_port_dtr_rts() in uart_shutdown() too
Peng Fan <[email protected]>
clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D
Peng Fan <[email protected]>
remoteproc: imx_rproc: Use imx specific hook for find_loaded_rsc_table
Yunke Cao <[email protected]>
media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put()
Ying Sun <[email protected]>
riscv/kexec_file: Fix relocation type R_RISCV_ADD16 and R_RISCV_SUB16 unknown
Pierre-Louis Bossart <[email protected]>
soundwire: cadence: re-check Peripheral status with delayed_work
Manivannan Sadhasivam <[email protected]>
PCI: endpoint: Assign PCI domain number for endpoint controllers
Prudhvi Yarlagadda <[email protected]>
PCI: qcom: Disable mirroring of DBI and iATU register space in BAR region
Michael Guralnik <[email protected]>
RDMA/mlx5: Enforce umem boundaries for explicit ODP page faults
Jisheng Zhang <[email protected]>
riscv: avoid Imbalance in RAS
Samuel Holland <[email protected]>
riscv: Omit optimized string routines when using KASAN
Ilpo Järvinen <[email protected]>
mfd: intel-lpss: Add Intel Panther Lake LPSS PCI IDs
Ilpo Järvinen <[email protected]>
mfd: intel-lpss: Add Intel Arrow Lake-H LPSS PCI IDs
Hans de Goede <[email protected]>
mfd: intel_soc_pmic_chtwc: Make Lenovo Yoga Tab 3 X90F DMI match less strict
Kaixin Wang <[email protected]>
ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
Jens Axboe <[email protected]>
io_uring: check if we need to reschedule during overflow flush
Palmer Dabbelt <[email protected]>
RISC-V: Don't have MAX_PHYSMEM_BITS exceed phys_addr_t
Kaixin Wang <[email protected]>
i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition
Alex Williamson <[email protected]>
PCI: Mark Creative Labs EMU20k2 INTx masking as broken
Hans de Goede <[email protected]>
i2c: i801: Use a different adapter-name for IDF adapters
Subramanian Ananthanarayanan <[email protected]>
PCI: Add ACS quirk for Qualcomm SA8775P
Krzysztof Kozlowski <[email protected]>
clk: bcm: bcm53573: fix OF node leak in init
Md Haris Iqbal <[email protected]>
RDMA/rtrs-srv: Avoid null pointer deref during path establishment
WangYuli <[email protected]>
PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
Pierre-Louis Bossart <[email protected]>
soundwire: intel_bus_common: enable interrupts before exiting reset
Saravanan Vajravel <[email protected]>
RDMA/mad: Improve handling of timed out WRs of mad agent
Daniel Jordan <[email protected]>
ktest.pl: Avoid false positives with grub2 skip regex
Xu Kuohai <[email protected]>
bpf: Prevent tail call between progs attached to different hooks
Heiko Carstens <[email protected]>
s390/traps: Handle early warnings gracefully
Thomas Richter <[email protected]>
s390/cpum_sf: Remove WARN_ON_ONCE statements
Wojciech Gładysz <[email protected]>
ext4: nested locking for xattr inode
Jan Kara <[email protected]>
ext4: don't set SB_RDONLY after filesystem errors
Yonghong Song <[email protected]>
bpf, x64: Fix a jit convergence issue
Gerald Schaefer <[email protected]>
s390/mm: Add cond_resched() to cmm_alloc/free_pages()
Heiko Carstens <[email protected]>
s390/facility: Disable compile time optimization for decompressor code
Heiko Carstens <[email protected]>
s390/boot: Compile all files with the same march flag
Tao Chen <[email protected]>
bpf: Check percpu map value size first
Daniel Borkmann <[email protected]>
selftests/bpf: Fix ARG_PTR_TO_LONG {half-,}uninitialized test
Hou Tao <[email protected]>
bpf: Call the missed btf_record_free() when map creation fails
Andrey Skvortsov <[email protected]>
zram: don't free statically defined names
Sergey Senozhatsky <[email protected]>
zram: free secondary algorithms names
Yang Jihong <[email protected]>
perf build: Fix build feature-dwarf_getlocations fail for old libdw
Yang Jihong <[email protected]>
perf build: Fix static compilation error when libdw is not installed
Diogo Jahchan Koike <[email protected]>
ntfs3: Change to non-blocking allocation in ntfs_d_hash
Ian Rogers <[email protected]>
perf vdso: Missed put on 32-bit dsos
Michael S. Tsirkin <[email protected]>
virtio_console: fix misc probe bugs
Srujana Challa <[email protected]>
vdpa/octeon_ep: Fix format specifier for pointers in debug messages
Konstantin Komarov <[email protected]>
fs/ntfs3: Refactor enum_rstbl to suppress static checker
Konstantin Komarov <[email protected]>
fs/ntfs3: Fix sparse warning in ni_fiemap
Konstantin Komarov <[email protected]>
fs/ntfs3: Fix sparse warning for bigendian
Konstantin Komarov <[email protected]>
fs/ntfs3: Optimize large writes into sparse file
Konstantin Komarov <[email protected]>
fs/ntfs3: Do not call file_modified if collapse range failed
Wei Fang <[email protected]>
net: fec: don't save PTP state if PTP is unsupported
Gabriel Krisman Bertazi <[email protected]>
unicode: Don't special case ignorable code points
-------------
Diffstat:
Makefile | 4 +- arch/loongarch/pci/acpi.c | 1 + arch/riscv/include/asm/sparsemem.h | 2 +- arch/riscv/include/asm/string.h | 2 + arch/riscv/kernel/elf_kexec.c | 6 + arch/riscv/kernel/entry.S | 4 +- arch/riscv/kernel/riscv_ksyms.c | 3 - arch/riscv/lib/Makefile | 2 + arch/riscv/lib/strcmp.S | 1 + arch/riscv/lib/strlen.S | 1 + arch/riscv/lib/strncmp.S | 1 + arch/riscv/purgatory/Makefile | 2 + arch/s390/boot/Makefile | 19 +- arch/s390/include/asm/facility.h | 6 +- arch/s390/include/asm/io.h | 2 + arch/s390/kernel/early.c | 17 +- arch/s390/kernel/perf_cpum_sf.c | 12 +- arch/s390/mm/cmm.c | 18 +- arch/x86/kernel/amd_nb.c | 3 + arch/x86/net/bpf_jit_comp.c | 54 +- arch/x86/xen/enlighten_pv.c | 4 + drivers/acpi/resource.c | 29 +- drivers/ata/libata-eh.c | 18 +- drivers/base/bus.c | 8 +- drivers/base/power/common.c | 25 +- drivers/block/zram/zram_drv.c | 7 + drivers/bluetooth/btusb.c | 20 +- drivers/char/virtio_console.c | 18 +- drivers/clk/bcm/clk-bcm53573-ilp.c | 2 +- drivers/clk/imx/clk-imx7d.c | 4 +- .../drivers/ni_routing/tools/convert_c_to_py.c | 5 + drivers/dax/device.c | 2 +- drivers/gpio/gpio-aspeed.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 4 - drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 87 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 67 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.h | 21 - drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 17 - drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c | 56 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c | 19 +- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 7 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 47 +- drivers/gpu/drm/amd/pm/powerplay/inc/hwmgr.h | 26 +- drivers/gpu/drm/drm_fbdev_dma.c | 3 +- drivers/gpu/drm/i915/display/intel_hdcp.c | 10 +- drivers/gpu/drm/nouveau/dispnv04/crtc.c | 2 +- drivers/gpu/drm/nouveau/nouveau_abi16.c | 2 +- drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +- drivers/gpu/drm/nouveau/nouveau_chan.c | 21 +- drivers/gpu/drm/nouveau/nouveau_chan.h | 3 +- drivers/gpu/drm/nouveau/nouveau_dmem.c | 2 +- drivers/gpu/drm/nouveau/nouveau_drm.c | 4 +- drivers/gpu/drm/v3d/v3d_perfmon.c | 9 +- drivers/gpu/drm/vc4/vc4_perfmon.c | 7 +- drivers/gpu/drm/xe/xe_bb.c | 3 +- drivers/gpu/drm/xe/xe_debugfs.c | 2 +- drivers/gpu/drm/xe/xe_gt.c | 4 +- drivers/gpu/drm/xe/xe_guc_ct.c | 44 +- drivers/gpu/drm/xe/xe_guc_submit.c | 9 +- drivers/hid/amd-sfh-hid/amd_sfh_client.c | 14 +- drivers/hid/hid-ids.h | 3 + drivers/hid/hid-multitouch.c | 8 +- drivers/hid/hid-plantronics.c | 23 + drivers/hid/intel-ish-hid/ishtp-fw-loader.c | 2 +- drivers/hid/wacom_wac.c | 2 + drivers/hwmon/Kconfig | 5 + drivers/hwmon/intel-m10-bmc-hwmon.c | 2 +- drivers/hwmon/k10temp.c | 1 + drivers/i2c/busses/i2c-i801.c | 9 +- drivers/i3c/master/i3c-master-cdns.c | 1 + drivers/infiniband/core/mad.c | 14 +- drivers/infiniband/hw/mlx5/odp.c | 25 +- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 13 +- drivers/md/dm-vdo/dedupe.c | 3 + drivers/media/common/videobuf2/videobuf2-core.c | 8 +- drivers/mfd/intel-lpss-pci.c | 39 + drivers/mfd/intel_soc_pmic_chtwc.c | 1 - drivers/mmc/host/mvsdio.c | 71 +- drivers/mmc/host/sdhci-of-dwcmshc.c | 8 + drivers/net/dsa/b53/b53_common.c | 17 +- drivers/net/dsa/lan9303-core.c | 29 + drivers/net/dsa/sja1105/sja1105_main.c | 1 - drivers/net/ethernet/adi/adin1110.c | 4 +- drivers/net/ethernet/freescale/fec_main.c | 6 +- drivers/net/ethernet/ibm/emac/mal.c | 4 +- drivers/net/ethernet/intel/e1000e/hw.h | 4 +- drivers/net/ethernet/intel/e1000e/netdev.c | 4 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 1 + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 2 + drivers/net/ethernet/intel/ice/ice_ddp.c | 58 +- drivers/net/ethernet/intel/ice/ice_ddp.h | 4 +- drivers/net/ethernet/intel/ice/ice_dpll.c | 6 +- drivers/net/ethernet/intel/ice/ice_eswitch_br.c | 5 +- drivers/net/ethernet/intel/ice/ice_eswitch_br.h | 1 + drivers/net/ethernet/intel/ice/ice_main.c | 39 +- drivers/net/ethernet/intel/ice/ice_sriov.c | 19 +- drivers/net/ethernet/intel/ice/ice_switch.c | 2 - drivers/net/ethernet/intel/ice/ice_tc_lib.c | 11 + drivers/net/ethernet/intel/ice/ice_vf_lib.c | 9 +- .../net/ethernet/intel/ice/ice_vf_lib_private.h | 1 - drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.c | 57 + drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.h | 1 + drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 9 +- drivers/net/ethernet/intel/igb/igb_main.c | 4 + drivers/net/ethernet/sfc/efx_channels.c | 3 +- drivers/net/ethernet/sfc/siena/efx_channels.c | 3 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- drivers/net/ethernet/ti/icssg/icssg_config.c | 2 + drivers/net/ethernet/ti/icssg/icssg_prueth.c | 1 + drivers/net/ethernet/ti/icssg/icssg_prueth.h | 2 + drivers/net/netconsole.c | 8 +- drivers/net/phy/aquantia/aquantia_main.c | 51 +- drivers/net/phy/bcm84881.c | 4 +- drivers/net/phy/dp83869.c | 1 - drivers/net/phy/phy_device.c | 5 +- drivers/net/phy/realtek.c | 24 +- drivers/net/ppp/ppp_async.c | 2 +- drivers/net/pse-pd/pse_core.c | 11 + drivers/net/slip/slhc.c | 57 +- drivers/net/vxlan/vxlan_core.c | 6 +- drivers/net/vxlan/vxlan_private.h | 2 +- drivers/net/vxlan/vxlan_vnifilter.c | 19 +- drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 1 + drivers/nvdimm/nd_virtio.c | 9 + drivers/opp/core.c | 4 +- drivers/pci/controller/dwc/pcie-designware.c | 2 + drivers/pci/controller/dwc/pcie-designware.h | 2 + drivers/pci/controller/dwc/pcie-qcom.c | 72 +- drivers/pci/endpoint/pci-epc-core.c | 14 + drivers/pci/pci.c | 14 +- drivers/pci/probe.c | 2 +- drivers/pci/quirks.c | 8 + drivers/pci/remove.c | 2 +- drivers/powercap/intel_rapl_tpmi.c | 19 +- drivers/remoteproc/imx_rproc.c | 13 +- drivers/scsi/fnic/fnic_main.c | 2 +- drivers/scsi/lpfc/lpfc_ct.c | 22 +- drivers/scsi/lpfc/lpfc_disc.h | 7 + drivers/scsi/lpfc/lpfc_els.c | 132 +- drivers/scsi/lpfc/lpfc_vport.c | 43 +- drivers/scsi/wd33c93.c | 2 +- drivers/soundwire/cadence_master.c | 39 +- drivers/soundwire/cadence_master.h | 5 + drivers/soundwire/intel.h | 2 + drivers/soundwire/intel_auxdevice.c | 1 + drivers/soundwire/intel_bus_common.c | 35 +- drivers/staging/vme_user/vme_fake.c | 6 + drivers/staging/vme_user/vme_tsi148.c | 6 + .../int340x_thermal/processor_thermal_device_pci.c | 2 - drivers/thermal/thermal_core.c | 5 +- drivers/thermal/thermal_core.h | 3 + drivers/thermal/thermal_netlink.c | 9 +- drivers/tty/serial/serial_core.c | 16 +- drivers/ufs/core/ufshcd.c | 5 +- drivers/usb/chipidea/udc.c | 8 +- drivers/usb/dwc2/platform.c | 26 +- drivers/usb/dwc3/core.c | 30 +- drivers/usb/dwc3/core.h | 4 - drivers/usb/dwc3/gadget.c | 11 - drivers/usb/gadget/function/uvc_v4l2.c | 12 +- drivers/usb/gadget/udc/core.c | 1 + drivers/usb/host/xhci-dbgcap.c | 133 +- drivers/usb/host/xhci-dbgcap.h | 2 +- drivers/usb/host/xhci-pci.c | 5 + drivers/usb/host/xhci-plat.c | 6 + drivers/usb/misc/yurex.c | 19 +- drivers/usb/storage/unusual_devs.h | 11 + drivers/usb/typec/tipd/core.c | 3 +- drivers/usb/typec/ucsi/ucsi.c | 8 +- drivers/usb/typec/ucsi/ucsi.h | 2 + drivers/vdpa/octeon_ep/octep_vdpa_hw.c | 12 +- drivers/video/fbdev/core/fbcon.c | 2 + drivers/video/fbdev/sis/sis_main.c | 2 +- fs/btrfs/extent-tree.c | 26 +- fs/btrfs/free-space-cache.c | 4 +- fs/btrfs/free-space-cache.h | 6 + fs/btrfs/volumes.h | 6 + fs/btrfs/zoned.c | 2 +- fs/ext4/super.c | 9 +- fs/ext4/xattr.c | 4 +- fs/nfs/callback_xdr.c | 2 + fs/nfs/client.c | 1 + fs/nfs/nfs42proc.c | 2 +- fs/nfs/nfs4state.c | 2 +- fs/nfsd/filecache.c | 4 +- fs/nfsd/nfs4state.c | 1 + fs/nfsd/nfssvc.c | 6 +- fs/ntfs3/file.c | 40 +- fs/ntfs3/frecord.c | 21 +- fs/ntfs3/fslog.c | 19 +- fs/ntfs3/namei.c | 4 +- fs/ntfs3/super.c | 3 +- fs/proc/kcore.c | 36 +- fs/smb/client/smb2ops.c | 47 +- fs/smb/client/smb2pdu.c | 6 + fs/unicode/mkutf8data.c | 70 - fs/unicode/utf8data.c_shipped | 6703 ++++++++++---------- include/linux/bpf.h | 1 + include/linux/nfs_fs_sb.h | 1 + include/linux/pci-epc.h | 2 + include/linux/pci.h | 2 +- include/linux/pci_ids.h | 3 + include/net/mctp.h | 2 +- include/net/rtnetlink.h | 17 + include/net/sch_generic.h | 1 - include/net/sock.h | 2 + io_uring/io_uring.c | 15 + io_uring/rw.c | 19 +- kernel/bpf/arraymap.c | 3 + kernel/bpf/core.c | 21 +- kernel/bpf/hashtab.c | 3 + kernel/bpf/syscall.c | 19 +- kernel/kthread.c | 2 + kernel/rcu/tree_nocb.h | 8 +- mm/secretmem.c | 4 +- net/bluetooth/hci_conn.c | 3 + net/bluetooth/rfcomm/sock.c | 2 - net/bridge/br_netfilter_hooks.c | 5 + net/bridge/br_netlink.c | 6 +- net/bridge/br_private.h | 5 +- net/bridge/br_vlan.c | 19 +- net/core/dst.c | 17 +- net/core/rtnetlink.c | 29 + net/dsa/user.c | 11 +- net/ipv4/netfilter/nf_reject_ipv4.c | 10 +- net/ipv4/netfilter/nft_fib_ipv4.c | 4 +- net/ipv4/tcp_input.c | 42 +- net/ipv6/netfilter/nf_reject_ipv6.c | 5 +- net/ipv6/netfilter/nft_fib_ipv6.c | 5 +- net/mctp/af_mctp.c | 6 +- net/mctp/device.c | 32 +- net/mctp/neigh.c | 29 +- net/mctp/route.c | 33 +- net/mpls/af_mpls.c | 32 +- net/mptcp/mib.c | 2 + net/mptcp/mib.h | 2 + net/mptcp/pm_netlink.c | 3 +- net/mptcp/protocol.c | 24 +- net/mptcp/subflow.c | 6 +- net/netfilter/nf_nat_core.c | 120 +- net/netfilter/xt_CHECKSUM.c | 33 +- net/netfilter/xt_CLASSIFY.c | 16 +- net/netfilter/xt_CONNSECMARK.c | 36 +- net/netfilter/xt_CT.c | 148 +- net/netfilter/xt_IDLETIMER.c | 59 +- net/netfilter/xt_LED.c | 39 +- net/netfilter/xt_NFLOG.c | 36 +- net/netfilter/xt_RATEEST.c | 39 +- net/netfilter/xt_SECMARK.c | 27 +- net/netfilter/xt_TRACE.c | 35 +- net/netfilter/xt_addrtype.c | 15 +- net/netfilter/xt_cluster.c | 33 +- net/netfilter/xt_connbytes.c | 4 +- net/netfilter/xt_connlimit.c | 39 +- net/netfilter/xt_connmark.c | 28 +- net/netfilter/xt_mark.c | 42 +- net/netlink/af_netlink.c | 3 +- net/phonet/pn_netlink.c | 28 +- net/rxrpc/sendmsg.c | 10 +- net/sched/sch_api.c | 7 +- net/sctp/socket.c | 18 +- net/smc/smc_inet.c | 11 + net/socket.c | 7 +- sound/pci/hda/hda_intel.c | 2 +- tools/build/feature/Makefile | 5 +- tools/iio/iio_generic_buffer.c | 4 + tools/perf/Makefile.config | 7 +- tools/perf/util/vdso.c | 4 +- tools/testing/ktest/ktest.pl | 2 +- .../testing/selftests/bpf/progs/verifier_int_ptr.c | 5 +- tools/testing/selftests/mm/hmm-tests.c | 2 +- .../selftests/net/forwarding/no_forwarding.sh | 2 +- tools/testing/selftests/rseq/rseq.c | 110 +- tools/testing/selftests/rseq/rseq.h | 10 +- 276 files changed, 5984 insertions(+), 4832 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/214 unicode: Dont special case ignorable code points
6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriel Krisman Bertazi <[email protected]>
commit 5c26d2f1d3f5e4be3e196526bead29ecb139cf91 upstream.
We don't need to handle them separately. Instead, just let them decompose/casefold to themselves.
--- fs/unicode/mkutf8data.c | 70 fs/unicode/utf8data.c_shipped | 6703 ++++++++++++++++++++---------------------- 2 files changed, 3346 insertions(+), 3427 deletions(-)
fs/unicode/mkutf8data.c +0 -70
@@ -2230,75 +2230,6 @@ static void nfdicf_init(void)file_fail (fold_name); } -static void ignore_init (void ) -{ -FILE *file; -unsigned int unichar; -unsigned int first; -unsigned int last; -unsigned int *um; -int count; -int ret; - -if (verbose >0 ) -printf ("Parsing %s\n" , prop_name); - file =fopen (prop_name,"r" ); -if (!file) -open_fail (prop_name, errno); -assert (file); - count =0 ; -while (fgets (line,LINESIZE , file)) { - ret =sscanf (line,"%X..%X ; %s # " , &first, &last, buf0); -if (ret ==3 ) { -if (strcmp (buf0,"Default_Ignorable_Code_Point" )) -continue ; -if (!utf32valid (first) || !utf32valid (last)) -line_fail (prop_name, line); -for (unichar = first; unichar <= last; unichar++) { -free (unicode_data[unichar].utf32nfdi); - um =malloc (sizeof (unsigned int )); - *um =0 ; - unicode_data[unichar].utf32nfdi = um; -free (unicode_data[unichar].utf32nfdicf); - um =malloc (sizeof (unsigned int )); - *um =0 ; - unicode_data[unichar].utf32nfdicf = um; - count++; - } -if (verbose >1 ) -printf (" %X..%X Default_Ignorable_Code_Point\n" , - first, last); -continue ; - } - ret =sscanf (line,"%X ; %s # " , &unichar, buf0); -if (ret ==2 ) { -if (strcmp (buf0,"Default_Ignorable_Code_Point" )) -continue ; -if (!utf32valid (unichar)) -line_fail (prop_name, line); -free (unicode_data[unichar].utf32nfdi); - um =malloc (sizeof (unsigned int )); - *um =0 ; - unicode_data[unichar].utf32nfdi = um; -free (unicode_data[unichar].utf32nfdicf); - um =malloc (sizeof (unsigned int )); - *um =0 ; - unicode_data[unichar].utf32nfdicf = um; -if (verbose >1 ) -printf (" %X Default_Ignorable_Code_Point\n" , - unichar); - count++; -continue ; - } - } -fclose (file); - -if (verbose >0 ) -printf ("Found %d entries\n" , count); -if (count ==0 ) -file_fail (prop_name); -} -static void corrections_init (void ) {FILE *file;
@@ -3411,7 +3342,6 @@ int main(int argc, char *argv[])ccc_init ();nfdi_init ();nfdicf_init (); -ignore_init ();corrections_init ();hangul_decompose ();nfdi_decompose ();
fs/unicode/utf8data.c_shipped +3346 -3357
2,918 lines not on this page · raw message
The rest of this diff is not shown. View the raw message.
Part of the diff is not shown here. View the raw message.
Greg Kroah-Hartman
maintainerPATCH 2/214 net: fec: dont save PTP state if PTP is unsupported
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
commit 6be063071a457767ee229db13f019c2ec03bfe44 upstream.
Some platforms (such as i.MX25 and i.MX27) do not support PTP, so on these platforms fec_ptp_init() is not called and the related members in fep are not initialized. However, fec_ptp_save_state() is called unconditionally, which causes the kernel to panic. Therefore, add a condition so that fec_ptp_save_state() is not called if PTP is not supported.
--- drivers/net/ethernet/freescale/fec_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/freescale/fec_main.c +4 -2
@@ -1077,7 +1077,8 @@ fec_restart(struct net_device *ndev)u32 rcntl =OPT_FRAME_SIZE |0x04 ;u32 ecntl =FEC_ECR_ETHEREN ; -fec_ptp_save_state (fep); +if (fep->bufdesc_ex) +fec_ptp_save_state (fep);/* Whack a reset. We should wait for this. * For i.MX6SX SOC, enet use AXI bus, we use disable MAC
@@ -1340,7 +1341,8 @@ fec_stop(struct net_device *ndev)netdev_err (ndev,"Graceful transmit stop did not complete!\n" ); } -fec_ptp_save_state (fep); +if (fep->bufdesc_ex) +fec_ptp_save_state (fep);/* Whack a reset. We should wait for this. * For i.MX6SX SOC, enet use AXI bus, we use disable MAC
Greg Kroah-Hartman
maintainerPATCH 3/214 fs/ntfs3: Do not call file_modified if collapse range failed
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit 2db86f7995fe6b62a4d6fee9f3cdeba3c6d27606 ]
--- fs/ntfs3/file.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/ntfs3/file.c +3 -1
@@ -484,7 +484,7 @@ static int ntfs_truncate(struct inode *inode, loff_t new_size) }/* -* ntfs_fallocate +* ntfs_fallocate - file_operations::ntfs_fallocate * * Preallocate space for a file. This implements ntfs's fallocate file * operation, which gets called from sys_fallocate system call. User
@@ -619,6 +619,8 @@ static long ntfs_fallocate(struct file *file, int mode, loff_t vbo, loff_t len)ni_lock (ni); err =attr_collapse_range (ni, vbo, len);ni_unlock (ni); +if (err) + goto out; }else if (mode &FALLOC_FL_INSERT_RANGE ) {/* Check new size. */ err =inode_newsize_ok (inode, new_size);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/214 fs/ntfs3: Optimize large writes into sparse file
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit acdbd67bf939577d6f9e3cf796a005c31cec52d8 ]
Optimized cluster allocation by allocating a large chunk in advance before writing, instead of allocating during the writing process by clusters.
Essentially replicates the logic of fallocate.
--- fs/ntfs3/file.c | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+)
fs/ntfs3/file.c +36 -0
@@ -408,6 +408,42 @@ static int ntfs_extend(struct inode *inode, loff_t pos, size_t count, err =0 ; } +if (file &&is_sparsed (ni)) { +/* +* This code optimizes large writes to sparse file. +* TODO: merge this fragment with fallocate fragment. +*/ +struct ntfs_sb_info *sbi = ni->mi.sbi; +CLST vcn = pos >> sbi->cluster_bits; +CLST cend =bytes_to_cluster (sbi, end); +CLST cend_v =bytes_to_cluster (sbi, ni->i_valid); +CLST lcn, clen; +bool new; + +if (cend_v > cend) + cend_v = cend; + +/* +* Allocate and zero new clusters. +* Zeroing these clusters may be too long. +*/ +for (; vcn < cend_v; vcn += clen) { + err =attr_data_get_block (ni, vcn, cend_v - vcn, &lcn, + &clen, &new, true); +if (err) + goto out; + } +/* +* Allocate but not zero new clusters. +*/ +for (; vcn < cend; vcn += clen) { + err =attr_data_get_block (ni, vcn, cend - vcn, &lcn, + &clen, &new, false); +if (err) + goto out; + } + } +inode_set_mtime_to_ts (inode,inode_set_ctime_current (inode));mark_inode_dirty (inode);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/214 fs/ntfs3: Fix sparse warning for bigendian
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit ffe718c9924eb7e4ce062dd383cf5fea7f02f180 ]
--- fs/ntfs3/super.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/ntfs3/super.c +1 -2
@@ -1491,11 +1491,10 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)#ifdef __BIG_ENDIAN { -const __le16 *src = sbi->upcase;u16 *dst = sbi->upcase;for (i =0 ; i <0x10000 ; i++) - *dst++ =le16_to_cpu (*src++); +__swab16s (dst++); }#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/214 fs/ntfs3: Fix sparse warning in ni_fiemap
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit 62fea783f96ce825f0ac9e40ce9530ddc1ea2a29 ]
The interface of fiemap_fill_next_extent_k() was modified to eliminate the sparse warning.
--- fs/ntfs3/frecord.c | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-)
fs/ntfs3/frecord.c +8 -13
@@ -1900,13 +1900,13 @@ enum REPARSE_SIGN ni_parse_reparse(struct ntfs_inode *ni, struct ATTRIB *attr,/* * fiemap_fill_next_extent_k - a copy of fiemap_fill_next_extent -* but it accepts kernel address for fi_extents_start +* but it uses 'fe_k' instead of fieinfo->fi_extents_start */ static int fiemap_fill_next_extent_k (struct fiemap_extent_info *fieinfo, -u64 logical,u64 phys,u64 len,u32 flags) +struct fiemap_extent *fe_k,u64 logical, +u64 phys,u64 len,u32 flags) {struct fiemap_extent extent; -struct fiemap_extent __user *dest = fieinfo->fi_extents_start;/* only count the extents */ if (fieinfo->fi_extents_max ==0 ) {
@@ -1930,8 +1930,7 @@ static int fiemap_fill_next_extent_k(struct fiemap_extent_info *fieinfo, extent.fe_length = len; extent.fe_flags = flags; - dest += fieinfo->fi_extents_mapped; -memcpy (dest, &extent,sizeof (extent)); +memcpy (fe_k + fieinfo->fi_extents_mapped, &extent,sizeof (extent)); fieinfo->fi_extents_mapped++;if (fieinfo->fi_extents_mapped == fieinfo->fi_extents_max)
@@ -1949,7 +1948,6 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, __u64 vbo, __u64 len) { int err = 0; -struct fiemap_extent __user *fe_u = fieinfo->fi_extents_start;struct fiemap_extent *fe_k =NULL ;struct ntfs_sb_info *sbi = ni->mi.sbi;u8 cluster_bits = sbi->cluster_bits;
@@ -2008,7 +2006,6 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, err = -ENOMEM ; goto out; } - fieinfo->fi_extents_start = fe_k; end = vbo + len; alloc_size =le64_to_cpu (attr->nres.alloc_size);
@@ -2098,8 +2095,8 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,if (vbo + dlen >= end) flags |=FIEMAP_EXTENT_LAST ; - err =fiemap_fill_next_extent_k (fieinfo, vbo, lbo, dlen, - flags); + err =fiemap_fill_next_extent_k (fieinfo, fe_k, vbo, lbo, + dlen, flags);if (err <0 )break ;
@@ -2120,7 +2117,7 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,if (vbo + bytes >= end) flags |=FIEMAP_EXTENT_LAST ; - err =fiemap_fill_next_extent_k (fieinfo, vbo, lbo, bytes, + err =fiemap_fill_next_extent_k (fieinfo, fe_k, vbo, lbo, bytes, flags);if (err <0 )break ;
@@ -2137,15 +2134,13 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,/* * Copy to user memory out of lock */ -if (copy_to_user (fe_u, fe_k, +if (copy_to_user (fieinfo->fi_extents_start, fe_k, fieinfo->fi_extents_max *sizeof (struct fiemap_extent ))) { err = -EFAULT ; } out: -/* Restore original pointer. */ - fieinfo->fi_extents_start = fe_u;kfree (fe_k);return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/214 fs/ntfs3: Refactor enum_rstbl to suppress static checker
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit 56c16d5459d5c050a97a138a00a82b105a8e0a66 ]
Comments and brief description of function enum_rstbl added.
--- fs/ntfs3/fslog.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
fs/ntfs3/fslog.c +17 -2
@@ -609,14 +609,29 @@ static inline void add_client(struct CLIENT_REC *ca, u16 index, __le16 *head) *head =cpu_to_le16 (index); } +/* +* Enumerate restart table. +* +* @t - table to enumerate. +* @c - current enumerated element. +* +* enumeration starts with @c == NULL +* returns next element or NULL +*/ static inline void *enum_rstbl (struct RESTART_TABLE *t,void *c) {__le32 *e;u32 bprt; -u16 rsize = t ?le16_to_cpu (t->size) :0 ; +u16 rsize; + +if (!t) +return NULL ; + + rsize =le16_to_cpu (t->size);if (!c) { -if (!t || !t->total) +/* start enumeration. */ +if (!t->total)return NULL ; e =Add2Ptr (t,sizeof (struct RESTART_TABLE )); }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/214 vdpa/octeon_ep: Fix format specifier for pointers in debug messages
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srujana Challa <[email protected]>
[ Upstream commit bc0dcbc5c2c539f37004f2cce0e6e245b2e50b6c ]
Updates the debug messages in octep_vdpa_hw.c to use the %p format specifier for pointers instead of casting them to u64.
Fixes smatch warning:octep_hw_caps_read() warn: argument 3 to %016llx specifier is cast from pointer
Message-Id: <[email protected]>
--- drivers/vdpa/octeon_ep/octep_vdpa_hw.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/vdpa/octeon_ep/octep_vdpa_hw.c +6 -6
@@ -475,11 +475,11 @@ int octep_hw_caps_read(struct octep_hw *oct_hw, struct pci_dev *pdev)dev_err (dev,"Incomplete PCI capabilities" );return -EIO ; } -dev_info (dev,"common cfg mapped at: 0x%016llx\n" , (u64 )(uintptr_t )oct_hw->common_cfg); -dev_info (dev,"device cfg mapped at: 0x%016llx\n" , (u64 )(uintptr_t )oct_hw->dev_cfg); -dev_info (dev,"isr cfg mapped at: 0x%016llx\n" , (u64 )(uintptr_t )oct_hw->isr); -dev_info (dev,"notify base: 0x%016llx, notify off multiplier: %u\n" , - (u64 )(uintptr_t )oct_hw->notify_base, oct_hw->notify_off_multiplier); +dev_info (dev,"common cfg mapped at: %p\n" , oct_hw->common_cfg); +dev_info (dev,"device cfg mapped at: %p\n" , oct_hw->dev_cfg); +dev_info (dev,"isr cfg mapped at: %p\n" , oct_hw->isr); +dev_info (dev,"notify base: %p, notify off multiplier: %u\n" , + oct_hw->notify_base, oct_hw->notify_off_multiplier); oct_hw->config_size =octep_get_config_size (oct_hw); oct_hw->features =octep_hw_get_dev_features (oct_hw);
@@ -511,7 +511,7 @@ int octep_hw_caps_read(struct octep_hw *oct_hw, struct pci_dev *pdev) } mbox =octep_get_mbox (oct_hw);octep_mbox_init (mbox); -dev_info (dev,"mbox mapped at: 0x%016llx\n" , (u64 )(uintptr_t )mbox); +dev_info (dev,"mbox mapped at: %p\n" , mbox);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/214 virtio_console: fix misc probe bugs
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <[email protected]>
[ Upstream commit b9efbe2b8f0177fa97bfab290d60858900aa196b ]
This fixes the following issue discovered by code review:
after vqs have been created, a buggy device can send an interrupt.
A control vq callback will then try to schedule control_work which has not been initialized yet. Similarly for config interrupt. Further, in and out vq callbacks invoke find_port_by_vq which attempts to take ports_lock which also has not been initialized.
To fix, init all locks and work before creating vqs.
Message-ID: <ad982e975a6160ad110c623c016041311ca15b4f.1726511547.git.mst@redhat.com>
--- drivers/char/virtio_console.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
drivers/char/virtio_console.c +10 -8
@@ -2007,25 +2007,27 @@ static int virtcons_probe(struct virtio_device *vdev) multiport = true; } - err =init_vqs (portdev); -if (err <0 ) { -dev_err (&vdev->dev,"Error %d initializing vqs\n" , err); - goto free_chrdev; - } -spin_lock_init (&portdev->ports_lock);INIT_LIST_HEAD (&portdev->ports);INIT_LIST_HEAD (&portdev->list); -virtio_device_ready (portdev->vdev); -INIT_WORK (&portdev->config_work, &config_work_handler);INIT_WORK (&portdev->control_work, &control_work_handler);if (multiport) {spin_lock_init (&portdev->c_ivq_lock);spin_lock_init (&portdev->c_ovq_lock); + } + err =init_vqs (portdev); +if (err <0 ) { +dev_err (&vdev->dev,"Error %d initializing vqs\n" , err); + goto free_chrdev; + } + +virtio_device_ready (portdev->vdev); + +if (multiport) { err =fill_queue (portdev->c_ivq, &portdev->c_ivq_lock);if (err <0 ) { dev_err(&vdev->dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/214 perf vdso: Missed put on 32-bit dsos
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 424aafb61a0b98d7d242f447fdb84bb8b323e8a8 ]
If the dso type doesn't match then NULL is returned but the dso should be put first.
--- tools/perf/util/vdso.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/perf/util/vdso.c +3 -1
@@ -308,8 +308,10 @@ static struct dso *machine__find_vdso(struct machine *machine,if (!dso) { dso =dsos__find (&machine->dsos,DSO__NAME_VDSO , true); -if (dso && dso_type !=dso__type (dso, machine)) +if (dso && dso_type !=dso__type (dso, machine)) { +dso__put (dso); dso =NULL ; + } }break ;case DSO__TYPE_X32BIT :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/214 ntfs3: Change to non-blocking allocation in ntfs_d_hash
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Diogo Jahchan Koike <[email protected]>
[ Upstream commit 589996bf8c459deb5bbc9747d8f1c51658608103 ]
d_hash is done while under "rcu-walk" and should not sleep. __get_name() allocates using GFP_KERNEL, having the possibility to sleep when under memory pressure. Change the allocation to GFP_NOWAIT.
--- fs/ntfs3/namei.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ntfs3/namei.c +2 -2
@@ -395,7 +395,7 @@ static int ntfs_d_hash(const struct dentry *dentry, struct qstr *name)/* * Try slow way with current upcase table */ - uni =__getname (); + uni =kmem_cache_alloc (names_cachep,GFP_NOWAIT );if (!uni)return -ENOMEM ;
@@ -417,7 +417,7 @@ static int ntfs_d_hash(const struct dentry *dentry, struct qstr *name) err =0 ; out: -__putname (uni); +kmem_cache_free (names_cachep, uni);return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/214 perf build: Fix static compilation error when libdw is not installed
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Jihong <[email protected]>
[ Upstream commit 43f6564f18bf5b27e1675ef6f4baf68e786396b2 ]
If libdw is not installed in build environment, the output of 'pkg-config --modversion libdw' is empty, causing LIBDW_VERSION_2 to be empty and the shell test will have the following error:
/bin/sh: 1: test: -lt: unexpected operator
Before:
$ pkg-config --modversion libdw
Package libdw was not found in the pkg-config search path.
Perhaps you should add the directory containing `libdw.pc'
to the PKG_CONFIG_PATH environment variable
No package 'libdw' found
$ make LDFLAGS=-static -j16
BUILD: Doing 'make -j20' parallel build
<SNIP>
Package libdw was not found in the pkg-config search path.
Perhaps you should add the directory containing `libdw.pc'
to the PKG_CONFIG_PATH environment variable
No package 'libdw' found
/bin/sh: 1: test: -lt: unexpected operatorAfter:
1. libdw is not installed:
$ pkg-config --modversion libdw
Package libdw was not found in the pkg-config search path.
Perhaps you should add the directory containing `libdw.pc'
to the PKG_CONFIG_PATH environment variable
No package 'libdw' found
$ make LDFLAGS=-static -j16
BUILD: Doing 'make -j20' parallel build
<SNIP>
Package libdw was not found in the pkg-config search path.
Perhaps you should add the directory containing `libdw.pc'
to the PKG_CONFIG_PATH environment variable
No package 'libdw' found
Makefile.config:473: No libdw DWARF unwind found, Please install elfutils-devel/libdw-dev >= 0.158 and/or set LIBDW_DIR2. libdw version is lower than 0.177
$ pkg-config --modversion libdw
0.176
$ make LDFLAGS=-static -j16
BUILD: Doing 'make -j20' parallel build
<SNIP> Auto-detecting system features:
... dwarf: [ on ]
<SNIP>
INSTALL libsubcmd_headers
INSTALL libapi_headers
INSTALL libperf_headers
INSTALL libsymbol_headers
INSTALL libbpf_headers
LINK perf
3. libdw version is higher than 0.177
$ pkg-config --modversion libdw
0.186
$ make LDFLAGS=-static -j16
BUILD: Doing 'make -j20' parallel build
<SNIP> Auto-detecting system features:
... dwarf: [ on ]
<SNIP>
CC util/bpf-utils.o
CC util/pfm.o
LD util/perf-util-in.o
LD perf-util-in.o
AR libperf-util.a
LINK perf--- tools/build/feature/Makefile | 2 +- tools/perf/Makefile.config | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
tools/build/feature/Makefile +1 -1
@@ -172,7 +172,7 @@ DWARFLIBS := -ldw ifeq ($(findstring -static,${LDFLAGS}),-static) DWARFLIBS += -lelf -lz -llzma -lbz2 -lzstd - LIBDW_VERSION := $(shell $(PKG_CONFIG) --modversion libdw) + LIBDW_VERSION := $(shell $(PKG_CONFIG) --modversion libdw).0.0 LIBDW_VERSION_1 := $(word 1, $(subst ., ,$(LIBDW_VERSION))) LIBDW_VERSION_2 := $(word 2, $(subst ., ,$(LIBDW_VERSION)))
tools/perf/Makefile.config +1 -1
@@ -154,7 +154,7 @@ DWARFLIBS := -ldw ifeq ($(findstring -static,${LDFLAGS}),-static) DWARFLIBS += -lelf -ldl -lz -llzma -lbz2 -lzstd - LIBDW_VERSION := $(shell $(PKG_CONFIG) --modversion libdw) + LIBDW_VERSION := $(shell $(PKG_CONFIG) --modversion libdw).0.0 LIBDW_VERSION_1 := $(word 1, $(subst ., ,$(LIBDW_VERSION))) LIBDW_VERSION_2 := $(word 2, $(subst ., ,$(LIBDW_VERSION)))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/214 perf build: Fix build feature-dwarf_getlocations fail for old libdw
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Jihong <[email protected]>
[ Upstream commit a530337ba9ef601c93ec378fd941be43f587d563 ]
For libdw versions below 0.177, need to link libdl.a in addition to libbebl.a during static compilation, otherwise feature-dwarf_getlocations compilation will fail.
Before:
$ make LDFLAGS=-static
BUILD: Doing 'make -j20' parallel build
<SNIP>
Makefile.config:483: Old libdw.h, finding variables at given 'perf probe' point will not work, install elfutils-devel/libdw-dev >= 0.157
<SNIP>$ cat ../build/feature/test-dwarf_getlocations.make.output /usr/bin/ld: /usr/lib/gcc/x86_64-linux-gnu/9/../../../x86_64-linux-gnu/libebl.a(eblclosebackend.o): in function `ebl_closebackend': (.text+0x20): undefined reference to `dlclose' collect2: error: ld returned 1 exit status
After:
$ make LDFLAGS=-static
<SNIP>
Auto-detecting system features:
... dwarf: [ on ]
<SNIP> $ ./perf probe
Usage: perf probe [<options>] 'PROBEDEF' ['PROBEDEF' ...]
or: perf probe [<options>] --add 'PROBEDEF' [--add 'PROBEDEF' ...]
or: perf probe [<options>] --del '[GROUP:]EVENT' ...
or: perf probe --list [GROUP:]EVENT ...
<SNIP>--- tools/build/feature/Makefile | 3 +++ tools/perf/Makefile.config | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-)
tools/build/feature/Makefile +3 -0
@@ -181,6 +181,9 @@ ifeq ($(findstring -static,${LDFLAGS}),-static) ifeq ($(shell test $(LIBDW_VERSION_2) -lt 177; echo $$?),0) DWARFLIBS += -lebl endif + + # Must put -ldl after -lebl for dependency + DWARFLIBS += -ldl endif $(OUTPUT)test-dwarf.bin:
tools/perf/Makefile.config +4 -1
@@ -152,7 +152,7 @@ ifdef LIBDW_DIR endif DWARFLIBS := -ldw ifeq ($(findstring -static,${LDFLAGS}),-static) - DWARFLIBS += -lelf -ldl -lz -llzma -lbz2 -lzstd + DWARFLIBS += -lelf -lz -llzma -lbz2 -lzstd LIBDW_VERSION := $(shell $(PKG_CONFIG) --modversion libdw).0.0 LIBDW_VERSION_1 := $(word 1, $(subst ., ,$(LIBDW_VERSION)))
@@ -163,6 +163,9 @@ ifeq ($(findstring -static,${LDFLAGS}),-static) ifeq ($(shell test $(LIBDW_VERSION_2) -lt 177; echo $$?),0) DWARFLIBS += -lebl endif + + # Must put -ldl after -lebl for dependency + DWARFLIBS += -ldl endif FEATURE_CHECK_CFLAGS-libdw-dwarf-unwind := $(LIBDW_CFLAGS) FEATURE_CHECK_LDFLAGS-libdw-dwarf-unwind := $(LIBDW_LDFLAGS) $(DWARFLIBS)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/214 zram: free secondary algorithms names
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Senozhatsky <[email protected]>
[ Upstream commit 684826f8271ad97580b138b9ffd462005e470b99 ]
We need to kfree() secondary algorithms names when reset zram device that had multi-streams, otherwise we leak memory.
--- drivers/block/zram/zram_drv.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/block/zram/zram_drv.c +5 -0
@@ -1989,6 +1989,11 @@ static void zram_destroy_comps(struct zram *zram)zcomp_destroy (comp); zram->num_active_comps--; } + +for (prio =ZRAM_SECONDARY_COMP ; prio <ZRAM_MAX_COMPS ; prio++) { +kfree (zram->comp_algs[prio]); + zram->comp_algs[prio] =NULL ; + } }static void zram_reset_device (struct zram *zram)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/214 zram: dont free statically defined names
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Skvortsov <[email protected]>
[ Upstream commit 486fd58af7ac1098b68370b1d4d9f94a2a1c7124 ]
When CONFIG_ZRAM_MULTI_COMP isn't set ZRAM_SECONDARY_COMP can hold default_compressor, because it's the same offset as ZRAM_PRIMARY_COMP, so we need to make sure that we don't attempt to kfree() the statically defined compressor name.
This is detected by KASAN.
==================================================================
Call trace: kfree+0x60/0x3a0 zram_destroy_comps+0x98/0x198 [zram] zram_reset_device+0x22c/0x4a8 [zram] reset_store+0x1bc/0x2d8 [zram] dev_attr_store+0x44/0x80 sysfs_kf_write+0xfc/0x188 kernfs_fop_write_iter+0x28c/0x428 vfs_write+0x4dc/0x9b8 ksys_write+0x100/0x1f8 __arm64_sys_write+0x74/0xb8 invoke_syscall+0xd8/0x260 el0_svc_common.constprop.0+0xb4/0x240 do_el0_svc+0x48/0x68 el0_svc+0x40/0xc8 el0t_64_sync_handler+0x120/0x130 el0t_64_sync+0x190/0x198 ==================================================================
--- drivers/block/zram/zram_drv.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/block/zram/zram_drv.c +4 -2
@@ -1990,8 +1990,10 @@ static void zram_destroy_comps(struct zram *zram) zram->num_active_comps--; } -for (prio =ZRAM_SECONDARY_COMP ; prio <ZRAM_MAX_COMPS ; prio++) { -kfree (zram->comp_algs[prio]); +for (prio =ZRAM_PRIMARY_COMP ; prio <ZRAM_MAX_COMPS ; prio++) { +/* Do not free statically defined compression algorithms */ +if (zram->comp_algs[prio] != default_compressor) +kfree (zram->comp_algs[prio]); zram->comp_algs[prio] =NULL ; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/214 bpf: Call the missed btf_record_free() when map creation fails
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Tao <[email protected]>
[ Upstream commit 87e9675a0dfd0bf4a36550e4a0e673038ec67aee ]
When security_bpf_map_create() in map_create() fails, map_create() will call btf_put() and ->map_free() callback to free the map. It doesn't free the btf_record of map value, so add the missed btf_record_free() when map creation fails.
However btf_record_free() needs to be called after ->map_free() just like bpf_map_free_deferred() did, because ->map_free() may use the btf_record to free the special fields in preallocated map value. So factor out bpf_map_free() helper to free the map, btf_record, and btf orderly and use the helper in both map_create() and bpf_map_free_deferred().
--- kernel/bpf/syscall.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
kernel/bpf/syscall.c +12 -7
@@ -733,15 +733,11 @@ void bpf_obj_free_fields(const struct btf_record *rec, void *obj) } } -/* called from workqueue */ -static void bpf_map_free_deferred (struct work_struct *work) +static void bpf_map_free (struct bpf_map *map) { - struct bpf_map *map = container_of(work, struct bpf_map, work);struct btf_record *rec = map->record;struct btf *btf = map->btf; -security_bpf_map_free (map); -bpf_map_release_memcg (map);/* implementation dependent freeing */ map->ops->map_free (map);/* Delay freeing of btf_record for maps, as map_free
@@ -760,6 +756,16 @@ static void bpf_map_free_deferred(struct work_struct *work)btf_put (btf); } +/* called from workqueue */ +static void bpf_map_free_deferred (struct work_struct *work) +{ + struct bpf_map *map = container_of(work, struct bpf_map, work); + +security_bpf_map_free (map); +bpf_map_release_memcg (map); +bpf_map_free (map); +} +static void bpf_map_put_uref (struct bpf_map *map) {if (atomic64_dec_and_test (&map->usercnt)) {
@@ -1411,8 +1417,7 @@ static int map_create(union bpf_attr *attr) free_map_sec:security_bpf_map_free (map); free_map: -btf_put (map->btf); - map->ops->map_free (map); +bpf_map_free (map); put_token:bpf_token_put (token);return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/214 selftests/bpf: Fix ARG_PTR_TO_LONG {half-,}uninitialized test
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit b8e188f023e07a733b47d5865311ade51878fe40 ]
The assumption of 'in privileged mode reads from uninitialized stack locations are permitted' is not quite correct since the verifier was probing for read access rather than write access. Both tests need to be annotated as __success for privileged and unprivileged.
