6.1.113-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainerPATCH 664/798 unicode: Dont special case ignorable code points
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriel Krisman Bertazi <[email protected]>
commit 5c26d2f1d3f5e4be3e196526bead29ecb139cf91 upstream.
We don't need to handle them separately. Instead, just let them decompose/casefold to themselves.
--- fs/unicode/mkutf8data.c | 70 fs/unicode/utf8data.c_shipped | 6703 ++++++++++++++++++++---------------------- 2 files changed, 3346 insertions(+), 3427 deletions(-)
fs/unicode/mkutf8data.c +0 -70
@@ -2230,75 +2230,6 @@ static void nfdicf_init(void)file_fail (fold_name); } -static void ignore_init (void ) -{ -FILE *file; -unsigned int unichar; -unsigned int first; -unsigned int last; -unsigned int *um; -int count; -int ret; - -if (verbose >0 ) -printf ("Parsing %s\n" , prop_name); - file =fopen (prop_name,"r" ); -if (!file) -open_fail (prop_name, errno); -assert (file); - count =0 ; -while (fgets (line,LINESIZE , file)) { - ret =sscanf (line,"%X..%X ; %s # " , &first, &last, buf0); -if (ret ==3 ) { -if (strcmp (buf0,"Default_Ignorable_Code_Point" )) -continue ; -if (!utf32valid (first) || !utf32valid (last)) -line_fail (prop_name, line); -for (unichar = first; unichar <= last; unichar++) { -free (unicode_data[unichar].utf32nfdi); - um =malloc (sizeof (unsigned int )); - *um =0 ; - unicode_data[unichar].utf32nfdi = um; -free (unicode_data[unichar].utf32nfdicf); - um =malloc (sizeof (unsigned int )); - *um =0 ; - unicode_data[unichar].utf32nfdicf = um; - count++; - } -if (verbose >1 ) -printf (" %X..%X Default_Ignorable_Code_Point\n" , - first, last); -continue ; - } - ret =sscanf (line,"%X ; %s # " , &unichar, buf0); -if (ret ==2 ) { -if (strcmp (buf0,"Default_Ignorable_Code_Point" )) -continue ; -if (!utf32valid (unichar)) -line_fail (prop_name, line); -free (unicode_data[unichar].utf32nfdi); - um =malloc (sizeof (unsigned int )); - *um =0 ; - unicode_data[unichar].utf32nfdi = um; -free (unicode_data[unichar].utf32nfdicf); - um =malloc (sizeof (unsigned int )); - *um =0 ; - unicode_data[unichar].utf32nfdicf = um; -if (verbose >1 ) -printf (" %X Default_Ignorable_Code_Point\n" , - unichar); - count++; -continue ; - } - } -fclose (file); - -if (verbose >0 ) -printf ("Found %d entries\n" , count); -if (count ==0 ) -file_fail (prop_name); -} -static void corrections_init (void ) {FILE *file;
@@ -3410,7 +3341,6 @@ int main(int argc, char *argv[])ccc_init ();nfdi_init ();nfdicf_init (); -ignore_init ();corrections_init ();hangul_decompose ();nfdi_decompose ();
fs/unicode/utf8data.c_shipped +3346 -3357
2,918 lines not on this page · raw message
The rest of this diff is not shown. View the raw message.
Part of the diff is not shown here. View the raw message.
Greg Kroah-Hartman
maintainerPATCH 665/798 net: ethernet: cortina: Drop TSO support
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
[ Upstream commit ac631873c9e7a50d2a8de457cfc4b9f86666403e ]
The recent change to allow large frames without hardware checksumming slotted in software checksumming in the driver if hardware could not do it.
This will however upset TSO (TCP Segment Offloading). Typical error dumps includes this:
skb len=2961 headroom=222 headlen=66 tailroom=0
(...)
WARNING: CPU: 0 PID: 956 at net/core/dev.c:3259 skb_warn_bad_offload+0x7c/0x108
gemini-ethernet-port: caps=(0x0000010000154813, 0x00002007ffdd7889)
And the packets do not go through.
The TSO implementation is bogus: a TSO enabled driver must propagate the skb_shinfo(skb)->gso_size value to the TSO engine on the NIC.
Drop the size check and TSO offloading features for now: this needs to be fixed up properly.
After this ethernet works fine on Gemini devices with a direct connected PHY such as D-Link DNS-313.
Also tested to still be working with a DSA switch using the Gemini ethernet as conduit interface.
--- drivers/net/ethernet/cortina/gemini.c | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-)
drivers/net/ethernet/cortina/gemini.c +2 -13
@@ -79,8 +79,7 @@ MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)");#define GMAC0_IRQ4_8 (GMAC0_MIB_INT_BIT | GMAC0_RX_OVERRUN_INT_BIT)#define GMAC_OFFLOAD_FEATURES (NETIF_F_SG | NETIF_F_IP_CSUM | \ - NETIF_F_IPV6_CSUM | NETIF_F_RXCSUM | \ - NETIF_F_TSO | NETIF_F_TSO_ECN | NETIF_F_TSO6) + NETIF_F_IPV6_CSUM | NETIF_F_RXCSUM)/** * struct gmac_queue_page - page buffer per-page info
@@ -1148,23 +1147,13 @@ static int gmac_map_tx_bufs(struct net_device *netdev, struct sk_buff *skb,struct gmac_txdesc *txd;skb_frag_t *skb_frag;dma_addr_t mapping; -unsigned short mtu;void *buffer;int ret; - mtu =ETH_HLEN ; - mtu += netdev->mtu; -if (skb->protocol ==htons (ETH_P_8021Q )) - mtu +=VLAN_HLEN ; - +/* TODO: implement proper TSO using MTU in word3 */ word1 = skb->len; word3 =SOF_BIT ; -if (word1 > mtu) { - word1 |=TSS_MTU_ENABLE_BIT ; - word3 |= mtu; - } -if (skb->len >=ETH_FRAME_LEN ) {/* Hardware offloaded checksumming isn't working on frames * bigger than 1514 bytes. A hypothesis about this is that the
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 666/798 tracing: Remove precision vsnprintf() check from print event
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
[ Upstream commit 5efd3e2aef91d2d812290dcb25b2058e6f3f532c ]
This reverts 60be76eeabb3d ("tracing: Add size check when printing trace_marker output"). The only reason the precision check was added was because of a bug that miscalculated the write size of the string into the ring buffer and it truncated it removing the terminating nul byte. On reading the trace it crashed the kernel. But this was due to the bug in the code that happened during development and should never happen in practice. If anything, the precision can hide bugs where the string in the ring buffer isn't nul terminated and it will not be checked.
--- kernel/trace/trace_output.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
kernel/trace/trace_output.c +2 -4
@@ -1445,12 +1445,11 @@ static enum print_line_t trace_print_print(struct trace_iterator *iter, {struct print_entry *field;struct trace_seq *s = &iter->seq; -int max = iter->ent_size - offsetof(struct print_entry , buf);trace_assign_type (field, iter->ent);seq_print_ip_sym (s, field->ip, flags); -trace_seq_printf (s,": %.*s" , max, field->buf); +trace_seq_printf (s,": %s" , field->buf);return trace_handle_return (s); }
@@ -1459,11 +1458,10 @@ static enum print_line_t trace_print_raw(struct trace_iterator *iter, int flags, struct trace_event *event) {struct print_entry *field; -int max = iter->ent_size - offsetof(struct print_entry , buf);trace_assign_type (field, iter->ent); -trace_seq_printf (&iter->seq,"# %lx %.*s" , field->ip, max, field->buf); +trace_seq_printf (&iter->seq,"# %lx %s" , field->ip, field->buf);return trace_handle_return (&iter->seq); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 667/798 ALSA: hda/realtek: cs35l41: Fix order and duplicates in quirks table
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Loïc Charroud <[email protected]>
[ Upstream commit 852d432a14dbcd34e15a3a3910c5c6869a6d1929 ]
Move entry {0x1043, 0x16a3, "ASUS UX3402VA"} following device ID order. Remove duplicate entry for device {0x1043, 0x1f62, "ASUS UX7602ZM"}.
--- sound/pci/hda/patch_realtek.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/pci/hda/patch_realtek.c +1 -2
@@ -9896,6 +9896,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x1662 ,"ASUS GV301QH" ,ALC294_FIXUP_ASUS_DUAL_SPK ),SND_PCI_QUIRK (0x1043 ,0x1663 ,"ASUS GU603ZV" ,ALC285_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1043 ,0x1683 ,"ASUS UM3402YAR" ,ALC287_FIXUP_CS35L41_I2C_2 ), +SND_PCI_QUIRK (0x1043 ,0x16a3 ,"ASUS UX3402VA" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x16b2 ,"ASUS GU603" ,ALC289_FIXUP_ASUS_GA401 ),SND_PCI_QUIRK (0x1043 ,0x16e3 ,"ASUS UX50" ,ALC269_FIXUP_STEREO_DMIC ), SND_PCI_QUIRK(0x1043, 0x1740, "ASUS UX430UA", ALC295_FIXUP_ASUS_DACS),
@@ -9926,8 +9927,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x1d4e ,"ASUS TM420" ,ALC256_FIXUP_ASUS_HPE ),SND_PCI_QUIRK (0x1043 ,0x1da2 ,"ASUS UP6502ZA/ZD" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x1e02 ,"ASUS UX3402ZA" ,ALC245_FIXUP_CS35L41_SPI_2 ), -SND_PCI_QUIRK (0x1043 ,0x16a3 ,"ASUS UX3402VA" ,ALC245_FIXUP_CS35L41_SPI_2 ), -SND_PCI_QUIRK (0x1043 ,0x1f62 ,"ASUS UX7602ZM" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x1e11 ,"ASUS Zephyrus G15" ,ALC289_FIXUP_ASUS_GA502 ),SND_PCI_QUIRK (0x1043 ,0x1e12 ,"ASUS UM6702RA/RC" ,ALC287_FIXUP_CS35L41_I2C_2 ), SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 668/798 ALSA: hda/realtek: cs35l41: Fix device ID / model name
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Loïc Charroud <[email protected]>
[ Upstream commit b91050448897663b60b6d15525c8c3ecae28a368 ]
The patch 51d976079976c800ef19ed1b542602fcf63f0edb ("ALSA: hda/realtek:
Add quirks for ASUS Zenbook 2022 Models") modified the entry 1043:1e2e from "ASUS UM3402" to "ASUS UM6702RA/RC" and added another entry for "ASUS UM3402" with 104e:1ee2.
The first entry was correct, while the new one corresponds to model "ASUS UM6702RA/RC"
Fix the model names for both devices.
--- sound/pci/hda/patch_realtek.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/patch_realtek.c +2 -2
@@ -9928,11 +9928,11 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x1da2 ,"ASUS UP6502ZA/ZD" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x1e02 ,"ASUS UX3402ZA" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x1e11 ,"ASUS Zephyrus G15" ,ALC289_FIXUP_ASUS_GA502 ), -SND_PCI_QUIRK (0x1043 ,0x1e12 ,"ASUS UM6702RA/RC" ,ALC287_FIXUP_CS35L41_I2C_2 ), +SND_PCI_QUIRK (0x1043 ,0x1e12 ,"ASUS UM3402" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x1043 ,0x1e51 ,"ASUS Zephyrus M15" ,ALC294_FIXUP_ASUS_GU502_PINS ),SND_PCI_QUIRK (0x1043 ,0x1e5e ,"ASUS ROG Strix G513" ,ALC294_FIXUP_ASUS_G513_PINS ),SND_PCI_QUIRK (0x1043 ,0x1e8e ,"ASUS Zephyrus G15" ,ALC289_FIXUP_ASUS_GA401 ), -SND_PCI_QUIRK (0x1043 ,0x1ee2 ,"ASUS UM3402" ,ALC287_FIXUP_CS35L41_I2C_2 ), +SND_PCI_QUIRK (0x1043 ,0x1ee2 ,"ASUS UM6702RA/RC" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x1043 ,0x1c52 ,"ASUS Zephyrus G15 2022" ,ALC289_FIXUP_ASUS_GA401 ),SND_PCI_QUIRK (0x1043 ,0x1f11 ,"ASUS Zephyrus G14" ,ALC289_FIXUP_ASUS_GA401 ), SND_PCI_QUIRK(0x1043, 0x1f12, "ASUS UM5302", ALC287_FIXUP_CS35L41_I2C_2),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 669/798 drm/crtc: fix uninitialized variable use even harder
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit b6802b61a9d0e99dcfa6fff7c50db7c48a9623d3 ]
DRM_MODESET_LOCK_ALL_BEGIN() has a hidden trap-door (aka retry loop), which means we can't rely too much on variable initializers.
--- drivers/gpu/drm/drm_crtc.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/drm_crtc.c +1 -0
@@ -904,6 +904,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, connector_set =NULL ; fb =NULL ; mode =NULL ; + num_connectors =0 ;DRM_MODESET_LOCK_ALL_END (dev, ctx, ret);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 670/798 tracing: Have saved_cmdlines arrays all in one allocation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
[ Upstream commit 0b18c852cc6fb8284ac0ab97e3e840974a6a8a64 ]
The saved_cmdlines have three arrays for mapping PIDs to COMMs:
- map_pid_to_cmdline[]
- map_cmdline_to_pid[]
- saved_cmdlines
The map_pid_to_cmdline[] is PID_MAX_DEFAULT in size and holds the index into the other arrays. The map_cmdline_to_pid[] is a mapping back to the full pid as it can be larger than PID_MAX_DEFAULT. And the saved_cmdlines[] just holds the COMMs associated to the pids.
Currently the map_pid_to_cmdline[] and saved_cmdlines[] are allocated together (in reality the saved_cmdlines is just in the memory of the rounding of the allocation of the structure as it is always allocated in powers of two). The map_cmdline_to_pid[] array is allocated separately.
Since the rounding to a power of two is rather large (it allows for 8000 elements in saved_cmdlines), also include the map_cmdline_to_pid[] array. (This drops it to 6000 by default, which is still plenty for most use cases). This saves even more memory as the map_cmdline_to_pid[] array doesn't need to be allocated.
--- kernel/trace/trace.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-)
kernel/trace/trace.c +8 -10
@@ -2254,6 +2254,10 @@ struct saved_cmdlines_buffer { };static struct saved_cmdlines_buffer *savedcmd; +/* Holds the size of a cmdline and pid element */ +#define SAVED_CMDLINE_MAP_ELEMENT_SIZE (s) \ + (TASK_COMM_LEN + sizeof((s)->map_cmdline_to_pid[0])) +static inline char *get_saved_cmdlines (int idx) {return &savedcmd->saved_cmdlines[idx *TASK_COMM_LEN ];
@@ -2268,7 +2272,6 @@ static void free_saved_cmdlines_buffer(struct saved_cmdlines_buffer *s) {int order =get_order (sizeof (*s) + s->cmdline_num *TASK_COMM_LEN ); -kfree (s->map_cmdline_to_pid);kmemleak_free (s);free_pages ((unsigned long )s, order); }
@@ -2281,7 +2284,7 @@ static struct saved_cmdlines_buffer *allocate_cmdlines_buffer(unsigned int val)int order;/* Figure out how much is needed to hold the given number of cmdlines */ - orig_size =sizeof (*s) + val *TASK_COMM_LEN ; + orig_size =sizeof (*s) + val *SAVED_CMDLINE_MAP_ELEMENT_SIZE (s); order =get_order (orig_size); size =1 << (order +PAGE_SHIFT ); page =alloc_pages (GFP_KERNEL , order);
@@ -2293,16 +2296,11 @@ static struct saved_cmdlines_buffer *allocate_cmdlines_buffer(unsigned int val)memset (s,0 ,sizeof (*s));/* Round up to actual allocation */ - val = (size -sizeof (*s)) /TASK_COMM_LEN ; + val = (size -sizeof (*s)) /SAVED_CMDLINE_MAP_ELEMENT_SIZE (s); s->cmdline_num = val; - s->map_cmdline_to_pid =kmalloc_array (val, -sizeof (*s->map_cmdline_to_pid), -GFP_KERNEL ); -if (!s->map_cmdline_to_pid) { -free_saved_cmdlines_buffer (s); -return NULL ; - } +/* Place map_cmdline_to_pid array right after saved_cmdlines */ + s->map_cmdline_to_pid = (unsigned *)&s->saved_cmdlines[val *TASK_COMM_LEN ]; s->cmdline_idx =0 ; memset(&s->map_pid_to_cmdline, NO_CMDLINE_MAP,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 671/798 bootconfig: Fix the kerneldoc of _xbc_exit()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit 298b871cd55a607037ac8af0011b9fdeb54c1e65 ]
Fix the kerneldoc of _xbc_exit() which is updated to have an @early argument and the function name is changed.
--- lib/bootconfig.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
lib/bootconfig.c +2 -1
@@ -901,7 +901,8 @@ static int __init xbc_parse_tree(void) }/** -* xbc_exit() - Clean up all parsed bootconfig +* _xbc_exit() - Clean up all parsed bootconfig +* @early: Set true if this is called before budy system is initialized. * * This clears all data structures of parsed bootconfig on memory. * If you need to reuse xbc_init() with new boot config, you can
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 672/798 perf lock: Dynamically allocate lockhash_table
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit eef4fee5e52071d563d9a851df1c09869215ee15 ]
lockhash_table is 32,768 bytes in .bss, make it a memory allocation so that the space is freed for non-lock perf commands.
Stable-dep-of: 1a5efc9e13f3 ("libsubcmd: Don't free the usage string")
--- tools/perf/builtin-lock.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
tools/perf/builtin-lock.c +16 -4
@@ -45,7 +45,7 @@ static struct target target;#define LOCKHASH_BITS 12#define LOCKHASH_SIZE (1UL << LOCKHASH_BITS) -static struct hlist_head lockhash_table[LOCKHASH_SIZE ]; +static struct hlist_head *lockhash_table;#define __lockhashfn (key) hash_long((unsigned long)key, LOCKHASH_BITS)#define lockhashentry (key) (lockhash_table + __lockhashfn((key)))
@@ -1645,16 +1645,22 @@ static int __cmd_contention(int argc, const char **argv) };struct lock_contention con = { .target = &target, - .result = &lockhash_table[0 ], .map_nr_entries = bpf_map_entries, .max_stack = max_stack_depth, .stack_skip = stack_skip, }; + lockhash_table =calloc (LOCKHASH_SIZE ,sizeof (*lockhash_table)); +if (!lockhash_table) +return -ENOMEM ; + + con.result = &lockhash_table[0 ]; + session =perf_session__new (use_bpf ?NULL : &data, &eops);if (IS_ERR (session)) {pr_err ("Initializing perf session failed\n" ); -return PTR_ERR (session); + err =PTR_ERR (session); + goto out_delete; } con.machine = &session->machines.host;
@@ -1755,6 +1761,7 @@ static int __cmd_contention(int argc, const char **argv)evlist__delete (con.evlist);lock_contention_finish ();perf_session__delete (session); +zfree (&lockhash_table);return err; }
@@ -1946,6 +1953,10 @@ int cmd_lock(int argc, const char **argv)unsigned int i;int rc =0 ; + lockhash_table =calloc (LOCKHASH_SIZE ,sizeof (*lockhash_table)); +if (!lockhash_table) +return -ENOMEM ; +for (i =0 ; i <LOCKHASH_SIZE ; i++)INIT_HLIST_HEAD (lockhash_table + i);
@@ -1967,7 +1978,7 @@ int cmd_lock(int argc, const char **argv) rc =__cmd_report (false); }else if (!strcmp (argv[0 ],"script" )) {/* Aliased to 'perf script' */ -return cmd_script (argc, argv); + rc =cmd_script (argc, argv); }else if (!strcmp (argv[0 ],"info" )) {if (argc) { argc = parse_options(argc, argv,
@@ -1996,5 +2007,6 @@ int cmd_lock(int argc, const char **argv)usage_with_options (lock_usage, lock_options); } +zfree (&lockhash_table);return rc; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 673/798 perf sched: Avoid large stack allocations
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 232418a0b2e8b8e72dac003b19352f1b647cdb31 ]
Commit 5ded57ac1bdb ("perf inject: Remove static variables") moved static variables to local, however, in this case 3 MAX_CPUS (4096) sized arrays were moved onto the stack making the stack frame quite large. Avoid the stack usage by dynamically allocating the arrays.
Stable-dep-of: 1a5efc9e13f3 ("libsubcmd: Don't free the usage string")
--- tools/perf/builtin-sched.c | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-)
tools/perf/builtin-sched.c +22 -4
@@ -193,8 +193,8 @@ struct perf_sched {* weird events, such as a task being switched away that is not current. */ struct perf_cpu max_cpu; -u32 curr_pid[MAX_CPUS ]; -struct thread *curr_thread[MAX_CPUS ]; +u32 *curr_pid; +struct thread **curr_thread;char next_shortname1;char next_shortname2;unsigned int replay_repeat;
@@ -224,7 +224,7 @@ struct perf_sched {u64 run_avg;u64 all_runtime;u64 all_count; -u64 cpu_last_switched[MAX_CPUS ]; +u64 *cpu_last_switched;struct rb_root_cached atom_root, sorted_atom_root, merged_atom_root;struct list_head sort_list, cmp_pid;bool force;
@@ -3590,7 +3590,22 @@ int cmd_sched(int argc, const char **argv)mutex_init (&sched.start_work_mutex);mutex_init (&sched.work_done_wait_mutex); -for (i =0 ; i <ARRAY_SIZE (sched.curr_pid); i++) + sched.curr_thread =calloc (MAX_CPUS ,sizeof (*sched.curr_thread)); +if (!sched.curr_thread) { + ret = -ENOMEM ; + goto out; + } + sched.cpu_last_switched =calloc (MAX_CPUS ,sizeof (*sched.cpu_last_switched)); +if (!sched.cpu_last_switched) { + ret = -ENOMEM ; + goto out; + } + sched.curr_pid =malloc (MAX_CPUS *sizeof (*sched.curr_pid)); +if (!sched.curr_pid) { + ret = -ENOMEM ; + goto out; + } +for (i =0 ; i <MAX_CPUS ; i++) sched.curr_pid[i] =-1 ; argc = parse_options_subcommand(argc, argv, sched_options, sched_subcommands,
@@ -3659,6 +3674,9 @@ int cmd_sched(int argc, const char **argv) } out: +free (sched.curr_pid); +free (sched.cpu_last_switched); +free (sched.curr_thread);mutex_destroy (&sched.start_work_mutex);mutex_destroy (&sched.work_done_wait_mutex);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 674/798 perf sched: Move start_work_mutex and work_done_wait_mutex initialization to perf_sched__replay()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Jihong <[email protected]>
[ Upstream commit c6907863519cf97ee09653cc8ec338a2328c2b6f ]
The start_work_mutex and work_done_wait_mutex are used only for the 'perf sched replay'. Put their initialization in perf_sched__replay () to reduce unnecessary actions in other commands.
Simple functional testing:
# perf sched record perf bench sched messaging # Running 'sched/messaging' benchmark: # 20 sender and receiver processes per group # 10 groups == 400 processes run
Total time: 0.197 [sec]
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 14.952 MB perf.data (134165 samples) ]
# perf sched replay run measurement overhead: 108 nsecs sleep measurement overhead: 65658 nsecs the run test took 999991 nsecs the sleep test took 1079324 nsecs nr_run_events: 42378 nr_sleep_events: 43102 nr_wakeup_events: 31852 target-less wakeups: 17 multi-target wakeups: 712 task 0 ( swapper: 0), nr_events: 10451 task 1 ( swapper: 1), nr_events: 3 task 2 ( swapper: 2), nr_events: 1 <SNIP> task 717 ( sched-messaging: 74483), nr_events: 152 task 718 ( sched-messaging: 74484), nr_events: 1944 task 719 ( sched-messaging: 74485), nr_events: 73 task 720 ( sched-messaging: 74486), nr_events: 163 task 721 ( sched-messaging: 74487), nr_events: 942 task 722 ( sched-messaging: 74488), nr_events: 78 task 723 ( sched-messaging: 74489), nr_events: 1090 ------------------------------------------------------------ #1 : 1366.507, ravg: 1366.51, cpu: 7682.70 / 7682.70 #2 : 1410.072, ravg: 1370.86, cpu: 7723.88 / 7686.82 #3 : 1396.296, ravg: 1373.41, cpu: 7568.20 / 7674.96 #4 : 1381.019, ravg: 1374.17, cpu: 7531.81 / 7660.64 #5 : 1393.826, ravg: 1376.13, cpu: 7725.25 / 7667.11 #6 : 1401.581, ravg: 1378.68, cpu: 7594.82 / 7659.88 #7 : 1381.337, ravg: 1378.94, cpu: 7371.22 / 7631.01 #8 : 1373.842, ravg: 1378.43, cpu: 7894.92 / 7657.40 #9 : 1364.697, ravg: 1377.06, cpu: 7324.91 / 7624.15 #10 : 1363.613, ravg: 1375.72, cpu: 7209.55 / 7582.69 # echo $? 0
Stable-dep-of: 1a5efc9e13f3 ("libsubcmd: Don't free the usage string")
--- tools/perf/builtin-sched.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
tools/perf/builtin-sched.c +12 -7
@@ -3317,15 +3317,20 @@ static int perf_sched__map(struct perf_sched *sched)static int perf_sched__replay (struct perf_sched *sched) { +int ret;unsigned long i; +mutex_init (&sched->start_work_mutex); +mutex_init (&sched->work_done_wait_mutex); +calibrate_run_measurement_overhead (sched);calibrate_sleep_measurement_overhead (sched);test_calibrations (sched); -if (perf_sched__read_events (sched)) -return -1 ; + ret =perf_sched__read_events (sched); +if (ret) + goto out_mutex_destroy;printf ("nr_run_events: %ld\n" , sched->nr_run_events);printf ("nr_sleep_events: %ld\n" , sched->nr_sleep_events);
@@ -3350,7 +3355,11 @@ static int perf_sched__replay(struct perf_sched *sched) sched->thread_funcs_exit = true;destroy_tasks (sched); -return 0 ; + +out_mutex_destroy: +mutex_destroy (&sched->start_work_mutex); +mutex_destroy (&sched->work_done_wait_mutex); +return ret; } static void setup_sorting(struct perf_sched *sched, const struct option *options,
@@ -3588,8 +3597,6 @@ int cmd_sched(int argc, const char **argv)unsigned int i;int ret =0 ; -mutex_init (&sched.start_work_mutex); -mutex_init (&sched.work_done_wait_mutex); sched.curr_thread =calloc (MAX_CPUS ,sizeof (*sched.curr_thread));if (!sched.curr_thread) { ret = -ENOMEM ;
@@ -3677,8 +3684,6 @@ int cmd_sched(int argc, const char **argv)free (sched.curr_pid);free (sched.cpu_last_switched);free (sched.curr_thread); -mutex_destroy (&sched.start_work_mutex); -mutex_destroy (&sched.work_done_wait_mutex);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 675/798 perf sched: Fix memory leak in perf_sched__map()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Jihong <[email protected]>
[ Upstream commit ef76a5af819743d405674f6de5d0e63320ac653e ]
perf_sched__map() needs to free memory of map_cpus, color_pids and color_cpus in normal path and rollback allocated memory in error path.
Stable-dep-of: 1a5efc9e13f3 ("libsubcmd: Don't free the usage string")
--- tools/perf/builtin-sched.c | 41 ++++++++++++++++++++++++-------------- 1 file changed, 26 insertions(+), 15 deletions(-)
tools/perf/builtin-sched.c +26 -15
@@ -3240,8 +3240,6 @@ static int perf_sched__lat(struct perf_sched *sched)static int setup_map_cpus (struct perf_sched *sched) { -struct perf_cpu_map *map; - sched->max_cpu.cpu =sysconf (_SC_NPROCESSORS_CONF);if (sched->map.comp) {
@@ -3250,16 +3248,15 @@ static int setup_map_cpus(struct perf_sched *sched)return -1 ; } -if (!sched->map.cpus_str) -return 0 ; - - map =perf_cpu_map__new (sched->map.cpus_str); -if (!map) { -pr_err ("failed to get cpus map from %s\n" , sched->map.cpus_str); -return -1 ; +if (sched->map.cpus_str) { + sched->map.cpus =perf_cpu_map__new (sched->map.cpus_str); +if (!sched->map.cpus) { +pr_err ("failed to get cpus map from %s\n" , sched->map.cpus_str); +zfree (&sched->map.comp_cpus); +return -1 ; + } } - sched->map.cpus = map;return 0 ; }
@@ -3299,20 +3296,34 @@ static int setup_color_cpus(struct perf_sched *sched)static int perf_sched__map (struct perf_sched *sched) { +int rc =-1 ; +if (setup_map_cpus (sched)) -return -1 ; +return rc;if (setup_color_pids (sched)) -return -1 ; + goto out_put_map_cpus;if (setup_color_cpus (sched)) -return -1 ; + goto out_put_color_pids;setup_pager ();if (perf_sched__read_events (sched)) -return -1 ; + goto out_put_color_cpus; + + rc =0 ;print_bad_events (sched); -return 0 ; + +out_put_color_cpus: +perf_cpu_map__put (sched->map.color_cpus); + +out_put_color_pids: +perf_thread_map__put (sched->map.color_pids); + +out_put_map_cpus: +zfree (&sched->map.comp_cpus); +perf_cpu_map__put (sched->map.cpus); +return rc; }static int perf_sched__replay (struct perf_sched *sched)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 676/798 perf sched: Move curr_thread initialization to perf_sched__map()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Jihong <[email protected]>
[ Upstream commit 5e895278697c014e95ae7ae5e79a72ef68c5184e ]
The curr_thread is used only for the 'perf sched map'. Put initialization in perf_sched__map() to reduce unnecessary actions in other commands.
Simple functional testing:
# perf sched record perf bench sched messaging # Running 'sched/messaging' benchmark: # 20 sender and receiver processes per group # 10 groups == 400 processes run
Total time: 0.197 [sec]
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 15.526 MB perf.data (140095 samples) ]
# perf sched map
*A0 451264.532445 secs A0 => migration/0:15
*. 451264.532468 secs . => swapper:0
. *B0 451264.532537 secs B0 => migration/1:21
. *. 451264.532560 secs
. . *C0 451264.532644 secs C0 => migration/2:27
. . *. 451264.532668 secs
. . . *D0 451264.532753 secs D0 => migration/3:33
. . . *. 451264.532778 secs
. . . . *E0 451264.532861 secs E0 => migration/4:39
. . . . *. 451264.532886 secs
. . . . . *F0 451264.532973 secs F0 => migration/5:45
<SNIP>
A7 A7 A7 A7 A7 *A7 . . . . . . . . . . 451264.790785 secs
A7 A7 A7 A7 A7 A7 *A7 . . . . . . . . . 451264.790858 secs
A7 A7 A7 A7 A7 A7 A7 *A7 . . . . . . . . 451264.790934 secs
A7 A7 A7 A7 A7 A7 A7 A7 *A7 . . . . . . . 451264.791004 secs
A7 A7 A7 A7 A7 A7 A7 A7 A7 *A7 . . . . . . 451264.791075 secs
A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 *A7 . . . . . 451264.791143 secs
A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 *A7 . . . . 451264.791232 secs
A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 *A7 . . . 451264.791336 secs
A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 *A7 . . 451264.791407 secs
A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 *A7 . 451264.791484 secs
A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 *A7 451264.791553 secs
# echo $?
0Stable-dep-of: 1a5efc9e13f3 ("libsubcmd: Don't free the usage string")
--- tools/perf/builtin-sched.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
tools/perf/builtin-sched.c +8 -7
@@ -3298,9 +3298,13 @@ static int perf_sched__map(struct perf_sched *sched) {int rc =-1 ; -if (setup_map_cpus (sched)) + sched->curr_thread =calloc (MAX_CPUS ,sizeof (*(sched->curr_thread))); +if (!sched->curr_thread)return rc; +if (setup_map_cpus (sched)) + goto out_free_curr_thread; +if (setup_color_pids (sched)) goto out_put_map_cpus;
@@ -3323,6 +3327,9 @@ static int perf_sched__map(struct perf_sched *sched) out_put_map_cpus:zfree (&sched->map.comp_cpus);perf_cpu_map__put (sched->map.cpus); + +out_free_curr_thread: +zfree (&sched->curr_thread);return rc; }
@@ -3608,11 +3615,6 @@ int cmd_sched(int argc, const char **argv)unsigned int i;int ret =0 ; - sched.curr_thread =calloc (MAX_CPUS ,sizeof (*sched.curr_thread)); -if (!sched.curr_thread) { - ret = -ENOMEM ; - goto out; - } sched.cpu_last_switched =calloc (MAX_CPUS ,sizeof (*sched.cpu_last_switched));if (!sched.cpu_last_switched) { ret = -ENOMEM ;
@@ -3694,7 +3696,6 @@ int cmd_sched(int argc, const char **argv) out:free (sched.curr_pid);free (sched.cpu_last_switched); -free (sched.curr_thread);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 677/798 perf sched: Move curr_pid and cpu_last_switched initialization to perf_sched__{lat|map|replay}()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Jihong <[email protected]>
[ Upstream commit bd2cdf26b9ea000339d54adc82e87fdbf22c21c3 ]
The curr_pid and cpu_last_switched are used only for the 'perf sched replay/latency/map'. Put their initialization in perf_sched__{lat|map|replay () to reduce unnecessary actions in other commands.
Simple functional testing:
# perf sched record perf bench sched messaging # Running 'sched/messaging' benchmark: # 20 sender and receiver processes per group # 10 groups == 400 processes run
Total time: 0.209 [sec]
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 16.456 MB perf.data (147907 samples) ]
# perf sched lat
-------------------------------------------------------------------------------------------------------------------------------------------
Task | Runtime ms | Switches | Avg delay ms | Max delay ms | Max delay start | Max delay end |
-------------------------------------------------------------------------------------------------------------------------------------------
sched-messaging:(401) | 2990.699 ms | 38705 | avg: 0.661 ms | max: 67.046 ms | max start: 456532.624830 s | max end: 456532.691876 s
qemu-system-x86:(7) | 179.764 ms | 2191 | avg: 0.152 ms | max: 21.857 ms | max start: 456532.576434 s | max end: 456532.598291 s
sshd:48125 | 0.522 ms | 2 | avg: 0.037 ms | max: 0.046 ms | max start: 456532.514610 s | max end: 456532.514656 s
<SNIP>
ksoftirqd/11:82 | 0.063 ms | 1 | avg: 0.005 ms | max: 0.005 ms | max start: 456532.769366 s | max end: 456532.769371 s
kworker/9:0-mm_:34624 | 0.233 ms | 20 | avg: 0.004 ms | max: 0.007 ms | max start: 456532.690804 s | max end: 456532.690812 s
migration/13:93 | 0.000 ms | 1 | avg: 0.004 ms | max: 0.004 ms | max start: 456532.512669 s | max end: 456532.512674 s
-----------------------------------------------------------------------------------------------------------------
TOTAL: | 3180.750 ms | 41368 |---------------------------------------------------
# echo $? 0
# perf sched map
*A0 456532.510141 secs A0 => migration/0:15
*. 456532.510171 secs . => swapper:0
. *B0 456532.510261 secs B0 => migration/1:21
. *. 456532.510279 secs
<SNIP>
L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 *L7 . . . . 456532.785979 secs
L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 *L7 . . . 456532.786054 secs
L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 *L7 . . 456532.786127 secs
L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 *L7 . 456532.786197 secs
L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 *L7 456532.786270 secs
# echo $?
0# perf sched replay run measurement overhead: 108 nsecs sleep measurement overhead: 66473 nsecs the run test took 1000002 nsecs the sleep test took 1082686 nsecs nr_run_events: 49334 nr_sleep_events: 50054 nr_wakeup_events: 34701 target-less wakeups: 165 multi-target wakeups: 766 task 0 ( swapper: 0), nr_events: 15419 task 1 ( swapper: 1), nr_events: 1 task 2 ( swapper: 2), nr_events: 1 <SNIP> task 715 ( sched-messaging: 110248), nr_events: 1438 task 716 ( sched-messaging: 110249), nr_events: 512 task 717 ( sched-messaging: 110250), nr_events: 500 task 718 ( sched-messaging: 110251), nr_events: 537 task 719 ( sched-messaging: 110252), nr_events: 823 ------------------------------------------------------------ #1 : 1325.288, ravg: 1325.29, cpu: 7823.35 / 7823.35 #2 : 1363.606, ravg: 1329.12, cpu: 7655.53 / 7806.56 #3 : 1349.494, ravg: 1331.16, cpu: 7544.80 / 7780.39 #4 : 1311.488, ravg: 1329.19, cpu: 7495.13 / 7751.86 #5 : 1309.902, ravg: 1327.26, cpu: 7266.65 / 7703.34 #6 : 1309.535, ravg: 1325.49, cpu: 7843.86 / 7717.39 #7 : 1316.482, ravg: 1324.59, cpu: 7854.41 / 7731.09 #8 : 1366.604, ravg: 1328.79, cpu: 7955.81 / 7753.57 #9 : 1326.286, ravg: 1328.54, cpu: 7466.86 / 7724.90 #10 : 1356.653, ravg: 1331.35, cpu: 7566.60 / 7709.07 # echo $? 0
Stable-dep-of: 1a5efc9e13f3 ("libsubcmd: Don't free the usage string")
--- tools/perf/builtin-sched.c | 94 +++++++++++++++++++++++++------------- 1 file changed, 61 insertions(+), 33 deletions(-)
tools/perf/builtin-sched.c +61 -33
@@ -3199,14 +3199,44 @@ static void perf_sched__merge_lat(struct perf_sched *sched) } } +static int setup_cpus_switch_event (struct perf_sched *sched) +{ +unsigned int i; + + sched->cpu_last_switched =calloc (MAX_CPUS ,sizeof (*(sched->cpu_last_switched))); +if (!sched->cpu_last_switched) +return -1 ; + + sched->curr_pid =malloc (MAX_CPUS *sizeof (*(sched->curr_pid))); +if (!sched->curr_pid) { +zfree (&sched->cpu_last_switched); +return -1 ; + } + +for (i =0 ; i <MAX_CPUS ; i++) + sched->curr_pid[i] =-1 ; + +return 0 ; +} + +static void free_cpus_switch_event (struct perf_sched *sched) +{ +zfree (&sched->curr_pid); +zfree (&sched->cpu_last_switched); +} +static int perf_sched__lat (struct perf_sched *sched) { +int rc =-1 ;struct rb_node *next;setup_pager (); +if (setup_cpus_switch_event (sched)) +return rc; +if (perf_sched__read_events (sched)) -return -1 ; + goto out_free_cpus_switch_event;perf_sched__merge_lat (sched);perf_sched__sort_lat (sched);
@@ -3235,7 +3265,11 @@ static int perf_sched__lat(struct perf_sched *sched)print_bad_events (sched);printf ("\n" ); -return 0 ; + rc =0 ; + +out_free_cpus_switch_event: +free_cpus_switch_event (sched); +return rc; }static int setup_map_cpus (struct perf_sched *sched)
@@ -3302,9 +3336,12 @@ static int perf_sched__map(struct perf_sched *sched)if (!sched->curr_thread)return rc; -if (setup_map_cpus (sched)) +if (setup_cpus_switch_event (sched)) goto out_free_curr_thread; +if (setup_map_cpus (sched)) + goto out_free_cpus_switch_event; +if (setup_color_pids (sched)) goto out_put_map_cpus;
@@ -3328,6 +3365,9 @@ static int perf_sched__map(struct perf_sched *sched)zfree (&sched->map.comp_cpus);perf_cpu_map__put (sched->map.cpus); +out_free_cpus_switch_event: +free_cpus_switch_event (sched); + out_free_curr_thread:zfree (&sched->curr_thread);return rc;
@@ -3341,6 +3381,10 @@ static int perf_sched__replay(struct perf_sched *sched)mutex_init (&sched->start_work_mutex);mutex_init (&sched->work_done_wait_mutex); + ret =setup_cpus_switch_event (sched); +if (ret) + goto out_mutex_destroy; +calibrate_run_measurement_overhead (sched);calibrate_sleep_measurement_overhead (sched);
@@ -3348,7 +3392,7 @@ static int perf_sched__replay(struct perf_sched *sched) ret =perf_sched__read_events (sched);if (ret) - goto out_mutex_destroy; + goto out_free_cpus_switch_event;printf ("nr_run_events: %ld\n" , sched->nr_run_events);printf ("nr_sleep_events: %ld\n" , sched->nr_sleep_events);
@@ -3374,6 +3418,9 @@ static int perf_sched__replay(struct perf_sched *sched) sched->thread_funcs_exit = true;destroy_tasks (sched); +out_free_cpus_switch_event: +free_cpus_switch_event (sched); + out_mutex_destroy:mutex_destroy (&sched->start_work_mutex);mutex_destroy (&sched->work_done_wait_mutex);
@@ -3612,21 +3659,7 @@ int cmd_sched(int argc, const char **argv) .switch_event = replay_switch_event, .fork_event = replay_fork_event, }; -unsigned int i; -int ret =0 ; - - sched.cpu_last_switched =calloc (MAX_CPUS ,sizeof (*sched.cpu_last_switched)); -if (!sched.cpu_last_switched) { - ret = -ENOMEM ; - goto out; - } - sched.curr_pid =malloc (MAX_CPUS *sizeof (*sched.curr_pid)); -if (!sched.curr_pid) { - ret = -ENOMEM ; - goto out; - } -for (i =0 ; i <MAX_CPUS ; i++) - sched.curr_pid[i] =-1 ; +int ret; argc =parse_options_subcommand (argc, argv, sched_options, sched_subcommands, sched_usage,PARSE_OPT_STOP_AT_NON_OPTION );
@@ -3637,9 +3670,9 @@ int cmd_sched(int argc, const char **argv)* Aliased to 'perf script' for now: */ if (!strcmp (argv[0 ],"script" )) { - ret =cmd_script (argc, argv); +return cmd_script (argc, argv); }else if (strlen (argv[0 ]) >2 &&strstarts ("record" , argv[0 ])) { - ret =__cmd_record (argc, argv); +return __cmd_record (argc, argv); }else if (strlen (argv[0 ]) >2 &&strstarts ("latency" , argv[0 ])) { sched.tp_handler = &lat_ops;if (argc >1 ) {
@@ -3648,7 +3681,7 @@ int cmd_sched(int argc, const char **argv)usage_with_options (latency_usage, latency_options); }setup_sorting (&sched, latency_options, latency_usage); - ret =perf_sched__lat (&sched); +return perf_sched__lat (&sched); }else if (!strcmp (argv[0 ],"map" )) {if (argc) { argc =parse_options (argc, argv, map_options, map_usage,0 );
@@ -3657,7 +3690,7 @@ int cmd_sched(int argc, const char **argv) } sched.tp_handler = &map_ops;setup_sorting (&sched, latency_options, latency_usage); - ret =perf_sched__map (&sched); +return perf_sched__map (&sched); }else if (strlen (argv[0 ]) >2 &&strstarts ("replay" , argv[0 ])) { sched.tp_handler = &replay_ops;if (argc) {
@@ -3665,7 +3698,7 @@ int cmd_sched(int argc, const char **argv)if (argc)usage_with_options (replay_usage, replay_options); } - ret =perf_sched__replay (&sched); +return perf_sched__replay (&sched); }else if (!strcmp (argv[0 ],"timehist" )) {if (argc) { argc = parse_options(argc, argv, timehist_options,
@@ -3681,21 +3714,16 @@ int cmd_sched(int argc, const char **argv)parse_options_usage (NULL , timehist_options,"w" , true);if (sched.show_next)parse_options_usage (NULL , timehist_options,"n" , true); - ret = -EINVAL ; - goto out; +return -EINVAL ; } ret =symbol__validate_sym_arguments ();if (ret) - goto out; +return ret; - ret =perf_sched__timehist (&sched); +return perf_sched__timehist (&sched); }else {usage_with_options (sched_usage, sched_options); } -out: -free (sched.curr_pid); -free (sched.cpu_last_switched); - -return ret; +return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 678/798 libsubcmd: Dont free the usage string
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Gupta <[email protected]>
[ Upstream commit 1a5efc9e13f357abc396dbf445b25d08914c8060 ]
Currently, commands which depend on 'parse_options_subcommand()' don't show the usage string, and instead show '(null)'
$ ./perf sched Usage: (null)
-D, --dump-raw-trace dump raw trace in ASCII
-f, --force don't complain, do it
-i, --input <file> input file name
-v, --verbose be more verbose (show symbol address, etc)'parse_options_subcommand()' is generally expected to initialise the usage string, with information in the passed 'subcommands[]' array
This behaviour was changed in:
230a7a71f92212e7 ("libsubcmd: Fix parse-options memory leak")
Where the generated usage string is deallocated, and usage[0] string is reassigned as NULL.