--- tools/testing/selftests/bpf/progs/verifier_int_ptr.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
tools/testing/selftests/bpf/progs/verifier_int_ptr.c +1 -4
@@ -8,7 +8,6 @@ SEC("socket") __description("ARG_PTR_TO_LONG uninitialized") __success -__failure_unpriv __msg_unpriv("invalid indirect read from stack R4 off -16+0 size 8")__naked void arg_ptr_to_long_uninitialized (void ) { asm volatile (" \
@@ -36,9 +35,7 @@ __naked void arg_ptr_to_long_uninitialized(void) SEC("socket") __description("ARG_PTR_TO_LONG half-uninitialized") -/* in privileged mode reads from uninitialized stack locations are permitted */ -__success __failure_unpriv -__msg_unpriv("invalid indirect read from stack R4 off -16+4 size 8") +__success __retval(0) __naked void ptr_to_long_half_uninitialized(void) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/214 bpf: Check percpu map value size first
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Chen <[email protected]>
[ Upstream commit 1d244784be6b01162b732a5a7d637dfc024c3203 ]
Percpu map is often used, but the map value size limit often ignored, like issue: https://github.com/iovisor/bcc/issues/2519. Actually, percpu map value size is bound by PCPU_MIN_UNIT_SIZE, so we can check the value size whether it exceeds PCPU_MIN_UNIT_SIZE first, like percpu map of local_storage. Maybe the error message seems clearer compared with "cannot allocate memory".
--- kernel/bpf/arraymap.c | 3 +++ kernel/bpf/hashtab.c | 3 +++ 2 files changed, 6 insertions(+)
kernel/bpf/arraymap.c +3 -0
@@ -73,6 +73,9 @@ int array_map_alloc_check(union bpf_attr *attr)/* avoid overflow on round_up(map->value_size) */ if (attr->value_size >INT_MAX )return -E2BIG ; +/* percpu map value size is bound by PCPU_MIN_UNIT_SIZE */ +if (percpu &&round_up (attr->value_size,8 ) >PCPU_MIN_UNIT_SIZE ) +return -E2BIG ;return 0 ; }
kernel/bpf/hashtab.c +3 -0
@@ -462,6 +462,9 @@ static int htab_map_alloc_check(union bpf_attr *attr)* kmalloc-able later in htab_map_update_elem() */ return -E2BIG ; +/* percpu map value size is bound by PCPU_MIN_UNIT_SIZE */ +if (percpu &&round_up (attr->value_size,8 ) >PCPU_MIN_UNIT_SIZE ) +return -E2BIG ;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/214 s390/boot: Compile all files with the same march flag
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit fccb175bc89a0d37e3ff513bb6bf1f73b3a48950 ]
Only a couple of files of the decompressor are compiled with the minimum architecture level. This is problematic for potential function calls between compile units, especially if a target function is within a compile until compiled for a higher architecture level, since that may lead to an unexpected operation exception.
Therefore compile all files of the decompressor for the same (minimum) architecture level.
--- arch/s390/boot/Makefile | 19 +++++-------------- 1 file changed, 5 insertions(+), 14 deletions(-)
arch/s390/boot/Makefile +5 -14
@@ -11,11 +11,8 @@ KASAN_SANITIZE := n KCSAN_SANITIZE := n KMSAN_SANITIZE := n -KBUILD_AFLAGS := $(KBUILD_AFLAGS_DECOMPRESSOR) -KBUILD_CFLAGS := $(KBUILD_CFLAGS_DECOMPRESSOR) - # -# Use minimum architecture for als.c to be able to print an error +# Use minimum architecture level so it is possible to print an error # message if the kernel is started on a machine which is too old # ifndef CONFIG_CC_IS_CLANG
@@ -24,16 +21,10 @@ else CC_FLAGS_MARCH_MINIMUM := -march=z10 endif -ifneq ($(CC_FLAGS_MARCH),$(CC_FLAGS_MARCH_MINIMUM)) -AFLAGS_REMOVE_head.o += $(CC_FLAGS_MARCH) -AFLAGS_head.o += $(CC_FLAGS_MARCH_MINIMUM) -AFLAGS_REMOVE_mem.o += $(CC_FLAGS_MARCH) -AFLAGS_mem.o += $(CC_FLAGS_MARCH_MINIMUM) -CFLAGS_REMOVE_als.o += $(CC_FLAGS_MARCH) -CFLAGS_als.o += $(CC_FLAGS_MARCH_MINIMUM) -CFLAGS_REMOVE_sclp_early_core.o += $(CC_FLAGS_MARCH) -CFLAGS_sclp_early_core.o += $(CC_FLAGS_MARCH_MINIMUM) -endif +KBUILD_AFLAGS := $(filter-out $(CC_FLAGS_MARCH),$(KBUILD_AFLAGS_DECOMPRESSOR)) +KBUILD_CFLAGS := $(filter-out $(CC_FLAGS_MARCH),$(KBUILD_CFLAGS_DECOMPRESSOR)) +KBUILD_AFLAGS += $(CC_FLAGS_MARCH_MINIMUM) +KBUILD_CFLAGS += $(CC_FLAGS_MARCH_MINIMUM) CFLAGS_sclp_early_core.o += -I$(srctree)/drivers/s390/char
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/214 s390/facility: Disable compile time optimization for decompressor code
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit 0147addc4fb72a39448b8873d8acdf3a0f29aa65 ]
Disable compile time optimizations of test_facility() for the decompressor. The decompressor should not contain any optimized code depending on the architecture level set the kernel image is compiled for to avoid unexpected operation exceptions.
Add a __DECOMPRESSOR check to test_facility() to enforce that facilities are always checked during runtime for the decompressor.
--- arch/s390/include/asm/facility.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/s390/include/asm/facility.h +4 -2
@@ -59,8 +59,10 @@ static inline int test_facility(unsigned long nr)unsigned long facilities_als[] = {FACILITIES_ALS };if (__builtin_constant_p (nr) && nr <sizeof (facilities_als) *8 ) { -if (__test_facility (nr, &facilities_als)) -return 1 ; +if (__test_facility (nr, &facilities_als)) { +if (!__is_defined (__DECOMPRESSOR)) +return 1 ; + } }return __test_facility (nr, &stfle_fac_list); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/214 s390/mm: Add cond_resched() to cmm_alloc/free_pages()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerald Schaefer <[email protected]>
[ Upstream commit 131b8db78558120f58c5dc745ea9655f6b854162 ]
Adding/removing large amount of pages at once to/from the CMM balloon can result in rcu_sched stalls or workqueue lockups, because of busy looping w/o cond_resched().
Prevent this by adding a cond_resched(). cmm_free_pages() holds a spin_lock while looping, so it cannot be added directly to the existing loop. Instead, introduce a wrapper function that operates on maximum 256 pages at once, and add it there.
--- arch/s390/mm/cmm.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
arch/s390/mm/cmm.c +17 -1
@@ -95,11 +95,12 @@ static long cmm_alloc_pages(long nr, long *counter, (*counter)++;spin_unlock (&cmm_lock); nr--; +cond_resched (); }return nr; } -static long cmm_free_pages (long nr,long *counter,struct cmm_page_array **list) +static long __cmm_free_pages (long nr,long *counter,struct cmm_page_array **list) {struct cmm_page_array *pa;unsigned long addr;
@@ -123,6 +124,21 @@ static long cmm_free_pages(long nr, long *counter, struct cmm_page_array **list)return nr; } +static long cmm_free_pages (long nr,long *counter,struct cmm_page_array **list) +{ +long inc =0 ; + +while (nr) { + inc =min (256L , nr); + nr -= inc; + inc =__cmm_free_pages (inc, counter, list); +if (inc) +break ; +cond_resched (); + } +return nr + inc; +} +static int cmm_oom_notify (struct notifier_block *self,unsigned long dummy,void *parm) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/214 bpf, x64: Fix a jit convergence issue
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <[email protected]>
[ Upstream commit c8831bdbfbab672c006a18006d36932a494b2fd6 ]
Daniel Hodges reported a jit error when playing with a sched-ext program. The error message is:
unexpected jmp_cond padding: -4 bytes
But further investigation shows the error is actual due to failed convergence. The following are some analysis:
...
pass4, final_proglen=4391:
...
20e: 48 85 ff test rdi,rdi
211: 74 7d je 0x290
213: 48 8b 77 00 mov rsi,QWORD PTR [rdi+0x0]
...
289: 48 85 ff test rdi,rdi
28c: 74 17 je 0x2a5
28e: e9 7f ff ff ff jmp 0x212
293: bf 03 00 00 00 mov edi,0x3Note that insn at 0x211 is 2-byte cond jump insn for offset 0x7d (-125) and insn at 0x28e is 5-byte jmp insn with offset -129.
pass5, final_proglen=4392:
...
20e: 48 85 ff test rdi,rdi
211: 0f 84 80 00 00 00 je 0x297
217: 48 8b 77 00 mov rsi,QWORD PTR [rdi+0x0]
...
28d: 48 85 ff test rdi,rdi
290: 74 1a je 0x2ac
292: eb 84 jmp 0x218
294: bf 03 00 00 00 mov edi,0x3Note that insn at 0x211 is 6-byte cond jump insn now since its offset becomes 0x80 based on previous round (0x293 - 0x213 = 0x80). At the same time, insn at 0x292 is a 2-byte insn since its offset is -124.
pass6 will repeat the same code as in pass4. pass7 will repeat the same code as in pass5, and so on. This will prevent eventual convergence.
Passes 1-14 are with padding = 0. At pass15, padding is 1 and related insn looks like:
211: 0f 84 80 00 00 00 je 0x297
217: 48 8b 77 00 mov rsi,QWORD PTR [rdi+0x0] ...
24d: 48 85 d2 test rdx,rdx
The similar code in pass14:
211: 74 7d je 0x290
213: 48 8b 77 00 mov rsi,QWORD PTR [rdi+0x0]
...
249: 48 85 d2 test rdx,rdx
24c: 74 21 je 0x26f
24e: 48 01 f7 add rdi,rsi
...Before generating the following insn,
250: 74 21 je 0x273
"padding = 1" enables some checking to ensure nops is either 0 or 4 where
#define INSN_SZ_DIFF (((addrs[i] - addrs[i - 1]) - (prog - temp))) nops = INSN_SZ_DIFF - 2
In this specific case,
addrs[i] = 0x24e // from pass14 addrs[i-1] = 0x24d // from pass15
prog - temp = 3 // from 'test rdx,rdx' in pass15
so
nops = -4
and this triggers the failure.
To fix the issue, we need to break cycles of je <-> jmp. For example, in the above case, we have
211: 74 7d je 0x290
the offset is 0x7d. If 2-byte je insn is generated only if the offset is less than 0x7d (<= 0x7c), the cycle can be break and we can achieve the convergence.
I did some study on other cases like je <-> je, jmp <-> je and jmp <-> jmp which may cause cycles. Those cases are not from actual reproducible cases since it is pretty hard to construct a test case for them. the results show that the offset <= 0x7b (0x7b = 123) should be enough to cover all cases. This patch added a new helper to generate 8-bit cond/uncond jmp insns only if the offset range is [-128, 123].
--- arch/x86/net/bpf_jit_comp.c | 54 +++++++++++++++++++++++++++++++++++-- 1 file changed, 52 insertions(+), 2 deletions(-)
arch/x86/net/bpf_jit_comp.c +52 -2
@@ -64,6 +64,56 @@ static bool is_imm8(int value)return value <=127 && value >=-128 ; } +/* +* Let us limit the positive offset to be <= 123. +* This is to ensure eventual jit convergence For the following patterns: +* ... +* pass4, final_proglen=4391: +* ... +* 20e: 48 85 ff test rdi,rdi +* 211: 74 7d je 0x290 +* 213: 48 8b 77 00 mov rsi,QWORD PTR [rdi+0x0] +* ... +* 289: 48 85 ff test rdi,rdi +* 28c: 74 17 je 0x2a5 +* 28e: e9 7f ff ff ff jmp 0x212 +* 293: bf 03 00 00 00 mov edi,0x3 +* Note that insn at 0x211 is 2-byte cond jump insn for offset 0x7d (-125) +* and insn at 0x28e is 5-byte jmp insn with offset -129. +* +* pass5, final_proglen=4392: +* ... +* 20e: 48 85 ff test rdi,rdi +* 211: 0f 84 80 00 00 00 je 0x297 +* 217: 48 8b 77 00 mov rsi,QWORD PTR [rdi+0x0] +* ... +* 28d: 48 85 ff test rdi,rdi +* 290: 74 1a je 0x2ac +* 292: eb 84 jmp 0x218 +* 294: bf 03 00 00 00 mov edi,0x3 +* Note that insn at 0x211 is 6-byte cond jump insn now since its offset +* becomes 0x80 based on previous round (0x293 - 0x213 = 0x80). +* At the same time, insn at 0x292 is a 2-byte insn since its offset is +* -124. +* +* pass6 will repeat the same code as in pass4 and this will prevent +* eventual convergence. +* +* To fix this issue, we need to break je (2->6 bytes) <-> jmp (5->2 bytes) +* cycle in the above. In the above example je offset <= 0x7c should work. +* +* For other cases, je <-> je needs offset <= 0x7b to avoid no convergence +* issue. For jmp <-> je and jmp <-> jmp cases, jmp offset <= 0x7c should +* avoid no convergence issue. +* +* Overall, let us limit the positive offset for 8bit cond/uncond jmp insn +* to maximum 123 (0x7b). This way, the jit pass can eventually converge. +*/ +static bool is_imm8_jmp_offset (int value) +{ +return value <=123 && value >=-128 ; +} +static bool is_simm32 (s64 value) {return value == (s64 )(s32 )value;
@@ -2231,7 +2281,7 @@ st: if (is_imm8(insn->off))return -EFAULT ; } jmp_offset = addrs[i + insn->off] - addrs[i]; -if (is_imm8 (jmp_offset)) { +if (is_imm8_jmp_offset (jmp_offset)) {if (jmp_padding) {/* To keep the jmp_offset valid, the extra bytes are * padded before the jump insn, so we subtract the
@@ -2313,7 +2363,7 @@ st: if (is_imm8(insn->off))break ; } emit_jmp: -if (is_imm8 (jmp_offset)) { +if (is_imm8_jmp_offset (jmp_offset)) {if (jmp_padding) {/* To avoid breaking jmp_offset, the extra bytes * are padded before the actual jmp insn, so
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/214 ext4: dont set SB_RDONLY after filesystem errors
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit d3476f3dad4ad68ae5f6b008ea6591d1520da5d8 ]
When the filesystem is mounted with errors=remount-ro, we were setting SB_RDONLY flag to stop all filesystem modifications. We knew this misses proper locking (sb->s_umount) and does not go through proper filesystem remount procedure but it has been the way this worked since early ext2 days and it was good enough for catastrophic situation damage mitigation. Recently, syzbot has found a way (see link) to trigger warnings in filesystem freezing because the code got confused by SB_RDONLY changing under its hands. Since these days we set EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all filesystem modifications, modifying SB_RDONLY shouldn't be needed. So stop doing that.
--- fs/ext4/super.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
fs/ext4/super.c +5 -4
@@ -735,11 +735,12 @@ static void ext4_handle_error(struct super_block *sb, bool force_ro, int error,ext4_msg (sb,KERN_CRIT ,"Remounting filesystem read-only" );/* -* Make sure updated value of ->s_mount_flags will be visible before -* ->s_flags update +* EXT4_FLAGS_SHUTDOWN was set which stops all filesystem +* modifications. We don't set SB_RDONLY because that requires +* sb->s_umount semaphore and setting it without proper remount +* procedure is confusing code such as freeze_super() leading to +* deadlocks and other problems. */ -smp_wmb (); - sb->s_flags |=SB_RDONLY ; }static void update_super_work (struct work_struct *work)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/214 ext4: nested locking for xattr inode
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wojciech Gładysz <[email protected]>
[ Upstream commit d1bc560e9a9c78d0b2314692847fc8661e0aeb99 ]
Add nested locking with I_MUTEX_XATTR subclass to avoid lockdep warning while handling xattr inode on file open syscall at ext4_xattr_inode_iget.
Backtrace
EXT4-fs (loop0): Ignoring removed oldalloc option
======================================================
WARNING: possible circular locking dependency detected
5.10.0-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor543/2794 is trying to acquire lock:ffff8880215e1a48 (&ea_inode->i_rwsem#7/1){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:782 [inline] ffff8880215e1a48 (&ea_inode->i_rwsem#7/1){+.+.}-{3:3}, at: ext4_xattr_inode_iget+0x42a/0x5c0 fs/ext4/xattr.c:425
but task is already holding lock:ffff8880215e3278 (&ei->i_data_sem/3){++++}-{3:3}, at: ext4_setattr+0x136d/0x19c0 fs/ext4/inode.c:5559
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&ei->i_data_sem/3){++++}-{3:3}:
lock_acquire+0x197/0x480 kernel/locking/lockdep.c:5566
down_write+0x93/0x180 kernel/locking/rwsem.c:1564
ext4_update_i_disksize fs/ext4/ext4.h:3267 [inline]
ext4_xattr_inode_write fs/ext4/xattr.c:1390 [inline]
ext4_xattr_inode_lookup_create fs/ext4/xattr.c:1538 [inline]
ext4_xattr_set_entry+0x331a/0x3d80 fs/ext4/xattr.c:1662
ext4_xattr_ibody_set+0x124/0x390 fs/ext4/xattr.c:2228
ext4_xattr_set_handle+0xc27/0x14e0 fs/ext4/xattr.c:2385
ext4_xattr_set+0x219/0x390 fs/ext4/xattr.c:2498
ext4_xattr_user_set+0xc9/0xf0 fs/ext4/xattr_user.c:40
__vfs_setxattr+0x404/0x450 fs/xattr.c:177
__vfs_setxattr_noperm+0x11d/0x4f0 fs/xattr.c:208
__vfs_setxattr_locked+0x1f9/0x210 fs/xattr.c:266
vfs_setxattr+0x112/0x2c0 fs/xattr.c:283
setxattr+0x1db/0x3e0 fs/xattr.c:548
path_setxattr+0x15a/0x240 fs/xattr.c:567
__do_sys_setxattr fs/xattr.c:582 [inline]
__se_sys_setxattr fs/xattr.c:578 [inline]
__x64_sys_setxattr+0xc5/0xe0 fs/xattr.c:578
do_syscall_64+0x6d/0xa0 arch/x86/entry/common.c:62
entry_SYSCALL_64_after_hwframe+0x61/0xcb-> #0 (&ea_inode->i_rwsem#7/1){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:2988 [inline]
check_prevs_add kernel/locking/lockdep.c:3113 [inline]
validate_chain+0x1695/0x58f0 kernel/locking/lockdep.c:3729
__lock_acquire+0x12fd/0x20d0 kernel/locking/lockdep.c:4955
lock_acquire+0x197/0x480 kernel/locking/lockdep.c:5566
down_write+0x93/0x180 kernel/locking/rwsem.c:1564
inode_lock include/linux/fs.h:782 [inline]
ext4_xattr_inode_iget+0x42a/0x5c0 fs/ext4/xattr.c:425
ext4_xattr_inode_get+0x138/0x410 fs/ext4/xattr.c:485
ext4_xattr_move_to_block fs/ext4/xattr.c:2580 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2682 [inline]
ext4_expand_extra_isize_ea+0xe70/0x1bb0 fs/ext4/xattr.c:2774
__ext4_expand_extra_isize+0x304/0x3f0 fs/ext4/inode.c:5898
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5941 [inline]
__ext4_mark_inode_dirty+0x591/0x810 fs/ext4/inode.c:6018
ext4_setattr+0x1400/0x19c0 fs/ext4/inode.c:5562
notify_change+0xbb6/0xe60 fs/attr.c:435
do_truncate+0x1de/0x2c0 fs/open.c:64
handle_truncate fs/namei.c:2970 [inline]
do_open fs/namei.c:3311 [inline]
path_openat+0x29f3/0x3290 fs/namei.c:3425
do_filp_open+0x20b/0x450 fs/namei.c:3452
do_sys_openat2+0x124/0x460 fs/open.c:1207
do_sys_open fs/open.c:1223 [inline]
__do_sys_open fs/open.c:1231 [inline]
__se_sys_open fs/open.c:1227 [inline]
__x64_sys_open+0x221/0x270 fs/open.c:1227
do_syscall_64+0x6d/0xa0 arch/x86/entry/common.c:62
entry_SYSCALL_64_after_hwframe+0x61/0xcbother info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ei->i_data_sem/3);
lock(&ea_inode->i_rwsem#7/1);
lock(&ei->i_data_sem/3); lock(&ea_inode->i_rwsem#7/1);
*** DEADLOCK ***
5 locks held by syz-executor543/2794:
#0: ffff888026fbc448 (sb_writers#4){.+.+}-{0:0}, at: mnt_want_write+0x4a/0x2a0 fs/namespace.c:365 #1: ffff8880215e3488 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:782 [inline] #1: ffff8880215e3488 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: do_truncate+0x1cf/0x2c0 fs/open.c:62 #2: ffff8880215e3310 (&ei->i_mmap_sem){++++}-{3:3}, at: ext4_setattr+0xec4/0x19c0 fs/ext4/inode.c:5519 #3: ffff8880215e3278 (&ei->i_data_sem/3){++++}-{3:3}, at: ext4_setattr+0x136d/0x19c0 fs/ext4/inode.c:5559 #4: ffff8880215e30c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_trylock_xattr fs/ext4/xattr.h:162 [inline] #4: ffff8880215e30c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:5938 [inline] #4: ffff8880215e30c8 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x4fb/0x810 fs/ext4/inode.c:6018
stack backtrace: CPU: 1 PID: 2794 Comm: syz-executor543 Not tainted 5.10.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x177/0x211 lib/dump_stack.c:118 print_circular_bug+0x146/0x1b0 kernel/locking/lockdep.c:2002 check_noncircular+0x2cc/0x390 kernel/locking/lockdep.c:2123 check_prev_add kernel/locking/lockdep.c:2988 [inline] check_prevs_add kernel/locking/lockdep.c:3113 [inline] validate_chain+0x1695/0x58f0 kernel/locking/lockdep.c:3729 __lock_acquire+0x12fd/0x20d0 kernel/locking/lockdep.c:4955 lock_acquire+0x197/0x480 kernel/locking/lockdep.c:5566 down_write+0x93/0x180 kernel/locking/rwsem.c:1564 inode_lock include/linux/fs.h:782 [inline] ext4_xattr_inode_iget+0x42a/0x5c0 fs/ext4/xattr.c:425 ext4_xattr_inode_get+0x138/0x410 fs/ext4/xattr.c:485 ext4_xattr_move_to_block fs/ext4/xattr.c:2580 [inline] ext4_xattr_make_inode_space fs/ext4/xattr.c:2682 [inline] ext4_expand_extra_isize_ea+0xe70/0x1bb0 fs/ext4/xattr.c:2774 __ext4_expand_extra_isize+0x304/0x3f0 fs/ext4/inode.c:5898 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5941 [inline] __ext4_mark_inode_dirty+0x591/0x810 fs/ext4/inode.c:6018 ext4_setattr+0x1400/0x19c0 fs/ext4/inode.c:5562 notify_change+0xbb6/0xe60 fs/attr.c:435 do_truncate+0x1de/0x2c0 fs/open.c:64 handle_truncate fs/namei.c:2970 [inline] do_open fs/namei.c:3311 [inline] path_openat+0x29f3/0x3290 fs/namei.c:3425 do_filp_open+0x20b/0x450 fs/namei.c:3452 do_sys_openat2+0x124/0x460 fs/open.c:1207 do_sys_open fs/open.c:1223 [inline] __do_sys_open fs/open.c:1231 [inline] __se_sys_open fs/open.c:1227 [inline] __x64_sys_open+0x221/0x270 fs/open.c:1227 do_syscall_64+0x6d/0xa0 arch/x86/entry/common.c:62 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f0cde4ea229 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd81d1c978 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 0030656c69662f30 RCX: 00007f0cde4ea229 RDX: 0000000000000089 RSI: 00000000000a0a00 RDI: 00000000200001c0 RBP: 2f30656c69662f2e R08: 0000000000208000 R09: 0000000000208000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd81d1c9c0 R13: 00007ffd81d1ca00 R14: 0000000000080000 R15: 0000000000000003
EXT4-fs error (device loop0): ext4_expand_extra_isize_ea:2730: inode #13: comm syz-executor543: corrupted in-inode xattr
--- fs/ext4/xattr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ext4/xattr.c +2 -2
@@ -458,7 +458,7 @@ static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_ino,ext4_set_inode_state (inode,EXT4_STATE_LUSTRE_EA_INODE );ext4_xattr_inode_set_ref (inode,1 ); }else { -inode_lock (inode); +inode_lock_nested (inode,I_MUTEX_XATTR ); inode->i_flags |=S_NOQUOTA ;inode_unlock (inode); }
@@ -1039,7 +1039,7 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode,s64 ref_count;int ret; -inode_lock (ea_inode); +inode_lock_nested (ea_inode,I_MUTEX_XATTR ); ret =ext4_reserve_inode_write (handle, ea_inode, &iloc);if (ret)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/214 s390/cpum_sf: Remove WARN_ON_ONCE statements
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richter <[email protected]>
[ Upstream commit b495e710157606889f2d8bdc62aebf2aa02f67a7 ]
Remove WARN_ON_ONCE statements. These have not triggered in the past.
--- arch/s390/kernel/perf_cpum_sf.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
arch/s390/kernel/perf_cpum_sf.c +4 -8
@@ -1463,7 +1463,7 @@ static int aux_output_begin(struct perf_output_handle *handle,unsigned long range, i, range_scan, idx, head, base, offset;struct hws_trailer_entry *te; -if (WARN_ON_ONCE (handle->head & ~PAGE_MASK )) +if (handle->head & ~PAGE_MASK )return -EINVAL ; aux->head = handle->head >>PAGE_SHIFT ;
@@ -1642,7 +1642,7 @@ static void hw_collect_aux(struct cpu_hw_sf *cpuhw)unsigned long num_sdb; aux =perf_get_aux (handle); -if (WARN_ON_ONCE (!aux)) +if (!aux)return ;/* Inform user space new data arrived */
@@ -1661,7 +1661,7 @@ static void hw_collect_aux(struct cpu_hw_sf *cpuhw) num_sdb);break ; } -if (WARN_ON_ONCE (!aux)) +if (!aux)return ;/* Update head and alert_mark to new position */
@@ -1896,12 +1896,8 @@ static void cpumsf_pmu_start(struct perf_event *event, int flags) {struct cpu_hw_sf *cpuhw =this_cpu_ptr (&cpu_hw_sf); -if (WARN_ON_ONCE (!(event->hw.state &PERF_HES_STOPPED ))) +if (!(event->hw.state &PERF_HES_STOPPED ))return ; - -if (flags &PERF_EF_RELOAD ) -WARN_ON_ONCE (!(event->hw.state &PERF_HES_UPTODATE )); -perf_pmu_disable (event->pmu); event->hw.state =0 ; cpuhw->lsctl.cs =1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/214 s390/traps: Handle early warnings gracefully
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit 3c4d0ae0671827f4b536cc2d26f8b9c54584ccc5 ]
Add missing warning handling to the early program check handler. This way a warning is printed to the console as soon as the early console is setup, and the kernel continues to boot.
Before this change a disabled wait psw was loaded instead and the machine was silently stopped without giving an idea about what happened.
--- arch/s390/kernel/early.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
arch/s390/kernel/early.c +15 -2
@@ -177,8 +177,21 @@ static __init void setup_topology(void)void __do_early_pgm_check (struct pt_regs *regs) { -if (!fixup_exception (regs)) -disabled_wait (); +struct lowcore *lc =get_lowcore (); +unsigned long ip; + + regs->int_code = lc->pgm_int_code; + regs->int_parm_long = lc->trans_exc_code; + ip =__rewind_psw (regs->psw, regs->int_code >>16 ); + +/* Monitor Event? Might be a warning */ +if ((regs->int_code &PGM_INT_CODE_MASK ) ==0x40 ) { +if (report_bug (ip, regs) ==BUG_TRAP_TYPE_WARN ) +return ; + } +if (fixup_exception (regs)) +return ; +disabled_wait (); } static noinline __init void setup_lowcore_early(void)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/214 bpf: Prevent tail call between progs attached to different hooks
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Kuohai <[email protected]>
[ Upstream commit 28ead3eaabc16ecc907cfb71876da028080f6356 ]
bpf progs can be attached to kernel functions, and the attached functions can take different parameters or return different return values. If prog attached to one kernel function tail calls prog attached to another kernel function, the ctx access or return value verification could be bypassed.
For example, if prog1 is attached to func1 which takes only 1 parameter and prog2 is attached to func2 which takes two parameters. Since verifier assumes the bpf ctx passed to prog2 is constructed based on func2's prototype, verifier allows prog2 to access the second parameter from the bpf ctx passed to it. The problem is that verifier does not prevent prog1 from passing its bpf ctx to prog2 via tail call. In this case, the bpf ctx passed to prog2 is constructed from func1 instead of func2, that is, the assumption for ctx access verification is bypassed.
Another example, if BPF LSM prog1 is attached to hook file_alloc_security, and BPF LSM prog2 is attached to hook bpf_lsm_audit_rule_known. Verifier knows the return value rules for these two hooks, e.g. it is legal for bpf_lsm_audit_rule_known to return positive number 1, and it is illegal for file_alloc_security to return positive number. So verifier allows prog2 to return positive number 1, but does not allow prog1 to return positive number. The problem is that verifier does not prevent prog1 from calling prog2 via tail call. In this case, prog2's return value 1 will be used as the return value for prog1's hook file_alloc_security. That is, the return value rule is bypassed.
This patch adds restriction for tail call to prevent such bypasses.
--- include/linux/bpf.h | 1 + kernel/bpf/core.c | 21 ++++++++++++++++++--- 2 files changed, 19 insertions(+), 3 deletions(-)
include/linux/bpf.h +1 -0
@@ -294,6 +294,7 @@ struct bpf_map {* same prog type, JITed flag and xdp_has_frags flag. */ struct { +const struct btf_type *attach_func_proto;spinlock_t lock;enum bpf_prog_type type;bool jited;
kernel/bpf/core.c +18 -3
@@ -2302,6 +2302,7 @@ bool bpf_prog_map_compatible(struct bpf_map *map, {enum bpf_prog_type prog_type =resolve_prog_type (fp);bool ret; +struct bpf_prog_aux *aux = fp->aux;if (fp->kprobe_override)return false;
@@ -2311,7 +2312,7 @@ bool bpf_prog_map_compatible(struct bpf_map *map,* in the case of devmap and cpumap). Until device checks * are implemented, prohibit adding dev-bound programs to program maps. */ -if (bpf_prog_is_dev_bound (fp->aux)) +if (bpf_prog_is_dev_bound (aux))return false;spin_lock (&map->owner.lock);
@@ -2321,12 +2322,26 @@ bool bpf_prog_map_compatible(struct bpf_map *map,*/ map->owner.type = prog_type; map->owner.jited = fp->jited; - map->owner.xdp_has_frags = fp->aux->xdp_has_frags; + map->owner.xdp_has_frags = aux->xdp_has_frags; + map->owner.attach_func_proto = aux->attach_func_proto; ret = true; }else { ret = map->owner.type == prog_type && map->owner.jited == fp->jited && - map->owner.xdp_has_frags == fp->aux->xdp_has_frags; + map->owner.xdp_has_frags == aux->xdp_has_frags; +if (ret && + map->owner.attach_func_proto != aux->attach_func_proto) { +switch (prog_type) { +case BPF_PROG_TYPE_TRACING : +case BPF_PROG_TYPE_LSM : +case BPF_PROG_TYPE_EXT : +case BPF_PROG_TYPE_STRUCT_OPS : + ret = false; +break ; +default : +break ; + } + } }spin_unlock (&map->owner.lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/214 ktest.pl: Avoid false positives with grub2 skip regex
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Jordan <[email protected]>
[ Upstream commit 2351e8c65404aabc433300b6bf90c7a37e8bbc4d ]
Some distros have grub2 config files with the lines
if [ x"${feature_menuentry_id}" = xy ]; then
menuentry_id_option="--id"
else
menuentry_id_option=""
fiwhich match the skip regex defined for grub2 in get_grub_index():
$skip = '^\s*menuentry';
These false positives cause the grub number to be higher than it should be, and the wrong kernel can end up booting.
Grub documents the menuentry command with whitespace between it and the title, so make the skip regex reflect this.
--- tools/testing/ktest/ktest.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/ktest/ktest.pl +1 -1
@@ -2047,7 +2047,7 @@ sub get_grub_index { } elsif ($reboot_type eq "grub2") { $command = "cat $grub_file"; $target = '^\s*menuentry.*' . $grub_menu_qt; - $skip = '^\s*menuentry'; + $skip = '^\s*menuentry\s'; $submenu = '^\s*submenu\s'; } elsif ($reboot_type eq "grub2bls") { $command = $grub_bls_get;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/214 RDMA/mad: Improve handling of timed out WRs of mad agent
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saravanan Vajravel <[email protected]>
[ Upstream commit 2a777679b8ccd09a9a65ea0716ef10365179caac ]
Current timeout handler of mad agent acquires/releases mad_agent_priv lock for every timed out WRs. This causes heavy locking contention when higher no. of WRs are to be handled inside timeout handler.
This leads to softlockup with below trace in some use cases where rdma-cm path is used to establish connection between peer nodes
Trace:
-----
BUG: soft lockup - CPU#4 stuck for 26s! [kworker/u128:3:19767]
CPU: 4 PID: 19767 Comm: kworker/u128:3 Kdump: loaded Tainted: G OE
------- --- 5.14.0-427.13.1.el9_4.x86_64 #1
Hardware name: Dell Inc. PowerEdge R740/01YM03, BIOS 2.4.8 11/26/2019
Workqueue: ib_mad1 timeout_sends [ib_core]
RIP: 0010:__do_softirq+0x78/0x2ac
RSP: 0018:ffffb253449e4f98 EFLAGS: 00000246
RAX: 00000000ffffffff RBX: 0000000000000000 RCX: 000000000000001f
RDX: 000000000000001d RSI: 000000003d1879ab RDI: fff363b66fd3a86b
RBP: ffffb253604cbcd8 R08: 0000009065635f3b R09: 0000000000000000
R10: 0000000000000040 R11: ffffb253449e4ff8 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000040
FS: 0000000000000000(0000) GS:ffff8caa1fc80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd9ec9db900 CR3: 0000000891934006 CR4: 00000000007706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
<IRQ>
? show_trace_log_lvl+0x1c4/0x2df
? show_trace_log_lvl+0x1c4/0x2df
? __irq_exit_rcu+0xa1/0xc0
? watchdog_timer_fn+0x1b2/0x210
? __pfx_watchdog_timer_fn+0x10/0x10
? __hrtimer_run_queues+0x127/0x2c0
? hrtimer_interrupt+0xfc/0x210
? __sysvec_apic_timer_interrupt+0x5c/0x110
? sysvec_apic_timer_interrupt+0x37/0x90
? asm_sysvec_apic_timer_interrupt+0x16/0x20
? __do_softirq+0x78/0x2ac
? __do_softirq+0x60/0x2ac
__irq_exit_rcu+0xa1/0xc0
sysvec_call_function_single+0x72/0x90
</IRQ>
<TASK>
asm_sysvec_call_function_single+0x16/0x20
RIP: 0010:_raw_spin_unlock_irq+0x14/0x30
RSP: 0018:ffffb253604cbd88 EFLAGS: 00000247
RAX: 000000000001960d RBX: 0000000000000002 RCX: ffff8cad2a064800
RDX: 000000008020001b RSI: 0000000000000001 RDI: ffff8cad5d39f66c
RBP: ffff8cad5d39f600 R08: 0000000000000001 R09: 0000000000000000
R10: ffff8caa443e0c00 R11: ffffb253604cbcd8 R12: ffff8cacb8682538
R13: 0000000000000005 R14: ffffb253604cbd90 R15: ffff8cad5d39f66c
cm_process_send_error+0x122/0x1d0 [ib_cm]
timeout_sends+0x1dd/0x270 [ib_core]
process_one_work+0x1e2/0x3b0
? __pfx_worker_thread+0x10/0x10
worker_thread+0x50/0x3a0
? __pfx_worker_thread+0x10/0x10
kthread+0xdd/0x100
? __pfx_kthread+0x10/0x10
ret_from_fork+0x29/0x50
</TASK>Simplified timeout handler by creating local list of timed out WRs and invoke send handler post creating the list. The new method acquires/ releases lock once to fetch the list and hence helps to reduce locking contetiong when processing higher no. of WRs
--- drivers/infiniband/core/mad.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/infiniband/core/mad.c +8 -6
@@ -2616,14 +2616,16 @@ static int retry_send(struct ib_mad_send_wr_private *mad_send_wr)static void timeout_sends (struct work_struct *work) { +struct ib_mad_send_wr_private *mad_send_wr, *n;struct ib_mad_agent_private *mad_agent_priv; -struct ib_mad_send_wr_private *mad_send_wr;struct ib_mad_send_wc mad_send_wc; +struct list_head local_list;unsigned long flags, delay; mad_agent_priv = container_of(work, struct ib_mad_agent_private, timed_work.work); mad_send_wc.vendor_err =0 ; +INIT_LIST_HEAD (&local_list);spin_lock_irqsave (&mad_agent_priv->lock, flags);while (!list_empty (&mad_agent_priv->wait_list)) {
@@ -2641,13 +2643,16 @@ static void timeout_sends(struct work_struct *work)break ; } -list_del (&mad_send_wr->agent_list); +list_del_init (&mad_send_wr->agent_list);if (mad_send_wr->status ==IB_WC_SUCCESS && !retry_send (mad_send_wr))continue ; -spin_unlock_irqrestore (&mad_agent_priv->lock, flags); +list_add_tail (&mad_send_wr->agent_list, &local_list); + } +spin_unlock_irqrestore (&mad_agent_priv->lock, flags); +list_for_each_entry_safe (mad_send_wr, n, &local_list, agent_list) {if (mad_send_wr->status ==IB_WC_SUCCESS ) mad_send_wc.status =IB_WC_RESP_TIMEOUT_ERR ;else
@@ -2655,11 +2660,8 @@ static void timeout_sends(struct work_struct *work) mad_send_wc.send_buf = &mad_send_wr->send_buf; mad_agent_priv->agent.send_handler (&mad_agent_priv->agent, &mad_send_wc); -deref_mad_agent (mad_agent_priv); -spin_lock_irqsave (&mad_agent_priv->lock, flags); } -spin_unlock_irqrestore (&mad_agent_priv->lock, flags); }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/214 soundwire: intel_bus_common: enable interrupts before exiting reset
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 5aedb8d8336b0a0421b58ca27d1b572aa6695b5b ]
The existing code enables the Cadence IP interrupts after the bus reset sequence. The problem with this sequence is that it might be pre-empted, giving SoundWire devices time to sync and report as ATTACHED before the interrupts are enabled. In that case, the Cadence IP will not detect a state change and will not throw an interrupt to proceed with the enumeration of a Device0.
In our overnight stress tests, we observed that a slight sub-millisecond delay in enabling interrupts after the reset was correlated with detection failures. This problem is more prevalent on the LunarLake silicon, likely due to SOC integration changes, but it was observed on earlier generations as well.
This patch reverts the sequence, with the interrupts enabled before performing the bus reset. This removes the race condition and makes sure the Cadence IP is able to detect the presence of a Device0 in all cases.
--- drivers/soundwire/intel_bus_common.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/soundwire/intel_bus_common.c +8 -8
@@ -45,15 +45,15 @@ int intel_start_bus(struct sdw_intel *sdw)return ret; } - ret =sdw_cdns_exit_reset (cdns); + ret =sdw_cdns_enable_interrupt (cdns, true);if (ret <0 ) { -dev_err (dev,"%s: unable to exit bus reset sequence: %d\n" , __func__, ret); +dev_err (dev,"%s: cannot enable interrupts: %d\n" , __func__, ret);return ret; } - ret =sdw_cdns_enable_interrupt (cdns, true); + ret =sdw_cdns_exit_reset (cdns);if (ret <0 ) { -dev_err (dev,"%s: cannot enable interrupts: %d\n" , __func__, ret); +dev_err (dev,"%s: unable to exit bus reset sequence: %d\n" , __func__, ret);return ret; }
@@ -136,15 +136,15 @@ int intel_start_bus_after_reset(struct sdw_intel *sdw)return ret; } - ret =sdw_cdns_exit_reset (cdns); + ret =sdw_cdns_enable_interrupt (cdns, true);if (ret <0 ) { -dev_err (dev,"unable to exit bus reset sequence during resume\n" ); +dev_err (dev,"cannot enable interrupts during resume\n" );return ret; } - ret =sdw_cdns_enable_interrupt (cdns, true); + ret =sdw_cdns_exit_reset (cdns);if (ret <0 ) { -dev_err (dev,"cannot enable interrupts during resume\n" ); +dev_err (dev,"unable to exit bus reset sequence during resume\n" );return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/214 PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: WangYuli <[email protected]>
[ Upstream commit 9246b487ab3c3b5993aae7552b7a4c541cc14a49 ]
Add DMA support for audio function of Glenfly Arise chip, which uses Requester ID of function 0.
--- drivers/pci/quirks.c | 4 ++++ include/linux/pci_ids.h | 2 ++ sound/pci/hda/hda_intel.c | 2 +- 3 files changed, 7 insertions(+), 1 deletion(-)
drivers/pci/quirks.c +4 -0
@@ -4259,6 +4259,10 @@ static void quirk_dma_func0_alias(struct pci_dev *dev)DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_RICOH ,0xe832 , quirk_dma_func0_alias);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_RICOH ,0xe476 , quirk_dma_func0_alias); +/* Some Glenfly chips use function 0 as the PCIe Requester ID for DMA */ +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_GLENFLY ,0x3d40 , quirk_dma_func0_alias); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_GLENFLY ,0x3d41 , quirk_dma_func0_alias); +static void quirk_dma_func1_alias (struct pci_dev *dev) {if (PCI_FUNC (dev->devfn) !=1 )
include/linux/pci_ids.h +2 -0
@@ -2661,6 +2661,8 @@#define PCI_DEVICE_ID_DCI_PCCOM8 0x0002#define PCI_DEVICE_ID_DCI_PCCOM2 0x0004 +#define PCI_VENDOR_ID_GLENFLY 0x6766 +#define PCI_VENDOR_ID_INTEL 0x8086#define PCI_DEVICE_ID_INTEL_EESSC 0x0008#define PCI_DEVICE_ID_INTEL_HDA_CML_LP 0x02c8
sound/pci/hda/hda_intel.c +1 -1
@@ -2671,7 +2671,7 @@ static const struct pci_device_id azx_ids[] = { .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS | AZX_DCAPS_PM_RUNTIME },/* GLENFLY */ - { PCI_DEVICE(0x6766, PCI_ANY_ID), + { PCI_DEVICE(PCI_VENDOR_ID_GLENFLY, PCI_ANY_ID), .class = PCI_CLASS_MULTIMEDIA_HD_AUDIO << 8, .class_mask = 0xffffff, .driver_data = AZX_DRIVER_GFHDMI | AZX_DCAPS_POSFIX_LPIB |
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/214 RDMA/rtrs-srv: Avoid null pointer deref during path establishment
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Md Haris Iqbal <[email protected]>
[ Upstream commit d0e62bf7b575fbfe591f6f570e7595dd60a2f5eb ]
For RTRS path establishment, RTRS client initiates and completes con_num of connections. After establishing all its connections, the information is exchanged between the client and server through the info_req message. During this exchange, it is essential that all connections have been established, and the state of the RTRS srv path is CONNECTED.
So add these sanity checks, to make sure we detect and abort process in error scenarios to avoid null pointer deref.
--- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/infiniband/ulp/rtrs/rtrs-srv.c +11 -2
@@ -931,12 +931,11 @@ static void rtrs_srv_info_req_done(struct ib_cq *cq, struct ib_wc *wc)if (err) goto close; -out:rtrs_iu_free (iu, srv_path->s.dev->ib_dev,1 );return ; close: +rtrs_iu_free (iu, srv_path->s.dev->ib_dev,1 );close_path (srv_path); - goto out; }static int post_recv_info_req (struct rtrs_srv_con *con)
@@ -987,6 +986,16 @@ static int post_recv_path(struct rtrs_srv_path *srv_path) q_size =SERVICE_CON_QUEUE_DEPTH ; else q_size = srv->queue_depth; +if (srv_path->state !=RTRS_SRV_CONNECTING ) { +rtrs_err (s,"Path state invalid. state %s\n" , +rtrs_srv_state_str (srv_path->state)); +return -EIO ; + } + +if (!srv_path->s.con[cid]) { +rtrs_err (s,"Conn not set for %d\n" , cid); +return -EIO ; + } err =post_recv_io (to_srv_con (srv_path->s.con[cid]), q_size);if (err) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/214 clk: bcm: bcm53573: fix OF node leak in init
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit f92d67e23b8caa81f6322a2bad1d633b00ca000e ]
Driver code is leaking OF node reference from of_get_parent() in bcm53573_ilp_init(). Usage of of_get_parent() is not needed in the first place, because the parent node will not be freed while we are processing given node (triggered by CLK_OF_DECLARE()). Thus fix the leak by accessing parent directly, instead of of_get_parent().
--- drivers/clk/bcm/clk-bcm53573-ilp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/bcm/clk-bcm53573-ilp.c +1 -1
@@ -112,7 +112,7 @@ static void bcm53573_ilp_init(struct device_node *np) goto err_free_ilp; } - ilp->regmap =syscon_node_to_regmap (of_get_parent (np)); + ilp->regmap =syscon_node_to_regmap (np->parent);if (IS_ERR (ilp->regmap)) { err =PTR_ERR (ilp->regmap); goto err_free_ilp;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/214 PCI: Add ACS quirk for Qualcomm SA8775P
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Subramanian Ananthanarayanan <[email protected]>
[ Upstream commit 026f84d3fa62d215b11cbeb5a5d97df941e93b5c ]
The Qualcomm SA8775P root ports don't advertise an ACS capability, but they do provide ACS-like features to disable peer transactions and validate bus numbers in requests.
Thus, add an ACS quirk for the SA8775P.
--- drivers/pci/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/quirks.c +2 -0
@@ -5087,6 +5087,8 @@ static const struct pci_dev_acs_enabled {/* QCOM QDF2xxx root ports */ { PCI_VENDOR_ID_QCOM, 0x0400, pci_quirk_qcom_rp_acs }, { PCI_VENDOR_ID_QCOM, 0x0401, pci_quirk_qcom_rp_acs }, +/* QCOM SA8775P root port */ + { PCI_VENDOR_ID_QCOM, 0x0115, pci_quirk_qcom_rp_acs },/* HXT SD4800 root ports. The ACS design is same as QCOM QDF2xxx */ { PCI_VENDOR_ID_HXT, 0x0401, pci_quirk_qcom_rp_acs }, /* Intel PCH root ports */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/214 i2c: i801: Use a different adapter-name for IDF adapters
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 43457ada98c824f310adb7bd96bd5f2fcd9a3279 ]
On chipsets with a second 'Integrated Device Function' SMBus controller use a different adapter-name for the second IDF adapter.
This allows platform glue code which is looking for the primary i801 adapter to manually instantiate i2c_clients on to differentiate between the 2.
This allows such code to find the primary i801 adapter by name, without needing to duplicate the PCI-ids to feature-flags mapping from i2c-i801.c.