As discussed in [1], free the allocated usage string in the main function itself, and don't reset usage string to NULL in parse_options_subcommand
With this change, the behaviour is restored.
$ ./perf sched
Usage: perf sched [<options>] {record|latency|map|replay|script|timehist} -D, --dump-raw-trace dump raw trace in ASCII
-f, --force don't complain, do it
-i, --input <file> input file name
-v, --verbose be more verbose (show symbol address, etc)--- tools/lib/subcmd/parse-options.c | 8 +++----- tools/perf/builtin-kmem.c | 2 ++ tools/perf/builtin-kvm.c | 3 +++ tools/perf/builtin-kwork.c | 3 +++ tools/perf/builtin-lock.c | 3 +++ tools/perf/builtin-mem.c | 3 +++ tools/perf/builtin-sched.c | 3 +++ 7 files changed, 20 insertions(+), 5 deletions(-)
tools/lib/subcmd/parse-options.c +3 -5
@@ -633,10 +633,11 @@ int parse_options_subcommand(int argc, const char **argv, const struct option *o const char *const subcommands[], const char *usagestr[], int flags) { struct parse_opt_ctx_t ctx; -char *buf =NULL ;/* build usage string if it's not provided */ if (subcommands && !usagestr[0 ]) { +char *buf =NULL ; +astrcatf (&buf,"%s %s [<options>] {" , subcmd_config.exec_name, argv[0 ]);for (int i =0 ; subcommands[i]; i++) {
@@ -678,10 +679,7 @@ int parse_options_subcommand(int argc, const char **argv, const struct option *oastrcatf (&error_buf,"unknown switch `%c'" , *ctx.opt);usage_with_options (usagestr, options); } -if (buf) { - usagestr[0 ] =NULL ; -free (buf); - } +return parse_options_end (&ctx); }
tools/perf/builtin-kmem.c +2 -0
@@ -2048,6 +2048,8 @@ int cmd_kmem(int argc, const char **argv) out_delete:perf_session__delete (session); +/* free usage string allocated by parse_options_subcommand */ +free ((void *)kmem_usage[0 ]);return ret; }
tools/perf/builtin-kvm.c +3 -0
@@ -1651,5 +1651,8 @@ int cmd_kvm(int argc, const char **argv)else usage_with_options (kvm_usage, kvm_options); +/* free usage string allocated by parse_options_subcommand */ +free ((void *)kvm_usage[0 ]); +return 0 ; }
tools/perf/builtin-kwork.c +3 -0
@@ -1831,5 +1831,8 @@ int cmd_kwork(int argc, const char **argv) }else usage_with_options (kwork_usage, kwork_options); +/* free usage string allocated by parse_options_subcommand */ +free ((void *)kwork_usage[0 ]); +return 0 ; }
tools/perf/builtin-lock.c +3 -0
@@ -2007,6 +2007,9 @@ int cmd_lock(int argc, const char **argv)usage_with_options (lock_usage, lock_options); } +/* free usage string allocated by parse_options_subcommand */ +free ((void *)lock_usage[0 ]); +zfree (&lockhash_table);return rc; }
tools/perf/builtin-mem.c +3 -0
@@ -514,5 +514,8 @@ int cmd_mem(int argc, const char **argv)else usage_with_options (mem_usage, mem_options); +/* free usage string allocated by parse_options_subcommand */ +free ((void *)mem_usage[0 ]); +return 0 ; }
tools/perf/builtin-sched.c +3 -0
@@ -3725,5 +3725,8 @@ int cmd_sched(int argc, const char **argv)usage_with_options (sched_usage, sched_options); } +/* free usage string allocated by parse_options_subcommand */ +free ((void *)sched_usage[0 ]); +return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 679/798 selftests: net: Remove executable bits from library scripts
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Poirier <[email protected]>
[ Upstream commit 9d851dd4dab63e95c1911a2fa847796d1ec5d58d ]
setup_loopback.sh and net_helper.sh are meant to be sourced from other scripts, not executed directly. Therefore, remove the executable bits from those files' permissions.
This change is similar to commit 49078c1b80b6 ("selftests: forwarding:
Remove executable bits from lib.sh")
--- tools/testing/selftests/net/net_helper.sh | 0 tools/testing/selftests/net/setup_loopback.sh | 0 2 files changed, 0 insertions(+), 0 deletions(-) mode change 100755 => 100644 tools/testing/selftests/net/net_helper.sh mode change 100755 => 100644 tools/testing/selftests/net/setup_loopback.sh
tools/testing/selftests/net/net_helper.sh +0 -0
tools/testing/selftests/net/setup_loopback.sh +0 -0
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 680/798 Bluetooth: Fix usage of __hci_cmd_sync_status
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 87be7b189b2c50d4b51512f59e4e97db4eedee8a ]
__hci_cmd_sync_status shall only be used if hci_req_sync_lock is _not_ required which is not the case of hci_dev_cmd so it needs to use hci_cmd_sync_status which uses hci_req_sync_lock internally.
--- net/bluetooth/hci_core.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-)
net/bluetooth/hci_core.c +12 -15
@@ -721,8 +721,8 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg)switch (cmd) {case HCISETAUTH : - err =__hci_cmd_sync_status (hdev,HCI_OP_WRITE_AUTH_ENABLE , -1 , &dr.dev_opt,HCI_CMD_TIMEOUT ); + err =hci_cmd_sync_status (hdev,HCI_OP_WRITE_AUTH_ENABLE , +1 , &dr.dev_opt,HCI_CMD_TIMEOUT );break ;case HCISETENCRYPT :
@@ -733,23 +733,21 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg)if (!test_bit (HCI_AUTH , &hdev->flags)) {/* Auth must be enabled first */ - err =__hci_cmd_sync_status (hdev, -HCI_OP_WRITE_AUTH_ENABLE , -1 , &dr.dev_opt, -HCI_CMD_TIMEOUT ); + err =hci_cmd_sync_status (hdev, +HCI_OP_WRITE_AUTH_ENABLE , +1 , &dr.dev_opt, +HCI_CMD_TIMEOUT );if (err)break ; } - err =__hci_cmd_sync_status (hdev,HCI_OP_WRITE_ENCRYPT_MODE , -1 , &dr.dev_opt, -HCI_CMD_TIMEOUT ); + err =hci_cmd_sync_status (hdev,HCI_OP_WRITE_ENCRYPT_MODE , +1 , &dr.dev_opt,HCI_CMD_TIMEOUT );break ;case HCISETSCAN : - err =__hci_cmd_sync_status (hdev,HCI_OP_WRITE_SCAN_ENABLE , -1 , &dr.dev_opt, -HCI_CMD_TIMEOUT ); + err =hci_cmd_sync_status (hdev,HCI_OP_WRITE_SCAN_ENABLE , +1 , &dr.dev_opt,HCI_CMD_TIMEOUT );/* Ensure that the connectable and discoverable states * get correctly modified as this was a non-mgmt change.
@@ -761,9 +759,8 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg)case HCISETLINKPOL : policy =cpu_to_le16 (dr.dev_opt); - err =__hci_cmd_sync_status (hdev,HCI_OP_WRITE_DEF_LINK_POLICY , -2 , &policy, -HCI_CMD_TIMEOUT ); + err =hci_cmd_sync_status (hdev,HCI_OP_WRITE_DEF_LINK_POLICY , +2 , &policy,HCI_CMD_TIMEOUT );break ;case HCISETLINKMODE :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 681/798 fs/ntfs3: Do not call file_modified if collapse range failed
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit 2db86f7995fe6b62a4d6fee9f3cdeba3c6d27606 ]
--- fs/ntfs3/file.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/ntfs3/file.c +3 -1
@@ -516,7 +516,7 @@ static int ntfs_truncate(struct inode *inode, loff_t new_size) }/* -* ntfs_fallocate +* ntfs_fallocate - file_operations::ntfs_fallocate * * Preallocate space for a file. This implements ntfs's fallocate file * operation, which gets called from sys_fallocate system call. User
@@ -647,6 +647,8 @@ static long ntfs_fallocate(struct file *file, int mode, loff_t vbo, loff_t len)ni_lock (ni); err =attr_collapse_range (ni, vbo, len);ni_unlock (ni); +if (err) + goto out; }else if (mode &FALLOC_FL_INSERT_RANGE ) {/* Check new size. */ err =inode_newsize_ok (inode, new_size);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 682/798 fs/ntfs3: Fix sparse warning in ni_fiemap
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit 62fea783f96ce825f0ac9e40ce9530ddc1ea2a29 ]
The interface of fiemap_fill_next_extent_k() was modified to eliminate the sparse warning.
--- fs/ntfs3/frecord.c | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-)
fs/ntfs3/frecord.c +8 -13
@@ -1901,13 +1901,13 @@ enum REPARSE_SIGN ni_parse_reparse(struct ntfs_inode *ni, struct ATTRIB *attr,/* * fiemap_fill_next_extent_k - a copy of fiemap_fill_next_extent -* but it accepts kernel address for fi_extents_start +* but it uses 'fe_k' instead of fieinfo->fi_extents_start */ static int fiemap_fill_next_extent_k (struct fiemap_extent_info *fieinfo, -u64 logical,u64 phys,u64 len,u32 flags) +struct fiemap_extent *fe_k,u64 logical, +u64 phys,u64 len,u32 flags) {struct fiemap_extent extent; -struct fiemap_extent __user *dest = fieinfo->fi_extents_start;/* only count the extents */ if (fieinfo->fi_extents_max ==0 ) {
@@ -1931,8 +1931,7 @@ static int fiemap_fill_next_extent_k(struct fiemap_extent_info *fieinfo, extent.fe_length = len; extent.fe_flags = flags; - dest += fieinfo->fi_extents_mapped; -memcpy (dest, &extent,sizeof (extent)); +memcpy (fe_k + fieinfo->fi_extents_mapped, &extent,sizeof (extent)); fieinfo->fi_extents_mapped++;if (fieinfo->fi_extents_mapped == fieinfo->fi_extents_max)
@@ -1950,7 +1949,6 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, __u64 vbo, __u64 len) { int err = 0; -struct fiemap_extent __user *fe_u = fieinfo->fi_extents_start;struct fiemap_extent *fe_k =NULL ;struct ntfs_sb_info *sbi = ni->mi.sbi;u8 cluster_bits = sbi->cluster_bits;
@@ -2009,7 +2007,6 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo, err = -ENOMEM ; goto out; } - fieinfo->fi_extents_start = fe_k; end = vbo + len; alloc_size =le64_to_cpu (attr->nres.alloc_size);
@@ -2099,8 +2096,8 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,if (vbo + dlen >= end) flags |=FIEMAP_EXTENT_LAST ; - err =fiemap_fill_next_extent_k (fieinfo, vbo, lbo, dlen, - flags); + err =fiemap_fill_next_extent_k (fieinfo, fe_k, vbo, lbo, + dlen, flags);if (err <0 )break ;
@@ -2121,7 +2118,7 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,if (vbo + bytes >= end) flags |=FIEMAP_EXTENT_LAST ; - err =fiemap_fill_next_extent_k (fieinfo, vbo, lbo, bytes, + err =fiemap_fill_next_extent_k (fieinfo, fe_k, vbo, lbo, bytes, flags);if (err <0 )break ;
@@ -2138,15 +2135,13 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,/* * Copy to user memory out of lock */ -if (copy_to_user (fe_u, fe_k, +if (copy_to_user (fieinfo->fi_extents_start, fe_k, fieinfo->fi_extents_max *sizeof (struct fiemap_extent ))) { err = -EFAULT ; } out: -/* Restore original pointer. */ - fieinfo->fi_extents_start = fe_u;kfree (fe_k);return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 683/798 fs/ntfs3: Refactor enum_rstbl to suppress static checker
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit 56c16d5459d5c050a97a138a00a82b105a8e0a66 ]
Comments and brief description of function enum_rstbl added.
--- fs/ntfs3/fslog.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
fs/ntfs3/fslog.c +17 -2
@@ -609,14 +609,29 @@ static inline void add_client(struct CLIENT_REC *ca, u16 index, __le16 *head) *head =cpu_to_le16 (index); } +/* +* Enumerate restart table. +* +* @t - table to enumerate. +* @c - current enumerated element. +* +* enumeration starts with @c == NULL +* returns next element or NULL +*/ static inline void *enum_rstbl (struct RESTART_TABLE *t,void *c) {__le32 *e;u32 bprt; -u16 rsize = t ?le16_to_cpu (t->size) :0 ; +u16 rsize; + +if (!t) +return NULL ; + + rsize =le16_to_cpu (t->size);if (!c) { -if (!t || !t->total) +/* start enumeration. */ +if (!t->total)return NULL ; e =Add2Ptr (t,sizeof (struct RESTART_TABLE )); }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 684/798 virtio_console: fix misc probe bugs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <[email protected]>
[ Upstream commit b9efbe2b8f0177fa97bfab290d60858900aa196b ]
This fixes the following issue discovered by code review:
after vqs have been created, a buggy device can send an interrupt.
A control vq callback will then try to schedule control_work which has not been initialized yet. Similarly for config interrupt. Further, in and out vq callbacks invoke find_port_by_vq which attempts to take ports_lock which also has not been initialized.
To fix, init all locks and work before creating vqs.
Message-ID: <ad982e975a6160ad110c623c016041311ca15b4f.1726511547.git.mst@redhat.com>
--- drivers/char/virtio_console.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
drivers/char/virtio_console.c +10 -8
@@ -2055,25 +2055,27 @@ static int virtcons_probe(struct virtio_device *vdev) multiport = true; } - err =init_vqs (portdev); -if (err <0 ) { -dev_err (&vdev->dev,"Error %d initializing vqs\n" , err); - goto free_chrdev; - } -spin_lock_init (&portdev->ports_lock);INIT_LIST_HEAD (&portdev->ports);INIT_LIST_HEAD (&portdev->list); -virtio_device_ready (portdev->vdev); -INIT_WORK (&portdev->config_work, &config_work_handler);INIT_WORK (&portdev->control_work, &control_work_handler);if (multiport) {spin_lock_init (&portdev->c_ivq_lock);spin_lock_init (&portdev->c_ovq_lock); + } + err =init_vqs (portdev); +if (err <0 ) { +dev_err (&vdev->dev,"Error %d initializing vqs\n" , err); + goto free_chrdev; + } + +virtio_device_ready (portdev->vdev); + +if (multiport) { err =fill_queue (portdev->c_ivq, &portdev->c_ivq_lock);if (err <0 ) { dev_err(&vdev->dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 685/798 Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <[email protected]>
commit fbf8d71742557abaf558d8efb96742d442720cc2 upstream.
Calling irq_domain_remove() will lead to freeing the IRQ domain prematurely. The domain is still referenced and will be attempted to get used via rmi_free_function_list() -> rmi_unregister_function() -> irq_dispose_mapping() -> irq_get_irq_data()'s ->domain pointer.
With PaX's MEMORY_SANITIZE this will lead to an access fault when attempting to dereference embedded pointers, as in Torsten's report that was faulting on the 'domain->ops->unmap' test.
Fix this by releasing the IRQ domain only after all related IRQs have been deactivated.
--- drivers/input/rmi4/rmi_driver.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/input/rmi4/rmi_driver.c +3 -3
@@ -978,12 +978,12 @@ static int rmi_driver_remove(struct device *dev)rmi_disable_irq (rmi_dev, false); -irq_domain_remove (data->irqdomain); - data->irqdomain =NULL ; -rmi_f34_remove_sysfs (rmi_dev);rmi_free_function_list (rmi_dev); +irq_domain_remove (data->irqdomain); + data->irqdomain =NULL ; +return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 686/798 bpf: Check percpu map value size first
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Chen <[email protected]>
[ Upstream commit 1d244784be6b01162b732a5a7d637dfc024c3203 ]
Percpu map is often used, but the map value size limit often ignored, like issue: https://github.com/iovisor/bcc/issues/2519. Actually, percpu map value size is bound by PCPU_MIN_UNIT_SIZE, so we can check the value size whether it exceeds PCPU_MIN_UNIT_SIZE first, like percpu map of local_storage. Maybe the error message seems clearer compared with "cannot allocate memory".
--- kernel/bpf/arraymap.c | 3 +++ kernel/bpf/hashtab.c | 3 +++ 2 files changed, 6 insertions(+)
kernel/bpf/arraymap.c +3 -0
@@ -73,6 +73,9 @@ int array_map_alloc_check(union bpf_attr *attr)/* avoid overflow on round_up(map->value_size) */ if (attr->value_size >INT_MAX )return -E2BIG ; +/* percpu map value size is bound by PCPU_MIN_UNIT_SIZE */ +if (percpu &&round_up (attr->value_size,8 ) >PCPU_MIN_UNIT_SIZE ) +return -E2BIG ;return 0 ; }
kernel/bpf/hashtab.c +3 -0
@@ -455,6 +455,9 @@ static int htab_map_alloc_check(union bpf_attr *attr)* kmalloc-able later in htab_map_update_elem() */ return -E2BIG ; +/* percpu map value size is bound by PCPU_MIN_UNIT_SIZE */ +if (percpu &&round_up (attr->value_size,8 ) >PCPU_MIN_UNIT_SIZE ) +return -E2BIG ;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 687/798 s390/boot: Compile all files with the same march flag
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit fccb175bc89a0d37e3ff513bb6bf1f73b3a48950 ]
Only a couple of files of the decompressor are compiled with the minimum architecture level. This is problematic for potential function calls between compile units, especially if a target function is within a compile until compiled for a higher architecture level, since that may lead to an unexpected operation exception.
Therefore compile all files of the decompressor for the same (minimum) architecture level.
--- arch/s390/boot/Makefile | 19 +++++-------------- 1 file changed, 5 insertions(+), 14 deletions(-)
arch/s390/boot/Makefile +5 -14
@@ -9,11 +9,8 @@ UBSAN_SANITIZE := n KASAN_SANITIZE := n KCSAN_SANITIZE := n -KBUILD_AFLAGS := $(KBUILD_AFLAGS_DECOMPRESSOR) -KBUILD_CFLAGS := $(KBUILD_CFLAGS_DECOMPRESSOR) - # -# Use minimum architecture for als.c to be able to print an error +# Use minimum architecture level so it is possible to print an error # message if the kernel is started on a machine which is too old # ifndef CONFIG_CC_IS_CLANG
@@ -22,16 +19,10 @@ else CC_FLAGS_MARCH_MINIMUM := -march=z10 endif -ifneq ($(CC_FLAGS_MARCH),$(CC_FLAGS_MARCH_MINIMUM)) -AFLAGS_REMOVE_head.o += $(CC_FLAGS_MARCH) -AFLAGS_head.o += $(CC_FLAGS_MARCH_MINIMUM) -AFLAGS_REMOVE_mem.o += $(CC_FLAGS_MARCH) -AFLAGS_mem.o += $(CC_FLAGS_MARCH_MINIMUM) -CFLAGS_REMOVE_als.o += $(CC_FLAGS_MARCH) -CFLAGS_als.o += $(CC_FLAGS_MARCH_MINIMUM) -CFLAGS_REMOVE_sclp_early_core.o += $(CC_FLAGS_MARCH) -CFLAGS_sclp_early_core.o += $(CC_FLAGS_MARCH_MINIMUM) -endif +KBUILD_AFLAGS := $(filter-out $(CC_FLAGS_MARCH),$(KBUILD_AFLAGS_DECOMPRESSOR)) +KBUILD_CFLAGS := $(filter-out $(CC_FLAGS_MARCH),$(KBUILD_CFLAGS_DECOMPRESSOR)) +KBUILD_AFLAGS += $(CC_FLAGS_MARCH_MINIMUM) +KBUILD_CFLAGS += $(CC_FLAGS_MARCH_MINIMUM) CFLAGS_sclp_early_core.o += -I$(srctree)/drivers/s390/char
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 688/798 s390/facility: Disable compile time optimization for decompressor code
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit 0147addc4fb72a39448b8873d8acdf3a0f29aa65 ]
Disable compile time optimizations of test_facility() for the decompressor. The decompressor should not contain any optimized code depending on the architecture level set the kernel image is compiled for to avoid unexpected operation exceptions.
Add a __DECOMPRESSOR check to test_facility() to enforce that facilities are always checked during runtime for the decompressor.
--- arch/s390/include/asm/facility.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/s390/include/asm/facility.h +4 -2
@@ -60,8 +60,10 @@ static inline int test_facility(unsigned long nr)unsigned long facilities_als[] = {FACILITIES_ALS };if (__builtin_constant_p (nr) && nr <sizeof (facilities_als) *8 ) { -if (__test_facility (nr, &facilities_als)) -return 1 ; +if (__test_facility (nr, &facilities_als)) { +if (!__is_defined (__DECOMPRESSOR)) +return 1 ; + } }return __test_facility (nr, &stfle_fac_list); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 689/798 s390/mm: Add cond_resched() to cmm_alloc/free_pages()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerald Schaefer <[email protected]>
[ Upstream commit 131b8db78558120f58c5dc745ea9655f6b854162 ]
Adding/removing large amount of pages at once to/from the CMM balloon can result in rcu_sched stalls or workqueue lockups, because of busy looping w/o cond_resched().
Prevent this by adding a cond_resched(). cmm_free_pages() holds a spin_lock while looping, so it cannot be added directly to the existing loop. Instead, introduce a wrapper function that operates on maximum 256 pages at once, and add it there.
--- arch/s390/mm/cmm.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
arch/s390/mm/cmm.c +17 -1
@@ -95,11 +95,12 @@ static long cmm_alloc_pages(long nr, long *counter, (*counter)++;spin_unlock (&cmm_lock); nr--; +cond_resched (); }return nr; } -static long cmm_free_pages (long nr,long *counter,struct cmm_page_array **list) +static long __cmm_free_pages (long nr,long *counter,struct cmm_page_array **list) {struct cmm_page_array *pa;unsigned long addr;
@@ -123,6 +124,21 @@ static long cmm_free_pages(long nr, long *counter, struct cmm_page_array **list)return nr; } +static long cmm_free_pages (long nr,long *counter,struct cmm_page_array **list) +{ +long inc =0 ; + +while (nr) { + inc =min (256L , nr); + nr -= inc; + inc =__cmm_free_pages (inc, counter, list); +if (inc) +break ; +cond_resched (); + } +return nr + inc; +} +static int cmm_oom_notify (struct notifier_block *self,unsigned long dummy,void *parm) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 690/798 bpf, x64: Fix a jit convergence issue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <[email protected]>
[ Upstream commit c8831bdbfbab672c006a18006d36932a494b2fd6 ]
Daniel Hodges reported a jit error when playing with a sched-ext program. The error message is:
unexpected jmp_cond padding: -4 bytes
But further investigation shows the error is actual due to failed convergence. The following are some analysis:
...
pass4, final_proglen=4391:
...
20e: 48 85 ff test rdi,rdi
211: 74 7d je 0x290
213: 48 8b 77 00 mov rsi,QWORD PTR [rdi+0x0]
...
289: 48 85 ff test rdi,rdi
28c: 74 17 je 0x2a5
28e: e9 7f ff ff ff jmp 0x212
293: bf 03 00 00 00 mov edi,0x3Note that insn at 0x211 is 2-byte cond jump insn for offset 0x7d (-125) and insn at 0x28e is 5-byte jmp insn with offset -129.
pass5, final_proglen=4392:
...
20e: 48 85 ff test rdi,rdi
211: 0f 84 80 00 00 00 je 0x297
217: 48 8b 77 00 mov rsi,QWORD PTR [rdi+0x0]
...
28d: 48 85 ff test rdi,rdi
290: 74 1a je 0x2ac
292: eb 84 jmp 0x218
294: bf 03 00 00 00 mov edi,0x3Note that insn at 0x211 is 6-byte cond jump insn now since its offset becomes 0x80 based on previous round (0x293 - 0x213 = 0x80). At the same time, insn at 0x292 is a 2-byte insn since its offset is -124.
pass6 will repeat the same code as in pass4. pass7 will repeat the same code as in pass5, and so on. This will prevent eventual convergence.
Passes 1-14 are with padding = 0. At pass15, padding is 1 and related insn looks like:
211: 0f 84 80 00 00 00 je 0x297
217: 48 8b 77 00 mov rsi,QWORD PTR [rdi+0x0] ...
24d: 48 85 d2 test rdx,rdx
The similar code in pass14:
211: 74 7d je 0x290
213: 48 8b 77 00 mov rsi,QWORD PTR [rdi+0x0]
...
249: 48 85 d2 test rdx,rdx
24c: 74 21 je 0x26f
24e: 48 01 f7 add rdi,rsi
...Before generating the following insn,
250: 74 21 je 0x273
"padding = 1" enables some checking to ensure nops is either 0 or 4 where
#define INSN_SZ_DIFF (((addrs[i] - addrs[i - 1]) - (prog - temp))) nops = INSN_SZ_DIFF - 2
In this specific case,
addrs[i] = 0x24e // from pass14 addrs[i-1] = 0x24d // from pass15
prog - temp = 3 // from 'test rdx,rdx' in pass15
so
nops = -4
and this triggers the failure.
To fix the issue, we need to break cycles of je <-> jmp. For example, in the above case, we have
211: 74 7d je 0x290
the offset is 0x7d. If 2-byte je insn is generated only if the offset is less than 0x7d (<= 0x7c), the cycle can be break and we can achieve the convergence.
I did some study on other cases like je <-> je, jmp <-> je and jmp <-> jmp which may cause cycles. Those cases are not from actual reproducible cases since it is pretty hard to construct a test case for them. the results show that the offset <= 0x7b (0x7b = 123) should be enough to cover all cases. This patch added a new helper to generate 8-bit cond/uncond jmp insns only if the offset range is [-128, 123].
--- arch/x86/net/bpf_jit_comp.c | 54 +++++++++++++++++++++++++++++++++++-- 1 file changed, 52 insertions(+), 2 deletions(-)
arch/x86/net/bpf_jit_comp.c +52 -2
@@ -57,6 +57,56 @@ static bool is_imm8(int value)return value <=127 && value >=-128 ; } +/* +* Let us limit the positive offset to be <= 123. +* This is to ensure eventual jit convergence For the following patterns: +* ... +* pass4, final_proglen=4391: +* ... +* 20e: 48 85 ff test rdi,rdi +* 211: 74 7d je 0x290 +* 213: 48 8b 77 00 mov rsi,QWORD PTR [rdi+0x0] +* ... +* 289: 48 85 ff test rdi,rdi +* 28c: 74 17 je 0x2a5 +* 28e: e9 7f ff ff ff jmp 0x212 +* 293: bf 03 00 00 00 mov edi,0x3 +* Note that insn at 0x211 is 2-byte cond jump insn for offset 0x7d (-125) +* and insn at 0x28e is 5-byte jmp insn with offset -129. +* +* pass5, final_proglen=4392: +* ... +* 20e: 48 85 ff test rdi,rdi +* 211: 0f 84 80 00 00 00 je 0x297 +* 217: 48 8b 77 00 mov rsi,QWORD PTR [rdi+0x0] +* ... +* 28d: 48 85 ff test rdi,rdi +* 290: 74 1a je 0x2ac +* 292: eb 84 jmp 0x218 +* 294: bf 03 00 00 00 mov edi,0x3 +* Note that insn at 0x211 is 6-byte cond jump insn now since its offset +* becomes 0x80 based on previous round (0x293 - 0x213 = 0x80). +* At the same time, insn at 0x292 is a 2-byte insn since its offset is +* -124. +* +* pass6 will repeat the same code as in pass4 and this will prevent +* eventual convergence. +* +* To fix this issue, we need to break je (2->6 bytes) <-> jmp (5->2 bytes) +* cycle in the above. In the above example je offset <= 0x7c should work. +* +* For other cases, je <-> je needs offset <= 0x7b to avoid no convergence +* issue. For jmp <-> je and jmp <-> jmp cases, jmp offset <= 0x7c should +* avoid no convergence issue. +* +* Overall, let us limit the positive offset for 8bit cond/uncond jmp insn +* to maximum 123 (0x7b). This way, the jit pass can eventually converge. +*/ +static bool is_imm8_jmp_offset (int value) +{ +return value <=123 && value >=-128 ; +} +static bool is_simm32 (s64 value) {return value == (s64 )(s32 )value;
@@ -1589,7 +1639,7 @@ st: if (is_imm8(insn->off))return -EFAULT ; } jmp_offset = addrs[i + insn->off] - addrs[i]; -if (is_imm8 (jmp_offset)) { +if (is_imm8_jmp_offset (jmp_offset)) {if (jmp_padding) {/* To keep the jmp_offset valid, the extra bytes are * padded before the jump insn, so we subtract the
@@ -1671,7 +1721,7 @@ st: if (is_imm8(insn->off))break ; } emit_jmp: -if (is_imm8 (jmp_offset)) { +if (is_imm8_jmp_offset (jmp_offset)) {if (jmp_padding) {/* To avoid breaking jmp_offset, the extra bytes * are padded before the actual jmp insn, so
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 691/798 ext4: dont set SB_RDONLY after filesystem errors
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit d3476f3dad4ad68ae5f6b008ea6591d1520da5d8 ]
When the filesystem is mounted with errors=remount-ro, we were setting SB_RDONLY flag to stop all filesystem modifications. We knew this misses proper locking (sb->s_umount) and does not go through proper filesystem remount procedure but it has been the way this worked since early ext2 days and it was good enough for catastrophic situation damage mitigation. Recently, syzbot has found a way (see link) to trigger warnings in filesystem freezing because the code got confused by SB_RDONLY changing under its hands. Since these days we set EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all filesystem modifications, modifying SB_RDONLY shouldn't be needed. So stop doing that.
--- fs/ext4/super.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
fs/ext4/super.c +5 -4
@@ -692,11 +692,12 @@ static void ext4_handle_error(struct super_block *sb, bool force_ro, int error,ext4_msg (sb,KERN_CRIT ,"Remounting filesystem read-only" );/* -* Make sure updated value of ->s_mount_flags will be visible before -* ->s_flags update +* EXT4_FLAGS_SHUTDOWN was set which stops all filesystem +* modifications. We don't set SB_RDONLY because that requires +* sb->s_umount semaphore and setting it without proper remount +* procedure is confusing code such as freeze_super() leading to +* deadlocks and other problems. */ -smp_wmb (); - sb->s_flags |=SB_RDONLY ; }static void flush_stashed_error_work (struct work_struct *work)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 692/798 ext4: nested locking for xattr inode
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wojciech Gładysz <[email protected]>
[ Upstream commit d1bc560e9a9c78d0b2314692847fc8661e0aeb99 ]
Add nested locking with I_MUTEX_XATTR subclass to avoid lockdep warning while handling xattr inode on file open syscall at ext4_xattr_inode_iget.
Backtrace
EXT4-fs (loop0): Ignoring removed oldalloc option
======================================================
WARNING: possible circular locking dependency detected
5.10.0-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor543/2794 is trying to acquire lock:ffff8880215e1a48 (&ea_inode->i_rwsem#7/1){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:782 [inline] ffff8880215e1a48 (&ea_inode->i_rwsem#7/1){+.+.}-{3:3}, at: ext4_xattr_inode_iget+0x42a/0x5c0 fs/ext4/xattr.c:425
but task is already holding lock:ffff8880215e3278 (&ei->i_data_sem/3){++++}-{3:3}, at: ext4_setattr+0x136d/0x19c0 fs/ext4/inode.c:5559
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&ei->i_data_sem/3){++++}-{3:3}:
lock_acquire+0x197/0x480 kernel/locking/lockdep.c:5566
down_write+0x93/0x180 kernel/locking/rwsem.c:1564
ext4_update_i_disksize fs/ext4/ext4.h:3267 [inline]
ext4_xattr_inode_write fs/ext4/xattr.c:1390 [inline]
ext4_xattr_inode_lookup_create fs/ext4/xattr.c:1538 [inline]
ext4_xattr_set_entry+0x331a/0x3d80 fs/ext4/xattr.c:1662
ext4_xattr_ibody_set+0x124/0x390 fs/ext4/xattr.c:2228
ext4_xattr_set_handle+0xc27/0x14e0 fs/ext4/xattr.c:2385
ext4_xattr_set+0x219/0x390 fs/ext4/xattr.c:2498
ext4_xattr_user_set+0xc9/0xf0 fs/ext4/xattr_user.c:40
__vfs_setxattr+0x404/0x450 fs/xattr.c:177
__vfs_setxattr_noperm+0x11d/0x4f0 fs/xattr.c:208
__vfs_setxattr_locked+0x1f9/0x210 fs/xattr.c:266
vfs_setxattr+0x112/0x2c0 fs/xattr.c:283
setxattr+0x1db/0x3e0 fs/xattr.c:548
path_setxattr+0x15a/0x240 fs/xattr.c:567
__do_sys_setxattr fs/xattr.c:582 [inline]
__se_sys_setxattr fs/xattr.c:578 [inline]
__x64_sys_setxattr+0xc5/0xe0 fs/xattr.c:578
do_syscall_64+0x6d/0xa0 arch/x86/entry/common.c:62
entry_SYSCALL_64_after_hwframe+0x61/0xcb-> #0 (&ea_inode->i_rwsem#7/1){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:2988 [inline]
check_prevs_add kernel/locking/lockdep.c:3113 [inline]
validate_chain+0x1695/0x58f0 kernel/locking/lockdep.c:3729
__lock_acquire+0x12fd/0x20d0 kernel/locking/lockdep.c:4955
lock_acquire+0x197/0x480 kernel/locking/lockdep.c:5566
down_write+0x93/0x180 kernel/locking/rwsem.c:1564
inode_lock include/linux/fs.h:782 [inline]
ext4_xattr_inode_iget+0x42a/0x5c0 fs/ext4/xattr.c:425
ext4_xattr_inode_get+0x138/0x410 fs/ext4/xattr.c:485
ext4_xattr_move_to_block fs/ext4/xattr.c:2580 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2682 [inline]
ext4_expand_extra_isize_ea+0xe70/0x1bb0 fs/ext4/xattr.c:2774
__ext4_expand_extra_isize+0x304/0x3f0 fs/ext4/inode.c:5898
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5941 [inline]
__ext4_mark_inode_dirty+0x591/0x810 fs/ext4/inode.c:6018
ext4_setattr+0x1400/0x19c0 fs/ext4/inode.c:5562
notify_change+0xbb6/0xe60 fs/attr.c:435
do_truncate+0x1de/0x2c0 fs/open.c:64
handle_truncate fs/namei.c:2970 [inline]
do_open fs/namei.c:3311 [inline]
path_openat+0x29f3/0x3290 fs/namei.c:3425
do_filp_open+0x20b/0x450 fs/namei.c:3452
do_sys_openat2+0x124/0x460 fs/open.c:1207
do_sys_open fs/open.c:1223 [inline]
__do_sys_open fs/open.c:1231 [inline]
__se_sys_open fs/open.c:1227 [inline]
__x64_sys_open+0x221/0x270 fs/open.c:1227
do_syscall_64+0x6d/0xa0 arch/x86/entry/common.c:62
entry_SYSCALL_64_after_hwframe+0x61/0xcbother info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ei->i_data_sem/3);
lock(&ea_inode->i_rwsem#7/1);
lock(&ei->i_data_sem/3); lock(&ea_inode->i_rwsem#7/1);
*** DEADLOCK ***
5 locks held by syz-executor543/2794:
#0: ffff888026fbc448 (sb_writers#4){.+.+}-{0:0}, at: mnt_want_write+0x4a/0x2a0 fs/namespace.c:365 #1: ffff8880215e3488 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:782 [inline] #1: ffff8880215e3488 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: do_truncate+0x1cf/0x2c0 fs/open.c:62 #2: ffff8880215e3310 (&ei->i_mmap_sem){++++}-{3:3}, at: ext4_setattr+0xec4/0x19c0 fs/ext4/inode.c:5519 #3: ffff8880215e3278 (&ei->i_data_sem/3){++++}-{3:3}, at: ext4_setattr+0x136d/0x19c0 fs/ext4/inode.c:5559 #4: ffff8880215e30c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_trylock_xattr fs/ext4/xattr.h:162 [inline] #4: ffff8880215e30c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:5938 [inline] #4: ffff8880215e30c8 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x4fb/0x810 fs/ext4/inode.c:6018
stack backtrace: CPU: 1 PID: 2794 Comm: syz-executor543 Not tainted 5.10.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x177/0x211 lib/dump_stack.c:118 print_circular_bug+0x146/0x1b0 kernel/locking/lockdep.c:2002 check_noncircular+0x2cc/0x390 kernel/locking/lockdep.c:2123 check_prev_add kernel/locking/lockdep.c:2988 [inline] check_prevs_add kernel/locking/lockdep.c:3113 [inline] validate_chain+0x1695/0x58f0 kernel/locking/lockdep.c:3729 __lock_acquire+0x12fd/0x20d0 kernel/locking/lockdep.c:4955 lock_acquire+0x197/0x480 kernel/locking/lockdep.c:5566 down_write+0x93/0x180 kernel/locking/rwsem.c:1564 inode_lock include/linux/fs.h:782 [inline] ext4_xattr_inode_iget+0x42a/0x5c0 fs/ext4/xattr.c:425 ext4_xattr_inode_get+0x138/0x410 fs/ext4/xattr.c:485 ext4_xattr_move_to_block fs/ext4/xattr.c:2580 [inline] ext4_xattr_make_inode_space fs/ext4/xattr.c:2682 [inline] ext4_expand_extra_isize_ea+0xe70/0x1bb0 fs/ext4/xattr.c:2774 __ext4_expand_extra_isize+0x304/0x3f0 fs/ext4/inode.c:5898 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5941 [inline] __ext4_mark_inode_dirty+0x591/0x810 fs/ext4/inode.c:6018 ext4_setattr+0x1400/0x19c0 fs/ext4/inode.c:5562 notify_change+0xbb6/0xe60 fs/attr.c:435 do_truncate+0x1de/0x2c0 fs/open.c:64 handle_truncate fs/namei.c:2970 [inline] do_open fs/namei.c:3311 [inline] path_openat+0x29f3/0x3290 fs/namei.c:3425 do_filp_open+0x20b/0x450 fs/namei.c:3452 do_sys_openat2+0x124/0x460 fs/open.c:1207 do_sys_open fs/open.c:1223 [inline] __do_sys_open fs/open.c:1231 [inline] __se_sys_open fs/open.c:1227 [inline] __x64_sys_open+0x221/0x270 fs/open.c:1227 do_syscall_64+0x6d/0xa0 arch/x86/entry/common.c:62 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f0cde4ea229 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd81d1c978 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 0030656c69662f30 RCX: 00007f0cde4ea229 RDX: 0000000000000089 RSI: 00000000000a0a00 RDI: 00000000200001c0 RBP: 2f30656c69662f2e R08: 0000000000208000 R09: 0000000000208000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd81d1c9c0 R13: 00007ffd81d1ca00 R14: 0000000000080000 R15: 0000000000000003
EXT4-fs error (device loop0): ext4_expand_extra_isize_ea:2730: inode #13: comm syz-executor543: corrupted in-inode xattr
--- fs/ext4/xattr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ext4/xattr.c +2 -2
@@ -422,7 +422,7 @@ static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_ino,ext4_set_inode_state (inode,EXT4_STATE_LUSTRE_EA_INODE );ext4_xattr_inode_set_ref (inode,1 ); }else { -inode_lock (inode); +inode_lock_nested (inode,I_MUTEX_XATTR ); inode->i_flags |=S_NOQUOTA ;inode_unlock (inode); }
@@ -990,7 +990,7 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode,s64 ref_count;int ret; -inode_lock (ea_inode); +inode_lock_nested (ea_inode,I_MUTEX_XATTR ); ret =ext4_reserve_inode_write (handle, ea_inode, &iloc);if (ret)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 693/798 s390/cpum_sf: Remove WARN_ON_ONCE statements
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richter <[email protected]>
[ Upstream commit b495e710157606889f2d8bdc62aebf2aa02f67a7 ]
Remove WARN_ON_ONCE statements. These have not triggered in the past.
--- arch/s390/kernel/perf_cpum_sf.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
arch/s390/kernel/perf_cpum_sf.c +4 -8
@@ -1432,7 +1432,7 @@ static int aux_output_begin(struct perf_output_handle *handle,unsigned long head, base, offset;struct hws_trailer_entry *te; -if (WARN_ON_ONCE (handle->head & ~PAGE_MASK )) +if (handle->head & ~PAGE_MASK )return -EINVAL ; aux->head = handle->head >>PAGE_SHIFT ;
@@ -1613,7 +1613,7 @@ static void hw_collect_aux(struct cpu_hw_sf *cpuhw)unsigned long num_sdb; aux =perf_get_aux (handle); -if (WARN_ON_ONCE (!aux)) +if (!aux)return ;/* Inform user space new data arrived */
@@ -1635,7 +1635,7 @@ static void hw_collect_aux(struct cpu_hw_sf *cpuhw) __func__);break ; } -if (WARN_ON_ONCE (!aux)) +if (!aux)return ;/* Update head and alert_mark to new position */
@@ -1870,12 +1870,8 @@ static void cpumsf_pmu_start(struct perf_event *event, int flags) {struct cpu_hw_sf *cpuhw =this_cpu_ptr (&cpu_hw_sf); -if (WARN_ON_ONCE (!(event->hw.state &PERF_HES_STOPPED ))) +if (!(event->hw.state &PERF_HES_STOPPED ))return ; - -if (flags &PERF_EF_RELOAD ) -WARN_ON_ONCE (!(event->hw.state &PERF_HES_UPTODATE )); -perf_pmu_disable (event->pmu); event->hw.state =0 ; cpuhw->lsctl.cs =1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 694/798 s390/traps: Handle early warnings gracefully
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit 3c4d0ae0671827f4b536cc2d26f8b9c54584ccc5 ]
Add missing warning handling to the early program check handler. This way a warning is printed to the console as soon as the early console is setup, and the kernel continues to boot.
Before this change a disabled wait psw was loaded instead and the machine was silently stopped without giving an idea about what happened.
--- arch/s390/kernel/early.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
arch/s390/kernel/early.c +15 -2
@@ -151,8 +151,21 @@ static __init void setup_topology(void)void __do_early_pgm_check (struct pt_regs *regs) { -if (!fixup_exception (regs)) -disabled_wait (); +struct lowcore *lc =get_lowcore (); +unsigned long ip; + + regs->int_code = lc->pgm_int_code; + regs->int_parm_long = lc->trans_exc_code; + ip =__rewind_psw (regs->psw, regs->int_code >>16 ); + +/* Monitor Event? Might be a warning */ +if ((regs->int_code &PGM_INT_CODE_MASK ) ==0x40 ) { +if (report_bug (ip, regs) ==BUG_TRAP_TYPE_WARN ) +return ; + } +if (fixup_exception (regs)) +return ; +disabled_wait (); } static noinline __init void setup_lowcore_early(void)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 695/798 ktest.pl: Avoid false positives with grub2 skip regex
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Jordan <[email protected]>
[ Upstream commit 2351e8c65404aabc433300b6bf90c7a37e8bbc4d ]
Some distros have grub2 config files with the lines
if [ x"${feature_menuentry_id}" = xy ]; then
menuentry_id_option="--id"
else
menuentry_id_option=""
fiwhich match the skip regex defined for grub2 in get_grub_index():
$skip = '^\s*menuentry';
These false positives cause the grub number to be higher than it should be, and the wrong kernel can end up booting.
Grub documents the menuentry command with whitespace between it and the title, so make the skip regex reflect this.
--- tools/testing/ktest/ktest.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/ktest/ktest.pl +1 -1
@@ -2036,7 +2036,7 @@ sub get_grub_index { } elsif ($reboot_type eq "grub2") { $command = "cat $grub_file"; $target = '^\s*menuentry.*' . $grub_menu_qt; - $skip = '^\s*menuentry'; + $skip = '^\s*menuentry\s'; $submenu = '^\s*submenu\s'; } elsif ($reboot_type eq "grub2bls") { $command = $grub_bls_get;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 696/798 RDMA/mad: Improve handling of timed out WRs of mad agent
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saravanan Vajravel <[email protected]>
[ Upstream commit 2a777679b8ccd09a9a65ea0716ef10365179caac ]
Current timeout handler of mad agent acquires/releases mad_agent_priv lock for every timed out WRs. This causes heavy locking contention when higher no. of WRs are to be handled inside timeout handler.
This leads to softlockup with below trace in some use cases where rdma-cm path is used to establish connection between peer nodes
Trace:
-----
BUG: soft lockup - CPU#4 stuck for 26s! [kworker/u128:3:19767]
CPU: 4 PID: 19767 Comm: kworker/u128:3 Kdump: loaded Tainted: G OE
------- --- 5.14.0-427.13.1.el9_4.x86_64 #1
Hardware name: Dell Inc. PowerEdge R740/01YM03, BIOS 2.4.8 11/26/2019
Workqueue: ib_mad1 timeout_sends [ib_core]
RIP: 0010:__do_softirq+0x78/0x2ac
RSP: 0018:ffffb253449e4f98 EFLAGS: 00000246
RAX: 00000000ffffffff RBX: 0000000000000000 RCX: 000000000000001f
RDX: 000000000000001d RSI: 000000003d1879ab RDI: fff363b66fd3a86b
RBP: ffffb253604cbcd8 R08: 0000009065635f3b R09: 0000000000000000
R10: 0000000000000040 R11: ffffb253449e4ff8 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000040
FS: 0000000000000000(0000) GS:ffff8caa1fc80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd9ec9db900 CR3: 0000000891934006 CR4: 00000000007706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
<IRQ>
? show_trace_log_lvl+0x1c4/0x2df
? show_trace_log_lvl+0x1c4/0x2df
? __irq_exit_rcu+0xa1/0xc0
? watchdog_timer_fn+0x1b2/0x210
? __pfx_watchdog_timer_fn+0x10/0x10
? __hrtimer_run_queues+0x127/0x2c0
? hrtimer_interrupt+0xfc/0x210
? __sysvec_apic_timer_interrupt+0x5c/0x110
? sysvec_apic_timer_interrupt+0x37/0x90
? asm_sysvec_apic_timer_interrupt+0x16/0x20
? __do_softirq+0x78/0x2ac
? __do_softirq+0x60/0x2ac
__irq_exit_rcu+0xa1/0xc0
sysvec_call_function_single+0x72/0x90
</IRQ>
<TASK>
asm_sysvec_call_function_single+0x16/0x20
RIP: 0010:_raw_spin_unlock_irq+0x14/0x30
RSP: 0018:ffffb253604cbd88 EFLAGS: 00000247
RAX: 000000000001960d RBX: 0000000000000002 RCX: ffff8cad2a064800
RDX: 000000008020001b RSI: 0000000000000001 RDI: ffff8cad5d39f66c
RBP: ffff8cad5d39f600 R08: 0000000000000001 R09: 0000000000000000
R10: ffff8caa443e0c00 R11: ffffb253604cbcd8 R12: ffff8cacb8682538
R13: 0000000000000005 R14: ffffb253604cbd90 R15: ffff8cad5d39f66c
cm_process_send_error+0x122/0x1d0 [ib_cm]
timeout_sends+0x1dd/0x270 [ib_core]
process_one_work+0x1e2/0x3b0
? __pfx_worker_thread+0x10/0x10
worker_thread+0x50/0x3a0
? __pfx_worker_thread+0x10/0x10
kthread+0xdd/0x100
? __pfx_kthread+0x10/0x10
ret_from_fork+0x29/0x50
</TASK>Simplified timeout handler by creating local list of timed out WRs and invoke send handler post creating the list. The new method acquires/ releases lock once to fetch the list and hence helps to reduce locking contetiong when processing higher no. of WRs
--- drivers/infiniband/core/mad.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/infiniband/core/mad.c +8 -6
@@ -2616,14 +2616,16 @@ static int retry_send(struct ib_mad_send_wr_private *mad_send_wr)static void timeout_sends (struct work_struct *work) { +struct ib_mad_send_wr_private *mad_send_wr, *n;struct ib_mad_agent_private *mad_agent_priv; -struct ib_mad_send_wr_private *mad_send_wr;struct ib_mad_send_wc mad_send_wc; +struct list_head local_list;unsigned long flags, delay; mad_agent_priv = container_of(work, struct ib_mad_agent_private, timed_work.work); mad_send_wc.vendor_err =0 ; +INIT_LIST_HEAD (&local_list);spin_lock_irqsave (&mad_agent_priv->lock, flags);while (!list_empty (&mad_agent_priv->wait_list)) {
@@ -2641,13 +2643,16 @@ static void timeout_sends(struct work_struct *work)break ; } -list_del (&mad_send_wr->agent_list); +list_del_init (&mad_send_wr->agent_list);if (mad_send_wr->status ==IB_WC_SUCCESS && !retry_send (mad_send_wr))continue ; -spin_unlock_irqrestore (&mad_agent_priv->lock, flags); +list_add_tail (&mad_send_wr->agent_list, &local_list); + } +spin_unlock_irqrestore (&mad_agent_priv->lock, flags); +list_for_each_entry_safe (mad_send_wr, n, &local_list, agent_list) {if (mad_send_wr->status ==IB_WC_SUCCESS ) mad_send_wc.status =IB_WC_RESP_TIMEOUT_ERR ;else
@@ -2655,11 +2660,8 @@ static void timeout_sends(struct work_struct *work) mad_send_wc.send_buf = &mad_send_wr->send_buf; mad_agent_priv->agent.send_handler (&mad_agent_priv->agent, &mad_send_wc); -deref_mad_agent (mad_agent_priv); -spin_lock_irqsave (&mad_agent_priv->lock, flags); } -spin_unlock_irqrestore (&mad_agent_priv->lock, flags); }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 697/798 PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: WangYuli <[email protected]>
[ Upstream commit 9246b487ab3c3b5993aae7552b7a4c541cc14a49 ]
Add DMA support for audio function of Glenfly Arise chip, which uses Requester ID of function 0.
--- drivers/pci/quirks.c | 4 ++++ include/linux/pci_ids.h | 2 ++ sound/pci/hda/hda_intel.c | 2 +- 3 files changed, 7 insertions(+), 1 deletion(-)
drivers/pci/quirks.c +4 -0
@@ -4144,6 +4144,10 @@ static void quirk_dma_func0_alias(struct pci_dev *dev)DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_RICOH ,0xe832 , quirk_dma_func0_alias);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_RICOH ,0xe476 , quirk_dma_func0_alias); +/* Some Glenfly chips use function 0 as the PCIe Requester ID for DMA */ +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_GLENFLY ,0x3d40 , quirk_dma_func0_alias); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_GLENFLY ,0x3d41 , quirk_dma_func0_alias); +static void quirk_dma_func1_alias (struct pci_dev *dev) {if (PCI_FUNC (dev->devfn) !=1 )
include/linux/pci_ids.h +2 -0
@@ -2638,6 +2638,8 @@#define PCI_DEVICE_ID_DCI_PCCOM8 0x0002#define PCI_DEVICE_ID_DCI_PCCOM2 0x0004 +#define PCI_VENDOR_ID_GLENFLY 0x6766 +#define PCI_VENDOR_ID_INTEL 0x8086#define PCI_DEVICE_ID_INTEL_EESSC 0x0008#define PCI_DEVICE_ID_INTEL_PXHD_0 0x0320
sound/pci/hda/hda_intel.c +1 -1
@@ -2748,7 +2748,7 @@ static const struct pci_device_id azx_ids[] = { .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS | AZX_DCAPS_PM_RUNTIME },/* GLENFLY */ - { PCI_DEVICE(0x6766, PCI_ANY_ID), + { PCI_DEVICE(PCI_VENDOR_ID_GLENFLY, PCI_ANY_ID), .class = PCI_CLASS_MULTIMEDIA_HD_AUDIO << 8, .class_mask = 0xffffff, .driver_data = AZX_DRIVER_GFHDMI | AZX_DCAPS_POSFIX_LPIB |
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 698/798 RDMA/rtrs-srv: Avoid null pointer deref during path establishment
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Md Haris Iqbal <[email protected]>
[ Upstream commit d0e62bf7b575fbfe591f6f570e7595dd60a2f5eb ]
For RTRS path establishment, RTRS client initiates and completes con_num of connections. After establishing all its connections, the information is exchanged between the client and server through the info_req message. During this exchange, it is essential that all connections have been established, and the state of the RTRS srv path is CONNECTED.
So add these sanity checks, to make sure we detect and abort process in error scenarios to avoid null pointer deref.
--- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/infiniband/ulp/rtrs/rtrs-srv.c +11 -2
@@ -936,12 +936,11 @@ static void rtrs_srv_info_req_done(struct ib_cq *cq, struct ib_wc *wc)if (err) goto close; -out:rtrs_iu_free (iu, srv_path->s.dev->ib_dev,1 );return ; close: +rtrs_iu_free (iu, srv_path->s.dev->ib_dev,1 );close_path (srv_path); - goto out; }static int post_recv_info_req (struct rtrs_srv_con *con)
@@ -992,6 +991,16 @@ static int post_recv_path(struct rtrs_srv_path *srv_path) q_size =SERVICE_CON_QUEUE_DEPTH ; else q_size = srv->queue_depth; +if (srv_path->state !=RTRS_SRV_CONNECTING ) { +rtrs_err (s,"Path state invalid. state %s\n" , +rtrs_srv_state_str (srv_path->state)); +return -EIO ; + } + +if (!srv_path->s.con[cid]) { +rtrs_err (s,"Conn not set for %d\n" , cid); +return -EIO ; + } err =post_recv_io (to_srv_con (srv_path->s.con[cid]), q_size);if (err) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 699/798 clk: bcm: bcm53573: fix OF node leak in init
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit f92d67e23b8caa81f6322a2bad1d633b00ca000e ]
Driver code is leaking OF node reference from of_get_parent() in bcm53573_ilp_init(). Usage of of_get_parent() is not needed in the first place, because the parent node will not be freed while we are processing given node (triggered by CLK_OF_DECLARE()). Thus fix the leak by accessing parent directly, instead of of_get_parent().
--- drivers/clk/bcm/clk-bcm53573-ilp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/bcm/clk-bcm53573-ilp.c +1 -1
@@ -112,7 +112,7 @@ static void bcm53573_ilp_init(struct device_node *np) goto err_free_ilp; } - ilp->regmap =syscon_node_to_regmap (of_get_parent (np)); + ilp->regmap =syscon_node_to_regmap (np->parent);if (IS_ERR (ilp->regmap)) { err =PTR_ERR (ilp->regmap); goto err_free_ilp;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 700/798 PCI: Add ACS quirk for Qualcomm SA8775P
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Subramanian Ananthanarayanan <[email protected]>
[ Upstream commit 026f84d3fa62d215b11cbeb5a5d97df941e93b5c ]
The Qualcomm SA8775P root ports don't advertise an ACS capability, but they do provide ACS-like features to disable peer transactions and validate bus numbers in requests.
Thus, add an ACS quirk for the SA8775P.
--- drivers/pci/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/quirks.c +2 -0
@@ -4972,6 +4972,8 @@ static const struct pci_dev_acs_enabled {/* QCOM QDF2xxx root ports */ { PCI_VENDOR_ID_QCOM, 0x0400, pci_quirk_qcom_rp_acs }, { PCI_VENDOR_ID_QCOM, 0x0401, pci_quirk_qcom_rp_acs }, +/* QCOM SA8775P root port */ + { PCI_VENDOR_ID_QCOM, 0x0115, pci_quirk_qcom_rp_acs },/* HXT SD4800 root ports. The ACS design is same as QCOM QDF2xxx */ { PCI_VENDOR_ID_HXT, 0x0401, pci_quirk_qcom_rp_acs }, /* Intel PCH root ports */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 701/798 i2c: i801: Use a different adapter-name for IDF adapters
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 43457ada98c824f310adb7bd96bd5f2fcd9a3279 ]
On chipsets with a second 'Integrated Device Function' SMBus controller use a different adapter-name for the second IDF adapter.
This allows platform glue code which is looking for the primary i801 adapter to manually instantiate i2c_clients on to differentiate between the 2.
This allows such code to find the primary i801 adapter by name, without needing to duplicate the PCI-ids to feature-flags mapping from i2c-i801.c.
--- drivers/i2c/busses/i2c-i801.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-i801.c +8 -1
@@ -1751,8 +1751,15 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)i801_add_tco (priv); +/* +* adapter.name is used by platform code to find the main I801 adapter +* to instantiante i2c_clients, do not change. +*/ snprintf (priv->adapter.name,sizeof (priv->adapter.name), -"SMBus I801 adapter at %04lx" , priv->smba); +"SMBus %s adapter at %04lx" , + (priv->features &FEATURE_IDF ) ?"I801 IDF" :"I801" , + priv->smba); + err =i2c_add_adapter (&priv->adapter);if (err) {platform_device_unregister (priv->tco_pdev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 702/798 PCI: Mark Creative Labs EMU20k2 INTx masking as broken
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <[email protected]>
[ Upstream commit 2910306655a7072640021563ec9501bfa67f0cb1 ]
Per user reports, the Creative Labs EMU20k2 (Sound Blaster X-Fi Titanium Series) generates spurious interrupts when used with vfio-pci unless DisINTx masking support is disabled.
Thus, quirk the device to mark INTx masking as broken.
--- drivers/pci/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/quirks.c +2 -0
@@ -3506,6 +3506,8 @@ DECLARE_PCI_FIXUP_FINAL(0x1814, 0x0601, /* Ralink RT2800 802.11n PCI */ quirk_broken_intx_masking);DECLARE_PCI_FIXUP_FINAL (0x1b7c ,0x0004 ,/* Ceton InfiniTV4 */ quirk_broken_intx_masking); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_CREATIVE ,PCI_DEVICE_ID_CREATIVE_20K2 , + quirk_broken_intx_masking);/* * Realtek RTL8169 PCI Gigabit Ethernet Controller (rev 10)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 703/798 RISC-V: Dont have MAX_PHYSMEM_BITS exceed phys_addr_t
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Palmer Dabbelt <[email protected]>
[ Upstream commit ad380f6a0a5e82e794b45bb2eaec24ed51a56846 ]
I recently ended up with a warning on some compilers along the lines of
CC kernel/resource.o
In file included from include/linux/ioport.h:16,
from kernel/resource.c:15:
kernel/resource.c: In function 'gfr_start':
include/linux/minmax.h:49:37: error: conversion from 'long long unsigned int' to 'resource_size_t' {aka 'unsigned int'} changes value from '17179869183' to '4294967295' [-Werror=overflow]
49 | ({ type ux = (x); type uy = (y); __cmp(op, ux, uy); })
| ^
include/linux/minmax.h:52:9: note: in expansion of macro '__cmp_once_unique'
52 | __cmp_once_unique(op, type, x, y, __UNIQUE_ID(x_), __UNIQUE_ID(y_))
| ^~~~~~~~~~~~~~~~~
include/linux/minmax.h:161:27: note: in expansion of macro '__cmp_once'
161 | #define min_t(type, x, y) __cmp_once(min, type, x, y)
| ^~~~~~~~~~
kernel/resource.c:1829:23: note: in expansion of macro 'min_t'
1829 | end = min_t(resource_size_t, base->end,
| ^~~~~
kernel/resource.c: In function 'gfr_continue':
include/linux/minmax.h:49:37: error: conversion from 'long long unsigned int' to 'resource_size_t' {aka 'unsigned int'} changes value from '17179869183' to '4294967295' [-Werror=overflow]
49 | ({ type ux = (x); type uy = (y); __cmp(op, ux, uy); })
| ^
include/linux/minmax.h:52:9: note: in expansion of macro '__cmp_once_unique'
52 | __cmp_once_unique(op, type, x, y, __UNIQUE_ID(x_), __UNIQUE_ID(y_))
| ^~~~~~~~~~~~~~~~~
include/linux/minmax.h:161:27: note: in expansion of macro '__cmp_once'
161 | #define min_t(type, x, y) __cmp_once(min, type, x, y)
| ^~~~~~~~~~
kernel/resource.c:1847:24: note: in expansion of macro 'min_t'
1847 | addr <= min_t(resource_size_t, base->end,
| ^~~~~
cc1: all warnings being treated as errorswhich looks like a real problem: our phys_addr_t is only 32 bits now, so having 34-bit masks is just going to result in overflows.
--- arch/riscv/include/asm/sparsemem.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/include/asm/sparsemem.h +1 -1
@@ -7,7 +7,7 @@#ifdef CONFIG_64BIT #define MAX_PHYSMEM_BITS 56#else -#define MAX_PHYSMEM_BITS 34 +#define MAX_PHYSMEM_BITS 32#endif /* CONFIG_64BIT */ #define SECTION_SIZE_BITS 27#endif /* CONFIG_SPARSEMEM */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 704/798 io_uring: check if we need to reschedule during overflow flush
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
[ Upstream commit eac2ca2d682f94f46b1973bdf5e77d85d77b8e53 ]
In terms of normal application usage, this list will always be empty. And if an application does overflow a bit, it'll have a few entries. However, nothing obviously prevents syzbot from running a test case that generates a ton of overflow entries, and then flushing them can take quite a while.
Check for needing to reschedule while flushing, and drop our locks and do so if necessary. There's no state to maintain here as overflows always prune from head-of-list, hence it's fine to drop and reacquire the locks at the end of the loop.
--- io_uring/io_uring.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
io_uring/io_uring.c +15 -0
@@ -615,6 +615,21 @@ static bool __io_cqring_overflow_flush(struct io_ring_ctx *ctx, bool force)list_del (&ocqe->list);kfree (ocqe); + +/* +* For silly syzbot cases that deliberately overflow by huge +* amounts, check if we need to resched and drop and +* reacquire the locks if so. Nothing real would ever hit this. +* Ideally we'd have a non-posting unlock for this, but hard +* to care for a non-real case. +*/ +if (need_resched ()) { +io_cq_unlock_post (ctx); +mutex_unlock (&ctx->uring_lock); +cond_resched (); +mutex_lock (&ctx->uring_lock); +io_cq_lock (ctx); + } } all_flushed =list_empty (&ctx->cq_overflow_list);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 705/798 ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaixin Wang <[email protected]>
[ Upstream commit e51aded92d42784313ba16c12f4f88cc4f973bbb ]
In the switchtec_ntb_add function, it can call switchtec_ntb_init_sndev function, then &sndev->check_link_status_work is bound with check_link_status_work. switchtec_ntb_link_notification may be called to start the work.
If we remove the module which will call switchtec_ntb_remove to make cleanup, it will free sndev through kfree(sndev), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| check_link_status_work
switchtec_ntb_remove |
kfree(sndev); |
| if (sndev->link_force_down)
| // use sndevFix it by ensuring that the work is canceled before proceeding with the cleanup in switchtec_ntb_remove.
--- drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 1 + 1 file changed, 1 insertion(+)
drivers/ntb/hw/mscc/ntb_hw_switchtec.c +1 -0
@@ -1556,6 +1556,7 @@ static void switchtec_ntb_remove(struct device *dev,switchtec_ntb_deinit_db_msg_irq (sndev);switchtec_ntb_deinit_shared_mw (sndev);switchtec_ntb_deinit_crosslink (sndev); +cancel_work_sync (&sndev->check_link_status_work);kfree (sndev);dev_info (dev,"ntb device unregistered\n" ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 706/798 RDMA/mlx5: Enforce umem boundaries for explicit ODP page faults
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Guralnik <[email protected]>
[ Upstream commit 8c6d097d830f779fc1725fbaa1314f20a7a07b4b ]
The new memory scheme page faults are requesting the driver to fetch additinal pages to the faulted memory access.
This is done in order to prefetch pages before and after the area that got the page fault, assuming this will reduce the total amount of page faults.
The driver should ensure it handles only the pages that are within the umem range.
--- drivers/infiniband/hw/mlx5/odp.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-)
drivers/infiniband/hw/mlx5/odp.c +16 -9
@@ -734,24 +734,31 @@ static int pagefault_dmabuf_mr(struct mlx5_ib_mr *mr, size_t bcnt,* >0: Number of pages mapped */ static int pagefault_mr (struct mlx5_ib_mr *mr,u64 io_virt,size_t bcnt, -u32 *bytes_mapped,u32 flags) +u32 *bytes_mapped,u32 flags,bool permissive_fault) {struct ib_umem_odp *odp =to_ib_umem_odp (mr->umem); -if (unlikely (io_virt < mr->ibmr.iova)) +if (unlikely (io_virt < mr->ibmr.iova) && !permissive_fault)return -EFAULT ;if (mr->umem->is_dmabuf)return pagefault_dmabuf_mr (mr, bcnt, bytes_mapped, flags);if (!odp->is_implicit_odp) { +u64 offset = io_virt < mr->ibmr.iova ?0 : io_virt - mr->ibmr.iova;u64 user_va; -if (check_add_overflow (io_virt - mr->ibmr.iova, - (u64 )odp->umem.address, &user_va)) +if (check_add_overflow (offset, (u64 )odp->umem.address, + &user_va))return -EFAULT ; -if (unlikely (user_va >=ib_umem_end (odp) || -ib_umem_end (odp) - user_va < bcnt)) + +if (permissive_fault) { +if (user_va <ib_umem_start (odp)) + user_va =ib_umem_start (odp); +if ((user_va + bcnt) >ib_umem_end (odp)) + bcnt =ib_umem_end (odp) - user_va; + }else if (unlikely (user_va >=ib_umem_end (odp) || +ib_umem_end (odp) - user_va < bcnt))return -EFAULT ;return pagefault_real_mr (mr, odp, user_va, bcnt, bytes_mapped, flags);
@@ -858,7 +865,7 @@ static int pagefault_single_data_segment(struct mlx5_ib_dev *dev,case MLX5_MKEY_MR : mr = container_of(mmkey, struct mlx5_ib_mr, mmkey); - ret =pagefault_mr (mr, io_virt, bcnt, bytes_mapped,0 ); + ret =pagefault_mr (mr, io_virt, bcnt, bytes_mapped,0 , false);if (ret <0 ) goto end;
@@ -1724,7 +1731,7 @@ static void mlx5_ib_prefetch_mr_work(struct work_struct *w)for (i =0 ; i < work->num_sge; ++i) { ret =pagefault_mr (work->frags[i].mr, work->frags[i].io_virt, work->frags[i].length, &bytes_mapped, - work->pf_flags); + work->pf_flags, false);if (ret <=0 )continue ;mlx5_update_odp_stats (work->frags[i].mr, prefetch, ret);
@@ -1775,7 +1782,7 @@ static int mlx5_ib_prefetch_sg_list(struct ib_pd *pd,if (IS_ERR (mr))return PTR_ERR (mr); ret =pagefault_mr (mr, sg_list[i].addr, sg_list[i].length, - &bytes_mapped, pf_flags); + &bytes_mapped, pf_flags, false);if (ret <0 ) {mlx5r_deref_odp_mkey (&mr->mmkey);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 707/798 riscv/kexec_file: Fix relocation type R_RISCV_ADD16 and R_RISCV_SUB16 unknown
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ying Sun <[email protected]>
[ Upstream commit c6ebf2c528470a09be77d0d9df2c6617ea037ac5 ]
Runs on the kernel with CONFIG_RISCV_ALTERNATIVE enabled:
kexec -sl vmlinux
Error:
kexec_image: Unknown rela relocation: 34
kexec_image: Error loading purgatory ret=-8
and
kexec_image: Unknown rela relocation: 38
kexec_image: Error loading purgatory ret=-8
The purgatory code uses the 16-bit addition and subtraction relocation type, but not handled, resulting in kexec_file_load failure. So add handle to arch_kexec_apply_relocations_add().
Tested on RISC-V64 Qemu-virt, issue fixed.
--- arch/riscv/kernel/elf_kexec.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/riscv/kernel/elf_kexec.c +6 -0
@@ -444,6 +444,12 @@ int arch_kexec_apply_relocations_add(struct purgatory_info *pi, *(u32 *)loc =CLEAN_IMM (CJTYPE , *(u32 *)loc) |ENCODE_CJTYPE_IMM (val - addr);break ; +case R_RISCV_ADD16 : + *(u16 *)loc += val; +break ; +case R_RISCV_SUB16 : + *(u16 *)loc -= val; +break ;case R_RISCV_ADD32 : *(u32 *)loc += val;break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 708/798 media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunke Cao <[email protected]>
[ Upstream commit 6a9c97ab6b7e85697e0b74e86062192a5ffffd99 ]
Clear vb2_plane's memory related fields in __vb2_plane_dmabuf_put(), including bytesused, length, fd and data_offset.
Remove the duplicated code in __prepare_dmabuf().
--- drivers/media/common/videobuf2/videobuf2-core.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/media/common/videobuf2/videobuf2-core.c +4 -4
@@ -302,6 +302,10 @@ static void __vb2_plane_dmabuf_put(struct vb2_buffer *vb, struct vb2_plane *p) p->mem_priv =NULL ; p->dbuf =NULL ; p->dbuf_mapped =0 ; + p->bytesused =0 ; + p->length =0 ; + p->m.fd =0 ; + p->data_offset =0 ; }/*
@@ -1310,10 +1314,6 @@ static int __prepare_dmabuf(struct vb2_buffer *vb)/* Release previously acquired memory if present */ __vb2_plane_dmabuf_put (vb, &vb->planes[plane]); - vb->planes[plane].bytesused =0 ; - vb->planes[plane].length =0 ; - vb->planes[plane].m.fd =0 ; - vb->planes[plane].data_offset =0 ;/* Acquire each plane's memory */ mem_priv = call_ptr_memop(attach_dmabuf,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 709/798 remoteproc: imx_rproc: Use imx specific hook for find_loaded_rsc_table
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit e954a1bd16102abc800629f9900715d8ec4c3130 ]
If there is a resource table device tree node, use the address as the resource table address, otherwise use the address(where .resource_table section loaded) inside the Cortex-M elf file.
And there is an update in NXP SDK that Resource Domain Control(RDC) enabled to protect TCM, linux not able to write the TCM space when updating resource table status and cause kernel dump. So use the address from device tree could avoid kernel dump.
Note: NXP M4 SDK not check resource table update, so it does not matter use whether resource table address specified in elf file or in device tree. But to reflect the fact that if people specific resource table address in device tree, it means people are aware and going to use it, not the address specified in elf file.
--- drivers/remoteproc/imx_rproc.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/remoteproc/imx_rproc.c +12 -1
@@ -537,6 +537,17 @@ static struct resource_table *imx_rproc_get_loaded_rsc_table(struct rproc *rprocreturn (struct resource_table *)priv->rsc_table; } +static struct resource_table * +imx_rproc_elf_find_loaded_rsc_table (struct rproc *rproc,const struct firmware *fw) +{ +struct imx_rproc *priv = rproc->priv; + +if (priv->rsc_table) +return (struct resource_table *)priv->rsc_table; + +return rproc_elf_find_loaded_rsc_table (rproc, fw); +} +static const struct rproc_ops imx_rproc_ops = { .prepare = imx_rproc_prepare, .attach = imx_rproc_attach,
@@ -546,7 +557,7 @@ static const struct rproc_ops imx_rproc_ops = { .da_to_va = imx_rproc_da_to_va, .load = rproc_elf_load_segments, .parse_fw = imx_rproc_parse_fw, - .find_loaded_rsc_table = rproc_elf_find_loaded_rsc_table, + .find_loaded_rsc_table = imx_rproc_elf_find_loaded_rsc_table, .get_loaded_rsc_table = imx_rproc_get_loaded_rsc_table, .sanity_check = rproc_elf_sanity_check, .get_boot_addr = rproc_elf_get_boot_addr,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 710/798 clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit a54c441b46a0745683c2eef5a359d22856d27323 ]
For i.MX7D DRAM related mux clock, the clock source change should ONLY be done done in low level asm code without accessing DRAM, and then calling clk API to sync the HW clock status with clk tree, it should never touch real clock source switch via clk API, so CLK_SET_PARENT_GATE flag should NOT be added, otherwise, DRAM's clock parent will be disabled when DRAM is active, and system will hang.
--- drivers/clk/imx/clk-imx7d.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/imx/clk-imx7d.c +2 -2
@@ -498,9 +498,9 @@ static void __init imx7d_clocks_init(struct device_node *ccm_node) hws[IMX7D_ENET_AXI_ROOT_SRC ] =imx_clk_hw_mux2_flags ("enet_axi_src" , base +0x8900 ,24 ,3 , enet_axi_sel,ARRAY_SIZE (enet_axi_sel),CLK_SET_PARENT_GATE ); hws[IMX7D_NAND_USDHC_BUS_ROOT_SRC ] =imx_clk_hw_mux2_flags ("nand_usdhc_src" , base +0x8980 ,24 ,3 , nand_usdhc_bus_sel,ARRAY_SIZE (nand_usdhc_bus_sel),CLK_SET_PARENT_GATE ); hws[IMX7D_DRAM_PHYM_ROOT_SRC ] =imx_clk_hw_mux2_flags ("dram_phym_src" , base +0x9800 ,24 ,1 , dram_phym_sel,ARRAY_SIZE (dram_phym_sel),CLK_SET_PARENT_GATE ); - hws[IMX7D_DRAM_ROOT_SRC ] =imx_clk_hw_mux2_flags ("dram_src" , base +0x9880 ,24 ,1 , dram_sel,ARRAY_SIZE (dram_sel),CLK_SET_PARENT_GATE ); + hws[IMX7D_DRAM_ROOT_SRC ] =imx_clk_hw_mux2 ("dram_src" , base +0x9880 ,24 ,1 , dram_sel,ARRAY_SIZE (dram_sel)); hws[IMX7D_DRAM_PHYM_ALT_ROOT_SRC ] =imx_clk_hw_mux2_flags ("dram_phym_alt_src" , base +0xa000 ,24 ,3 , dram_phym_alt_sel,ARRAY_SIZE (dram_phym_alt_sel),CLK_SET_PARENT_GATE ); - hws[IMX7D_DRAM_ALT_ROOT_SRC ] =imx_clk_hw_mux2_flags ("dram_alt_src" , base +0xa080 ,24 ,3 , dram_alt_sel,ARRAY_SIZE (dram_alt_sel),CLK_SET_PARENT_GATE ); + hws[IMX7D_DRAM_ALT_ROOT_SRC ] =imx_clk_hw_mux2 ("dram_alt_src" , base +0xa080 ,24 ,3 , dram_alt_sel,ARRAY_SIZE (dram_alt_sel)); hws[IMX7D_USB_HSIC_ROOT_SRC ] =imx_clk_hw_mux2_flags ("usb_hsic_src" , base +0xa100 ,24 ,3 , usb_hsic_sel,ARRAY_SIZE (usb_hsic_sel),CLK_SET_PARENT_GATE ); hws[IMX7D_PCIE_CTRL_ROOT_SRC ] =imx_clk_hw_mux2_flags ("pcie_ctrl_src" , base +0xa180 ,24 ,3 , pcie_ctrl_sel,ARRAY_SIZE (pcie_ctrl_sel),CLK_SET_PARENT_GATE ); hws[IMX7D_PCIE_PHY_ROOT_SRC ] =imx_clk_hw_mux2_flags ("pcie_phy_src" , base +0xa200 ,24 ,3 , pcie_phy_sel,ARRAY_SIZE (pcie_phy_sel),CLK_SET_PARENT_GATE );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 711/798 usb: chipidea: udc: enable suspend interrupt after usb reset
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
[ Upstream commit e4fdcc10092fb244218013bfe8ff01c55d54e8e4 ]
Currently, suspend interrupt is enabled before pullup enable operation. This will cause a suspend interrupt assert right after pullup DP. This suspend interrupt is meaningless, so this will ignore such interrupt by enable it after usb reset completed.
--- drivers/usb/chipidea/udc.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/usb/chipidea/udc.c +7 -1
@@ -86,7 +86,7 @@ static int hw_device_state(struct ci_hdrc *ci, u32 dma)hw_write (ci,OP_ENDPTLISTADDR , ~0 , dma);/* interrupt, error, port change, reset, sleep/suspend */ hw_write (ci,OP_USBINTR , ~0 , - USBi_UI|USBi_UEI|USBi_PCI|USBi_URI|USBi_SLI); + USBi_UI|USBi_UEI|USBi_PCI|USBi_URI); }else {hw_write (ci,OP_USBINTR , ~0 ,0 ); }
@@ -876,6 +876,7 @@ __releases(ci->lock) __acquires(ci->lock) {int retval; +u32 intr;spin_unlock (&ci->lock);if (ci->gadget.speed !=USB_SPEED_UNKNOWN )
@@ -889,6 +890,11 @@ __acquires(ci->lock)if (retval) goto done; +/* clear SLI */ +hw_write (ci,OP_USBSTS , USBi_SLI, USBi_SLI); + intr =hw_read (ci,OP_USBINTR , ~0 ); +hw_write (ci,OP_USBINTR , ~0 , intr | USBi_SLI); + ci->status =usb_ep_alloc_request (&ci->ep0in->ep,GFP_ATOMIC );if (ci->status ==NULL ) retval = -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 712/798 usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the Crashkernel Scenario
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Shao <[email protected]>
[ Upstream commit 4058c39bd176daf11a826802d940d86292a6b02b ]
The issue is that before entering the crash kernel, the DWC USB controller did not perform operations such as resetting the interrupt mask bits. After entering the crash kernel,before the USB interrupt handler registration was completed while loading the DWC USB driver,an GINTSTS_SOF interrupt was received.This triggered the misroute_irq process within the GIC handling framework,ultimately leading to the misrouting of the interrupt,causing it to be handled by the wrong interrupt handler and resulting in the issue.
Summary:In a scenario where the kernel triggers a panic and enters the crash kernel,it is necessary to ensure that the interrupt mask bit is not enabled before the interrupt registration is complete. If an interrupt reaches the CPU at this moment,it will certainly not be handled correctly,especially in cases where this interrupt is reported frequently.
Please refer to the Crashkernel dmesg information as follows (the message on line 3 was added before devm_request_irq is called by the dwc2_driver_probe function):
[ 5.866837][ T1] dwc2 JMIC0010:01: supply vusb_d not found, using dummy regulator [ 5.874588][ T1] dwc2 JMIC0010:01: supply vusb_a not found, using dummy regulator [ 5.882335][ T1] dwc2 JMIC0010:01: before devm_request_irq irq: [71], gintmsk[0xf300080e], gintsts[0x04200009] [ 5.892686][ C0] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.10.0-jmnd1.2_RC #18 [ 5.900327][ C0] Hardware name: CMSS HyperCard4-25G/HyperCard4-25G, BIOS 1.6.4 Jul 8 2024 [ 5.908836][ C0] Call trace: [ 5.911965][ C0] dump_backtrace+0x0/0x1f0 [ 5.916308][ C0] show_stack+0x20/0x30 [ 5.920304][ C0] dump_stack+0xd8/0x140 [ 5.924387][ C0] pcie_xxx_handler+0x3c/0x1d8 [ 5.930121][ C0] __handle_irq_event_percpu+0x64/0x1e0 [ 5.935506][ C0] handle_irq_event+0x80/0x1d0 [ 5.940109][ C0] try_one_irq+0x138/0x174 [ 5.944365][ C0] misrouted_irq+0x134/0x140 [ 5.948795][ C0] note_interrupt+0x1d0/0x30c [ 5.953311][ C0] handle_irq_event+0x13c/0x1d0 [ 5.958001][ C0] handle_fasteoi_irq+0xd4/0x260 [ 5.962779][ C0] __handle_domain_irq+0x88/0xf0 [ 5.967555][ C0] gic_handle_irq+0x9c/0x2f0 [ 5.971985][ C0] el1_irq+0xb8/0x140 [ 5.975807][ C0] __setup_irq+0x3dc/0x7cc [ 5.980064][ C0] request_threaded_irq+0xf4/0x1b4 [ 5.985015][ C0] devm_request_threaded_irq+0x80/0x100 [ 5.990400][ C0] dwc2_driver_probe+0x1b8/0x6b0 [ 5.995178][ C0] platform_drv_probe+0x5c/0xb0 [ 5.999868][ C0] really_probe+0xf8/0x51c [ 6.004125][ C0] driver_probe_device+0xfc/0x170 [ 6.008989][ C0] device_driver_attach+0xc8/0xd0 [ 6.013853][ C0] __driver_attach+0xe8/0x1b0 [ 6.018369][ C0] bus_for_each_dev+0x7c/0xdc [ 6.022886][ C0] driver_attach+0x2c/0x3c [ 6.027143][ C0] bus_add_driver+0xdc/0x240 [ 6.031573][ C0] driver_register+0x80/0x13c [ 6.036090][ C0] __platform_driver_register+0x50/0x5c [ 6.041476][ C0] dwc2_platform_driver_init+0x24/0x30 [ 6.046774][ C0] do_one_initcall+0x50/0x25c [ 6.051291][ C0] do_initcall_level+0xe4/0xfc [ 6.055894][ C0] do_initcalls+0x80/0xa4 [ 6.060064][ C0] kernel_init_freeable+0x198/0x240 [ 6.065102][ C0] kernel_init+0x1c/0x12c
--- drivers/usb/dwc2/platform.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-)
drivers/usb/dwc2/platform.c +14 -12
@@ -438,18 +438,6 @@ static int dwc2_driver_probe(struct platform_device *dev)spin_lock_init (&hsotg->lock); - hsotg->irq =platform_get_irq (dev,0 ); -if (hsotg->irq <0 ) -return hsotg->irq; - -dev_dbg (hsotg->dev,"registering common handler for irq%d\n" , - hsotg->irq); - retval =devm_request_irq (hsotg->dev, hsotg->irq, - dwc2_handle_common_intr,IRQF_SHARED , -dev_name (hsotg->dev), hsotg); -if (retval) -return retval; - hsotg->vbus_supply =devm_regulator_get_optional (hsotg->dev,"vbus" );if (IS_ERR (hsotg->vbus_supply)) { retval =PTR_ERR (hsotg->vbus_supply);
@@ -493,6 +481,20 @@ static int dwc2_driver_probe(struct platform_device *dev)if (retval) goto error; + hsotg->irq =platform_get_irq (dev,0 ); +if (hsotg->irq <0 ) { + retval = hsotg->irq; + goto error; + } + +dev_dbg (hsotg->dev,"registering common handler for irq%d\n" , + hsotg->irq); + retval =devm_request_irq (hsotg->dev, hsotg->irq, + dwc2_handle_common_intr,IRQF_SHARED , +dev_name (hsotg->dev), hsotg); +if (retval) + goto error; +/* * For OTG cores, set the force mode bits to reflect the value * of dr_mode. Force mode bits should not be touched at any
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 713/798 comedi: ni_routing: tools: Check when the file could not be opened
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruffalo Lavoisier <[email protected]>
[ Upstream commit 5baeb157b341b1d26a5815aeaa4d3bb9e0444fda ]
- After fopen check NULL before using the file pointer use
--- drivers/comedi/drivers/ni_routing/tools/convert_c_to_py.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/comedi/drivers/ni_routing/tools/convert_c_to_py.c +5 -0
@@ -140,6 +140,11 @@ int main(void) {FILE *fp =fopen ("ni_values.py" ,"w" ); +if (fp ==NULL ) { +fprintf (stderr,"Could not open file!" ); +return -1 ; + } +/* write route register values */ fprintf (fp,"ni_route_values = {\n" );for (int i =0 ; ni_all_route_values[i]; ++i)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 714/798 LoongArch: Fix memleak in pci_acpi_scan_root()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Guan <[email protected]>
[ Upstream commit 5016c3a31a6d74eaf2fdfdec673eae8fcf90379e ]
Add kfree(root_ops) in this case to avoid memleak of root_ops, leaks when pci_find_bus() != 0.
--- arch/loongarch/pci/acpi.c | 1 + 1 file changed, 1 insertion(+)
arch/loongarch/pci/acpi.c +1 -0
@@ -222,6 +222,7 @@ struct pci_bus *pci_acpi_scan_root(struct acpi_pci_root *root)if (bus) {memcpy (bus->sysdata, info->cfg,sizeof (struct pci_config_window ));kfree (info); +kfree (root_ops); }else {struct pci_bus *child;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 715/798 netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit fc56878ca1c288e49b5cbb43860a5938e3463654 ]
If CONFIG_BRIDGE_NETFILTER is not enabled, which is the case for x86_64 defconfig, then building nf_reject_ipv4.c and nf_reject_ipv6.c with W=1 using gcc-14 results in the following warnings, which are treated as errors:
net/ipv4/netfilter/nf_reject_ipv4.c: In function 'nf_send_reset':net/ipv4/netfilter/nf_reject_ipv4.c:243:23: error: variable 'niph' set but not used [-Werror=unused-but-set-variable]
243 | struct iphdr *niph;
| ^~~~
cc1: all warnings being treated as errorsnet/ipv6/netfilter/nf_reject_ipv6.c: In function 'nf_send_reset6':net/ipv6/netfilter/nf_reject_ipv6.c:286:25: error: variable 'ip6h' set but not used [-Werror=unused-but-set-variable]
286 | struct ipv6hdr *ip6h;
| ^~~~
cc1: all warnings being treated as errors
Address this by reducing the scope of these local variables to where they are used, which is code only compiled when CONFIG_BRIDGE_NETFILTER enabled.
Compile tested and run through netfilter selftests.