--- drivers/i2c/busses/i2c-i801.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-i801.c +8 -1
@@ -1763,8 +1763,15 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)i801_add_tco (priv); +/* +* adapter.name is used by platform code to find the main I801 adapter +* to instantiante i2c_clients, do not change. +*/ snprintf (priv->adapter.name,sizeof (priv->adapter.name), -"SMBus I801 adapter at %04lx" , priv->smba); +"SMBus %s adapter at %04lx" , + (priv->features &FEATURE_IDF ) ?"I801 IDF" :"I801" , + priv->smba); + err =i2c_add_adapter (&priv->adapter);if (err) {platform_device_unregister (priv->tco_pdev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/214 PCI: Mark Creative Labs EMU20k2 INTx masking as broken
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <[email protected]>
[ Upstream commit 2910306655a7072640021563ec9501bfa67f0cb1 ]
Per user reports, the Creative Labs EMU20k2 (Sound Blaster X-Fi Titanium Series) generates spurious interrupts when used with vfio-pci unless DisINTx masking support is disabled.
Thus, quirk the device to mark INTx masking as broken.
--- drivers/pci/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/quirks.c +2 -0
@@ -3621,6 +3621,8 @@ DECLARE_PCI_FIXUP_FINAL(0x1814, 0x0601, /* Ralink RT2800 802.11n PCI */ quirk_broken_intx_masking);DECLARE_PCI_FIXUP_FINAL (0x1b7c ,0x0004 ,/* Ceton InfiniTV4 */ quirk_broken_intx_masking); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_CREATIVE ,PCI_DEVICE_ID_CREATIVE_20K2 , + quirk_broken_intx_masking);/* * Realtek RTL8169 PCI Gigabit Ethernet Controller (rev 10)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/214 i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaixin Wang <[email protected]>
[ Upstream commit 609366e7a06d035990df78f1562291c3bf0d4a12 ]
In the cdns_i3c_master_probe function, &master->hj_work is bound with cdns_i3c_master_hj. And cdns_i3c_master_interrupt can call cnds_i3c_master_demux_ibis function to start the work.
If we remove the module which will call cdns_i3c_master_remove to make cleanup, it will free master->base through i3c_master_unregister while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| cdns_i3c_master_hj
cdns_i3c_master_remove |
i3c_master_unregister(&master->base) |
device_unregister(&master->dev) |
device_release |
//free master->base |
| i3c_master_do_daa(&master->base)
| //use master->baseFix it by ensuring that the work is canceled before proceeding with the cleanup in cdns_i3c_master_remove.
--- drivers/i3c/master/i3c-master-cdns.c | 1 + 1 file changed, 1 insertion(+)
drivers/i3c/master/i3c-master-cdns.c +1 -0
@@ -1666,6 +1666,7 @@ static void cdns_i3c_master_remove(struct platform_device *pdev) {struct cdns_i3c_master *master =platform_get_drvdata (pdev); +cancel_work_sync (&master->hj_work);i3c_master_unregister (&master->base);clk_disable_unprepare (master->sysclk);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/214 RISC-V: Dont have MAX_PHYSMEM_BITS exceed phys_addr_t
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Palmer Dabbelt <[email protected]>
[ Upstream commit ad380f6a0a5e82e794b45bb2eaec24ed51a56846 ]
I recently ended up with a warning on some compilers along the lines of
CC kernel/resource.o
In file included from include/linux/ioport.h:16,
from kernel/resource.c:15:
kernel/resource.c: In function 'gfr_start':
include/linux/minmax.h:49:37: error: conversion from 'long long unsigned int' to 'resource_size_t' {aka 'unsigned int'} changes value from '17179869183' to '4294967295' [-Werror=overflow]
49 | ({ type ux = (x); type uy = (y); __cmp(op, ux, uy); })
| ^
include/linux/minmax.h:52:9: note: in expansion of macro '__cmp_once_unique'
52 | __cmp_once_unique(op, type, x, y, __UNIQUE_ID(x_), __UNIQUE_ID(y_))
| ^~~~~~~~~~~~~~~~~
include/linux/minmax.h:161:27: note: in expansion of macro '__cmp_once'
161 | #define min_t(type, x, y) __cmp_once(min, type, x, y)
| ^~~~~~~~~~
kernel/resource.c:1829:23: note: in expansion of macro 'min_t'
1829 | end = min_t(resource_size_t, base->end,
| ^~~~~
kernel/resource.c: In function 'gfr_continue':
include/linux/minmax.h:49:37: error: conversion from 'long long unsigned int' to 'resource_size_t' {aka 'unsigned int'} changes value from '17179869183' to '4294967295' [-Werror=overflow]
49 | ({ type ux = (x); type uy = (y); __cmp(op, ux, uy); })
| ^
include/linux/minmax.h:52:9: note: in expansion of macro '__cmp_once_unique'
52 | __cmp_once_unique(op, type, x, y, __UNIQUE_ID(x_), __UNIQUE_ID(y_))
| ^~~~~~~~~~~~~~~~~
include/linux/minmax.h:161:27: note: in expansion of macro '__cmp_once'
161 | #define min_t(type, x, y) __cmp_once(min, type, x, y)
| ^~~~~~~~~~
kernel/resource.c:1847:24: note: in expansion of macro 'min_t'
1847 | addr <= min_t(resource_size_t, base->end,
| ^~~~~
cc1: all warnings being treated as errorswhich looks like a real problem: our phys_addr_t is only 32 bits now, so having 34-bit masks is just going to result in overflows.
--- arch/riscv/include/asm/sparsemem.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/include/asm/sparsemem.h +1 -1
@@ -7,7 +7,7 @@#ifdef CONFIG_64BIT #define MAX_PHYSMEM_BITS 56#else -#define MAX_PHYSMEM_BITS 34 +#define MAX_PHYSMEM_BITS 32#endif /* CONFIG_64BIT */ #define SECTION_SIZE_BITS 27#endif /* CONFIG_SPARSEMEM */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/214 io_uring: check if we need to reschedule during overflow flush
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
[ Upstream commit eac2ca2d682f94f46b1973bdf5e77d85d77b8e53 ]
In terms of normal application usage, this list will always be empty. And if an application does overflow a bit, it'll have a few entries. However, nothing obviously prevents syzbot from running a test case that generates a ton of overflow entries, and then flushing them can take quite a while.
Check for needing to reschedule while flushing, and drop our locks and do so if necessary. There's no state to maintain here as overflows always prune from head-of-list, hence it's fine to drop and reacquire the locks at the end of the loop.
--- io_uring/io_uring.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
io_uring/io_uring.c +15 -0
@@ -627,6 +627,21 @@ static void __io_cqring_overflow_flush(struct io_ring_ctx *ctx, bool dying) }list_del (&ocqe->list);kfree (ocqe); + +/* +* For silly syzbot cases that deliberately overflow by huge +* amounts, check if we need to resched and drop and +* reacquire the locks if so. Nothing real would ever hit this. +* Ideally we'd have a non-posting unlock for this, but hard +* to care for a non-real case. +*/ +if (need_resched ()) { +io_cq_unlock_post (ctx); +mutex_unlock (&ctx->uring_lock); +cond_resched (); +mutex_lock (&ctx->uring_lock); +io_cq_lock (ctx); + } }if (list_empty (&ctx->cq_overflow_list)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/214 ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaixin Wang <[email protected]>
[ Upstream commit e51aded92d42784313ba16c12f4f88cc4f973bbb ]
In the switchtec_ntb_add function, it can call switchtec_ntb_init_sndev function, then &sndev->check_link_status_work is bound with check_link_status_work. switchtec_ntb_link_notification may be called to start the work.
If we remove the module which will call switchtec_ntb_remove to make cleanup, it will free sndev through kfree(sndev), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| check_link_status_work
switchtec_ntb_remove |
kfree(sndev); |
| if (sndev->link_force_down)
| // use sndevFix it by ensuring that the work is canceled before proceeding with the cleanup in switchtec_ntb_remove.
--- drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 1 + 1 file changed, 1 insertion(+)
drivers/ntb/hw/mscc/ntb_hw_switchtec.c +1 -0
@@ -1554,6 +1554,7 @@ static void switchtec_ntb_remove(struct device *dev)switchtec_ntb_deinit_db_msg_irq (sndev);switchtec_ntb_deinit_shared_mw (sndev);switchtec_ntb_deinit_crosslink (sndev); +cancel_work_sync (&sndev->check_link_status_work);kfree (sndev);dev_info (dev,"ntb device unregistered\n" ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/214 mfd: intel_soc_pmic_chtwc: Make Lenovo Yoga Tab 3 X90F DMI match less strict
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit ae7eee56cdcfcb6a886f76232778d6517fd58690 ]
There are 2G and 4G RAM versions of the Lenovo Yoga Tab 3 X90F and it turns out that the 2G version has a DMI product name of "CHERRYVIEW D1 PLATFORM" where as the 4G version has "CHERRYVIEW C0 PLATFORM". The sys-vendor + product-version check are unique enough that the product-name check is not necessary.
Drop the product-name check so that the existing DMI match for the 4G RAM version also matches the 2G RAM version.
--- drivers/mfd/intel_soc_pmic_chtwc.c | 1 - 1 file changed, 1 deletion(-)
drivers/mfd/intel_soc_pmic_chtwc.c +0 -1
@@ -178,7 +178,6 @@ static const struct dmi_system_id cht_wc_model_dmi_ids[] = { .driver_data = (void *)(long)INTEL_CHT_WC_LENOVO_YT3_X90, .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"Intel Corporation" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"CHERRYVIEW D1 PLATFORM" ), DMI_MATCH(DMI_PRODUCT_VERSION, "Blade3-10A-001"), }, },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/214 mfd: intel-lpss: Add Intel Arrow Lake-H LPSS PCI IDs
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 6112597f5ba84b70870fade5069ccc9c8b534a33 ]
Add Intel Arrow Lake-H PCI IDs.
--- drivers/mfd/intel-lpss-pci.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/mfd/intel-lpss-pci.c +13 -0
@@ -424,6 +424,19 @@ static const struct pci_device_id intel_lpss_pci_ids[] = { { PCI_VDEVICE(INTEL, 0x5ac4), (kernel_ulong_t)&bxt_spi_info }, { PCI_VDEVICE(INTEL, 0x5ac6), (kernel_ulong_t)&bxt_spi_info }, { PCI_VDEVICE(INTEL, 0x5aee), (kernel_ulong_t)&bxt_uart_info }, +/* ARL-H */ + { PCI_VDEVICE(INTEL, 0x7725), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0x7726), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0x7727), (kernel_ulong_t)&tgl_spi_info }, + { PCI_VDEVICE(INTEL, 0x7730), (kernel_ulong_t)&tgl_spi_info }, + { PCI_VDEVICE(INTEL, 0x7746), (kernel_ulong_t)&tgl_spi_info }, + { PCI_VDEVICE(INTEL, 0x7750), (kernel_ulong_t)&bxt_i2c_info }, + { PCI_VDEVICE(INTEL, 0x7751), (kernel_ulong_t)&bxt_i2c_info }, + { PCI_VDEVICE(INTEL, 0x7752), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0x7778), (kernel_ulong_t)&bxt_i2c_info }, + { PCI_VDEVICE(INTEL, 0x7779), (kernel_ulong_t)&bxt_i2c_info }, + { PCI_VDEVICE(INTEL, 0x777a), (kernel_ulong_t)&bxt_i2c_info }, + { PCI_VDEVICE(INTEL, 0x777b), (kernel_ulong_t)&bxt_i2c_info },/* RPL-S */ { PCI_VDEVICE(INTEL, 0x7a28), (kernel_ulong_t)&bxt_uart_info }, { PCI_VDEVICE(INTEL, 0x7a29), (kernel_ulong_t)&bxt_uart_info },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/214 mfd: intel-lpss: Add Intel Panther Lake LPSS PCI IDs
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit db6a186505c8156e55681a3b93ada431863b85c1 ]
Add Intel Panther Lake-H/P PCI IDs.
--- drivers/mfd/intel-lpss-pci.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+)
drivers/mfd/intel-lpss-pci.c +26 -0
@@ -607,6 +607,32 @@ static const struct pci_device_id intel_lpss_pci_ids[] = { { PCI_VDEVICE(INTEL, 0xa879), (kernel_ulong_t)&ehl_i2c_info }, { PCI_VDEVICE(INTEL, 0xa87a), (kernel_ulong_t)&ehl_i2c_info }, { PCI_VDEVICE(INTEL, 0xa87b), (kernel_ulong_t)&ehl_i2c_info }, +/* PTL-H */ + { PCI_VDEVICE(INTEL, 0xe325), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0xe326), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0xe327), (kernel_ulong_t)&tgl_spi_info }, + { PCI_VDEVICE(INTEL, 0xe330), (kernel_ulong_t)&tgl_spi_info }, + { PCI_VDEVICE(INTEL, 0xe346), (kernel_ulong_t)&tgl_spi_info }, + { PCI_VDEVICE(INTEL, 0xe350), (kernel_ulong_t)&ehl_i2c_info }, + { PCI_VDEVICE(INTEL, 0xe351), (kernel_ulong_t)&ehl_i2c_info }, + { PCI_VDEVICE(INTEL, 0xe352), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0xe378), (kernel_ulong_t)&ehl_i2c_info }, + { PCI_VDEVICE(INTEL, 0xe379), (kernel_ulong_t)&ehl_i2c_info }, + { PCI_VDEVICE(INTEL, 0xe37a), (kernel_ulong_t)&ehl_i2c_info }, + { PCI_VDEVICE(INTEL, 0xe37b), (kernel_ulong_t)&ehl_i2c_info }, +/* PTL-P */ + { PCI_VDEVICE(INTEL, 0xe425), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0xe426), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0xe427), (kernel_ulong_t)&tgl_spi_info }, + { PCI_VDEVICE(INTEL, 0xe430), (kernel_ulong_t)&tgl_spi_info }, + { PCI_VDEVICE(INTEL, 0xe446), (kernel_ulong_t)&tgl_spi_info }, + { PCI_VDEVICE(INTEL, 0xe450), (kernel_ulong_t)&ehl_i2c_info }, + { PCI_VDEVICE(INTEL, 0xe451), (kernel_ulong_t)&ehl_i2c_info }, + { PCI_VDEVICE(INTEL, 0xe452), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0xe478), (kernel_ulong_t)&ehl_i2c_info }, + { PCI_VDEVICE(INTEL, 0xe479), (kernel_ulong_t)&ehl_i2c_info }, + { PCI_VDEVICE(INTEL, 0xe47a), (kernel_ulong_t)&ehl_i2c_info }, + { PCI_VDEVICE(INTEL, 0xe47b), (kernel_ulong_t)&ehl_i2c_info }, { } };MODULE_DEVICE_TABLE (pci, intel_lpss_pci_ids);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/214 riscv: Omit optimized string routines when using KASAN
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Holland <[email protected]>
[ Upstream commit 58ff537109ac863d4ec83baf8413b17dcc10101c ]
The optimized string routines are implemented in assembly, so they are not instrumented for use with KASAN. Fall back to the C version of the routines in order to improve KASAN coverage. This fixes the kasan_strings() unit test.
--- arch/riscv/include/asm/string.h | 2 ++ arch/riscv/kernel/riscv_ksyms.c | 3 --- arch/riscv/lib/Makefile | 2 ++ arch/riscv/lib/strcmp.S | 1 + arch/riscv/lib/strlen.S | 1 + arch/riscv/lib/strncmp.S | 1 + arch/riscv/purgatory/Makefile | 2 ++ 7 files changed, 9 insertions(+), 3 deletions(-)
arch/riscv/include/asm/string.h +2 -0
@@ -19,6 +19,7 @@ extern asmlinkage void *__memcpy(void *, const void *, size_t); extern asmlinkage void *memmove(void *, const void *, size_t); extern asmlinkage void *__memmove(void *, const void *, size_t); +#if !(defined(CONFIG_KASAN_GENERIC ) || defined(CONFIG_KASAN_SW_TAGS ))#define __HAVE_ARCH_STRCMP extern asmlinkage int strcmp(const char *cs, const char *ct);
@@ -27,6 +28,7 @@ extern asmlinkage __kernel_size_t strlen(const char *);#define __HAVE_ARCH_STRNCMP extern asmlinkage int strncmp(const char *cs, const char *ct, size_t count); +#endif /* For those files which don't want to check by kasan. */ #if defined(CONFIG_KASAN ) && !defined(__SANITIZE_ADDRESS__)
arch/riscv/kernel/riscv_ksyms.c +0 -3
@@ -12,9 +12,6 @@EXPORT_SYMBOL (memset);EXPORT_SYMBOL (memcpy);EXPORT_SYMBOL (memmove); -EXPORT_SYMBOL (strcmp); -EXPORT_SYMBOL (strlen); -EXPORT_SYMBOL (strncmp);EXPORT_SYMBOL (__memset);EXPORT_SYMBOL (__memcpy);EXPORT_SYMBOL (__memmove);
arch/riscv/lib/Makefile +2 -0
@@ -3,9 +3,11 @@ lib-y += delay.o lib-y += memcpy.o lib-y += memset.o lib-y += memmove.o +ifeq ($(CONFIG_KASAN_GENERIC)$(CONFIG_KASAN_SW_TAGS),) lib-y += strcmp.o lib-y += strlen.o lib-y += strncmp.o +endif lib-y += csum.o ifeq ($(CONFIG_MMU), y) lib-$(CONFIG_RISCV_ISA_V) += uaccess_vector.o
arch/riscv/lib/strcmp.S +1 -0
@@ -120,3 +120,4 @@ strcmp_zbb: .option pop #endif SYM_FUNC_END(strcmp) +EXPORT_SYMBOL(strcmp)
arch/riscv/lib/strlen.S +1 -0
@@ -131,3 +131,4 @@ strlen_zbb: #endif SYM_FUNC_END(strlen) SYM_FUNC_ALIAS(__pi_strlen, strlen) +EXPORT_SYMBOL(strlen)
arch/riscv/lib/strncmp.S +1 -0
@@ -136,3 +136,4 @@ strncmp_zbb: .option pop #endif SYM_FUNC_END(strncmp) +EXPORT_SYMBOL(strncmp)
arch/riscv/purgatory/Makefile +2 -0
@@ -1,7 +1,9 @@ # SPDX-License-Identifier: GPL-2.0 purgatory-y := purgatory.o sha256.o entry.o string.o ctype.o memcpy.o memset.o +ifeq ($(CONFIG_KASAN_GENERIC)$(CONFIG_KASAN_SW_TAGS),) purgatory-y += strcmp.o strlen.o strncmp.o +endif targets += $(purgatory-y) PURGATORY_OBJS = $(addprefix $(obj)/,$(purgatory-y))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/214 riscv: avoid Imbalance in RAS
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jisheng Zhang <[email protected]>
[ Upstream commit 8f1534e7440382d118c3d655d3a6014128b2086d ]
Inspired by[1], modify the code to remove the code of modifying ra to avoid imbalance RAS (return address stack) which may lead to incorret predictions on return.
--- arch/riscv/kernel/entry.S | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/riscv/kernel/entry.S +2 -2
@@ -239,8 +239,8 @@ SYM_CODE_START(ret_from_fork) jalr s0 1: move a0, sp /* pt_regs */ - la ra, ret_from_exception - tail syscall_exit_to_user_mode + call syscall_exit_to_user_mode + j ret_from_exception SYM_CODE_END(ret_from_fork) #ifdef CONFIG_IRQ_STACKS
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/214 RDMA/mlx5: Enforce umem boundaries for explicit ODP page faults
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Guralnik <[email protected]>
[ Upstream commit 8c6d097d830f779fc1725fbaa1314f20a7a07b4b ]
The new memory scheme page faults are requesting the driver to fetch additinal pages to the faulted memory access.
This is done in order to prefetch pages before and after the area that got the page fault, assuming this will reduce the total amount of page faults.
The driver should ensure it handles only the pages that are within the umem range.
--- drivers/infiniband/hw/mlx5/odp.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-)
drivers/infiniband/hw/mlx5/odp.c +16 -9
@@ -733,24 +733,31 @@ static int pagefault_dmabuf_mr(struct mlx5_ib_mr *mr, size_t bcnt,* >0: Number of pages mapped */ static int pagefault_mr (struct mlx5_ib_mr *mr,u64 io_virt,size_t bcnt, -u32 *bytes_mapped,u32 flags) +u32 *bytes_mapped,u32 flags,bool permissive_fault) {struct ib_umem_odp *odp =to_ib_umem_odp (mr->umem); -if (unlikely (io_virt < mr->ibmr.iova)) +if (unlikely (io_virt < mr->ibmr.iova) && !permissive_fault)return -EFAULT ;if (mr->umem->is_dmabuf)return pagefault_dmabuf_mr (mr, bcnt, bytes_mapped, flags);if (!odp->is_implicit_odp) { +u64 offset = io_virt < mr->ibmr.iova ?0 : io_virt - mr->ibmr.iova;u64 user_va; -if (check_add_overflow (io_virt - mr->ibmr.iova, - (u64 )odp->umem.address, &user_va)) +if (check_add_overflow (offset, (u64 )odp->umem.address, + &user_va))return -EFAULT ; -if (unlikely (user_va >=ib_umem_end (odp) || -ib_umem_end (odp) - user_va < bcnt)) + +if (permissive_fault) { +if (user_va <ib_umem_start (odp)) + user_va =ib_umem_start (odp); +if ((user_va + bcnt) >ib_umem_end (odp)) + bcnt =ib_umem_end (odp) - user_va; + }else if (unlikely (user_va >=ib_umem_end (odp) || +ib_umem_end (odp) - user_va < bcnt))return -EFAULT ;return pagefault_real_mr (mr, odp, user_va, bcnt, bytes_mapped, flags);
@@ -857,7 +864,7 @@ static int pagefault_single_data_segment(struct mlx5_ib_dev *dev,case MLX5_MKEY_MR : mr = container_of(mmkey, struct mlx5_ib_mr, mmkey); - ret =pagefault_mr (mr, io_virt, bcnt, bytes_mapped,0 ); + ret =pagefault_mr (mr, io_virt, bcnt, bytes_mapped,0 , false);if (ret <0 ) goto end;
@@ -1710,7 +1717,7 @@ static void mlx5_ib_prefetch_mr_work(struct work_struct *w)for (i =0 ; i < work->num_sge; ++i) { ret =pagefault_mr (work->frags[i].mr, work->frags[i].io_virt, work->frags[i].length, &bytes_mapped, - work->pf_flags); + work->pf_flags, false);if (ret <=0 )continue ;mlx5_update_odp_stats (work->frags[i].mr, prefetch, ret);
@@ -1761,7 +1768,7 @@ static int mlx5_ib_prefetch_sg_list(struct ib_pd *pd,if (IS_ERR (mr))return PTR_ERR (mr); ret =pagefault_mr (mr, sg_list[i].addr, sg_list[i].length, - &bytes_mapped, pf_flags); + &bytes_mapped, pf_flags, false);if (ret <0 ) {mlx5r_deref_odp_mkey (&mr->mmkey);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/214 PCI: qcom: Disable mirroring of DBI and iATU register space in BAR region
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prudhvi Yarlagadda <[email protected]>
[ Upstream commit 10ba0854c5e6165b58e17bda5fb671e729fecf9e ]
PARF hardware block which is a wrapper on top of DWC PCIe controller mirrors the DBI and ATU register space. It uses PARF_SLV_ADDR_SPACE_SIZE register to get the size of the memory block to be mirrored and uses PARF_DBI_BASE_ADDR, PARF_ATU_BASE_ADDR registers to determine the base address of DBI and ATU space inside the memory block that is being mirrored.
When a memory region which is located above the SLV_ADDR_SPACE_SIZE boundary is used for BAR region then there could be an overlap of DBI and ATU address space that is getting mirrored and the BAR region. This results in DBI and ATU address space contents getting updated when a PCIe function driver tries updating the BAR/MMIO memory region. Reference memory map of the PCIe memory region with DBI and ATU address space overlapping BAR region is as below.
|---------------|
| |
| |
------- --------|---------------|
| | |---------------|
| | | DBI |
| | |---------------|---->DBI_BASE_ADDR
| | | |
| | | |
| PCIe | |---->2*SLV_ADDR_SPACE_SIZE
| BAR/MMIO|---------------|
| Region | ATU |
| | |---------------|---->ATU_BASE_ADDR
| | | |
PCIe | |---------------|
Memory | | DBI |
Region | |---------------|---->DBI_BASE_ADDR
| | | |
| --------| |
| | |---->SLV_ADDR_SPACE_SIZE
| |---------------|
| | ATU |
| |---------------|---->ATU_BASE_ADDR
| | |
| |---------------|
| | DBI |
| |---------------|---->DBI_BASE_ADDR
| | |
| | |
----------------|---------------|
| |
| |
| |
|---------------|Currently memory region beyond the SLV_ADDR_SPACE_SIZE boundary is not used for BAR region which is why the above mentioned issue is not encountered. This issue is discovered as part of internal testing when we tried moving the BAR region beyond the SLV_ADDR_SPACE_SIZE boundary. Hence we are trying to fix this.
As PARF hardware block mirrors DBI and ATU register space after every PARF_SLV_ADDR_SPACE_SIZE (default 0x1000000) boundary multiple, program maximum possible size to this register by writing 0x80000000 to it(it considers only powers of 2 as values) to avoid mirroring DBI and ATU to BAR/MMIO region. Write the physical base address of DBI and ATU register blocks to PARF_DBI_BASE_ADDR (default 0x0) and PARF_ATU_BASE_ADDR (default 0x1000) respectively to make sure DBI and ATU blocks are at expected memory locations.
The register offsets PARF_DBI_BASE_ADDR_V2, PARF_SLV_ADDR_SPACE_SIZE_V2 and PARF_ATU_BASE_ADDR are applicable for platforms that use Qcom IP rev 1.9.0, 2.7.0 and 2.9.0. PARF_DBI_BASE_ADDR_V2 and PARF_SLV_ADDR_SPACE_SIZE_V2 are applicable for Qcom IP rev 2.3.3. PARF_DBI_BASE_ADDR and PARF_SLV_ADDR_SPACE_SIZE are applicable for Qcom IP rev 1.0.0, 2.3.2 and 2.4.0. Update init()/post_init() functions of the respective Qcom IP versions to program applicable PARF_DBI_BASE_ADDR, PARF_SLV_ADDR_SPACE_SIZE and PARF_ATU_BASE_ADDR register offsets. Update the SLV_ADDR_SPACE_SZ macro to 0x80000000 to set highest bit in PARF_SLV_ADDR_SPACE_SIZE register.
Cache DBI and iATU physical addresses in 'struct dw_pcie' so that pcie_qcom.c driver can program these addresses in the PARF_DBI_BASE_ADDR and PARF_ATU_BASE_ADDR registers.
--- drivers/pci/controller/dwc/pcie-designware.c | 2 + drivers/pci/controller/dwc/pcie-designware.h | 2 + drivers/pci/controller/dwc/pcie-qcom.c | 72 ++++++++++++++++---- 3 files changed, 61 insertions(+), 15 deletions(-)
drivers/pci/controller/dwc/pcie-designware.c +2 -0
@@ -112,6 +112,7 @@ int dw_pcie_get_resources(struct dw_pcie *pci) pci->dbi_base =devm_pci_remap_cfg_resource (pci->dev, res);if (IS_ERR (pci->dbi_base))return PTR_ERR (pci->dbi_base); + pci->dbi_phys_addr = res->start; }/* DBI2 is mainly useful for the endpoint controller */
@@ -134,6 +135,7 @@ int dw_pcie_get_resources(struct dw_pcie *pci) pci->atu_base =devm_ioremap_resource (pci->dev, res);if (IS_ERR (pci->atu_base))return PTR_ERR (pci->atu_base); + pci->atu_phys_addr = res->start; }else { pci->atu_base = pci->dbi_base +DEFAULT_DBI_ATU_OFFSET ; }
drivers/pci/controller/dwc/pcie-designware.h +2 -0
@@ -407,8 +407,10 @@ struct dw_pcie_ops {struct dw_pcie {struct device *dev;void __iomem *dbi_base; +resource_size_t dbi_phys_addr;void __iomem *dbi_base2;void __iomem *atu_base; +resource_size_t atu_phys_addr;size_t atu_size;u32 num_ib_windows;u32 num_ob_windows;
drivers/pci/controller/dwc/pcie-qcom.c +57 -15
135 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/214 PCI: endpoint: Assign PCI domain number for endpoint controllers
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
[ Upstream commit 0328947c50324cf4b2d8b181bf948edb8101f59f ]
Right now, PCI endpoint subsystem doesn't assign PCI domain number for the PCI endpoint controllers. But this domain number could be useful to the EPC drivers to uniquely identify each controller based on the hardware instance when there are multiple ones present in an SoC (even multiple RC/EP).
So let's make use of the existing pci_bus_find_domain_nr() API to allocate domain numbers based on either devicetree (linux,pci-domain) property or dynamic domain number allocation scheme.
It should be noted that the domain number allocated by this API will be based on both RC and EP controllers in a SoC. If the 'linux,pci-domain' DT property is present, then the domain number represents the actual hardware instance of the PCI endpoint controller. If not, then the domain number will be allocated based on the PCI EP/RC controller probe order.
If the architecture doesn't support CONFIG_PCI_DOMAINS_GENERIC (rare), then currently a warning is thrown to indicate that the architecture specific implementation is needed.
--- drivers/pci/endpoint/pci-epc-core.c | 14 ++++++++++++++ include/linux/pci-epc.h | 2 ++ 2 files changed, 16 insertions(+)
drivers/pci/endpoint/pci-epc-core.c +14 -0
@@ -838,6 +838,10 @@ void pci_epc_destroy(struct pci_epc *epc) {pci_ep_cfs_remove_epc_group (epc->group);device_unregister (&epc->dev); + +#ifdef CONFIG_PCI_DOMAINS_GENERIC +pci_bus_release_domain_nr (NULL , &epc->dev); +#endif }EXPORT_SYMBOL_GPL (pci_epc_destroy);
@@ -900,6 +904,16 @@ __pci_epc_create(struct device *dev, const struct pci_epc_ops *ops, epc->dev.release = pci_epc_release; epc->ops = ops; +#ifdef CONFIG_PCI_DOMAINS_GENERIC + epc->domain_nr =pci_bus_find_domain_nr (NULL , dev); +#else +/* +* TODO: If the architecture doesn't support generic PCI +* domains, then a custom implementation has to be used. +*/ +WARN_ONCE (1 ,"This architecture doesn't support generic PCI domains\n" ); +#endif + ret =dev_set_name (&epc->dev,"%s" ,dev_name (dev));if (ret) goto put_dev;
include/linux/pci-epc.h +2 -0
@@ -128,6 +128,7 @@ struct pci_epc_mem {* @group: configfs group representing the PCI EPC device * @lock: mutex to protect pci_epc ops * @function_num_map: bitmap to manage physical function number +* @domain_nr: PCI domain number of the endpoint controller * @init_complete: flag to indicate whether the EPC initialization is complete * or not */
@@ -145,6 +146,7 @@ struct pci_epc {/* mutex to protect against concurrent access of EP controller */ struct mutex lock;unsigned long function_num_map; +int domain_nr;bool init_complete; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/214 soundwire: cadence: re-check Peripheral status with delayed_work
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit f8c35d61ba01afa76846905c67862cdace7f66b0 ]
The SoundWire peripheral enumeration is entirely based on interrupts, more specifically sticky bits tracking state changes.
This patch adds a defensive programming check on the actual status reported in PING frames. If for some reason an interrupt was lost or delayed, the delayed work would detect a peripheral change of status after the bus starts.
The 100ms defined for the delay is not completely arbitrary, if a Peripheral didn't join the bus within that delay then probably the hardware link is broken, and conversely if the detection didn't happen because of software issues the 100ms is still acceptable in terms of user experience.
The overhead of the one-shot workqueue is minimal, and the mutual exclusion ensures that the interrupt and delayed work cannot update the status concurrently.
--- drivers/soundwire/cadence_master.c | 39 ++++++++++++++++++++++++++-- drivers/soundwire/cadence_master.h | 5 ++++ drivers/soundwire/intel.h | 2 ++ drivers/soundwire/intel_auxdevice.c | 1 + drivers/soundwire/intel_bus_common.c | 11 ++++++++ 5 files changed, 56 insertions(+), 2 deletions(-)
drivers/soundwire/cadence_master.c +37 -2
@@ -890,8 +890,14 @@ static int cdns_update_slave_status(struct sdw_cdns *cdns, } } -if (is_slave) -return sdw_handle_slave_status (&cdns->bus, status); +if (is_slave) { +int ret; + +mutex_lock (&cdns->status_update_lock); + ret =sdw_handle_slave_status (&cdns->bus, status); +mutex_unlock (&cdns->status_update_lock); +return ret; + }return 0 ; }
@@ -988,6 +994,31 @@ irqreturn_t sdw_cdns_irq(int irq, void *dev_id) }EXPORT_SYMBOL (sdw_cdns_irq); +static void cdns_check_attached_status_dwork (struct work_struct *work) +{ +struct sdw_cdns *cdns = + container_of(work, struct sdw_cdns, attach_dwork.work); +enum sdw_slave_status status[SDW_MAX_DEVICES +1 ]; +u32 val; +int ret; +int i; + + val =cdns_readl (cdns,CDNS_MCP_SLAVE_STAT ); + +for (i =0 ; i <=SDW_MAX_DEVICES ; i++) { + status[i] = val &0x3 ; +if (status[i]) +dev_dbg (cdns->dev,"Peripheral %d status: %d\n" , i, status[i]); + val >>=2 ; + } + +mutex_lock (&cdns->status_update_lock); + ret =sdw_handle_slave_status (&cdns->bus, status); +mutex_unlock (&cdns->status_update_lock); +if (ret <0 ) +dev_err (cdns->dev,"%s: sdw_handle_slave_status failed: %d\n" , __func__, ret); +} +/** * cdns_update_slave_status_work - update slave status in a work since we will need to handle * other interrupts eg. CDNS_MCP_INT_RX_WL during the update slave
@@ -1740,7 +1771,11 @@ int sdw_cdns_probe(struct sdw_cdns *cdns)init_completion (&cdns->tx_complete); cdns->bus.port_ops = &cdns_port_ops; +mutex_init (&cdns->status_update_lock); +INIT_WORK (&cdns->work, cdns_update_slave_status_work); +INIT_DELAYED_WORK (&cdns->attach_dwork, cdns_check_attached_status_dwork); +return 0 ; }EXPORT_SYMBOL (sdw_cdns_probe);
drivers/soundwire/cadence_master.h +5 -0
@@ -117,6 +117,8 @@ struct sdw_cdns_dai_runtime {* @link_up: Link status * @msg_count: Messages sent on bus * @dai_runtime_array: runtime context for each allocated DAI. +* @status_update_lock: protect concurrency between interrupt-based and delayed work +* status update */ struct sdw_cdns {struct device *dev;
@@ -148,10 +150,13 @@ struct sdw_cdns {bool interrupt_enabled;struct work_struct work; +struct delayed_work attach_dwork;struct list_head list;struct sdw_cdns_dai_runtime **dai_runtime_array; + +struct mutex status_update_lock;/* add mutual exclusion to sdw_handle_slave_status() */ };#define bus_to_cdns (_bus) container_of(_bus, struct sdw_cdns, bus)
drivers/soundwire/intel.h +2 -0
@@ -103,6 +103,8 @@ static inline void intel_writew(void __iomem *base, int offset, u16 value)#define INTEL_MASTER_RESET_ITERATIONS 10 +#define SDW_INTEL_DELAYED_ENUMERATION_MS 100 +#define SDW_INTEL_CHECK_OPS (sdw, cb) ((sdw) && (sdw)->link_res && (sdw)->link_res->hw_ops && \ (sdw)->link_res->hw_ops->cb)#define SDW_INTEL_OPS (sdw, cb) ((sdw)->link_res->hw_ops->cb)
drivers/soundwire/intel_auxdevice.c +1 -0
@@ -475,6 +475,7 @@ static void intel_link_remove(struct auxiliary_device *auxdev)*/ if (!bus->prop.hw_disabled) {sdw_intel_debugfs_exit (sdw); +cancel_delayed_work_sync (&cdns->attach_dwork);sdw_cdns_enable_interrupt (cdns, false); }sdw_bus_master_delete (bus);
drivers/soundwire/intel_bus_common.c +11 -0
@@ -60,6 +60,9 @@ int intel_start_bus(struct sdw_intel *sdw)sdw_cdns_check_self_clearing_bits (cdns, __func__, true,INTEL_MASTER_RESET_ITERATIONS ); +schedule_delayed_work (&cdns->attach_dwork, +msecs_to_jiffies (SDW_INTEL_DELAYED_ENUMERATION_MS )); +return 0 ; }
@@ -151,6 +154,9 @@ int intel_start_bus_after_reset(struct sdw_intel *sdw) }sdw_cdns_check_self_clearing_bits (cdns, __func__, true,INTEL_MASTER_RESET_ITERATIONS ); +schedule_delayed_work (&cdns->attach_dwork, +msecs_to_jiffies (SDW_INTEL_DELAYED_ENUMERATION_MS )); +return 0 ; }
@@ -184,6 +190,9 @@ int intel_start_bus_after_clock_stop(struct sdw_intel *sdw)sdw_cdns_check_self_clearing_bits (cdns, __func__, true,INTEL_MASTER_RESET_ITERATIONS ); +schedule_delayed_work (&cdns->attach_dwork, +msecs_to_jiffies (SDW_INTEL_DELAYED_ENUMERATION_MS )); +return 0 ; }
@@ -194,6 +203,8 @@ int intel_stop_bus(struct sdw_intel *sdw, bool clock_stop)bool wake_enable = false;int ret; +cancel_delayed_work_sync (&cdns->attach_dwork); +if (clock_stop) { ret =sdw_cdns_clock_stop (cdns, true);if (ret <0 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/214 riscv/kexec_file: Fix relocation type R_RISCV_ADD16 and R_RISCV_SUB16 unknown
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ying Sun <[email protected]>
[ Upstream commit c6ebf2c528470a09be77d0d9df2c6617ea037ac5 ]
Runs on the kernel with CONFIG_RISCV_ALTERNATIVE enabled:
kexec -sl vmlinux
Error:
kexec_image: Unknown rela relocation: 34
kexec_image: Error loading purgatory ret=-8
and
kexec_image: Unknown rela relocation: 38
kexec_image: Error loading purgatory ret=-8
The purgatory code uses the 16-bit addition and subtraction relocation type, but not handled, resulting in kexec_file_load failure. So add handle to arch_kexec_apply_relocations_add().
Tested on RISC-V64 Qemu-virt, issue fixed.
--- arch/riscv/kernel/elf_kexec.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/riscv/kernel/elf_kexec.c +6 -0
@@ -451,6 +451,12 @@ int arch_kexec_apply_relocations_add(struct purgatory_info *pi, *(u32 *)loc =CLEAN_IMM (CJTYPE , *(u32 *)loc) |ENCODE_CJTYPE_IMM (val - addr);break ; +case R_RISCV_ADD16 : + *(u16 *)loc += val; +break ; +case R_RISCV_SUB16 : + *(u16 *)loc -= val; +break ;case R_RISCV_ADD32 : *(u32 *)loc += val;break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/214 media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunke Cao <[email protected]>
[ Upstream commit 6a9c97ab6b7e85697e0b74e86062192a5ffffd99 ]
Clear vb2_plane's memory related fields in __vb2_plane_dmabuf_put(), including bytesused, length, fd and data_offset.
Remove the duplicated code in __prepare_dmabuf().
--- drivers/media/common/videobuf2/videobuf2-core.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/media/common/videobuf2/videobuf2-core.c +4 -4
@@ -311,6 +311,10 @@ static void __vb2_plane_dmabuf_put(struct vb2_buffer *vb, struct vb2_plane *p) p->mem_priv =NULL ; p->dbuf =NULL ; p->dbuf_mapped =0 ; + p->bytesused =0 ; + p->length =0 ; + p->m.fd =0 ; + p->data_offset =0 ; }/*
@@ -1420,10 +1424,6 @@ static int __prepare_dmabuf(struct vb2_buffer *vb)/* Release previously acquired memory if present */ __vb2_plane_dmabuf_put (vb, &vb->planes[plane]); - vb->planes[plane].bytesused =0 ; - vb->planes[plane].length =0 ; - vb->planes[plane].m.fd =0 ; - vb->planes[plane].data_offset =0 ;/* Acquire each plane's memory */ mem_priv = call_ptr_memop(attach_dmabuf,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/214 remoteproc: imx_rproc: Use imx specific hook for find_loaded_rsc_table
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit e954a1bd16102abc800629f9900715d8ec4c3130 ]
If there is a resource table device tree node, use the address as the resource table address, otherwise use the address(where .resource_table section loaded) inside the Cortex-M elf file.
And there is an update in NXP SDK that Resource Domain Control(RDC) enabled to protect TCM, linux not able to write the TCM space when updating resource table status and cause kernel dump. So use the address from device tree could avoid kernel dump.
Note: NXP M4 SDK not check resource table update, so it does not matter use whether resource table address specified in elf file or in device tree. But to reflect the fact that if people specific resource table address in device tree, it means people are aware and going to use it, not the address specified in elf file.
--- drivers/remoteproc/imx_rproc.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/remoteproc/imx_rproc.c +12 -1
@@ -666,6 +666,17 @@ static struct resource_table *imx_rproc_get_loaded_rsc_table(struct rproc *rprocreturn (struct resource_table *)priv->rsc_table; } +static struct resource_table * +imx_rproc_elf_find_loaded_rsc_table (struct rproc *rproc,const struct firmware *fw) +{ +struct imx_rproc *priv = rproc->priv; + +if (priv->rsc_table) +return (struct resource_table *)priv->rsc_table; + +return rproc_elf_find_loaded_rsc_table (rproc, fw); +} +static const struct rproc_ops imx_rproc_ops = { .prepare = imx_rproc_prepare, .attach = imx_rproc_attach,
@@ -676,7 +687,7 @@ static const struct rproc_ops imx_rproc_ops = { .da_to_va = imx_rproc_da_to_va, .load = rproc_elf_load_segments, .parse_fw = imx_rproc_parse_fw, - .find_loaded_rsc_table = rproc_elf_find_loaded_rsc_table, + .find_loaded_rsc_table = imx_rproc_elf_find_loaded_rsc_table, .get_loaded_rsc_table = imx_rproc_get_loaded_rsc_table, .sanity_check = rproc_elf_sanity_check, .get_boot_addr = rproc_elf_get_boot_addr,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/214 clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit a54c441b46a0745683c2eef5a359d22856d27323 ]
For i.MX7D DRAM related mux clock, the clock source change should ONLY be done done in low level asm code without accessing DRAM, and then calling clk API to sync the HW clock status with clk tree, it should never touch real clock source switch via clk API, so CLK_SET_PARENT_GATE flag should NOT be added, otherwise, DRAM's clock parent will be disabled when DRAM is active, and system will hang.
--- drivers/clk/imx/clk-imx7d.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/imx/clk-imx7d.c +2 -2
@@ -498,9 +498,9 @@ static void __init imx7d_clocks_init(struct device_node *ccm_node) hws[IMX7D_ENET_AXI_ROOT_SRC ] =imx_clk_hw_mux2_flags ("enet_axi_src" , base +0x8900 ,24 ,3 , enet_axi_sel,ARRAY_SIZE (enet_axi_sel),CLK_SET_PARENT_GATE ); hws[IMX7D_NAND_USDHC_BUS_ROOT_SRC ] =imx_clk_hw_mux2_flags ("nand_usdhc_src" , base +0x8980 ,24 ,3 , nand_usdhc_bus_sel,ARRAY_SIZE (nand_usdhc_bus_sel),CLK_SET_PARENT_GATE ); hws[IMX7D_DRAM_PHYM_ROOT_SRC ] =imx_clk_hw_mux2_flags ("dram_phym_src" , base +0x9800 ,24 ,1 , dram_phym_sel,ARRAY_SIZE (dram_phym_sel),CLK_SET_PARENT_GATE ); - hws[IMX7D_DRAM_ROOT_SRC ] =imx_clk_hw_mux2_flags ("dram_src" , base +0x9880 ,24 ,1 , dram_sel,ARRAY_SIZE (dram_sel),CLK_SET_PARENT_GATE ); + hws[IMX7D_DRAM_ROOT_SRC ] =imx_clk_hw_mux2 ("dram_src" , base +0x9880 ,24 ,1 , dram_sel,ARRAY_SIZE (dram_sel)); hws[IMX7D_DRAM_PHYM_ALT_ROOT_SRC ] =imx_clk_hw_mux2_flags ("dram_phym_alt_src" , base +0xa000 ,24 ,3 , dram_phym_alt_sel,ARRAY_SIZE (dram_phym_alt_sel),CLK_SET_PARENT_GATE ); - hws[IMX7D_DRAM_ALT_ROOT_SRC ] =imx_clk_hw_mux2_flags ("dram_alt_src" , base +0xa080 ,24 ,3 , dram_alt_sel,ARRAY_SIZE (dram_alt_sel),CLK_SET_PARENT_GATE ); + hws[IMX7D_DRAM_ALT_ROOT_SRC ] =imx_clk_hw_mux2 ("dram_alt_src" , base +0xa080 ,24 ,3 , dram_alt_sel,ARRAY_SIZE (dram_alt_sel)); hws[IMX7D_USB_HSIC_ROOT_SRC ] =imx_clk_hw_mux2_flags ("usb_hsic_src" , base +0xa100 ,24 ,3 , usb_hsic_sel,ARRAY_SIZE (usb_hsic_sel),CLK_SET_PARENT_GATE ); hws[IMX7D_PCIE_CTRL_ROOT_SRC ] =imx_clk_hw_mux2_flags ("pcie_ctrl_src" , base +0xa180 ,24 ,3 , pcie_ctrl_sel,ARRAY_SIZE (pcie_ctrl_sel),CLK_SET_PARENT_GATE ); hws[IMX7D_PCIE_PHY_ROOT_SRC ] =imx_clk_hw_mux2_flags ("pcie_phy_src" , base +0xa200 ,24 ,3 , pcie_phy_sel,ARRAY_SIZE (pcie_phy_sel),CLK_SET_PARENT_GATE );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/214 serial: protect uart_port_dtr_rts() in uart_shutdown() too
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <[email protected]>
[ Upstream commit 602babaa84d627923713acaf5f7e9a4369e77473 ]
Commit af224ca2df29 (serial: core: Prevent unsafe uart port access, part
3) added few uport == NULL checks. It added one to uart_shutdown(), so the commit assumes, uport can be NULL in there. But right after that protection, there is an unprotected "uart_port_dtr_rts(uport, false);" call. That is invoked only if HUPCL is set, so I assume that is the reason why we do not see lots of these reports.
Or it cannot be NULL at this point at all for some reason :P.
Until the above is investigated, stay on the safe side and move this dereference to the if too.
I got this inconsistency from Coverity under CID 1585130. Thanks.
--- drivers/tty/serial/serial_core.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/tty/serial/serial_core.c +9 -7
@@ -407,14 +407,16 @@ static void uart_shutdown(struct tty_struct *tty, struct uart_state *state)/* * Turn off DTR and RTS early. */ -if (uport &&uart_console (uport) && tty) { - uport->cons->cflag = tty->termios.c_cflag; - uport->cons->ispeed = tty->termios.c_ispeed; - uport->cons->ospeed = tty->termios.c_ospeed; - } +if (uport) { +if (uart_console (uport) && tty) { + uport->cons->cflag = tty->termios.c_cflag; + uport->cons->ispeed = tty->termios.c_ispeed; + uport->cons->ospeed = tty->termios.c_ospeed; + } -if (!tty ||C_HUPCL (tty)) -uart_port_dtr_rts (uport, false); +if (!tty ||C_HUPCL (tty)) +uart_port_dtr_rts (uport, false); + }uart_port_shutdown (port); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/214 usb: typec: tipd: Free IRQ only if it was requested before
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wadim Egorov <[email protected]>
[ Upstream commit db63d9868f7f310de44ba7bea584e2454f8b4ed0 ]
In polling mode, if no IRQ was requested there is no need to free it. Call devm_free_irq() only if client->irq is set. This fixes the warning caused by the tps6598x module removal:
WARNING: CPU: 2 PID: 333 at kernel/irq/devres.c:144 devm_free_irq+0x80/0x8c ... ... Call trace: devm_free_irq+0x80/0x8c tps6598x_remove+0x28/0x88 [tps6598x] i2c_device_remove+0x2c/0x9c device_remove+0x4c/0x80 device_release_driver_internal+0x1cc/0x228 driver_detach+0x50/0x98 bus_remove_driver+0x6c/0xbc driver_unregister+0x30/0x60 i2c_del_driver+0x54/0x64 tps6598x_i2c_driver_exit+0x18/0xc3c [tps6598x] __arm64_sys_delete_module+0x184/0x264 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0xc8/0xe8 do_el0_svc+0x20/0x2c el0_svc+0x28/0x98 el0t_64_sync_handler+0x13c/0x158 el0t_64_sync+0x190/0x194
--- drivers/usb/typec/tipd/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/typec/tipd/core.c +2 -1
@@ -1465,8 +1465,9 @@ static void tps6598x_remove(struct i2c_client *client)if (!client->irq)cancel_delayed_work_sync (&tps->wq_poll); +else +devm_free_irq (tps->dev, client->irq, tps); -devm_free_irq (tps->dev, client->irq, tps);tps6598x_disconnect (tps,0 );typec_unregister_port (tps->port);usb_role_switch_put (tps->role_sw);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/214 usb: typec: ucsi: Dont truncate the reads
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heikki Krogerus <[email protected]>
[ Upstream commit 1d05c382ddb4e43ce251a50f308df5e42a2f6088 ]
That may silently corrupt the data. Instead, failing attempts to read more than the interface can handle.
--- drivers/usb/typec/ucsi/ucsi.c | 8 ++------ drivers/usb/typec/ucsi/ucsi.h | 2 ++ 2 files changed, 4 insertions(+), 6 deletions(-)
drivers/usb/typec/ucsi/ucsi.c +2 -6
@@ -103,12 +103,8 @@ static int ucsi_run_command(struct ucsi *ucsi, u64 command, u32 *cci, *cci =0 ; -/* -* Below UCSI 2.0, MESSAGE_IN was limited to 16 bytes. Truncate the -* reads here. -*/ -if (ucsi->version <=UCSI_VERSION_1_2 ) - size =clamp (size,0 ,16 ); +if (size >UCSI_MAX_DATA_LENGTH (ucsi)) +return -EINVAL ; ret = ucsi->ops->sync_control (ucsi, command);if (ucsi->ops->read_cci (ucsi, cci))
drivers/usb/typec/ucsi/ucsi.h +2 -0
@@ -435,6 +435,8 @@ struct ucsi {#define UCSI_DELAY_DEVICE_PDOS BIT(1)/* Reading PDOs fails until the parter is in PD mode */ }; +#define UCSI_MAX_DATA_LENGTH (u) (((u)->version < UCSI_VERSION_2_0) ? 0x10 : 0xff) +#define UCSI_MAX_SVID 5#define UCSI_MAX_ALTMODES (UCSI_MAX_SVID * 6)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/214 usb: chipidea: udc: enable suspend interrupt after usb reset
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
[ Upstream commit e4fdcc10092fb244218013bfe8ff01c55d54e8e4 ]
Currently, suspend interrupt is enabled before pullup enable operation. This will cause a suspend interrupt assert right after pullup DP. This suspend interrupt is meaningless, so this will ignore such interrupt by enable it after usb reset completed.
--- drivers/usb/chipidea/udc.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/usb/chipidea/udc.c +7 -1
@@ -86,7 +86,7 @@ static int hw_device_state(struct ci_hdrc *ci, u32 dma)hw_write (ci,OP_ENDPTLISTADDR , ~0 , dma);/* interrupt, error, port change, reset, sleep/suspend */ hw_write (ci,OP_USBINTR , ~0 , - USBi_UI|USBi_UEI|USBi_PCI|USBi_URI|USBi_SLI); + USBi_UI|USBi_UEI|USBi_PCI|USBi_URI); }else {hw_write (ci,OP_USBINTR , ~0 ,0 ); }
@@ -877,6 +877,7 @@ __releases(ci->lock) __acquires(ci->lock) {int retval; +u32 intr;spin_unlock (&ci->lock);if (ci->gadget.speed !=USB_SPEED_UNKNOWN )
@@ -890,6 +891,11 @@ __acquires(ci->lock)if (retval) goto done; +/* clear SLI */ +hw_write (ci,OP_USBSTS , USBi_SLI, USBi_SLI); + intr =hw_read (ci,OP_USBINTR , ~0 ); +hw_write (ci,OP_USBINTR , ~0 , intr | USBi_SLI); + ci->status =usb_ep_alloc_request (&ci->ep0in->ep,GFP_ATOMIC );if (ci->status ==NULL ) retval = -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/214 usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the Crashkernel Scenario
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Shao <[email protected]>
[ Upstream commit 4058c39bd176daf11a826802d940d86292a6b02b ]
The issue is that before entering the crash kernel, the DWC USB controller did not perform operations such as resetting the interrupt mask bits. After entering the crash kernel,before the USB interrupt handler registration was completed while loading the DWC USB driver,an GINTSTS_SOF interrupt was received.This triggered the misroute_irq process within the GIC handling framework,ultimately leading to the misrouting of the interrupt,causing it to be handled by the wrong interrupt handler and resulting in the issue.
Summary:In a scenario where the kernel triggers a panic and enters the crash kernel,it is necessary to ensure that the interrupt mask bit is not enabled before the interrupt registration is complete. If an interrupt reaches the CPU at this moment,it will certainly not be handled correctly,especially in cases where this interrupt is reported frequently.
Please refer to the Crashkernel dmesg information as follows (the message on line 3 was added before devm_request_irq is called by the dwc2_driver_probe function):
[ 5.866837][ T1] dwc2 JMIC0010:01: supply vusb_d not found, using dummy regulator [ 5.874588][ T1] dwc2 JMIC0010:01: supply vusb_a not found, using dummy regulator [ 5.882335][ T1] dwc2 JMIC0010:01: before devm_request_irq irq: [71], gintmsk[0xf300080e], gintsts[0x04200009] [ 5.892686][ C0] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.10.0-jmnd1.2_RC #18 [ 5.900327][ C0] Hardware name: CMSS HyperCard4-25G/HyperCard4-25G, BIOS 1.6.4 Jul 8 2024 [ 5.908836][ C0] Call trace: [ 5.911965][ C0] dump_backtrace+0x0/0x1f0 [ 5.916308][ C0] show_stack+0x20/0x30 [ 5.920304][ C0] dump_stack+0xd8/0x140 [ 5.924387][ C0] pcie_xxx_handler+0x3c/0x1d8 [ 5.930121][ C0] __handle_irq_event_percpu+0x64/0x1e0 [ 5.935506][ C0] handle_irq_event+0x80/0x1d0 [ 5.940109][ C0] try_one_irq+0x138/0x174 [ 5.944365][ C0] misrouted_irq+0x134/0x140 [ 5.948795][ C0] note_interrupt+0x1d0/0x30c [ 5.953311][ C0] handle_irq_event+0x13c/0x1d0 [ 5.958001][ C0] handle_fasteoi_irq+0xd4/0x260 [ 5.962779][ C0] __handle_domain_irq+0x88/0xf0 [ 5.967555][ C0] gic_handle_irq+0x9c/0x2f0 [ 5.971985][ C0] el1_irq+0xb8/0x140 [ 5.975807][ C0] __setup_irq+0x3dc/0x7cc [ 5.980064][ C0] request_threaded_irq+0xf4/0x1b4 [ 5.985015][ C0] devm_request_threaded_irq+0x80/0x100 [ 5.990400][ C0] dwc2_driver_probe+0x1b8/0x6b0 [ 5.995178][ C0] platform_drv_probe+0x5c/0xb0 [ 5.999868][ C0] really_probe+0xf8/0x51c [ 6.004125][ C0] driver_probe_device+0xfc/0x170 [ 6.008989][ C0] device_driver_attach+0xc8/0xd0 [ 6.013853][ C0] __driver_attach+0xe8/0x1b0 [ 6.018369][ C0] bus_for_each_dev+0x7c/0xdc [ 6.022886][ C0] driver_attach+0x2c/0x3c [ 6.027143][ C0] bus_add_driver+0xdc/0x240 [ 6.031573][ C0] driver_register+0x80/0x13c [ 6.036090][ C0] __platform_driver_register+0x50/0x5c [ 6.041476][ C0] dwc2_platform_driver_init+0x24/0x30 [ 6.046774][ C0] do_one_initcall+0x50/0x25c [ 6.051291][ C0] do_initcall_level+0xe4/0xfc [ 6.055894][ C0] do_initcalls+0x80/0xa4 [ 6.060064][ C0] kernel_init_freeable+0x198/0x240 [ 6.065102][ C0] kernel_init+0x1c/0x12c
--- drivers/usb/dwc2/platform.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-)
drivers/usb/dwc2/platform.c +14 -12
@@ -469,18 +469,6 @@ static int dwc2_driver_probe(struct platform_device *dev)spin_lock_init (&hsotg->lock); - hsotg->irq =platform_get_irq (dev,0 ); -if (hsotg->irq <0 ) -return hsotg->irq; - -dev_dbg (hsotg->dev,"registering common handler for irq%d\n" , - hsotg->irq); - retval =devm_request_irq (hsotg->dev, hsotg->irq, - dwc2_handle_common_intr,IRQF_SHARED , -dev_name (hsotg->dev), hsotg); -if (retval) -return retval; - hsotg->vbus_supply =devm_regulator_get_optional (hsotg->dev,"vbus" );if (IS_ERR (hsotg->vbus_supply)) { retval =PTR_ERR (hsotg->vbus_supply);
@@ -524,6 +512,20 @@ static int dwc2_driver_probe(struct platform_device *dev)if (retval) goto error; + hsotg->irq =platform_get_irq (dev,0 ); +if (hsotg->irq <0 ) { + retval = hsotg->irq; + goto error; + } + +dev_dbg (hsotg->dev,"registering common handler for irq%d\n" , + hsotg->irq); + retval =devm_request_irq (hsotg->dev, hsotg->irq, + dwc2_handle_common_intr,IRQF_SHARED , +dev_name (hsotg->dev), hsotg); +if (retval) + goto error; +/* * For OTG cores, set the force mode bits to reflect the value * of dr_mode. Force mode bits should not be touched at any
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/214 xhci: dbc: Fix STALL transfer event handling
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
[ Upstream commit 9044ad57b60b0556d42b6f8aa218a68865e810a4 ]
Don't flush all pending DbC data requests when an endpoint halts.
An endpoint may halt and xHC DbC triggers a STALL error event if there's an issue with a bulk data transfer. The transfer should restart once xHC DbC receives a ClearFeature(ENDPOINT_HALT) request from the host.
Once xHC DbC restarts it will start from the TRB pointed to by dequeue field in the endpoint context, which might be the same TRB we got the STALL event for. Turn the TRB to a no-op in this case to make sure xHC DbC doesn't reuse and tries to retransmit this same TRB after we already handled it, and gave its corresponding data request back.
Other STALL events might be completely bogus.
Lukasz Bartosik discovered that xHC DbC might issue spurious STALL events if hosts sends a ClearFeature(ENDPOINT_HALT) request to non-halted endpoints even without any active bulk transfers.
Assume STALL event is spurious if it reports 0 bytes transferred, and the endpoint stopped on the STALLED TRB.
Don't give back the data request corresponding to the TRB in this case.
The halted status is per endpoint. Track it with a per endpoint flag instead of the driver invented DbC wide DS_STALLED state. DbC remains in DbC-Configured state even if endpoints halt. There is no Stalled state in the DbC Port state Machine (xhci section 7.6.6)
--- drivers/usb/host/xhci-dbgcap.c | 133 ++++++++++++++++++++------------- drivers/usb/host/xhci-dbgcap.h | 2 +- 2 files changed, 83 insertions(+), 52 deletions(-)
drivers/usb/host/xhci-dbgcap.c +82 -51
@@ -173,16 +173,18 @@ static void xhci_dbc_giveback(struct dbc_request *req, int status)spin_lock (&dbc->lock); } -static void xhci_dbc_flush_single_request (struct dbc_request *req) +static void trb_to_noop (union xhci_trb *trb) { -union xhci_trb *trb = req->trb; - trb->generic.field[0 ] =0 ; trb->generic.field[1 ] =0 ; trb->generic.field[2 ] =0 ; trb->generic.field[3 ] &=cpu_to_le32 (TRB_CYCLE ); trb->generic.field[3 ] |=cpu_to_le32 (TRB_TYPE (TRB_TR_NOOP )); +} +static void xhci_dbc_flush_single_request (struct dbc_request *req) +{ +trb_to_noop (req->trb);xhci_dbc_giveback (req, -ESHUTDOWN ); }
@@ -649,7 +651,6 @@ static void xhci_dbc_stop(struct xhci_dbc *dbc)case DS_DISABLED :return ;case DS_CONFIGURED : -case DS_STALLED :if (dbc->driver->disconnect) dbc->driver->disconnect (dbc);break ;
@@ -669,6 +670,23 @@ static void xhci_dbc_stop(struct xhci_dbc *dbc)pm_runtime_put_sync (dbc->dev);/* note, was self.controller */ } +static void +handle_ep_halt_changes (struct xhci_dbc *dbc,struct dbc_ep *dep,bool halted) +{ +if (halted) { +dev_info (dbc->dev,"DbC Endpoint halted\n" ); + dep->halted =1 ; + + }else if (dep->halted) { +dev_info (dbc->dev,"DbC Endpoint halt cleared\n" ); + dep->halted =0 ; + +if (!list_empty (&dep->list_pending)) +writel (DBC_DOOR_BELL_TARGET (dep->direction), + &dbc->regs->doorbell); + } +} +static void dbc_handle_port_status (struct xhci_dbc *dbc,union xhci_trb *event) {
@@ -697,6 +715,7 @@ static void dbc_handle_xfer_event(struct xhci_dbc *dbc, union xhci_trb *event)struct xhci_ring *ring;int ep_id;int status; +struct xhci_ep_ctx *ep_ctx;u32 comp_code;size_t remain_length;struct dbc_request *req =NULL , *r;
@@ -706,8 +725,30 @@ static void dbc_handle_xfer_event(struct xhci_dbc *dbc, union xhci_trb *event) ep_id =TRB_TO_EP_ID (le32_to_cpu (event->generic.field[3 ])); dep = (ep_id ==EPID_OUT ) ?get_out_ep (dbc) :get_in_ep (dbc); + ep_ctx = (ep_id ==EPID_OUT ) ? +dbc_bulkout_ctx (dbc) :dbc_bulkin_ctx (dbc); ring = dep->ring; +/* Match the pending request: */ +list_for_each_entry (r, &dep->list_pending, list_pending) { +if (r->trb_dma == event->trans_event.buffer) { + req = r; +break ; + } +if (r->status == -COMP_STALL_ERROR ) { +dev_warn (dbc->dev,"Give back stale stalled req\n" ); + ring->num_trbs_free++; +xhci_dbc_giveback (r,0 ); + } + } + +if (!req) { +dev_warn (dbc->dev,"no matched request\n" ); +return ; + } + +trace_xhci_dbc_handle_transfer (ring, &req->trb->generic); +switch (comp_code) {case COMP_SUCCESS : remain_length =0 ;
@@ -718,31 +759,49 @@ static void dbc_handle_xfer_event(struct xhci_dbc *dbc, union xhci_trb *event)case COMP_TRB_ERROR :case COMP_BABBLE_DETECTED_ERROR :case COMP_USB_TRANSACTION_ERROR : -case COMP_STALL_ERROR :dev_warn (dbc->dev,"tx error %d detected\n" , comp_code); status = -comp_code;break ; +case COMP_STALL_ERROR : +dev_warn (dbc->dev,"Stall error at bulk TRB %llx, remaining %zu, ep deq %llx\n" , + event->trans_event.buffer, remain_length, ep_ctx->deq); + status =0 ; + dep->halted =1 ; + +/* +* xHC DbC may trigger a STALL bulk xfer event when host sends a +* ClearFeature(ENDPOINT_HALT) request even if there wasn't an +* active bulk transfer. +* +* Don't give back this transfer request as hardware will later +* start processing TRBs starting from this 'STALLED' TRB, +* causing TRBs and requests to be out of sync. +* +* If STALL event shows some bytes were transferred then assume +* it's an actual transfer issue and give back the request. +* In this case mark the TRB as No-Op to avoid hw from using the +* TRB again. +*/ + +if ((ep_ctx->deq & ~TRB_CYCLE ) == event->trans_event.buffer) { +dev_dbg (dbc->dev,"Ep stopped on Stalled TRB\n" ); +if (remain_length == req->length) { +dev_dbg (dbc->dev,"Spurious stall event, keep req\n" ); + req->status = -COMP_STALL_ERROR ; + req->actual =0 ; +return ; + } +dev_dbg (dbc->dev,"Give back stalled req, but turn TRB to No-op\n" ); +trb_to_noop (req->trb); + } +break ; +default :dev_err (dbc->dev,"unknown tx error %d\n" , comp_code); status = -comp_code;break ; } -/* Match the pending request: */ -list_for_each_entry (r, &dep->list_pending, list_pending) { -if (r->trb_dma == event->trans_event.buffer) { - req = r; -break ; - } - } - -if (!req) { -dev_warn (dbc->dev,"no matched request\n" ); -return ; - } - -trace_xhci_dbc_handle_transfer (ring, &req->trb->generic); - ring->num_trbs_free++; req->actual = req->length - remain_length;xhci_dbc_giveback (req, status);
@@ -762,7 +821,6 @@ static void inc_evt_deq(struct xhci_ring *ring)static enum evtreturn xhci_dbc_do_handle_events (struct xhci_dbc *dbc) {dma_addr_t deq; -struct dbc_ep *dep;union xhci_trb *evt;u32 ctrl, portsc;bool update_erdp = false;
@@ -814,43 +872,17 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc)return EVT_DISC ; } -/* Handle endpoint stall event: */ +/* Check and handle changes in endpoint halt status */ ctrl =readl (&dbc->regs->control); -if ((ctrl &DBC_CTRL_HALT_IN_TR ) || - (ctrl &DBC_CTRL_HALT_OUT_TR )) { -dev_info (dbc->dev,"DbC Endpoint stall\n" ); - dbc->state =DS_STALLED ; - -if (ctrl &DBC_CTRL_HALT_IN_TR ) { - dep =get_in_ep (dbc); -xhci_dbc_flush_endpoint_requests (dep); - } - -if (ctrl &DBC_CTRL_HALT_OUT_TR ) { - dep =get_out_ep (dbc); -xhci_dbc_flush_endpoint_requests (dep); - } - -return EVT_DONE ; - } +handle_ep_halt_changes (dbc,get_in_ep (dbc), ctrl &DBC_CTRL_HALT_IN_TR ); +handle_ep_halt_changes (dbc,get_out_ep (dbc), ctrl &DBC_CTRL_HALT_OUT_TR );/* Clear DbC run change bit: */ if (ctrl &DBC_CTRL_DBC_RUN_CHANGE ) {writel (ctrl, &dbc->regs->control); ctrl =readl (&dbc->regs->control); } -break ; -case DS_STALLED : - ctrl =readl (&dbc->regs->control); -if (!(ctrl &DBC_CTRL_HALT_IN_TR ) && - !(ctrl &DBC_CTRL_HALT_OUT_TR ) && - (ctrl &DBC_CTRL_DBC_RUN )) { - dbc->state =DS_CONFIGURED ; -break ; - } - -return EVT_DONE ;default :dev_err (dbc->dev,"Unknown DbC state %d\n" , dbc->state);break ;
@@ -939,7 +971,6 @@ static const char * const dbc_state_strings[DS_MAX] = { [DS_ENABLED] = "enabled", [DS_CONNECTED] = "connected", [DS_CONFIGURED] = "configured", - [DS_STALLED] = "stalled", }; static ssize_t dbc_show(struct device *dev,
drivers/usb/host/xhci-dbgcap.h +1 -1
@@ -81,7 +81,6 @@ enum dbc_state {DS_ENABLED ,DS_CONNECTED ,DS_CONFIGURED , -DS_STALLED , DS_MAX };
@@ -90,6 +89,7 @@ struct dbc_ep {struct list_head list_pending;struct xhci_ring *ring; unsigned int direction:1; + unsigned int halted:1; };#define DBC_QUEUE_SIZE 16
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/214 usb: host: xhci-plat: Parse xhci-missing_cas_quirk and apply quirk
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
[ Upstream commit a6cd2b3fa89468b5f28b83d211bd25cc589f9eba ]
Parse software managed property 'xhci-skip-phy-init-quirk' and 'xhci-skip-phy-init-quirk' to apply related quirk. It allows usb glue layer driver apply these quirk.
--- drivers/usb/host/xhci-plat.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/host/xhci-plat.c +6 -0
@@ -259,6 +259,12 @@ int xhci_plat_probe(struct platform_device *pdev, struct device *sysdev, const sif (device_property_read_bool (tmpdev,"write-64-hi-lo-quirk" )) xhci->quirks |=XHCI_WRITE_64_HI_LO ; +if (device_property_read_bool (tmpdev,"xhci-missing-cas-quirk" )) + xhci->quirks |=XHCI_MISSING_CAS ; + +if (device_property_read_bool (tmpdev,"xhci-skip-phy-init-quirk" )) + xhci->quirks |=XHCI_SKIP_PHY_INIT ; +device_property_read_u32 (tmpdev,"imod-interval-ns" , &xhci->imod_interval); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/214 comedi: ni_routing: tools: Check when the file could not be opened
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruffalo Lavoisier <[email protected]>
[ Upstream commit 5baeb157b341b1d26a5815aeaa4d3bb9e0444fda ]
- After fopen check NULL before using the file pointer use
--- drivers/comedi/drivers/ni_routing/tools/convert_c_to_py.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/comedi/drivers/ni_routing/tools/convert_c_to_py.c +5 -0
@@ -140,6 +140,11 @@ int main(void) {FILE *fp =fopen ("ni_values.py" ,"w" ); +if (fp ==NULL ) { +fprintf (stderr,"Could not open file!" ); +return -1 ; + } +/* write route register values */ fprintf (fp,"ni_route_values = {\n" );for (int i =0 ; ni_all_route_values[i]; ++i)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/214 LoongArch: Fix memleak in pci_acpi_scan_root()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Guan <[email protected]>
[ Upstream commit 5016c3a31a6d74eaf2fdfdec673eae8fcf90379e ]
Add kfree(root_ops) in this case to avoid memleak of root_ops, leaks when pci_find_bus() != 0.
--- arch/loongarch/pci/acpi.c | 1 + 1 file changed, 1 insertion(+)
arch/loongarch/pci/acpi.c +1 -0
@@ -225,6 +225,7 @@ struct pci_bus *pci_acpi_scan_root(struct acpi_pci_root *root)if (bus) {memcpy (bus->sysdata, info->cfg,sizeof (struct pci_config_window ));kfree (info); +kfree (root_ops); }else {struct pci_bus *child;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/214 netfilter: nf_nat: dont try nat source port reallocation for reverse dir clash
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit d8f84a9bc7c4e07fdc4edc00f9e868b8db974ccb ]
A conntrack entry can be inserted to the connection tracking table if there is no existing entry with an identical tuple in either direction.
Example:
INITIATOR -> NAT/PAT -> RESPONDER
Initiator passes through NAT/PAT ("us") and SNAT is done (saddr rewrite). Then, later, NAT/PAT machine itself also wants to connect to RESPONDER.
This will not work if the SNAT done earlier has same IP:PORT source pair.
Conntrack table has:
ORIGINAL: $IP_INITATOR:$SPORT -> $IP_RESPONDER:$DPORT REPLY: $IP_RESPONDER:$DPORT -> $IP_NAT:$SPORT
and new locally originating connection wants:
ORIGINAL: $IP_NAT:$SPORT -> $IP_RESPONDER:$DPORT REPLY: $IP_RESPONDER:$DPORT -> $IP_NAT:$SPORT
This is handled by the NAT engine which will do a source port reallocation for the locally originating connection that is colliding with an existing tuple by attempting a source port rewrite.
This is done even if this new connection attempt did not go through a masquerade/snat rule.
There is a rare race condition with connection-less protocols like UDP, where we do the port reallocation even though its not needed.
This happens when new packets from the same, pre-existing flow are received in both directions at the exact same time on different CPUs after the conntrack table was flushed (or conntrack becomes active for first time).
With strict ordering/single cpu, the first packet creates new ct entry and second packet is resolved as established reply packet.
With parallel processing, both packets are picked up as new and both get their own ct entry.
In this case, the 'reply' packet (picked up as ORIGINAL) can be mangled by NAT engine because a port collision is detected.
This change isn't enough to prevent a packet drop later during nf_conntrack_confirm(), the existing clash resolution strategy will not detect such reverse clash case. This is resolved by a followup patch.
--- net/netfilter/nf_nat_core.c | 120 +++++++++++++++++++++++++++++++++++- 1 file changed, 118 insertions(+), 2 deletions(-)
net/netfilter/nf_nat_core.c +118 -2
@@ -183,7 +183,35 @@ hash_by_src(const struct net *net,return reciprocal_scale (hash, nf_nat_htable_size); } -/* Is this tuple already taken? (not by us) */ +/** +* nf_nat_used_tuple - check if proposed nat tuple clashes with existing entry +* @tuple: proposed NAT binding +* @ignored_conntrack: our (unconfirmed) conntrack entry +* +* A conntrack entry can be inserted to the connection tracking table +* if there is no existing entry with an identical tuple in either direction. +* +* Example: +* INITIATOR -> NAT/PAT -> RESPONDER +* +* INITIATOR passes through NAT/PAT ("us") and SNAT is done (saddr rewrite). +* Then, later, NAT/PAT itself also connects to RESPONDER. +* +* This will not work if the SNAT done earlier has same IP:PORT source pair. +* +* Conntrack table has: +* ORIGINAL: $IP_INITIATOR:$SPORT -> $IP_RESPONDER:$DPORT +* REPLY: $IP_RESPONDER:$DPORT -> $IP_NAT:$SPORT +* +* and new locally originating connection wants: +* ORIGINAL: $IP_NAT:$SPORT -> $IP_RESPONDER:$DPORT +* REPLY: $IP_RESPONDER:$DPORT -> $IP_NAT:$SPORT +* +* ... which would mean incoming packets cannot be distinguished between +* the existing and the newly added entry (identical IP_CT_DIR_REPLY tuple). +* +* @return: true if the proposed NAT mapping collides with an existing entry. +*/ static int nf_nat_used_tuple (const struct nf_conntrack_tuple *tuple,const struct nf_conn *ignored_conntrack)
@@ -200,6 +228,94 @@ nf_nat_used_tuple(const struct nf_conntrack_tuple *tuple,return nf_conntrack_tuple_taken (&reply, ignored_conntrack); } +static bool nf_nat_allow_clash (const struct nf_conn *ct) +{ +return nf_ct_l4proto_find (nf_ct_protonum (ct))->allow_clash; +} + +/** +* nf_nat_used_tuple_new - check if to-be-inserted conntrack collides with existing entry +* @tuple: proposed NAT binding +* @ignored_ct: our (unconfirmed) conntrack entry +* +* Same as nf_nat_used_tuple, but also check for rare clash in reverse +* direction. Should be called only when @tuple has not been altered, i.e. +* @ignored_conntrack will not be subject to NAT. +* +* @return: true if the proposed NAT mapping collides with existing entry. +*/ +static noinline bool +nf_nat_used_tuple_new (const struct nf_conntrack_tuple *tuple, +const struct nf_conn *ignored_ct) +{ +static const unsigned long uses_nat =IPS_NAT_MASK |IPS_SEQ_ADJUST_BIT ; +const struct nf_conntrack_tuple_hash *thash; +const struct nf_conntrack_zone *zone; +struct nf_conn *ct; +bool taken = true; +struct net *net; + +if (!nf_nat_used_tuple (tuple, ignored_ct)) +return false; + +if (!nf_nat_allow_clash (ignored_ct)) +return true; + +/* Initial choice clashes with existing conntrack. +* Check for (rare) reverse collision. +* +* This can happen when new packets are received in both directions +* at the exact same time on different CPUs. +* +* Without SMP, first packet creates new conntrack entry and second +* packet is resolved as established reply packet. +* +* With parallel processing, both packets could be picked up as +* new and both get their own ct entry allocated. +* +* If ignored_conntrack and colliding ct are not subject to NAT then +* pretend the tuple is available and let later clash resolution +* handle this at insertion time. +* +* Without it, the 'reply' packet has its source port rewritten +* by nat engine. +*/ +if (READ_ONCE (ignored_ct->status) & uses_nat) +return true; + + net =nf_ct_net (ignored_ct); + zone =nf_ct_zone (ignored_ct); + + thash =nf_conntrack_find_get (net, zone, tuple); +if (unlikely (!thash))/* clashing entry went away */ +return false; + + ct =nf_ct_tuplehash_to_ctrack (thash); + +/* NB: IP_CT_DIR_ORIGINAL should be impossible because +* nf_nat_used_tuple() handles origin collisions. +* +* Handle remote chance other CPU confirmed its ct right after. +*/ +if (thash->tuple.dst.dir !=IP_CT_DIR_REPLY ) + goto out; + +/* clashing connection subject to NAT? Retry with new tuple. */ +if (READ_ONCE (ct->status) & uses_nat) + goto out; + +if (nf_ct_tuple_equal (&ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple, + &ignored_ct->tuplehash[IP_CT_DIR_REPLY ].tuple) && +nf_ct_tuple_equal (&ct->tuplehash[IP_CT_DIR_REPLY ].tuple, + &ignored_ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple)) { + taken = false; + goto out; + } +out: +nf_ct_put (ct); +return taken; +} +static bool nf_nat_may_kill (struct nf_conn *ct,unsigned long flags) { static const unsigned long flags_refuse = IPS_FIXED_TIMEOUT |
@@ -611,7 +727,7 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple, !(range->flags & NF_NAT_RANGE_PROTO_RANDOM_ALL)) {/* try the original tuple first */ if (nf_in_range (orig_tuple, range)) { -if (!nf_nat_used_tuple (orig_tuple, ct)) { +if (!nf_nat_used_tuple_new (orig_tuple, ct)) { *tuple = *orig_tuple;return ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/214 netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit fc56878ca1c288e49b5cbb43860a5938e3463654 ]
If CONFIG_BRIDGE_NETFILTER is not enabled, which is the case for x86_64 defconfig, then building nf_reject_ipv4.c and nf_reject_ipv6.c with W=1 using gcc-14 results in the following warnings, which are treated as errors:
net/ipv4/netfilter/nf_reject_ipv4.c: In function 'nf_send_reset':net/ipv4/netfilter/nf_reject_ipv4.c:243:23: error: variable 'niph' set but not used [-Werror=unused-but-set-variable]
243 | struct iphdr *niph;
| ^~~~
cc1: all warnings being treated as errorsnet/ipv6/netfilter/nf_reject_ipv6.c: In function 'nf_send_reset6':net/ipv6/netfilter/nf_reject_ipv6.c:286:25: error: variable 'ip6h' set but not used [-Werror=unused-but-set-variable]
286 | struct ipv6hdr *ip6h;
| ^~~~
cc1: all warnings being treated as errors
Address this by reducing the scope of these local variables to where they are used, which is code only compiled when CONFIG_BRIDGE_NETFILTER enabled.
Compile tested and run through netfilter selftests.
--- net/ipv4/netfilter/nf_reject_ipv4.c | 10 ++++------ net/ipv6/netfilter/nf_reject_ipv6.c | 5 ++--- 2 files changed, 6 insertions(+), 9 deletions(-)
net/ipv4/netfilter/nf_reject_ipv4.c +4 -6
@@ -239,9 +239,8 @@ static int nf_reject_fill_skb_dst(struct sk_buff *skb_in)void nf_send_reset (struct net *net,struct sock *sk,struct sk_buff *oldskb,int hook) { -struct sk_buff *nskb; -struct iphdr *niph;const struct tcphdr *oth; +struct sk_buff *nskb;struct tcphdr _oth; oth =nf_reject_ip_tcphdr_get (oldskb, &_oth, hook);
@@ -266,14 +265,12 @@ void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb, nskb->mark =IP4_REPLY_MARK (net, oldskb->mark);skb_reserve (nskb,LL_MAX_HEADER ); - niph =nf_reject_iphdr_put (nskb, oldskb,IPPROTO_TCP , -ip4_dst_hoplimit (skb_dst (nskb))); +nf_reject_iphdr_put (nskb, oldskb,IPPROTO_TCP , +ip4_dst_hoplimit (skb_dst (nskb)));nf_reject_ip_tcphdr_put (nskb, oldskb, oth);if (ip_route_me_harder (net, sk, nskb,RTN_UNSPEC )) goto free_nskb; - niph =ip_hdr (nskb); -/* "Never happens" */ if (nskb->len >dst_mtu (skb_dst (nskb))) goto free_nskb;
@@ -290,6 +287,7 @@ void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb,*/ if (nf_bridge_info_exists (oldskb)) {struct ethhdr *oeth =eth_hdr (oldskb); +struct iphdr *niph =ip_hdr (nskb);struct net_device *br_indev; br_indev =nf_bridge_get_physindev (oldskb, net);
net/ipv6/netfilter/nf_reject_ipv6.c +2 -3
@@ -273,7 +273,6 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb,const struct tcphdr *otcph;unsigned int otcplen, hh_len;const struct ipv6hdr *oip6h =ipv6_hdr (oldskb); -struct ipv6hdr *ip6h;struct dst_entry *dst =NULL ;struct flowi6 fl6;
@@ -329,8 +328,7 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb, nskb->mark = fl6.flowi6_mark;skb_reserve (nskb, hh_len + dst->header_len); - ip6h =nf_reject_ip6hdr_put (nskb, oldskb,IPPROTO_TCP , -ip6_dst_hoplimit (dst)); +nf_reject_ip6hdr_put (nskb, oldskb,IPPROTO_TCP ,ip6_dst_hoplimit (dst));nf_reject_ip6_tcphdr_put (nskb, oldskb, otcph, otcplen);nf_ct_attach (nskb, oldskb);
@@ -345,6 +343,7 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb,*/ if (nf_bridge_info_exists (oldskb)) {struct ethhdr *oeth =eth_hdr (oldskb); +struct ipv6hdr *ip6h =ipv6_hdr (nskb);struct net_device *br_indev; br_indev =nf_bridge_get_physindev (oldskb, net);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/214 virtio_pmem: Check device status before requesting flush
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philip Chen <[email protected]>
[ Upstream commit e25fbcd97cf52c3c9824d44b5c56c19673c3dd50 ]
If a pmem device is in a bad status, the driver side could wait for host ack forever in virtio_pmem_flush(), causing the system to hang.
So add a status check in the beginning of virtio_pmem_flush() to return early if the device is not activated.
Message-Id: <[email protected]>
--- drivers/nvdimm/nd_virtio.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/nvdimm/nd_virtio.c +9 -0
@@ -44,6 +44,15 @@ static int virtio_pmem_flush(struct nd_region *nd_region)unsigned long flags;int err, err1; +/* +* Don't bother to submit the request to the device if the device is +* not activated. +*/ +if (vdev->config->get_status (vdev) &VIRTIO_CONFIG_S_NEEDS_RESET ) { +dev_info (&vdev->dev,"virtio pmem device needs a reset\n" ); +return -EIO ; + } +might_sleep (); req_data =kmalloc (sizeof (*req_data),GFP_KERNEL );if (!req_data)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/214 tools/iio: Add memory allocation failure check for trigger_name
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Jun <[email protected]>
[ Upstream commit 3c6b818b097dd6932859bcc3d6722a74ec5931c1 ]
Added a check to handle memory allocation failure for trigger_name and return -ENOMEM.
--- tools/iio/iio_generic_buffer.c | 4 ++++ 1 file changed, 4 insertions(+)
tools/iio/iio_generic_buffer.c +4 -0
@@ -498,6 +498,10 @@ int main(int argc, char **argv)return -ENOMEM ; } trigger_name =malloc (IIO_MAX_NAME_LENGTH ); +if (!trigger_name) { + ret = -ENOMEM ; + goto error; + } ret =read_sysfs_string ("name" , trig_dev_name, trigger_name);free (trig_dev_name);if (ret <0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/214 staging: vme_user: added bound check to geoid
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Riyan Dhiman <[email protected]>
[ Upstream commit a8a8b54350229f59c8ba6496fb5689a1632a59be ]
The geoid is a module parameter that allows users to hardcode the slot number. A bound check for geoid was added in the probe function because only values between 0 and less than VME_MAX_SLOT are valid.
--- drivers/staging/vme_user/vme_fake.c | 6 ++++++ drivers/staging/vme_user/vme_tsi148.c | 6 ++++++ 2 files changed, 12 insertions(+)
drivers/staging/vme_user/vme_fake.c +6 -0
@@ -1059,6 +1059,12 @@ static int __init fake_init(void)struct vme_slave_resource *slave_image;struct vme_lm_resource *lm; +if (geoid <0 || geoid >=VME_MAX_SLOTS ) { +pr_err ("VME geographical address must be between 0 and %d (exclusive), but got %d\n" , +VME_MAX_SLOTS , geoid); +return -EINVAL ; + } +/* We need a fake parent device */ vme_root =root_device_register ("vme" );if (IS_ERR (vme_root))
drivers/staging/vme_user/vme_tsi148.c +6 -0
@@ -2253,6 +2253,12 @@ static int tsi148_probe(struct pci_dev *pdev, const struct pci_device_id *id)struct vme_dma_resource *dma_ctrlr;struct vme_lm_resource *lm; +if (geoid <0 || geoid >=VME_MAX_SLOTS ) { +dev_err (&pdev->dev,"VME geographical address must be between 0 and %d (exclusive), but got %d\n" , +VME_MAX_SLOTS , geoid); +return -EINVAL ; + } +/* If we want to support more than one of each bridge, we need to * dynamically generate this so we get one per device */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/214 usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhishek Tamboli <[email protected]>
[ Upstream commit a7bb96b18864225a694e3887ac2733159489e4b0 ]
Fix potential dereferencing of ERR_PTR() in find_format_by_pix() and uvc_v4l2_enum_format().
Fix the following smatch errors:
drivers/usb/gadget/function/uvc_v4l2.c:124 find_format_by_pix()
error: 'fmtdesc' dereferencing possible ERR_PTR()
drivers/usb/gadget/function/uvc_v4l2.c:392 uvc_v4l2_enum_format()
error: 'fmtdesc' dereferencing possible ERR_PTR()
Also, fix similar issue in uvc_v4l2_try_format() for potential dereferencing of ERR_PTR().
--- drivers/usb/gadget/function/uvc_v4l2.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/uvc_v4l2.c +11 -1
@@ -121,6 +121,9 @@ static struct uvcg_format *find_format_by_pix(struct uvc_device *uvc,list_for_each_entry (format, &uvc->header->formats, entry) {const struct uvc_format_desc *fmtdesc =to_uvc_format (format->fmt); +if (IS_ERR (fmtdesc)) +continue ; +if (fmtdesc->fcc == pixelformat) { uformat = format->fmt;break ;
@@ -240,6 +243,7 @@ uvc_v4l2_try_format(struct file *file, void *fh, struct v4l2_format *fmt)struct uvc_video *video = &uvc->video;struct uvcg_format *uformat;struct uvcg_frame *uframe; +const struct uvc_format_desc *fmtdesc;u8 *fcc;if (fmt->type != video->queue.queue.type)
@@ -277,7 +281,10 @@ uvc_v4l2_try_format(struct file *file, void *fh, struct v4l2_format *fmt) fmt->fmt.pix.height = uframe->frame.w_height; fmt->fmt.pix.bytesperline =uvc_v4l2_get_bytesperline (uformat, uframe); fmt->fmt.pix.sizeimage =uvc_get_frame_size (uformat, uframe); - fmt->fmt.pix.pixelformat =to_uvc_format (uformat)->fcc; + fmtdesc =to_uvc_format (uformat); +if (IS_ERR (fmtdesc)) +return PTR_ERR (fmtdesc); + fmt->fmt.pix.pixelformat = fmtdesc->fcc; } fmt->fmt.pix.field =V4L2_FIELD_NONE ; fmt->fmt.pix.colorspace =V4L2_COLORSPACE_SRGB ;
@@ -389,6 +396,9 @@ uvc_v4l2_enum_format(struct file *file, void *fh, struct v4l2_fmtdesc *f)return -EINVAL ; fmtdesc =to_uvc_format (uformat); +if (IS_ERR (fmtdesc)) +return PTR_ERR (fmtdesc); + f->pixelformat = fmtdesc->fcc;return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/214 dm vdo: dont refer to dedupe_context after releasing it
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ken Raeburn <[email protected]>
[ Upstream commit 0808ebf2f80b962e75741a41ced372a7116f1e26 ]
Clear the dedupe_context pointer in a data_vio whenever ownership of the context is lost, so that vdo can't examine it accidentally.
--- drivers/md/dm-vdo/dedupe.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/md/dm-vdo/dedupe.c +3 -0
@@ -729,6 +729,7 @@ static void process_update_result(struct data_vio *agent) !change_context_state(context, DEDUPE_CONTEXT_COMPLETE, DEDUPE_CONTEXT_IDLE)) return; + agent->dedupe_context =NULL ;release_context (context); }
@@ -1648,6 +1649,7 @@ static void process_query_result(struct data_vio *agent)if (change_context_state (context,DEDUPE_CONTEXT_COMPLETE ,DEDUPE_CONTEXT_IDLE )) { agent->is_duplicate =decode_uds_advice (context); + agent->dedupe_context =NULL ;release_context (context); } }
@@ -2321,6 +2323,7 @@ static void timeout_index_operations_callback(struct vdo_completion *completion)* send its requestor on its way. */ list_del_init (&context->list_entry); + context->requestor->dedupe_context =NULL ;continue_data_vio (context->requestor); timed_out++; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/214 driver core: bus: Fix double free in driver API bus_register()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
[ Upstream commit bfa54a793ba77ef696755b66f3ac4ed00c7d1248 ]
For bus_register(), any error which happens after kset_register() will cause that @priv are freed twice, fixed by setting @priv with NULL after the first free.
--- drivers/base/bus.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/base/bus.c +2 -0
@@ -920,6 +920,8 @@ int bus_register(const struct bus_type *bus)bus_remove_file (bus, &bus_attr_uevent); bus_uevent_fail:kset_unregister (&priv->subsys); +/* Above kset_unregister() will kfree @priv */ + priv =NULL ; out:kfree (priv);return retval;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/214 driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
[ Upstream commit c0fd973c108cdc22a384854bc4b3e288a9717bb2 ]
Return -EIO instead of 0 for below erroneous bus attribute operations:
- read a bus attribute without show().
- write a bus attribute without store().
--- drivers/base/bus.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/base/bus.c +4 -2
@@ -152,7 +152,8 @@ static ssize_t bus_attr_show(struct kobject *kobj, struct attribute *attr, {struct bus_attribute *bus_attr =to_bus_attr (attr);struct subsys_private *subsys_priv =to_subsys_private (kobj); -ssize_t ret =0 ; +/* return -EIO for reading a bus attribute without show() */ +ssize_t ret = -EIO ;if (bus_attr->show) ret = bus_attr->show (subsys_priv->bus, buf);
@@ -164,7 +165,8 @@ static ssize_t bus_attr_store(struct kobject *kobj, struct attribute *attr, {struct bus_attribute *bus_attr =to_bus_attr (attr);struct subsys_private *subsys_priv =to_subsys_private (kobj); -ssize_t ret =0 ; +/* return -EIO for writing a bus attribute without store() */ +ssize_t ret = -EIO ;if (bus_attr->store) ret = bus_attr->store (subsys_priv->bus, buf, count);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/214 scsi: lpfc: Add ELS_RSP cmd to the list of WQEs to flush in lpfc_els_flush_cmd()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 93bcc5f3984bf4f51da1529700aec351872dbfff ]
During HBA stress testing, a spam of received PLOGIs exposes a resource recovery bug causing leakage of lpfc_sqlq entries from the global phba->sli4_hba.lpfc_els_sgl_list.
The issue is in lpfc_els_flush_cmd(), where the driver attempts to recover outstanding ELS sgls when walking the txcmplq. Only CMD_ELS_REQUEST64_CRs and CMD_GEN_REQUEST64_CRs are added to the abort and cancel lists. A check for CMD_XMIT_ELS_RSP64_WQE is missing in order to recover LS_ACC usages of the phba->sli4_hba.lpfc_els_sgl_list too.
Fix by adding CMD_XMIT_ELS_RSP64_WQE as part of the txcmplq walk when adding WQEs to the abort and cancel list in lpfc_els_flush_cmd(). Also, update naming convention from CRs to WQEs.
--- drivers/scsi/lpfc/lpfc_els.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/scsi/lpfc/lpfc_els.c +4 -3
@@ -9656,11 +9656,12 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport)if (piocb->cmd_flag &LPFC_DRIVER_ABORTED && !mbx_tmo_err)continue ; -/* On the ELS ring we can have ELS_REQUESTs or -* GEN_REQUESTs waiting for a response. +/* On the ELS ring we can have ELS_REQUESTs, ELS_RSPs, +* or GEN_REQUESTs waiting for a CQE response. */ ulp_command =get_job_cmnd (phba, piocb); -if (ulp_command ==CMD_ELS_REQUEST64_CR ) { +if (ulp_command ==CMD_ELS_REQUEST64_WQE || + ulp_command ==CMD_XMIT_ELS_RSP64_WQE ) {list_add_tail (&piocb->dlist, &abort_list);/* If the link is down when flushing ELS commands
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/214 scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 0a3c84f71680684c1d41abb92db05f95c09111e8 ]
Deleting an NPIV instance requires all fabric ndlps to be released before an NPIV's resources can be torn down. Failure to release fabric ndlps beforehand opens kref imbalance race conditions. Fix by forcing the DA_ID to complete synchronously with usage of wait_queue.
--- drivers/scsi/lpfc/lpfc_ct.c | 12 ++++++++++ drivers/scsi/lpfc/lpfc_disc.h | 7 ++++++ drivers/scsi/lpfc/lpfc_vport.c | 43 ++++++++++++++++++++++++++++------ 3 files changed, 55 insertions(+), 7 deletions(-)
drivers/scsi/lpfc/lpfc_ct.c +12 -0
@@ -1647,6 +1647,18 @@ lpfc_cmpl_ct(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, } out: +/* If the caller wanted a synchronous DA_ID completion, signal the +* wait obj and clear flag to reset the vport. +*/ +if (ndlp->save_flags &NLP_WAIT_FOR_DA_ID ) { +if (ndlp->da_id_waitq) +wake_up (ndlp->da_id_waitq); + } + +spin_lock_irq (&ndlp->lock); + ndlp->save_flags &= ~NLP_WAIT_FOR_DA_ID ; +spin_unlock_irq (&ndlp->lock); +lpfc_ct_free_iocb (phba, cmdiocb);lpfc_nlp_put (ndlp);return ;
drivers/scsi/lpfc/lpfc_disc.h +7 -0
@@ -90,6 +90,8 @@ enum lpfc_nlp_save_flags {NLP_IN_RECOV_POST_DEV_LOSS =0x1 ,/* wait for outstanding LOGO to cmpl */ NLP_WAIT_FOR_LOGO =0x2 , +/* wait for outstanding DA_ID to finish */ +NLP_WAIT_FOR_DA_ID =0x4 }; struct lpfc_nodelist {
@@ -159,7 +161,12 @@ struct lpfc_nodelist {uint32_t nvme_fb_size;/* NVME target's supported byte cnt */ #define NVME_FB_BIT_SHIFT 9/* PRLI Rsp first burst in 512B units. */ uint32_t nlp_defer_did; + +/* These wait objects are NPIV specific. These IOs must complete +* synchronously. +*/ wait_queue_head_t *logo_waitq; +wait_queue_head_t *da_id_waitq; };struct lpfc_node_rrq {
drivers/scsi/lpfc/lpfc_vport.c +36 -7
63 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/214 scsi: lpfc: Revise TRACE_EVENT log flag severities from KERN_ERR to KERN_WARNING
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 1af9af1f8ab38f1285b27581a5e6920ec58296ba ]
Revise certain log messages marked as KERN_ERR LOG_TRACE_EVENT to KERN_WARNING and use the lpfc_vlog_msg() macro to still log the event. The benefit is that events of interest are still logged and the entire trace buffer is not dumped with extraneous logging information when using default lpfc_log_verbose driver parameter settings.
Also, delete the keyword "fail" from such log messages as they aren't really causes for concern. The log messages are more for warnings to a SAN admin about SAN activity.