--- net/ipv4/netfilter/nf_reject_ipv4.c | 10 ++++------ net/ipv6/netfilter/nf_reject_ipv6.c | 5 ++--- 2 files changed, 6 insertions(+), 9 deletions(-)
net/ipv4/netfilter/nf_reject_ipv4.c +4 -6
@@ -239,9 +239,8 @@ static int nf_reject_fill_skb_dst(struct sk_buff *skb_in)void nf_send_reset (struct net *net,struct sock *sk,struct sk_buff *oldskb,int hook) { -struct sk_buff *nskb; -struct iphdr *niph;const struct tcphdr *oth; +struct sk_buff *nskb;struct tcphdr _oth; oth =nf_reject_ip_tcphdr_get (oldskb, &_oth, hook);
@@ -266,14 +265,12 @@ void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb, nskb->mark =IP4_REPLY_MARK (net, oldskb->mark);skb_reserve (nskb,LL_MAX_HEADER ); - niph =nf_reject_iphdr_put (nskb, oldskb,IPPROTO_TCP , -ip4_dst_hoplimit (skb_dst (nskb))); +nf_reject_iphdr_put (nskb, oldskb,IPPROTO_TCP , +ip4_dst_hoplimit (skb_dst (nskb)));nf_reject_ip_tcphdr_put (nskb, oldskb, oth);if (ip_route_me_harder (net, sk, nskb,RTN_UNSPEC )) goto free_nskb; - niph =ip_hdr (nskb); -/* "Never happens" */ if (nskb->len >dst_mtu (skb_dst (nskb))) goto free_nskb;
@@ -290,6 +287,7 @@ void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb,*/ if (nf_bridge_info_exists (oldskb)) {struct ethhdr *oeth =eth_hdr (oldskb); +struct iphdr *niph =ip_hdr (nskb);struct net_device *br_indev; br_indev =nf_bridge_get_physindev (oldskb, net);
net/ipv6/netfilter/nf_reject_ipv6.c +2 -3
@@ -273,7 +273,6 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb,const struct tcphdr *otcph;unsigned int otcplen, hh_len;const struct ipv6hdr *oip6h =ipv6_hdr (oldskb); -struct ipv6hdr *ip6h;struct dst_entry *dst =NULL ;struct flowi6 fl6;
@@ -329,8 +328,7 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb, nskb->mark = fl6.flowi6_mark;skb_reserve (nskb, hh_len + dst->header_len); - ip6h =nf_reject_ip6hdr_put (nskb, oldskb,IPPROTO_TCP , -ip6_dst_hoplimit (dst)); +nf_reject_ip6hdr_put (nskb, oldskb,IPPROTO_TCP ,ip6_dst_hoplimit (dst));nf_reject_ip6_tcphdr_put (nskb, oldskb, otcph, otcplen);nf_ct_attach (nskb, oldskb);
@@ -345,6 +343,7 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb,*/ if (nf_bridge_info_exists (oldskb)) {struct ethhdr *oeth =eth_hdr (oldskb); +struct ipv6hdr *ip6h =ipv6_hdr (nskb);struct net_device *br_indev; br_indev =nf_bridge_get_physindev (oldskb, net);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 716/798 virtio_pmem: Check device status before requesting flush
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philip Chen <[email protected]>
[ Upstream commit e25fbcd97cf52c3c9824d44b5c56c19673c3dd50 ]
If a pmem device is in a bad status, the driver side could wait for host ack forever in virtio_pmem_flush(), causing the system to hang.
So add a status check in the beginning of virtio_pmem_flush() to return early if the device is not activated.
Message-Id: <[email protected]>
--- drivers/nvdimm/nd_virtio.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/nvdimm/nd_virtio.c +9 -0
@@ -44,6 +44,15 @@ static int virtio_pmem_flush(struct nd_region *nd_region)unsigned long flags;int err, err1; +/* +* Don't bother to submit the request to the device if the device is +* not activated. +*/ +if (vdev->config->get_status (vdev) &VIRTIO_CONFIG_S_NEEDS_RESET ) { +dev_info (&vdev->dev,"virtio pmem device needs a reset\n" ); +return -EIO ; + } +might_sleep (); req_data =kmalloc (sizeof (*req_data),GFP_KERNEL );if (!req_data)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 717/798 tools/iio: Add memory allocation failure check for trigger_name
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Jun <[email protected]>
[ Upstream commit 3c6b818b097dd6932859bcc3d6722a74ec5931c1 ]
Added a check to handle memory allocation failure for trigger_name and return -ENOMEM.
--- tools/iio/iio_generic_buffer.c | 4 ++++ 1 file changed, 4 insertions(+)
tools/iio/iio_generic_buffer.c +4 -0
@@ -498,6 +498,10 @@ int main(int argc, char **argv)return -ENOMEM ; } trigger_name =malloc (IIO_MAX_NAME_LENGTH ); +if (!trigger_name) { + ret = -ENOMEM ; + goto error; + } ret =read_sysfs_string ("name" , trig_dev_name, trigger_name);free (trig_dev_name);if (ret <0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 718/798 staging: vme_user: added bound check to geoid
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Riyan Dhiman <[email protected]>
[ Upstream commit a8a8b54350229f59c8ba6496fb5689a1632a59be ]
The geoid is a module parameter that allows users to hardcode the slot number. A bound check for geoid was added in the probe function because only values between 0 and less than VME_MAX_SLOT are valid.
--- drivers/staging/vme_user/vme_fake.c | 6 ++++++ drivers/staging/vme_user/vme_tsi148.c | 6 ++++++ 2 files changed, 12 insertions(+)
drivers/staging/vme_user/vme_fake.c +6 -0
@@ -1071,6 +1071,12 @@ static int __init fake_init(void)struct vme_slave_resource *slave_image;struct vme_lm_resource *lm; +if (geoid <0 || geoid >=VME_MAX_SLOTS ) { +pr_err ("VME geographical address must be between 0 and %d (exclusive), but got %d\n" , +VME_MAX_SLOTS , geoid); +return -EINVAL ; + } +/* We need a fake parent device */ vme_root =__root_device_register ("vme" ,THIS_MODULE );if (IS_ERR (vme_root))
drivers/staging/vme_user/vme_tsi148.c +6 -0
@@ -2261,6 +2261,12 @@ static int tsi148_probe(struct pci_dev *pdev, const struct pci_device_id *id)struct vme_dma_resource *dma_ctrlr;struct vme_lm_resource *lm; +if (geoid <0 || geoid >=VME_MAX_SLOTS ) { +dev_err (&pdev->dev,"VME geographical address must be between 0 and %d (exclusive), but got %d\n" , +VME_MAX_SLOTS , geoid); +return -EINVAL ; + } +/* If we want to support more than one of each bridge, we need to * dynamically generate this so we get one per device */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 719/798 driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
[ Upstream commit c0fd973c108cdc22a384854bc4b3e288a9717bb2 ]
Return -EIO instead of 0 for below erroneous bus attribute operations:
- read a bus attribute without show().
- write a bus attribute without store().
--- drivers/base/bus.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/base/bus.c +4 -2
@@ -104,7 +104,8 @@ static ssize_t bus_attr_show(struct kobject *kobj, struct attribute *attr, {struct bus_attribute *bus_attr =to_bus_attr (attr);struct subsys_private *subsys_priv =to_subsys_private (kobj); -ssize_t ret =0 ; +/* return -EIO for reading a bus attribute without show() */ +ssize_t ret = -EIO ;if (bus_attr->show) ret = bus_attr->show (subsys_priv->bus, buf);
@@ -116,7 +117,8 @@ static ssize_t bus_attr_store(struct kobject *kobj, struct attribute *attr, {struct bus_attribute *bus_attr =to_bus_attr (attr);struct subsys_private *subsys_priv =to_subsys_private (kobj); -ssize_t ret =0 ; +/* return -EIO for writing a bus attribute without store() */ +ssize_t ret = -EIO ;if (bus_attr->store) ret = bus_attr->store (subsys_priv->bus, buf, count);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 720/798 scsi: lpfc: Add ELS_RSP cmd to the list of WQEs to flush in lpfc_els_flush_cmd()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 93bcc5f3984bf4f51da1529700aec351872dbfff ]
During HBA stress testing, a spam of received PLOGIs exposes a resource recovery bug causing leakage of lpfc_sqlq entries from the global phba->sli4_hba.lpfc_els_sgl_list.
The issue is in lpfc_els_flush_cmd(), where the driver attempts to recover outstanding ELS sgls when walking the txcmplq. Only CMD_ELS_REQUEST64_CRs and CMD_GEN_REQUEST64_CRs are added to the abort and cancel lists. A check for CMD_XMIT_ELS_RSP64_WQE is missing in order to recover LS_ACC usages of the phba->sli4_hba.lpfc_els_sgl_list too.
Fix by adding CMD_XMIT_ELS_RSP64_WQE as part of the txcmplq walk when adding WQEs to the abort and cancel list in lpfc_els_flush_cmd(). Also, update naming convention from CRs to WQEs.
--- drivers/scsi/lpfc/lpfc_els.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/scsi/lpfc/lpfc_els.c +4 -3
@@ -9455,11 +9455,12 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport)if (piocb->cmd_flag &LPFC_DRIVER_ABORTED && !mbx_tmo_err)continue ; -/* On the ELS ring we can have ELS_REQUESTs or -* GEN_REQUESTs waiting for a response. +/* On the ELS ring we can have ELS_REQUESTs, ELS_RSPs, +* or GEN_REQUESTs waiting for a CQE response. */ ulp_command =get_job_cmnd (phba, piocb); -if (ulp_command ==CMD_ELS_REQUEST64_CR ) { +if (ulp_command ==CMD_ELS_REQUEST64_WQE || + ulp_command ==CMD_XMIT_ELS_RSP64_WQE ) {list_add_tail (&piocb->dlist, &abort_list);/* If the link is down when flushing ELS commands
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 721/798 scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 0a3c84f71680684c1d41abb92db05f95c09111e8 ]
Deleting an NPIV instance requires all fabric ndlps to be released before an NPIV's resources can be torn down. Failure to release fabric ndlps beforehand opens kref imbalance race conditions. Fix by forcing the DA_ID to complete synchronously with usage of wait_queue.
--- drivers/scsi/lpfc/lpfc_ct.c | 12 ++++++++++ drivers/scsi/lpfc/lpfc_disc.h | 7 ++++++ drivers/scsi/lpfc/lpfc_vport.c | 43 ++++++++++++++++++++++++++++------ 3 files changed, 55 insertions(+), 7 deletions(-)
drivers/scsi/lpfc/lpfc_ct.c +12 -0
@@ -1663,6 +1663,18 @@ lpfc_cmpl_ct(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, } out: +/* If the caller wanted a synchronous DA_ID completion, signal the +* wait obj and clear flag to reset the vport. +*/ +if (ndlp->save_flags &NLP_WAIT_FOR_DA_ID ) { +if (ndlp->da_id_waitq) +wake_up (ndlp->da_id_waitq); + } + +spin_lock_irq (&ndlp->lock); + ndlp->save_flags &= ~NLP_WAIT_FOR_DA_ID ; +spin_unlock_irq (&ndlp->lock); +lpfc_ct_free_iocb (phba, cmdiocb);lpfc_nlp_put (ndlp);return ;
drivers/scsi/lpfc/lpfc_disc.h +7 -0
@@ -90,6 +90,8 @@ enum lpfc_nlp_save_flags {NLP_IN_RECOV_POST_DEV_LOSS =0x1 ,/* wait for outstanding LOGO to cmpl */ NLP_WAIT_FOR_LOGO =0x2 , +/* wait for outstanding DA_ID to finish */ +NLP_WAIT_FOR_DA_ID =0x4 }; struct lpfc_nodelist {
@@ -159,7 +161,12 @@ struct lpfc_nodelist {uint32_t nvme_fb_size;/* NVME target's supported byte cnt */ #define NVME_FB_BIT_SHIFT 9/* PRLI Rsp first burst in 512B units. */ uint32_t nlp_defer_did; + +/* These wait objects are NPIV specific. These IOs must complete +* synchronously. +*/ wait_queue_head_t *logo_waitq; +wait_queue_head_t *da_id_waitq; };struct lpfc_node_rrq {
drivers/scsi/lpfc/lpfc_vport.c +36 -7
63 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 722/798 drm/amd/display: Check null pointer before dereferencing se
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit ff599ef6970ee000fa5bc38d02fa5ff5f3fc7575 ]
[WHAT & HOW]
se is null checked previously in the same function, indicating it might be null; therefore, it must be checked when used again.
This fixes 1 FORWARD_NULL issue reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc.c +1 -1
@@ -1659,7 +1659,7 @@ bool dc_validate_boot_timing(const struct dc *dc,if (crtc_timing->pix_clk_100hz != pix_clk_100hz)return false; -if (!se->funcs->dp_get_pixel_format) +if (!se || !se->funcs->dp_get_pixel_format)return false; if (!se->funcs->dp_get_pixel_format(
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 723/798 fbcon: Fix a NULL pointer dereference issue in fbcon_putcs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianqiang Liu <[email protected]>
[ Upstream commit 5b97eebcce1b4f3f07a71f635d6aa3af96c236e7 ]
syzbot has found a NULL pointer dereference bug in fbcon. Here is the simplified C reproducer:
struct param {
uint8_t type;
struct tiocl_selection ts;
};int main()
{
struct fb_con2fbmap con2fb;
struct param param;
int fd = open("/dev/fb1", 0, 0);
con2fb.console = 0x19;
con2fb.framebuffer = 0;
ioctl(fd, FBIOPUT_CON2FBMAP, &con2fb);
param.type = 2;
param.ts.xs = 0; param.ts.ys = 0;
param.ts.xe = 0; param.ts.ye = 0;
param.ts.sel_mode = 0;
int fd1 = open("/dev/tty1", O_RDWR, 0);
ioctl(fd1, TIOCLINUX, ¶m);
con2fb.console = 1;
con2fb.framebuffer = 0;
ioctl(fd, FBIOPUT_CON2FBMAP, &con2fb);
return 0;
}After calling ioctl(fd1, TIOCLINUX, ¶m), the subsequent ioctl(fd, FBIOPUT_CON2FBMAP, &con2fb) causes the kernel to follow a different execution path:
set_con2fb_map
-> con2fb_init_display
-> fbcon_set_disp
-> redraw_screen
-> hide_cursor
-> clear_selection
-> highlight
-> invert_screen
-> do_update_region
-> fbcon_putcs
-> ops->putcsSince ops->putcs is a NULL pointer, this leads to a kernel panic. To prevent this, we need to call set_blitting_type() within set_con2fb_map() to properly initialize ops->putcs.
--- drivers/video/fbdev/core/fbcon.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/video/fbdev/core/fbcon.c +2 -0
@@ -847,6 +847,8 @@ static int set_con2fb_map(int unit, int newidx, int user)return err;fbcon_add_cursor_work (info); + }else if (vc) { +set_blitting_type (vc, info); } con2fb_map[unit] = newidx;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 724/798 fbdev: sisfb: Fix strbuf array overflow
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Shumilin <[email protected]>
[ Upstream commit 9cf14f5a2746c19455ce9cb44341b5527b5e19c3 ]
The values of the variables xres and yres are placed in strbuf. These variables are obtained from strbuf1.
The strbuf1 array contains digit characters
and a space if the array contains non-digit characters. Then, when executing sprintf(strbuf, "%ux%ux8", xres, yres); more than 16 bytes will be written to strbuf.
It is suggested to increase the size of the strbuf array to 24.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/video/fbdev/sis/sis_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/sis/sis_main.c +1 -1
@@ -184,7 +184,7 @@ static void sisfb_search_mode(char *name, bool quiet) {unsigned int j =0 , xres =0 , yres =0 , depth =0 , rate =0 ;int i =0 ; -char strbuf[16 ], strbuf1[20 ]; +char strbuf[24 ], strbuf1[20 ];char *nameptr = name;/* We don't know the hardware specs yet and there is no ivideo */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 725/798 drm/rockchip: vop: limit maximum resolution to hardware capabilities
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sascha Hauer <[email protected]>
[ Upstream commit 8e140cb60270ee8b5b41e80806323c668d8d4da9 ]
The different VOP variants support different maximum resolutions. Reject resolutions that are not supported by a specific variant.
This hasn't been a problem in the upstream driver so far as 1920x1080 has been the maximum resolution supported by the HDMI driver and that resolution is supported by all VOP variants. Now with higher resolutions supported in the HDMI driver we have to limit the resolutions to the ones supported by the VOP.
The actual maximum resolutions are taken from the Rockchip downstream Kernel.
[dropped the vdisplay > height check after talking to Sascha, as according to
the vendor code "Actually vop hardware has no output height limit" (from vendor commit "drm/rockchip: vop: get rid of max_output.height check") and the height-check broke the px30-minievb display]
Stable-dep-of: 6ed51ba95e27 ("drm/rockchip: vop: enable VOP_FEATURE_INTERNAL_RGB on RK3066")
--- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 12 ++++++++++++ drivers/gpu/drm/rockchip/rockchip_drm_vop.h | 6 ++++++ drivers/gpu/drm/rockchip/rockchip_drm_vop2.h | 5 ----- drivers/gpu/drm/rockchip/rockchip_vop_reg.c | 18 ++++++++++++++++++ 4 files changed, 36 insertions(+), 5 deletions(-)
drivers/gpu/drm/rockchip/rockchip_drm_vop.c +12 -0
@@ -1183,6 +1183,17 @@ static void vop_crtc_disable_vblank(struct drm_crtc *crtc)spin_unlock_irqrestore (&vop->irq_lock, flags); } +static enum drm_mode_status vop_crtc_mode_valid (struct drm_crtc *crtc, +const struct drm_display_mode *mode) +{ +struct vop *vop =to_vop (crtc); + +if (vop->data->max_output.width && mode->hdisplay > vop->data->max_output.width) +return MODE_BAD_HVALUE ; + +return MODE_OK ; +} +static bool vop_crtc_mode_fixup (struct drm_crtc *crtc,const struct drm_display_mode *mode,struct drm_display_mode *adjusted_mode)
@@ -1598,6 +1609,7 @@ static void vop_crtc_atomic_flush(struct drm_crtc *crtc, }static const struct drm_crtc_helper_funcs vop_crtc_helper_funcs = { + .mode_valid = vop_crtc_mode_valid, .mode_fixup = vop_crtc_mode_fixup, .atomic_check = vop_crtc_atomic_check, .atomic_begin = vop_crtc_atomic_begin,
drivers/gpu/drm/rockchip/rockchip_drm_vop.h +6 -0
@@ -42,6 +42,11 @@ enum vop_data_format { VOP_FMT_YUV444SP, }; +struct vop_rect { +int width; +int height; +}; +struct vop_reg {uint32_t mask;uint16_t offset;
@@ -226,6 +231,7 @@ struct vop_data {const struct vop_win_data *win;unsigned int win_size;unsigned int lut_size; +struct vop_rect max_output;#define VOP_FEATURE_OUTPUT_RGB10 BIT(0)#define VOP_FEATURE_INTERNAL_RGB BIT(1)
drivers/gpu/drm/rockchip/rockchip_drm_vop2.h +0 -5
@@ -27,11 +27,6 @@ enum win_dly_mode { VOP2_DLY_MODE_MAX, }; -struct vop_rect { -int width; -int height; -}; -enum vop2_scale_up_mode {VOP2_SCALE_UP_NRST_NBOR ,VOP2_SCALE_UP_BIL ,
drivers/gpu/drm/rockchip/rockchip_vop_reg.c +18 -0
@@ -181,6 +181,7 @@ static const struct vop_data rk3036_vop = { .output = &rk3036_output, .win = rk3036_vop_win_data, .win_size = ARRAY_SIZE(rk3036_vop_win_data), + .max_output = { 1920, 1080 }, }; static const struct vop_win_phy rk3126_win1_data = {
@@ -213,6 +214,7 @@ static const struct vop_data rk3126_vop = { .output = &rk3036_output, .win = rk3126_vop_win_data, .win_size = ARRAY_SIZE(rk3126_vop_win_data), + .max_output = { 1920, 1080 }, }; static const int px30_vop_intrs[] = {
@@ -340,6 +342,7 @@ static const struct vop_data px30_vop_big = { .output = &px30_output, .win = px30_vop_big_win_data, .win_size = ARRAY_SIZE(px30_vop_big_win_data), + .max_output = { 1920, 1080 }, }; static const struct vop_win_data px30_vop_lit_win_data[] = {
@@ -356,6 +359,7 @@ static const struct vop_data px30_vop_lit = { .output = &px30_output, .win = px30_vop_lit_win_data, .win_size = ARRAY_SIZE(px30_vop_lit_win_data), + .max_output = { 1920, 1080 }, }; static const struct vop_scl_regs rk3066_win_scl = {
@@ -480,6 +484,7 @@ static const struct vop_data rk3066_vop = { .output = &rk3066_output, .win = rk3066_vop_win_data, .win_size = ARRAY_SIZE(rk3066_vop_win_data), + .max_output = { 1920, 1080 }, }; static const struct vop_scl_regs rk3188_win_scl = {
@@ -586,6 +591,7 @@ static const struct vop_data rk3188_vop = { .win = rk3188_vop_win_data, .win_size = ARRAY_SIZE(rk3188_vop_win_data), .feature = VOP_FEATURE_INTERNAL_RGB, + .max_output = { 2048, 1536 }, }; static const struct vop_scl_extension rk3288_win_full_scl_ext = {
@@ -733,6 +739,12 @@ static const struct vop_data rk3288_vop = { .win = rk3288_vop_win_data, .win_size = ARRAY_SIZE(rk3288_vop_win_data), .lut_size = 1024, +/* +* This is the maximum resolution for the VOPB, the VOPL can only do +* 2560x1600, but we can't distinguish them as they have the same +* compatible. +*/ + .max_output = { 3840, 2160 }, }; static const int rk3368_vop_intrs[] = {
@@ -834,6 +846,7 @@ static const struct vop_data rk3368_vop = { .misc = &rk3368_misc, .win = rk3368_vop_win_data, .win_size = ARRAY_SIZE(rk3368_vop_win_data), + .max_output = { 4096, 2160 }, }; static const struct vop_intr rk3366_vop_intr = {
@@ -855,6 +868,7 @@ static const struct vop_data rk3366_vop = { .misc = &rk3368_misc, .win = rk3368_vop_win_data, .win_size = ARRAY_SIZE(rk3368_vop_win_data), + .max_output = { 4096, 2160 }, }; static const struct vop_output rk3399_output = {
@@ -985,6 +999,7 @@ static const struct vop_data rk3399_vop_big = { .win_size = ARRAY_SIZE(rk3399_vop_win_data), .win_yuv2yuv = rk3399_vop_big_win_yuv2yuv_data, .lut_size = 1024, + .max_output = { 4096, 2160 }, }; static const struct vop_win_data rk3399_vop_lit_win_data[] = {
@@ -1011,6 +1026,7 @@ static const struct vop_data rk3399_vop_lit = { .win_size = ARRAY_SIZE(rk3399_vop_lit_win_data), .win_yuv2yuv = rk3399_vop_lit_win_yuv2yuv_data, .lut_size = 256, + .max_output = { 2560, 1600 }, }; static const struct vop_win_data rk3228_vop_win_data[] = {
@@ -1030,6 +1046,7 @@ static const struct vop_data rk3228_vop = { .misc = &rk3368_misc, .win = rk3228_vop_win_data, .win_size = ARRAY_SIZE(rk3228_vop_win_data), + .max_output = { 4096, 2160 }, }; static const struct vop_modeset rk3328_modeset = {
@@ -1101,6 +1118,7 @@ static const struct vop_data rk3328_vop = { .misc = &rk3328_misc, .win = rk3328_vop_win_data, .win_size = ARRAY_SIZE(rk3328_vop_win_data), + .max_output = { 4096, 2160 }, }; static const struct of_device_id vop_driver_dt_match[] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 726/798 drm/rockchip: vop: enable VOP_FEATURE_INTERNAL_RGB on RK3066
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Val Packett <[email protected]>
[ Upstream commit 6ed51ba95e27221ce87979bd2ad5926033b9e1b9 ]
The RK3066 does have RGB display output, so it should be marked as such.
--- drivers/gpu/drm/rockchip/rockchip_vop_reg.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/rockchip/rockchip_vop_reg.c +1 -0
@@ -484,6 +484,7 @@ static const struct vop_data rk3066_vop = { .output = &rk3066_output, .win = rk3066_vop_win_data, .win_size = ARRAY_SIZE(rk3066_vop_win_data), + .feature = VOP_FEATURE_INTERNAL_RGB, .max_output = { 1920, 1080 }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 727/798 NFSD: Mark filecache "down" if init fails
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit dc0d0f885aa422f621bc1c2124133eff566b0bc8 ]
NeilBrown says:
Quoted 4 lines
The handling of
NFSD_FILE_CACHE_UPis strange.nfsd_file_cache_init()sets it, but doesn't clear it on failure. So ifnfsd_file_cache_init()fails for some reason,nfsd_file_cache_shutdown()would still try to clean up if it was called.
--- fs/nfsd/filecache.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/nfsd/filecache.c +3 -1
@@ -718,7 +718,7 @@ nfsd_file_cache_init(void) ret =rhltable_init (&nfsd_file_rhltable, &nfsd_file_rhash_params);if (ret) -return ret; + goto out; ret = -ENOMEM ; nfsd_filecache_wq =alloc_workqueue ("nfsd_filecache" ,0 ,0 );
@@ -770,6 +770,8 @@ nfsd_file_cache_init(void)INIT_DELAYED_WORK (&nfsd_filecache_laundrette, nfsd_file_gc_worker); out: +if (ret) +clear_bit (NFSD_FILE_CACHE_UP , &nfsd_file_flags);return ret; out_notifier:lease_unregister_notifier (&nfsd_file_lease_notifier);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 728/798 ice: fix VLAN replay after reset
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Ertman <[email protected]>
[ Upstream commit 0eae2c136cb624e4050092feb59f18159b4f2512 ]
There is a bug currently when there are more than one VLAN defined and any reset that affects the PF is initiated, after the reset rebuild no traffic will pass on any VLAN but the last one created.
This is caused by the iteration though the VLANs during replay each clearing the vsi_map bitmap of the VSI that is being replayed. The problem is that during rhe replay, the pointer to the vsi_map bitmap is used by each successive vlan to determine if it should be replayed on this VSI.
The logic was that the replay of the VLAN would replace the bit in the map before the next VLAN would iterate through. But, since the replay copies the old bitmap pointer to filt_replay_rules and creates a new one for the recreated VLANS, it does not do this, and leaves the old bitmap broken to be used to replay the remaining VLANs.
Since the old bitmap will be cleaned up in post replay cleanup, there is no need to alter it and break following VLAN replay, so don't clear the bit.
--- drivers/net/ethernet/intel/ice/ice_switch.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/ethernet/intel/ice/ice_switch.c +0 -2
@@ -6317,8 +6317,6 @@ ice_replay_vsi_fltr(struct ice_hw *hw, u16 vsi_handle, u8 recp_id,if (!itr->vsi_list_info || !test_bit (vsi_handle, itr->vsi_list_info->vsi_map))continue ; -/* Clearing it so that the logic can add it back */ -clear_bit (vsi_handle, itr->vsi_list_info->vsi_map); f_entry.fltr_info.vsi_handle = vsi_handle; f_entry.fltr_info.fltr_act =ICE_FWD_TO_VSI ;/* update the src in case it is VSI num */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 729/798 SUNRPC: Fix integer overflow in decode_rc_list()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 6dbf1f341b6b35bcc20ff95b6b315e509f6c5369 ]
The math in "rc_list->rcl_nrefcalls * 2 * sizeof(uint32_t)" could have an integer overflow. Add bounds checking on rc_list->rcl_nrefcalls to fix that.
--- fs/nfs/callback_xdr.c | 2 ++ 1 file changed, 2 insertions(+)
fs/nfs/callback_xdr.c +2 -0
@@ -372,6 +372,8 @@ static __be32 decode_rc_list(struct xdr_stream *xdr, rc_list->rcl_nrefcalls =ntohl (*p++);if (rc_list->rcl_nrefcalls) { +if (unlikely (rc_list->rcl_nrefcalls > xdr->buf->len)) + goto out; p =xdr_inline_decode (xdr, rc_list->rcl_nrefcalls *2 *sizeof (uint32_t ));if (unlikely (p ==NULL ))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 730/798 NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yanjun Zhang <[email protected]>
[ Upstream commit a848c29e3486189aaabd5663bc11aea50c5bd144 ]
On the node of an NFS client, some files saved in the mountpoint of the NFS server were copied to another location of the same NFS server. Accidentally, the nfs42_complete_copies() got a NULL-pointer dereference crash with the following syslog:
[232064.838881] NFSv4: state recovery failed for open file nfs/pvc-12b5200d-cd0f-46a3-b9f0-af8f4fe0ef64.qcow2, error = -116 [232064.839360] NFSv4: state recovery failed for open file nfs/pvc-12b5200d-cd0f-46a3-b9f0-af8f4fe0ef64.qcow2, error = -116 [232066.588183] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000058 [232066.588586] Mem abort info: [232066.588701] ESR = 0x0000000096000007 [232066.588862] EC = 0x25: DABT (current EL), IL = 32 bits [232066.589084] SET = 0, FnV = 0 [232066.589216] EA = 0, S1PTW = 0 [232066.589340] FSC = 0x07: level 3 translation fault [232066.589559] Data abort info: [232066.589683] ISV = 0, ISS = 0x00000007 [232066.589842] CM = 0, WnR = 0 [232066.589967] user pgtable: 64k pages, 48-bit VAs, pgdp=00002000956ff400 [232066.590231] [0000000000000058] pgd=08001100ae100003, p4d=08001100ae100003, pud=08001100ae100003, pmd=08001100b3c00003, pte=0000000000000000 [232066.590757] Internal error: Oops: 96000007 [#1] SMP [232066.590958] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm vhost_net vhost vhost_iotlb tap tun ipt_rpfilter xt_multiport ip_set_hash_ip ip_set_hash_net xfrm_interface xfrm6_tunnel tunnel4 tunnel6 esp4 ah4 wireguard libcurve25519_generic veth xt_addrtype xt_set nf_conntrack_netlink ip_set_hash_ipportnet ip_set_hash_ipportip ip_set_bitmap_port ip_set_hash_ipport dummy ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs iptable_filter sch_ingress nfnetlink_cttimeout vport_gre ip_gre ip_tunnel gre vport_geneve geneve vport_vxlan vxlan ip6_udp_tunnel udp_tunnel openvswitch nf_conncount dm_round_robin dm_service_time dm_multipath xt_nat xt_MASQUERADE nft_chain_nat nf_nat xt_mark xt_conntrack xt_comment nft_compat nft_counter nf_tables nfnetlink ocfs2 ocfs2_nodemanager ocfs2_stackglue iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ipmi_ssif nbd overlay 8021q garp mrp bonding tls rfkill sunrpc ext4 mbcache jbd2 [232066.591052] vfat fat cas_cache cas_disk ses enclosure scsi_transport_sas sg acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler ip_tables vfio_pci vfio_pci_core vfio_virqfd vfio_iommu_type1 vfio dm_mirror dm_region_hash dm_log dm_mod nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter bridge stp llc fuse xfs libcrc32c ast drm_vram_helper qla2xxx drm_kms_helper syscopyarea crct10dif_ce sysfillrect ghash_ce sysimgblt sha2_ce fb_sys_fops cec sha256_arm64 sha1_ce drm_ttm_helper ttm nvme_fc igb sbsa_gwdt nvme_fabrics drm nvme_core i2c_algo_bit i40e scsi_transport_fc megaraid_sas aes_neon_bs [232066.596953] CPU: 6 PID: 4124696 Comm: 10.253.166.125- Kdump: loaded Not tainted 5.15.131-9.cl9_ocfs2.aarch64 #1 [232066.597356] Hardware name: Great Wall .\x93\x8e...RF6260 V5/GWMSSE2GL1T, BIOS T656FBE_V3.0.18 2024-01-06 [232066.597721] pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [232066.598034] pc : nfs4_reclaim_open_state+0x220/0x800 [nfsv4] [232066.598327] lr : nfs4_reclaim_open_state+0x12c/0x800 [nfsv4] [232066.598595] sp : ffff8000f568fc70 [232066.598731] x29: ffff8000f568fc70 x28: 0000000000001000 x27: ffff21003db33000 [232066.599030] x26: ffff800005521ae0 x25: ffff0100f98fa3f0 x24: 0000000000000001 [232066.599319] x23: ffff800009920008 x22: ffff21003db33040 x21: ffff21003db33050 [232066.599628] x20: ffff410172fe9e40 x19: ffff410172fe9e00 x18: 0000000000000000 [232066.599914] x17: 0000000000000000 x16: 0000000000000004 x15: 0000000000000000 [232066.600195] x14: 0000000000000000 x13: ffff800008e685a8 x12: 00000000eac0c6e6 [232066.600498] x11: 0000000000000000 x10: 0000000000000008 x9 : ffff8000054e5828 [232066.600784] x8 : 00000000ffffffbf x7 : 0000000000000001 x6 : 000000000a9eb14a [232066.601062] x5 : 0000000000000000 x4 : ffff70ff8a14a800 x3 : 0000000000000058 [232066.601348] x2 : 0000000000000001 x1 : 54dce46366daa6c6 x0 : 0000000000000000 [232066.601636] Call trace: [232066.601749] nfs4_reclaim_open_state+0x220/0x800 [nfsv4] [232066.601998] nfs4_do_reclaim+0x1b8/0x28c [nfsv4] [232066.602218] nfs4_state_manager+0x928/0x10f0 [nfsv4] [232066.602455] nfs4_run_state_manager+0x78/0x1b0 [nfsv4] [232066.602690] kthread+0x110/0x114 [232066.602830] ret_from_fork+0x10/0x20 [232066.602985] Code: 1400000d f9403f20 f9402e61 91016003 (f9402c00) [232066.603284] SMP: stopping secondary CPUs [232066.606936] Starting crashdump kernel... [232066.607146] Bye!
Analysing the vmcore, we know that nfs4_copy_state listed by destination nfs_server->ss_copies was added by the field copies in handle_async_copy(), and we found a waiting copy process with the stack as:
PID: 3511963 TASK: ffff710028b47e00 CPU: 0 COMMAND: "cp"
#0 [ffff8001116ef740] __switch_to at ffff8000081b92f4
#1 [ffff8001116ef760] __schedule at ffff800008dd0650
#2 [ffff8001116ef7c0] schedule at ffff800008dd0a00
#3 [ffff8001116ef7e0] schedule_timeout at ffff800008dd6aa0
#4 [ffff8001116ef860] __wait_for_common at ffff800008dd166c
#5 [ffff8001116ef8e0] wait_for_completion_interruptible at ffff800008dd1898 #6 [ffff8001116ef8f0] handle_async_copy at ffff8000055142f4 [nfsv4]
#7 [ffff8001116ef970] _nfs42_proc_copy at ffff8000055147c8 [nfsv4]
#8 [ffff8001116efa80] nfs42_proc_copy at ffff800005514cf0 [nfsv4]
#9 [ffff8001116efc50] __nfs4_copy_file_range.constprop.0 at ffff8000054ed694 [nfsv4]
The NULL-pointer dereference was due to nfs42_complete_copies() listed the nfs_server->ss_copies by the field ss_copies of nfs4_copy_state. So the nfs4_copy_state address ffff0100f98fa3f0 was offset by 0x10 and the data accessed through this pointer was also incorrect. Generally, the ordered list nfs4_state_owner->so_states indicate open(O_RDWR) or open(O_WRITE) states are reclaimed firstly by nfs4_reclaim_open_state(). When destination state reclaim is failed with NFS_STATE_RECOVERY_FAILED and copies are not deleted in nfs_server->ss_copies, the source state may be passed to the nfs42_complete_copies() process earlier, resulting in this crash scene finally. To solve this issue, we add a list_head nfs_server->ss_src_copies for a server-to-server copy specially.
--- fs/nfs/client.c | 1 + fs/nfs/nfs42proc.c | 2 +- fs/nfs/nfs4state.c | 2 +- include/linux/nfs_fs_sb.h | 1 + 4 files changed, 4 insertions(+), 2 deletions(-)
fs/nfs/client.c +1 -0
@@ -965,6 +965,7 @@ struct nfs_server *nfs_alloc_server(void)INIT_LIST_HEAD (&server->layouts);INIT_LIST_HEAD (&server->state_owners_lru);INIT_LIST_HEAD (&server->ss_copies); +INIT_LIST_HEAD (&server->ss_src_copies);atomic_set (&server->active,0 );
fs/nfs/nfs42proc.c +1 -1
@@ -218,7 +218,7 @@ static int handle_async_copy(struct nfs42_copy_res *res,if (dst_server != src_server) {spin_lock (&src_server->nfs_client->cl_lock); -list_add_tail (©->src_copies, &src_server->ss_copies); +list_add_tail (©->src_copies, &src_server->ss_src_copies);spin_unlock (&src_server->nfs_client->cl_lock); }
fs/nfs/nfs4state.c +1 -1
@@ -1594,7 +1594,7 @@ static void nfs42_complete_copies(struct nfs4_state_owner *sp, struct nfs4_statecomplete (©->completion); } } -list_for_each_entry (copy, &sp->so_server->ss_copies, src_copies) { +list_for_each_entry (copy, &sp->so_server->ss_src_copies, src_copies) {if ((test_bit (NFS_CLNT_SRC_SSC_COPY_STATE , &state->flags) && !nfs4_stateid_match_other (&state->stateid, ©->parent_src_state->stateid)))
include/linux/nfs_fs_sb.h +1 -0
@@ -235,6 +235,7 @@ struct nfs_server {struct list_head layouts;struct list_head delegations;struct list_head ss_copies; +struct list_head ss_src_copies;unsigned long mig_gen;unsigned long mig_status;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 731/798 net: phy: dp83869: fix memory corruption when enabling fiber
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ingo van Lil <[email protected]>
[ Upstream commit a842e443ca8184f2dc82ab307b43a8b38defd6a5 ]
When configuring the fiber port, the DP83869 PHY driver incorrectly calls linkmode_set_bit() with a bit mask (1 << 10) rather than a bit number (10). This corrupts some other memory location -- in case of arm64 the priv pointer in the same structure.
Since the advertising flags are updated from supported at the end of the function the incorrect line isn't needed at all and can be removed.
--- drivers/net/phy/dp83869.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/phy/dp83869.c +0 -1
@@ -645,7 +645,6 @@ static int dp83869_configure_fiber(struct phy_device *phydev, phydev->supported);linkmode_set_bit (ETHTOOL_LINK_MODE_FIBRE_BIT , phydev->supported); -linkmode_set_bit (ADVERTISED_FIBRE , phydev->advertising);if (dp83869->mode ==DP83869_RGMII_1000_BASE ) { linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 732/798 tcp: fix to allow timestamp undo if no retransmits were sent
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neal Cardwell <[email protected]>
[ Upstream commit e37ab7373696e650d3b6262a5b882aadad69bb9e ]
Fix the TCP loss recovery undo logic in tcp_packet_delayed() so that it can trigger undo even if TSQ prevents a fast recovery episode from reaching tcp_retransmit_skb().
Geumhwan Yu <[email protected]> recently reported that after this commit from 2019:
commit bc9f38c8328e ("tcp: avoid unconditional congestion window undo on SYN retransmit")
...and before this fix we could have buggy scenarios like the following:
+ Due to reordering, a TCP connection receives some SACKs and enters a spurious fast recovery.
+ TSQ prevents all invocations of tcp_retransmit_skb(), because many skbs are queued in lower layers of the sending machine's network stack; thus tp->retrans_stamp remains 0.
+ The connection receives a TCP timestamp ECR value echoing a timestamp before the fast recovery, indicating that the fast recovery was spurious.
+ The connection fails to undo the spurious fast recovery because tp->retrans_stamp is 0, and thus tcp_packet_delayed() returns false, due to the new logic in the 2019 commit: commit bc9f38c8328e ("tcp:
avoid unconditional congestion window undo on SYN retransmit")
This fix tweaks the logic to be more similar to the tcp_packet_delayed() logic before bc9f38c8328e, except that we take care not to be fooled by the FLAG_SYN_ACKED code path zeroing out tp->retrans_stamp (the bug noted and fixed by Yuchung in bc9f38c8328e).
Note that this returns the high-level behavior of tcp_packet_delayed() to again match the comment for the function, which says: "Nothing was retransmitted or returned timestamp is less than timestamp of the first retransmission." Note that this comment is in the original 2005-04-16 Linux git commit, so this is evidently long-standing behavior.
--- net/ipv4/tcp_input.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
net/ipv4/tcp_input.c +16 -2
@@ -2440,8 +2440,22 @@ static bool tcp_skb_spurious_retrans(const struct tcp_sock *tp,*/ static inline bool tcp_packet_delayed (const struct tcp_sock *tp) { -return tp->retrans_stamp && -tcp_tsopt_ecr_before (tp, tp->retrans_stamp); +const struct sock *sk = (const struct sock *)tp; + +if (tp->retrans_stamp && +tcp_tsopt_ecr_before (tp, tp->retrans_stamp)) +return true;/* got echoed TS before first retransmission */ + +/* Check if nothing was retransmitted (retrans_stamp==0), which may +* happen in fast recovery due to TSQ. But we ignore zero retrans_stamp +* in TCP_SYN_SENT, since when we set FLAG_SYN_ACKED we also clear +* retrans_stamp even if we had retransmitted the SYN. +*/ +if (!tp->retrans_stamp &&/* no record of a retransmit/SYN? */ + sk->sk_state !=TCP_SYN_SENT )/* not the FLAG_SYN_ACKED case? */ +return true;/* nothing was retransmitted */ + +return false; }/* Undo procedures. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 733/798 tcp: fix tcp_enter_recovery() to zero retrans_stamp when its safe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neal Cardwell <[email protected]>
[ Upstream commit b41b4cbd9655bcebcce941bef3601db8110335be ]
Fix tcp_enter_recovery() so that if there are no retransmits out then we zero retrans_stamp when entering fast recovery. This is necessary to fix two buggy behaviors.
Currently a non-zero retrans_stamp value can persist across multiple back-to-back loss recovery episodes. This is because we generally only clears retrans_stamp if we are completely done with loss recoveries, and get to tcp_try_to_open() and find !tcp_any_retrans_done(sk). This behavior causes two bugs:
(1) When a loss recovery episode (CA_Loss or CA_Recovery) is followed immediately by a new CA_Recovery, the retrans_stamp value can persist and can be a time before this new CA_Recovery episode starts. That means that timestamp-based undo will be using the wrong retrans_stamp (a value that is too old) when comparing incoming TS ecr values to retrans_stamp to see if the current fast recovery episode can be undone.
(2) If there is a roughly minutes-long sequence of back-to-back fast recovery episodes, one after another (e.g. in a shallow-buffered or policed bottleneck), where each fast recovery successfully makes forward progress and recovers one window of sequence space (but leaves at least one retransmit in flight at the end of the recovery), followed by several RTOs, then the ETIMEDOUT check may be using the wrong retrans_stamp (a value set at the start of the first fast recovery in the sequence). This can cause a very premature ETIMEDOUT, killing the connection prematurely.
This commit changes the code to zero retrans_stamp when entering fast recovery, when this is known to be safe (no retransmits are out in the network). That ensures that when starting a fast recovery episode, and it is safe to do so, retrans_stamp is set when we send the fast retransmit packet. That addresses both bug (1) and bug (2) by ensuring that (if no retransmits are out when we start a fast recovery) we use the initial fast retransmit of this fast recovery as the time value for undo and ETIMEDOUT calculations.
This makes intuitive sense, since the start of a new fast recovery episode (in a scenario where no lost packets are out in the network) means that the connection has made forward progress since the last RTO or fast recovery, and we should thus "restart the clock" used for both undo and ETIMEDOUT logic.
Note that if when we start fast recovery there *are* retransmits out in the network, there can still be undesirable (1)/(2) issues. For example, after this patch we can still have the (1) and (2) problems in cases like this:
+ round 1: sender sends flight 1
+ round 2: sender receives SACKs and enters fast recovery 1, retransmits some packets in flight 1 and then sends some new data as flight 2
+ round 3: sender receives some SACKs for flight 2, notes losses, and retransmits some packets to fill the holes in flight 2
+ fast recovery has some lost retransmits in flight 1 and continues for one or more rounds sending retransmits for flight 1 and flight 2
+ fast recovery 1 completes when snd_una reaches high_seq at end of flight 1
+ there are still holes in the SACK scoreboard in flight 2, so we enter fast recovery 2, but some retransmits in the flight 2 sequence range are still in flight (retrans_out > 0), so we can't execute the new retrans_stamp=0 added here to clear retrans_stamp
It's not yet clear how to fix these remaining (1)/(2) issues in an efficient way without breaking undo behavior, given that retrans_stamp is currently used for undo and ETIMEDOUT. Perhaps the optimal (but expensive) strategy would be to set retrans_stamp to the timestamp of the earliest outstanding retransmit when entering fast recovery. But at least this commit makes things better.
Note that this does not change the semantics of retrans_stamp; it simply makes retrans_stamp accurate in some cases where it was not before:
(1) Some loss recovery, followed by an immediate entry into a fast recovery, where there are no retransmits out when entering the fast recovery.
(2) When a TFO server has a SYNACK retransmit that sets retrans_stamp, and then the ACK that completes the 3-way handshake has SACK blocks that trigger a fast recovery. In this case when entering fast recovery we want to zero out the retrans_stamp from the TFO SYNACK retransmit, and set the retrans_stamp based on the timestamp of the fast recovery.
We introduce a tcp_retrans_stamp_cleanup() helper, because this two-line sequence already appears in 3 places and is about to appear in 2 more as a result of this bug fix patch series. Once this bug fix patches series in the net branch makes it into the net-next branch we'll update the 3 other call sites to use the new helper.
This is a long-standing issue. The Fixes tag below is chosen to be the oldest commit at which the patch will apply cleanly, which is from Linux v3.5 in 2012.
--- net/ipv4/tcp_input.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
net/ipv4/tcp_input.c +13 -0
@@ -2489,6 +2489,16 @@ static bool tcp_any_retrans_done(const struct sock *sk)return false; } +/* If loss recovery is finished and there are no retransmits out in the +* network, then we clear retrans_stamp so that upon the next loss recovery +* retransmits_timed_out() and timestamp-undo are using the correct value. +*/ +static void tcp_retrans_stamp_cleanup (struct sock *sk) +{ +if (!tcp_any_retrans_done (sk)) +tcp_sk (sk)->retrans_stamp =0 ; +} +static void DBGUNDO (struct sock *sk,const char *msg) {#if FASTRETRANS_DEBUG >1
@@ -2856,6 +2866,9 @@ void tcp_enter_recovery(struct sock *sk, bool ece_ack)struct tcp_sock *tp =tcp_sk (sk);int mib_idx; +/* Start the clock with our fast retransmit, for undo and ETIMEDOUT. */ +tcp_retrans_stamp_cleanup (sk); +if (tcp_is_reno (tp)) mib_idx =LINUX_MIB_TCPRENORECOVERY ;else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 734/798 netfilter: br_netfilter: fix panic with metadata_dst skb
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Roulin <[email protected]>
[ Upstream commit f9ff7665cd128012868098bbd07e28993e314fdb ]
Fix a kernel panic in the br_netfilter module when sending untagged traffic via a VxLAN device.
This happens during the check for fragmentation in br_nf_dev_queue_xmit.
It is dependent on:
1) the br_netfilter module being loaded;
2) net.bridge.bridge-nf-call-iptables set to 1;
3) a bridge with a VxLAN (single-vxlan-device) netdevice as a bridge port;
4) untagged frames with size higher than the VxLAN MTU forwarded/flooded
When forwarding the untagged packet to the VxLAN bridge port, before the netfilter hooks are called, br_handle_egress_vlan_tunnel is called and changes the skb_dst to the tunnel dst. The tunnel_dst is a metadata type of dst, i.e., skb_valid_dst(skb) is false, and metadata->dst.dev is NULL.
Then in the br_netfilter hooks, in br_nf_dev_queue_xmit, there's a check for frames that needs to be fragmented: frames with higher MTU than the VxLAN device end up calling br_nf_ip_fragment, which in turns call ip_skb_dst_mtu.
The ip_dst_mtu tries to use the skb_dst(skb) as if it was a valid dst with valid dst->dev, thus the crash.
This case was never supported in the first place, so drop the packet instead.
PING 10.0.0.2 (10.0.0.2) from 0.0.0.0 h1-eth0: 2000(2028) bytes of data.
[ 176.291791] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000110 [ 176.292101] Mem abort info: [ 176.292184] ESR = 0x0000000096000004 [ 176.292322] EC = 0x25: DABT (current EL), IL = 32 bits [ 176.292530] SET = 0, FnV = 0 [ 176.292709] EA = 0, S1PTW = 0 [ 176.292862] FSC = 0x04: level 0 translation fault [ 176.293013] Data abort info: [ 176.293104] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 176.293488] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 176.293787] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 176.293995] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000043ef5000 [ 176.294166] [0000000000000110] pgd=0000000000000000, p4d=0000000000000000 [ 176.294827] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 176.295252] Modules linked in: vxlan ip6_udp_tunnel udp_tunnel veth br_netfilter bridge stp llc ipv6 crct10dif_ce [ 176.295923] CPU: 0 PID: 188 Comm: ping Not tainted 6.8.0-rc3-g5b3fbd61b9d1 #2 [ 176.296314] Hardware name: linux,dummy-virt (DT) [ 176.296535] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 176.296808] pc : br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter] [ 176.297382] lr : br_nf_dev_queue_xmit+0x2ac/0x4ec [br_netfilter] [ 176.297636] sp : ffff800080003630 [ 176.297743] x29: ffff800080003630 x28: 0000000000000008 x27: ffff6828c49ad9f8 [ 176.298093] x26: ffff6828c49ad000 x25: 0000000000000000 x24: 00000000000003e8 [ 176.298430] x23: 0000000000000000 x22: ffff6828c4960b40 x21: ffff6828c3b16d28 [ 176.298652] x20: ffff6828c3167048 x19: ffff6828c3b16d00 x18: 0000000000000014 [ 176.298926] x17: ffffb0476322f000 x16: ffffb7e164023730 x15: 0000000095744632 [ 176.299296] x14: ffff6828c3f1c880 x13: 0000000000000002 x12: ffffb7e137926a70 [ 176.299574] x11: 0000000000000001 x10: ffff6828c3f1c898 x9 : 0000000000000000 [ 176.300049] x8 : ffff6828c49bf070 x7 : 0008460f18d5f20e x6 : f20e0100bebafeca [ 176.300302] x5 : ffff6828c7f918fe x4 : ffff6828c49bf070 x3 : 0000000000000000 [ 176.300586] x2 : 0000000000000000 x1 : ffff6828c3c7ad00 x0 : ffff6828c7f918f0 [ 176.300889] Call trace: [ 176.301123] br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter] [ 176.301411] br_nf_post_routing+0x2a8/0x3e4 [br_netfilter] [ 176.301703] nf_hook_slow+0x48/0x124 [ 176.302060] br_forward_finish+0xc8/0xe8 [bridge] [ 176.302371] br_nf_hook_thresh+0x124/0x134 [br_netfilter] [ 176.302605] br_nf_forward_finish+0x118/0x22c [br_netfilter] [ 176.302824] br_nf_forward_ip.part.0+0x264/0x290 [br_netfilter] [ 176.303136] br_nf_forward+0x2b8/0x4e0 [br_netfilter] [ 176.303359] nf_hook_slow+0x48/0x124 [ 176.303803] __br_forward+0xc4/0x194 [bridge] [ 176.304013] br_flood+0xd4/0x168 [bridge] [ 176.304300] br_handle_frame_finish+0x1d4/0x5c4 [bridge] [ 176.304536] br_nf_hook_thresh+0x124/0x134 [br_netfilter] [ 176.304978] br_nf_pre_routing_finish+0x29c/0x494 [br_netfilter] [ 176.305188] br_nf_pre_routing+0x250/0x524 [br_netfilter] [ 176.305428] br_handle_frame+0x244/0x3cc [bridge] [ 176.305695] __netif_receive_skb_core.constprop.0+0x33c/0xecc [ 176.306080] __netif_receive_skb_one_core+0x40/0x8c [ 176.306197] __netif_receive_skb+0x18/0x64 [ 176.306369] process_backlog+0x80/0x124 [ 176.306540] __napi_poll+0x38/0x17c [ 176.306636] net_rx_action+0x124/0x26c [ 176.306758] __do_softirq+0x100/0x26c [ 176.307051] ____do_softirq+0x10/0x1c [ 176.307162] call_on_irq_stack+0x24/0x4c [ 176.307289] do_softirq_own_stack+0x1c/0x2c [ 176.307396] do_softirq+0x54/0x6c [ 176.307485] __local_bh_enable_ip+0x8c/0x98 [ 176.307637] __dev_queue_xmit+0x22c/0xd28 [ 176.307775] neigh_resolve_output+0xf4/0x1a0 [ 176.308018] ip_finish_output2+0x1c8/0x628 [ 176.308137] ip_do_fragment+0x5b4/0x658 [ 176.308279] ip_fragment.constprop.0+0x48/0xec [ 176.308420] __ip_finish_output+0xa4/0x254 [ 176.308593] ip_finish_output+0x34/0x130 [ 176.308814] ip_output+0x6c/0x108 [ 176.308929] ip_send_skb+0x50/0xf0 [ 176.309095] ip_push_pending_frames+0x30/0x54 [ 176.309254] raw_sendmsg+0x758/0xaec [ 176.309568] inet_sendmsg+0x44/0x70 [ 176.309667] __sys_sendto+0x110/0x178 [ 176.309758] __arm64_sys_sendto+0x28/0x38 [ 176.309918] invoke_syscall+0x48/0x110 [ 176.310211] el0_svc_common.constprop.0+0x40/0xe0 [ 176.310353] do_el0_svc+0x1c/0x28 [ 176.310434] el0_svc+0x34/0xb4 [ 176.310551] el0t_64_sync_handler+0x120/0x12c [ 176.310690] el0t_64_sync+0x190/0x194 [ 176.311066] Code: f9402e61 79402aa2 927ff821 f9400023 (f9408860) [ 176.315743] ---[ end trace 0000000000000000 ]--- [ 176.316060] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 176.316371] Kernel Offset: 0x37e0e3000000 from 0xffff800080000000 [ 176.316564] PHYS_OFFSET: 0xffff97d780000000 [ 176.316782] CPU features: 0x0,88000203,3c020000,0100421b [ 176.317210] Memory Limit: none [ 176.317527] ---[ end Kernel panic - not syncing: Oops: Fatal
Exception in interrupt ]---\
--- net/bridge/br_netfilter_hooks.c | 5 +++++ 1 file changed, 5 insertions(+)
net/bridge/br_netfilter_hooks.c +5 -0
@@ -33,6 +33,7 @@#include <net/ip.h> #include <net/ipv6.h> #include <net/addrconf.h> +#include <net/dst_metadata.h> #include <net/route.h> #include <net/netfilter/br_netfilter.h> #include <net/netns/generic.h>
@@ -871,6 +872,10 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buffreturn br_dev_queue_push_xmit (net, sk, skb); } +/* Fragmentation on metadata/template dst is not supported */ +if (unlikely (!skb_valid_dst (skb))) + goto drop; +/* This is wrong! We should preserve the original fragment * boundaries by preserving frag_list rather than refragmenting. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 735/798 selftests: net: no_forwarding: fix VID for $swp2 in one_bridge_two_pvids() test
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kacper Ludwinski <[email protected]>
[ Upstream commit 9f49d14ec41ce7be647028d7d34dea727af55272 ]
Currently, the second bridge command overwrites the first one. Fix this by adding this VID to the interface behind $swp2.
The one_bridge_two_pvids() test intends to check that there is no leakage of traffic between bridge ports which have a single VLAN - the PVID VLAN.
Because of a typo, port $swp1 is configured with a PVID twice (second command overwrites first), and $swp2 isn't configured at all (and since the bridge vlan_default_pvid property is set to 0, this port will not have a PVID at all, so it will drop all untagged and priority-tagged traffic).
So, instead of testing the configuration that was intended, we are testing a different one, where one port has PVID 2 and the other has no PVID. This incorrect version of the test should also pass, but is ineffective for its purpose, so fix the typo.
This typo has an impact on results of the test, potentially leading to wrong conclusions regarding the functionality of a network device.
The tests results:
TEST: Switch ports in VLAN-aware bridge with different PVIDs:
Unicast non-IP untagged [ OK ]
Multicast non-IP untagged [ OK ]
Broadcast non-IP untagged [ OK ]
Unicast IPv4 untagged [ OK ]
Multicast IPv4 untagged [ OK ]
Unicast IPv6 untagged [ OK ]
Multicast IPv6 untagged [ OK ]
Unicast non-IP VID 1 [ OK ]
Multicast non-IP VID 1 [ OK ]
Broadcast non-IP VID 1 [ OK ]
Unicast IPv4 VID 1 [ OK ]
Multicast IPv4 VID 1 [ OK ]
Unicast IPv6 VID 1 [ OK ]
Multicast IPv6 VID 1 [ OK ]
Unicast non-IP VID 4094 [ OK ]
Multicast non-IP VID 4094 [ OK ]
Broadcast non-IP VID 4094 [ OK ]
Unicast IPv4 VID 4094 [ OK ]
Multicast IPv4 VID 4094 [ OK ]
Unicast IPv6 VID 4094 [ OK ]
Multicast IPv6 VID 4094 [ OK ]
--- tools/testing/selftests/net/forwarding/no_forwarding.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/forwarding/no_forwarding.sh +1 -1
@@ -202,7 +202,7 @@ one_bridge_two_pvids() ip link set $swp2 master br0 bridge vlan add dev $swp1 vid 1 pvid untagged - bridge vlan add dev $swp1 vid 2 pvid untagged + bridge vlan add dev $swp2 vid 2 pvid untagged run_test "Switch ports in VLAN-aware bridge with different PVIDs"
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 736/798 Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 08d1914293dae38350b8088980e59fbc699a72fe ]
rfcomm_sk_state_change attempts to use sock_lock so it must never be called with it locked but rfcomm_sock_ioctl always attempt to lock it causing the following trace:
======================================================
WARNING: possible circular locking dependency detected
6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted
------------------------------------------------------
syz-executor386/5093 is trying to acquire lock:ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1671 [inline] ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sk_state_change+0x5b/0x310 net/bluetooth/rfcomm/sock.c:73
but task is already holding lock:ffff88807badfd28 (&d->lock){+.+.}-{3:3}, at: __rfcomm_dlc_close+0x226/0x6a0 net/bluetooth/rfcomm/core.c:491
--- net/bluetooth/rfcomm/sock.c | 2 -- 1 file changed, 2 deletions(-)
net/bluetooth/rfcomm/sock.c +0 -2
@@ -865,9 +865,7 @@ static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned lonif (err == -ENOIOCTLCMD ) {#ifdef CONFIG_BT_RFCOMM_TTY -lock_sock (sk); err =rfcomm_dev_ioctl (sk, cmd, (void __user *) arg); -release_sock (sk);#else err = -EOPNOTSUPP ;#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 737/798 net: phy: bcm84881: Fix some error handling paths
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 9234a2549cb6ac038bec36cc7c084218e9575513 ]
If phy_read_mmd() fails, the error code stored in 'bmsr' should be returned instead of 'val' which is likely to be 0.
--- drivers/net/phy/bcm84881.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/phy/bcm84881.c +2 -2
@@ -120,7 +120,7 @@ static int bcm84881_aneg_done(struct phy_device *phydev) bmsr =phy_read_mmd (phydev,MDIO_MMD_AN ,MDIO_AN_C22 +MII_BMSR );if (bmsr <0 ) -return val; +return bmsr;return !!(val &MDIO_AN_STAT1_COMPLETE ) && !!(bmsr &BMSR_ANEGCOMPLETE );
@@ -146,7 +146,7 @@ static int bcm84881_read_status(struct phy_device *phydev) bmsr =phy_read_mmd (phydev,MDIO_MMD_AN ,MDIO_AN_C22 +MII_BMSR );if (bmsr <0 ) -return val; +return bmsr; phydev->autoneg_complete = !!(val &MDIO_AN_STAT1_COMPLETE ) && !!(bmsr &BMSR_ANEGCOMPLETE );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 738/798 thermal: int340x: processor_thermal: Set feature mask before proc_thermal_add
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
[ Upstream commit 6ebc25d8b053a208786295bab58abbb66b39c318 ]
The function proc_thermal_add() adds sysfs entries for power limits.
The feature mask of available features is not present at that time, so it cannot be used by proc_thermal_add() to selectively create sysfs attributes.
The feature mask is set by proc_thermal_mmio_add(), so modify the code to call it before proc_thermal_add() so as to allow the latter to use the feature mask.
There is no functional impact with this change.
Stable-dep-of: 99ca0b57e49f ("thermal: intel: int340x: processor: Fix warning during module unload")
--- .../processor_thermal_device_pci.c | 21 +++++++++---------- 1 file changed, 10 insertions(+), 11 deletions(-)
drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c +10 -11
@@ -237,26 +237,26 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev, const struct pci_device_INIT_DELAYED_WORK (&pci_info->work, proc_thermal_threshold_work_fn); - ret =proc_thermal_add (&pdev->dev, proc_priv); -if (ret) { -dev_err (&pdev->dev,"error: proc_thermal_add, will continue\n" ); - pci_info->no_legacy =1 ; - } - proc_priv->priv_data = pci_info; pci_info->proc_priv = proc_priv;pci_set_drvdata (pdev, proc_priv); ret =proc_thermal_mmio_add (pdev, proc_priv, id->driver_data);if (ret) - goto err_ret_thermal; +return ret; + + ret =proc_thermal_add (&pdev->dev, proc_priv); +if (ret) { +dev_err (&pdev->dev,"error: proc_thermal_add, will continue\n" ); + pci_info->no_legacy =1 ; + } pci_info->tzone =thermal_zone_device_register ("TCPU_PCI" ,1 ,1 , pci_info, &tzone_ops, &tzone_params,0 ,0 );if (IS_ERR (pci_info->tzone)) { ret =PTR_ERR (pci_info->tzone); - goto err_ret_mmio; + goto err_del_legacy; }/* request and enable interrupt */
@@ -283,11 +283,10 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev, const struct pci_device_pci_free_irq_vectors (pdev); err_ret_tzone:thermal_zone_device_unregister (pci_info->tzone); -err_ret_mmio: -proc_thermal_mmio_remove (pdev, proc_priv); -err_ret_thermal: +err_del_legacy:if (!pci_info->no_legacy)proc_thermal_remove (proc_priv); +proc_thermal_mmio_remove (pdev, proc_priv);pci_disable_device (pdev);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 739/798 thermal: intel: int340x: processor: Fix warning during module unload
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Rui <[email protected]>
[ Upstream commit 99ca0b57e49fb73624eede1c4396d9e3d10ccf14 ]
The processor_thermal driver uses pcim_device_enable() to enable a PCI device, which means the device will be automatically disabled on driver detach. Thus there is no need to call pci_disable_device() again on it.
With recent PCI device resource management improvements, e.g. commit f748a07a0b64 ("PCI: Remove legacy pcim_release()"), this problem is exposed and triggers the warining below.
[ 224.010735] proc_thermal_pci 0000:00:04.0: disabling already-disabled device [ 224.010747] WARNING: CPU: 8 PID: 4442 at drivers/pci/pci.c:2250 pci_disable_device+0xe5/0x100 ... [ 224.010844] Call Trace: [ 224.010845] <TASK> [ 224.010847] ? show_regs+0x6d/0x80 [ 224.010851] ? __warn+0x8c/0x140 [ 224.010854] ? pci_disable_device+0xe5/0x100 [ 224.010856] ? report_bug+0x1c9/0x1e0 [ 224.010859] ? handle_bug+0x46/0x80 [ 224.010862] ? exc_invalid_op+0x1d/0x80 [ 224.010863] ? asm_exc_invalid_op+0x1f/0x30 [ 224.010867] ? pci_disable_device+0xe5/0x100 [ 224.010869] ? pci_disable_device+0xe5/0x100 [ 224.010871] ? kfree+0x21a/0x2b0 [ 224.010873] pcim_disable_device+0x20/0x30 [ 224.010875] devm_action_release+0x16/0x20 [ 224.010878] release_nodes+0x47/0xc0 [ 224.010880] devres_release_all+0x9f/0xe0 [ 224.010883] device_unbind_cleanup+0x12/0x80 [ 224.010885] device_release_driver_internal+0x1ca/0x210 [ 224.010887] driver_detach+0x4e/0xa0 [ 224.010889] bus_remove_driver+0x6f/0xf0 [ 224.010890] driver_unregister+0x35/0x60 [ 224.010892] pci_unregister_driver+0x44/0x90 [ 224.010894] proc_thermal_pci_driver_exit+0x14/0x5f0 [processor_thermal_device_pci] ... [ 224.010921] ---[ end trace 0000000000000000 ]---
Remove the excess pci_disable_device() calls.
--- .../intel/int340x_thermal/processor_thermal_device_pci.c | 2 -- 1 file changed, 2 deletions(-)
drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c +0 -2
@@ -287,7 +287,6 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev, const struct pci_device_if (!pci_info->no_legacy)proc_thermal_remove (proc_priv);proc_thermal_mmio_remove (pdev, proc_priv); -pci_disable_device (pdev);return ret; }
@@ -309,7 +308,6 @@ static void proc_thermal_pci_remove(struct pci_dev *pdev)proc_thermal_mmio_remove (pdev, pci_info->proc_priv);if (!pci_info->no_legacy)proc_thermal_remove (proc_priv); -pci_disable_device (pdev); }#ifdef CONFIG_PM_SLEEP
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 740/798 Revert "net: stmmac: set PP_FLAG_DMA_SYNC_DEV only if XDP is enabled"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 5546da79e6cc5bb3324bf25688ed05498fd3f86d ]
This reverts commit b514c47ebf41a6536551ed28a05758036e6eca7c.
The commit describes that we don't have to sync the page when recycling, and it tries to optimize that case. But we do need to sync after allocation. Recycling side should be changed to pass the right sync size instead.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +1 -1
@@ -2015,7 +2015,7 @@ static int __alloc_dma_rx_desc_resources(struct stmmac_priv *priv, rx_q->queue_index = queue; rx_q->priv_data = priv; - pp_params.flags =PP_FLAG_DMA_MAP | (xdp_prog ?PP_FLAG_DMA_SYNC_DEV :0 ); + pp_params.flags =PP_FLAG_DMA_MAP |PP_FLAG_DMA_SYNC_DEV ; pp_params.pool_size = dma_conf->dma_rx_size; num_pages =DIV_ROUND_UP (dma_conf->dma_buf_sz,PAGE_SIZE ); pp_params.order =ilog2 (num_pages);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 741/798 net: ethernet: adi: adin1110: Fix some error handling path in adin1110_read_fifo()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 83211ae1640516accae645de82f5a0a142676897 ]
If 'frame_size' is too small or if 'round_len' is an error code, it is likely that an error code should be returned to the caller.
Actually, 'ret' is likely to be 0, so if one of these sanity checks fails, 'success' is returned.
Return -EINVAL instead.
--- drivers/net/ethernet/adi/adin1110.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/adi/adin1110.c +2 -2
@@ -318,11 +318,11 @@ static int adin1110_read_fifo(struct adin1110_port_priv *port_priv)* from the ADIN1110 frame header. */ if (frame_size <ADIN1110_FRAME_HEADER_LEN +ADIN1110_FEC_LEN ) -return ret; +return -EINVAL ; round_len =adin1110_round_len (frame_size);if (round_len <0 ) -return ret; +return -EINVAL ; frame_size_no_fcs = frame_size -ADIN1110_FRAME_HEADER_LEN -ADIN1110_FEC_LEN ;memset (priv->data,0 ,ADIN1110_RD_HEADER_LEN );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 742/798 net: dsa: b53: fix jumbo frame mtu check
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit 42fb3acf6826c6764ba79feb6e15229b43fd2f9f ]
JMS_MIN_SIZE is the full ethernet frame length, while mtu is just the data payload size. Comparing these two meant that mtus between 1500 and 1518 did not trigger enabling jumbo frames.
So instead compare the set mtu ETH_DATA_LEN, which is equal to JMS_MIN_SIZE - ETH_HLEN - ETH_FCS_LEN;
Also do a check that the requested mtu is actually greater than the minimum length, else we do not need to enable jumbo frames.
In practice this only introduced a very small range of mtus that did not work properly. Newer chips allow 2000 byte large frames by default, and older chips allow 1536 bytes long, which is equivalent to an mtu of 1514. So effectivly only mtus of 1515~1517 were broken.
--- drivers/net/dsa/b53/b53_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/b53/b53_common.c +1 -1
@@ -2224,7 +2224,7 @@ static int b53_change_mtu(struct dsa_switch *ds, int port, int mtu)if (!dsa_is_cpu_port (ds, port))return 0 ; - enable_jumbo = (mtu >=JMS_MIN_SIZE ); + enable_jumbo = (mtu >ETH_DATA_LEN ); allow_10_100 = (dev->chip_id ==BCM583XX_DEVICE_ID );return b53_set_jumbo (dev, enable_jumbo, allow_10_100);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 743/798 net: dsa: b53: fix max MTU for 1g switches
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit 680a8217dc00dc7e7da57888b3c053289b60eb2b ]
JMS_MAX_SIZE is the ethernet frame length, not the MTU, which is payload without ethernet headers.
According to the datasheets maximum supported frame length for most gigabyte swithes is 9720 bytes, so convert that to the expected MTU when using VLAN tagged frames.
--- drivers/net/dsa/b53/b53_common.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/dsa/b53/b53_common.c +4 -1
@@ -27,6 +27,7 @@#include <linux/phylink.h> #include <linux/etherdevice.h> #include <linux/if_bridge.h> +#include <linux/if_vlan.h> #include <net/dsa.h> #include "b53_regs.h"
@@ -224,6 +225,8 @@ static const struct b53_mib_desc b53_mibs_58xx[] = {#define B53_MIBS_58XX_SIZE ARRAY_SIZE(b53_mibs_58xx) +#define B53_MAX_MTU (9720 - ETH_HLEN - VLAN_HLEN - ETH_FCS_LEN) +static int b53_do_vlan_op (struct b53_device *dev,u8 op) {unsigned int i;
@@ -2232,7 +2235,7 @@ static int b53_change_mtu(struct dsa_switch *ds, int port, int mtu)static int b53_get_max_mtu (struct dsa_switch *ds,int port) { -return JMS_MAX_SIZE ; +return B53_MAX_MTU ; }static const struct dsa_switch_ops b53_switch_ops = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 744/798 net: dsa: b53: fix max MTU for BCM5325/BCM5365
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit ca8c1f71c10193c270f772d70d34b15ad765d6a8 ]
BCM5325/BCM5365 do not support jumbo frames, so we should not report a jumbo frame mtu for them. But they do support so called "oversized" frames up to 1536 bytes long by default, so report an appropriate MTU.
--- drivers/net/dsa/b53/b53_common.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/dsa/b53/b53_common.c +6 -0
@@ -225,6 +225,7 @@ static const struct b53_mib_desc b53_mibs_58xx[] = {#define B53_MIBS_58XX_SIZE ARRAY_SIZE(b53_mibs_58xx) +#define B53_MAX_MTU_25 (1536 - ETH_HLEN - VLAN_HLEN - ETH_FCS_LEN)#define B53_MAX_MTU (9720 - ETH_HLEN - VLAN_HLEN - ETH_FCS_LEN)static int b53_do_vlan_op (struct b53_device *dev,u8 op)
@@ -2235,6 +2236,11 @@ static int b53_change_mtu(struct dsa_switch *ds, int port, int mtu)static int b53_get_max_mtu (struct dsa_switch *ds,int port) { +struct b53_device *dev = ds->priv; + +if (is5325 (dev) ||is5365 (dev)) +return B53_MAX_MTU_25 ; +return B53_MAX_MTU ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 745/798 net: dsa: b53: allow lower MTUs on BCM5325/5365
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit e4b294f88a32438baf31762441f3dd1c996778be ]
While BCM5325/5365 do not support jumbo frames, they do support slightly oversized frames, so do not error out if requesting a supported MTU for them.
--- drivers/net/dsa/b53/b53_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/b53/b53_common.c +1 -1
@@ -2223,7 +2223,7 @@ static int b53_change_mtu(struct dsa_switch *ds, int port, int mtu)bool allow_10_100;if (is5325 (dev) ||is5365 (dev)) -return -EOPNOTSUPP ; +return 0 ;if (!dsa_is_cpu_port (ds, port))return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 746/798 net: dsa: b53: fix jumbo frames on 10/100 ports
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit 2f3dcd0d39affe5b9ba1c351ce0e270c8bdd5109 ]
All modern chips support and need the 10_100 bit set for supporting jumbo frames on 10/100 ports, so instead of enabling it only for 583XX enable it for everything except bcm63xx, where the bit is writeable, but does nothing.
Tested on BCM53115, where jumbo frames were dropped at 10/100 speeds without the bit set.
--- drivers/net/dsa/b53/b53_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/b53/b53_common.c +1 -1
@@ -2229,7 +2229,7 @@ static int b53_change_mtu(struct dsa_switch *ds, int port, int mtu)return 0 ; enable_jumbo = (mtu >ETH_DATA_LEN ); - allow_10_100 = (dev->chip_id ==BCM583XX_DEVICE_ID ); + allow_10_100 = !is63xx (dev);return b53_set_jumbo (dev, enable_jumbo, allow_10_100); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 747/798 gpio: aspeed: Add the flush write to ensure the write complete.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Billy Tsai <[email protected]>
[ Upstream commit 1bb5a99e1f3fd27accb804aa0443a789161f843c ]
Performing a dummy read ensures that the register write operation is fully completed, mitigating any potential bus delays that could otherwise impact the frequency of bitbang usage. E.g., if the JTAG application uses GPIO to control the JTAG pins (TCK, TMS, TDI, TDO, and TRST), and the application sets the TCK clock to 1 MHz, the GPIO's high/low transitions will rely on a delay function to ensure the clock frequency does not exceed 1 MHz. However, this can lead to rapid toggling of the GPIO because the write operation is POSTed and does not wait for a bus acknowledgment.
--- drivers/gpio/gpio-aspeed.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpio/gpio-aspeed.c +2 -0
@@ -404,6 +404,8 @@ static void __aspeed_gpio_set(struct gpio_chip *gc, unsigned int offset, gpio->dcache[GPIO_BANK (offset)] = reg;iowrite32 (reg, addr); +/* Flush write */ +ioread32 (addr); } static void aspeed_gpio_set(struct gpio_chip *gc, unsigned int offset,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 748/798 gpio: aspeed: Use devm_clk api to manage clock source
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Billy Tsai <[email protected]>
[ Upstream commit a6191a3d18119184237f4ee600039081ad992320 ]
Replace of_clk_get with devm_clk_get_enabled to manage the clock source.
--- drivers/gpio/gpio-aspeed.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-aspeed.c +1 -1
@@ -1156,7 +1156,7 @@ static int __init aspeed_gpio_probe(struct platform_device *pdev)if (!gpio_id)return -EINVAL ; - gpio->clk =of_clk_get (pdev->dev.of_node,0 ); + gpio->clk =devm_clk_get_enabled (&pdev->dev,NULL );if (IS_ERR (gpio->clk)) {dev_warn (&pdev->dev,"Failed to get clock from devicetree, debouncing disabled\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 749/798 ice: Fix netif_is_ice() in Safe Mode
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcin Szycik <[email protected]>
[ Upstream commit 8e60dbcbaaa177dacef55a61501790e201bf8c88 ]
netif_is_ice() works by checking the pointer to netdev ops. However, it only checks for the default ice_netdev_ops, not ice_netdev_safe_mode_ops, so in Safe Mode it always returns false, which is unintuitive. While it doesn't look like netif_is_ice() is currently being called anywhere in Safe Mode, this could change and potentially lead to unexpected behaviour.
--- drivers/net/ethernet/intel/ice/ice_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_main.c +2 -1
@@ -82,7 +82,8 @@ ice_indr_setup_tc_cb(struct net_device *netdev, struct Qdisc *sch,bool netif_is_ice (struct net_device *dev) { -return dev && (dev->netdev_ops == &ice_netdev_ops); +return dev && (dev->netdev_ops == &ice_netdev_ops || + dev->netdev_ops == &ice_netdev_safe_mode_ops); }/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 750/798 i40e: Fix macvlan leak by synchronizing access to mac_filter_hash
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Loktionov <[email protected]>
[ Upstream commit dac6c7b3d33756d6ce09f00a96ea2ecd79fae9fb ]
This patch addresses a macvlan leak issue in the i40e driver caused by concurrent access to vsi->mac_filter_hash. The leak occurs when multiple threads attempt to modify the mac_filter_hash simultaneously, leading to inconsistent state and potential memory leaks.
To fix this, we now wrap the calls to i40e_del_mac_filter() and zeroing vf->default_lan_addr.addr with spin_lock/unlock_bh(&vsi->mac_filter_hash_lock), ensuring atomic operations and preventing concurrent access.
Additionally, we add lockdep_assert_held(&vsi->mac_filter_hash_lock) in i40e_add_mac_filter() to help catch similar issues in the future.
Reproduction steps:
1. Spawn VFs and configure port vlan on them.
2. Trigger concurrent macvlan operations (e.g., adding and deleting portvlan and/or mac filters).
3. Observe the potential memory leak and inconsistent state in the mac_filter_hash.
This synchronization ensures the integrity of the mac_filter_hash and prevents the described leak.
--- drivers/net/ethernet/intel/i40e/i40e_main.c | 1 + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 2 ++ 2 files changed, 3 insertions(+)
drivers/net/ethernet/intel/i40e/i40e_main.c +1 -0
@@ -1730,6 +1730,7 @@ struct i40e_mac_filter *i40e_add_mac_filter(struct i40e_vsi *vsi,struct hlist_node *h;int bkt; +lockdep_assert_held (&vsi->mac_filter_hash_lock);if (vsi->info.pvid)return i40e_add_filter (vsi, macaddr,le16_to_cpu (vsi->info.pvid));
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +2 -0
@@ -2215,8 +2215,10 @@ static int i40e_vc_get_vf_resources_msg(struct i40e_vf *vf, u8 *msg) vfres->vsi_res[0 ].qset_handle =le16_to_cpu (vsi->info.qs_handle[0 ]);if (!(vf->driver_caps &VIRTCHNL_VF_OFFLOAD_USO ) && !vf->pf_set_mac) { +spin_lock_bh (&vsi->mac_filter_hash_lock);i40e_del_mac_filter (vsi, vf->default_lan_addr.addr);eth_zero_addr (vf->default_lan_addr.addr); +spin_unlock_bh (&vsi->mac_filter_hash_lock); }ether_addr_copy (vfres->vsi_res[0 ].default_mac_addr, vf->default_lan_addr.addr);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 751/798 igb: Do not bring the device up after non-fatal error
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohamed Khalfella <[email protected]>
[ Upstream commit 330a699ecbfc9c26ec92c6310686da1230b4e7eb ]
Commit 004d25060c78 ("igb: Fix igb_down hung on surprise removal") changed igb_io_error_detected() to ignore non-fatal pcie errors in order to avoid hung task that can happen when igb_down() is called multiple times. This caused an issue when processing transient non-fatal errors. igb_io_resume(), which is called after igb_io_error_detected(), assumes that device is brought down by igb_io_error_detected() if the interface is up. This resulted in panic with stacktrace below.
[ T3256] igb 0000:09:00.0 haeth0: igb: haeth0 NIC Link is Down
[ T292] pcieport 0000:00:1c.5: AER: Uncorrected (Non-Fatal) error received: 0000:09:00.0 [ T292] igb 0000:09:00.0: PCIe Bus Error: severity=Uncorrected (Non-Fatal), type=Transaction Layer, (Requester ID) [ T292] igb 0000:09:00.0: device [8086:1537] error status/mask=00004000/00000000 [ T292] igb 0000:09:00.0: [14] CmpltTO [ 200.105524,009][ T292] igb 0000:09:00.0: AER: TLP Header: 00000000 00000000 00000000 00000000 [ T292] pcieport 0000:00:1c.5: AER: broadcast error_detected message [ T292] igb 0000:09:00.0: Non-correctable non-fatal error reported. [ T292] pcieport 0000:00:1c.5: AER: broadcast mmio_enabled message [ T292] pcieport 0000:00:1c.5: AER: broadcast resume message [ T292] ------------[ cut here ]------------ [ T292] kernel BUG at net/core/dev.c:6539! [ T292] invalid opcode: 0000 [#1] PREEMPT SMP [ T292] RIP: 0010:napi_enable+0x37/0x40 [ T292] Call Trace: [ T292] <TASK> [ T292] ? die+0x33/0x90 [ T292] ? do_trap+0xdc/0x110 [ T292] ? napi_enable+0x37/0x40 [ T292] ? do_error_trap+0x70/0xb0 [ T292] ? napi_enable+0x37/0x40 [ T292] ? napi_enable+0x37/0x40 [ T292] ? exc_invalid_op+0x4e/0x70 [ T292] ? napi_enable+0x37/0x40 [ T292] ? asm_exc_invalid_op+0x16/0x20 [ T292] ? napi_enable+0x37/0x40 [ T292] igb_up+0x41/0x150 [ T292] igb_io_resume+0x25/0x70 [ T292] report_resume+0x54/0x70 [ T292] ? report_frozen_detected+0x20/0x20 [ T292] pci_walk_bus+0x6c/0x90 [ T292] ? aer_print_port_info+0xa0/0xa0 [ T292] pcie_do_recovery+0x22f/0x380 [ T292] aer_process_err_devices+0x110/0x160 [ T292] aer_isr+0x1c1/0x1e0 [ T292] ? disable_irq_nosync+0x10/0x10 [ T292] irq_thread_fn+0x1a/0x60 [ T292] irq_thread+0xe3/0x1a0 [ T292] ? irq_set_affinity_notifier+0x120/0x120 [ T292] ? irq_affinity_notify+0x100/0x100 [ T292] kthread+0xe2/0x110 [ T292] ? kthread_complete_and_exit+0x20/0x20 [ T292] ret_from_fork+0x2d/0x50 [ T292] ? kthread_complete_and_exit+0x20/0x20 [ T292] ret_from_fork_asm+0x11/0x20 [ T292] </TASK>
To fix this issue igb_io_resume() checks if the interface is running and the device is not down this means igb_io_error_detected() did not bring the device down and there is no need to bring it up.
--- drivers/net/ethernet/intel/igb/igb_main.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/intel/igb/igb_main.c +4 -0
@@ -9666,6 +9666,10 @@ static void igb_io_resume(struct pci_dev *pdev)struct igb_adapter *adapter =netdev_priv (netdev);if (netif_running (netdev)) { +if (!test_bit (__IGB_DOWN, &adapter->state)) { +dev_dbg (&pdev->dev,"Resuming from non-fatal error, do nothing.\n" ); +return ; + }if (igb_up (adapter)) {dev_err (&pdev->dev,"igb_up failed after reset\n" );return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 752/798 net/sched: accept TCA_STAB only for root qdisc
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 3cb7cf1540ddff5473d6baeb530228d19bc97b8a ]
Most qdiscs maintain their backlog using qdisc_pkt_len(skb) on the assumption it is invariant between the enqueue() and dequeue() handlers.
Unfortunately syzbot can crash a host rather easily using a TBF + SFQ combination, with an STAB on SFQ [1]
We can't support TCA_STAB on arbitrary level, this would require to maintain per-qdisc storage.
[1]
[ 88.796496] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 88.798611] #PF: supervisor read access in kernel mode [ 88.799014] #PF: error_code(0x0000) - not-present page [ 88.799506] PGD 0 P4D 0 [ 88.799829] Oops: Oops: 0000 [#1] SMP NOPTI [ 88.800569] CPU: 14 UID: 0 PID: 2053 Comm: b371744477 Not tainted 6.12.0-rc1-virtme #1117 [ 88.801107] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 88.801779] RIP: 0010:sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq [ 88.802544] Code: 0f b7 50 12 48 8d 04 d5 00 00 00 00 48 89 d6 48 29 d0 48 8b 91 c0 01 00 00 48 c1 e0 03 48 01 c2 66 83 7a 1a 00 7e c0 48 8b 3a <4c> 8b 07 4c 89 02 49 89 50 08 48 c7 47 08 00 00 00 00 48 c7 07 00
All code
========
0: 0f b7 50 12 movzwl 0x12(%rax),%edx
4: 48 8d 04 d5 00 00 00 lea 0x0(,%rdx,8),%rax
b: 00
c: 48 89 d6 mov %rdx,%rsi f: 48 29 d0 sub %rdx,%rax 12: 48 8b 91 c0 01 00 00 mov 0x1c0(%rcx),%rdx 19: 48 c1 e0 03 shl $0x3,%rax 1d: 48 01 c2 add %rax,%rdx 20: 66 83 7a 1a 00 cmpw $0x0,0x1a(%rdx) 25: 7e c0 jle 0xffffffffffffffe7 27: 48 8b 3a mov (%rdx),%rdi 2a:* 4c 8b 07 mov (%rdi),%r8 <-- trapping instruction 2d: 4c 89 02 mov %r8,(%rdx) 30: 49 89 50 08 mov %rdx,0x8(%r8) 34: 48 c7 47 08 00 00 00 movq $0x0,0x8(%rdi) 3b: 00 3c: 48 rex.W 3d: c7 .byte 0xc7 3e: 07 (bad) ...