--- drivers/scsi/lpfc/lpfc_ct.c | 10 +-- drivers/scsi/lpfc/lpfc_els.c | 125 +++++++++++++++++------------------ 2 files changed, 64 insertions(+), 71 deletions(-)
drivers/scsi/lpfc/lpfc_ct.c +5 -5
@@ -1572,8 +1572,8 @@ lpfc_cmpl_ct_cmd_gft_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, } } }else -lpfc_printf_vlog (vport,KERN_ERR ,LOG_TRACE_EVENT , -"3065 GFT_ID failed x%08x\n" , ulp_status); +lpfc_vlog_msg (vport,KERN_WARNING ,LOG_DISCOVERY , +"3065 GFT_ID status x%08x\n" , ulp_status); out:lpfc_ct_free_iocb (phba, cmdiocb);
@@ -2258,7 +2258,7 @@ lpfc_cmpl_ct_disc_fdmi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, }lpfc_printf_vlog (vport,KERN_INFO ,LOG_DISCOVERY , -"0229 FDMI cmd %04x failed, latt = %d " +"0229 FDMI cmd %04x latt = %d " "ulp_status: x%x, rid x%x\n" ,be16_to_cpu (fdmi_cmd), latt, ulp_status, ulp_word4);
@@ -2275,9 +2275,9 @@ lpfc_cmpl_ct_disc_fdmi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,/* Check for a CT LS_RJT response */ cmd =be16_to_cpu (fdmi_cmd);if (be16_to_cpu (fdmi_rsp) ==SLI_CT_RESPONSE_FS_RJT ) { -/* FDMI rsp failed */ +/* Log FDMI reject */ lpfc_printf_vlog (vport,KERN_INFO ,LOG_DISCOVERY |LOG_ELS , -"0220 FDMI cmd failed FS_RJT Data: x%x" , cmd); +"0220 FDMI cmd FS_RJT Data: x%x" , cmd);/* Should we fallback to FDMI-2 / FDMI-1 ? */ switch (cmd) {
drivers/scsi/lpfc/lpfc_els.c +59 -66
225 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/214 drm/xe/oa: Fix overflow in oa batch buffer
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: José Roberto de Souza <[email protected]>
[ Upstream commit 6c10ba06bb1b48acce6d4d9c1e33beb9954f1788 ]
By default xe_bb_create_job() appends a MI_BATCH_BUFFER_END to batch buffer, this is not a problem if batch buffer is only used once but oa reuses the batch buffer for the same metric and at each call it appends a MI_BATCH_BUFFER_END, printing the warning below and then overflowing.
[ 381.072016] ------------[ cut here ]------------
[ 381.072019] xe 0000:00:02.0: [drm] Assertion `bb->len * 4 + bb_prefetch(q->gt) <= size` failed!
platform: LUNARLAKE subplatform: 1
graphics: Xe2_LPG / Xe2_HPG 20.04 step B0
media: Xe2_LPM / Xe2_HPM 20.00 step B0
tile: 0 VRAM 0 B
GT: 0 type 1So here checking if batch buffer already have MI_BATCH_BUFFER_END if not append it.
v2:
- simply fix, suggestion from Ashutosh
--- drivers/gpu/drm/xe/xe_bb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_bb.c +2 -1
@@ -65,7 +65,8 @@ __xe_bb_create_job(struct xe_exec_queue *q, struct xe_bb *bb, u64 *addr) {u32 size =drm_suballoc_size (bb->bo); - bb->cs[bb->len++] =MI_BATCH_BUFFER_END ; +if (bb->len ==0 || bb->cs[bb->len -1 ] !=MI_BATCH_BUFFER_END ) + bb->cs[bb->len++] =MI_BATCH_BUFFER_END ;xe_gt_assert (q->gt, bb->len *4 +bb_prefetch (q->gt) <= size);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/214 drm/amdgpu: nuke the VM PD/PT shadow handling
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian König <[email protected]>
[ Upstream commit 7181faaa4703705939580abffaf9cb5d6b50dbb7 ]
This was only used as workaround for recovering the page tables after VRAM was lost and is no longer necessary after the function amdgpu_vm_bo_reset_state_machine() started to do the same.
Compute never used shadows either, so the only proplematic case left is SVM and that is most likely not recoverable in any way when VRAM is lost.
--- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 4 - drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 87 +-------------------- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 67 +--------------- drivers/gpu/drm/amd/amdgpu/amdgpu_object.h | 21 ----- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 17 ---- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c | 56 +------------ drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c | 19 +---- 7 files changed, 6 insertions(+), 265 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu.h +0 -4
@@ -1091,10 +1091,6 @@ struct amdgpu_device {struct amdgpu_virt virt; -/* link all shadow bo */ -struct list_head shadow_list; -struct mutex shadow_list_lock; -/* record hw reset is performed */ bool has_hw_reset;u8 reset_magic[AMDGPU_RESET_MAGIC_NUM ];
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +2 -85
112 lines not on this page · raw message
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +1 -66
85 lines not on this page · raw message
drivers/gpu/drm/amd/amdgpu/amdgpu_object.h +0 -21
@@ -130,8 +130,6 @@ struct amdgpu_bo_user {struct amdgpu_bo_vm {struct amdgpu_bo bo; -struct amdgpu_bo *shadow; -struct list_head shadow_list;struct amdgpu_vm_bo_base entries[]; };
@@ -269,22 +267,6 @@ static inline bool amdgpu_bo_encrypted(struct amdgpu_bo *bo)return bo->flags &AMDGPU_GEM_CREATE_ENCRYPTED ; } -/** -* amdgpu_bo_shadowed - check if the BO is shadowed -* -* @bo: BO to be tested. -* -* Returns: -* NULL if not shadowed or else return a BO pointer. -*/ -static inline struct amdgpu_bo *amdgpu_bo_shadowed (struct amdgpu_bo *bo) -{ -if (bo->tbo.type == ttm_bo_type_kernel) -return to_amdgpu_bo_vm (bo)->shadow; - -return NULL ; -} -bool amdgpu_bo_is_amdgpu_bo (struct ttm_buffer_object *bo);void amdgpu_bo_placement_from_domain (struct amdgpu_bo *abo,u32 domain);
@@ -343,9 +325,6 @@ u64 amdgpu_bo_gpu_offset(struct amdgpu_bo *bo);u64 amdgpu_bo_gpu_offset_no_check (struct amdgpu_bo *bo);void amdgpu_bo_get_memory (struct amdgpu_bo *bo,struct amdgpu_mem_stats *stats); -void amdgpu_bo_add_to_shadow_list (struct amdgpu_bo_vm *vmbo); -int amdgpu_bo_restore_shadow (struct amdgpu_bo *shadow, -struct dma_fence **fence);uint32_t amdgpu_bo_get_preferred_domain (struct amdgpu_device *adev,uint32_t domain);
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +0 -17
@@ -465,7 +465,6 @@ int amdgpu_vm_validate(struct amdgpu_device *adev, struct amdgpu_vm *vm, {uint64_t new_vm_generation =amdgpu_vm_generation (adev, vm);struct amdgpu_vm_bo_base *bo_base; -struct amdgpu_bo *shadow;struct amdgpu_bo *bo;int r;
@@ -486,16 +485,10 @@ int amdgpu_vm_validate(struct amdgpu_device *adev, struct amdgpu_vm *vm,spin_unlock (&vm->status_lock); bo = bo_base->bo; - shadow =amdgpu_bo_shadowed (bo); r =validate (param, bo);if (r)return r; -if (shadow) { - r =validate (param, shadow); -if (r) -return r; - }if (bo->tbo.type != ttm_bo_type_kernel) {amdgpu_vm_bo_moved (bo_base);
@@ -2125,10 +2118,6 @@ void amdgpu_vm_bo_invalidate(struct amdgpu_device *adev, {struct amdgpu_vm_bo_base *bo_base; -/* shadow bo doesn't have bo base, its validation needs its parent */ -if (bo->parent && (amdgpu_bo_shadowed (bo->parent) == bo)) - bo = bo->parent; -for (bo_base = bo->vm_bo; bo_base; bo_base = bo_base->next) {struct amdgpu_vm *vm = bo_base->vm;
@@ -2456,7 +2445,6 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm, root_bo =amdgpu_bo_ref (&root->bo); r =amdgpu_bo_reserve (root_bo, true);if (r) { -amdgpu_bo_unref (&root->shadow);amdgpu_bo_unref (&root_bo); goto error_free_delayed; }
@@ -2548,11 +2536,6 @@ int amdgpu_vm_make_compute(struct amdgpu_device *adev, struct amdgpu_vm *vm) vm->last_update =dma_fence_get_stub (); vm->is_compute_context = true; -/* Free the shadow bo for compute VM */ -amdgpu_bo_unref (&to_amdgpu_bo_vm (vm->root.bo)->shadow); - - goto unreserve_bo; - unreserve_bo:amdgpu_bo_unreserve (vm->root.bo);return r;
drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c +1 -55
91 lines not on this page · raw message
drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c +2 -17
@@ -35,16 +35,7 @@*/ static int amdgpu_vm_sdma_map_table (struct amdgpu_bo_vm *table) { -int r; - - r =amdgpu_ttm_alloc_gart (&table->bo.tbo); -if (r) -return r; - -if (table->shadow) - r =amdgpu_ttm_alloc_gart (&table->shadow->tbo); - -return r; +return amdgpu_ttm_alloc_gart (&table->bo.tbo); }/* Allocate a new job for @count PTE updates */
@@ -273,17 +264,13 @@ static int amdgpu_vm_sdma_update(struct amdgpu_vm_update_params *p,if (!p->pages_addr) {/* set page commands needed */ -if (vmbo->shadow) -amdgpu_vm_sdma_set_ptes (p, vmbo->shadow, pe, addr, - count, incr, flags);amdgpu_vm_sdma_set_ptes (p, bo, pe, addr, count, incr, flags);return 0 ; }/* copy commands needed */ - ndw -= p->adev->vm_manager.vm_pte_funcs->copy_pte_num_dw * - (vmbo->shadow ?2 :1 ); + ndw -= p->adev->vm_manager.vm_pte_funcs->copy_pte_num_dw;/* for padding */ ndw -=7 ;
@@ -298,8 +285,6 @@ static int amdgpu_vm_sdma_update(struct amdgpu_vm_update_params *p, pte[i] |= flags; } -if (vmbo->shadow) -amdgpu_vm_sdma_copy_ptes (p, vmbo->shadow, pe, nptes);amdgpu_vm_sdma_copy_ptes (p, bo, pe, nptes); pe += nptes *8 ;
Signature · 1 line
2.43.0
Re: [PATCH 6.11 076/214] drm/amdgpu: nuke the VM PD/PT shadow handling
Hey Greg & Sasha,
I've pointed out before that this patch here shouldn't be backported.
The patch just removes an unused feature on the current development kernel, but I can't guarantee that this feature is unused on older kernels.
Please don't backport this!
Regards,
Christian.
Am 14.10.24 um 16:18 schrieb Greg Kroah-Hartman:
Quoted 513 lines
6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian König <[email protected]>
[ Upstream commit
7181faaa4703705939580abffaf9cb5d6b50dbb7]This was only used as workaround for recovering the page tables after VRAM was lost and is no longer necessary after the function
amdgpu_vm_bo_reset_state_machine()started to do the same.Compute never used shadows either, so the only proplematic case left is SVM and that is most likely not recoverable in any way when VRAM is lost.
Signed-off-by Christian König <[email protected]>Acked-by Lijo Lazar <[email protected]>Signed-off-by Alex Deucher <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 4 - drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 87 +-------------------- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 67 +--------------- drivers/gpu/drm/amd/amdgpu/amdgpu_object.h | 21 ----- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 17 ---- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c | 56 +------------ drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c | 19 +---- 7 files changed, 6 insertions(+), 265 deletions(-)drivers/gpu/drm/amd/amdgpu/amdgpu.h +0
-4@@ -1091,10 +1091,6 @@ struct amdgpu_device {struct amdgpu_virt virt; -/* link all shadow bo */ -struct list_head shadow_list; -struct mutex shadow_list_lock; -/* record hw reset is performed */ bool has_hw_reset;u8 reset_magic[AMDGPU_RESET_MAGIC_NUM ];drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +2
-85@@ -4073,9 +4073,6 @@ int amdgpu_device_init(struct amdgpu_device *adev,spin_lock_init (&adev->mm_stats.lock);spin_lock_init (&adev->wb.lock); -INIT_LIST_HEAD (&adev->shadow_list); -mutex_init (&adev->shadow_list_lock); -INIT_LIST_HEAD (&adev->reset_list);INIT_LIST_HEAD (&adev->ras_list);@@ -4980,80 +4977,6 @@ static int amdgpu_device_ip_post_soft_reset(struct amdgpu_device *adev)return 0 ; } -/** -* amdgpu_device_recover_vram - Recover some VRAM contents -* -* @adev: amdgpu_device pointer -* -* Restores the contents of VRAM buffers from the shadows in GTT. Used to -* restore things like GPUVM page tables after a GPU reset where -* the contents of VRAM might be lost. -* -* Returns: -* 0 on success, negative error code on failure. -*/ -static int amdgpu_device_recover_vram (struct amdgpu_device *adev) -{ -struct dma_fence *fence =NULL , *next =NULL ; -struct amdgpu_bo *shadow; -struct amdgpu_bo_vm *vmbo; -long r =1 , tmo; - -if (amdgpu_sriov_runtime (adev)) - tmo =msecs_to_jiffies (8000 ); -else - tmo =msecs_to_jiffies (100 ); - -dev_info (adev->dev,"recover vram bo from shadow start\n" ); -mutex_lock (&adev->shadow_list_lock); -list_for_each_entry (vmbo, &adev->shadow_list, shadow_list) { -/* If vm is compute context or adev is APU, shadow will be NULL */ -if (!vmbo->shadow) -continue ; - shadow = vmbo->shadow; - -/* No need to recover an evicted BO */ -if (!shadow->tbo.resource || - shadow->tbo.resource->mem_type !=TTM_PL_TT || - shadow->tbo.resource->start ==AMDGPU_BO_INVALID_OFFSET || - shadow->parent->tbo.resource->mem_type !=TTM_PL_VRAM ) -continue ; - - r =amdgpu_bo_restore_shadow (shadow, &next); -if (r) -break ; - -if (fence) { - tmo =dma_fence_wait_timeout (fence, false, tmo); -dma_fence_put (fence); - fence = next; -if (tmo ==0 ) { - r = -ETIMEDOUT ; -break ; - }else if (tmo <0 ) { - r = tmo; -break ; - } - }else { - fence = next; - } - } -mutex_unlock (&adev->shadow_list_lock); - -if (fence) - tmo =dma_fence_wait_timeout (fence, false, tmo); -dma_fence_put (fence); - -if (r <0 || tmo <=0 ) { -dev_err (adev->dev,"recover vram bo from shadow failed, r is %ld, tmo is %ld\n" , r, tmo); -return -EIO ; - } - -dev_info (adev->dev,"recover vram bo from shadow done\n" ); -return 0 ; -} - -/** * amdgpu_device_reset_sriov - reset ASIC for SR-IOV vf * @@ -5116,12 +5039,8 @@ static int amdgpu_device_reset_sriov(struct amdgpu_device *adev,if (r)return r; -if (adev->virt.gim_feature &AMDGIM_FEATURE_GIM_FLR_VRAMLOST ) { +if (adev->virt.gim_feature &AMDGIM_FEATURE_GIM_FLR_VRAMLOST )amdgpu_inc_vram_lost (adev); - r =amdgpu_device_recover_vram (adev); - } -if (r) -return r;/* need to be called during full access so we can't do it later like * bare-metal does. @@ -5541,9 +5460,7 @@ int amdgpu_do_asic_reset(struct list_head *device_list_handle, } } -if (!r) - r =amdgpu_device_recover_vram (tmp_adev); -else +if (r) tmp_adev->asic_reset_res = r; }drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +1
-66@@ -77,24 +77,6 @@ static void amdgpu_bo_user_destroy(struct ttm_buffer_object *tbo)amdgpu_bo_destroy (tbo); } -static void amdgpu_bo_vm_destroy (struct ttm_buffer_object *tbo) -{ -struct amdgpu_device *adev =amdgpu_ttm_adev (tbo->bdev); -struct amdgpu_bo *shadow_bo =ttm_to_amdgpu_bo (tbo), *bo; -struct amdgpu_bo_vm *vmbo; - - bo = shadow_bo->parent; - vmbo =to_amdgpu_bo_vm (bo); -/* in case amdgpu_device_recover_vram got NULL of bo->parent */ -if (!list_empty (&vmbo->shadow_list)) { -mutex_lock (&adev->shadow_list_lock); -list_del_init (&vmbo->shadow_list); -mutex_unlock (&adev->shadow_list_lock); - } - -amdgpu_bo_destroy (tbo); -} -/** * amdgpu_bo_is_amdgpu_bo - check if the buffer object is an &amdgpu_bo * @bo: buffer object to be checked @@ -108,8 +90,7 @@ static void amdgpu_bo_vm_destroy(struct ttm_buffer_object *tbo)bool amdgpu_bo_is_amdgpu_bo (struct ttm_buffer_object *bo) {if (bo->destroy == &amdgpu_bo_destroy || - bo->destroy == &amdgpu_bo_user_destroy || - bo->destroy == &amdgpu_bo_vm_destroy) + bo->destroy == &amdgpu_bo_user_destroy)return true;return false;@@ -722,52 +703,6 @@ int amdgpu_bo_create_vm(struct amdgpu_device *adev,return r; } -/** -* amdgpu_bo_add_to_shadow_list - add a BO to the shadow list -* -* @vmbo: BO that will be inserted into the shadow list -* -* Insert a BO to the shadow list. -*/ -void amdgpu_bo_add_to_shadow_list (struct amdgpu_bo_vm *vmbo) -{ -struct amdgpu_device *adev =amdgpu_ttm_adev (vmbo->bo.tbo.bdev); - -mutex_lock (&adev->shadow_list_lock); -list_add_tail (&vmbo->shadow_list, &adev->shadow_list); - vmbo->shadow->parent =amdgpu_bo_ref (&vmbo->bo); - vmbo->shadow->tbo.destroy = &amdgpu_bo_vm_destroy; -mutex_unlock (&adev->shadow_list_lock); -} - -/** -* amdgpu_bo_restore_shadow - restore an &amdgpu_bo shadow -* -* @shadow: &amdgpu_bo shadow to be restored -* @fence: dma_fence associated with the operation -* -* Copies a buffer object's shadow content back to the object. -* This is used for recovering a buffer from its shadow in case of a gpu -* reset where vram context may be lost. -* -* Returns: -* 0 for success or a negative error code on failure. -*/ -int amdgpu_bo_restore_shadow (struct amdgpu_bo *shadow,struct dma_fence **fence) - -{ -struct amdgpu_device *adev =amdgpu_ttm_adev (shadow->tbo.bdev); -struct amdgpu_ring *ring = adev->mman.buffer_funcs_ring; -uint64_t shadow_addr, parent_addr; - - shadow_addr =amdgpu_bo_gpu_offset (shadow); - parent_addr =amdgpu_bo_gpu_offset (shadow->parent); - -return amdgpu_copy_buffer (ring, shadow_addr, parent_addr, -amdgpu_bo_size (shadow),NULL , fence, - true, false,0 ); -} -/** * amdgpu_bo_kmap - map an &amdgpu_bo buffer object * @bo: &amdgpu_bo buffer object to be mapped drivers/gpu/drm/amd/amdgpu/amdgpu_object.h +0
-21@@ -130,8 +130,6 @@ struct amdgpu_bo_user {struct amdgpu_bo_vm {struct amdgpu_bo bo; -struct amdgpu_bo *shadow; -struct list_head shadow_list;struct amdgpu_vm_bo_base entries[]; };@@ -269,22 +267,6 @@ static inline bool amdgpu_bo_encrypted(struct amdgpu_bo *bo)return bo->flags &AMDGPU_GEM_CREATE_ENCRYPTED ; } -/** -* amdgpu_bo_shadowed - check if the BO is shadowed -* -* @bo: BO to be tested. -* -* Returns: -* NULL if not shadowed or else return a BO pointer. -*/ -static inline struct amdgpu_bo *amdgpu_bo_shadowed (struct amdgpu_bo *bo) -{ -if (bo->tbo.type == ttm_bo_type_kernel) -return to_amdgpu_bo_vm (bo)->shadow; - -return NULL ; -} -bool amdgpu_bo_is_amdgpu_bo (struct ttm_buffer_object *bo);void amdgpu_bo_placement_from_domain (struct amdgpu_bo *abo,u32 domain);@@ -343,9 +325,6 @@ u64 amdgpu_bo_gpu_offset(struct amdgpu_bo *bo);u64 amdgpu_bo_gpu_offset_no_check (struct amdgpu_bo *bo);void amdgpu_bo_get_memory (struct amdgpu_bo *bo,struct amdgpu_mem_stats *stats); -void amdgpu_bo_add_to_shadow_list (struct amdgpu_bo_vm *vmbo); -int amdgpu_bo_restore_shadow (struct amdgpu_bo *shadow, -struct dma_fence **fence);uint32_t amdgpu_bo_get_preferred_domain (struct amdgpu_device *adev,uint32_t domain);drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +0
-17@@ -465,7 +465,6 @@ int amdgpu_vm_validate(struct amdgpu_device *adev, struct amdgpu_vm *vm, {uint64_t new_vm_generation =amdgpu_vm_generation (adev, vm);struct amdgpu_vm_bo_base *bo_base; -struct amdgpu_bo *shadow;struct amdgpu_bo *bo;int r;@@ -486,16 +485,10 @@ int amdgpu_vm_validate(struct amdgpu_device *adev, struct amdgpu_vm *vm,spin_unlock (&vm->status_lock); bo = bo_base->bo; - shadow =amdgpu_bo_shadowed (bo); r =validate (param, bo);if (r)return r; -if (shadow) { - r =validate (param, shadow); -if (r) -return r; - }if (bo->tbo.type != ttm_bo_type_kernel) {amdgpu_vm_bo_moved (bo_base);@@ -2125,10 +2118,6 @@ void amdgpu_vm_bo_invalidate(struct amdgpu_device *adev, {struct amdgpu_vm_bo_base *bo_base; -/* shadow bo doesn't have bo base, its validation needs its parent */ -if (bo->parent && (amdgpu_bo_shadowed (bo->parent) == bo)) - bo = bo->parent; -for (bo_base = bo->vm_bo; bo_base; bo_base = bo_base->next) {struct amdgpu_vm *vm = bo_base->vm;@@ -2456,7 +2445,6 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm, root_bo =amdgpu_bo_ref (&root->bo); r =amdgpu_bo_reserve (root_bo, true);if (r) { -amdgpu_bo_unref (&root->shadow);amdgpu_bo_unref (&root_bo); goto error_free_delayed; }@@ -2548,11 +2536,6 @@ int amdgpu_vm_make_compute(struct amdgpu_device *adev, struct amdgpu_vm *vm) vm->last_update =dma_fence_get_stub (); vm->is_compute_context = true; -/* Free the shadow bo for compute VM */ -amdgpu_bo_unref (&to_amdgpu_bo_vm (vm->root.bo)->shadow); - - goto unreserve_bo; - unreserve_bo:amdgpu_bo_unreserve (vm->root.bo);return r;drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c +1
-55@@ -383,14 +383,6 @@ int amdgpu_vm_pt_clear(struct amdgpu_device *adev, struct amdgpu_vm *vm,if (r)return r; -if (vmbo->shadow) { -struct amdgpu_bo *shadow = vmbo->shadow; - - r =ttm_bo_validate (&shadow->tbo, &shadow->placement, &ctx); -if (r) -return r; - } -if (!drm_dev_enter (adev_to_drm (adev), &idx))return -ENODEV ;@@ -448,10 +440,7 @@ int amdgpu_vm_pt_create(struct amdgpu_device *adev, struct amdgpu_vm *vm, int32_t xcp_id) {struct amdgpu_bo_param bp; -struct amdgpu_bo *bo; -struct dma_resv *resv;unsigned int num_entries; -int r;memset (&bp,0 ,sizeof (bp));@@ -484,42 +473,7 @@ int amdgpu_vm_pt_create(struct amdgpu_device *adev, struct amdgpu_vm *vm,if (vm->root.bo) bp.resv = vm->root.bo->tbo.base.resv; - r =amdgpu_bo_create_vm (adev, &bp, vmbo); -if (r) -return r; - - bo = &(*vmbo)->bo; -if (vm->is_compute_context || (adev->flags &AMD_IS_APU )) { - (*vmbo)->shadow =NULL ; -return 0 ; - } - -if (!bp.resv) -WARN_ON (dma_resv_lock (bo->tbo.base.resv, -NULL )); - resv = bp.resv; -memset (&bp,0 ,sizeof (bp)); - bp.size =amdgpu_vm_pt_size (adev, level); - bp.domain =AMDGPU_GEM_DOMAIN_GTT ; - bp.flags =AMDGPU_GEM_CREATE_CPU_GTT_USWC ; - bp.type = ttm_bo_type_kernel; - bp.resv = bo->tbo.base.resv; - bp.bo_ptr_size =sizeof (struct amdgpu_bo ); - bp.xcp_id_plus1 = xcp_id +1 ; - - r =amdgpu_bo_create (adev, &bp, &(*vmbo)->shadow); - -if (!resv) -dma_resv_unlock (bo->tbo.base.resv); - -if (r) { -amdgpu_bo_unref (&bo); -return r; - } - -amdgpu_bo_add_to_shadow_list (*vmbo); - -return 0 ; +return amdgpu_bo_create_vm (adev, &bp, vmbo); }/** @@ -569,7 +523,6 @@ static int amdgpu_vm_pt_alloc(struct amdgpu_device *adev,return 0 ; error_free_pt: -amdgpu_bo_unref (&pt->shadow);amdgpu_bo_unref (&pt_bo);return r; }@@ -581,17 +534,10 @@ static int amdgpu_vm_pt_alloc(struct amdgpu_device *adev,*/ static void amdgpu_vm_pt_free (struct amdgpu_vm_bo_base *entry) { -struct amdgpu_bo *shadow; -if (!entry->bo)return ; entry->bo->vm_bo =NULL ; - shadow =amdgpu_bo_shadowed (entry->bo); -if (shadow) { -ttm_bo_set_bulk_move (&shadow->tbo,NULL ); -amdgpu_bo_unref (&shadow); - }ttm_bo_set_bulk_move (&entry->bo->tbo,NULL );spin_lock (&entry->vm->status_lock);drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c +2
-17@@ -35,16 +35,7 @@*/ static int amdgpu_vm_sdma_map_table (struct amdgpu_bo_vm *table) { -int r; - - r =amdgpu_ttm_alloc_gart (&table->bo.tbo); -if (r) -return r; - -if (table->shadow) - r =amdgpu_ttm_alloc_gart (&table->shadow->tbo); - -return r; +return amdgpu_ttm_alloc_gart (&table->bo.tbo); }/* Allocate a new job for @count PTE updates */ @@ -273,17 +264,13 @@ static int amdgpu_vm_sdma_update(struct amdgpu_vm_update_params *p,if (!p->pages_addr) {/* set page commands needed */ -if (vmbo->shadow) -amdgpu_vm_sdma_set_ptes (p, vmbo->shadow, pe, addr, - count, incr, flags);amdgpu_vm_sdma_set_ptes (p, bo, pe, addr, count, incr, flags);return 0 ; }/* copy commands needed */ - ndw -= p->adev->vm_manager.vm_pte_funcs->copy_pte_num_dw * - (vmbo->shadow ?2 :1 ); + ndw -= p->adev->vm_manager.vm_pte_funcs->copy_pte_num_dw;/* for padding */ ndw -=7 ;@@ -298,8 +285,6 @@ static int amdgpu_vm_sdma_update(struct amdgpu_vm_update_params *p, pte[i] |= flags; } -if (vmbo->shadow) -amdgpu_vm_sdma_copy_ptes (p, vmbo->shadow, pe, nptes);amdgpu_vm_sdma_copy_ptes (p, bo, pe, nptes); pe += nptes *8 ;
Greg Kroah-Hartman
maintainerRe: [PATCH 6.11 076/214] drm/amdgpu: nuke the VM PD/PT shadow handling
Quoted 3 lines · Christian König
Hey Greg & Sasha,
I've pointed out before that this patch here shouldn't be backported.
Yeah, odd, it shouldn't have come back, sorry about that.
Quoted 5 lines
The patch just removes an unused feature on the current development kernel, but I can't guarantee that this feature is unused on older kernels.
Please don't backport this!
Now dropped. Again. :)
greg k-h
Greg Kroah-Hartman
maintainerPATCH 77/214 drm/amd/display: Check null pointer before dereferencing se
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit ff599ef6970ee000fa5bc38d02fa5ff5f3fc7575 ]
[WHAT & HOW]
se is null checked previously in the same function, indicating it might be null; therefore, it must be checked when used again.
This fixes 1 FORWARD_NULL issue reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc.c +1 -1
@@ -1832,7 +1832,7 @@ bool dc_validate_boot_timing(const struct dc *dc,if (crtc_timing->pix_clk_100hz != pix_clk_100hz)return false; -if (!se->funcs->dp_get_pixel_format) +if (!se || !se->funcs->dp_get_pixel_format)return false; if (!se->funcs->dp_get_pixel_format(
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/214 fbcon: Fix a NULL pointer dereference issue in fbcon_putcs
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianqiang Liu <[email protected]>
[ Upstream commit 5b97eebcce1b4f3f07a71f635d6aa3af96c236e7 ]
syzbot has found a NULL pointer dereference bug in fbcon. Here is the simplified C reproducer:
struct param {
uint8_t type;
struct tiocl_selection ts;
};int main()
{
struct fb_con2fbmap con2fb;
struct param param;
int fd = open("/dev/fb1", 0, 0);
con2fb.console = 0x19;
con2fb.framebuffer = 0;
ioctl(fd, FBIOPUT_CON2FBMAP, &con2fb);
param.type = 2;
param.ts.xs = 0; param.ts.ys = 0;
param.ts.xe = 0; param.ts.ye = 0;
param.ts.sel_mode = 0;
int fd1 = open("/dev/tty1", O_RDWR, 0);
ioctl(fd1, TIOCLINUX, ¶m);
con2fb.console = 1;
con2fb.framebuffer = 0;
ioctl(fd, FBIOPUT_CON2FBMAP, &con2fb);
return 0;
}After calling ioctl(fd1, TIOCLINUX, ¶m), the subsequent ioctl(fd, FBIOPUT_CON2FBMAP, &con2fb) causes the kernel to follow a different execution path:
set_con2fb_map
-> con2fb_init_display
-> fbcon_set_disp
-> redraw_screen
-> hide_cursor
-> clear_selection
-> highlight
-> invert_screen
-> do_update_region
-> fbcon_putcs
-> ops->putcsSince ops->putcs is a NULL pointer, this leads to a kernel panic. To prevent this, we need to call set_blitting_type() within set_con2fb_map() to properly initialize ops->putcs.
--- drivers/video/fbdev/core/fbcon.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/video/fbdev/core/fbcon.c +2 -0
@@ -847,6 +847,8 @@ static int set_con2fb_map(int unit, int newidx, int user)return err;fbcon_add_cursor_work (info); + }else if (vc) { +set_blitting_type (vc, info); } con2fb_map[unit] = newidx;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/214 smb: client: fix UAF in async decryption
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Enzo Matsumiya <[email protected]>
[ Upstream commit b0abcd65ec545701b8793e12bc27dc98042b151a ]
Doing an async decryption (large read) crashes with a slab-use-after-free way down in the crypto API.
Reproducer:
# mount.cifs -o ...,seal,esize=1 //srv/share /mnt
# dd if=/mnt/largefile of=/dev/null
...
[ 194.196391] ==================================================================
[ 194.196844] BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xc1/0x110
[ 194.197269] Read of size 8 at addr ffff888112bd0448 by task kworker/u77:2/899
[ 194.197707]
[ 194.197818] CPU: 12 UID: 0 PID: 899 Comm: kworker/u77:2 Not tainted 6.11.0-lku-00028-gfca3ca14a17a-dirty #43
[ 194.198400] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014
[ 194.199046] Workqueue: smb3decryptd smb2_decrypt_offload [cifs]
[ 194.200032] Call Trace:
[ 194.200191] <TASK>
[ 194.200327] dump_stack_lvl+0x4e/0x70
[ 194.200558] ? gf128mul_4k_lle+0xc1/0x110
[ 194.200809] print_report+0x174/0x505
[ 194.201040] ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[ 194.201352] ? srso_return_thunk+0x5/0x5f
[ 194.201604] ? __virt_addr_valid+0xdf/0x1c0
[ 194.201868] ? gf128mul_4k_lle+0xc1/0x110
[ 194.202128] kasan_report+0xc8/0x150
[ 194.202361] ? gf128mul_4k_lle+0xc1/0x110
[ 194.202616] gf128mul_4k_lle+0xc1/0x110
[ 194.202863] ghash_update+0x184/0x210
[ 194.203103] shash_ahash_update+0x184/0x2a0
[ 194.203377] ? __pfx_shash_ahash_update+0x10/0x10
[ 194.203651] ? srso_return_thunk+0x5/0x5f
[ 194.203877] ? crypto_gcm_init_common+0x1ba/0x340
[ 194.204142] gcm_hash_assoc_remain_continue+0x10a/0x140
[ 194.204434] crypt_message+0xec1/0x10a0 [cifs]
[ 194.206489] ? __pfx_crypt_message+0x10/0x10 [cifs]
[ 194.208507] ? srso_return_thunk+0x5/0x5f
[ 194.209205] ? srso_return_thunk+0x5/0x5f
[ 194.209925] ? srso_return_thunk+0x5/0x5f
[ 194.210443] ? srso_return_thunk+0x5/0x5f
[ 194.211037] decrypt_raw_data+0x15f/0x250 [cifs]
[ 194.212906] ? __pfx_decrypt_raw_data+0x10/0x10 [cifs]
[ 194.214670] ? srso_return_thunk+0x5/0x5f
[ 194.215193] smb2_decrypt_offload+0x12a/0x6c0 [cifs]This is because TFM is being used in parallel.
Fix this by allocating a new AEAD TFM for async decryption, but keep the existing one for synchronous READ cases (similar to what is done in smb3_calc_signature()).
Also remove the calls to aead_request_set_callback() and crypto_wait_req() since it's always going to be a synchronous operation.
--- fs/smb/client/smb2ops.c | 47 ++++++++++++++++++++++++----------------- fs/smb/client/smb2pdu.c | 6 ++++++ 2 files changed, 34 insertions(+), 19 deletions(-)
fs/smb/client/smb2ops.c +28 -19
@@ -4312,7 +4312,7 @@ smb2_get_enc_key(struct TCP_Server_Info *server, __u64 ses_id, int enc, u8 *key)*/ static int crypt_message (struct TCP_Server_Info *server,int num_rqst, -struct smb_rqst *rqst,int enc) +struct smb_rqst *rqst,int enc,struct crypto_aead *tfm) {struct smb2_transform_hdr *tr_hdr = (struct smb2_transform_hdr *)rqst[0 ].rq_iov[0 ].iov_base;
@@ -4323,8 +4323,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,u8 key[SMB3_ENC_DEC_KEY_SIZE ];struct aead_request *req;u8 *iv; -DECLARE_CRYPTO_WAIT (wait); -struct crypto_aead *tfm;unsigned int crypt_len =le32_to_cpu (tr_hdr->OriginalMessageSize);void *creq;size_t sensitive_size;
@@ -4336,14 +4334,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,return rc; } - rc =smb3_crypto_aead_allocate (server); -if (rc) { -cifs_server_dbg (VFS ,"%s: crypto alloc failed\n" , __func__); -return rc; - } - - tfm = enc ? server->secmech.enc : server->secmech.dec; -if ((server->cipher_type ==SMB2_ENCRYPTION_AES256_CCM ) || (server->cipher_type ==SMB2_ENCRYPTION_AES256_GCM )) rc =crypto_aead_setkey (tfm, key,SMB3_GCM256_CRYPTKEY_SIZE );
@@ -4383,11 +4373,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,aead_request_set_crypt (req, sg, sg, crypt_len, iv);aead_request_set_ad (req, assoc_data_len); -aead_request_set_callback (req,CRYPTO_TFM_REQ_MAY_BACKLOG , - crypto_req_done, &wait); - - rc =crypto_wait_req (enc ?crypto_aead_encrypt (req) - :crypto_aead_decrypt (req), &wait); + rc = enc ?crypto_aead_encrypt (req) :crypto_aead_decrypt (req);if (!rc && enc)memcpy (&tr_hdr->Signature, sign,SMB2_SIGNATURE_SIZE );
@@ -4493,7 +4479,7 @@ smb3_init_transform_rq(struct TCP_Server_Info *server, int num_rqst,/* fill the 1st iov with a transform header */ fill_transform_hdr (tr_hdr, orig_len, old_rq, server->cipher_type); - rc =crypt_message (server, num_rqst, new_rq,1 ); + rc =crypt_message (server, num_rqst, new_rq,1 , server->secmech.enc);cifs_dbg (FYI ,"Encrypt message returned %d\n" , rc);if (rc) goto err_free;
@@ -4518,8 +4504,9 @@ decrypt_raw_data(struct TCP_Server_Info *server, char *buf, unsigned int buf_data_size, struct iov_iter *iter, bool is_offloaded) { - struct kvec iov[2]; + struct crypto_aead *tfm;struct smb_rqst rqst = {NULL }; +struct kvec iov[2 ];size_t iter_size =0 ;int rc;
@@ -4535,9 +4522,31 @@ decrypt_raw_data(struct TCP_Server_Info *server, char *buf, iter_size =iov_iter_count (iter); } - rc =crypt_message (server,1 , &rqst,0 ); +if (is_offloaded) { +if ((server->cipher_type ==SMB2_ENCRYPTION_AES128_GCM ) || + (server->cipher_type ==SMB2_ENCRYPTION_AES256_GCM )) + tfm =crypto_alloc_aead ("gcm(aes)" ,0 ,0 ); +else + tfm =crypto_alloc_aead ("ccm(aes)" ,0 ,0 ); +if (IS_ERR (tfm)) { + rc =PTR_ERR (tfm); +cifs_server_dbg (VFS ,"%s: Failed alloc decrypt TFM, rc=%d\n" , __func__, rc); + +return rc; + } + }else { +if (unlikely (!server->secmech.dec)) +return -EIO ; + + tfm = server->secmech.dec; + } + + rc =crypt_message (server,1 , &rqst,0 , tfm);cifs_dbg (FYI ,"Decrypt message returned %d\n" , rc); +if (is_offloaded) +crypto_free_aead (tfm); +if (rc)return rc;
fs/smb/client/smb2pdu.c +6 -0
@@ -1265,6 +1265,12 @@ SMB2_negotiate(const unsigned int xid,else cifs_server_dbg (VFS ,"Missing expected negotiate contexts\n" ); } + +if (server->cipher_type && !rc) { + rc =smb3_crypto_aead_allocate (server); +if (rc) +cifs_server_dbg (VFS ,"%s: crypto alloc failed, rc=%d\n" , __func__, rc); + } neg_exit:free_rsp_buf (resp_buftype, rsp);return rc;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/214 fbdev: sisfb: Fix strbuf array overflow
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Shumilin <[email protected]>
[ Upstream commit 9cf14f5a2746c19455ce9cb44341b5527b5e19c3 ]
The values of the variables xres and yres are placed in strbuf. These variables are obtained from strbuf1.
The strbuf1 array contains digit characters
and a space if the array contains non-digit characters. Then, when executing sprintf(strbuf, "%ux%ux8", xres, yres); more than 16 bytes will be written to strbuf.
It is suggested to increase the size of the strbuf array to 24.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/video/fbdev/sis/sis_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/sis/sis_main.c +1 -1
@@ -183,7 +183,7 @@ static void sisfb_search_mode(char *name, bool quiet) {unsigned int j =0 , xres =0 , yres =0 , depth =0 , rate =0 ;int i =0 ; -char strbuf[16 ], strbuf1[20 ]; +char strbuf[24 ], strbuf1[20 ];char *nameptr = name;/* We don't know the hardware specs yet and there is no ivideo */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/214 NFSD: Mark filecache "down" if init fails
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit dc0d0f885aa422f621bc1c2124133eff566b0bc8 ]
NeilBrown says:
Quoted 4 lines
The handling of
NFSD_FILE_CACHE_UPis strange.nfsd_file_cache_init()sets it, but doesn't clear it on failure. So ifnfsd_file_cache_init()fails for some reason,nfsd_file_cache_shutdown()would still try to clean up if it was called.
--- fs/nfsd/filecache.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/nfsd/filecache.c +3 -1
@@ -719,7 +719,7 @@ nfsd_file_cache_init(void) ret =rhltable_init (&nfsd_file_rhltable, &nfsd_file_rhash_params);if (ret) -return ret; + goto out; ret = -ENOMEM ; nfsd_file_slab =KMEM_CACHE (nfsd_file,0 );
@@ -771,6 +771,8 @@ nfsd_file_cache_init(void)INIT_DELAYED_WORK (&nfsd_filecache_laundrette, nfsd_file_gc_worker); out: +if (ret) +clear_bit (NFSD_FILE_CACHE_UP , &nfsd_file_flags);return ret; out_notifier:lease_unregister_notifier (&nfsd_file_lease_notifier);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/214 nfsd: nfsd_destroy_serv() must call svc_destroy() even if nfsd_startup_net() failed
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
[ Upstream commit 53e4e17557049d7688ca9dadeae80864d40cf0b7 ]
If nfsd_startup_net() fails and so ->nfsd_net_up is false, nfsd_destroy_serv() doesn't currently call svc_destroy(). It should.
--- fs/nfsd/nfssvc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/nfsd/nfssvc.c +3 -3
@@ -449,6 +449,9 @@ static void nfsd_shutdown_net(struct net *net) {struct nfsd_net *nn =net_generic (net, nfsd_net_id); +if (!nn->nfsd_net_up) +return ; +nfsd_export_flush (net);nfs4_state_shutdown_net (net);nfsd_reply_cache_shutdown (nn);nfsd_file_cache_shutdown_net (net);
@@ -556,11 +559,8 @@ void nfsd_destroy_serv(struct net *net)* other initialization has been done except the rpcb information. */ svc_rpcb_cleanup (serv, net); -if (!nn->nfsd_net_up) -return ;nfsd_shutdown_net (net); -nfsd_export_flush (net);svc_destroy (&serv); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/214 ice: set correct dst VSI in only LAN filters
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Swiatkowski <[email protected]>
[ Upstream commit 839e3f9bee425c90a0423d14b102a42fe6635c73 ]
The filters set that will reproduce the problem:
$ tc filter add dev $VF0_PR ingress protocol arp prio 0 flower \ skip_sw dst_mac ff:ff:ff:ff:ff:ff action mirred egress \ redirect dev $PF0 $ tc filter add dev $VF0_PR ingress protocol arp prio 0 flower \ skip_sw dst_mac ff:ff:ff:ff:ff:ff src_mac 52:54:00:00:00:10 \ action mirred egress mirror dev $VF1_PR
Expected behaviour is to set all broadcast from VF0 to the LAN. If the src_mac match the value from filters, send packet to LAN and to VF1.
In this case both LAN_EN and LB_EN flags in switch is set in case of packet matching both filters. As dst VSI for the only LAN enable bit is PF VSI, the packet is being seen on PF. To fix this change dst VSI to the source VSI. It will block receiving any packet even when LB_EN is set by switch, because local loopback is clear on VF VSI during normal operation.
Side note: if the second filters action is redirect instead of mirror LAN_EN is clear, because switch is AND-ing LAN_EN from each matched filters and OR-ing LB_EN.
--- drivers/net/ethernet/intel/ice/ice_tc_lib.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/net/ethernet/intel/ice/ice_tc_lib.c +11 -0
@@ -819,6 +819,17 @@ ice_eswitch_add_tc_fltr(struct ice_vsi *vsi, struct ice_tc_flower_fltr *fltr) rule_info.sw_act.flag |=ICE_FLTR_TX ; rule_info.sw_act.src = vsi->idx; rule_info.flags_info.act =ICE_SINGLE_ACT_LAN_ENABLE ; +/* This is a specific case. The destination VSI index is +* overwritten by the source VSI index. This type of filter +* should allow the packet to go to the LAN, not to the +* VSI passed here. It should set LAN_EN bit only. However, +* the VSI must be a valid one. Setting source VSI index +* here is safe. Even if the result from switch is set LAN_EN +* and LB_EN (which normally will pass the packet to this VSI) +* packet won't be seen on the VSI, because local loopback is +* turned off. +*/ + rule_info.sw_act.vsi_handle = vsi->idx; }else {/* VF to VF */ rule_info.sw_act.flag |=ICE_FLTR_TX ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/214 ice: clear port vlan config during reset
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Swiatkowski <[email protected]>
[ Upstream commit d019b1a9128d65956f04679ec2bb8b0800f13358 ]
Since commit 2a2cb4c6c181 ("ice: replace ice_vf_recreate_vsi() with ice_vf_reconfig_vsi()") VF VSI is only reconfigured instead of recreated. The context configuration from previous setting is still the same. If any of the config needs to be cleared it needs to be cleared explicitly.
Previously there was assumption that port vlan will be cleared automatically. Now, when VSI is only reconfigured we have to do it in the code.
Not clearing port vlan configuration leads to situation when the driver VSI config is different than the VSI config in HW. Traffic can't be passed after setting and clearing port vlan, because of invalid VSI config in HW.
Example reproduction:
Quoted 3 lines
ip a a dev $(VF) $(VF_IP_ADDRESS)
ip l s dev $(VF) up
ping $(VF_IP_ADDRESS)
ping is working fine here
Quoted 3 lines
ip link set eth5 vf 0 vlan 100
ip link set eth5 vf 0 vlan 0
ping $(VF_IP_ADDRESS)
ping isn't working
--- drivers/net/ethernet/intel/ice/ice_vf_lib.c | 7 +++ .../net/ethernet/intel/ice/ice_vsi_vlan_lib.c | 57 +++++++++++++++++++ .../net/ethernet/intel/ice/ice_vsi_vlan_lib.h | 1 + 3 files changed, 65 insertions(+)
drivers/net/ethernet/intel/ice/ice_vf_lib.c +7 -0
@@ -335,6 +335,13 @@ static int ice_vf_rebuild_host_vlan_cfg(struct ice_vf *vf, struct ice_vsi *vsi) err = vlan_ops->add_vlan (vsi, &vf->port_vlan_info); }else { +/* clear possible previous port vlan config */ + err =ice_vsi_clear_port_vlan (vsi); +if (err) { +dev_err (dev,"failed to clear port VLAN via VSI parameters for VF %u, error %d\n" , + vf->vf_id, err); +return err; + } err =ice_vsi_add_vlan_zero (vsi); }
drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.c +57 -0
60 lines not on this page · raw message
drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.h +1 -0
@@ -36,5 +36,6 @@ int ice_vsi_ena_outer_insertion(struct ice_vsi *vsi, u16 tpid);int ice_vsi_dis_outer_insertion (struct ice_vsi *vsi);int ice_vsi_set_outer_port_vlan (struct ice_vsi *vsi,struct ice_vlan *vlan);int ice_vsi_clear_outer_port_vlan (struct ice_vsi *vsi); +int ice_vsi_clear_port_vlan (struct ice_vsi *vsi);#endif /* _ICE_VSI_VLAN_LIB_H_ */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/214 ice: fix memleak in ice_init_tx_topology()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Przemek Kitszel <[email protected]>
[ Upstream commit c188afdc36113760873ec78cbc036f6b05f77621 ]
Fix leak of the FW blob (DDP pkg).
Make ice_cfg_tx_topo() const-correct, so ice_init_tx_topology() can avoid copying whole FW blob. Copy just the topology section, and only when needed. Reuse the buffer allocated for the read of the current topology.
This was found by kmemleak, with the following trace for each PF:
[<ffffffff8761044d>] kmemdup_noprof+0x1d/0x50
[<ffffffffc0a0a480>] ice_init_ddp_config+0x100/0x220 [ice]
[<ffffffffc0a0da7f>] ice_init_dev+0x6f/0x200 [ice]
[<ffffffffc0a0dc49>] ice_init+0x29/0x560 [ice]
[<ffffffffc0a10c1d>] ice_probe+0x21d/0x310 [ice]Constify ice_cfg_tx_topo() @buf parameter.
This cascades further down to few more functions.