Code starting with the faulting instruction
===========================================
0: 4c 8b 07 mov (%rdi),%r8 3: 4c 89 02 mov %r8,(%rdx) 6: 49 89 50 08 mov %rdx,0x8(%r8) a: 48 c7 47 08 00 00 00 movq $0x0,0x8(%rdi) 11: 00 12: 48 rex.W 13: c7 .byte 0xc7 14: 07 (bad) ... [ 88.803721] RSP: 0018:ffff9a1f892b7d58 EFLAGS: 00000206 [ 88.804032] RAX: 0000000000000000 RBX: ffff9a1f8420c800 RCX: ffff9a1f8420c800 [ 88.804560] RDX: ffff9a1f81bc1440 RSI: 0000000000000000 RDI: 0000000000000000 [ 88.805056] RBP: ffffffffc04bb0e0 R08: 0000000000000001 R09: 00000000ff7f9a1f [ 88.805473] R10: 000000000001001b R11: 0000000000009a1f R12: 0000000000000140 [ 88.806194] R13: 0000000000000001 R14: ffff9a1f886df400 R15: ffff9a1f886df4ac [ 88.806734] FS: 00007f445601a740(0000) GS:ffff9a2e7fd80000(0000) knlGS:0000000000000000 [ 88.807225] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 88.807672] CR2: 0000000000000000 CR3: 000000050cc46000 CR4: 00000000000006f0 [ 88.808165] Call Trace: [ 88.808459] <TASK> [ 88.808710] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434) [ 88.809261] ? page_fault_oops (arch/x86/mm/fault.c:715) [ 88.809561] ? exc_page_fault (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:147 arch/x86/mm/fault.c:1489 arch/x86/mm/fault.c:1539) [ 88.809806] ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:623) [ 88.810074] ? sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq [ 88.810411] sfq_reset (net/sched/sch_sfq.c:525) sch_sfq [ 88.810671] qdisc_reset (./include/linux/skbuff.h:2135 ./include/linux/skbuff.h:2441 ./include/linux/skbuff.h:3304 ./include/linux/skbuff.h:3310 net/sched/sch_generic.c:1036) [ 88.810950] tbf_reset (./include/linux/timekeeping.h:169 net/sched/sch_tbf.c:334) sch_tbf [ 88.811208] qdisc_reset (./include/linux/skbuff.h:2135 ./include/linux/skbuff.h:2441 ./include/linux/skbuff.h:3304 ./include/linux/skbuff.h:3310 net/sched/sch_generic.c:1036) [ 88.811484] netif_set_real_num_tx_queues (./include/linux/spinlock.h:396 ./include/net/sch_generic.h:768 net/core/dev.c:2958) [ 88.811870] __tun_detach (drivers/net/tun.c:590 drivers/net/tun.c:673) [ 88.812271] tun_chr_close (drivers/net/tun.c:702 drivers/net/tun.c:3517) [ 88.812505] __fput (fs/file_table.c:432 (discriminator 1)) [ 88.812735] task_work_run (kernel/task_work.c:230) [ 88.813016] do_exit (kernel/exit.c:940) [ 88.813372] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:58 (discriminator 4)) [ 88.813639] ? handle_mm_fault (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:97 ./arch/x86/include/asm/irqflags.h:155 ./include/linux/memcontrol.h:1022 ./include/linux/memcontrol.h:1045 ./include/linux/memcontrol.h:1052 mm/memory.c:5928 mm/memory.c:6088) [ 88.813867] do_group_exit (kernel/exit.c:1070) [ 88.814138] __x64_sys_exit_group (kernel/exit.c:1099) [ 88.814490] x64_sys_call (??:?) [ 88.814791] do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1)) [ 88.815012] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 88.815495] RIP: 0033:0x7f44560f1975
--- include/net/sch_generic.h | 1 - net/sched/sch_api.c | 7 ++++++- 2 files changed, 6 insertions(+), 2 deletions(-)
include/net/sch_generic.h +0 -1
@@ -813,7 +813,6 @@ static inline void qdisc_calculate_pkt_len(struct sk_buff *skb,static inline int qdisc_enqueue (struct sk_buff *skb,struct Qdisc *sch,struct sk_buff **to_free) { -qdisc_calculate_pkt_len (skb, sch);return sch->enqueue (skb, sch, to_free); }
net/sched/sch_api.c +6 -1
@@ -592,7 +592,6 @@ void __qdisc_calculate_pkt_len(struct sk_buff *skb, pkt_len =1 ;qdisc_skb_cb (skb)->pkt_len = pkt_len; } -EXPORT_SYMBOL (__qdisc_calculate_pkt_len);void qdisc_warn_nonwc (const char *txt,struct Qdisc *qdisc) {
@@ -1169,6 +1168,12 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,return -EINVAL ; } +if (new && + !(parent->flags &TCQ_F_MQROOT ) && +rcu_access_pointer (new->stab)) { +NL_SET_ERR_MSG (extack,"STAB not supported on a non root" ); +return -EINVAL ; + } err = cops->graft (parent, cl, new, &old, extack);if (err)return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 753/798 net: ibm: emac: mal: fix wrong goto
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit 08c8acc9d8f3f70d62dd928571368d5018206490 ]
dcr_map is called in the previous if and therefore needs to be unmapped.
--- drivers/net/ethernet/ibm/emac/mal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/ibm/emac/mal.c +1 -1
@@ -576,7 +576,7 @@ static int mal_probe(struct platform_device *ofdev)printk (KERN_ERR "%pOF: Support for 405EZ not enabled!\n" , ofdev->dev.of_node); err = -ENODEV ; - goto fail; + goto fail_unmap;#endif }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 754/798 btrfs: zoned: fix missing RCU locking in error message when loading zone info
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit fe4cd7ed128fe82ab9fe4f9fc8a73d4467699787 ]
At btrfs_load_zone_info() we have an error path that is dereferencing the name of a device which is a RCU string but we are not holding a RCU read lock, which is incorrect.
Fix this by using btrfs_err_in_rcu() instead of btrfs_err().
The problem is there since commit 08e11a3db098 ("btrfs: zoned: load zone's allocation offset"), back then at btrfs_load_block_group_zone_info() but then later on that code was factored out into the helper btrfs_load_zone_info() by commit 09a46725cc84 ("btrfs: zoned: factor out per-zone logic from btrfs_load_block_group_zone_info").
--- fs/btrfs/zoned.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/zoned.c +1 -1
@@ -1345,7 +1345,7 @@ static int btrfs_load_zone_info(struct btrfs_fs_info *fs_info, int zone_idx,switch (zone.cond) {case BLK_ZONE_COND_OFFLINE :case BLK_ZONE_COND_READONLY : -btrfs_err (fs_info, +btrfs_err_in_rcu (fs_info,"zoned: offline/readonly zone %llu on device %s (devid %llu)" , (info->physical >> device->zone_info->zone_size_shift),rcu_str_deref (device->name), device->devid);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 755/798 sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 4d5c70e6155d5eae198bade4afeab3c1b15073b6 ]
If hashing fails in sctp_listen_start(), the socket remains in the LISTENING state, even though it was not added to the hash table. This can lead to a scenario where a socket appears to be listening without actually being accessible.
This patch ensures that if the hashing operation fails, the sk_state is set back to CLOSED before returning an error.
Note that there is no need to undo the autobind operation if hashing fails, as the bind port can still be used for next listen() call on the same socket.
--- net/sctp/socket.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
net/sctp/socket.c +13 -5
@@ -8520,6 +8520,7 @@ static int sctp_listen_start(struct sock *sk, int backlog)struct sctp_endpoint *ep = sp->ep;struct crypto_shash *tfm =NULL ;char alg[32 ]; +int err;/* Allocate HMAC for generating cookie. */ if (!sp->hmac && sp->sctp_hmac_alg) {
@@ -8547,18 +8548,25 @@ static int sctp_listen_start(struct sock *sk, int backlog)inet_sk_set_state (sk,SCTP_SS_LISTENING );if (!ep->base.bind_addr.port) {if (sctp_autobind (sk)) { -inet_sk_set_state (sk,SCTP_SS_CLOSED ); -return -EAGAIN ; + err = -EAGAIN ; + goto err; } }else {if (sctp_get_port (sk,inet_sk (sk)->inet_num)) { -inet_sk_set_state (sk,SCTP_SS_CLOSED ); -return -EADDRINUSE ; + err = -EADDRINUSE ; + goto err; } }WRITE_ONCE (sk->sk_max_ack_backlog, backlog); -return sctp_hash_endpoint (ep); + err =sctp_hash_endpoint (ep); +if (err) + goto err; + +return 0 ; +err: +inet_sk_set_state (sk,SCTP_SS_CLOSED ); +return err; }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 756/798 netfilter: xtables: avoid NFPROTO_UNSPEC where needed
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 0bfcb7b71e735560077a42847f69597ec7dcc326 ]
syzbot managed to call xt_cluster match via ebtables:
WARNING: CPU: 0 PID: 11 at net/netfilter/xt_cluster.c:72 xt_cluster_mt+0x196/0x780 [..] ebt_do_table+0x174b/0x2a40
Module registers to NFPROTO_UNSPEC, but it assumes ipv4/ipv6 packet processing. As this is only useful to restrict locally terminating TCP/UDP traffic, register this for ipv4 and ipv6 family only.
Pablo points out that this is a general issue, direct users of the set/getsockopt interface can call into targets/matches that were only intended for use with ip(6)tables.
Check all UNSPEC matches and targets for similar issues:
- matches and targets are fine except if they assume skb_network_header() is valid -- this is only true when called from inet layer: ip(6) stack pulls the ip/ipv6 header into linear data area.
- targets that return XT_CONTINUE or other xtables verdicts must be restricted too, they are incompatbile with the ebtables traverser, e.g. EBT_CONTINUE is a completely different value than XT_CONTINUE.
Most matches/targets are changed to register for NFPROTO_IPV4/IPV6, as they are provided for use by ip(6)tables.
The MARK target is also used by arptables, so register for NFPROTO_ARP too.
While at it, bail out if connbytes fails to enable the corresponding conntrack family.
This change passes the selftests in iptables.git.
--- net/netfilter/xt_CHECKSUM.c | 33 ++++++---- net/netfilter/xt_CLASSIFY.c | 16 ++++- net/netfilter/xt_CONNSECMARK.c | 36 +++++++---- net/netfilter/xt_CT.c | 106 +++++++++++++++++++++------------ net/netfilter/xt_IDLETIMER.c | 59 ++++++++++++------ net/netfilter/xt_LED.c | 39 ++++++++---- net/netfilter/xt_NFLOG.c | 36 +++++++---- net/netfilter/xt_RATEEST.c | 39 ++++++++---- net/netfilter/xt_SECMARK.c | 27 ++++++++- net/netfilter/xt_TRACE.c | 35 +++++++---- net/netfilter/xt_addrtype.c | 15 ++++- net/netfilter/xt_cluster.c | 33 ++++++---- net/netfilter/xt_connbytes.c | 4 +- net/netfilter/xt_connlimit.c | 39 ++++++++---- net/netfilter/xt_connmark.c | 28 ++++++++- net/netfilter/xt_mark.c | 42 +++++++++---- 16 files changed, 422 insertions(+), 165 deletions(-)
net/netfilter/xt_CHECKSUM.c +23 -10
@@ -63,24 +63,37 @@ static int checksum_tg_check(const struct xt_tgchk_param *par)return 0 ; } -static struct xt_target checksum_tg_reg__read_mostly = { - .name ="CHECKSUM" , - .family =NFPROTO_UNSPEC , - .target = checksum_tg, - .targetsize =sizeof (struct xt_CHECKSUM_info ), - .table ="mangle" , - .checkentry = checksum_tg_check, - .me =THIS_MODULE , +static struct xt_target checksum_tg_reg[]__read_mostly = { + { + .name ="CHECKSUM" , + .family =NFPROTO_IPV4 , + .target = checksum_tg, + .targetsize =sizeof (struct xt_CHECKSUM_info ), + .table ="mangle" , + .checkentry = checksum_tg_check, + .me =THIS_MODULE , + }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name ="CHECKSUM" , + .family =NFPROTO_IPV6 , + .target = checksum_tg, + .targetsize =sizeof (struct xt_CHECKSUM_info ), + .table ="mangle" , + .checkentry = checksum_tg_check, + .me =THIS_MODULE , + }, +#endif };static int __init checksum_tg_init (void ) { -return xt_register_target (&checksum_tg_reg); +return xt_register_targets (checksum_tg_reg,ARRAY_SIZE (checksum_tg_reg)); } static void __exit checksum_tg_exit(void) { -xt_unregister_target (&checksum_tg_reg); +xt_unregister_targets (checksum_tg_reg,ARRAY_SIZE (checksum_tg_reg)); }module_init (checksum_tg_init);
net/netfilter/xt_CLASSIFY.c +14 -2
@@ -38,9 +38,9 @@ static struct xt_target classify_tg_reg[] __read_mostly = { { .name = "CLASSIFY", .revision = 0, - .family = NFPROTO_UNSPEC, + .family = NFPROTO_IPV4, .hooks = (1 <<NF_INET_LOCAL_OUT ) | (1 <<NF_INET_FORWARD ) | - (1 << NF_INET_POST_ROUTING), + (1 << NF_INET_POST_ROUTING), .target = classify_tg, .targetsize = sizeof(struct xt_classify_target_info), .me = THIS_MODULE,
@@ -54,6 +54,18 @@ static struct xt_target classify_tg_reg[] __read_mostly = { .targetsize = sizeof(struct xt_classify_target_info), .me = THIS_MODULE, }, +#if IS_ENABLED (CONFIG_IP6_NF_IPTABLES ) + { + .name = "CLASSIFY", + .revision = 0, + .family = NFPROTO_IPV6, + .hooks = (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_FORWARD) | + (1 << NF_INET_POST_ROUTING), + .target = classify_tg, + .targetsize = sizeof(struct xt_classify_target_info), + .me = THIS_MODULE, + }, +#endif };static int __init classify_tg_init (void )
net/netfilter/xt_CONNSECMARK.c +25 -11
@@ -114,25 +114,39 @@ static void connsecmark_tg_destroy(const struct xt_tgdtor_param *par)nf_ct_netns_put (par->net, par->family); } -static struct xt_target connsecmark_tg_reg__read_mostly = { - .name ="CONNSECMARK" , - .revision =0 , - .family =NFPROTO_UNSPEC , - .checkentry = connsecmark_tg_check, - .destroy = connsecmark_tg_destroy, - .target = connsecmark_tg, - .targetsize =sizeof (struct xt_connsecmark_target_info ), - .me =THIS_MODULE , +static struct xt_target connsecmark_tg_reg[]__read_mostly = { + { + .name ="CONNSECMARK" , + .revision =0 , + .family =NFPROTO_IPV4 , + .checkentry = connsecmark_tg_check, + .destroy = connsecmark_tg_destroy, + .target = connsecmark_tg, + .targetsize =sizeof (struct xt_connsecmark_target_info ), + .me =THIS_MODULE , + }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name ="CONNSECMARK" , + .revision =0 , + .family =NFPROTO_IPV6 , + .checkentry = connsecmark_tg_check, + .destroy = connsecmark_tg_destroy, + .target = connsecmark_tg, + .targetsize =sizeof (struct xt_connsecmark_target_info ), + .me =THIS_MODULE , + }, +#endif };static int __init connsecmark_tg_init (void ) { -return xt_register_target (&connsecmark_tg_reg); +return xt_register_targets (connsecmark_tg_reg,ARRAY_SIZE (connsecmark_tg_reg)); } static void __exit connsecmark_tg_exit(void) { -xt_unregister_target (&connsecmark_tg_reg); +xt_unregister_targets (connsecmark_tg_reg,ARRAY_SIZE (connsecmark_tg_reg)); }module_init (connsecmark_tg_init);
net/netfilter/xt_CT.c +69 -37
142 lines not on this page · raw message
net/netfilter/xt_IDLETIMER.c +40 -19
68 lines not on this page · raw message
net/netfilter/xt_LED.c +27 -12
@@ -176,26 +176,41 @@ static void led_tg_destroy(const struct xt_tgdtor_param *par)kfree (ledinternal); } -static struct xt_target led_tg_reg__read_mostly = { - .name ="LED" , - .revision =0 , - .family =NFPROTO_UNSPEC , - .target = led_tg, - .targetsize =sizeof (struct xt_led_info ), - .usersize = offsetof(struct xt_led_info , internal_data), - .checkentry = led_tg_check, - .destroy = led_tg_destroy, - .me =THIS_MODULE , +static struct xt_target led_tg_reg[]__read_mostly = { + { + .name ="LED" , + .revision =0 , + .family =NFPROTO_IPV4 , + .target = led_tg, + .targetsize =sizeof (struct xt_led_info ), + .usersize = offsetof(struct xt_led_info , internal_data), + .checkentry = led_tg_check, + .destroy = led_tg_destroy, + .me =THIS_MODULE , + }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name ="LED" , + .revision =0 , + .family =NFPROTO_IPV6 , + .target = led_tg, + .targetsize =sizeof (struct xt_led_info ), + .usersize = offsetof(struct xt_led_info , internal_data), + .checkentry = led_tg_check, + .destroy = led_tg_destroy, + .me =THIS_MODULE , + }, +#endif };static int __init led_tg_init (void ) { -return xt_register_target (&led_tg_reg); +return xt_register_targets (led_tg_reg,ARRAY_SIZE (led_tg_reg)); } static void __exit led_tg_exit(void) { -xt_unregister_target (&led_tg_reg); +xt_unregister_targets (led_tg_reg,ARRAY_SIZE (led_tg_reg)); }module_init (led_tg_init);
net/netfilter/xt_NFLOG.c +25 -11
@@ -64,25 +64,39 @@ static void nflog_tg_destroy(const struct xt_tgdtor_param *par)nf_logger_put (par->family,NF_LOG_TYPE_ULOG ); } -static struct xt_target nflog_tg_reg__read_mostly = { - .name ="NFLOG" , - .revision =0 , - .family =NFPROTO_UNSPEC , - .checkentry = nflog_tg_check, - .destroy = nflog_tg_destroy, - .target = nflog_tg, - .targetsize =sizeof (struct xt_nflog_info ), - .me =THIS_MODULE , +static struct xt_target nflog_tg_reg[]__read_mostly = { + { + .name ="NFLOG" , + .revision =0 , + .family =NFPROTO_IPV4 , + .checkentry = nflog_tg_check, + .destroy = nflog_tg_destroy, + .target = nflog_tg, + .targetsize =sizeof (struct xt_nflog_info ), + .me =THIS_MODULE , + }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name ="NFLOG" , + .revision =0 , + .family =NFPROTO_IPV4 , + .checkentry = nflog_tg_check, + .destroy = nflog_tg_destroy, + .target = nflog_tg, + .targetsize =sizeof (struct xt_nflog_info ), + .me =THIS_MODULE , + }, +#endif };static int __init nflog_tg_init (void ) { -return xt_register_target (&nflog_tg_reg); +return xt_register_targets (nflog_tg_reg,ARRAY_SIZE (nflog_tg_reg)); } static void __exit nflog_tg_exit(void) { -xt_unregister_target (&nflog_tg_reg); +xt_unregister_targets (nflog_tg_reg,ARRAY_SIZE (nflog_tg_reg)); }module_init (nflog_tg_init);
net/netfilter/xt_RATEEST.c +27 -12
@@ -179,16 +179,31 @@ static void xt_rateest_tg_destroy(const struct xt_tgdtor_param *par)xt_rateest_put (par->net, info->est); } -static struct xt_target xt_rateest_tg_reg__read_mostly = { - .name ="RATEEST" , - .revision =0 , - .family =NFPROTO_UNSPEC , - .target = xt_rateest_tg, - .checkentry = xt_rateest_tg_checkentry, - .destroy = xt_rateest_tg_destroy, - .targetsize =sizeof (struct xt_rateest_target_info ), - .usersize = offsetof(struct xt_rateest_target_info , est), - .me =THIS_MODULE , +static struct xt_target xt_rateest_tg_reg[]__read_mostly = { + { + .name ="RATEEST" , + .revision =0 , + .family =NFPROTO_IPV4 , + .target = xt_rateest_tg, + .checkentry = xt_rateest_tg_checkentry, + .destroy = xt_rateest_tg_destroy, + .targetsize =sizeof (struct xt_rateest_target_info ), + .usersize = offsetof(struct xt_rateest_target_info , est), + .me =THIS_MODULE , + }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name ="RATEEST" , + .revision =0 , + .family =NFPROTO_IPV6 , + .target = xt_rateest_tg, + .checkentry = xt_rateest_tg_checkentry, + .destroy = xt_rateest_tg_destroy, + .targetsize =sizeof (struct xt_rateest_target_info ), + .usersize = offsetof(struct xt_rateest_target_info , est), + .me =THIS_MODULE , + }, +#endif };static __net_init int xt_rateest_net_init (struct net *net)
@@ -214,12 +229,12 @@ static int __init xt_rateest_tg_init(void)if (err)return err; -return xt_register_target (&xt_rateest_tg_reg); +return xt_register_targets (xt_rateest_tg_reg,ARRAY_SIZE (xt_rateest_tg_reg)); } static void __exit xt_rateest_tg_fini(void) { -xt_unregister_target (&xt_rateest_tg_reg); +xt_unregister_targets (xt_rateest_tg_reg,ARRAY_SIZE (xt_rateest_tg_reg));unregister_pernet_subsys (&xt_rateest_net_ops); }
net/netfilter/xt_SECMARK.c +25 -2
@@ -157,7 +157,7 @@ static struct xt_target secmark_tg_reg[] __read_mostly = { { .name = "SECMARK", .revision = 0, - .family = NFPROTO_UNSPEC, + .family = NFPROTO_IPV4, .checkentry = secmark_tg_check_v0, .destroy = secmark_tg_destroy, .target = secmark_tg_v0,
@@ -167,7 +167,7 @@ static struct xt_target secmark_tg_reg[] __read_mostly = { { .name = "SECMARK", .revision = 1, - .family = NFPROTO_UNSPEC, + .family = NFPROTO_IPV4, .checkentry = secmark_tg_check_v1, .destroy = secmark_tg_destroy, .target = secmark_tg_v1,
@@ -175,6 +175,29 @@ static struct xt_target secmark_tg_reg[] __read_mostly = { .usersize = offsetof(struct xt_secmark_target_info_v1, secid), .me = THIS_MODULE, }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name = "SECMARK", + .revision = 0, + .family = NFPROTO_IPV6, + .checkentry = secmark_tg_check_v0, + .destroy = secmark_tg_destroy, + .target = secmark_tg_v0, + .targetsize = sizeof(struct xt_secmark_target_info), + .me = THIS_MODULE, + }, + { + .name = "SECMARK", + .revision = 1, + .family = NFPROTO_IPV6, + .checkentry = secmark_tg_check_v1, + .destroy = secmark_tg_destroy, + .target = secmark_tg_v1, + .targetsize = sizeof(struct xt_secmark_target_info_v1), + .usersize = offsetof(struct xt_secmark_target_info_v1, secid), + .me = THIS_MODULE, + }, +#endif }; static int __init secmark_tg_init(void)
net/netfilter/xt_TRACE.c +24 -11
@@ -29,25 +29,38 @@ trace_tg(struct sk_buff *skb, const struct xt_action_param *par)return XT_CONTINUE ; } -static struct xt_target trace_tg_reg__read_mostly = { - .name ="TRACE" , - .revision =0 , - .family =NFPROTO_UNSPEC , - .table ="raw" , - .target = trace_tg, - .checkentry = trace_tg_check, - .destroy = trace_tg_destroy, - .me =THIS_MODULE , +static struct xt_target trace_tg_reg[]__read_mostly = { + { + .name ="TRACE" , + .revision =0 , + .family =NFPROTO_IPV4 , + .table ="raw" , + .target = trace_tg, + .checkentry = trace_tg_check, + .destroy = trace_tg_destroy, + .me =THIS_MODULE , + }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name ="TRACE" , + .revision =0 , + .family =NFPROTO_IPV6 , + .table ="raw" , + .target = trace_tg, + .checkentry = trace_tg_check, + .destroy = trace_tg_destroy, + }, +#endif };static int __init trace_tg_init (void ) { -return xt_register_target (&trace_tg_reg); +return xt_register_targets (trace_tg_reg,ARRAY_SIZE (trace_tg_reg)); } static void __exit trace_tg_exit(void) { -xt_unregister_target (&trace_tg_reg); +xt_unregister_targets (trace_tg_reg,ARRAY_SIZE (trace_tg_reg)); }module_init (trace_tg_init);
net/netfilter/xt_addrtype.c +13 -2
@@ -208,13 +208,24 @@ static struct xt_match addrtype_mt_reg[] __read_mostly = { }, { .name = "addrtype", - .family = NFPROTO_UNSPEC, + .family = NFPROTO_IPV4, .revision = 1, .match = addrtype_mt_v1, .checkentry = addrtype_mt_checkentry_v1, .matchsize = sizeof(struct xt_addrtype_info_v1), .me = THIS_MODULE - } + }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name = "addrtype", + .family = NFPROTO_IPV6, + .revision = 1, + .match = addrtype_mt_v1, + .checkentry = addrtype_mt_checkentry_v1, + .matchsize = sizeof(struct xt_addrtype_info_v1), + .me = THIS_MODULE + }, +#endif }; static int __init addrtype_mt_init(void)
net/netfilter/xt_cluster.c +23 -10
@@ -146,24 +146,37 @@ static void xt_cluster_mt_destroy(const struct xt_mtdtor_param *par)nf_ct_netns_put (par->net, par->family); } -static struct xt_match xt_cluster_match__read_mostly = { - .name ="cluster" , - .family =NFPROTO_UNSPEC , - .match = xt_cluster_mt, - .checkentry = xt_cluster_mt_checkentry, - .matchsize =sizeof (struct xt_cluster_match_info ), - .destroy = xt_cluster_mt_destroy, - .me =THIS_MODULE , +static struct xt_match xt_cluster_match[]__read_mostly = { + { + .name ="cluster" , + .family =NFPROTO_IPV4 , + .match = xt_cluster_mt, + .checkentry = xt_cluster_mt_checkentry, + .matchsize =sizeof (struct xt_cluster_match_info ), + .destroy = xt_cluster_mt_destroy, + .me =THIS_MODULE , + }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name ="cluster" , + .family =NFPROTO_IPV6 , + .match = xt_cluster_mt, + .checkentry = xt_cluster_mt_checkentry, + .matchsize =sizeof (struct xt_cluster_match_info ), + .destroy = xt_cluster_mt_destroy, + .me =THIS_MODULE , + }, +#endif };static int __init xt_cluster_mt_init (void ) { -return xt_register_match (&xt_cluster_match); +return xt_register_matches (xt_cluster_match,ARRAY_SIZE (xt_cluster_match)); } static void __exit xt_cluster_mt_fini(void) { -xt_unregister_match (&xt_cluster_match); +xt_unregister_matches (xt_cluster_match,ARRAY_SIZE (xt_cluster_match)); }MODULE_AUTHOR ("Pablo Neira Ayuso <[email protected]>" );
net/netfilter/xt_connbytes.c +3 -1
@@ -111,9 +111,11 @@ static int connbytes_mt_check(const struct xt_mtchk_param *par)return -EINVAL ; ret =nf_ct_netns_get (par->net, par->family); -if (ret <0 ) +if (ret <0 ) {pr_info_ratelimited ("cannot load conntrack support for proto=%u\n" , par->family); +return ret; + }/* * This filter cannot function correctly unless connection tracking
net/netfilter/xt_connlimit.c +27 -12
@@ -106,26 +106,41 @@ static void connlimit_mt_destroy(const struct xt_mtdtor_param *par)nf_conncount_destroy (par->net, par->family, info->data); } -static struct xt_match connlimit_mt_reg__read_mostly = { - .name ="connlimit" , - .revision =1 , - .family =NFPROTO_UNSPEC , - .checkentry = connlimit_mt_check, - .match = connlimit_mt, - .matchsize =sizeof (struct xt_connlimit_info ), - .usersize = offsetof(struct xt_connlimit_info , data), - .destroy = connlimit_mt_destroy, - .me =THIS_MODULE , +static struct xt_match connlimit_mt_reg[]__read_mostly = { + { + .name ="connlimit" , + .revision =1 , + .family =NFPROTO_IPV4 , + .checkentry = connlimit_mt_check, + .match = connlimit_mt, + .matchsize =sizeof (struct xt_connlimit_info ), + .usersize = offsetof(struct xt_connlimit_info , data), + .destroy = connlimit_mt_destroy, + .me =THIS_MODULE , + }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name ="connlimit" , + .revision =1 , + .family =NFPROTO_IPV6 , + .checkentry = connlimit_mt_check, + .match = connlimit_mt, + .matchsize =sizeof (struct xt_connlimit_info ), + .usersize = offsetof(struct xt_connlimit_info , data), + .destroy = connlimit_mt_destroy, + .me =THIS_MODULE , + }, +#endif };static int __init connlimit_mt_init (void ) { -return xt_register_match (&connlimit_mt_reg); +return xt_register_matches (connlimit_mt_reg,ARRAY_SIZE (connlimit_mt_reg)); } static void __exit connlimit_mt_exit(void) { -xt_unregister_match (&connlimit_mt_reg); +xt_unregister_matches (connlimit_mt_reg,ARRAY_SIZE (connlimit_mt_reg)); }module_init (connlimit_mt_init);
net/netfilter/xt_connmark.c +25 -3
@@ -151,7 +151,7 @@ static struct xt_target connmark_tg_reg[] __read_mostly = { { .name = "CONNMARK", .revision = 1, - .family = NFPROTO_UNSPEC, + .family = NFPROTO_IPV4, .checkentry = connmark_tg_check, .target = connmark_tg, .targetsize = sizeof(struct xt_connmark_tginfo1),
@@ -161,13 +161,35 @@ static struct xt_target connmark_tg_reg[] __read_mostly = { { .name = "CONNMARK", .revision = 2, - .family = NFPROTO_UNSPEC, + .family = NFPROTO_IPV4, .checkentry = connmark_tg_check, .target = connmark_tg_v2, .targetsize = sizeof(struct xt_connmark_tginfo2), .destroy = connmark_tg_destroy, .me = THIS_MODULE, - } + }, +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + { + .name = "CONNMARK", + .revision = 1, + .family = NFPROTO_IPV6, + .checkentry = connmark_tg_check, + .target = connmark_tg, + .targetsize = sizeof(struct xt_connmark_tginfo1), + .destroy = connmark_tg_destroy, + .me = THIS_MODULE, + }, + { + .name = "CONNMARK", + .revision = 2, + .family = NFPROTO_IPV6, + .checkentry = connmark_tg_check, + .target = connmark_tg_v2, + .targetsize = sizeof(struct xt_connmark_tginfo2), + .destroy = connmark_tg_destroy, + .me = THIS_MODULE, + }, +#endif }; static struct xt_match connmark_mt_reg __read_mostly = {
net/netfilter/xt_mark.c +32 -10
64 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 757/798 netfilter: fib: check correct rtable in vrf setups
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 05ef7055debc804e8083737402127975e7244fc4 ]
We need to init l3mdev unconditionally, else main routing table is searched and incorrect result is returned unless strict (iif keyword) matching is requested.
Next patch adds a selftest for this.
--- net/ipv4/netfilter/nft_fib_ipv4.c | 4 +--- net/ipv6/netfilter/nft_fib_ipv6.c | 5 +++-- 2 files changed, 4 insertions(+), 5 deletions(-)
net/ipv4/netfilter/nft_fib_ipv4.c +1 -3
@@ -66,6 +66,7 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs, .flowi4_scope = RT_SCOPE_UNIVERSE, .flowi4_iif = LOOPBACK_IFINDEX, .flowi4_uid = sock_net_uid(nft_net(pkt), NULL), + .flowi4_l3mdev = l3mdev_master_ifindex_rcu(nft_in(pkt)), };const struct net_device *oif;const struct net_device *found;
@@ -84,9 +85,6 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,else oif =NULL ; -if (priv->flags &NFTA_FIB_F_IIF ) - fl4.flowi4_l3mdev =l3mdev_master_ifindex_rcu (oif); -if (nft_hook (pkt) ==NF_INET_PRE_ROUTING &&nft_fib_is_loopback (pkt->skb,nft_in (pkt))) {nft_fib_store_result (dest, priv,nft_in (pkt));
net/ipv6/netfilter/nft_fib_ipv6.c +3 -2
@@ -41,8 +41,6 @@ static int nft_fib6_flowi_init(struct flowi6 *fl6, const struct nft_fib *priv,if (ipv6_addr_type (&fl6->daddr) &IPV6_ADDR_LINKLOCAL ) { lookup_flags |=RT6_LOOKUP_F_IFACE ; fl6->flowi6_oif =get_ifindex (dev ? dev : pkt->skb->dev); - }else if (priv->flags &NFTA_FIB_F_IIF ) { - fl6->flowi6_l3mdev =l3mdev_master_ifindex_rcu (dev); }if (ipv6_addr_type (&fl6->saddr) &IPV6_ADDR_UNICAST )
@@ -75,6 +73,8 @@ static u32 __nft_fib6_eval_type(const struct nft_fib *priv,else if (priv->flags &NFTA_FIB_F_OIF ) dev =nft_out (pkt); + fl6.flowi6_l3mdev =l3mdev_master_ifindex_rcu (dev); +nft_fib6_flowi_init (&fl6, priv, pkt, dev, iph);if (dev &&nf_ipv6_chk_addr (nft_net (pkt), &fl6.daddr, dev, true))
@@ -165,6 +165,7 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs, .flowi6_iif = LOOPBACK_IFINDEX, .flowi6_proto = pkt->tprot, .flowi6_uid = sock_net_uid(nft_net(pkt), NULL), + .flowi6_l3mdev = l3mdev_master_ifindex_rcu(nft_in(pkt)), };struct rt6_info *rt;int lookup_flags;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 758/798 net: ibm/emac: allocate dummy net_device dynamically
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit 2eb5e25d84956c264dc03fc45deb3701f3a0ccea ]
Embedding net_device into structures prohibits the usage of flexible arrays in the net_device structure. For more details, see the discussion at [1].
Un-embed the net_device from the private struct by converting it into a pointer. Then use the leverage the new alloc_netdev_dummy() helper to allocate and initialize dummy devices.
[1] https://lore.kernel.org/all/[email protected]/
Stable-dep-of: 080ddc22f3b0 ("net: ibm: emac: mal: add dcr_unmap to _remove")
--- drivers/net/ethernet/ibm/emac/mal.c | 14 +++++++++++--- drivers/net/ethernet/ibm/emac/mal.h | 2 +- 2 files changed, 12 insertions(+), 4 deletions(-)
drivers/net/ethernet/ibm/emac/mal.c +11 -3
@@ -603,9 +603,13 @@ static int mal_probe(struct platform_device *ofdev)INIT_LIST_HEAD (&mal->list);spin_lock_init (&mal->lock); -init_dummy_netdev (&mal->dummy_dev); + mal->dummy_dev =alloc_netdev_dummy (0 ); +if (!mal->dummy_dev) { + err = -ENOMEM ; + goto fail_unmap; + } -netif_napi_add_weight (&mal->dummy_dev, &mal->napi, mal_poll, +netif_napi_add_weight (mal->dummy_dev, &mal->napi, mal_poll,CONFIG_IBM_EMAC_POLL_WEIGHT );/* Load power-on reset defaults */
@@ -635,7 +639,7 @@ static int mal_probe(struct platform_device *ofdev) GFP_KERNEL);if (mal->bd_virt ==NULL ) { err = -ENOMEM ; - goto fail_unmap; + goto fail_dummy; }for (i =0 ; i < mal->num_tx_chans; ++i)
@@ -701,6 +705,8 @@ static int mal_probe(struct platform_device *ofdev)free_irq (mal->serr_irq, mal); fail2:dma_free_coherent (&ofdev->dev, bd_size, mal->bd_virt, mal->bd_dma); + fail_dummy: +free_netdev (mal->dummy_dev); fail_unmap:dcr_unmap (mal->dcr_host,0x100 ); fail:
@@ -732,6 +738,8 @@ static int mal_remove(struct platform_device *ofdev)mal_reset (mal); +free_netdev (mal->dummy_dev); + dma_free_coherent(&ofdev->dev, sizeof(struct mal_descriptor) * (NUM_TX_BUFF * mal->num_tx_chans +
drivers/net/ethernet/ibm/emac/mal.h +1 -1
@@ -205,7 +205,7 @@ struct mal_instance {int index;spinlock_t lock; -struct net_device dummy_dev; +struct net_device *dummy_dev;unsigned int features; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 759/798 net: ibm: emac: mal: add dcr_unmap to _remove
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit 080ddc22f3b0a58500f87e8e865aabbf96495eea ]
It's done in probe so it should be undone here.
--- drivers/net/ethernet/ibm/emac/mal.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/ibm/emac/mal.c +2 -0
@@ -740,6 +740,8 @@ static int mal_remove(struct platform_device *ofdev)free_netdev (mal->dummy_dev); +dcr_unmap (mal->dcr_host,0x100 ); + dma_free_coherent(&ofdev->dev, sizeof(struct mal_descriptor) * (NUM_TX_BUFF * mal->num_tx_chans +
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 760/798 rtnetlink: Add bulk registration helpers for rtnetlink message handlers.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 07cc7b0b942bf55ef1a471470ecda8d2a6a6541f ]
Before commit addf9b90de22 ("net: rtnetlink: use rcu to free rtnl message handlers"), once rtnl_msg_handlers[protocol] was allocated, the following rtnl_register_module() for the same protocol never failed.
However, after the commit, rtnl_msg_handler[protocol][msgtype] needs to be allocated in each rtnl_register_module(), so each call could fail.
Many callers of rtnl_register_module() do not handle the returned error, and we need to add many error handlings.
To handle that easily, let's add wrapper functions for bulk registration of rtnetlink message handlers.
Stable-dep-of: 78b7b991838a ("vxlan: Handle error of rtnl_register_module().")
--- include/net/rtnetlink.h | 17 +++++++++++++++++ net/core/rtnetlink.c | 29 +++++++++++++++++++++++++++++ 2 files changed, 46 insertions(+)
include/net/rtnetlink.h +17 -0
@@ -27,6 +27,15 @@ static inline enum rtnl_kinds rtnl_msgtype_kind(int msgtype)return msgtype &RTNL_KIND_MASK ; } +struct rtnl_msg_handler { +struct module *owner; +int protocol; +int msgtype; +rtnl_doit_func doit; +rtnl_dumpit_func dumpit; +int flags; +}; +void rtnl_register (int protocol,int msgtype,rtnl_doit_func ,rtnl_dumpit_func ,unsigned int flags); int rtnl_register_module(struct module *owner, int protocol, int msgtype,
@@ -34,6 +43,14 @@ int rtnl_register_module(struct module *owner, int protocol, int msgtype,int rtnl_unregister (int protocol,int msgtype);void rtnl_unregister_all (int protocol); +int __rtnl_register_many (const struct rtnl_msg_handler *handlers,int n); +void __rtnl_unregister_many (const struct rtnl_msg_handler *handlers,int n); + +#define rtnl_register_many (handlers) \ + __rtnl_register_many(handlers, ARRAY_SIZE(handlers)) +#define rtnl_unregister_many (handlers) \ + __rtnl_unregister_many(handlers, ARRAY_SIZE(handlers)) +static inline int rtnl_msg_family (const struct nlmsghdr *nlh) {if (nlmsg_len (nlh) >=sizeof (struct rtgenmsg ))
net/core/rtnetlink.c +29 -0
@@ -385,6 +385,35 @@ void rtnl_unregister_all(int protocol) }EXPORT_SYMBOL_GPL (rtnl_unregister_all); +int __rtnl_register_many (const struct rtnl_msg_handler *handlers,int n) +{ +const struct rtnl_msg_handler *handler; +int i, err; + +for (i =0 , handler = handlers; i < n; i++, handler++) { + err =rtnl_register_internal (handler->owner, handler->protocol, + handler->msgtype, handler->doit, + handler->dumpit, handler->flags); +if (err) { +__rtnl_unregister_many (handlers, i); +break ; + } + } + +return err; +} +EXPORT_SYMBOL_GPL (__rtnl_register_many); + +void __rtnl_unregister_many (const struct rtnl_msg_handler *handlers,int n) +{ +const struct rtnl_msg_handler *handler; +int i; + +for (i = n -1 , handler = handlers + n -1 ; i >=0 ; i--, handler--) +rtnl_unregister (handler->protocol, handler->msgtype); +} +EXPORT_SYMBOL_GPL (__rtnl_unregister_many); +static LIST_HEAD (link_ops);static const struct rtnl_link_ops *rtnl_link_ops_get (const char *kind)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 761/798 vxlan: Handle error of rtnl_register_module().
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 78b7b991838a4a6baeaad934addc4db2c5917eb8 ]
Since introduced, vxlan_vnifilter_init() has been ignoring the returned value of rtnl_register_module(), which could fail silently.
Handling the error allows users to view a module as an all-or-nothing thing in terms of the rtnetlink functionality. This prevents syzkaller from reporting spurious errors from its tests, where OOM often occurs and module is automatically loaded.
Let's handle the errors by rtnl_register_many().
--- drivers/net/vxlan/vxlan_core.c | 6 +++++- drivers/net/vxlan/vxlan_private.h | 2 +- drivers/net/vxlan/vxlan_vnifilter.c | 19 +++++++++---------- 3 files changed, 15 insertions(+), 12 deletions(-)
drivers/net/vxlan/vxlan_core.c +5 -1
@@ -4803,9 +4803,13 @@ static int __init vxlan_init_module(void)if (rc) goto out4; -vxlan_vnifilter_init (); + rc =vxlan_vnifilter_init (); +if (rc) + goto out5;return 0 ; +out5: +rtnl_link_unregister (&vxlan_link_ops); out4:unregister_switchdev_notifier (&vxlan_switchdev_notifier_block); out3:
drivers/net/vxlan/vxlan_private.h +1 -1
@@ -134,7 +134,7 @@ int vxlan_vni_in_use(struct net *src_net, struct vxlan_dev *vxlan,int vxlan_vnigroup_init (struct vxlan_dev *vxlan);void vxlan_vnigroup_uninit (struct vxlan_dev *vxlan); -void vxlan_vnifilter_init (void ); +int vxlan_vnifilter_init (void );void vxlan_vnifilter_uninit (void ); void vxlan_vnifilter_count(struct vxlan_dev *vxlan, __be32 vni, struct vxlan_vni_node *vninode,
drivers/net/vxlan/vxlan_vnifilter.c +9 -10
@@ -992,19 +992,18 @@ static int vxlan_vnifilter_process(struct sk_buff *skb, struct nlmsghdr *nlh,return err; } -void vxlan_vnifilter_init (void ) +static const struct rtnl_msg_handler vxlan_vnifilter_rtnl_msg_handlers[] = { + {THIS_MODULE ,PF_BRIDGE ,RTM_GETTUNNEL ,NULL , vxlan_vnifilter_dump,0 }, + {THIS_MODULE ,PF_BRIDGE ,RTM_NEWTUNNEL , vxlan_vnifilter_process,NULL ,0 }, + {THIS_MODULE ,PF_BRIDGE ,RTM_DELTUNNEL , vxlan_vnifilter_process,NULL ,0 }, +}; + +int vxlan_vnifilter_init (void ) { -rtnl_register_module (THIS_MODULE ,PF_BRIDGE ,RTM_GETTUNNEL ,NULL , - vxlan_vnifilter_dump,0 ); -rtnl_register_module (THIS_MODULE ,PF_BRIDGE ,RTM_NEWTUNNEL , - vxlan_vnifilter_process,NULL ,0 ); -rtnl_register_module (THIS_MODULE ,PF_BRIDGE ,RTM_DELTUNNEL , - vxlan_vnifilter_process,NULL ,0 ); +return rtnl_register_many (vxlan_vnifilter_rtnl_msg_handlers); }void vxlan_vnifilter_uninit (void ) { -rtnl_unregister (PF_BRIDGE ,RTM_GETTUNNEL ); -rtnl_unregister (PF_BRIDGE ,RTM_NEWTUNNEL ); -rtnl_unregister (PF_BRIDGE ,RTM_DELTUNNEL ); +rtnl_unregister_many (vxlan_vnifilter_rtnl_msg_handlers); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 762/798 mctp: Handle error of rtnl_register_module().
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit d51705614f668254cc5def7490df76f9680b4659 ]
Since introduced, mctp has been ignoring the returned value of rtnl_register_module(), which could fail silently.
Handling the error allows users to view a module as an all-or-nothing thing in terms of the rtnetlink functionality. This prevents syzkaller from reporting spurious errors from its tests, where OOM often occurs and module is automatically loaded.
Let's handle the errors by rtnl_register_many().
--- include/net/mctp.h | 2 +- net/mctp/af_mctp.c | 6 +++++- net/mctp/device.c | 30 ++++++++++++++++++------------ net/mctp/neigh.c | 31 +++++++++++++++++++------------ net/mctp/route.c | 33 +++++++++++++++++++++++---------- 5 files changed, 66 insertions(+), 36 deletions(-)
include/net/mctp.h +1 -1
@@ -293,7 +293,7 @@ void mctp_neigh_remove_dev(struct mctp_dev *mdev);int mctp_routes_init (void );void mctp_routes_exit (void ); -void mctp_device_init (void ); +int mctp_device_init (void );void mctp_device_exit (void );#endif /* __NET_MCTP_H */
net/mctp/af_mctp.c +5 -1
@@ -677,10 +677,14 @@ static __init int mctp_init(void)if (rc) goto err_unreg_routes; -mctp_device_init (); + rc =mctp_device_init (); +if (rc) + goto err_unreg_neigh;return 0 ; +err_unreg_neigh: +mctp_neigh_exit (); err_unreg_routes:mctp_routes_exit (); err_unreg_proto:
net/mctp/device.c +18 -12
@@ -524,25 +524,31 @@ static struct notifier_block mctp_dev_nb = { .priority = ADDRCONF_NOTIFY_PRIORITY, }; -void __init mctp_device_init (void ) +static const struct rtnl_msg_handler mctp_device_rtnl_msg_handlers[] = { + {THIS_MODULE ,PF_MCTP ,RTM_NEWADDR , mctp_rtm_newaddr,NULL ,0 }, + {THIS_MODULE ,PF_MCTP ,RTM_DELADDR , mctp_rtm_deladdr,NULL ,0 }, + {THIS_MODULE ,PF_MCTP ,RTM_GETADDR ,NULL , mctp_dump_addrinfo,0 }, +}; + +int __init mctp_device_init (void ) { -register_netdevice_notifier (&mctp_dev_nb); +int err; -rtnl_register_module (THIS_MODULE ,PF_MCTP ,RTM_GETADDR , -NULL , mctp_dump_addrinfo,0 ); -rtnl_register_module (THIS_MODULE ,PF_MCTP ,RTM_NEWADDR , - mctp_rtm_newaddr,NULL ,0 ); -rtnl_register_module (THIS_MODULE ,PF_MCTP ,RTM_DELADDR , - mctp_rtm_deladdr,NULL ,0 ); +register_netdevice_notifier (&mctp_dev_nb);rtnl_af_register (&mctp_af_ops); + + err =rtnl_register_many (mctp_device_rtnl_msg_handlers); +if (err) { +rtnl_af_unregister (&mctp_af_ops); +unregister_netdevice_notifier (&mctp_dev_nb); + } + +return err; } void __exit mctp_device_exit(void) { +rtnl_unregister_many (mctp_device_rtnl_msg_handlers);rtnl_af_unregister (&mctp_af_ops); -rtnl_unregister (PF_MCTP ,RTM_DELADDR ); -rtnl_unregister (PF_MCTP ,RTM_NEWADDR ); -rtnl_unregister (PF_MCTP ,RTM_GETADDR ); -unregister_netdevice_notifier (&mctp_dev_nb); }
net/mctp/neigh.c +19 -12
@@ -322,22 +322,29 @@ static struct pernet_operations mctp_net_ops = { .exit = mctp_neigh_net_exit, }; +static const struct rtnl_msg_handler mctp_neigh_rtnl_msg_handlers[] = { + {THIS_MODULE ,PF_MCTP ,RTM_NEWNEIGH , mctp_rtm_newneigh,NULL ,0 }, + {THIS_MODULE ,PF_MCTP ,RTM_DELNEIGH , mctp_rtm_delneigh,NULL ,0 }, + {THIS_MODULE ,PF_MCTP ,RTM_GETNEIGH ,NULL , mctp_rtm_getneigh,0 }, +}; +int __init mctp_neigh_init (void ) { -rtnl_register_module (THIS_MODULE ,PF_MCTP ,RTM_NEWNEIGH , - mctp_rtm_newneigh,NULL ,0 ); -rtnl_register_module (THIS_MODULE ,PF_MCTP ,RTM_DELNEIGH , - mctp_rtm_delneigh,NULL ,0 ); -rtnl_register_module (THIS_MODULE ,PF_MCTP ,RTM_GETNEIGH , -NULL , mctp_rtm_getneigh,0 ); - -return register_pernet_subsys (&mctp_net_ops); +int err; + + err =register_pernet_subsys (&mctp_net_ops); +if (err) +return err; + + err =rtnl_register_many (mctp_neigh_rtnl_msg_handlers); +if (err) +unregister_pernet_subsys (&mctp_net_ops); + +return err; } -void __exit mctp_neigh_exit(void) +void mctp_neigh_exit (void ) { +rtnl_unregister_many (mctp_neigh_rtnl_msg_handlers);unregister_pernet_subsys (&mctp_net_ops); -rtnl_unregister (PF_MCTP ,RTM_GETNEIGH ); -rtnl_unregister (PF_MCTP ,RTM_DELNEIGH ); -rtnl_unregister (PF_MCTP ,RTM_NEWNEIGH ); }
net/mctp/route.c +23 -10
@@ -1413,26 +1413,39 @@ static struct pernet_operations mctp_net_ops = { .exit = mctp_routes_net_exit, }; +static const struct rtnl_msg_handler mctp_route_rtnl_msg_handlers[] = { + {THIS_MODULE ,PF_MCTP ,RTM_NEWROUTE , mctp_newroute,NULL ,0 }, + {THIS_MODULE ,PF_MCTP ,RTM_DELROUTE , mctp_delroute,NULL ,0 }, + {THIS_MODULE ,PF_MCTP ,RTM_GETROUTE ,NULL , mctp_dump_rtinfo,0 }, +}; +int __init mctp_routes_init (void ) { +int err; +dev_add_pack (&mctp_packet_type); -rtnl_register_module (THIS_MODULE ,PF_MCTP ,RTM_GETROUTE , -NULL , mctp_dump_rtinfo,0 ); -rtnl_register_module (THIS_MODULE ,PF_MCTP ,RTM_NEWROUTE , - mctp_newroute,NULL ,0 ); -rtnl_register_module (THIS_MODULE ,PF_MCTP ,RTM_DELROUTE , - mctp_delroute,NULL ,0 ); + err =register_pernet_subsys (&mctp_net_ops); +if (err) + goto err_pernet; + + err =rtnl_register_many (mctp_route_rtnl_msg_handlers); +if (err) + goto err_rtnl; -return register_pernet_subsys (&mctp_net_ops); +return 0 ; + +err_rtnl: +unregister_pernet_subsys (&mctp_net_ops); +err_pernet: +dev_remove_pack (&mctp_packet_type); +return err; }void mctp_routes_exit (void ) { +rtnl_unregister_many (mctp_route_rtnl_msg_handlers);unregister_pernet_subsys (&mctp_net_ops); -rtnl_unregister (PF_MCTP ,RTM_DELROUTE ); -rtnl_unregister (PF_MCTP ,RTM_NEWROUTE ); -rtnl_unregister (PF_MCTP ,RTM_GETROUTE );dev_remove_pack (&mctp_packet_type); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 763/798 ppp: fix ppp_async_encode() illegal access
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 40dddd4b8bd08a69471efd96107a4e1c73fabefc ]
syzbot reported an issue in ppp_async_encode() [1]
In this case, pppoe_sendmsg() is called with a zero size. Then ppp_async_encode() is called with an empty skb.
BUG: KMSAN: uninit-value in ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline] BUG: KMSAN: uninit-value in ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675 ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline] ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675 ppp_async_send+0x130/0x1b0 drivers/net/ppp/ppp_async.c:634 ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2280 [inline] ppp_input+0x1f1/0xe60 drivers/net/ppp/ppp_generic.c:2304 pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113 __release_sock+0x1da/0x330 net/core/sock.c:3072 release_sock+0x6b/0x250 net/core/sock.c:3626 pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was created at:
slab_post_alloc_hook mm/slub.c:4092 [inline] slab_alloc_node mm/slub.c:4135 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4187 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1322 [inline] sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732 pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 1 UID: 0 PID: 5411 Comm: syz.1.14 Not tainted 6.12.0-rc1-syzkaller-00165-g360c1f1f24c6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
--- drivers/net/ppp/ppp_async.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ppp/ppp_async.c +1 -1
@@ -550,7 +550,7 @@ ppp_async_encode(struct asyncppp *ap)* and 7 (code-reject) must be sent as though no options * had been negotiated. */ - islcp = proto ==PPP_LCP &&1 <= data[2 ] && data[2 ] <=7 ; + islcp = proto ==PPP_LCP && count >=3 &&1 <= data[2 ] && data[2 ] <=7 ;if (i ==0 ) {if (islcp)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 764/798 slip: make slhc_remember() more robust against malicious packets
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 7d3fce8cbe3a70a1c7c06c9b53696be5d5d8dd5c ]
syzbot found that slhc_remember() was missing checks against malicious packets [1].
slhc_remember() only checked the size of the packet was at least 20, which is not good enough.
We need to make sure the packet includes the IPv4 and TCP header that are supposed to be carried.
Add iph and th pointers to make the code more readable.
[1]
BUG: KMSAN: uninit-value in slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666 slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666 ppp_receive_nonmp_frame+0xe45/0x35e0 drivers/net/ppp/ppp_generic.c:2455 ppp_receive_frame drivers/net/ppp/ppp_generic.c:2372 [inline] ppp_do_recv+0x65f/0x40d0 drivers/net/ppp/ppp_generic.c:2212 ppp_input+0x7dc/0xe60 drivers/net/ppp/ppp_generic.c:2327 pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113 __release_sock+0x1da/0x330 net/core/sock.c:3072 release_sock+0x6b/0x250 net/core/sock.c:3626 pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was created at:
slab_post_alloc_hook mm/slub.c:4091 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4186 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1322 [inline] sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732 pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 5460 Comm: syz.2.33 Not tainted 6.12.0-rc2-syzkaller-00006-g87d6aab2389e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
--- drivers/net/slip/slhc.c | 57 ++++++++++++++++++++++++----------------- 1 file changed, 34 insertions(+), 23 deletions(-)
drivers/net/slip/slhc.c +34 -23
@@ -643,46 +643,57 @@ slhc_uncompress(struct slcompress *comp, unsigned char *icp, int isize)int slhc_remember (struct slcompress *comp,unsigned char *icp,int isize) { -struct cstate *cs; -unsigned ihl; - +const struct tcphdr *th;unsigned char index; +struct iphdr *iph; +struct cstate *cs; +unsigned int ihl; -if (isize <20 ) { -/* The packet is shorter than a legal IP header */ +/* The packet is shorter than a legal IP header. +* Also make sure isize is positive. +*/ +if (isize < (int )sizeof (struct iphdr )) { +runt: comp->sls_i_runt++; -return slhc_toss ( comp ); +return slhc_toss (comp); } + iph = (struct iphdr *)icp;/* Peek at the IP header's IHL field to find its length */ - ihl = icp[0 ] &0xf ; -if (ihl <20 /4 ){ -/* The IP header length field is too small */ - comp->sls_i_runt++; -return slhc_toss ( comp ); - } - index = icp[9 ]; - icp[9 ] =IPPROTO_TCP ; + ihl = iph->ihl; +/* The IP header length field is too small, +* or packet is shorter than the IP header followed +* by minimal tcp header. +*/ +if (ihl <5 || isize < ihl *4 +sizeof (struct tcphdr )) + goto runt; + + index = iph->protocol; + iph->protocol =IPPROTO_TCP ;if (ip_fast_csum (icp, ihl)) {/* Bad IP header checksum; discard */ comp->sls_i_badcheck++; -return slhc_toss ( comp ); +return slhc_toss (comp); } -if (index > comp->rslot_limit) { +if (index > comp->rslot_limit) { comp->sls_i_error++;return slhc_toss (comp); } - + th = (struct tcphdr *)(icp + ihl *4 ); +if (th->doff <sizeof (struct tcphdr ) /4 ) + goto runt; +if (isize < ihl *4 + th->doff *4 ) + goto runt;/* Update local state */ cs = &comp->rstate[comp->recv_current = index]; comp->flags &=~SLF_TOSS ; -memcpy (&cs->cs_ip,icp,20 ); -memcpy (&cs->cs_tcp,icp + ihl*4 ,20 ); +memcpy (&cs->cs_ip, iph,sizeof (*iph)); +memcpy (&cs->cs_tcp, th,sizeof (*th));if (ihl >5 ) -memcpy (cs->cs_ipopt, icp +sizeof (struct iphdr ), (ihl -5 ) *4 ); -if (cs->cs_tcp.doff >5 ) -memcpy (cs->cs_tcpopt, icp + ihl*4 +sizeof (struct tcphdr ), (cs->cs_tcp.doff -5 ) *4 ); - cs->cs_hsize = ihl*2 + cs->cs_tcp.doff*2 ; +memcpy (cs->cs_ipopt, &iph[1 ], (ihl -5 ) *4 ); +if (th->doff >5 ) +memcpy (cs->cs_tcpopt, &th[1 ], (th->doff -5 ) *4 ); + cs->cs_hsize = ihl*2 + th->doff*2 ; cs->initialized = true;/* Put headers back on packet * Neither header checksum is recalculated
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 765/798 rust: macros: provide correct provenance when constructing THIS_MODULE
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boqun Feng <[email protected]>
commit a5a3c952e82c1ada12bf8c55b73af26f1a454bd2 upstream.
Currently while defining THIS_MODULE symbol in module!(), the pointer used to construct ThisModule is derived from an immutable reference of __this_module, which means the pointer doesn't have the provenance for writing, and that means any write to that pointer is UB regardless of data races or not. However, the usage of THIS_MODULE includes passing this pointer to functions that may write to it (probably in unsafe code), and this will create soundness issues.
One way to fix this is using addr_of_mut!() but that requires the unstable feature "const_mut_refs". So instead of addr_of_mut()!, an extern static Opaque is used here: since Opaque<T> is transparent to T, an extern static Opaque will just wrap the C symbol (defined in a C compile unit) in an Opaque, which provides a pointer with writable provenance via Opaque::get(). This fix the potential UBs because of pointer provenance unmatched.
[ Boqun: Use UnsafeCell since Opaque is not in v6.1, as suggested by
Gary Guo, UnsafeCell also suffices for this particular case because __this_module is only used to create THIS_MODULE, no other Rust code will touch it. ]
--- rust/macros/module.rs | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
rust/macros/module.rs +5 -1
@@ -183,7 +183,11 @@ pub(crate) fn module(ts: TokenStream) -> TokenStream {// freed until the module is unloaded. #[cfg( MODULE )] static THIS_MODULE : kernel::ThisModule =unsafe {{ - kernel::ThisModule ::from_ptr (&kernel::bindings::__this_moduleas *const _ as *mut _ ) + extern \"C\" {{ +static __this_module: core::cell::UnsafeCell <kernel::bindings::module >; + }} + + kernel::ThisModule ::from_ptr (__this_module.get ()) }};#[cfg(not( MODULE ))] static THIS_MODULE : kernel::ThisModule =unsafe {{
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 766/798 HID: multitouch: Add support for lenovo Y9000P Touchpad
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: He Lugang <[email protected]>
[ Upstream commit 251efae73bd46b097deec4f9986d926813aed744 ]
The 2024 Lenovo Y9000P which use GT7868Q chip also needs a fixup. The information of the chip is as follows:
I2C HID v1.00 Mouse [GXTP5100:00 27C6:01E0]
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-multitouch.c | 8 ++++++-- 2 files changed, 7 insertions(+), 2 deletions(-)
drivers/hid/hid-ids.h +1 -0
@@ -506,6 +506,7 @@#define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100 0xe100#define I2C_VENDOR_ID_GOODIX 0x27c6 +#define I2C_DEVICE_ID_GOODIX_01E0 0x01e0#define I2C_DEVICE_ID_GOODIX_01E8 0x01e8#define I2C_DEVICE_ID_GOODIX_01E9 0x01e9#define I2C_DEVICE_ID_GOODIX_01F0 0x01f0
drivers/hid/hid-multitouch.c +6 -2
@@ -1447,7 +1447,8 @@ static __u8 *mt_report_fixup(struct hid_device *hdev, __u8 *rdesc, {if (hdev->vendor ==I2C_VENDOR_ID_GOODIX && (hdev->product ==I2C_DEVICE_ID_GOODIX_01E8 || - hdev->product ==I2C_DEVICE_ID_GOODIX_01E9 )) { + hdev->product ==I2C_DEVICE_ID_GOODIX_01E9 || + hdev->product ==I2C_DEVICE_ID_GOODIX_01E0 )) {if (rdesc[607 ] ==0x15 ) { rdesc[607 ] =0x25 ; dev_info(
@@ -2068,7 +2069,10 @@ static const struct hid_device_id mt_devices[] = { I2C_DEVICE_ID_GOODIX_01E8) }, { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU,HID_DEVICE (BUS_I2C ,HID_GROUP_ANY ,I2C_VENDOR_ID_GOODIX , - I2C_DEVICE_ID_GOODIX_01E8) }, + I2C_DEVICE_ID_GOODIX_01E9) }, + { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, +HID_DEVICE (BUS_I2C ,HID_GROUP_ANY ,I2C_VENDOR_ID_GOODIX , + I2C_DEVICE_ID_GOODIX_01E0) }, /* GoodTouch panels */ { .driver_data = MT_CLS_NSMU,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 767/798 net/mlx5: Always drain health in shutdown callback
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shay Drory <[email protected]>
[ Upstream commit 1b75da22ed1e6171e261bc9265370162553d5393 ]
There is no point in recovery during device shutdown. if health work started need to wait for it to avoid races and NULL pointer access.
Hence, drain health WQ on shutdown callback.
--- drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/main.c +1 -1
@@ -1950,7 +1950,6 @@ static int mlx5_try_fast_unload(struct mlx5_core_dev *dev)/* Panic tear down fw command will stop the PCI bus communication * with the HCA, so the health poll is no longer needed. */ -mlx5_drain_health_wq (dev);mlx5_stop_health_poll (dev, false); ret =mlx5_cmd_fast_teardown_hca (dev);
@@ -1985,6 +1984,7 @@ static void shutdown(struct pci_dev *pdev)mlx5_core_info (dev,"Shutdown was called\n" );set_bit (MLX5_BREAK_FW_WAIT , &dev->intf_state); +mlx5_drain_health_wq (dev); err =mlx5_try_fast_unload (dev);if (err)mlx5_unload_one (dev, false);
drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c +1 -0
@@ -75,6 +75,7 @@ static void mlx5_sf_dev_shutdown(struct auxiliary_device *adev) { struct mlx5_sf_dev *sf_dev = container_of(adev, struct mlx5_sf_dev, adev); +mlx5_drain_health_wq (sf_dev->mdev);mlx5_unload_one (sf_dev->mdev, false); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 768/798 wifi: mac80211: Avoid address calculations via out of bounds array indexing
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kenton Groombridge <[email protected]>
[ Upstream commit 2663d0462eb32ae7c9b035300ab6b1523886c718 ]
req->n_channels must be set before req->channels[] can be used.
This patch fixes one of the issues encountered in [1].
[ 83.964255] UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:364:4 [ 83.964258] index 0 is out of range for type 'struct ieee80211_channel *[]' [...] [ 83.964264] Call Trace: [ 83.964267] <TASK> [ 83.964269] dump_stack_lvl+0x3f/0xc0 [ 83.964274] __ubsan_handle_out_of_bounds+0xec/0x110 [ 83.964278] ieee80211_prep_hw_scan+0x2db/0x4b0 [ 83.964281] __ieee80211_start_scan+0x601/0x990 [ 83.964291] nl80211_trigger_scan+0x874/0x980 [ 83.964295] genl_family_rcv_msg_doit+0xe8/0x160 [ 83.964298] genl_rcv_msg+0x240/0x270
[...]
[1] https://bugzilla.kernel.org/show_bug.cgi?id=218810
--- net/mac80211/scan.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
net/mac80211/scan.c +9 -8
@@ -357,7 +357,8 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_sub_if_data *sdata)struct cfg80211_scan_request *req;struct cfg80211_chan_def chandef;u8 bands_used =0 ; -int i, ielen, n_chans; +int i, ielen; +u32 *n_chans;u32 flags =0 ; req = rcu_dereference_protected(local->scan_req,
@@ -367,34 +368,34 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_sub_if_data *sdata)return false;if (ieee80211_hw_check (&local->hw,SINGLE_SCAN_ON_ALL_BANDS )) { + local->hw_scan_req->req.n_channels = req->n_channels; +for (i =0 ; i < req->n_channels; i++) { local->hw_scan_req->req.channels[i] = req->channels[i]; bands_used |=BIT (req->channels[i]->band); } - - n_chans = req->n_channels; }else {do {if (local->hw_scan_band ==NUM_NL80211_BANDS )return false; - n_chans =0 ; + n_chans = &local->hw_scan_req->req.n_channels; + *n_chans =0 ;for (i =0 ; i < req->n_channels; i++) {if (req->channels[i]->band != local->hw_scan_band)continue ; - local->hw_scan_req->req.channels[n_chans] = + local->hw_scan_req->req.channels[(*n_chans)++] = req->channels[i]; - n_chans++; + bands_used |=BIT (req->channels[i]->band); } local->hw_scan_band++; - }while (!n_chans); + }while (!*n_chans); } - local->hw_scan_req->req.n_channels = n_chans;ieee80211_prepare_scan_chandef (&chandef, req->scan_width);if (req->flags &NL80211_SCAN_FLAG_MIN_PREQ_CONTENT )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 769/798 hwmon: (tmp513) Add missing dependency on REGMAP_I2C
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 193bc02c664999581a1f38c152f379fce91afc0c ]
0-day reports:
drivers/hwmon/tmp513.c:162:21: error:
variable 'tmp51x_regmap_config' has initializer but incomplete type
162 | static const struct regmap_config tmp51x_regmap_config = {
| ^
struct regmap_config is only available if REGMAP is enabled. Add the missing Kconfig dependency to fix the problem.
--- drivers/hwmon/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/Kconfig +1 -0
@@ -2101,6 +2101,7 @@ config SENSORS_TMP464 config SENSORS_TMP513 tristate "Texas Instruments TMP513 and compatibles" depends on I2C + select REGMAP_I2C help If you say yes here you get support for Texas Instruments TMP512, and TMP513 temperature and power supply sensor chips.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 770/798 hwmon: (adm9240) Add missing dependency on REGMAP_I2C
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
[ Upstream commit 14849a2ec175bb8a2280ce20efe002bb19f1e274 ]
This driver requires REGMAP_I2C to be selected in order to get access to regmap_config and devm_regmap_init_i2c. Add the missing dependency.
Message-ID: <[email protected]>
--- drivers/hwmon/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/Kconfig +1 -0
@@ -166,6 +166,7 @@ config SENSORS_ADM9240 tristate "Analog Devices ADM9240 and compatibles" depends on I2C select HWMON_VID + select REGMAP_I2C help If you say yes here you get support for Analog Devices ADM9240, Dallas DS1780, National Semiconductor LM81 sensor chips.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 771/798 hwmon: (adt7470) Add missing dependency on REGMAP_I2C
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
[ Upstream commit b6abcc19566509ab4812bd5ae5df46515d0c1d70 ]
This driver requires REGMAP_I2C to be selected in order to get access to regmap_config and devm_regmap_init_i2c. Add the missing dependency.
Message-ID: <[email protected]>
--- drivers/hwmon/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/Kconfig +1 -0
@@ -228,6 +228,7 @@ config SENSORS_ADT7462 config SENSORS_ADT7470 tristate "Analog Devices ADT7470" depends on I2C + select REGMAP_I2C help If you say yes here you get support for the Analog Devices ADT7470 temperature monitoring chips.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 772/798 Revert "net: ibm/emac: allocate dummy net_device dynamically"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit b40eeedbbc0833716b5ccae64cf914f2604a3e5e, which was upstream commit 2eb5e25d8495 ("net: ibm/emac: allocate dummy net_device dynamically").
alloc_netdev_dummy(( does not exist in 6.1, so all this backport did was break the build.
--- drivers/net/ethernet/ibm/emac/mal.c | 14 +++----------- drivers/net/ethernet/ibm/emac/mal.h | 2 +- 2 files changed, 4 insertions(+), 12 deletions(-)
drivers/net/ethernet/ibm/emac/mal.c +3 -11
@@ -603,13 +603,9 @@ static int mal_probe(struct platform_device *ofdev)INIT_LIST_HEAD (&mal->list);spin_lock_init (&mal->lock); - mal->dummy_dev =alloc_netdev_dummy (0 ); -if (!mal->dummy_dev) { - err = -ENOMEM ; - goto fail_unmap; - } +init_dummy_netdev (&mal->dummy_dev); -netif_napi_add_weight (mal->dummy_dev, &mal->napi, mal_poll, +netif_napi_add_weight (&mal->dummy_dev, &mal->napi, mal_poll,CONFIG_IBM_EMAC_POLL_WEIGHT );/* Load power-on reset defaults */
@@ -639,7 +635,7 @@ static int mal_probe(struct platform_device *ofdev) GFP_KERNEL);if (mal->bd_virt ==NULL ) { err = -ENOMEM ; - goto fail_dummy; + goto fail_unmap; }for (i =0 ; i < mal->num_tx_chans; ++i)
@@ -705,8 +701,6 @@ static int mal_probe(struct platform_device *ofdev)free_irq (mal->serr_irq, mal); fail2:dma_free_coherent (&ofdev->dev, bd_size, mal->bd_virt, mal->bd_dma); - fail_dummy: -free_netdev (mal->dummy_dev); fail_unmap:dcr_unmap (mal->dcr_host,0x100 ); fail:
@@ -738,8 +732,6 @@ static int mal_remove(struct platform_device *ofdev)mal_reset (mal); -free_netdev (mal->dummy_dev); -dcr_unmap (mal->dcr_host,0x100 ); dma_free_coherent(&ofdev->dev,
drivers/net/ethernet/ibm/emac/mal.h +1 -1
@@ -205,7 +205,7 @@ struct mal_instance {int index;spinlock_t lock; -struct net_device *dummy_dev; +struct net_device dummy_dev;unsigned int features; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 773/798 HID: amd_sfh: Switch to device-managed dmam_alloc_coherent()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Basavaraj Natikar <[email protected]>
commit c56f9ecb7fb6a3a90079c19eb4c8daf3bbf514b3 upstream.
Using the device-managed version allows to simplify clean-up in probe() error path.
Additionally, this device-managed ensures proper cleanup, which helps to resolve memory errors, page faults, btrfs going read-only, and btrfs disk corruption.
--- drivers/hid/amd-sfh-hid/amd_sfh_client.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-)
drivers/hid/amd-sfh-hid/amd_sfh_client.c +3 -11
@@ -235,9 +235,9 @@ int amd_sfh_hid_client_init(struct amd_m cl_data->in_data = in_data;for (i =0 ; i < cl_data->num_hid_devices; i++) { - in_data->sensor_virt_addr[i] =dma_alloc_coherent (dev,sizeof (int ) *8 , - &cl_data->sensor_dma_addr[i], -GFP_KERNEL ); + in_data->sensor_virt_addr[i] =dmam_alloc_coherent (dev,sizeof (int ) *8 , + &cl_data->sensor_dma_addr[i], +GFP_KERNEL );if (!in_data->sensor_virt_addr[i]) { rc = -ENOMEM ; goto cleanup;
@@ -334,7 +334,6 @@ cleanup:int amd_sfh_hid_client_deinit (struct amd_mp2_dev *privdata) {struct amdtp_cl_data *cl_data = privdata->cl_data; -struct amd_input_data *in_data = cl_data->in_data;int i, status;for (i =0 ; i < cl_data->num_hid_devices; i++) {
@@ -354,12 +353,5 @@ int amd_sfh_hid_client_deinit(struct amdcancel_delayed_work_sync (&cl_data->work_buffer);amdtp_hid_remove (cl_data); -for (i =0 ; i < cl_data->num_hid_devices; i++) { -if (in_data->sensor_virt_addr[i]) { -dma_free_coherent (&privdata->pdev->dev,8 *sizeof (int ), - in_data->sensor_virt_addr[i], - cl_data->sensor_dma_addr[i]); - } - }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 774/798 HID: plantronics: Workaround for an unexcepted opposite volume key
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wade Wang <[email protected]>
commit 87b696209007b7c4ef7bdfe39ea0253404a43770 upstream.
Some Plantronics headset as the below send an unexcept opposite volume key's HID report for each volume key press after 200ms, like unecepted Volume Up Key following Volume Down key pressed by user. This patch adds a quirk to hid-plantronics for these devices, which will ignore the second unexcepted opposite volume key if it happens within 220ms from the last one that was handled.
Plantronics EncorePro 500 Series (047f:431e)
Plantronics Blackwire_3325 Series (047f:430c)The patch was tested on the mentioned model, it shouldn't affect other models, however, this quirk might be needed for them too. Auto-repeat (when a key is held pressed) is not affected per test result.
--- drivers/hid/hid-ids.h | 2 ++ drivers/hid/hid-plantronics.c | 23 +++++++++++++++++++++++ 2 files changed, 25 insertions(+)
drivers/hid/hid-ids.h +2 -0
@@ -1020,6 +1020,8 @@#define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES 0xc056#define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3215_SERIES 0xc057#define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3225_SERIES 0xc058 +#define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3325_SERIES 0x430c +#define USB_DEVICE_ID_PLANTRONICS_ENCOREPRO_500_SERIES 0x431e#define USB_VENDOR_ID_PANASONIC 0x04da#define USB_DEVICE_ID_PANABOARD_UBT780 0x1044
drivers/hid/hid-plantronics.c +23 -0
@@ -38,8 +38,10 @@ (usage->hid & HID_USAGE_PAGE) == HID_UP_CONSUMER)#define PLT_QUIRK_DOUBLE_VOLUME_KEYS BIT(0) +#define PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS BIT(1)#define PLT_DOUBLE_KEY_TIMEOUT 5/* ms */ +#define PLT_FOLLOWED_OPPOSITE_KEY_TIMEOUT 220/* ms */ struct plt_drv_data {unsigned long device_type;
@@ -137,6 +139,21 @@ static int plantronics_event(struct hid_ drv_data->last_volume_key_ts = cur_ts; } +if (drv_data->quirks &PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS ) { +unsigned long prev_ts, cur_ts; + +/* Usages are filtered in plantronics_usages. */ + +if (!value)/* Handle key presses only. */ +return 0 ; + + prev_ts = drv_data->last_volume_key_ts; + cur_ts = jiffies; +if (jiffies_to_msecs (cur_ts - prev_ts) <=PLT_FOLLOWED_OPPOSITE_KEY_TIMEOUT ) +return 1 ;/* Ignore the followed opposite volume key. */ + + drv_data->last_volume_key_ts = cur_ts; + }return 0 ; }
@@ -210,6 +227,12 @@ static const struct hid_device_id plantr {HID_USB_DEVICE (USB_VENDOR_ID_PLANTRONICS , USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3225_SERIES), .driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS }, + { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, + USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3325_SERIES), + .driver_data = PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS }, + { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, + USB_DEVICE_ID_PLANTRONICS_ENCOREPRO_500_SERIES), + .driver_data = PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS }, { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, HID_ANY_ID) }, { } };
Greg Kroah-Hartman
maintainerPATCH 775/798 Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 71c717cd8a2e180126932cc6851ff21c1d04d69a upstream.
This reverts commit 86b20af11e84c26ae3fde4dcc4f490948e3f8035.
This patch leads to passing 0 to simple_read_from_buffer() as a fifth argument, turning the read method into a nop. The change is fundamentally flawed, as it breaks the driver.
--- drivers/usb/misc/yurex.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-)
drivers/usb/misc/yurex.c +8 -11
@@ -34,8 +34,6 @@#define YUREX_BUF_SIZE 8#define YUREX_WRITE_TIMEOUT (HZ*2) -#define MAX_S64_STRLEN 20/* {-}922337203685477580{7,8} */ -/* table of devices that work with this driver */ static struct usb_device_id yurex_table[] = { {USB_DEVICE (YUREX_VENDOR_ID ,YUREX_PRODUCT_ID ) },
@@ -403,7 +401,8 @@ static ssize_t yurex_read(struct file *f {struct usb_yurex *dev;int len =0 ; -char in_buffer[MAX_S64_STRLEN ]; +char in_buffer[20 ]; +unsigned long flags; dev = file->private_data;
@@ -413,16 +412,14 @@ static ssize_t yurex_read(struct file *freturn -ENODEV ; } -if (WARN_ON_ONCE (dev->bbu >S64_MAX || dev->bbu <S64_MIN )) { -mutex_unlock (&dev->io_mutex); -return -EIO ; - } - -spin_lock_irq (&dev->lock); -scnprintf (in_buffer,MAX_S64_STRLEN ,"%lld\n" , dev->bbu); -spin_unlock_irq (&dev->lock); +spin_lock_irqsave (&dev->lock, flags); + len =snprintf (in_buffer,20 ,"%lld\n" , dev->bbu); +spin_unlock_irqrestore (&dev->lock, flags);mutex_unlock (&dev->io_mutex); +if (WARN_ON_ONCE (len >=sizeof (in_buffer))) +return -EIO ; +return simple_read_from_buffer (buffer, count, ppos, in_buffer, len); }
Greg Kroah-Hartman
maintainerPATCH 776/798 usb: dwc3: core: Stop processing of pending events if controller is halted
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Selvarasu Ganesan <[email protected]>
commit 0d410e8913f5cffebcca79ffdd596009d4a13a28 upstream.
This commit addresses an issue where events were being processed when the controller was in a halted state. To fix this issue by stop processing the events as the event count was considered stale or invalid when the controller was halted.
--- drivers/usb/dwc3/core.c | 22 +++++++++++++++++++--- drivers/usb/dwc3/core.h | 4 ---- drivers/usb/dwc3/gadget.c | 11 ----------- 3 files changed, 19 insertions(+), 18 deletions(-)
drivers/usb/dwc3/core.c +19 -3
@@ -533,6 +533,7 @@ static int dwc3_alloc_event_buffers(struint dwc3_event_buffers_setup (struct dwc3 *dwc) {struct dwc3_event_buffer *evt; +u32 reg;if (!dwc->ev_buf)return 0 ;
@@ -545,8 +546,10 @@ int dwc3_event_buffers_setup(struct dwc3 upper_32_bits(evt->dma));dwc3_writel (dwc->regs,DWC3_GEVNTSIZ (0 ),DWC3_GEVNTSIZ_SIZE (evt->length)); -dwc3_writel (dwc->regs,DWC3_GEVNTCOUNT (0 ),0 ); +/* Clear any stale event */ + reg =dwc3_readl (dwc->regs,DWC3_GEVNTCOUNT (0 )); +dwc3_writel (dwc->regs,DWC3_GEVNTCOUNT (0 ), reg);return 0 ; }
@@ -573,7 +576,10 @@ void dwc3_event_buffers_cleanup(struct ddwc3_writel (dwc->regs,DWC3_GEVNTADRHI (0 ),0 );dwc3_writel (dwc->regs,DWC3_GEVNTSIZ (0 ),DWC3_GEVNTSIZ_INTMASK |DWC3_GEVNTSIZ_SIZE (0 )); -dwc3_writel (dwc->regs,DWC3_GEVNTCOUNT (0 ),0 ); + +/* Clear any stale event */ + reg =dwc3_readl (dwc->regs,DWC3_GEVNTCOUNT (0 )); +dwc3_writel (dwc->regs,DWC3_GEVNTCOUNT (0 ), reg); }static int dwc3_alloc_scratch_buffers (struct dwc3 *dwc)
@@ -2279,7 +2285,11 @@ static int dwc3_runtime_resume(struct deswitch (dwc->current_dr_role) {case DWC3_GCTL_PRTCAP_DEVICE : -dwc3_gadget_process_pending_events (dwc); +if (dwc->pending_events) { +pm_runtime_put (dwc->dev); + dwc->pending_events = false; +enable_irq (dwc->irq_gadget); + }break ;case DWC3_GCTL_PRTCAP_HOST :default :
@@ -2366,6 +2376,12 @@ static void dwc3_complete(struct devicestatic const struct dev_pm_ops dwc3_dev_pm_ops = {SET_SYSTEM_SLEEP_PM_OPS (dwc3_suspend, dwc3_resume) .complete = dwc3_complete, + +/* +* Runtime suspend halts the controller on disconnection. It relies on +* platforms with custom connection notification to start the controller +* again. +*/ SET_RUNTIME_PM_OPS (dwc3_runtime_suspend, dwc3_runtime_resume, dwc3_runtime_idle) };
drivers/usb/dwc3/core.h +0 -4
@@ -1633,7 +1633,6 @@ static inline void dwc3_otg_host_init(st#if !IS_ENABLED (CONFIG_USB_DWC3_HOST )int dwc3_gadget_suspend (struct dwc3 *dwc);int dwc3_gadget_resume (struct dwc3 *dwc); -void dwc3_gadget_process_pending_events (struct dwc3 *dwc);#else static inline int dwc3_gadget_suspend (struct dwc3 *dwc) {
@@ -1645,9 +1644,6 @@ static inline int dwc3_gadget_resume(str return 0; } -static inline void dwc3_gadget_process_pending_events (struct dwc3 *dwc) -{ -}#endif /* !IS_ENABLED(CONFIG_USB_DWC3_HOST) */ #if IS_ENABLED (CONFIG_USB_DWC3_ULPI )
drivers/usb/dwc3/gadget.c +0 -11
@@ -4618,14 +4618,3 @@ int dwc3_gadget_resume(struct dwc3 *dwc)return dwc3_gadget_soft_connect (dwc); } - -void dwc3_gadget_process_pending_events (struct dwc3 *dwc) -{ -if (dwc->pending_events) { -dwc3_interrupt (dwc->irq_gadget, dwc->ev_buf); -dwc3_thread_interrupt (dwc->irq_gadget, dwc->ev_buf); -pm_runtime_put (dwc->dev); - dwc->pending_events = false; -enable_irq (dwc->irq_gadget); - } -}
Greg Kroah-Hartman
maintainerPATCH 777/798 usb: xhci: Fix problem with xhci resume from suspend
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jose Alberto Reguero <[email protected]>
commit d44238d8254a36249d576c96473269dbe500f5e4 upstream.
I have a ASUS PN51 S mini pc that has two xhci devices. One from AMD, and other from ASMEDIA. The one from ASMEDIA have problems when resume from suspend, and keep broken until unplug the power cord. I use this kernel parameter: xhci-hcd.quirks=128 and then it works ok. I make a path to reset only the ASMEDIA xhci.
--- drivers/usb/host/xhci-pci.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/host/xhci-pci.c +5 -0
@@ -73,6 +73,7 @@#define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI 0x1142#define PCI_DEVICE_ID_ASMEDIA_1142_XHCI 0x1242#define PCI_DEVICE_ID_ASMEDIA_2142_XHCI 0x2142 +#define PCI_DEVICE_ID_ASMEDIA_3042_XHCI 0x3042#define PCI_DEVICE_ID_ASMEDIA_3242_XHCI 0x3242#define PCI_DEVICE_ID_CADENCE 0x17CD
@@ -330,6 +331,10 @@ static void xhci_pci_quirks(struct devic pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI) xhci->quirks |= XHCI_ASMEDIA_MODIFY_FLOWCONTROL; +if (pdev->vendor ==PCI_VENDOR_ID_ASMEDIA && + pdev->device ==PCI_DEVICE_ID_ASMEDIA_3042_XHCI ) + xhci->quirks |=XHCI_RESET_ON_RESUME ; +if (pdev->vendor ==PCI_VENDOR_ID_TI && pdev->device ==0x8241 ) xhci->quirks |=XHCI_LIMIT_ENDPOINT_INTERVAL_7 ;
Greg Kroah-Hartman
maintainerPATCH 778/798 usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Icenowy Zheng <[email protected]>
commit a6555cb1cb69db479d0760e392c175ba32426842 upstream.
JieLi tends to use SCSI via USB Mass Storage to implement their own proprietary commands instead of implementing another USB interface. Enumerating it as a generic mass storage device will lead to a Hardware Error sense key get reported.
Ignore this bogus device to prevent appearing a unusable sdX device file.
--- drivers/usb/storage/unusual_devs.h | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/usb/storage/unusual_devs.h +11 -0
@@ -2423,6 +2423,17 @@ UNUSUAL_DEV( 0xc251, 0x4003, 0x0100, 0x USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE), +/* +* Reported by Icenowy Zheng <[email protected]> +* This is an interface for vendor-specific cryptic commands instead +* of real USB storage device. +*/ +UNUSUAL_DEV (0xe5b7 ,0x0811 ,0x0100 ,0x0100 , +"ZhuHai JieLi Technology" , +"JieLi BR21" , +USB_SC_DEVICE ,USB_PR_DEVICE ,NULL , +US_FL_IGNORE_DEVICE ), +/* Reported by Andrew Simmons <[email protected]> */ UNUSUAL_DEV( 0xed06, 0x4500, 0x0001, 0x0001, "DataStor",
Greg Kroah-Hartman
maintainerPATCH 779/798 usb: gadget: core: force synchronous registration
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Keeping <[email protected]>
commit df9158826b00e53f42c67d62c887a84490d80a0a upstream.
Registering a gadget driver is expected to complete synchronously and immediately after calling driver_register() this function checks that the driver has bound so as to return an error.
Set PROBE_FORCE_SYNCHRONOUS to ensure this is the case even when asynchronous probing is set as the default.
--- drivers/usb/gadget/udc/core.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/gadget/udc/core.c +1 -0
@@ -1671,6 +1671,7 @@ int usb_gadget_register_driver_owner(str driver->driver.bus = &gadget_bus_type; driver->driver.owner = owner; driver->driver.mod_name = mod_name; + driver->driver.probe_type =PROBE_FORCE_SYNCHRONOUS ; ret =driver_register (&driver->driver);if (ret) { pr_warn("%s: driver registration failed: %d\n",
Greg Kroah-Hartman
maintainerPATCH 780/798 hid: intel-ish-hid: Fix uninitialized variable rv in ish_fw_xfer_direct_dma
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: SurajSonawane2415 <[email protected]>
commit d41bff05a61fb539f21e9bf0d39fac77f457434e upstream.
Fix the uninitialized symbol 'rv' in the function ish_fw_xfer_direct_dma to resolve the following warning from the smatch tool:drivers/hid/intel-ish-hid/ishtp-fw-loader.c:714 ish_fw_xfer_direct_dma()
error: uninitialized symbol 'rv'.
Initialize 'rv' to 0 to prevent undefined behavior from uninitialized access.
--- drivers/hid/intel-ish-hid/ishtp-fw-loader.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/intel-ish-hid/ishtp-fw-loader.c +1 -1
@@ -635,7 +635,7 @@ static int ish_fw_xfer_direct_dma(structconst struct firmware *fw, const struct shim_fw_info fw_info) { - int rv; + int rv = 0;void *dma_buf;dma_addr_t dma_buf_phy;u32 fragment_offset, fragment_size, payload_max_size;
Greg Kroah-Hartman
maintainerPATCH 781/798 drm/v3d: Stop the active perfmon before being destroyed
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maíra Canal <[email protected]>
commit 7d1fd3638ee3a9f9bca4785fffb638ca19120718 upstream.