--- drivers/net/ethernet/intel/ice/ice_ddp.c | 58 +++++++++++------------ drivers/net/ethernet/intel/ice/ice_ddp.h | 4 +- drivers/net/ethernet/intel/ice/ice_main.c | 8 +--- 3 files changed, 31 insertions(+), 39 deletions(-)
drivers/net/ethernet/intel/ice/ice_ddp.c +28 -30
@@ -31,7 +31,7 @@ static const struct ice_tunnel_type_scan tnls[] = {* Verifies various attributes of the package file, including length, format * version, and the requirement of at least one segment. */ -static enum ice_ddp_state ice_verify_pkg (struct ice_pkg_hdr *pkg,u32 len) +static enum ice_ddp_state ice_verify_pkg (const struct ice_pkg_hdr *pkg,u32 len) {u32 seg_count;u32 i;
@@ -57,13 +57,13 @@ static enum ice_ddp_state ice_verify_pkg(struct ice_pkg_hdr *pkg, u32 len)/* all segments must fit within length */ for (i =0 ; i < seg_count; i++) {u32 off =le32_to_cpu (pkg->seg_offset[i]); -struct ice_generic_seg_hdr *seg; +const struct ice_generic_seg_hdr *seg;/* segment header must fit */ if (len < off +sizeof (*seg))return ICE_DDP_PKG_INVALID_FILE ; - seg = (struct ice_generic_seg_hdr *)((u8 *)pkg + off); + seg = (void *)pkg + off;/* segment body must fit */ if (len < off +le32_to_cpu (seg->seg_size))
@@ -119,13 +119,13 @@ static enum ice_ddp_state ice_chk_pkg_version(struct ice_pkg_ver *pkg_ver)* * This helper function validates a buffer's header. */ -static struct ice_buf_hdr *ice_pkg_val_buf (struct ice_buf *buf) +static const struct ice_buf_hdr *ice_pkg_val_buf (const struct ice_buf *buf) { -struct ice_buf_hdr *hdr; +const struct ice_buf_hdr *hdr;u16 section_count;u16 data_end; - hdr = (struct ice_buf_hdr *)buf->buf; + hdr = (const struct ice_buf_hdr *)buf->buf;/* verify data */ section_count =le16_to_cpu (hdr->section_count);if (section_count <ICE_MIN_S_COUNT || section_count >ICE_MAX_S_COUNT )
@@ -165,8 +165,8 @@ static struct ice_buf_table *ice_find_buf_table(struct ice_seg *ice_seg)* unexpected value has been detected (for example an invalid section count or * an invalid buffer end value). */ -static struct ice_buf_hdr *ice_pkg_enum_buf (struct ice_seg *ice_seg, -struct ice_pkg_enum *state) +static const struct ice_buf_hdr *ice_pkg_enum_buf (struct ice_seg *ice_seg, +struct ice_pkg_enum *state) {if (ice_seg) { state->buf_table =ice_find_buf_table (ice_seg);
@@ -1800,9 +1800,9 @@ int ice_update_pkg(struct ice_hw *hw, struct ice_buf *bufs, u32 count)* success it returns a pointer to the segment header, otherwise it will * return NULL. */ -static struct ice_generic_seg_hdr * +static const struct ice_generic_seg_hdr *ice_find_seg_in_pkg (struct ice_hw *hw,u32 seg_type, -struct ice_pkg_hdr *pkg_hdr) +const struct ice_pkg_hdr *pkg_hdr) {u32 i;
@@ -1813,11 +1813,9 @@ ice_find_seg_in_pkg(struct ice_hw *hw, u32 seg_type,/* Search all package segments for the requested segment type */ for (i =0 ; i <le32_to_cpu (pkg_hdr->seg_count); i++) { -struct ice_generic_seg_hdr *seg; +const struct ice_generic_seg_hdr *seg; - seg = (struct ice_generic_seg_hdr - *)((u8 *)pkg_hdr + -le32_to_cpu (pkg_hdr->seg_offset[i])); + seg = (void *)pkg_hdr +le32_to_cpu (pkg_hdr->seg_offset[i]);if (le32_to_cpu (seg->seg_type) == seg_type)return seg;
@@ -2354,12 +2352,12 @@ ice_get_set_tx_topo(struct ice_hw *hw, u8 *buf, u16 buf_size,* * Return: zero when update was successful, negative values otherwise. */ -int ice_cfg_tx_topo (struct ice_hw *hw,u8 *buf,u32 len) +int ice_cfg_tx_topo (struct ice_hw *hw,const void *buf,u32 len) { -u8 *current_topo, *new_topo =NULL ; -struct ice_run_time_cfg_seg *seg; -struct ice_buf_hdr *section; -struct ice_pkg_hdr *pkg_hdr; + u8 *new_topo = NULL, *topo __free(kfree) = NULL; +const struct ice_run_time_cfg_seg *seg; +const struct ice_buf_hdr *section; +const struct ice_pkg_hdr *pkg_hdr;enum ice_ddp_state state;u16 offset, size =0 ;u32 reg =0 ;
@@ -2375,15 +2373,13 @@ int ice_cfg_tx_topo(struct ice_hw *hw, u8 *buf, u32 len)return -EOPNOTSUPP ; } - current_topo =kzalloc (ICE_AQ_MAX_BUF_LEN ,GFP_KERNEL ); -if (!current_topo) + topo =kzalloc (ICE_AQ_MAX_BUF_LEN ,GFP_KERNEL ); +if (!topo)return -ENOMEM ; -/* Get the current Tx topology */ - status =ice_get_set_tx_topo (hw, current_topo,ICE_AQ_MAX_BUF_LEN ,NULL , - &flags, false); - -kfree (current_topo); +/* Get the current Tx topology flags */ + status =ice_get_set_tx_topo (hw, topo,ICE_AQ_MAX_BUF_LEN ,NULL , &flags, + false);if (status) {ice_debug (hw,ICE_DBG_INIT ,"Get current topology is failed\n" );
@@ -2419,7 +2415,7 @@ int ice_cfg_tx_topo(struct ice_hw *hw, u8 *buf, u32 len) goto update_topo; } - pkg_hdr = (struct ice_pkg_hdr *)buf; + pkg_hdr = (const struct ice_pkg_hdr *)buf; state =ice_verify_pkg (pkg_hdr, len);if (state) { ice_debug(hw, ICE_DBG_INIT, "Failed to verify pkg (err: %d)\n",
@@ -2428,7 +2424,7 @@ int ice_cfg_tx_topo(struct ice_hw *hw, u8 *buf, u32 len) }/* Find runtime configuration segment */ - seg = (struct ice_run_time_cfg_seg *) + seg = (const struct ice_run_time_cfg_seg *)ice_find_seg_in_pkg (hw,SEGMENT_TYPE_ICE_RUN_TIME_CFG , pkg_hdr);if (!seg) {ice_debug (hw,ICE_DBG_INIT ,"5 layer topology segment is missing\n" );
@@ -2461,8 +2457,10 @@ int ice_cfg_tx_topo(struct ice_hw *hw, u8 *buf, u32 len)return -EIO ; } -/* Get the new topology buffer */ - new_topo = ((u8 *)section) + offset; +/* Get the new topology buffer, reuse current topo copy mem */ +static_assert (ICE_PKG_BUF_SIZE ==ICE_AQ_MAX_BUF_LEN ); + new_topo = topo; +memcpy (new_topo, (u8 *)section + offset, size); update_topo:/* Acquire global lock to make sure that set topology issued
drivers/net/ethernet/intel/ice/ice_ddp.h +2 -2
@@ -430,7 +430,7 @@ struct ice_pkg_enum {u32 buf_idx;u32 type; -struct ice_buf_hdr *buf; +const struct ice_buf_hdr *buf;u32 sect_idx;void *sect;u32 sect_type;
@@ -454,6 +454,6 @@ u16 ice_pkg_buf_get_active_sections(struct ice_buf_build *bld);void *ice_pkg_enum_section (struct ice_seg *ice_seg,struct ice_pkg_enum *state,u32 sect_type); -int ice_cfg_tx_topo (struct ice_hw *hw,u8 *buf,u32 len); +int ice_cfg_tx_topo (struct ice_hw *hw,const void *buf,u32 len);#endif
drivers/net/ethernet/intel/ice/ice_main.c +1 -7
@@ -4548,16 +4548,10 @@ ice_init_tx_topology(struct ice_hw *hw, const struct firmware *firmware)u8 num_tx_sched_layers = hw->num_tx_sched_layers;struct ice_pf *pf = hw->back;struct device *dev; -u8 *buf_copy;int err; dev =ice_pf_to_dev (pf); -/* ice_cfg_tx_topo buf argument is not a constant, -* so we have to make a copy -*/ - buf_copy =kmemdup (firmware->data, firmware->size,GFP_KERNEL ); - - err =ice_cfg_tx_topo (hw, buf_copy, firmware->size); + err =ice_cfg_tx_topo (hw, firmware->data, firmware->size);if (!err) {if (hw->num_tx_sched_layers > num_tx_sched_layers)dev_info (dev,"Tx scheduling layers switching feature disabled\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/214 ice: disallow DPLL_PIN_STATE_SELECTABLE for dpll output pins
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arkadiusz Kubalewski <[email protected]>
[ Upstream commit afe6e30e7701979f536f8fbf6fdef7212441f61a ]
Currently the user may request DPLL_PIN_STATE_SELECTABLE for an output pin, and this would actually set the DISCONNECTED state instead.
It doesn't make any sense. SELECTABLE is valid only in case of input pins (on AUTOMATIC type dpll), where dpll itself would select best valid input. For the output pin only CONNECTED/DISCONNECTED are expected.
--- drivers/net/ethernet/intel/ice/ice_dpll.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/intel/ice/ice_dpll.c +2 -0
@@ -651,6 +651,8 @@ ice_dpll_output_state_set(const struct dpll_pin *pin, void *pin_priv,struct ice_dpll_pin *p = pin_priv;struct ice_dpll *d = dpll_priv; +if (state ==DPLL_PIN_STATE_SELECTABLE ) +return -EINVAL ;if (!enable && p->state[d->dpll_idx] ==DPLL_PIN_STATE_DISCONNECTED )return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/214 ice: fix VLAN replay after reset
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Ertman <[email protected]>
[ Upstream commit 0eae2c136cb624e4050092feb59f18159b4f2512 ]
There is a bug currently when there are more than one VLAN defined and any reset that affects the PF is initiated, after the reset rebuild no traffic will pass on any VLAN but the last one created.
This is caused by the iteration though the VLANs during replay each clearing the vsi_map bitmap of the VSI that is being replayed. The problem is that during rhe replay, the pointer to the vsi_map bitmap is used by each successive vlan to determine if it should be replayed on this VSI.
The logic was that the replay of the VLAN would replace the bit in the map before the next VLAN would iterate through. But, since the replay copies the old bitmap pointer to filt_replay_rules and creates a new one for the recreated VLANS, it does not do this, and leaves the old bitmap broken to be used to replay the remaining VLANs.
Since the old bitmap will be cleaned up in post replay cleanup, there is no need to alter it and break following VLAN replay, so don't clear the bit.
--- drivers/net/ethernet/intel/ice/ice_switch.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/ethernet/intel/ice/ice_switch.c +0 -2
@@ -6322,8 +6322,6 @@ ice_replay_vsi_fltr(struct ice_hw *hw, u16 vsi_handle, u8 recp_id,if (!itr->vsi_list_info || !test_bit (vsi_handle, itr->vsi_list_info->vsi_map))continue ; -/* Clearing it so that the logic can add it back */ -clear_bit (vsi_handle, itr->vsi_list_info->vsi_map); f_entry.fltr_info.vsi_handle = vsi_handle; f_entry.fltr_info.fltr_act =ICE_FWD_TO_VSI ;/* update the src in case it is VSI num */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/214 SUNRPC: Fix integer overflow in decode_rc_list()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 6dbf1f341b6b35bcc20ff95b6b315e509f6c5369 ]
The math in "rc_list->rcl_nrefcalls * 2 * sizeof(uint32_t)" could have an integer overflow. Add bounds checking on rc_list->rcl_nrefcalls to fix that.
--- fs/nfs/callback_xdr.c | 2 ++ 1 file changed, 2 insertions(+)
fs/nfs/callback_xdr.c +2 -0
@@ -375,6 +375,8 @@ static __be32 decode_rc_list(struct xdr_stream *xdr, rc_list->rcl_nrefcalls =ntohl (*p++);if (rc_list->rcl_nrefcalls) { +if (unlikely (rc_list->rcl_nrefcalls > xdr->buf->len)) + goto out; p =xdr_inline_decode (xdr, rc_list->rcl_nrefcalls *2 *sizeof (uint32_t ));if (unlikely (p ==NULL ))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/214 NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yanjun Zhang <[email protected]>
[ Upstream commit a848c29e3486189aaabd5663bc11aea50c5bd144 ]
On the node of an NFS client, some files saved in the mountpoint of the NFS server were copied to another location of the same NFS server. Accidentally, the nfs42_complete_copies() got a NULL-pointer dereference crash with the following syslog:
[232064.838881] NFSv4: state recovery failed for open file nfs/pvc-12b5200d-cd0f-46a3-b9f0-af8f4fe0ef64.qcow2, error = -116 [232064.839360] NFSv4: state recovery failed for open file nfs/pvc-12b5200d-cd0f-46a3-b9f0-af8f4fe0ef64.qcow2, error = -116 [232066.588183] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000058 [232066.588586] Mem abort info: [232066.588701] ESR = 0x0000000096000007 [232066.588862] EC = 0x25: DABT (current EL), IL = 32 bits [232066.589084] SET = 0, FnV = 0 [232066.589216] EA = 0, S1PTW = 0 [232066.589340] FSC = 0x07: level 3 translation fault [232066.589559] Data abort info: [232066.589683] ISV = 0, ISS = 0x00000007 [232066.589842] CM = 0, WnR = 0 [232066.589967] user pgtable: 64k pages, 48-bit VAs, pgdp=00002000956ff400 [232066.590231] [0000000000000058] pgd=08001100ae100003, p4d=08001100ae100003, pud=08001100ae100003, pmd=08001100b3c00003, pte=0000000000000000 [232066.590757] Internal error: Oops: 96000007 [#1] SMP [232066.590958] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm vhost_net vhost vhost_iotlb tap tun ipt_rpfilter xt_multiport ip_set_hash_ip ip_set_hash_net xfrm_interface xfrm6_tunnel tunnel4 tunnel6 esp4 ah4 wireguard libcurve25519_generic veth xt_addrtype xt_set nf_conntrack_netlink ip_set_hash_ipportnet ip_set_hash_ipportip ip_set_bitmap_port ip_set_hash_ipport dummy ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs iptable_filter sch_ingress nfnetlink_cttimeout vport_gre ip_gre ip_tunnel gre vport_geneve geneve vport_vxlan vxlan ip6_udp_tunnel udp_tunnel openvswitch nf_conncount dm_round_robin dm_service_time dm_multipath xt_nat xt_MASQUERADE nft_chain_nat nf_nat xt_mark xt_conntrack xt_comment nft_compat nft_counter nf_tables nfnetlink ocfs2 ocfs2_nodemanager ocfs2_stackglue iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ipmi_ssif nbd overlay 8021q garp mrp bonding tls rfkill sunrpc ext4 mbcache jbd2 [232066.591052] vfat fat cas_cache cas_disk ses enclosure scsi_transport_sas sg acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler ip_tables vfio_pci vfio_pci_core vfio_virqfd vfio_iommu_type1 vfio dm_mirror dm_region_hash dm_log dm_mod nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter bridge stp llc fuse xfs libcrc32c ast drm_vram_helper qla2xxx drm_kms_helper syscopyarea crct10dif_ce sysfillrect ghash_ce sysimgblt sha2_ce fb_sys_fops cec sha256_arm64 sha1_ce drm_ttm_helper ttm nvme_fc igb sbsa_gwdt nvme_fabrics drm nvme_core i2c_algo_bit i40e scsi_transport_fc megaraid_sas aes_neon_bs [232066.596953] CPU: 6 PID: 4124696 Comm: 10.253.166.125- Kdump: loaded Not tainted 5.15.131-9.cl9_ocfs2.aarch64 #1 [232066.597356] Hardware name: Great Wall .\x93\x8e...RF6260 V5/GWMSSE2GL1T, BIOS T656FBE_V3.0.18 2024-01-06 [232066.597721] pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [232066.598034] pc : nfs4_reclaim_open_state+0x220/0x800 [nfsv4] [232066.598327] lr : nfs4_reclaim_open_state+0x12c/0x800 [nfsv4] [232066.598595] sp : ffff8000f568fc70 [232066.598731] x29: ffff8000f568fc70 x28: 0000000000001000 x27: ffff21003db33000 [232066.599030] x26: ffff800005521ae0 x25: ffff0100f98fa3f0 x24: 0000000000000001 [232066.599319] x23: ffff800009920008 x22: ffff21003db33040 x21: ffff21003db33050 [232066.599628] x20: ffff410172fe9e40 x19: ffff410172fe9e00 x18: 0000000000000000 [232066.599914] x17: 0000000000000000 x16: 0000000000000004 x15: 0000000000000000 [232066.600195] x14: 0000000000000000 x13: ffff800008e685a8 x12: 00000000eac0c6e6 [232066.600498] x11: 0000000000000000 x10: 0000000000000008 x9 : ffff8000054e5828 [232066.600784] x8 : 00000000ffffffbf x7 : 0000000000000001 x6 : 000000000a9eb14a [232066.601062] x5 : 0000000000000000 x4 : ffff70ff8a14a800 x3 : 0000000000000058 [232066.601348] x2 : 0000000000000001 x1 : 54dce46366daa6c6 x0 : 0000000000000000 [232066.601636] Call trace: [232066.601749] nfs4_reclaim_open_state+0x220/0x800 [nfsv4] [232066.601998] nfs4_do_reclaim+0x1b8/0x28c [nfsv4] [232066.602218] nfs4_state_manager+0x928/0x10f0 [nfsv4] [232066.602455] nfs4_run_state_manager+0x78/0x1b0 [nfsv4] [232066.602690] kthread+0x110/0x114 [232066.602830] ret_from_fork+0x10/0x20 [232066.602985] Code: 1400000d f9403f20 f9402e61 91016003 (f9402c00) [232066.603284] SMP: stopping secondary CPUs [232066.606936] Starting crashdump kernel... [232066.607146] Bye!
Analysing the vmcore, we know that nfs4_copy_state listed by destination nfs_server->ss_copies was added by the field copies in handle_async_copy(), and we found a waiting copy process with the stack as:
PID: 3511963 TASK: ffff710028b47e00 CPU: 0 COMMAND: "cp"
#0 [ffff8001116ef740] __switch_to at ffff8000081b92f4
#1 [ffff8001116ef760] __schedule at ffff800008dd0650
#2 [ffff8001116ef7c0] schedule at ffff800008dd0a00
#3 [ffff8001116ef7e0] schedule_timeout at ffff800008dd6aa0
#4 [ffff8001116ef860] __wait_for_common at ffff800008dd166c
#5 [ffff8001116ef8e0] wait_for_completion_interruptible at ffff800008dd1898 #6 [ffff8001116ef8f0] handle_async_copy at ffff8000055142f4 [nfsv4]
#7 [ffff8001116ef970] _nfs42_proc_copy at ffff8000055147c8 [nfsv4]
#8 [ffff8001116efa80] nfs42_proc_copy at ffff800005514cf0 [nfsv4]
#9 [ffff8001116efc50] __nfs4_copy_file_range.constprop.0 at ffff8000054ed694 [nfsv4]
The NULL-pointer dereference was due to nfs42_complete_copies() listed the nfs_server->ss_copies by the field ss_copies of nfs4_copy_state. So the nfs4_copy_state address ffff0100f98fa3f0 was offset by 0x10 and the data accessed through this pointer was also incorrect. Generally, the ordered list nfs4_state_owner->so_states indicate open(O_RDWR) or open(O_WRITE) states are reclaimed firstly by nfs4_reclaim_open_state(). When destination state reclaim is failed with NFS_STATE_RECOVERY_FAILED and copies are not deleted in nfs_server->ss_copies, the source state may be passed to the nfs42_complete_copies() process earlier, resulting in this crash scene finally. To solve this issue, we add a list_head nfs_server->ss_src_copies for a server-to-server copy specially.
--- fs/nfs/client.c | 1 + fs/nfs/nfs42proc.c | 2 +- fs/nfs/nfs4state.c | 2 +- include/linux/nfs_fs_sb.h | 1 + 4 files changed, 4 insertions(+), 2 deletions(-)
fs/nfs/client.c +1 -0
@@ -983,6 +983,7 @@ struct nfs_server *nfs_alloc_server(void)INIT_LIST_HEAD (&server->layouts);INIT_LIST_HEAD (&server->state_owners_lru);INIT_LIST_HEAD (&server->ss_copies); +INIT_LIST_HEAD (&server->ss_src_copies);atomic_set (&server->active,0 );
fs/nfs/nfs42proc.c +1 -1
@@ -218,7 +218,7 @@ static int handle_async_copy(struct nfs42_copy_res *res,if (dst_server != src_server) {spin_lock (&src_server->nfs_client->cl_lock); -list_add_tail (©->src_copies, &src_server->ss_copies); +list_add_tail (©->src_copies, &src_server->ss_src_copies);spin_unlock (&src_server->nfs_client->cl_lock); }
fs/nfs/nfs4state.c +1 -1
@@ -1596,7 +1596,7 @@ static void nfs42_complete_copies(struct nfs4_state_owner *sp, struct nfs4_statecomplete (©->completion); } } -list_for_each_entry (copy, &sp->so_server->ss_copies, src_copies) { +list_for_each_entry (copy, &sp->so_server->ss_src_copies, src_copies) {if ((test_bit (NFS_CLNT_SRC_SSC_COPY_STATE , &state->flags) && !nfs4_stateid_match_other (&state->stateid, ©->parent_src_state->stateid)))
include/linux/nfs_fs_sb.h +1 -0
@@ -240,6 +240,7 @@ struct nfs_server {struct list_head layouts;struct list_head delegations;struct list_head ss_copies; +struct list_head ss_src_copies;unsigned long delegation_gen;unsigned long mig_gen;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/214 net: phy: dp83869: fix memory corruption when enabling fiber
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ingo van Lil <[email protected]>
[ Upstream commit a842e443ca8184f2dc82ab307b43a8b38defd6a5 ]
When configuring the fiber port, the DP83869 PHY driver incorrectly calls linkmode_set_bit() with a bit mask (1 << 10) rather than a bit number (10). This corrupts some other memory location -- in case of arm64 the priv pointer in the same structure.
Since the advertising flags are updated from supported at the end of the function the incorrect line isn't needed at all and can be removed.
--- drivers/net/phy/dp83869.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/phy/dp83869.c +0 -1
@@ -645,7 +645,6 @@ static int dp83869_configure_fiber(struct phy_device *phydev, phydev->supported);linkmode_set_bit (ETHTOOL_LINK_MODE_FIBRE_BIT , phydev->supported); -linkmode_set_bit (ADVERTISED_FIBRE , phydev->advertising);if (dp83869->mode ==DP83869_RGMII_1000_BASE ) { linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/214 sfc: Dont invoke xdp_do_flush() from netpoll.
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 55e802468e1d38dec8e25a2fdb6078d45b647e8c ]
Yury reported a crash in the sfc driver originated from netpoll_send_udp(). The netconsole sends a message and then netpoll invokes the driver's NAPI function with a budget of zero. It is dedicated to allow driver to free TX resources, that it may have used while sending the packet.
In the netpoll case the driver invokes xdp_do_flush() unconditionally, leading to crash because bpf_net_context was never assigned.
Invoke xdp_do_flush() only if budget is not zero.
--- drivers/net/ethernet/sfc/efx_channels.c | 3 ++- drivers/net/ethernet/sfc/siena/efx_channels.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/sfc/efx_channels.c +2 -1
@@ -1260,7 +1260,8 @@ static int efx_poll(struct napi_struct *napi, int budget) spent =efx_process_channel (channel, budget); -xdp_do_flush (); +if (budget) +xdp_do_flush ();if (spent < budget) { if (efx_channel_has_rx_queue(channel) &&
drivers/net/ethernet/sfc/siena/efx_channels.c +2 -1
@@ -1285,7 +1285,8 @@ static int efx_poll(struct napi_struct *napi, int budget) spent =efx_process_channel (channel, budget); -xdp_do_flush (); +if (budget) +xdp_do_flush ();if (spent < budget) { if (efx_channel_has_rx_queue(channel) &&
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/214 net: phy: aquantia: AQR115c fix up PMA capabilities
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhishek Chauhan <[email protected]>
[ Upstream commit 17cbfcdd85f6c93b2e9565d61110ad0b90440436 ]
AQR115c reports incorrect PMA capabilities which includes 10G/5G and also incorrectly disables capabilities like autoneg and 10Mbps support.
AQR115c as per the Marvell databook supports speeds up to 2.5Gbps with autonegotiation.
--- drivers/net/phy/aquantia/aquantia_main.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/net/phy/aquantia/aquantia_main.c +14 -0
@@ -731,6 +731,19 @@ static int aqr113c_fill_interface_modes(struct phy_device *phydev)return aqr107_fill_interface_modes (phydev); } +static int aqr115c_get_features (struct phy_device *phydev) +{ +unsigned long *supported = phydev->supported; + +/* PHY supports speeds up to 2.5G with autoneg. PMA capabilities +* are not useful. +*/ +linkmode_or (supported, supported, phy_gbit_features); +linkmode_set_bit (ETHTOOL_LINK_MODE_2500baseT_Full_BIT, supported); + +return 0 ; +} +static int aqr113c_config_init (struct phy_device *phydev) {int ret;
@@ -1046,6 +1059,7 @@ static struct phy_driver aqr_driver[] = { .get_sset_count = aqr107_get_sset_count, .get_strings = aqr107_get_strings, .get_stats = aqr107_get_stats, + .get_features = aqr115c_get_features, .link_change_notify = aqr107_link_change_notify, .led_brightness_set = aqr_phy_led_brightness_set, .led_hw_is_supported = aqr_phy_led_hw_is_supported,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/214 net: phy: aquantia: remove usage of phy_set_max_speed
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhishek Chauhan <[email protected]>
[ Upstream commit 8f61d73306c62e3c0e368cf6051330f4593415f6 ]
Remove the use of phy_set_max_speed in phy driver as the function is mainly used in MAC driver to set the max speed.
Instead use get_features to fix up Phy PMA capabilities for AQR111, AQR111B0, AQR114C and AQCS109
--- drivers/net/phy/aquantia/aquantia_main.c | 37 ++++++++++++------------ 1 file changed, 19 insertions(+), 18 deletions(-)
drivers/net/phy/aquantia/aquantia_main.c +19 -18
@@ -537,12 +537,6 @@ static int aqcs109_config_init(struct phy_device *phydev)if (!ret)aqr107_chip_info (phydev); -/* AQCS109 belongs to a chip family partially supporting 10G and 5G. -* PMA speed ability bits are the same for all members of the family, -* AQCS109 however supports speeds up to 2.5G only. -*/ -phy_set_max_speed (phydev,SPEED_2500 ); -return aqr107_set_downshift (phydev,MDIO_AN_VEND_PROV_DOWNSHIFT_DFLT ); }
@@ -744,6 +738,18 @@ static int aqr115c_get_features(struct phy_device *phydev)return 0 ; } +static int aqr111_get_features (struct phy_device *phydev) +{ +/* PHY supports speeds up to 5G with autoneg. PMA capabilities +* are not useful. +*/ +aqr115c_get_features (phydev); +linkmode_set_bit (ETHTOOL_LINK_MODE_5000baseT_Full_BIT, + phydev->supported); + +return 0 ; +} +static int aqr113c_config_init (struct phy_device *phydev) {int ret;
@@ -780,15 +786,6 @@ static int aqr107_probe(struct phy_device *phydev)return aqr_hwmon_probe (phydev); } -static int aqr111_config_init (struct phy_device *phydev) -{ -/* AQR111 reports supporting speed up to 10G, -* however only speeds up to 5G are supported. -*/ -phy_set_max_speed (phydev,SPEED_5000 ); - -return aqr107_config_init (phydev); -}static struct phy_driver aqr_driver[] = { {
@@ -866,6 +863,7 @@ static struct phy_driver aqr_driver[] = { .get_sset_count = aqr107_get_sset_count, .get_strings = aqr107_get_strings, .get_stats = aqr107_get_stats, + .get_features = aqr115c_get_features, .link_change_notify = aqr107_link_change_notify, .led_brightness_set = aqr_phy_led_brightness_set, .led_hw_is_supported = aqr_phy_led_hw_is_supported,
@@ -878,7 +876,7 @@ static struct phy_driver aqr_driver[] = { .name = "Aquantia AQR111", .probe = aqr107_probe, .get_rate_matching = aqr107_get_rate_matching, - .config_init = aqr111_config_init, + .config_init = aqr107_config_init, .config_aneg = aqr_config_aneg, .config_intr = aqr_config_intr, .handle_interrupt = aqr_handle_interrupt,
@@ -890,6 +888,7 @@ static struct phy_driver aqr_driver[] = { .get_sset_count = aqr107_get_sset_count, .get_strings = aqr107_get_strings, .get_stats = aqr107_get_stats, + .get_features = aqr111_get_features, .link_change_notify = aqr107_link_change_notify, .led_brightness_set = aqr_phy_led_brightness_set, .led_hw_is_supported = aqr_phy_led_hw_is_supported,
@@ -902,7 +901,7 @@ static struct phy_driver aqr_driver[] = { .name = "Aquantia AQR111B0", .probe = aqr107_probe, .get_rate_matching = aqr107_get_rate_matching, - .config_init = aqr111_config_init, + .config_init = aqr107_config_init, .config_aneg = aqr_config_aneg, .config_intr = aqr_config_intr, .handle_interrupt = aqr_handle_interrupt,
@@ -914,6 +913,7 @@ static struct phy_driver aqr_driver[] = { .get_sset_count = aqr107_get_sset_count, .get_strings = aqr107_get_strings, .get_stats = aqr107_get_stats, + .get_features = aqr111_get_features, .link_change_notify = aqr107_link_change_notify, .led_brightness_set = aqr_phy_led_brightness_set, .led_hw_is_supported = aqr_phy_led_hw_is_supported,
@@ -1023,7 +1023,7 @@ static struct phy_driver aqr_driver[] = { .name = "Aquantia AQR114C", .probe = aqr107_probe, .get_rate_matching = aqr107_get_rate_matching, - .config_init = aqr111_config_init, + .config_init = aqr107_config_init, .config_aneg = aqr_config_aneg, .config_intr = aqr_config_intr, .handle_interrupt = aqr_handle_interrupt,
@@ -1035,6 +1035,7 @@ static struct phy_driver aqr_driver[] = { .get_sset_count = aqr107_get_sset_count, .get_strings = aqr107_get_strings, .get_stats = aqr107_get_stats, + .get_features = aqr111_get_features, .link_change_notify = aqr107_link_change_notify, .led_brightness_set = aqr_phy_led_brightness_set, .led_hw_is_supported = aqr_phy_led_hw_is_supported,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/214 tcp: fix to allow timestamp undo if no retransmits were sent
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neal Cardwell <[email protected]>
[ Upstream commit e37ab7373696e650d3b6262a5b882aadad69bb9e ]
Fix the TCP loss recovery undo logic in tcp_packet_delayed() so that it can trigger undo even if TSQ prevents a fast recovery episode from reaching tcp_retransmit_skb().
Geumhwan Yu <[email protected]> recently reported that after this commit from 2019:
commit bc9f38c8328e ("tcp: avoid unconditional congestion window undo on SYN retransmit")
...and before this fix we could have buggy scenarios like the following:
+ Due to reordering, a TCP connection receives some SACKs and enters a spurious fast recovery.
+ TSQ prevents all invocations of tcp_retransmit_skb(), because many skbs are queued in lower layers of the sending machine's network stack; thus tp->retrans_stamp remains 0.
+ The connection receives a TCP timestamp ECR value echoing a timestamp before the fast recovery, indicating that the fast recovery was spurious.
+ The connection fails to undo the spurious fast recovery because tp->retrans_stamp is 0, and thus tcp_packet_delayed() returns false, due to the new logic in the 2019 commit: commit bc9f38c8328e ("tcp:
avoid unconditional congestion window undo on SYN retransmit")
This fix tweaks the logic to be more similar to the tcp_packet_delayed() logic before bc9f38c8328e, except that we take care not to be fooled by the FLAG_SYN_ACKED code path zeroing out tp->retrans_stamp (the bug noted and fixed by Yuchung in bc9f38c8328e).
Note that this returns the high-level behavior of tcp_packet_delayed() to again match the comment for the function, which says: "Nothing was retransmitted or returned timestamp is less than timestamp of the first retransmission." Note that this comment is in the original 2005-04-16 Linux git commit, so this is evidently long-standing behavior.
--- net/ipv4/tcp_input.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
net/ipv4/tcp_input.c +16 -2
@@ -2473,8 +2473,22 @@ static bool tcp_skb_spurious_retrans(const struct tcp_sock *tp,*/ static inline bool tcp_packet_delayed (const struct tcp_sock *tp) { -return tp->retrans_stamp && -tcp_tsopt_ecr_before (tp, tp->retrans_stamp); +const struct sock *sk = (const struct sock *)tp; + +if (tp->retrans_stamp && +tcp_tsopt_ecr_before (tp, tp->retrans_stamp)) +return true;/* got echoed TS before first retransmission */ + +/* Check if nothing was retransmitted (retrans_stamp==0), which may +* happen in fast recovery due to TSQ. But we ignore zero retrans_stamp +* in TCP_SYN_SENT, since when we set FLAG_SYN_ACKED we also clear +* retrans_stamp even if we had retransmitted the SYN. +*/ +if (!tp->retrans_stamp &&/* no record of a retransmit/SYN? */ + sk->sk_state !=TCP_SYN_SENT )/* not the FLAG_SYN_ACKED case? */ +return true;/* nothing was retransmitted */ + +return false; }/* Undo procedures. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/214 tcp: fix tcp_enter_recovery() to zero retrans_stamp when its safe
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neal Cardwell <[email protected]>
[ Upstream commit b41b4cbd9655bcebcce941bef3601db8110335be ]
Fix tcp_enter_recovery() so that if there are no retransmits out then we zero retrans_stamp when entering fast recovery. This is necessary to fix two buggy behaviors.
Currently a non-zero retrans_stamp value can persist across multiple back-to-back loss recovery episodes. This is because we generally only clears retrans_stamp if we are completely done with loss recoveries, and get to tcp_try_to_open() and find !tcp_any_retrans_done(sk). This behavior causes two bugs:
(1) When a loss recovery episode (CA_Loss or CA_Recovery) is followed immediately by a new CA_Recovery, the retrans_stamp value can persist and can be a time before this new CA_Recovery episode starts. That means that timestamp-based undo will be using the wrong retrans_stamp (a value that is too old) when comparing incoming TS ecr values to retrans_stamp to see if the current fast recovery episode can be undone.
(2) If there is a roughly minutes-long sequence of back-to-back fast recovery episodes, one after another (e.g. in a shallow-buffered or policed bottleneck), where each fast recovery successfully makes forward progress and recovers one window of sequence space (but leaves at least one retransmit in flight at the end of the recovery), followed by several RTOs, then the ETIMEDOUT check may be using the wrong retrans_stamp (a value set at the start of the first fast recovery in the sequence). This can cause a very premature ETIMEDOUT, killing the connection prematurely.
This commit changes the code to zero retrans_stamp when entering fast recovery, when this is known to be safe (no retransmits are out in the network). That ensures that when starting a fast recovery episode, and it is safe to do so, retrans_stamp is set when we send the fast retransmit packet. That addresses both bug (1) and bug (2) by ensuring that (if no retransmits are out when we start a fast recovery) we use the initial fast retransmit of this fast recovery as the time value for undo and ETIMEDOUT calculations.
This makes intuitive sense, since the start of a new fast recovery episode (in a scenario where no lost packets are out in the network) means that the connection has made forward progress since the last RTO or fast recovery, and we should thus "restart the clock" used for both undo and ETIMEDOUT logic.
Note that if when we start fast recovery there *are* retransmits out in the network, there can still be undesirable (1)/(2) issues. For example, after this patch we can still have the (1) and (2) problems in cases like this:
+ round 1: sender sends flight 1
+ round 2: sender receives SACKs and enters fast recovery 1, retransmits some packets in flight 1 and then sends some new data as flight 2
+ round 3: sender receives some SACKs for flight 2, notes losses, and retransmits some packets to fill the holes in flight 2
+ fast recovery has some lost retransmits in flight 1 and continues for one or more rounds sending retransmits for flight 1 and flight 2
+ fast recovery 1 completes when snd_una reaches high_seq at end of flight 1
+ there are still holes in the SACK scoreboard in flight 2, so we enter fast recovery 2, but some retransmits in the flight 2 sequence range are still in flight (retrans_out > 0), so we can't execute the new retrans_stamp=0 added here to clear retrans_stamp
It's not yet clear how to fix these remaining (1)/(2) issues in an efficient way without breaking undo behavior, given that retrans_stamp is currently used for undo and ETIMEDOUT. Perhaps the optimal (but expensive) strategy would be to set retrans_stamp to the timestamp of the earliest outstanding retransmit when entering fast recovery. But at least this commit makes things better.
Note that this does not change the semantics of retrans_stamp; it simply makes retrans_stamp accurate in some cases where it was not before:
(1) Some loss recovery, followed by an immediate entry into a fast recovery, where there are no retransmits out when entering the fast recovery.
(2) When a TFO server has a SYNACK retransmit that sets retrans_stamp, and then the ACK that completes the 3-way handshake has SACK blocks that trigger a fast recovery. In this case when entering fast recovery we want to zero out the retrans_stamp from the TFO SYNACK retransmit, and set the retrans_stamp based on the timestamp of the fast recovery.
We introduce a tcp_retrans_stamp_cleanup() helper, because this two-line sequence already appears in 3 places and is about to appear in 2 more as a result of this bug fix patch series. Once this bug fix patches series in the net branch makes it into the net-next branch we'll update the 3 other call sites to use the new helper.
This is a long-standing issue. The Fixes tag below is chosen to be the oldest commit at which the patch will apply cleanly, which is from Linux v3.5 in 2012.
--- net/ipv4/tcp_input.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
net/ipv4/tcp_input.c +13 -0
@@ -2522,6 +2522,16 @@ static bool tcp_any_retrans_done(const struct sock *sk)return false; } +/* If loss recovery is finished and there are no retransmits out in the +* network, then we clear retrans_stamp so that upon the next loss recovery +* retransmits_timed_out() and timestamp-undo are using the correct value. +*/ +static void tcp_retrans_stamp_cleanup (struct sock *sk) +{ +if (!tcp_any_retrans_done (sk)) +tcp_sk (sk)->retrans_stamp =0 ; +} +static void DBGUNDO (struct sock *sk,const char *msg) {#if FASTRETRANS_DEBUG >1
@@ -2889,6 +2899,9 @@ void tcp_enter_recovery(struct sock *sk, bool ece_ack)struct tcp_sock *tp =tcp_sk (sk);int mib_idx; +/* Start the clock with our fast retransmit, for undo and ETIMEDOUT. */ +tcp_retrans_stamp_cleanup (sk); +if (tcp_is_reno (tp)) mib_idx =LINUX_MIB_TCPRENORECOVERY ;else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/214 tcp: fix TFO SYN_RECV to not zero retrans_stamp with retransmits out
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neal Cardwell <[email protected]>
[ Upstream commit 27c80efcc20486c82698f05f00e288b44513c86b ]
Fix tcp_rcv_synrecv_state_fastopen() to not zero retrans_stamp if retransmits are outstanding.
tcp_fastopen_synack_timer() sets retrans_stamp, so typically we'll need to zero retrans_stamp here to prevent spurious retransmits_timed_out(). The logic to zero retrans_stamp is from this 2019 commit:
commit cd736d8b67fb ("tcp: fix retrans timestamp on passive Fast Open")
However, in the corner case where the ACK of our TFO SYNACK carried some SACK blocks that caused us to enter TCP_CA_Recovery then that non-zero retrans_stamp corresponds to the active fast recovery, and we need to leave retrans_stamp with its current non-zero value, for correct ETIMEDOUT and undo behavior.
--- net/ipv4/tcp_input.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
net/ipv4/tcp_input.c +9 -2
@@ -6677,10 +6677,17 @@ static void tcp_rcv_synrecv_state_fastopen(struct sock *sk)if (inet_csk (sk)->icsk_ca_state == TCP_CA_Loss && !tp->packets_out)tcp_try_undo_recovery (sk); -/* Reset rtx states to prevent spurious retransmits_timed_out() */ tcp_update_rto_time (tp); - tp->retrans_stamp =0 ;inet_csk (sk)->icsk_retransmits =0 ; +/* In tcp_fastopen_synack_timer() on the first SYNACK RTO we set +* retrans_stamp but don't enter CA_Loss, so in case that happened we +* need to zero retrans_stamp here to prevent spurious +* retransmits_timed_out(). However, if the ACK of our SYNACK caused us +* to enter CA_Recovery then we need to leave retrans_stamp as it was +* set entering CA_Recovery, for correct retransmits_timed_out() and +* undo behavior. +*/ +tcp_retrans_stamp_cleanup (sk);/* Once we leave TCP_SYN_RECV or TCP_FIN_WAIT_1, * we no longer need req so release it.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/214 rxrpc: Fix uninitialised variable in rxrpc_send_data()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 7a310f8d7dfe2d92a1f31ddb5357bfdd97eed273 ]
Fix the uninitialised txb variable in rxrpc_send_data() by moving the code that loads it above all the jumps to maybe_error, txb being stored back into call->tx_pending right before the normal return.
--- net/rxrpc/sendmsg.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
net/rxrpc/sendmsg.c +5 -5
@@ -303,6 +303,11 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,sk_clear_bit (SOCKWQ_ASYNC_NOSPACE , sk); reload: + txb = call->tx_pending; + call->tx_pending =NULL ; +if (txb) +rxrpc_see_txbuf (txb, rxrpc_txbuf_see_send_more); + ret = -EPIPE ;if (sk->sk_shutdown &SEND_SHUTDOWN ) goto maybe_error;
@@ -329,11 +334,6 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, goto maybe_error; } - txb = call->tx_pending; - call->tx_pending =NULL ; -if (txb) -rxrpc_see_txbuf (txb, rxrpc_txbuf_see_send_more); - do { if (!txb) { size_t remain;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/214 net: dsa: sja1105: fix reception from VLAN-unaware bridges
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit 1f9fc48fd302be3311186152225ef195e6139d7a ]
The blamed commit introduced an unexpected regression in the sja1105 driver. Packets from VLAN-unaware bridge ports get received correctly, but the protocol stack can't seem to decode them properly.
For ds->untag_bridge_pvid users (thus also sja1105), the blamed commit did introduce a functional change: dsa_switch_rcv() used to call dsa_untag_bridge_pvid(), which looked like this:
err = br_vlan_get_proto(br, &proto);
if (err)
return skb;
/* Move VLAN tag from data to hwaccel */
if (!skb_vlan_tag_present(skb) && skb->protocol == htons(proto)) {
skb = skb_vlan_untag(skb);
if (!skb)
return NULL;
}and now it calls dsa_software_vlan_untag() which has just this:
/* Move VLAN tag from data to hwaccel */
if (!skb_vlan_tag_present(skb)) {
skb = skb_vlan_untag(skb);
if (!skb)
return NULL;
}thus lacks any skb->protocol == bridge VLAN protocol check. That check is deferred until a later check for skb->vlan_proto (in the hwaccel area).
The new code is problematic because, for VLAN-untagged packets, skb_vlan_untag() blindly takes the 4 bytes starting with the EtherType and turns them into a hwaccel VLAN tag. This is what breaks the protocol stack.
It would be tempting to "make it work as before" and only call skb_vlan_untag() for those packets with the skb->protocol actually representing a VLAN.
But the premise of the newly introduced dsa_software_vlan_untag() core function is not wrong. Drivers set ds->untag_bridge_pvid or ds->untag_vlan_aware_bridge_pvid presumably because they send all traffic to the CPU reception path as VLAN-tagged. So why should we spend any additional CPU cycles assuming that the packet may be VLAN-untagged? And why does the sja1105 driver opt into ds->untag_bridge_pvid if it doesn't always deliver packets to the CPU as VLAN-tagged?
The answer to the latter question is indeed more interesting: it doesn't need to. This got done in commit 884be12f8566 ("net: dsa: sja1105: add support for imprecise RX"), because I thought it would be needed, but I didn't realize that it doesn't actually make a difference.
As explained in the commit message of the blamed patch, ds->untag_bridge_pvid only makes a difference in the VLAN-untagged receive path of a bridge port. However, in that operating mode, tag_sja1105.c makes use of VLAN tags with the ETH_P_SJA1105 TPID, and it decodes and consumes these VLAN tags as if they were DSA tags (aka tag_8021q operation). Even if commit 884be12f8566 ("net: dsa: sja1105: add support for imprecise RX") added this logic in sja1105_bridge_vlan_add():
/* Always install bridge VLANs as egress-tagged on the CPU port. */ if (dsa_is_cpu_port(ds, port)) flags = 0;
that was for _bridge_ VLANs, which are _not_ committed to hardware in VLAN-unaware mode (aka the mode where ds->untag_bridge_pvid does anything at all). Even prior to that change, the tag_8021q VLANs were always installed as egress-tagged on the CPU port, see dsa_switch_tag_8021q_vlan_add():
u16 flags = 0; // egress-tagged, non-PVID if (dsa_port_is_user(dp)) flags |= BRIDGE_VLAN_INFO_UNTAGGED | BRIDGE_VLAN_INFO_PVID; err = dsa_port_do_tag_8021q_vlan_add(dp, info->vid, flags); if (err) return err;
Whether the sja1105 driver needs the new flag, ds->untag_vlan_aware_bridge_pvid, rather than ds->untag_bridge_pvid, is a separate discussion. To fix the current bug in VLAN-unaware bridge mode, I would argue that the sja1105 driver should not request something it doesn't need, rather than complicating the core DSA helper. Whereas before the blamed commit, this setting was harmless, now it has caused breakage.
--- drivers/net/dsa/sja1105/sja1105_main.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/dsa/sja1105/sja1105_main.c +0 -1
@@ -3164,7 +3164,6 @@ static int sja1105_setup(struct dsa_switch *ds)* TPID is ETH_P_SJA1105, and the VLAN ID is the port pvid. */ ds->vlan_filtering_is_global = true; - ds->untag_bridge_pvid = true; ds->fdb_isolation = true; ds->max_num_bridges =DSA_TAG_8021Q_MAX_NUM_BRIDGES ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/214 netfilter: br_netfilter: fix panic with metadata_dst skb
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Roulin <[email protected]>
[ Upstream commit f9ff7665cd128012868098bbd07e28993e314fdb ]
Fix a kernel panic in the br_netfilter module when sending untagged traffic via a VxLAN device.
This happens during the check for fragmentation in br_nf_dev_queue_xmit.
It is dependent on:
1) the br_netfilter module being loaded;
2) net.bridge.bridge-nf-call-iptables set to 1;
3) a bridge with a VxLAN (single-vxlan-device) netdevice as a bridge port;
4) untagged frames with size higher than the VxLAN MTU forwarded/flooded
When forwarding the untagged packet to the VxLAN bridge port, before the netfilter hooks are called, br_handle_egress_vlan_tunnel is called and changes the skb_dst to the tunnel dst. The tunnel_dst is a metadata type of dst, i.e., skb_valid_dst(skb) is false, and metadata->dst.dev is NULL.
Then in the br_netfilter hooks, in br_nf_dev_queue_xmit, there's a check for frames that needs to be fragmented: frames with higher MTU than the VxLAN device end up calling br_nf_ip_fragment, which in turns call ip_skb_dst_mtu.
The ip_dst_mtu tries to use the skb_dst(skb) as if it was a valid dst with valid dst->dev, thus the crash.
This case was never supported in the first place, so drop the packet instead.
PING 10.0.0.2 (10.0.0.2) from 0.0.0.0 h1-eth0: 2000(2028) bytes of data.