When running kmscube with one or more performance monitors enabled via GALLIUM_HUD, the following kernel panic can occur:
[ 55.008324] Unable to handle kernel paging request at virtual address 00000000052004a4 [ 55.008368] Mem abort info: [ 55.008377] ESR = 0x0000000096000005 [ 55.008387] EC = 0x25: DABT (current EL), IL = 32 bits [ 55.008402] SET = 0, FnV = 0 [ 55.008412] EA = 0, S1PTW = 0 [ 55.008421] FSC = 0x05: level 1 translation fault [ 55.008434] Data abort info: [ 55.008442] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 55.008455] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 55.008467] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 55.008481] user pgtable: 4k pages, 39-bit VAs, pgdp=00000001046c6000 [ 55.008497] [00000000052004a4] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 55.008525] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ 55.008542] Modules linked in: rfcomm [...] vc4 v3d snd_soc_hdmi_codec drm_display_helper gpu_sched drm_shmem_helper cec drm_dma_helper drm_kms_helper i2c_brcmstb drm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd backlight [ 55.008799] CPU: 2 PID: 166 Comm: v3d_bin Tainted: G C 6.6.47+rpt-rpi-v8 #1 Debian 1:6.6.47-1+rpt1 [ 55.008824] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT) [ 55.008838] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 55.008855] pc : __mutex_lock.constprop.0+0x90/0x608 [ 55.008879] lr : __mutex_lock.constprop.0+0x58/0x608 [ 55.008895] sp : ffffffc080673cf0 [ 55.008904] x29: ffffffc080673cf0 x28: 0000000000000000 x27: ffffff8106188a28 [ 55.008926] x26: ffffff8101e78040 x25: ffffff8101baa6c0 x24: ffffffd9d989f148 [ 55.008947] x23: ffffffda1c2a4008 x22: 0000000000000002 x21: ffffffc080673d38 [ 55.008968] x20: ffffff8101238000 x19: ffffff8104f83188 x18: 0000000000000000 [ 55.008988] x17: 0000000000000000 x16: ffffffda1bd04d18 x15: 00000055bb08bc90 [ 55.009715] x14: 0000000000000000 x13: 0000000000000000 x12: ffffffda1bd4cbb0 [ 55.010433] x11: 00000000fa83b2da x10: 0000000000001a40 x9 : ffffffda1bd04d04 [ 55.011162] x8 : ffffff8102097b80 x7 : 0000000000000000 x6 : 00000000030a5857 [ 55.011880] x5 : 00ffffffffffffff x4 : 0300000005200470 x3 : 0300000005200470 [ 55.012598] x2 : ffffff8101238000 x1 : 0000000000000021 x0 : 0300000005200470 [ 55.013292] Call trace: [ 55.013959] __mutex_lock.constprop.0+0x90/0x608 [ 55.014646] __mutex_lock_slowpath+0x1c/0x30 [ 55.015317] mutex_lock+0x50/0x68 [ 55.015961] v3d_perfmon_stop+0x40/0xe0 [v3d] [ 55.016627] v3d_bin_job_run+0x10c/0x2d8 [v3d] [ 55.017282] drm_sched_main+0x178/0x3f8 [gpu_sched] [ 55.017921] kthread+0x11c/0x128 [ 55.018554] ret_from_fork+0x10/0x20 [ 55.019168] Code: f9400260 f1001c1f 54001ea9 927df000 (b9403401) [ 55.019776] ---[ end trace 0000000000000000 ]--- [ 55.020411] note: v3d_bin[166] exited with preempt_count 1
This issue arises because, upon closing the file descriptor (which happens when we interrupt kmscube), the active performance monitor is not stopped. Although all perfmons are destroyed in v3d_perfmon_close_file(), the active performance monitor's pointer (v3d->active_perfmon) is still retained.
If kmscube is run again, the driver will attempt to stop the active performance monitor using the stale pointer in v3d->active_perfmon. However, this pointer is no longer valid because the previous process has already terminated, and all performance monitors associated with it have been destroyed and freed.
To fix this, when the active performance monitor belongs to a given process, explicitly stop it before destroying and freeing it.
--- drivers/gpu/drm/v3d/v3d_perfmon.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/gpu/drm/v3d/v3d_perfmon.c +8 -1
@@ -101,6 +101,11 @@ void v3d_perfmon_open_file(struct v3d_fistatic int v3d_perfmon_idr_del (int id,void *elem,void *data) {struct v3d_perfmon *perfmon = elem; +struct v3d_dev *v3d = (struct v3d_dev *)data; + +/* If the active perfmon is being destroyed, stop it first */ +if (perfmon == v3d->active_perfmon) +v3d_perfmon_stop (v3d, perfmon, false);v3d_perfmon_put (perfmon);
@@ -109,8 +114,10 @@ static int v3d_perfmon_idr_del(int id, vvoid v3d_perfmon_close_file (struct v3d_file_priv *v3d_priv) { +struct v3d_dev *v3d = v3d_priv->v3d; +mutex_lock (&v3d_priv->perfmon.lock); -idr_for_each (&v3d_priv->perfmon.idr, v3d_perfmon_idr_del,NULL ); +idr_for_each (&v3d_priv->perfmon.idr, v3d_perfmon_idr_del, v3d);idr_destroy (&v3d_priv->perfmon.idr);mutex_unlock (&v3d_priv->perfmon.lock); }
Greg Kroah-Hartman
maintainerPATCH 782/798 drm/vc4: Stop the active perfmon before being destroyed
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maíra Canal <[email protected]>
commit 0b2ad4f6f2bec74a5287d96cb2325a5e11706f22 upstream.
Upon closing the file descriptor, the active performance monitor is not stopped. Although all perfmons are destroyed in vc4_perfmon_close_file(), the active performance monitor's pointer (vc4->active_perfmon) is still retained.
If we open a new file descriptor and submit a few jobs with performance monitors, the driver will attempt to stop the active performance monitor using the stale pointer in vc4->active_perfmon. However, this pointer is no longer valid because the previous process has already terminated, and all performance monitors associated with it have been destroyed and freed.
To fix this, when the active performance monitor belongs to a given process, explicitly stop it before destroying and freeing it.
--- drivers/gpu/drm/vc4/vc4_perfmon.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/vc4/vc4_perfmon.c +6 -1
@@ -116,6 +116,11 @@ void vc4_perfmon_open_file(struct vc4_fistatic int vc4_perfmon_idr_del (int id,void *elem,void *data) {struct vc4_perfmon *perfmon = elem; +struct vc4_dev *vc4 = (struct vc4_dev *)data; + +/* If the active perfmon is being destroyed, stop it first */ +if (perfmon == vc4->active_perfmon) +vc4_perfmon_stop (vc4, perfmon, false);vc4_perfmon_put (perfmon);
@@ -130,7 +135,7 @@ void vc4_perfmon_close_file(struct vc4_freturn ;mutex_lock (&vc4file->perfmon.lock); -idr_for_each (&vc4file->perfmon.idr, vc4_perfmon_idr_del,NULL ); +idr_for_each (&vc4file->perfmon.idr, vc4_perfmon_idr_del, vc4);idr_destroy (&vc4file->perfmon.idr);mutex_unlock (&vc4file->perfmon.lock);mutex_destroy (&vc4file->perfmon.lock);
Greg Kroah-Hartman
maintainerPATCH 783/798 scsi: wd33c93: Dont use stale scsi_pointer value
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Palmer <[email protected]>
commit 9023ed8d91eb1fcc93e64dc4962f7412b1c4cbec upstream.
A regression was introduced with commit dbb2da557a6a ("scsi: wd33c93:
Move the SCSI pointer to private command data") which results in an oops in wd33c93_intr(). That commit added the scsi_pointer variable and initialized it from hostdata->connected. However, during selection, hostdata->connected is not yet valid. Fix this by getting the current scsi_pointer from hostdata->selecting.
--- drivers/scsi/wd33c93.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/wd33c93.c +1 -1
@@ -831,7 +831,7 @@ wd33c93_intr(struct Scsi_Host *instance)/* construct an IDENTIFY message with correct disconnect bit */ hostdata->outgoing_msg[0 ] =IDENTIFY (0 , cmd->device->lun); -if (scsi_pointer->phase) +if (WD33C93_scsi_pointer (cmd)->phase) hostdata->outgoing_msg[0 ] |=0x40 ;if (hostdata->sync_stat[cmd->device->id] ==SS_FIRST ) {
Greg Kroah-Hartman
maintainerPATCH 784/798 mptcp: fallback when MPTCP opts are dropped after 1st data
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 119d51e225febc8152476340a880f5415a01e99e upstream.
As reported by Christoph [1], before this patch, an MPTCP connection was wrongly reset when a host received a first data packet with MPTCP options after the 3wHS, but got the next ones without.
According to the MPTCP v1 specs [2], a fallback should happen in this case, because the host didn't receive a DATA_ACK from the other peer, nor receive data for more than the initial window which implies a DATA_ACK being received by the other peer.
The patch here re-uses the same logic as the one used in other places:
by looking at allow_infinite_fallback, which is disabled at the creation of an additional subflow. It's not looking at the first DATA_ACK (or implying one received from the other side) as suggested by the RFC, but it is in continuation with what was already done, which is safer, and it fixes the reported issue. The next step, looking at this first DATA_ACK, is tracked in [4].
This patch has been validated using the following Packetdrill script:
0 socket(..., SOCK_STREAM, IPPROTO_MPTCP) = 3
+0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 +0 bind(3, ..., ...) = 0
+0 listen(3, 1) = 0
// 3WHS is OK
+0.0 < S 0:0(0) win 65535 <mss 1460, sackOK, nop, nop, nop, wscale 6, mpcapable v1 flags[flag_h] nokey>
+0.0 > S. 0:0(0) ack 1 <mss 1460, nop, nop, sackOK, nop, wscale 8, mpcapable v1 flags[flag_h] key[skey]>
+0.1 < . 1:1(0) ack 1 win 2048 <mpcapable v1 flags[flag_h] key[ckey=2, skey]>
+0 accept(3, ..., ...) = 4
// Data from the client with valid MPTCP options (no DATA_ACK: normal)
+0.1 < P. 1:501(500) ack 1 win 2048 <mpcapable v1 flags[flag_h] key[skey, ckey] mpcdatalen 500, nop, nop> // From here, the MPTCP options will be dropped by a middlebox
+0.0 > . 1:1(0) ack 501 <dss dack8=501 dll=0 nocs>
+0.1 read(4, ..., 500) = 500
+0 write(4, ..., 100) = 100
// The server replies with data, still thinking MPTCP is being used
+0.0 > P. 1:101(100) ack 501 <dss dack8=501 dsn8=1 ssn=1 dll=100 nocs, nop, nop>
// But the client already did a fallback to TCP, because the two previous packets have been received without MPTCP options
+0.1 < . 501:501(0) ack 101 win 2048
+0.0 < P. 501:601(100) ack 101 win 2048
// The server should fallback to TCP, not reset: it didn't get a DATA_ACK, nor data for more than the initial window
+0.0 > . 101:101(0) ack 601
Note that this script requires Packetdrill with MPTCP support, see [3].
--- net/mptcp/subflow.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mptcp/subflow.c +1 -1
@@ -1158,7 +1158,7 @@ static bool subflow_can_fallback(structelse if (READ_ONCE (msk->csum_enabled))return !subflow->valid_csum_seen;else -return !subflow->fully_established; +return READ_ONCE (msk->allow_infinite_fallback); }static void mptcp_subflow_fail (struct mptcp_sock *msk,struct sock *ssk)
Greg Kroah-Hartman
maintainerPATCH 785/798 ata: libata: avoid superfluous disk spin down + spin up during hibernation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
commit a38719e3157118428e34fbd45b0d0707a5877784 upstream.
A user reported that commit aa3998dbeb3a ("ata: libata-scsi: Disable scsi device manage_system_start_stop") introduced a spin down + immediate spin up of the disk both when entering and when resuming from hibernation. This behavior was not there before, and causes an increased latency both when entering and when resuming from hibernation.
Hibernation is done by three consecutive PM events, in the following order:
1) PM_EVENT_FREEZE
2) PM_EVENT_THAW
3) PM_EVENT_HIBERNATE
Commit aa3998dbeb3a ("ata: libata-scsi: Disable scsi device manage_system_start_stop") modified ata_eh_handle_port_suspend() to call ata_dev_power_set_standby() (which spins down the disk), for both event PM_EVENT_FREEZE and event PM_EVENT_HIBERNATE.
Documentation/driver-api/pm/devices.rst, section "Entering Hibernation", explicitly mentions that PM_EVENT_FREEZE does not have to be put the device in a low-power state, and actually recommends not doing so. Thus, let's not spin down the disk on PM_EVENT_FREEZE. (The disk will instead be spun down during the subsequent PM_EVENT_HIBERNATE event.)
This way, PM_EVENT_FREEZE will behave as it did before commit aa3998dbeb3a ("ata: libata-scsi: Disable scsi device manage_system_start_stop"), while PM_EVENT_HIBERNATE will continue to spin down the disk.
This will avoid the superfluous spin down + spin up when entering and resuming from hibernation, while still making sure that the disk is spun down before actually entering hibernation.
--- drivers/ata/libata-eh.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
drivers/ata/libata-eh.c +14 -4
@@ -3946,10 +3946,20 @@ static void ata_eh_handle_port_suspend(sWARN_ON (ap->pflags &ATA_PFLAG_SUSPENDED ); -/* Set all devices attached to the port in standby mode */ -ata_for_each_link (link, ap,HOST_FIRST ) { -ata_for_each_dev (dev, link,ENABLED ) -ata_dev_power_set_standby (dev); +/* +* We will reach this point for all of the PM events: +* PM_EVENT_SUSPEND (if runtime pm, PM_EVENT_AUTO will also be set) +* PM_EVENT_FREEZE, and PM_EVENT_HIBERNATE. +* +* We do not want to perform disk spin down for PM_EVENT_FREEZE. +* (Spin down will be performed by the subsequent PM_EVENT_HIBERNATE.) +*/ +if (!(ap->pm_mesg.event &PM_EVENT_FREEZE )) { +/* Set all devices attached to the port in standby mode */ +ata_for_each_link (link, ap,HOST_FIRST ) { +ata_for_each_dev (dev, link,ENABLED ) +ata_dev_power_set_standby (dev); + } }/*
Greg Kroah-Hartman
maintainerPATCH 786/798 net: explicitly clear the sk pointer, when pf->create fails
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ignat Korchagin <[email protected]>
commit 631083143315d1b192bd7d915b967b37819e88ea upstream.
We have recently noticed the exact same KASAN splat as in commit 6cd4a78d962b ("net: do not leave a dangling sk pointer, when socket creation fails"). The problem is that commit did not fully address the problem, as some pf->create implementations do not use sk_common_release in their error paths.
For example, we can use the same reproducer as in the above commit, but changing ping to arping. arping uses AF_PACKET socket and if packet_create fails, it will just sk_free the allocated sk object.
While we could chase all the pf->create implementations and make sure they NULL the freed sk object on error from the socket, we can't guarantee future protocols will not make the same mistake.
So it is easier to just explicitly NULL the sk pointer upon return from pf->create in __sock_create. We do know that pf->create always releases the allocated sk object on error, so if the pointer is not NULL, it is definitely dangling.
--- net/socket.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/socket.c +6 -1
@@ -1548,8 +1548,13 @@ int __sock_create(struct net *net, int frcu_read_unlock (); err = pf->create (net, sock, protocol, kern); -if (err <0 ) +if (err <0 ) { +/* ->create should release the allocated sock->sk object on error +* but it may leave the dangling pointer +*/ + sock->sk =NULL ; goto out_module_put; + }/* * Now to bump the refcnt of the [loadable] module that owns this
Greg Kroah-Hartman
maintainerPATCH 787/798 net: Fix an unsafe loop on the list
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anastasia Kovaleva <[email protected]>
commit 1dae9f1187189bc09ff6d25ca97ead711f7e26f9 upstream.
The kernel may crash when deleting a genetlink family if there are still listeners for that family:
Oops: Kernel access of bad area, sig: 11 [#1] ... NIP [c000000000c080bc] netlink_update_socket_mc+0x3c/0xc0 LR [c000000000c0f764] __netlink_clear_multicast_users+0x74/0xc0 Call Trace: __netlink_clear_multicast_users+0x74/0xc0 genl_unregister_family+0xd4/0x2d0
Change the unsafe loop on the list to a safe one, because inside the loop there is an element removal from this list.
--- include/net/sock.h | 2 ++ net/netlink/af_netlink.c | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-)
include/net/sock.h +2 -0
@@ -898,6 +898,8 @@ static inline void sk_add_bind2_node(str hlist_for_each_entry(__sk, list, sk_bind_node)#define sk_for_each_bound_bhash2 (__sk, list) \ hlist_for_each_entry(__sk, list, sk_bind2_node) +#define sk_for_each_bound_safe (__sk, tmp, list) \ + hlist_for_each_entry_safe(__sk, tmp, list, sk_bind_node)/** * sk_for_each_entry_offset_rcu - iterate over a list at a given struct offset
net/netlink/af_netlink.c +2 -1
@@ -2112,8 +2112,9 @@ void __netlink_clear_multicast_users(str {struct sock *sk;struct netlink_table *tbl = &nl_table[ksk->sk_protocol]; +struct hlist_node *tmp; -sk_for_each_bound (sk, &tbl->mc_list) +sk_for_each_bound_safe (sk, tmp, &tbl->mc_list)netlink_update_socket_mc (nlk_sk (sk), group,0 ); }
Greg Kroah-Hartman
maintainerPATCH 788/798 net: dsa: lan9303: ensure chip reset and wait for READY status
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anatolij Gustschin <[email protected]>
commit 5c14e51d2d7df49fe0d4e64a12c58d2542f452ff upstream.
Accessing device registers seems to be not reliable, the chip revision is sometimes detected wrongly (0 instead of expected 1).
Ensure that the chip reset is performed via reset GPIO and then wait for 'Device Ready' status in HW_CFG register before doing any register initializations.
--- drivers/net/dsa/lan9303-core.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+)
drivers/net/dsa/lan9303-core.c +29 -0
@@ -6,6 +6,7 @@#include <linux/module.h> #include <linux/gpio/consumer.h> #include <linux/regmap.h> +#include <linux/iopoll.h> #include <linux/mutex.h> #include <linux/mii.h> #include <linux/phy.h>
@@ -825,6 +826,8 @@ static void lan9303_handle_reset(structif (!chip->reset_gpio)return ; +gpiod_set_value_cansleep (chip->reset_gpio,1 ); +if (chip->reset_duration !=0 )msleep (chip->reset_duration);
@@ -850,8 +853,34 @@ static int lan9303_disable_processing(ststatic int lan9303_check_device (struct lan9303 *chip) {int ret; +int err;u32 reg; +/* In I2C-managed configurations this polling loop will clash with +* switch's reading of EEPROM right after reset and this behaviour is +* not configurable. While lan9303_read() already has quite long retry +* timeout, seems not all cases are being detected as arbitration error. +* +* According to datasheet, EEPROM loader has 30ms timeout (in case of +* missing EEPROM). +* +* Loading of the largest supported EEPROM is expected to take at least +* 5.9s. +*/ + err =read_poll_timeout (lan9303_read, ret, + !ret && reg &LAN9303_HW_CFG_READY , +20000 ,6000000 , false, + chip->regmap,LAN9303_HW_CFG , ®); +if (ret) { +dev_err (chip->dev,"failed to read HW_CFG reg: %pe\n" , +ERR_PTR (ret)); +return ret; + } +if (err) { +dev_err (chip->dev,"HW_CFG not ready: 0x%08x\n" , reg); +return err; + } + ret =lan9303_read (chip->regmap,LAN9303_CHIP_REV , ®);if (ret) { dev_err(chip->dev, "failed to read chip revision register: %d\n",
Greg Kroah-Hartman
maintainerPATCH 789/798 mptcp: handle consistently DSS corruption
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit e32d262c89e2b22cb0640223f953b548617ed8a6 upstream.
Bugged peer implementation can send corrupted DSS options, consistently hitting a few warning in the data path. Use DEBUG_NET assertions, to avoid the splat on some builds and handle consistently the error, dumping related MIBs and performing fallback and/or reset according to the subflow type.
--- net/mptcp/mib.c | 2 ++ net/mptcp/mib.h | 2 ++ net/mptcp/protocol.c | 24 +++++++++++++++++++++--- net/mptcp/subflow.c | 4 +++- 4 files changed, 28 insertions(+), 4 deletions(-)
net/mptcp/mib.c +2 -0
@@ -26,6 +26,8 @@ static const struct snmp_mib mptcp_snmp_SNMP_MIB_ITEM ("MPJoinAckRx" ,MPTCP_MIB_JOINACKRX ),SNMP_MIB_ITEM ("MPJoinAckHMacFailure" ,MPTCP_MIB_JOINACKMAC ),SNMP_MIB_ITEM ("DSSNotMatching" ,MPTCP_MIB_DSSNOMATCH ), +SNMP_MIB_ITEM ("DSSCorruptionFallback" ,MPTCP_MIB_DSSCORRUPTIONFALLBACK ), +SNMP_MIB_ITEM ("DSSCorruptionReset" ,MPTCP_MIB_DSSCORRUPTIONRESET ),SNMP_MIB_ITEM ("InfiniteMapTx" ,MPTCP_MIB_INFINITEMAPTX ),SNMP_MIB_ITEM ("InfiniteMapRx" ,MPTCP_MIB_INFINITEMAPRX ), SNMP_MIB_ITEM("DSSNoMatchTCP", MPTCP_MIB_DSSTCPMISMATCH),
net/mptcp/mib.h +2 -0
@@ -19,6 +19,8 @@ enum linux_mptcp_mib_field {MPTCP_MIB_JOINACKRX ,/* Received an ACK + MP_JOIN */ MPTCP_MIB_JOINACKMAC ,/* HMAC was wrong on ACK + MP_JOIN */ MPTCP_MIB_DSSNOMATCH ,/* Received a new mapping that did not match the previous one */ +MPTCP_MIB_DSSCORRUPTIONFALLBACK ,/* DSS corruption detected, fallback */ +MPTCP_MIB_DSSCORRUPTIONRESET ,/* DSS corruption detected, MPJ subflow reset */ MPTCP_MIB_INFINITEMAPTX ,/* Sent an infinite mapping */ MPTCP_MIB_INFINITEMAPRX ,/* Received an infinite mapping */ MPTCP_MIB_DSSTCPMISMATCH, /* DSS-mapping did not map with TCP's sequence numbers */
net/mptcp/protocol.c +21 -3
@@ -630,6 +630,18 @@ static bool mptcp_check_data_fin(structreturn ret; } +static void mptcp_dss_corruption (struct mptcp_sock *msk,struct sock *ssk) +{ +if (READ_ONCE (msk->allow_infinite_fallback)) { +MPTCP_INC_STATS (sock_net (ssk), +MPTCP_MIB_DSSCORRUPTIONFALLBACK ); +mptcp_do_fallback (ssk); + }else { +MPTCP_INC_STATS (sock_net (ssk),MPTCP_MIB_DSSCORRUPTIONRESET ); +mptcp_subflow_reset (ssk); + } +} +static bool __mptcp_move_skbs_from_subflow (struct mptcp_sock *msk,struct sock *ssk,unsigned int *bytes)
@@ -702,10 +714,16 @@ static bool __mptcp_move_skbs_from_subfl moved += len; seq += len; -if (WARN_ON_ONCE (map_remaining < len)) -break ; +if (unlikely (map_remaining < len)) { +DEBUG_NET_WARN_ON_ONCE (1 ); +mptcp_dss_corruption (msk, ssk); + } }else { -WARN_ON_ONCE (!fin); +if (unlikely (!fin)) { +DEBUG_NET_WARN_ON_ONCE (1 ); +mptcp_dss_corruption (msk, ssk); + } +sk_eat_skb (ssk, skb); done = true; }
net/mptcp/subflow.c +3 -1
@@ -855,8 +855,10 @@ static bool skb_is_fully_mapped(struct sunsigned int skb_consumed; skb_consumed =tcp_sk (ssk)->copied_seq -TCP_SKB_CB (skb)->seq; -if (WARN_ON_ONCE (skb_consumed >= skb->len)) +if (unlikely (skb_consumed >= skb->len)) { +DEBUG_NET_WARN_ON_ONCE (1 );return true; + }return skb->len - skb_consumed <= subflow->map_data_len -mptcp_subflow_get_map_offset (subflow);
Greg Kroah-Hartman
maintainerPATCH 790/798 mptcp: pm: do not remove closing subflows
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit db0a37b7ac27d8ca27d3dc676a16d081c16ec7b9 upstream.
In a previous fix, the in-kernel path-manager has been modified not to retrigger the removal of a subflow if it was already closed, e.g. when the initial subflow is removed, but kept in the subflows list.
To be complete, this fix should also skip the subflows that are in any closing state: mptcp_close_ssk() will initiate the closure, but the switch to the TCP_CLOSE state depends on the other peer.
--- net/mptcp/pm_netlink.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/mptcp/pm_netlink.c +2 -1
@@ -864,7 +864,8 @@ static void mptcp_pm_nl_rm_addr_or_subflint how =RCV_SHUTDOWN |SEND_SHUTDOWN ;u8 id =subflow_get_local_id (subflow); -if (inet_sk_state_load (ssk) ==TCP_CLOSE ) +if ((1 <<inet_sk_state_load (ssk)) & + (TCPF_FIN_WAIT1 |TCPF_FIN_WAIT2 |TCPF_CLOSING |TCPF_CLOSE ))continue ;if (rm_type ==MPTCP_MIB_RMADDR && remote_id != rm_id)continue ;
Greg Kroah-Hartman
maintainerPATCH 791/798 device-dax: correct pgoff align in dax_set_mapping()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kun(llfl) <[email protected]>
commit 7fcbd9785d4c17ea533c42f20a9083a83f301fa6 upstream.
pgoff should be aligned using ALIGN_DOWN() instead of ALIGN(). Otherwise, vmf->address not aligned to fault_size will be aligned to the next alignment, that can result in memory failure getting the wrong address.
It's a subtle situation that only can be observed in page_mapped_in_vma() after the page is page fault handled by dev_dax_huge_fault. Generally, there is little chance to perform page_mapped_in_vma in dev-dax's page unless in specific error injection to the dax device to trigger an MCE - memory-failure. In that case, page_mapped_in_vma() will be triggered to determine which task is accessing the failure address and kill that task in the end.
We used self-developed dax device (which is 2M aligned mapping) , to perform error injection to random address. It turned out that error injected to non-2M-aligned address was causing endless MCE until panic. Because page_mapped_in_vma() kept resulting wrong address and the task accessing the failure address was never killed properly:
[ 3783.719419] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3784.049006] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3784.049190] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3784.448042] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3784.448186] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3784.792026] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3784.792179] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3785.162502] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3785.162633] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3785.461116] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3785.461247] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3785.764730] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3785.764859] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3786.042128] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3786.042259] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3786.464293] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3786.464423] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3786.818090] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3786.818217] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3787.085297] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3787.085424] Memory failure: 0x200c9742: recovery action for dax page:
Recovered
It took us several weeks to pinpoint this problem, but we eventually used bpftrace to trace the page fault and mce address and successfully identified the issue.
Joao added:
; Likely we never reproduce in production because we always pin : device-dax regions in the region align they provide (Qemu does : similarly with prealloc in hugetlb/file backed memory). I think this : bug requires that we touch *unpinned* device-dax regions unaligned to : the device-dax selected alignment (page size i.e. 4K/2M/1G)
--- drivers/dax/device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dax/device.c +1 -1
@@ -86,7 +86,7 @@ static void dax_set_mapping(struct vm_fault *vmf, pfn_t pfn, nr_pages =1 ; pgoff =linear_page_index (vmf->vma, -ALIGN (vmf->address, fault_size)); +ALIGN_DOWN (vmf->address, fault_size));for (i =0 ; i < nr_pages; i++) {struct page *page =pfn_to_page (pfn_t_to_pfn (pfn) + i);
Signature · 1 line
2.47.0
Greg Kroah-Hartman
maintainerPATCH 792/798 nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonatan Maman <[email protected]>
commit 835745a377a4519decd1a36d6b926e369b3033e2 upstream.
The nouveau_dmem_copy_one function ensures that the copy push command is sent to the device firmware but does not track whether it was executed successfully.
In the case of a copy error (e.g., firmware or hardware failure), the copy push command will be sent via the firmware channel, and nouveau_dmem_copy_one will likely report success, leading to the migrate_to_ram function returning a dirty HIGH_USER page to the user.
This can result in a security vulnerability, as a HIGH_USER page that may contain sensitive or corrupted data could be returned to the user.
To prevent this vulnerability, we allocate a zero page. Thus, in case of an error, a non-dirty (zero) page will be returned to the user.
--- drivers/gpu/drm/nouveau/nouveau_dmem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nouveau_dmem.c +1 -1
@@ -194,7 +194,7 @@ static vm_fault_t nouveau_dmem_migrate_tif (!spage || !(src &MIGRATE_PFN_MIGRATE )) goto done; - dpage =alloc_page_vma (GFP_HIGHUSER , vmf->vma, vmf->address); + dpage =alloc_page_vma (GFP_HIGHUSER | __GFP_ZERO, vmf->vma, vmf->address);if (!dpage) goto done;
Greg Kroah-Hartman
maintainerPATCH 793/798 kthread: unpark only parked kthread
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederic Weisbecker <[email protected]>
commit 214e01ad4ed7158cab66498810094fac5d09b218 upstream.
Calling into kthread unparking unconditionally is mostly harmless when the kthread is already unparked. The wake up is then simply ignored because the target is not in TASK_PARKED state.
However if the kthread is per CPU, the wake up is preceded by a call to kthread_bind() which expects the task to be inactive and in TASK_PARKED state, which obviously isn't the case if it is unparked.
As a result, calling kthread_stop() on an unparked per-cpu kthread triggers such a warning:
WARNING: CPU: 0 PID: 11 at kernel/kthread.c:525 __kthread_bind_mask kernel/kthread.c:525 <TASK> kthread_stop+0x17a/0x630 kernel/kthread.c:707 destroy_workqueue+0x136/0xc40 kernel/workqueue.c:5810 wg_destruct+0x1e2/0x2e0 drivers/net/wireguard/device.c:257 netdev_run_todo+0xe1a/0x1000 net/core/dev.c:10693 default_device_exit_batch+0xa14/0xa90 net/core/dev.c:11769 ops_exit_list net/core/net_namespace.c:178 [inline] cleanup_net+0x89d/0xcc0 net/core/net_namespace.c:640 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd70 kernel/workqueue.c:3393 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>
Fix this with skipping unecessary unparking while stopping a kthread.
--- kernel/kthread.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/kthread.c +2 -0
@@ -622,6 +622,8 @@ void kthread_unpark(struct task_struct * {struct kthread *kthread =to_kthread (k); +if (!test_bit (KTHREAD_SHOULD_PARK , &kthread->flags)) +return ;/* * Newly created kthread was parked when the CPU was offline. * The binding was lost and we need to set it again.
Greg Kroah-Hartman
maintainerPATCH 794/798 secretmem: disable memfd_secret() if arch cannot set direct map
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrick Roy <[email protected]>
commit 532b53cebe58f34ce1c0f34d866f5c0e335c53c6 upstream.
Return -ENOSYS from memfd_secret() syscall if !can_set_direct_map(). This is the case for example on some arm64 configurations, where marking 4k PTEs in the direct map not present can only be done if the direct map is set up at 4k granularity in the first place (as ARM's break-before-make semantics do not easily allow breaking apart large/gigantic pages).
More precisely, on arm64 systems with !can_set_direct_map(), set_direct_map_invalid_noflush() is a no-op, however it returns success
(0) instead of an error. This means that memfd_secret will seemingly "work" (e.g. syscall succeeds, you can mmap the fd and fault in pages), but it does not actually achieve its goal of removing its memory from the direct map.
Note that with this patch, memfd_secret() will start erroring on systems where can_set_direct_map() returns false (arm64 with CONFIG_RODATA_FULL_DEFAULT_ENABLED=n, CONFIG_DEBUG_PAGEALLOC=n and CONFIG_KFENCE=n), but that still seems better than the current silent failure. Since CONFIG_RODATA_FULL_DEFAULT_ENABLED defaults to 'y', most arm64 systems actually have a working memfd_secret() and aren't be affected.
Quoted 1 line
From going through the iterations of the original
memfd_secretpatch
series, it seems that disabling the syscall in these scenarios was the intended behavior [1] (preferred over having set_direct_map_invalid_noflush return an error as that would result in SIGBUSes at page-fault time), however the check for it got dropped between v16 [2] and v17 [3], when secretmem moved away from CMA allocations.
[1]: https://lore.kernel.org/lkml/[email protected]/
[2]: https://lore.kernel.org/lkml/[email protected]/#t
[3]: https://lore.kernel.org/lkml/[email protected]/
--- mm/secretmem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
mm/secretmem.c +2 -2
@@ -236,7 +236,7 @@ SYSCALL_DEFINE1(memfd_secret, unsigned i/* make sure local flags do not confict with global fcntl.h */ BUILD_BUG_ON (SECRETMEM_FLAGS_MASK &O_CLOEXEC ); -if (!secretmem_enable) +if (!secretmem_enable || !can_set_direct_map ())return -ENOSYS ;if (flags & ~(SECRETMEM_FLAGS_MASK |O_CLOEXEC ))
@@ -278,7 +278,7 @@ static struct file_system_type secretmemstatic int __init secretmem_init (void ) { -if (!secretmem_enable) +if (!secretmem_enable || !can_set_direct_map ())return 0 ; secretmem_mnt =kern_mount (&secretmem_fs);
Greg Kroah-Hartman
maintainerPATCH 795/798 net: ethernet: cortina: Restore TSO support
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
commit 2942dfab630444d46aaa37fb7d629b620abbf6ba upstream.
An earlier commit deleted the TSO support in the Cortina Gemini driver because the driver was confusing gso_size and MTU, probably because what the Linux kernel calls "gso_size" was called "MTU" in the datasheet.
Restore the functionality properly reading the gso_size from the skbuff.
Tested with iperf3, running a server on a different machine and client on the device with the cortina gemini ethernet:
Connecting to host 192.168.1.2, port 5201 60008000.ethernet-port eth0: segment offloading mss = 05ea len=1c8a 60008000.ethernet-port eth0: segment offloading mss = 05ea len=1c8a 60008000.ethernet-port eth0: segment offloading mss = 05ea len=27da 60008000.ethernet-port eth0: segment offloading mss = 05ea len=0b92 60008000.ethernet-port eth0: segment offloading mss = 05ea len=2bda (...)
(The hardware MSS 0x05ea here includes the ethernet headers.)
If I disable all segment offloading on the receiving host and dump packets using tcpdump -xx like this:
ethtool -K enp2s0 gro off gso off tso off
tcpdump -xx -i enp2s0 host 192.168.1.136
I get segmented packages such as this when running iperf3:
23:16:54.024139 IP OpenWrt.lan.59168 > Fecusia.targus-getdata1:
Flags [.], seq 1486:2934, ack 1, win 4198,
options [nop,nop,TS val 3886192908 ecr 3601341877], length 1448
0x0000: fc34 9701 a0c6 14d6 4da8 3c4f 0800 4500 0x0010: 05dc 16a0 4000 4006 9aa1 c0a8 0188 c0a8 0x0020: 0102 e720 1451 ff25 9822 4c52 29cf 8010 0x0030: 1066 ac8c 0000 0101 080a e7a2 990c d6a8 (...) 0x05c0: 5e49 e109 fe8c 4617 5e18 7a82 7eae d647 0x05d0: e8ee ae64 dc88 c897 3f8a 07a4 3a33 6b1b 0x05e0: 3501 a30f 2758 cc44 4b4a
Several such packets often follow after each other verifying the segmentation into 0x05a8 (1448) byte packages also on the reveiving end. As can be seen, the ethernet frames are 0x05ea (1514) in size.
Performance with iperf3 before this patch: ~15.5 Mbit/s Performance with iperf3 after this patch: ~175 Mbit/s
This was running a 60 second test (twice) the best measurement was 179 Mbit/s.
For comparison if I run iperf3 with UDP I get around 1.05 Mbit/s both before and after this patch.
While this is a gigabit ethernet interface, the CPU is a cheap D-Link DIR-685 router (based on the ARMv5 Faraday FA526 at ~50 MHz), and the software is not supposed to drive traffic, as the device has a DSA chip, so this kind of numbers can be expected.
--- drivers/net/ethernet/cortina/gemini.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-)
drivers/net/ethernet/cortina/gemini.c +19 -4
@@ -79,7 +79,8 @@ MODULE_PARM_DESC(debug, "Debug level (0=#define GMAC0_IRQ4_8 (GMAC0_MIB_INT_BIT | GMAC0_RX_OVERRUN_INT_BIT)#define GMAC_OFFLOAD_FEATURES (NETIF_F_SG | NETIF_F_IP_CSUM | \ - NETIF_F_IPV6_CSUM | NETIF_F_RXCSUM) + NETIF_F_IPV6_CSUM | NETIF_F_RXCSUM | \ + NETIF_F_TSO | NETIF_F_TSO_ECN | NETIF_F_TSO6)/** * struct gmac_queue_page - page buffer per-page info
@@ -1148,13 +1149,25 @@ static int gmac_map_tx_bufs(struct net_dskb_frag_t *skb_frag;dma_addr_t mapping;void *buffer; +u16 mss;int ret; -/* TODO: implement proper TSO using MTU in word3 */ word1 = skb->len; word3 =SOF_BIT ; -if (skb->len >=ETH_FRAME_LEN ) { + mss =skb_shinfo (skb)->gso_size; +if (mss) { +/* This means we are dealing with TCP and skb->len is the +* sum total of all the segments. The TSO will deal with +* chopping this up for us. +*/ +/* The accelerator needs the full frame size here */ + mss +=skb_tcp_all_headers (skb); +netdev_dbg (netdev,"segment offloading mss = %04x len=%04x\n" , + mss, skb->len); + word1 |=TSS_MTU_ENABLE_BIT ; + word3 |= mss; + }else if (skb->len >=ETH_FRAME_LEN ) {/* Hardware offloaded checksumming isn't working on frames * bigger than 1514 bytes. A hypothesis about this is that the * checksum buffer is only 1518 bytes, so when the frames get
@@ -1169,7 +1182,9 @@ static int gmac_map_tx_bufs(struct net_dreturn ret; } word1 |=TSS_BYPASS_BIT ; - }else if (skb->ip_summed ==CHECKSUM_PARTIAL ) { + } + +if (skb->ip_summed ==CHECKSUM_PARTIAL ) {int tcp =0 ;/* We do not switch off the checksumming on non TCP/UDP
Greg Kroah-Hartman
maintainerPATCH 796/798 perf lock: Dont pass an ERR_PTR() directly to perf_session__delete()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
commit abaf1e0355abb050f9c11d2d13a513caec80f7ad upstream.
While debugging a segfault on 'perf lock contention' without an available perf.data file I noticed that it was basically calling:
perf_session__delete(ERR_PTR(-1))
Resulting in:
(gdb) run lock contention
Starting program: /root/bin/perf lock contention
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1". failed to open perf.data: No such file or directory (try 'perf record' first) Initializing perf session failed
Program received signal SIGSEGV, Segmentation fault.
0x00000000005e7515 in auxtrace__free (session=0xffffffffffffffff) at util/auxtrace.c:2858
2858 if (!session->auxtrace)
(gdb) p session
$1 = (struct perf_session *) 0xffffffffffffffff
(gdb) bt
#0 0x00000000005e7515 in auxtrace__free (session=0xffffffffffffffff) at util/auxtrace.c:2858 #1 0x000000000057bb4d in perf_session__delete (session=0xffffffffffffffff) at util/session.c:300 #2 0x000000000047c421 in __cmd_contention (argc=0, argv=0x7fffffffe200) at builtin-lock.c:2161 #3 0x000000000047dc95 in cmd_lock (argc=0, argv=0x7fffffffe200) at builtin-lock.c:2604 #4 0x0000000000501466 in run_builtin (p=0xe597a8 <commands+552>, argc=2, argv=0x7fffffffe200) at perf.c:322 #5 0x00000000005016d5 in handle_internal_command (argc=2, argv=0x7fffffffe200) at perf.c:375 #6 0x0000000000501824 in run_argv (argcp=0x7fffffffe02c, argv=0x7fffffffe020) at perf.c:419 #7 0x0000000000501b11 in main (argc=2, argv=0x7fffffffe200) at perf.c:535
(gdb)
So just set it to NULL after using PTR_ERR(session) to decode the error as perf_session__delete(NULL) is supported.
--- tools/perf/builtin-lock.c | 1 + 1 file changed, 1 insertion(+)
tools/perf/builtin-lock.c +1 -0
@@ -1660,6 +1660,7 @@ static int __cmd_contention(int argc, coif (IS_ERR (session)) {pr_err ("Initializing perf session failed\n" ); err =PTR_ERR (session); + session =NULL ; goto out_delete; }
Greg Kroah-Hartman
maintainerPATCH 797/798 block, bfq: fix uaf for accessing waker_bfqq after splitting
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
commit 1ba0403ac6447f2d63914fb760c44a3b19c44eaf upstream.
After commit 42c306ed7233 ("block, bfq: don't break merge chain in bfq_split_bfqq()"), if the current procress is the last holder of bfqq, the bfqq can be freed after bfq_split_bfqq(). Hence recored the bfqq and then access bfqq->waker_bfqq may trigger UAF. What's more, the waker_bfqq may in the merge chain of bfqq, hence just recored waker_bfqq is still not safe.
Fix the problem by adding a helper bfq_waker_bfqq() to check if bfqq->waker_bfqq is in the merge chain, and current procress is the only holder.
--- block/bfq-iosched.c | 31 ++++++++++++++++++++++++++++--- 1 file changed, 28 insertions(+), 3 deletions(-)
block/bfq-iosched.c +28 -3
@@ -6724,6 +6724,31 @@ static void bfq_prepare_request(struct r rq->elv.priv[0 ] = rq->elv.priv[1 ] =NULL ; } +static struct bfq_queue *bfq_waker_bfqq (struct bfq_queue *bfqq) +{ +struct bfq_queue *new_bfqq = bfqq->new_bfqq; +struct bfq_queue *waker_bfqq = bfqq->waker_bfqq; + +if (!waker_bfqq) +return NULL ; + +while (new_bfqq) { +if (new_bfqq == waker_bfqq) { +/* +* If waker_bfqq is in the merge chain, and current +* is the only procress. +*/ +if (bfqq_process_refs (waker_bfqq) ==1 ) +return NULL ; +break ; + } + + new_bfqq = new_bfqq->new_bfqq; + } + +return waker_bfqq; +} +/* * If needed, init rq, allocate bfq data structures associated with * rq, and increment reference counters in the destination bfq_queue
@@ -6784,7 +6809,7 @@ static struct bfq_queue *bfq_init_rq(str/* If the queue was seeky for too long, break it apart. */ if (bfq_bfqq_coop (bfqq) &&bfq_bfqq_split_coop (bfqq) && !bic->stably_merged) { -struct bfq_queue *old_bfqq = bfqq; +struct bfq_queue *waker_bfqq =bfq_waker_bfqq (bfqq);/* Update bic before losing reference to bfqq */ if (bfq_bfqq_in_large_burst (bfqq))
@@ -6803,7 +6828,7 @@ static struct bfq_queue *bfq_init_rq(str bfqq_already_existing = true;if (!bfqq_already_existing) { - bfqq->waker_bfqq = old_bfqq->waker_bfqq; + bfqq->waker_bfqq = waker_bfqq; bfqq->tentative_waker_bfqq =NULL ;/*
@@ -6813,7 +6838,7 @@ static struct bfq_queue *bfq_init_rq(str* woken_list of the waker. See * bfq_check_waker for details. */ -if (bfqq->waker_bfqq) +if (waker_bfqq)hlist_add_head (&bfqq->woken_list_node, &bfqq->waker_bfqq->woken_list); }