[ 176.291791] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000110 [ 176.292101] Mem abort info: [ 176.292184] ESR = 0x0000000096000004 [ 176.292322] EC = 0x25: DABT (current EL), IL = 32 bits [ 176.292530] SET = 0, FnV = 0 [ 176.292709] EA = 0, S1PTW = 0 [ 176.292862] FSC = 0x04: level 0 translation fault [ 176.293013] Data abort info: [ 176.293104] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 176.293488] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 176.293787] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 176.293995] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000043ef5000 [ 176.294166] [0000000000000110] pgd=0000000000000000, p4d=0000000000000000 [ 176.294827] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 176.295252] Modules linked in: vxlan ip6_udp_tunnel udp_tunnel veth br_netfilter bridge stp llc ipv6 crct10dif_ce [ 176.295923] CPU: 0 PID: 188 Comm: ping Not tainted 6.8.0-rc3-g5b3fbd61b9d1 #2 [ 176.296314] Hardware name: linux,dummy-virt (DT) [ 176.296535] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 176.296808] pc : br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter] [ 176.297382] lr : br_nf_dev_queue_xmit+0x2ac/0x4ec [br_netfilter] [ 176.297636] sp : ffff800080003630 [ 176.297743] x29: ffff800080003630 x28: 0000000000000008 x27: ffff6828c49ad9f8 [ 176.298093] x26: ffff6828c49ad000 x25: 0000000000000000 x24: 00000000000003e8 [ 176.298430] x23: 0000000000000000 x22: ffff6828c4960b40 x21: ffff6828c3b16d28 [ 176.298652] x20: ffff6828c3167048 x19: ffff6828c3b16d00 x18: 0000000000000014 [ 176.298926] x17: ffffb0476322f000 x16: ffffb7e164023730 x15: 0000000095744632 [ 176.299296] x14: ffff6828c3f1c880 x13: 0000000000000002 x12: ffffb7e137926a70 [ 176.299574] x11: 0000000000000001 x10: ffff6828c3f1c898 x9 : 0000000000000000 [ 176.300049] x8 : ffff6828c49bf070 x7 : 0008460f18d5f20e x6 : f20e0100bebafeca [ 176.300302] x5 : ffff6828c7f918fe x4 : ffff6828c49bf070 x3 : 0000000000000000 [ 176.300586] x2 : 0000000000000000 x1 : ffff6828c3c7ad00 x0 : ffff6828c7f918f0 [ 176.300889] Call trace: [ 176.301123] br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter] [ 176.301411] br_nf_post_routing+0x2a8/0x3e4 [br_netfilter] [ 176.301703] nf_hook_slow+0x48/0x124 [ 176.302060] br_forward_finish+0xc8/0xe8 [bridge] [ 176.302371] br_nf_hook_thresh+0x124/0x134 [br_netfilter] [ 176.302605] br_nf_forward_finish+0x118/0x22c [br_netfilter] [ 176.302824] br_nf_forward_ip.part.0+0x264/0x290 [br_netfilter] [ 176.303136] br_nf_forward+0x2b8/0x4e0 [br_netfilter] [ 176.303359] nf_hook_slow+0x48/0x124 [ 176.303803] __br_forward+0xc4/0x194 [bridge] [ 176.304013] br_flood+0xd4/0x168 [bridge] [ 176.304300] br_handle_frame_finish+0x1d4/0x5c4 [bridge] [ 176.304536] br_nf_hook_thresh+0x124/0x134 [br_netfilter] [ 176.304978] br_nf_pre_routing_finish+0x29c/0x494 [br_netfilter] [ 176.305188] br_nf_pre_routing+0x250/0x524 [br_netfilter] [ 176.305428] br_handle_frame+0x244/0x3cc [bridge] [ 176.305695] __netif_receive_skb_core.constprop.0+0x33c/0xecc [ 176.306080] __netif_receive_skb_one_core+0x40/0x8c [ 176.306197] __netif_receive_skb+0x18/0x64 [ 176.306369] process_backlog+0x80/0x124 [ 176.306540] __napi_poll+0x38/0x17c [ 176.306636] net_rx_action+0x124/0x26c [ 176.306758] __do_softirq+0x100/0x26c [ 176.307051] ____do_softirq+0x10/0x1c [ 176.307162] call_on_irq_stack+0x24/0x4c [ 176.307289] do_softirq_own_stack+0x1c/0x2c [ 176.307396] do_softirq+0x54/0x6c [ 176.307485] __local_bh_enable_ip+0x8c/0x98 [ 176.307637] __dev_queue_xmit+0x22c/0xd28 [ 176.307775] neigh_resolve_output+0xf4/0x1a0 [ 176.308018] ip_finish_output2+0x1c8/0x628 [ 176.308137] ip_do_fragment+0x5b4/0x658 [ 176.308279] ip_fragment.constprop.0+0x48/0xec [ 176.308420] __ip_finish_output+0xa4/0x254 [ 176.308593] ip_finish_output+0x34/0x130 [ 176.308814] ip_output+0x6c/0x108 [ 176.308929] ip_send_skb+0x50/0xf0 [ 176.309095] ip_push_pending_frames+0x30/0x54 [ 176.309254] raw_sendmsg+0x758/0xaec [ 176.309568] inet_sendmsg+0x44/0x70 [ 176.309667] __sys_sendto+0x110/0x178 [ 176.309758] __arm64_sys_sendto+0x28/0x38 [ 176.309918] invoke_syscall+0x48/0x110 [ 176.310211] el0_svc_common.constprop.0+0x40/0xe0 [ 176.310353] do_el0_svc+0x1c/0x28 [ 176.310434] el0_svc+0x34/0xb4 [ 176.310551] el0t_64_sync_handler+0x120/0x12c [ 176.310690] el0t_64_sync+0x190/0x194 [ 176.311066] Code: f9402e61 79402aa2 927ff821 f9400023 (f9408860) [ 176.315743] ---[ end trace 0000000000000000 ]--- [ 176.316060] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 176.316371] Kernel Offset: 0x37e0e3000000 from 0xffff800080000000 [ 176.316564] PHYS_OFFSET: 0xffff97d780000000 [ 176.316782] CPU features: 0x0,88000203,3c020000,0100421b [ 176.317210] Memory Limit: none [ 176.317527] ---[ end Kernel panic - not syncing: Oops: Fatal
Exception in interrupt ]---\
--- net/bridge/br_netfilter_hooks.c | 5 +++++ 1 file changed, 5 insertions(+)
net/bridge/br_netfilter_hooks.c +5 -0
@@ -33,6 +33,7 @@#include <net/ip.h> #include <net/ipv6.h> #include <net/addrconf.h> +#include <net/dst_metadata.h> #include <net/route.h> #include <net/netfilter/br_netfilter.h> #include <net/netns/generic.h>
@@ -878,6 +879,10 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buffreturn br_dev_queue_push_xmit (net, sk, skb); } +/* Fragmentation on metadata/template dst is not supported */ +if (unlikely (!skb_valid_dst (skb))) + goto drop; +/* This is wrong! We should preserve the original fragment * boundaries by preserving frag_list rather than refragmenting. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/214 selftests: net: no_forwarding: fix VID for $swp2 in one_bridge_two_pvids() test
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kacper Ludwinski <[email protected]>
[ Upstream commit 9f49d14ec41ce7be647028d7d34dea727af55272 ]
Currently, the second bridge command overwrites the first one. Fix this by adding this VID to the interface behind $swp2.
The one_bridge_two_pvids() test intends to check that there is no leakage of traffic between bridge ports which have a single VLAN - the PVID VLAN.
Because of a typo, port $swp1 is configured with a PVID twice (second command overwrites first), and $swp2 isn't configured at all (and since the bridge vlan_default_pvid property is set to 0, this port will not have a PVID at all, so it will drop all untagged and priority-tagged traffic).
So, instead of testing the configuration that was intended, we are testing a different one, where one port has PVID 2 and the other has no PVID. This incorrect version of the test should also pass, but is ineffective for its purpose, so fix the typo.
This typo has an impact on results of the test, potentially leading to wrong conclusions regarding the functionality of a network device.
The tests results:
TEST: Switch ports in VLAN-aware bridge with different PVIDs:
Unicast non-IP untagged [ OK ]
Multicast non-IP untagged [ OK ]
Broadcast non-IP untagged [ OK ]
Unicast IPv4 untagged [ OK ]
Multicast IPv4 untagged [ OK ]
Unicast IPv6 untagged [ OK ]
Multicast IPv6 untagged [ OK ]
Unicast non-IP VID 1 [ OK ]
Multicast non-IP VID 1 [ OK ]
Broadcast non-IP VID 1 [ OK ]
Unicast IPv4 VID 1 [ OK ]
Multicast IPv4 VID 1 [ OK ]
Unicast IPv6 VID 1 [ OK ]
Multicast IPv6 VID 1 [ OK ]
Unicast non-IP VID 4094 [ OK ]
Multicast non-IP VID 4094 [ OK ]
Broadcast non-IP VID 4094 [ OK ]
Unicast IPv4 VID 4094 [ OK ]
Multicast IPv4 VID 4094 [ OK ]
Unicast IPv6 VID 4094 [ OK ]
Multicast IPv6 VID 4094 [ OK ]
--- tools/testing/selftests/net/forwarding/no_forwarding.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/forwarding/no_forwarding.sh +1 -1
@@ -202,7 +202,7 @@ one_bridge_two_pvids() ip link set $swp2 master br0 bridge vlan add dev $swp1 vid 1 pvid untagged - bridge vlan add dev $swp1 vid 2 pvid untagged + bridge vlan add dev $swp2 vid 2 pvid untagged run_test "Switch ports in VLAN-aware bridge with different PVIDs"
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/214 net: pse-pd: Fix enabled status mismatch
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kory Maincent <[email protected]>
[ Upstream commit dda3529d2e84e2ee7b97158c9cdf5e10308f37bc ]
PSE controllers like the TPS23881 can forcefully turn off their configuration state. In such cases, the is_enabled() and get_status() callbacks will report the PSE as disabled, while admin_state_enabled will show it as enabled. This mismatch can lead the user to attempt to enable it, but no action is taken as admin_state_enabled remains set.
The solution is to disable the PSE before enabling it, ensuring the actual status matches admin_state_enabled.
--- drivers/net/pse-pd/pse_core.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/net/pse-pd/pse_core.c +11 -0
@@ -785,6 +785,17 @@ static int pse_ethtool_c33_set_config(struct pse_control *psec,*/ switch (config->c33_admin_control) {case ETHTOOL_C33_PSE_ADMIN_STATE_ENABLED : +/* We could have mismatch between admin_state_enabled and +* state reported by regulator_is_enabled. This can occur when +* the PI is forcibly turn off by the controller. Call +* regulator_disable on that case to fix the counters state. +*/ +if (psec->pcdev->pi[psec->id].admin_state_enabled && + !regulator_is_enabled (psec->ps)) { + err =regulator_disable (psec->ps); +if (err) +break ; + }if (!psec->pcdev->pi[psec->id].admin_state_enabled) err =regulator_enable (psec->ps);break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/214 Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 08d1914293dae38350b8088980e59fbc699a72fe ]
rfcomm_sk_state_change attempts to use sock_lock so it must never be called with it locked but rfcomm_sock_ioctl always attempt to lock it causing the following trace:
======================================================
WARNING: possible circular locking dependency detected
6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted
------------------------------------------------------
syz-executor386/5093 is trying to acquire lock:ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1671 [inline] ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sk_state_change+0x5b/0x310 net/bluetooth/rfcomm/sock.c:73
but task is already holding lock:ffff88807badfd28 (&d->lock){+.+.}-{3:3}, at: __rfcomm_dlc_close+0x226/0x6a0 net/bluetooth/rfcomm/core.c:491
--- net/bluetooth/rfcomm/sock.c | 2 -- 1 file changed, 2 deletions(-)
net/bluetooth/rfcomm/sock.c +0 -2
@@ -865,9 +865,7 @@ static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned lonif (err == -ENOIOCTLCMD ) {#ifdef CONFIG_BT_RFCOMM_TTY -lock_sock (sk); err =rfcomm_dev_ioctl (sk, cmd, (void __user *) arg); -release_sock (sk);#else err = -EOPNOTSUPP ;#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/214 Bluetooth: btusb: Dont fail external suspend requests
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 610712298b11b2914be00b35abe9326b5dbb62c8 ]
Commit 4e0a1d8b0675
("Bluetooth: btusb: Don't suspend when there are connections") introduces a check for connections to prevent auto-suspend but that actually ignored the fact the .suspend callback can be called for external suspend requests which Documentation/driver-api/usb/power-management.rst states the following:
'External suspend calls should never be allowed to fail in this way, only autosuspend calls. The driver can tell them apart by applying the :c:func:PMSG_IS_AUTO macro to the message argument to the ``suspend`` method; it will return True for internal PM events (autosuspend) and False for external PM events.'
In addition to that align system suspend with USB suspend by using hci_suspend_dev since otherwise the stack would be expecting events such as advertising reports which may not be delivered while the transport is suspended.
--- drivers/bluetooth/btusb.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-)
drivers/bluetooth/btusb.c +18 -2
@@ -4092,16 +4092,29 @@ static void btusb_disconnect(struct usb_interface *intf)static int btusb_suspend (struct usb_interface *intf,pm_message_t message) {struct btusb_data *data =usb_get_intfdata (intf); +int err;BT_DBG ("intf %p" , intf); -/* Don't suspend if there are connections */ -if (hci_conn_count (data->hdev)) +/* Don't auto-suspend if there are connections; external suspend calls +* shall never fail. +*/ +if (PMSG_IS_AUTO (message) &&hci_conn_count (data->hdev))return -EBUSY ;if (data->suspend_count++)return 0 ; +/* Notify Host stack to suspend; this has to be done before stopping +* the traffic since the hci_suspend_dev itself may generate some +* traffic. +*/ + err =hci_suspend_dev (data->hdev); +if (err) { + data->suspend_count--; +return err; + } +spin_lock_irq (&data->txlock);if (!(PMSG_IS_AUTO (message) && data->tx_in_flight)) {set_bit (BTUSB_SUSPENDING , &data->flags);
@@ -4109,6 +4122,7 @@ static int btusb_suspend(struct usb_interface *intf, pm_message_t message) }else {spin_unlock_irq (&data->txlock); data->suspend_count--; +hci_resume_dev (data->hdev);return -EBUSY ; }
@@ -4229,6 +4243,8 @@ static int btusb_resume(struct usb_interface *intf)spin_unlock_irq (&data->txlock);schedule_work (&data->work); +hci_resume_dev (data->hdev); +return 0 ; failed:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/214 net: phy: bcm84881: Fix some error handling paths
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 9234a2549cb6ac038bec36cc7c084218e9575513 ]
If phy_read_mmd() fails, the error code stored in 'bmsr' should be returned instead of 'val' which is likely to be 0.
--- drivers/net/phy/bcm84881.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/phy/bcm84881.c +2 -2
@@ -132,7 +132,7 @@ static int bcm84881_aneg_done(struct phy_device *phydev) bmsr =phy_read_mmd (phydev,MDIO_MMD_AN ,MDIO_AN_C22 +MII_BMSR );if (bmsr <0 ) -return val; +return bmsr;return !!(val &MDIO_AN_STAT1_COMPLETE ) && !!(bmsr &BMSR_ANEGCOMPLETE );
@@ -158,7 +158,7 @@ static int bcm84881_read_status(struct phy_device *phydev) bmsr =phy_read_mmd (phydev,MDIO_MMD_AN ,MDIO_AN_C22 +MII_BMSR );if (bmsr <0 ) -return val; +return bmsr; phydev->autoneg_complete = !!(val &MDIO_AN_STAT1_COMPLETE ) && !!(bmsr &BMSR_ANEGCOMPLETE );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/214 nfsd: fix possible badness in FREE_STATEID
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <[email protected]>
[ Upstream commit c88c150a467fcb670a1608e2272beeee3e86df6e ]
When multiple FREE_STATEIDs are sent for the same delegation stateid, it can lead to a possible either use-after-free or counter refcount underflow errors.
In nfsd4_free_stateid() under the client lock we find a delegation stateid, however the code drops the lock before calling nfs4_put_stid(), that allows another FREE_STATE to find the stateid again. The first one will proceed to then free the stateid which leads to either use-after-free or decrementing already zeroed counter.
--- fs/nfsd/nfs4state.c | 1 + 1 file changed, 1 insertion(+)
fs/nfsd/nfs4state.c +1 -0
@@ -7158,6 +7158,7 @@ nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,switch (s->sc_type) {case SC_TYPE_DELEG :if (s->sc_status &SC_STATUS_REVOKED ) { + s->sc_status |=SC_STATUS_CLOSED ;spin_unlock (&s->sc_lock); dp =delegstateid (s);list_del_init (&dp->dl_recall_lru);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/214 thermal: intel: int340x: processor: Fix warning during module unload
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Rui <[email protected]>
[ Upstream commit 99ca0b57e49fb73624eede1c4396d9e3d10ccf14 ]
The processor_thermal driver uses pcim_device_enable() to enable a PCI device, which means the device will be automatically disabled on driver detach. Thus there is no need to call pci_disable_device() again on it.
With recent PCI device resource management improvements, e.g. commit f748a07a0b64 ("PCI: Remove legacy pcim_release()"), this problem is exposed and triggers the warining below.
[ 224.010735] proc_thermal_pci 0000:00:04.0: disabling already-disabled device [ 224.010747] WARNING: CPU: 8 PID: 4442 at drivers/pci/pci.c:2250 pci_disable_device+0xe5/0x100 ... [ 224.010844] Call Trace: [ 224.010845] <TASK> [ 224.010847] ? show_regs+0x6d/0x80 [ 224.010851] ? __warn+0x8c/0x140 [ 224.010854] ? pci_disable_device+0xe5/0x100 [ 224.010856] ? report_bug+0x1c9/0x1e0 [ 224.010859] ? handle_bug+0x46/0x80 [ 224.010862] ? exc_invalid_op+0x1d/0x80 [ 224.010863] ? asm_exc_invalid_op+0x1f/0x30 [ 224.010867] ? pci_disable_device+0xe5/0x100 [ 224.010869] ? pci_disable_device+0xe5/0x100 [ 224.010871] ? kfree+0x21a/0x2b0 [ 224.010873] pcim_disable_device+0x20/0x30 [ 224.010875] devm_action_release+0x16/0x20 [ 224.010878] release_nodes+0x47/0xc0 [ 224.010880] devres_release_all+0x9f/0xe0 [ 224.010883] device_unbind_cleanup+0x12/0x80 [ 224.010885] device_release_driver_internal+0x1ca/0x210 [ 224.010887] driver_detach+0x4e/0xa0 [ 224.010889] bus_remove_driver+0x6f/0xf0 [ 224.010890] driver_unregister+0x35/0x60 [ 224.010892] pci_unregister_driver+0x44/0x90 [ 224.010894] proc_thermal_pci_driver_exit+0x14/0x5f0 [processor_thermal_device_pci] ... [ 224.010921] ---[ end trace 0000000000000000 ]---
Remove the excess pci_disable_device() calls.
--- .../intel/int340x_thermal/processor_thermal_device_pci.c | 2 -- 1 file changed, 2 deletions(-)
drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c +0 -2
@@ -416,7 +416,6 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev, const struct pci_device_if (!pci_info->no_legacy)proc_thermal_remove (proc_priv);proc_thermal_mmio_remove (pdev, proc_priv); -pci_disable_device (pdev);return ret; }
@@ -438,7 +437,6 @@ static void proc_thermal_pci_remove(struct pci_dev *pdev)proc_thermal_mmio_remove (pdev, pci_info->proc_priv);if (!pci_info->no_legacy)proc_thermal_remove (proc_priv); -pci_disable_device (pdev); }#ifdef CONFIG_PM_SLEEP
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/214 Revert "net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled"
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 5546da79e6cc5bb3324bf25688ed05498fd3f86d ]
This reverts commit b514c47ebf41a6536551ed28a05758036e6eca7c.
The commit describes that we don't have to sync the page when recycling, and it tries to optimize that case. But we do need to sync after allocation. Recycling side should be changed to pass the right sync size instead.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +1 -1
@@ -2022,7 +2022,7 @@ static int __alloc_dma_rx_desc_resources(struct stmmac_priv *priv, rx_q->queue_index = queue; rx_q->priv_data = priv; - pp_params.flags =PP_FLAG_DMA_MAP | (xdp_prog ?PP_FLAG_DMA_SYNC_DEV :0 ); + pp_params.flags =PP_FLAG_DMA_MAP |PP_FLAG_DMA_SYNC_DEV ; pp_params.pool_size = dma_conf->dma_rx_size; num_pages =DIV_ROUND_UP (dma_conf->dma_buf_sz,PAGE_SIZE ); pp_params.order =ilog2 (num_pages);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/214 net: ethernet: adi: adin1110: Fix some error handling path in adin1110_read_fifo()
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 83211ae1640516accae645de82f5a0a142676897 ]
If 'frame_size' is too small or if 'round_len' is an error code, it is likely that an error code should be returned to the caller.
Actually, 'ret' is likely to be 0, so if one of these sanity checks fails, 'success' is returned.
Return -EINVAL instead.
--- drivers/net/ethernet/adi/adin1110.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/adi/adin1110.c +2 -2
@@ -318,11 +318,11 @@ static int adin1110_read_fifo(struct adin1110_port_priv *port_priv)* from the ADIN1110 frame header. */ if (frame_size <ADIN1110_FRAME_HEADER_LEN +ADIN1110_FEC_LEN ) -return ret; +return -EINVAL ; round_len =adin1110_round_len (frame_size);if (round_len <0 ) -return ret; +return -EINVAL ; frame_size_no_fcs = frame_size -ADIN1110_FRAME_HEADER_LEN -ADIN1110_FEC_LEN ;memset (priv->data,0 ,ADIN1110_RD_HEADER_LEN );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/214 net: dsa: b53: fix jumbo frame mtu check
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit 42fb3acf6826c6764ba79feb6e15229b43fd2f9f ]
JMS_MIN_SIZE is the full ethernet frame length, while mtu is just the data payload size. Comparing these two meant that mtus between 1500 and 1518 did not trigger enabling jumbo frames.
So instead compare the set mtu ETH_DATA_LEN, which is equal to JMS_MIN_SIZE - ETH_HLEN - ETH_FCS_LEN;
Also do a check that the requested mtu is actually greater than the minimum length, else we do not need to enable jumbo frames.
In practice this only introduced a very small range of mtus that did not work properly. Newer chips allow 2000 byte large frames by default, and older chips allow 1536 bytes long, which is equivalent to an mtu of 1514. So effectivly only mtus of 1515~1517 were broken.
--- drivers/net/dsa/b53/b53_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/b53/b53_common.c +1 -1
@@ -2259,7 +2259,7 @@ static int b53_change_mtu(struct dsa_switch *ds, int port, int mtu)if (!dsa_is_cpu_port (ds, port))return 0 ; - enable_jumbo = (mtu >=JMS_MIN_SIZE ); + enable_jumbo = (mtu >ETH_DATA_LEN ); allow_10_100 = (dev->chip_id ==BCM583XX_DEVICE_ID );return b53_set_jumbo (dev, enable_jumbo, allow_10_100);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/214 net: dsa: b53: fix max MTU for 1g switches
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit 680a8217dc00dc7e7da57888b3c053289b60eb2b ]
JMS_MAX_SIZE is the ethernet frame length, not the MTU, which is payload without ethernet headers.
According to the datasheets maximum supported frame length for most gigabyte swithes is 9720 bytes, so convert that to the expected MTU when using VLAN tagged frames.
--- drivers/net/dsa/b53/b53_common.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/dsa/b53/b53_common.c +4 -1
@@ -27,6 +27,7 @@#include <linux/phylink.h> #include <linux/etherdevice.h> #include <linux/if_bridge.h> +#include <linux/if_vlan.h> #include <net/dsa.h> #include "b53_regs.h"
@@ -224,6 +225,8 @@ static const struct b53_mib_desc b53_mibs_58xx[] = {#define B53_MIBS_58XX_SIZE ARRAY_SIZE(b53_mibs_58xx) +#define B53_MAX_MTU (9720 - ETH_HLEN - VLAN_HLEN - ETH_FCS_LEN) +static int b53_do_vlan_op (struct b53_device *dev,u8 op) {unsigned int i;
@@ -2267,7 +2270,7 @@ static int b53_change_mtu(struct dsa_switch *ds, int port, int mtu)static int b53_get_max_mtu (struct dsa_switch *ds,int port) { -return JMS_MAX_SIZE ; +return B53_MAX_MTU ; }static const struct phylink_mac_ops b53_phylink_mac_ops = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/214 net: dsa: b53: fix max MTU for BCM5325/BCM5365
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit ca8c1f71c10193c270f772d70d34b15ad765d6a8 ]
BCM5325/BCM5365 do not support jumbo frames, so we should not report a jumbo frame mtu for them. But they do support so called "oversized" frames up to 1536 bytes long by default, so report an appropriate MTU.
--- drivers/net/dsa/b53/b53_common.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/dsa/b53/b53_common.c +6 -0
@@ -225,6 +225,7 @@ static const struct b53_mib_desc b53_mibs_58xx[] = {#define B53_MIBS_58XX_SIZE ARRAY_SIZE(b53_mibs_58xx) +#define B53_MAX_MTU_25 (1536 - ETH_HLEN - VLAN_HLEN - ETH_FCS_LEN)#define B53_MAX_MTU (9720 - ETH_HLEN - VLAN_HLEN - ETH_FCS_LEN)static int b53_do_vlan_op (struct b53_device *dev,u8 op)
@@ -2270,6 +2271,11 @@ static int b53_change_mtu(struct dsa_switch *ds, int port, int mtu)static int b53_get_max_mtu (struct dsa_switch *ds,int port) { +struct b53_device *dev = ds->priv; + +if (is5325 (dev) ||is5365 (dev)) +return B53_MAX_MTU_25 ; +return B53_MAX_MTU ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/214 net: dsa: b53: allow lower MTUs on BCM5325/5365
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit e4b294f88a32438baf31762441f3dd1c996778be ]
While BCM5325/5365 do not support jumbo frames, they do support slightly oversized frames, so do not error out if requesting a supported MTU for them.
--- drivers/net/dsa/b53/b53_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/b53/b53_common.c +1 -1
@@ -2258,7 +2258,7 @@ static int b53_change_mtu(struct dsa_switch *ds, int port, int mtu)bool allow_10_100;if (is5325 (dev) ||is5365 (dev)) -return -EOPNOTSUPP ; +return 0 ;if (!dsa_is_cpu_port (ds, port))return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/214 net: dsa: b53: fix jumbo frames on 10/100 ports
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit 2f3dcd0d39affe5b9ba1c351ce0e270c8bdd5109 ]
All modern chips support and need the 10_100 bit set for supporting jumbo frames on 10/100 ports, so instead of enabling it only for 583XX enable it for everything except bcm63xx, where the bit is writeable, but does nothing.
Tested on BCM53115, where jumbo frames were dropped at 10/100 speeds without the bit set.
--- drivers/net/dsa/b53/b53_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/b53/b53_common.c +1 -1
@@ -2264,7 +2264,7 @@ static int b53_change_mtu(struct dsa_switch *ds, int port, int mtu)return 0 ; enable_jumbo = (mtu >ETH_DATA_LEN ); - allow_10_100 = (dev->chip_id ==BCM583XX_DEVICE_ID ); + allow_10_100 = !is63xx (dev);return b53_set_jumbo (dev, enable_jumbo, allow_10_100); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/214 drm/nouveau: pass cli to nouveau_channel_new() instead of drm+device
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <[email protected]>
[ Upstream commit 5cca41ac70e5877383ed925bd017884c37edf09b ]
Both of these are stored in nouveau_cli already, and also allows the removal of some void casts.
Stable-dep-of: 04e0481526e3 ("nouveau/dmem: Fix privileged error in copy engine channel")
--- drivers/gpu/drm/nouveau/dispnv04/crtc.c | 2 +- drivers/gpu/drm/nouveau/nouveau_abi16.c | 2 +- drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +- drivers/gpu/drm/nouveau/nouveau_chan.c | 21 +++++++++++---------- drivers/gpu/drm/nouveau/nouveau_chan.h | 3 ++- drivers/gpu/drm/nouveau/nouveau_drm.c | 4 ++-- 6 files changed, 18 insertions(+), 16 deletions(-)
drivers/gpu/drm/nouveau/dispnv04/crtc.c +1 -1
@@ -1157,7 +1157,7 @@ nv04_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb, chan = drm->channel;if (!chan)return -ENODEV ; - cli = (void *)chan->user.client; + cli = chan->cli; push = chan->chan.push; s =kzalloc (sizeof (*s),GFP_KERNEL );
drivers/gpu/drm/nouveau/nouveau_abi16.c +1 -1
@@ -356,7 +356,7 @@ nouveau_abi16_ioctl_channel_alloc(ABI16_IOCTL_ARGS)list_add (&chan->head, &abi16->channels);/* create channel object and initialise dma and fence management */ - ret =nouveau_channel_new (drm, device, false, runm, init->fb_ctxdma_handle, + ret =nouveau_channel_new (cli, false, runm, init->fb_ctxdma_handle, init->tt_ctxdma_handle, &chan->chan);if (ret) goto done;
drivers/gpu/drm/nouveau/nouveau_bo.c +1 -1
@@ -859,7 +859,7 @@ nouveau_bo_move_m2mf(struct ttm_buffer_object *bo, int evict, {struct nouveau_drm *drm =nouveau_bdev (bo->bdev);struct nouveau_channel *chan = drm->ttm.chan; -struct nouveau_cli *cli = (void *)chan->user.client; +struct nouveau_cli *cli = chan->cli;struct nouveau_fence *fence;int ret;
drivers/gpu/drm/nouveau/nouveau_chan.c +11 -10
@@ -52,7 +52,7 @@ static int nouveau_channel_killed(struct nvif_event *event, void *repv, u32 repc) { struct nouveau_channel *chan = container_of(event, typeof(*chan), kill); -struct nouveau_cli *cli = (void *)chan->user.client; +struct nouveau_cli *cli = chan->cli;NV_PRINTK (warn, cli,"channel %d killed!\n" , chan->chid);
@@ -66,7 +66,7 @@ int nouveau_channel_idle(struct nouveau_channel *chan) {if (likely (chan && chan->fence && !atomic_read (&chan->killed))) { -struct nouveau_cli *cli = (void *)chan->user.client; +struct nouveau_cli *cli = chan->cli;struct nouveau_fence *fence =NULL ;int ret;
@@ -142,10 +142,11 @@ nouveau_channel_wait(struct nvif_push *push, u32 size) }static int -nouveau_channel_prep (struct nouveau_drm *drm,struct nvif_device *device, +nouveau_channel_prep (struct nouveau_cli *cli,u32 size,struct nouveau_channel **pchan) { -struct nouveau_cli *cli = (void *)device->object.client; +struct nouveau_drm *drm = cli->drm; +struct nvif_device *device = &cli->device;struct nv_dma_v0 args = {};struct nouveau_channel *chan;u32 target;
@@ -155,6 +156,7 @@ nouveau_channel_prep(struct nouveau_drm *drm, struct nvif_device *device,if (!chan)return -ENOMEM ; + chan->cli = cli; chan->device = device; chan->drm = drm; chan->vmm =nouveau_cli_vmm (cli);
@@ -254,7 +256,7 @@ nouveau_channel_prep(struct nouveau_drm *drm, struct nvif_device *device, }static int -nouveau_channel_ctor (struct nouveau_drm *drm,struct nvif_device *device,bool priv,u64 runm, +nouveau_channel_ctor (struct nouveau_cli *cli,bool priv,u64 runm,struct nouveau_channel **pchan) {const struct nvif_mclass hosts[] = {
@@ -279,7 +281,7 @@ nouveau_channel_ctor(struct nouveau_drm *drm, struct nvif_device *device, bool pstruct nvif_chan_v0 chan;char name[TASK_COMM_LEN +16 ]; } args; -struct nouveau_cli *cli = (void *)device->object.client; +struct nvif_device *device = &cli->device;struct nouveau_channel *chan;const u64 plength =0x10000 ;const u64 ioffset = plength;
@@ -298,7 +300,7 @@ nouveau_channel_ctor(struct nouveau_drm *drm, struct nvif_device *device, bool p size = ioffset + ilength;/* allocate dma push buffer */ - ret =nouveau_channel_prep (drm, device, size, &chan); + ret =nouveau_channel_prep (cli, size, &chan); *pchan = chan;if (ret)return ret;
@@ -493,13 +495,12 @@ nouveau_channel_init(struct nouveau_channel *chan, u32 vram, u32 gart) }int -nouveau_channel_new (struct nouveau_drm *drm,struct nvif_device *device, +nouveau_channel_new (struct nouveau_cli *cli,bool priv,u64 runm,u32 vram,u32 gart,struct nouveau_channel **pchan) { -struct nouveau_cli *cli = (void *)device->object.client;int ret; - ret =nouveau_channel_ctor (drm, device, priv, runm, pchan); + ret =nouveau_channel_ctor (cli, priv, runm, pchan);if (ret) {NV_PRINTK (dbg, cli,"channel create, %d\n" , ret);return ret;
drivers/gpu/drm/nouveau/nouveau_chan.h +2 -1
@@ -12,6 +12,7 @@ struct nouveau_channel {struct nvif_push *push; } chan; +struct nouveau_cli *cli;struct nvif_device *device;struct nouveau_drm *drm;struct nouveau_vmm *vmm;
@@ -62,7 +63,7 @@ struct nouveau_channel {int nouveau_channels_init (struct nouveau_drm *);void nouveau_channels_fini (struct nouveau_drm *); -int nouveau_channel_new (struct nouveau_drm *,struct nvif_device *,bool priv,u64 runm, +int nouveau_channel_new (struct nouveau_cli *,bool priv,u64 runm,u32 vram,u32 gart,struct nouveau_channel **);void nouveau_channel_del (struct nouveau_channel **);int nouveau_channel_idle (struct nouveau_channel *);
drivers/gpu/drm/nouveau/nouveau_drm.c +2 -2
@@ -356,7 +356,7 @@ nouveau_accel_ce_init(struct nouveau_drm *drm)return ; } - ret =nouveau_channel_new (drm, device, false, runm, NvDmaFB, NvDmaTT, &drm->cechan); + ret =nouveau_channel_new (&drm->client, false, runm, NvDmaFB, NvDmaTT, &drm->cechan);if (ret)NV_ERROR (drm,"failed to create ce channel, %d\n" , ret); }
@@ -384,7 +384,7 @@ nouveau_accel_gr_init(struct nouveau_drm *drm)return ; } - ret =nouveau_channel_new (drm, device, false, runm, NvDmaFB, NvDmaTT, &drm->channel); + ret =nouveau_channel_new (&drm->client, false, runm, NvDmaFB, NvDmaTT, &drm->channel);if (ret) {NV_ERROR (drm,"failed to create kernel channel, %d\n" , ret);nouveau_accel_gr_fini (drm);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/214 nouveau/dmem: Fix privileged error in copy engine channel
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonatan Maman <[email protected]>
[ Upstream commit 04e0481526e30ab8c7e7580033d2f88b7ef2da3f ]
When nouveau_dmem_copy_one is called, the following error occurs:
[272146.675156] nouveau 0000:06:00.0: fifo: PBDMA9: 00000004 [HCE_PRIV]
ch 1 00000300 00003386
This indicates that a copy push command triggered a Host Copy Engine Privileged error on channel 1 (Copy Engine channel). To address this issue, modify the Copy Engine channel to allow privileged push commands
--- drivers/gpu/drm/nouveau/nouveau_drm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nouveau_drm.c +1 -1
@@ -356,7 +356,7 @@ nouveau_accel_ce_init(struct nouveau_drm *drm)return ; } - ret =nouveau_channel_new (&drm->client, false, runm, NvDmaFB, NvDmaTT, &drm->cechan); + ret =nouveau_channel_new (&drm->client, true, runm, NvDmaFB, NvDmaTT, &drm->cechan);if (ret)NV_ERROR (drm,"failed to create ce channel, %d\n" , ret); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/214 gpio: aspeed: Add the flush write to ensure the write complete.
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Billy Tsai <[email protected]>
[ Upstream commit 1bb5a99e1f3fd27accb804aa0443a789161f843c ]
Performing a dummy read ensures that the register write operation is fully completed, mitigating any potential bus delays that could otherwise impact the frequency of bitbang usage. E.g., if the JTAG application uses GPIO to control the JTAG pins (TCK, TMS, TDI, TDO, and TRST), and the application sets the TCK clock to 1 MHz, the GPIO's high/low transitions will rely on a delay function to ensure the clock frequency does not exceed 1 MHz. However, this can lead to rapid toggling of the GPIO because the write operation is POSTed and does not wait for a bus acknowledgment.
--- drivers/gpio/gpio-aspeed.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpio/gpio-aspeed.c +2 -0
@@ -406,6 +406,8 @@ static void __aspeed_gpio_set(struct gpio_chip *gc, unsigned int offset, gpio->dcache[GPIO_BANK (offset)] = reg;iowrite32 (reg, addr); +/* Flush write */ +ioread32 (addr); } static void aspeed_gpio_set(struct gpio_chip *gc, unsigned int offset,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/214 gpio: aspeed: Use devm_clk api to manage clock source
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Billy Tsai <[email protected]>
[ Upstream commit a6191a3d18119184237f4ee600039081ad992320 ]
Replace of_clk_get with devm_clk_get_enabled to manage the clock source.
--- drivers/gpio/gpio-aspeed.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-aspeed.c +1 -1
@@ -1193,7 +1193,7 @@ static int __init aspeed_gpio_probe(struct platform_device *pdev)if (!gpio_id)return -EINVAL ; - gpio->clk =of_clk_get (pdev->dev.of_node,0 ); + gpio->clk =devm_clk_get_enabled (&pdev->dev,NULL );if (IS_ERR (gpio->clk)) {dev_warn (&pdev->dev,"Failed to get clock from devicetree, debouncing disabled\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/214 x86/xen: mark boot CPU of PV guest in MSR_IA32_APICBASE
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <[email protected]>
[ Upstream commit bf56c410162dbf2e27906acbdcd904cbbfdba302 ]
Recent topology checks of the x86 boot code uncovered the need for PV guests to have the boot cpu marked in the APICBASE MSR.
--- arch/x86/xen/enlighten_pv.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/x86/xen/enlighten_pv.c +4 -0
@@ -1032,6 +1032,10 @@ static u64 xen_do_read_msr(unsigned int msr, int *err)switch (msr) {case MSR_IA32_APICBASE : val &= ~X2APIC_ENABLE ; +if (smp_processor_id () ==0 ) + val |=MSR_IA32_APICBASE_BSP ; +else + val &= ~MSR_IA32_APICBASE_BSP ;break ; }return val;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/214 powercap: intel_rapl_tpmi: Ignore minor version change
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Rui <[email protected]>
[ Upstream commit 1d390923974cc233245649cf23833e06b15a9ef7 ]
The hardware definition of every TPMI feature contains a major and minor version. When there is a change in the MMIO offset or change in the definition of a field, hardware will change major version. For addition of new fields without modifying existing MMIO offsets or fields, only the minor version is changed.
If the driver has not been updated to recognize a new hardware major version, it cannot provide the RAPL interface to users due to possible register layout incompatibilities. However, the driver does not need to be updated every time the hardware minor version changes because in that case it will just miss some new functionality exposed by the hardware.
The current implementation causes the driver to refuse to work for any hardware version change which is unnecessarily restrictive.
If there is a minor version mismatch, log an information message and continue, but if there is a major version mismatch, log a warning and exit (as before).
--- drivers/powercap/intel_rapl_tpmi.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-)
drivers/powercap/intel_rapl_tpmi.c +14 -3
@@ -15,7 +15,8 @@#include <linux/module.h> #include <linux/slab.h> -#define TPMI_RAPL_VERSION 1 +#define TPMI_RAPL_MAJOR_VERSION 0 +#define TPMI_RAPL_MINOR_VERSION 1/* 1 header + 10 registers + 5 reserved. 8 bytes for each. */ #define TPMI_RAPL_DOMAIN_SIZE 128
@@ -154,11 +155,21 @@ static int parse_one_domain(struct tpmi_rapl_package *trp, u32 offset) tpmi_domain_size = tpmi_domain_header >>16 &0xff ; tpmi_domain_flags = tpmi_domain_header >>32 &0xffff ; -if (tpmi_domain_version !=TPMI_RAPL_VERSION ) { -pr_warn (FW_BUG "Unsupported version:%d\n" , tpmi_domain_version); +if (tpmi_domain_version ==TPMI_VERSION_INVALID ) { +pr_warn (FW_BUG "Invalid version\n" );return -ENODEV ; } +if (TPMI_MAJOR_VERSION (tpmi_domain_version) !=TPMI_RAPL_MAJOR_VERSION ) { +pr_warn (FW_BUG "Unsupported major version:%ld\n" , +TPMI_MAJOR_VERSION (tpmi_domain_version)); +return -ENODEV ; + } + +if (TPMI_MINOR_VERSION (tpmi_domain_version) >TPMI_RAPL_MINOR_VERSION ) +pr_info ("Ignore: Unsupported minor version:%ld\n" , +TPMI_MINOR_VERSION (tpmi_domain_version)); +/* Domain size: in unit of 128 Bytes */ if (tpmi_domain_size !=1 ) {pr_warn (FW_BUG "Invalid Domain size %d\n" , tpmi_domain_size);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/214 ice: Fix entering Safe Mode
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcin Szycik <[email protected]>
[ Upstream commit b972060a47780aa2d46441e06b354156455cc877 ]
If DDP package is missing or corrupted, the driver should enter Safe Mode. Instead, an error is returned and probe fails.
To fix this, don't exit init if ice_init_ddp_config() returns an error.
Repro:
* Remove or rename DDP package (/lib/firmware/intel/ice/ddp/ice.pkg)
* Load ice
--- drivers/net/ethernet/intel/ice/ice_main.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/ethernet/intel/ice/ice_main.c +1 -3
@@ -4779,14 +4779,12 @@ int ice_init_dev(struct ice_pf *pf)ice_init_feature_support (pf); err =ice_init_ddp_config (hw, pf); -if (err) -return err;/* if ice_init_ddp_config fails, ICE_FLAG_ADV_FEATURES bit won't be * set in pf->state, which will cause ice_is_safe_mode to return * true */ -if (ice_is_safe_mode (pf)) { +if (err ||ice_is_safe_mode (pf)) {/* we already got function/device capabilities but these don't * reflect what the driver needs to do in safe mode. Instead of * adding conditional logic everywhere to ignore these
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/214 ice: Fix netif_is_ice() in Safe Mode
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcin Szycik <[email protected]>
[ Upstream commit 8e60dbcbaaa177dacef55a61501790e201bf8c88 ]
netif_is_ice() works by checking the pointer to netdev ops. However, it only checks for the default ice_netdev_ops, not ice_netdev_safe_mode_ops, so in Safe Mode it always returns false, which is unintuitive. While it doesn't look like netif_is_ice() is currently being called anywhere in Safe Mode, this could change and potentially lead to unexpected behaviour.
--- drivers/net/ethernet/intel/ice/ice_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_main.c +2 -1
@@ -86,7 +86,8 @@ ice_indr_setup_tc_cb(struct net_device *netdev, struct Qdisc *sch,bool netif_is_ice (const struct net_device *dev) { -return dev && (dev->netdev_ops == &ice_netdev_ops); +return dev && (dev->netdev_ops == &ice_netdev_ops || + dev->netdev_ops == &ice_netdev_safe_mode_ops); }/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/214 ice: Flush FDB entries before reset
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wojciech Drewek <[email protected]>
[ Upstream commit fbcb968a98ac0b71f5a2bda2751d7a32d201f90d ]
Triggering the reset while in switchdev mode causes errors[1]. Rules are already removed by this time because switch content is flushed in case of the reset. This means that rules were deleted from HW but SW still thinks they exist so when we get SWITCHDEV_FDB_DEL_TO_DEVICE notification we try to delete not existing rule.
We can avoid these errors by clearing the rules early in the reset flow before they are removed from HW. Switchdev API will get notified that the rule was removed so we won't get SWITCHDEV_FDB_DEL_TO_DEVICE notification. Remove unnecessary ice_clear_sw_switch_recipes.
[1]
ice 0000:01:00.0: Failed to delete FDB forward rule, err: -2 ice 0000:01:00.0: Failed to delete FDB guard rule, err: -2
--- .../net/ethernet/intel/ice/ice_eswitch_br.c | 5 +++- .../net/ethernet/intel/ice/ice_eswitch_br.h | 1 + drivers/net/ethernet/intel/ice/ice_main.c | 24 +++---------------- 3 files changed, 8 insertions(+), 22 deletions(-)
drivers/net/ethernet/intel/ice/ice_eswitch_br.c +4 -1
@@ -582,10 +582,13 @@ ice_eswitch_br_switchdev_event(struct notifier_block *nb,return NOTIFY_DONE ; } -static void ice_eswitch_br_fdb_flush (struct ice_esw_br *bridge) +void ice_eswitch_br_fdb_flush (struct ice_esw_br *bridge) {struct ice_esw_br_fdb_entry *entry, *tmp; +if (!bridge) +return ; +list_for_each_entry_safe (entry, tmp, &bridge->fdb_list, list)ice_eswitch_br_fdb_entry_notify_and_cleanup (bridge, entry); }
drivers/net/ethernet/intel/ice/ice_eswitch_br.h +1 -0
@@ -117,5 +117,6 @@ void ice_eswitch_br_offloads_deinit(struct ice_pf *pf);int ice_eswitch_br_offloads_init (struct ice_pf *pf); +void ice_eswitch_br_fdb_flush (struct ice_esw_br *bridge);#endif /* _ICE_ESWITCH_BR_H_ */
drivers/net/ethernet/intel/ice/ice_main.c +3 -21
@@ -520,25 +520,6 @@ static void ice_pf_dis_all_vsi(struct ice_pf *pf, bool locked) pf->vf_agg_node[node].num_vsis =0 ; } -/** -* ice_clear_sw_switch_recipes - clear switch recipes -* @pf: board private structure -* -* Mark switch recipes as not created in sw structures. There are cases where -* rules (especially advanced rules) need to be restored, either re-read from -* hardware or added again. For example after the reset. 'recp_created' flag -* prevents from doing that and need to be cleared upfront. -*/ -static void ice_clear_sw_switch_recipes (struct ice_pf *pf) -{ -struct ice_sw_recipe *recp; -u8 i; - - recp = pf->hw.switch_info->recp_list; -for (i =0 ; i <ICE_MAX_NUM_RECIPES ; i++) - recp[i].recp_created = false; -} -/** * ice_prepare_for_reset - prep for reset * @pf: board private structure
@@ -575,8 +556,9 @@ ice_prepare_for_reset(struct ice_pf *pf, enum ice_reset_req reset_type)mutex_unlock (&pf->vfs.table_lock);if (ice_is_eswitch_mode_switchdev (pf)) { -if (reset_type !=ICE_RESET_PFR ) -ice_clear_sw_switch_recipes (pf); +rtnl_lock (); +ice_eswitch_br_fdb_flush (pf->eswitch.br_offloads->bridge); +rtnl_unlock (); }/* release ADQ specific HW and SW resources */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/214 ice: Fix increasing MSI-X on VF
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcin Szycik <[email protected]>
[ Upstream commit bce9af1b030bf59d51bbabf909a3ef164787e44e ]
Increasing MSI-X value on a VF leads to invalid memory operations. This is caused by not reallocating some arrays.
Reproducer:
modprobe ice
echo 0 > /sys/bus/pci/devices/$PF_PCI/sriov_drivers_autoprobe echo 1 > /sys/bus/pci/devices/$PF_PCI/sriov_numvfs echo 17 > /sys/bus/pci/devices/$VF0_PCI/sriov_vf_msix_count
Default MSI-X is 16, so 17 and above triggers this issue.
KASAN reports:
BUG: KASAN: slab-out-of-bounds in ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice] Read of size 8 at addr ffff8888b937d180 by task bash/28433 (...) Call Trace: (...) ? ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice] kasan_report+0xed/0x120 ? ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice] ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice] ice_vsi_cfg_def+0x3360/0x4770 [ice] ? mutex_unlock+0x83/0xd0 ? __pfx_ice_vsi_cfg_def+0x10/0x10 [ice] ? __pfx_ice_remove_vsi_lkup_fltr+0x10/0x10 [ice] ice_vsi_cfg+0x7f/0x3b0 [ice] ice_vf_reconfig_vsi+0x114/0x210 [ice] ice_sriov_set_msix_vec_count+0x3d0/0x960 [ice] sriov_vf_msix_count_store+0x21c/0x300 (...) Allocated by task 28201: (...) ice_vsi_cfg_def+0x1c8e/0x4770 [ice] ice_vsi_cfg+0x7f/0x3b0 [ice] ice_vsi_setup+0x179/0xa30 [ice] ice_sriov_configure+0xcaa/0x1520 [ice] sriov_numvfs_store+0x212/0x390 (...)
To fix it, use ice_vsi_rebuild() instead of ice_vf_reconfig_vsi(). This causes the required arrays to be reallocated taking the new queue count into account (ice_vsi_realloc_stat_arrays()). Set req_txq and req_rxq before ice_vsi_rebuild(), so that realloc uses the newly set queue count.
Additionally, ice_vsi_rebuild() does not remove VSI filters (ice_fltr_remove_all()), so ice_vf_init_host_cfg() is no longer necessary.
--- drivers/net/ethernet/intel/ice/ice_sriov.c | 11 ++++++++--- drivers/net/ethernet/intel/ice/ice_vf_lib.c | 2 +- drivers/net/ethernet/intel/ice/ice_vf_lib_private.h | 1 - 3 files changed, 9 insertions(+), 5 deletions(-)
drivers/net/ethernet/intel/ice/ice_sriov.c +8 -3
@@ -1119,7 +1119,10 @@ int ice_sriov_set_msix_vec_count(struct pci_dev *vf_dev, int msix_vec_count)if (vf->first_vector_idx <0 ) goto unroll; -if (ice_vf_reconfig_vsi (vf) ||ice_vf_init_host_cfg (vf, vsi)) { + vsi->req_txq = queues; + vsi->req_rxq = queues; + +if (ice_vsi_rebuild (vsi,ICE_VSI_FLAG_NO_INIT )) {/* Try to rebuild with previous values */ needs_rebuild = true; goto unroll;
@@ -1146,8 +1149,10 @@ int ice_sriov_set_msix_vec_count(struct pci_dev *vf_dev, int msix_vec_count)return -EINVAL ;if (needs_rebuild) { -ice_vf_reconfig_vsi (vf); -ice_vf_init_host_cfg (vf, vsi); + vsi->req_txq = prev_queues; + vsi->req_rxq = prev_queues; + +ice_vsi_rebuild (vsi,ICE_VSI_FLAG_NO_INIT ); }ice_ena_vf_mappings (vf);
drivers/net/ethernet/intel/ice/ice_vf_lib.c +1 -1
@@ -256,7 +256,7 @@ static void ice_vf_pre_vsi_rebuild(struct ice_vf *vf)* * It brings the VSI down and then reconfigures it with the hardware. */ -int ice_vf_reconfig_vsi (struct ice_vf *vf) +static int ice_vf_reconfig_vsi (struct ice_vf *vf) {struct ice_vsi *vsi =ice_get_vf_vsi (vf);struct ice_pf *pf = vf->pf;
drivers/net/ethernet/intel/ice/ice_vf_lib_private.h +0 -1
@@ -23,7 +23,6 @@#warning "Only include ice_vf_lib_private.h in CONFIG_PCI_IOV virtualization files"#endif -int ice_vf_reconfig_vsi (struct ice_vf *vf);void ice_initialize_vf_entry (struct ice_vf *vf);void ice_dis_vf_qs (struct ice_vf *vf);int ice_check_vf_init (struct ice_vf *vf);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/214 i40e: Fix macvlan leak by synchronizing access to mac_filter_hash
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Loktionov <[email protected]>
[ Upstream commit dac6c7b3d33756d6ce09f00a96ea2ecd79fae9fb ]
This patch addresses a macvlan leak issue in the i40e driver caused by concurrent access to vsi->mac_filter_hash. The leak occurs when multiple threads attempt to modify the mac_filter_hash simultaneously, leading to inconsistent state and potential memory leaks.
To fix this, we now wrap the calls to i40e_del_mac_filter() and zeroing vf->default_lan_addr.addr with spin_lock/unlock_bh(&vsi->mac_filter_hash_lock), ensuring atomic operations and preventing concurrent access.
Additionally, we add lockdep_assert_held(&vsi->mac_filter_hash_lock) in i40e_add_mac_filter() to help catch similar issues in the future.
Reproduction steps:
1. Spawn VFs and configure port vlan on them.
2. Trigger concurrent macvlan operations (e.g., adding and deleting portvlan and/or mac filters).
3. Observe the potential memory leak and inconsistent state in the mac_filter_hash.
This synchronization ensures the integrity of the mac_filter_hash and prevents the described leak.
--- drivers/net/ethernet/intel/i40e/i40e_main.c | 1 + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 2 ++ 2 files changed, 3 insertions(+)
drivers/net/ethernet/intel/i40e/i40e_main.c +1 -0
@@ -1734,6 +1734,7 @@ struct i40e_mac_filter *i40e_add_mac_filter(struct i40e_vsi *vsi,struct hlist_node *h;int bkt; +lockdep_assert_held (&vsi->mac_filter_hash_lock);if (vsi->info.pvid)return i40e_add_filter (vsi, macaddr,le16_to_cpu (vsi->info.pvid));
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +2 -0
@@ -2213,8 +2213,10 @@ static int i40e_vc_get_vf_resources_msg(struct i40e_vf *vf, u8 *msg) vfres->vsi_res[0 ].qset_handle =le16_to_cpu (vsi->info.qs_handle[0 ]);if (!(vf->driver_caps &VIRTCHNL_VF_OFFLOAD_USO ) && !vf->pf_set_mac) { +spin_lock_bh (&vsi->mac_filter_hash_lock);i40e_del_mac_filter (vsi, vf->default_lan_addr.addr);eth_zero_addr (vf->default_lan_addr.addr); +spin_unlock_bh (&vsi->mac_filter_hash_lock); }ether_addr_copy (vfres->vsi_res[0 ].default_mac_addr, vf->default_lan_addr.addr);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/214 igb: Do not bring the device up after non-fatal error
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohamed Khalfella <[email protected]>
[ Upstream commit 330a699ecbfc9c26ec92c6310686da1230b4e7eb ]
Commit 004d25060c78 ("igb: Fix igb_down hung on surprise removal") changed igb_io_error_detected() to ignore non-fatal pcie errors in order to avoid hung task that can happen when igb_down() is called multiple times. This caused an issue when processing transient non-fatal errors. igb_io_resume(), which is called after igb_io_error_detected(), assumes that device is brought down by igb_io_error_detected() if the interface is up. This resulted in panic with stacktrace below.
[ T3256] igb 0000:09:00.0 haeth0: igb: haeth0 NIC Link is Down
[ T292] pcieport 0000:00:1c.5: AER: Uncorrected (Non-Fatal) error received: 0000:09:00.0 [ T292] igb 0000:09:00.0: PCIe Bus Error: severity=Uncorrected (Non-Fatal), type=Transaction Layer, (Requester ID) [ T292] igb 0000:09:00.0: device [8086:1537] error status/mask=00004000/00000000 [ T292] igb 0000:09:00.0: [14] CmpltTO [ 200.105524,009][ T292] igb 0000:09:00.0: AER: TLP Header: 00000000 00000000 00000000 00000000 [ T292] pcieport 0000:00:1c.5: AER: broadcast error_detected message [ T292] igb 0000:09:00.0: Non-correctable non-fatal error reported. [ T292] pcieport 0000:00:1c.5: AER: broadcast mmio_enabled message [ T292] pcieport 0000:00:1c.5: AER: broadcast resume message [ T292] ------------[ cut here ]------------ [ T292] kernel BUG at net/core/dev.c:6539! [ T292] invalid opcode: 0000 [#1] PREEMPT SMP [ T292] RIP: 0010:napi_enable+0x37/0x40 [ T292] Call Trace: [ T292] <TASK> [ T292] ? die+0x33/0x90 [ T292] ? do_trap+0xdc/0x110 [ T292] ? napi_enable+0x37/0x40 [ T292] ? do_error_trap+0x70/0xb0 [ T292] ? napi_enable+0x37/0x40 [ T292] ? napi_enable+0x37/0x40 [ T292] ? exc_invalid_op+0x4e/0x70 [ T292] ? napi_enable+0x37/0x40 [ T292] ? asm_exc_invalid_op+0x16/0x20 [ T292] ? napi_enable+0x37/0x40 [ T292] igb_up+0x41/0x150 [ T292] igb_io_resume+0x25/0x70 [ T292] report_resume+0x54/0x70 [ T292] ? report_frozen_detected+0x20/0x20 [ T292] pci_walk_bus+0x6c/0x90 [ T292] ? aer_print_port_info+0xa0/0xa0 [ T292] pcie_do_recovery+0x22f/0x380 [ T292] aer_process_err_devices+0x110/0x160 [ T292] aer_isr+0x1c1/0x1e0 [ T292] ? disable_irq_nosync+0x10/0x10 [ T292] irq_thread_fn+0x1a/0x60 [ T292] irq_thread+0xe3/0x1a0 [ T292] ? irq_set_affinity_notifier+0x120/0x120 [ T292] ? irq_affinity_notify+0x100/0x100 [ T292] kthread+0xe2/0x110 [ T292] ? kthread_complete_and_exit+0x20/0x20 [ T292] ret_from_fork+0x2d/0x50 [ T292] ? kthread_complete_and_exit+0x20/0x20 [ T292] ret_from_fork_asm+0x11/0x20 [ T292] </TASK>
To fix this issue igb_io_resume() checks if the interface is running and the device is not down this means igb_io_error_detected() did not bring the device down and there is no need to bring it up.
--- drivers/net/ethernet/intel/igb/igb_main.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/intel/igb/igb_main.c +4 -0
@@ -9651,6 +9651,10 @@ static void igb_io_resume(struct pci_dev *pdev)struct igb_adapter *adapter =netdev_priv (netdev);if (netif_running (netdev)) { +if (!test_bit (__IGB_DOWN, &adapter->state)) { +dev_dbg (&pdev->dev,"Resuming from non-fatal error, do nothing.\n" ); +return ; + }if (igb_up (adapter)) {dev_err (&pdev->dev,"igb_up failed after reset\n" );return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/214 e1000e: change I219 (19) devices to ADP
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Lifshits <[email protected]>
[ Upstream commit 9d9e5347b035412daa844f884b94a05bac94f864 ]
Sporadic issues, such as PHY access loss, have been observed on I219 (19) devices. It was found that these devices have hardware more closely related to ADP than MTP and the issues were caused by taking MTP-specific flows.
Change the MAC and board types of these devices from MTP to ADP to correctly reflect the LAN hardware, and flows, of these devices.
--- drivers/net/ethernet/intel/e1000e/hw.h | 4 ++-- drivers/net/ethernet/intel/e1000e/netdev.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/e1000e/hw.h +2 -2
@@ -108,8 +108,8 @@ struct e1000_hw;#define E1000_DEV_ID_PCH_RPL_I219_V22 0x0DC8#define E1000_DEV_ID_PCH_MTP_I219_LM18 0x550A#define E1000_DEV_ID_PCH_MTP_I219_V18 0x550B -#define E1000_DEV_ID_PCH_MTP_I219_LM19 0x550C -#define E1000_DEV_ID_PCH_MTP_I219_V19 0x550D +#define E1000_DEV_ID_PCH_ADP_I219_LM19 0x550C +#define E1000_DEV_ID_PCH_ADP_I219_V19 0x550D#define E1000_DEV_ID_PCH_LNP_I219_LM20 0x550E#define E1000_DEV_ID_PCH_LNP_I219_V20 0x550F#define E1000_DEV_ID_PCH_LNP_I219_LM21 0x5510
drivers/net/ethernet/intel/e1000e/netdev.c +2 -2
@@ -7899,10 +7899,10 @@ static const struct pci_device_id e1000_pci_tbl[] = { { PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_ADP_I219_V17), board_pch_adp }, { PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_RPL_I219_LM22), board_pch_adp }, { PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_RPL_I219_V22), board_pch_adp }, + { PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_ADP_I219_LM19), board_pch_adp }, + { PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_ADP_I219_V19), board_pch_adp }, { PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_MTP_I219_LM18), board_pch_mtp }, { PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_MTP_I219_V18), board_pch_mtp }, - { PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_MTP_I219_LM19), board_pch_mtp }, - { PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_MTP_I219_V19), board_pch_mtp }, { PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_LNP_I219_LM20), board_pch_mtp }, { PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_LNP_I219_V20), board_pch_mtp }, { PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_LNP_I219_LM21), board_pch_mtp },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/214 net/sched: accept TCA_STAB only for root qdisc
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 3cb7cf1540ddff5473d6baeb530228d19bc97b8a ]
Most qdiscs maintain their backlog using qdisc_pkt_len(skb) on the assumption it is invariant between the enqueue() and dequeue() handlers.
Unfortunately syzbot can crash a host rather easily using a TBF + SFQ combination, with an STAB on SFQ [1]
We can't support TCA_STAB on arbitrary level, this would require to maintain per-qdisc storage.
[1]
[ 88.796496] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 88.798611] #PF: supervisor read access in kernel mode [ 88.799014] #PF: error_code(0x0000) - not-present page [ 88.799506] PGD 0 P4D 0 [ 88.799829] Oops: Oops: 0000 [#1] SMP NOPTI [ 88.800569] CPU: 14 UID: 0 PID: 2053 Comm: b371744477 Not tainted 6.12.0-rc1-virtme #1117 [ 88.801107] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 88.801779] RIP: 0010:sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq [ 88.802544] Code: 0f b7 50 12 48 8d 04 d5 00 00 00 00 48 89 d6 48 29 d0 48 8b 91 c0 01 00 00 48 c1 e0 03 48 01 c2 66 83 7a 1a 00 7e c0 48 8b 3a <4c> 8b 07 4c 89 02 49 89 50 08 48 c7 47 08 00 00 00 00 48 c7 07 00
All code
========
0: 0f b7 50 12 movzwl 0x12(%rax),%edx
4: 48 8d 04 d5 00 00 00 lea 0x0(,%rdx,8),%rax
b: 00
c: 48 89 d6 mov %rdx,%rsi f: 48 29 d0 sub %rdx,%rax 12: 48 8b 91 c0 01 00 00 mov 0x1c0(%rcx),%rdx 19: 48 c1 e0 03 shl $0x3,%rax 1d: 48 01 c2 add %rax,%rdx 20: 66 83 7a 1a 00 cmpw $0x0,0x1a(%rdx) 25: 7e c0 jle 0xffffffffffffffe7 27: 48 8b 3a mov (%rdx),%rdi 2a:* 4c 8b 07 mov (%rdi),%r8 <-- trapping instruction 2d: 4c 89 02 mov %r8,(%rdx) 30: 49 89 50 08 mov %rdx,0x8(%r8) 34: 48 c7 47 08 00 00 00 movq $0x0,0x8(%rdi) 3b: 00 3c: 48 rex.W 3d: c7 .byte 0xc7 3e: 07 (bad) ...
Code starting with the faulting instruction
===========================================
0: 4c 8b 07 mov (%rdi),%r8 3: 4c 89 02 mov %r8,(%rdx) 6: 49 89 50 08 mov %rdx,0x8(%r8) a: 48 c7 47 08 00 00 00 movq $0x0,0x8(%rdi) 11: 00 12: 48 rex.W 13: c7 .byte 0xc7 14: 07 (bad) ... [ 88.803721] RSP: 0018:ffff9a1f892b7d58 EFLAGS: 00000206 [ 88.804032] RAX: 0000000000000000 RBX: ffff9a1f8420c800 RCX: ffff9a1f8420c800 [ 88.804560] RDX: ffff9a1f81bc1440 RSI: 0000000000000000 RDI: 0000000000000000 [ 88.805056] RBP: ffffffffc04bb0e0 R08: 0000000000000001 R09: 00000000ff7f9a1f [ 88.805473] R10: 000000000001001b R11: 0000000000009a1f R12: 0000000000000140 [ 88.806194] R13: 0000000000000001 R14: ffff9a1f886df400 R15: ffff9a1f886df4ac [ 88.806734] FS: 00007f445601a740(0000) GS:ffff9a2e7fd80000(0000) knlGS:0000000000000000 [ 88.807225] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 88.807672] CR2: 0000000000000000 CR3: 000000050cc46000 CR4: 00000000000006f0 [ 88.808165] Call Trace: [ 88.808459] <TASK> [ 88.808710] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434) [ 88.809261] ? page_fault_oops (arch/x86/mm/fault.c:715) [ 88.809561] ? exc_page_fault (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:147 arch/x86/mm/fault.c:1489 arch/x86/mm/fault.c:1539) [ 88.809806] ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:623) [ 88.810074] ? sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq [ 88.810411] sfq_reset (net/sched/sch_sfq.c:525) sch_sfq [ 88.810671] qdisc_reset (./include/linux/skbuff.h:2135 ./include/linux/skbuff.h:2441 ./include/linux/skbuff.h:3304 ./include/linux/skbuff.h:3310 net/sched/sch_generic.c:1036) [ 88.810950] tbf_reset (./include/linux/timekeeping.h:169 net/sched/sch_tbf.c:334) sch_tbf [ 88.811208] qdisc_reset (./include/linux/skbuff.h:2135 ./include/linux/skbuff.h:2441 ./include/linux/skbuff.h:3304 ./include/linux/skbuff.h:3310 net/sched/sch_generic.c:1036) [ 88.811484] netif_set_real_num_tx_queues (./include/linux/spinlock.h:396 ./include/net/sch_generic.h:768 net/core/dev.c:2958) [ 88.811870] __tun_detach (drivers/net/tun.c:590 drivers/net/tun.c:673) [ 88.812271] tun_chr_close (drivers/net/tun.c:702 drivers/net/tun.c:3517) [ 88.812505] __fput (fs/file_table.c:432 (discriminator 1)) [ 88.812735] task_work_run (kernel/task_work.c:230) [ 88.813016] do_exit (kernel/exit.c:940) [ 88.813372] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:58 (discriminator 4)) [ 88.813639] ? handle_mm_fault (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:97 ./arch/x86/include/asm/irqflags.h:155 ./include/linux/memcontrol.h:1022 ./include/linux/memcontrol.h:1045 ./include/linux/memcontrol.h:1052 mm/memory.c:5928 mm/memory.c:6088) [ 88.813867] do_group_exit (kernel/exit.c:1070) [ 88.814138] __x64_sys_exit_group (kernel/exit.c:1099) [ 88.814490] x64_sys_call (??:?) [ 88.814791] do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1)) [ 88.815012] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 88.815495] RIP: 0033:0x7f44560f1975
--- include/net/sch_generic.h | 1 - net/sched/sch_api.c | 7 ++++++- 2 files changed, 6 insertions(+), 2 deletions(-)
include/net/sch_generic.h +0 -1
@@ -848,7 +848,6 @@ static inline void qdisc_calculate_pkt_len(struct sk_buff *skb,static inline int qdisc_enqueue (struct sk_buff *skb,struct Qdisc *sch,struct sk_buff **to_free) { -qdisc_calculate_pkt_len (skb, sch);return sch->enqueue (skb, sch, to_free); }
net/sched/sch_api.c +6 -1
@@ -593,7 +593,6 @@ void __qdisc_calculate_pkt_len(struct sk_buff *skb, pkt_len =1 ;qdisc_skb_cb (skb)->pkt_len = pkt_len; } -EXPORT_SYMBOL (__qdisc_calculate_pkt_len);void qdisc_warn_nonwc (const char *txt,struct Qdisc *qdisc) {
@@ -1201,6 +1200,12 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,return -EINVAL ; } +if (new && + !(parent->flags &TCQ_F_MQROOT ) && +rcu_access_pointer (new->stab)) { +NL_SET_ERR_MSG (extack,"STAB not supported on a non root" ); +return -EINVAL ; + } err = cops->graft (parent, cl, new, &old, extack);if (err)return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/214 drm/xe: Restore GT freq on GSC load error
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinay Belgaumkar <[email protected]>
[ Upstream commit 3fd76be868ae5c7e9f905f3bcc2ce0e3d8f5aa08 ]
As part of a Wa_22019338487, ensure that GT freq is restored even when GSC reload is not successful.
--- drivers/gpu/drm/xe/xe_gt.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_gt.c +3 -1
@@ -874,7 +874,9 @@ int xe_gt_sanitize_freq(struct xe_gt *gt)int ret =0 ;if ((!xe_uc_fw_is_available (>->uc.gsc.fw) || -xe_uc_fw_is_loaded (>->uc.gsc.fw)) &&XE_WA (gt,22019338487 )) +xe_uc_fw_is_loaded (>->uc.gsc.fw) || +xe_uc_fw_is_in_error_state (>->uc.gsc.fw)) && +XE_WA (gt,22019338487 )) ret =xe_guc_pc_restore_stashed_freq (>->uc.guc.pc);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/214 drm/xe: Make wedged_mode debugfs writable
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Roper <[email protected]>
[ Upstream commit 1badf482816417dca71f8120b4c540cdc82aa03c ]
The intent of this debugfs entry is to allow modification of wedging behavior, either from IGT tests or during manual debug; it should be marked as writable to properly reflect this. In practice this hasn't caused a problem because we always access wedged_mode as root, which ignores file permissions, but it's still misleading to have the entry incorrectly marked as RO.
--- drivers/gpu/drm/xe/xe_debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_debugfs.c +1 -1
@@ -190,7 +190,7 @@ void xe_debugfs_register(struct xe_device *xe)debugfs_create_file ("forcewake_all" ,0400 , root, xe, &forcewake_all_fops); -debugfs_create_file ("wedged_mode" ,0400 , root, xe, +debugfs_create_file ("wedged_mode" ,0600 , root, xe, &wedged_mode_fops);for (mem_type =XE_PL_VRAM0 ; mem_type <=XE_PL_VRAM1 ; ++mem_type) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/214 net: ibm: emac: mal: fix wrong goto
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit 08c8acc9d8f3f70d62dd928571368d5018206490 ]
dcr_map is called in the previous if and therefore needs to be unmapped.
--- drivers/net/ethernet/ibm/emac/mal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/ibm/emac/mal.c +1 -1
@@ -578,7 +578,7 @@ static int mal_probe(struct platform_device *ofdev)printk (KERN_ERR "%pOF: Support for 405EZ not enabled!\n" , ofdev->dev.of_node); err = -ENODEV ; - goto fail; + goto fail_unmap;#endif }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/214 net: ti: icssg-prueth: Fix race condition for VLAN table access
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: MD Danish Anwar <[email protected]>
[ Upstream commit ff8ee11e778520c5716b7f165d2c7ce14d6a068b ]
The VLAN table is a shared memory between the two ports/slices in a ICSSG cluster and this may lead to race condition when the common code paths for both ports are executed in different CPUs.
Fix the race condition access by locking the shared memory access
--- drivers/net/ethernet/ti/icssg/icssg_config.c | 2 ++ drivers/net/ethernet/ti/icssg/icssg_prueth.c | 1 + drivers/net/ethernet/ti/icssg/icssg_prueth.h | 2 ++ 3 files changed, 5 insertions(+)
drivers/net/ethernet/ti/icssg/icssg_config.c +2 -0
@@ -733,6 +733,7 @@ void icssg_vtbl_modify(struct prueth_emac *emac, u8 vid, u8 port_mask,u8 fid_c1; tbl = prueth->vlan_tbl; +spin_lock (&prueth->vtbl_lock); fid_c1 = tbl[vid].fid_c1;/* FID_C1: bit0..2 port membership mask,
@@ -748,6 +749,7 @@ void icssg_vtbl_modify(struct prueth_emac *emac, u8 vid, u8 port_mask, } tbl[vid].fid_c1 = fid_c1; +spin_unlock (&prueth->vtbl_lock); }EXPORT_SYMBOL_GPL (icssg_vtbl_modify);
drivers/net/ethernet/ti/icssg/icssg_prueth.c +1 -0
@@ -1262,6 +1262,7 @@ static int prueth_probe(struct platform_device *pdev)icss_iep_init_fw (prueth->iep1); } +spin_lock_init (&prueth->vtbl_lock);/* setup netdev interfaces */ if (eth0_node) { ret =prueth_netdev_init (prueth, eth0_node);
drivers/net/ethernet/ti/icssg/icssg_prueth.h +2 -0
@@ -282,6 +282,8 @@ struct prueth {bool is_switchmode_supported;unsigned char switch_id[MAX_PHYS_ITEM_ID_LEN ];int default_vlan; +/** @vtbl_lock: Lock for vtbl in shared memory */ +spinlock_t vtbl_lock; };struct emac_tx_ts_response {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/214 btrfs: zoned: fix missing RCU locking in error message when loading zone info
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit fe4cd7ed128fe82ab9fe4f9fc8a73d4467699787 ]
At btrfs_load_zone_info() we have an error path that is dereferencing the name of a device which is a RCU string but we are not holding a RCU read lock, which is incorrect.
Fix this by using btrfs_err_in_rcu() instead of btrfs_err().
The problem is there since commit 08e11a3db098 ("btrfs: zoned: load zone's allocation offset"), back then at btrfs_load_block_group_zone_info() but then later on that code was factored out into the helper btrfs_load_zone_info() by commit 09a46725cc84 ("btrfs: zoned: factor out per-zone logic from btrfs_load_block_group_zone_info").
--- fs/btrfs/zoned.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/zoned.c +1 -1
@@ -1352,7 +1352,7 @@ static int btrfs_load_zone_info(struct btrfs_fs_info *fs_info, int zone_idx,switch (zone.cond) {case BLK_ZONE_COND_OFFLINE :case BLK_ZONE_COND_READONLY : -btrfs_err (fs_info, +btrfs_err_in_rcu (fs_info,"zoned: offline/readonly zone %llu on device %s (devid %llu)" , (info->physical >> device->zone_info->zone_size_shift),rcu_str_deref (device->name), device->devid);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/214 sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 4d5c70e6155d5eae198bade4afeab3c1b15073b6 ]
If hashing fails in sctp_listen_start(), the socket remains in the LISTENING state, even though it was not added to the hash table. This can lead to a scenario where a socket appears to be listening without actually being accessible.
This patch ensures that if the hashing operation fails, the sk_state is set back to CLOSED before returning an error.
Note that there is no need to undo the autobind operation if hashing fails, as the bind port can still be used for next listen() call on the same socket.
--- net/sctp/socket.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
net/sctp/socket.c +13 -5
@@ -8531,6 +8531,7 @@ static int sctp_listen_start(struct sock *sk, int backlog)struct sctp_endpoint *ep = sp->ep;struct crypto_shash *tfm =NULL ;char alg[32 ]; +int err;/* Allocate HMAC for generating cookie. */ if (!sp->hmac && sp->sctp_hmac_alg) {
@@ -8558,18 +8559,25 @@ static int sctp_listen_start(struct sock *sk, int backlog)inet_sk_set_state (sk,SCTP_SS_LISTENING );if (!ep->base.bind_addr.port) {if (sctp_autobind (sk)) { -inet_sk_set_state (sk,SCTP_SS_CLOSED ); -return -EAGAIN ; + err = -EAGAIN ; + goto err; } }else {if (sctp_get_port (sk,inet_sk (sk)->inet_num)) { -inet_sk_set_state (sk,SCTP_SS_CLOSED ); -return -EADDRINUSE ; + err = -EADDRINUSE ; + goto err; } }WRITE_ONCE (sk->sk_max_ack_backlog, backlog); -return sctp_hash_endpoint (ep); + err =sctp_hash_endpoint (ep); +if (err) + goto err; + +return 0 ; +err: +inet_sk_set_state (sk,SCTP_SS_CLOSED ); +return err; }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 134/214 netfilter: xtables: avoid NFPROTO_UNSPEC where needed
In reply to Greg Kroah-Hartman6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 0bfcb7b71e735560077a42847f69597ec7dcc326 ]
syzbot managed to call xt_cluster match via ebtables:
WARNING: CPU: 0 PID: 11 at net/netfilter/xt_cluster.c:72 xt_cluster_mt+0x196/0x780 [..] ebt_do_table+0x174b/0x2a40
Module registers to NFPROTO_UNSPEC, but it assumes ipv4/ipv6 packet processing. As this is only useful to restrict locally terminating TCP/UDP traffic, register this for ipv4 and ipv6 family only.
Pablo points out that this is a general issue, direct users of the set/getsockopt interface can call into targets/matches that were only intended for use with ip(6)tables.
Check all UNSPEC matches and targets for similar issues:
- matches and targets are fine except if they assume skb_network_header() is valid -- this is only true when called from inet layer: ip(6) stack pulls the ip/ipv6 header into linear data area.
- targets that return XT_CONTINUE or other xtables verdicts must be restricted too, they are incompatbile with the ebtables traverser, e.g. EBT_CONTINUE is a completely different value than XT_CONTINUE.
Most matches/targets are changed to register for NFPROTO_IPV4/IPV6, as they are provided for use by ip(6)tables.
The MARK target is also used by arptables, so register for NFPROTO_ARP too.
While at it, bail out if connbytes fails to enable the corresponding conntrack family.
This change passes the selftests in iptables.git.
--- net/netfilter/xt_CHECKSUM.c | 33 ++++++---- net/netfilter/xt_CLASSIFY.c | 16 ++++- net/netfilter/xt_CONNSECMARK.c | 36 +++++++---- net/netfilter/xt_CT.c | 106 +++++++++++++++++++++------------ net/netfilter/xt_IDLETIMER.c | 59 ++++++++++++------ net/netfilter/xt_LED.c | 39 ++++++++---- net/netfilter/xt_NFLOG.c | 36 +++++++---- net/netfilter/xt_RATEEST.c | 39 ++++++++---- net/netfilter/xt_SECMARK.c | 27 ++++++++- net/netfilter/xt_TRACE.c | 35 +++++++---- net/netfilter/xt_addrtype.c | 15 ++++- net/netfilter/xt_cluster.c | 33 ++++++---- net/netfilter/xt_connbytes.c | 4 +- net/netfilter/xt_connlimit.c | 39 ++++++++---- net/netfilter/xt_connmark.c | 28 ++++++++- net/netfilter/xt_mark.c | 42 +++++++++---- 16 files changed, 422 insertions(+), 165 deletions(-)
net/netfilter/xt_CHECKSUM.c +23 -10
@@ -63,24 +63,37 @@ static int checksum_tg_check(const struct xt_tgchk_param *par)return 0 ; } -static struct xt_target checksum_tg_reg__read_mostly = { - .name ="CHECKSUM" , - .family =NFPROTO_UNSPEC , - .target = checksum_tg, - .targetsize =sizeof (struct xt_CHECKSUM_info ), - .table ="mangle" , - .checkentry = checksum_tg_check, - .me =THIS_MODULE , +static struct xt_target checksum_tg_reg[]__read_mostly = { + { + .name ="CHECKSUM" , + .family =NFPROTO_IPV4 , + .target = checksum_tg, + .targetsize =sizeof (struct xt_CHECKSUM_info ), + .table ="mangle" , + .checkentry = checksum_tg_check, + .me =THIS_MODULE , + }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name ="CHECKSUM" , + .family =NFPROTO_IPV6 , + .target = checksum_tg, + .targetsize =sizeof (struct xt_CHECKSUM_info ), + .table ="mangle" , + .checkentry = checksum_tg_check, + .me =THIS_MODULE , + }, +#endif };static int __init checksum_tg_init (void ) { -return xt_register_target (&checksum_tg_reg); +return xt_register_targets (checksum_tg_reg,ARRAY_SIZE (checksum_tg_reg)); } static void __exit checksum_tg_exit(void) { -xt_unregister_target (&checksum_tg_reg); +xt_unregister_targets (checksum_tg_reg,ARRAY_SIZE (checksum_tg_reg)); }module_init (checksum_tg_init);
net/netfilter/xt_CLASSIFY.c +14 -2
@@ -38,9 +38,9 @@ static struct xt_target classify_tg_reg[] __read_mostly = { { .name = "CLASSIFY", .revision = 0, - .family = NFPROTO_UNSPEC, + .family = NFPROTO_IPV4, .hooks = (1 <<NF_INET_LOCAL_OUT ) | (1 <<NF_INET_FORWARD ) | - (1 << NF_INET_POST_ROUTING), + (1 << NF_INET_POST_ROUTING), .target = classify_tg, .targetsize = sizeof(struct xt_classify_target_info), .me = THIS_MODULE,
@@ -54,6 +54,18 @@ static struct xt_target classify_tg_reg[] __read_mostly = { .targetsize = sizeof(struct xt_classify_target_info), .me = THIS_MODULE, }, +#if IS_ENABLED (CONFIG_IP6_NF_IPTABLES ) + { + .name = "CLASSIFY", + .revision = 0, + .family = NFPROTO_IPV6, + .hooks = (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_FORWARD) | + (1 << NF_INET_POST_ROUTING), + .target = classify_tg, + .targetsize = sizeof(struct xt_classify_target_info), + .me = THIS_MODULE, + }, +#endif };static int __init classify_tg_init (void )
net/netfilter/xt_CONNSECMARK.c +25 -11
@@ -114,25 +114,39 @@ static void connsecmark_tg_destroy(const struct xt_tgdtor_param *par)nf_ct_netns_put (par->net, par->family); } -static struct xt_target connsecmark_tg_reg__read_mostly = { - .name ="CONNSECMARK" , - .revision =0 , - .family =NFPROTO_UNSPEC , - .checkentry = connsecmark_tg_check, - .destroy = connsecmark_tg_destroy, - .target = connsecmark_tg, - .targetsize =sizeof (struct xt_connsecmark_target_info ), - .me =THIS_MODULE , +static struct xt_target connsecmark_tg_reg[]__read_mostly = { + { + .name ="CONNSECMARK" , + .revision =0 , + .family =NFPROTO_IPV4 , + .checkentry = connsecmark_tg_check, + .destroy = connsecmark_tg_destroy, + .target = connsecmark_tg, + .targetsize =sizeof (struct xt_connsecmark_target_info ), + .me =THIS_MODULE , + }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name ="CONNSECMARK" , + .revision =0 , + .family =NFPROTO_IPV6 , + .checkentry = connsecmark_tg_check, + .destroy = connsecmark_tg_destroy, + .target = connsecmark_tg, + .targetsize =sizeof (struct xt_connsecmark_target_info ), + .me =THIS_MODULE , + }, +#endif };static int __init connsecmark_tg_init (void ) { -return xt_register_target (&connsecmark_tg_reg); +return xt_register_targets (connsecmark_tg_reg,ARRAY_SIZE (connsecmark_tg_reg)); } static void __exit connsecmark_tg_exit(void) { -xt_unregister_target (&connsecmark_tg_reg); +xt_unregister_targets (connsecmark_tg_reg,ARRAY_SIZE (connsecmark_tg_reg)); }module_init (connsecmark_tg_init);
net/netfilter/xt_CT.c +69 -37
142 lines not on this page · raw message
net/netfilter/xt_IDLETIMER.c +40 -19
68 lines not on this page · raw message
net/netfilter/xt_LED.c +27 -12
@@ -175,26 +175,41 @@ static void led_tg_destroy(const struct xt_tgdtor_param *par)kfree (ledinternal); } -static struct xt_target led_tg_reg__read_mostly = { - .name ="LED" , - .revision =0 , - .family =NFPROTO_UNSPEC , - .target = led_tg, - .targetsize =sizeof (struct xt_led_info ), - .usersize = offsetof(struct xt_led_info , internal_data), - .checkentry = led_tg_check, - .destroy = led_tg_destroy, - .me =THIS_MODULE , +static struct xt_target led_tg_reg[]__read_mostly = { + { + .name ="LED" , + .revision =0 , + .family =NFPROTO_IPV4 , + .target = led_tg, + .targetsize =sizeof (struct xt_led_info ), + .usersize = offsetof(struct xt_led_info , internal_data), + .checkentry = led_tg_check, + .destroy = led_tg_destroy, + .me =THIS_MODULE , + }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name ="LED" , + .revision =0 , + .family =NFPROTO_IPV6 , + .target = led_tg, + .targetsize =sizeof (struct xt_led_info ), + .usersize = offsetof(struct xt_led_info , internal_data), + .checkentry = led_tg_check, + .destroy = led_tg_destroy, + .me =THIS_MODULE , + }, +#endif };static int __init led_tg_init (void ) { -return xt_register_target (&led_tg_reg); +return xt_register_targets (led_tg_reg,ARRAY_SIZE (led_tg_reg)); } static void __exit led_tg_exit(void) { -xt_unregister_target (&led_tg_reg); +xt_unregister_targets (led_tg_reg,ARRAY_SIZE (led_tg_reg)); }module_init (led_tg_init);
net/netfilter/xt_NFLOG.c +25 -11
@@ -64,25 +64,39 @@ static void nflog_tg_destroy(const struct xt_tgdtor_param *par)nf_logger_put (par->family,NF_LOG_TYPE_ULOG ); } -static struct xt_target nflog_tg_reg__read_mostly = { - .name ="NFLOG" , - .revision =0 , - .family =NFPROTO_UNSPEC , - .checkentry = nflog_tg_check, - .destroy = nflog_tg_destroy, - .target = nflog_tg, - .targetsize =sizeof (struct xt_nflog_info ), - .me =THIS_MODULE , +static struct xt_target nflog_tg_reg[]__read_mostly = { + { + .name ="NFLOG" , + .revision =0 , + .family =NFPROTO_IPV4 , + .checkentry = nflog_tg_check, + .destroy = nflog_tg_destroy, + .target = nflog_tg, + .targetsize =sizeof (struct xt_nflog_info ), + .me =THIS_MODULE , + }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name ="NFLOG" , + .revision =0 , + .family =NFPROTO_IPV4 , + .checkentry = nflog_tg_check, + .destroy = nflog_tg_destroy, + .target = nflog_tg, + .targetsize =sizeof (struct xt_nflog_info ), + .me =THIS_MODULE , + }, +#endif };static int __init nflog_tg_init (void ) { -return xt_register_target (&nflog_tg_reg); +return xt_register_targets (nflog_tg_reg,ARRAY_SIZE (nflog_tg_reg)); } static void __exit nflog_tg_exit(void) { -xt_unregister_target (&nflog_tg_reg); +xt_unregister_targets (nflog_tg_reg,ARRAY_SIZE (nflog_tg_reg)); }module_init (nflog_tg_init);
net/netfilter/xt_RATEEST.c +27 -12
@@ -179,16 +179,31 @@ static void xt_rateest_tg_destroy(const struct xt_tgdtor_param *par)xt_rateest_put (par->net, info->est); } -static struct xt_target xt_rateest_tg_reg__read_mostly = { - .name ="RATEEST" , - .revision =0 , - .family =NFPROTO_UNSPEC , - .target = xt_rateest_tg, - .checkentry = xt_rateest_tg_checkentry, - .destroy = xt_rateest_tg_destroy, - .targetsize =sizeof (struct xt_rateest_target_info ), - .usersize = offsetof(struct xt_rateest_target_info , est), - .me =THIS_MODULE , +static struct xt_target xt_rateest_tg_reg[]__read_mostly = { + { + .name ="RATEEST" , + .revision =0 , + .family =NFPROTO_IPV4 , + .target = xt_rateest_tg, + .checkentry = xt_rateest_tg_checkentry, + .destroy = xt_rateest_tg_destroy, + .targetsize =sizeof (struct xt_rateest_target_info ), + .usersize = offsetof(struct xt_rateest_target_info , est), + .me =THIS_MODULE , + }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name ="RATEEST" , + .revision =0 , + .family =NFPROTO_IPV6 , + .target = xt_rateest_tg, + .checkentry = xt_rateest_tg_checkentry, + .destroy = xt_rateest_tg_destroy, + .targetsize =sizeof (struct xt_rateest_target_info ), + .usersize = offsetof(struct xt_rateest_target_info , est), + .me =THIS_MODULE , + }, +#endif };static __net_init int xt_rateest_net_init (struct net *net)
@@ -214,12 +229,12 @@ static int __init xt_rateest_tg_init(void)if (err)return err; -return xt_register_target (&xt_rateest_tg_reg); +return xt_register_targets (xt_rateest_tg_reg,ARRAY_SIZE (xt_rateest_tg_reg)); } static void __exit xt_rateest_tg_fini(void) { -xt_unregister_target (&xt_rateest_tg_reg); +xt_unregister_targets (xt_rateest_tg_reg,ARRAY_SIZE (xt_rateest_tg_reg));unregister_pernet_subsys (&xt_rateest_net_ops); }
net/netfilter/xt_SECMARK.c +25 -2
@@ -157,7 +157,7 @@ static struct xt_target secmark_tg_reg[] __read_mostly = { { .name = "SECMARK", .revision = 0, - .family = NFPROTO_UNSPEC, + .family = NFPROTO_IPV4, .checkentry = secmark_tg_check_v0, .destroy = secmark_tg_destroy, .target = secmark_tg_v0,
@@ -167,7 +167,7 @@ static struct xt_target secmark_tg_reg[] __read_mostly = { { .name = "SECMARK", .revision = 1, - .family = NFPROTO_UNSPEC, + .family = NFPROTO_IPV4, .checkentry = secmark_tg_check_v1, .destroy = secmark_tg_destroy, .target = secmark_tg_v1,
@@ -175,6 +175,29 @@ static struct xt_target secmark_tg_reg[] __read_mostly = { .usersize = offsetof(struct xt_secmark_target_info_v1, secid), .me = THIS_MODULE, }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name = "SECMARK", + .revision = 0, + .family = NFPROTO_IPV6, + .checkentry = secmark_tg_check_v0, + .destroy = secmark_tg_destroy, + .target = secmark_tg_v0, + .targetsize = sizeof(struct xt_secmark_target_info), + .me = THIS_MODULE, + }, + { + .name = "SECMARK", + .revision = 1, + .family = NFPROTO_IPV6, + .checkentry = secmark_tg_check_v1, + .destroy = secmark_tg_destroy, + .target = secmark_tg_v1, + .targetsize = sizeof(struct xt_secmark_target_info_v1), + .usersize = offsetof(struct xt_secmark_target_info_v1, secid), + .me = THIS_MODULE, + }, +#endif }; static int __init secmark_tg_init(void)
net/netfilter/xt_TRACE.c +24 -11
@@ -29,25 +29,38 @@ trace_tg(struct sk_buff *skb, const struct xt_action_param *par)return XT_CONTINUE ; } -static struct xt_target trace_tg_reg__read_mostly = { - .name ="TRACE" , - .revision =0 , - .family =NFPROTO_UNSPEC , - .table ="raw" , - .target = trace_tg, - .checkentry = trace_tg_check, - .destroy = trace_tg_destroy, - .me =THIS_MODULE , +static struct xt_target trace_tg_reg[]__read_mostly = { + { + .name ="TRACE" , + .revision =0 , + .family =NFPROTO_IPV4 , + .table ="raw" , + .target = trace_tg, + .checkentry = trace_tg_check, + .destroy = trace_tg_destroy, + .me =THIS_MODULE , + }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name ="TRACE" , + .revision =0 , + .family =NFPROTO_IPV6 , + .table ="raw" , + .target = trace_tg, + .checkentry = trace_tg_check, + .destroy = trace_tg_destroy, + }, +#endif };static int __init trace_tg_init (void ) { -return xt_register_target (&trace_tg_reg); +return xt_register_targets (trace_tg_reg,ARRAY_SIZE (trace_tg_reg)); } static void __exit trace_tg_exit(void) { -xt_unregister_target (&trace_tg_reg); +xt_unregister_targets (trace_tg_reg,ARRAY_SIZE (trace_tg_reg)); }module_init (trace_tg_init);
net/netfilter/xt_addrtype.c +13 -2
@@ -208,13 +208,24 @@ static struct xt_match addrtype_mt_reg[] __read_mostly = { }, { .name = "addrtype", - .family = NFPROTO_UNSPEC, + .family = NFPROTO_IPV4, .revision = 1, .match = addrtype_mt_v1, .checkentry = addrtype_mt_checkentry_v1, .matchsize = sizeof(struct xt_addrtype_info_v1), .me = THIS_MODULE - } + }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name = "addrtype", + .family = NFPROTO_IPV6, + .revision = 1, + .match = addrtype_mt_v1, + .checkentry = addrtype_mt_checkentry_v1, + .matchsize = sizeof(struct xt_addrtype_info_v1), + .me = THIS_MODULE + }, +#endif }; static int __init addrtype_mt_init(void)
net/netfilter/xt_cluster.c +23 -10
@@ -146,24 +146,37 @@ static void xt_cluster_mt_destroy(const struct xt_mtdtor_param *par)nf_ct_netns_put (par->net, par->family); } -static struct xt_match xt_cluster_match__read_mostly = { - .name ="cluster" , - .family =NFPROTO_UNSPEC , - .match = xt_cluster_mt, - .checkentry = xt_cluster_mt_checkentry, - .matchsize =sizeof (struct xt_cluster_match_info ), - .destroy = xt_cluster_mt_destroy, - .me =THIS_MODULE , +static struct xt_match xt_cluster_match[]__read_mostly = { + { + .name ="cluster" , + .family =NFPROTO_IPV4 , + .match = xt_cluster_mt, + .checkentry = xt_cluster_mt_checkentry, + .matchsize =sizeof (struct xt_cluster_match_info ), + .destroy = xt_cluster_mt_destroy, + .me =THIS_MODULE , + }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name ="cluster" , + .family =NFPROTO_IPV6 , + .match = xt_cluster_mt, + .checkentry = xt_cluster_mt_checkentry, + .matchsize =sizeof (struct xt_cluster_match_info ), + .destroy = xt_cluster_mt_destroy, + .me =THIS_MODULE , + }, +#endif };static int __init xt_cluster_mt_init (void ) { -return xt_register_match (&xt_cluster_match); +return xt_register_matches (xt_cluster_match,ARRAY_SIZE (xt_cluster_match)); } static void __exit xt_cluster_mt_fini(void) { -xt_unregister_match (&xt_cluster_match); +xt_unregister_matches (xt_cluster_match,ARRAY_SIZE (xt_cluster_match)); }MODULE_AUTHOR ("Pablo Neira Ayuso <[email protected]>" );
net/netfilter/xt_connbytes.c +3 -1
@@ -111,9 +111,11 @@ static int connbytes_mt_check(const struct xt_mtchk_param *par)return -EINVAL ; ret =nf_ct_netns_get (par->net, par->family); -if (ret <0 ) +if (ret <0 ) {pr_info_ratelimited ("cannot load conntrack support for proto=%u\n" , par->family); +return ret; + }/* * This filter cannot function correctly unless connection tracking
net/netfilter/xt_connlimit.c +27 -12
@@ -106,26 +106,41 @@ static void connlimit_mt_destroy(const struct xt_mtdtor_param *par)nf_conncount_destroy (par->net, par->family, info->data); } -static struct xt_match connlimit_mt_reg__read_mostly = { - .name ="connlimit" , - .revision =1 , - .family =NFPROTO_UNSPEC , - .checkentry = connlimit_mt_check, - .match = connlimit_mt, - .matchsize =sizeof (struct xt_connlimit_info ), - .usersize = offsetof(struct xt_connlimit_info , data), - .destroy = connlimit_mt_destroy, - .me =THIS_MODULE , +static struct xt_match connlimit_mt_reg[]__read_mostly = { + { + .name ="connlimit" , + .revision =1 , + .family =NFPROTO_IPV4 , + .checkentry = connlimit_mt_check, + .match = connlimit_mt, + .matchsize =sizeof (struct xt_connlimit_info ), + .usersize = offsetof(struct xt_connlimit_info , data), + .destroy = connlimit_mt_destroy, + .me =THIS_MODULE , + }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name ="connlimit" , + .revision =1 , + .family =NFPROTO_IPV6 , + .checkentry = connlimit_mt_check, + .match = connlimit_mt, + .matchsize =sizeof (struct xt_connlimit_info ), + .usersize = offsetof(struct xt_connlimit_info , data), + .destroy = connlimit_mt_destroy, + .me =THIS_MODULE , + }, +#endif };static int __init connlimit_mt_init (void ) { -return xt_register_match (&connlimit_mt_reg); +return xt_register_matches (connlimit_mt_reg,ARRAY_SIZE (connlimit_mt_reg)); } static void __exit connlimit_mt_exit(void) { -xt_unregister_match (&connlimit_mt_reg); +xt_unregister_matches (connlimit_mt_reg,ARRAY_SIZE (connlimit_mt_reg)); }module_init (connlimit_mt_init);
net/netfilter/xt_connmark.c +25 -3
@@ -151,7 +151,7 @@ static struct xt_target connmark_tg_reg[] __read_mostly = { { .name = "CONNMARK", .revision = 1, - .family = NFPROTO_UNSPEC, + .family = NFPROTO_IPV4, .checkentry = connmark_tg_check, .target = connmark_tg, .targetsize = sizeof(struct xt_connmark_tginfo1),
@@ -161,13 +161,35 @@ static struct xt_target connmark_tg_reg[] __read_mostly = { { .name = "CONNMARK", .revision = 2, - .family = NFPROTO_UNSPEC, + .family = NFPROTO_IPV4, .checkentry = connmark_tg_check, .target = connmark_tg_v2, .targetsize = sizeof(struct xt_connmark_tginfo2), .destroy = connmark_tg_destroy, .me = THIS_MODULE, - } + }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name = "CONNMARK", + .revision = 1, + .family = NFPROTO_IPV6, + .checkentry = connmark_tg_check, + .target = connmark_tg, + .targetsize = sizeof(struct xt_connmark_tginfo1), + .destroy = connmark_tg_destroy, + .me = THIS_MODULE, + }, + { + .name = "CONNMARK", + .revision = 2, + .family = NFPROTO_IPV6, + .checkentry = connmark_tg_check, + .target = connmark_tg_v2, + .targetsize = sizeof(struct xt_connmark_tginfo2), + .destroy = connmark_tg_destroy, + .me = THIS_MODULE, + }, +#endif }; static struct xt_match connmark_mt_reg __read_mostly = {
net/netfilter/xt_mark.c +32 -10
64 lines not on this page · raw message
Signature · 1 line
2.43.0